TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: If077b25ad9c08f9f5c896a1b3e1a36417d0feb97
Reviewed-on: https://chromium-review.googlesource.com/663399
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#16}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

Parser creates a FunctionState for default ctors, which affects the
next_function_is_likely_called logic. PreParser needs to match that logic, so
that Parser and PreParser agree about which functions are skippable.

BUG=v8:5515, chromium:773576
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I96cb6f5aa68e74389a863355f70a34693a2d1329
Reviewed-on: https://chromium-review.googlesource.com/712579
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#48511}(cherry picked from commit dd18faf)
Reviewed-on: https://chromium-review.googlesource.com/723519
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#16}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

…e case - Currently WebAsse ...

Revision: 6934db7

BUG=chromium:680938
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2649743002 .
Cr-Commit-Position: refs/branch-heads/5.7@{v8#16}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Merged: AIX: [Memory] Use madvise on POSIX to allow OS to reclaim memory.
Revision: 3c5cb5e

Merged: Fix SmartOS compilation errors
Revision: c8ffe74

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Bug: v8:7191
Bug: v8:7198
Change-Id: Iab37e7fca0fdfdd58dab87c518976903e3b87d09
Reviewed-on: https://chromium-review.googlesource.com/829174
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/branch-heads/6.4@{#16}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9490893636c0c773899db61162c59fa9b3696199
Reviewed-on: https://chromium-review.googlesource.com/894226
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#16}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I59dde4143a091fdd5daa58082a746abe057f6eaf
Reviewed-on: https://chromium-review.googlesource.com/957908
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#16}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

This is to fix an assertion failure in formatToParts when
Chinese calendar is specified with 'u-ca-chinese'.

See tc39/ecma402#225 . This CL
is a temporary work-around to get v8 match the spec in terms
of the external behavior, but it's not taking the steps in
the spec, yet.

Moreover, the spec may have to be revised as to how to pick the best
match pattern when the default calendar for a locale is different from
the calendar specified via 'u-ca'. How to handle 'related year' part
also needs to be specified.

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: chromium:826549
Test: intl/date-format/format-with-extensions
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I1f9a2467e86e71e024bc9babe18f16e49746008e
Reviewed-on: https://chromium-review.googlesource.com/1006915
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#52556}(cherry picked from commit 98c0cd9)
Reviewed-on: https://chromium-review.googlesource.com/1014277
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#16}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

Cr-Commit-Position: refs/branch-heads/6.0@{v8#16}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I5024e003d04e843851d69d2f4d99c2ccd9892031
Reviewed-on: https://chromium-review.googlesource.com/1088752
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#16}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54170}

TBR=mstarzinger@chromium.org,jarin@chromium.org,neis@chromium.org

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54192}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic9a9f12a4285cb4cfce163804a6d3e85d2337b53
Reviewed-on: https://chromium-review.googlesource.com/1155381
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#16}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ibb776078902de6e5fe4597e1ac0f2f8cccc4ef04
Reviewed-on: https://chromium-review.googlesource.com/c/1370009
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#16}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

Improve code generation for stores with write barriers slightly by using the
assembler's dedicated scratch registers (x16 and x17 on Arm64, ip on Arm)
instead of allocating temporaries.

To do this, we've done two things:

  - Use ip as a scratch register when loading page flags.

  - TurboAssembler::CallRecordWriteStub() now takes the offset of the slot
    that's written to rather than its address, removing the need to allocate a
    temporary register for it.

In essence, we've gone from:

```
;; Do the store.
stur x19, [x9, v8#15]
;; Check *destination* object page flags and jump out-of-line.
and x4, x9, #0xfffffffffff80000
ldr x4, [x4, v8#8]
tbnz x4, v8#2, #+0x1e7c
|     ;; Check *source* object page flags.
| `-> and x4, x19, #0xfffffffffff80000
|     ldr x4, [xM, v8#8]
|,--- tbz x4, #1, #-0x1e80
|     ;; Compute address of slot.
|     add x5, x9, #0xf (15)
|     ;; Setup arguments to RecordWrite
|     stp x2, x3, [sp, #-32]!
|     stp x4, lr, [sp, v8#16]
|     stp x0, x1, [sp, #-16]!
|     mov x0, x9 ;; Object address in x9
|     mov x1, x5 ;; Slot address in x5
|     movz x2, #0x0
|     movz x3, #0x100000000
|     ;; Call RecordWrite
|     ldr x16, pc+2056
|     blr x16
```

Which allocates x4 and x5 as temporaries.

To:

```
stur x19, [x9, v8#15]
and x16, x9, #0xfffffffffff80000 ;; Using x16 instead of allocating x4.
ldr x16, [x16, v8#8]
tbnz x16, v8#2, #+0x1e7c
| `-> and x16, x19, #0xfffffffffff80000
|     ldr x16, [xM, v8#8]
|,--- tbz x16, #1, #-0x1e80
|     stp x2, x3, [sp, #-32]!
|     stp x4, lr, [sp, v8#16]
|     stp x0, x1, [sp, #-16]!
|     mov x0, x9            ;; Object address still in x9.
|     add x1, x9, #0xf (15) ;; Compute the slot address directly.
|     movz x2, #0x0
|     movz x3, #0x100000000
|     ldr x16, pc+2056
|     blr x16
```

Finally, `RecordWriteField()` does not need an extra scratch register anymore.

Change-Id: Icb71310e7b8ab1ca83ced250851456166b337d00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1505793
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61153}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I0e7a881faff7ddf8f4ce65f2e91ef0c6357c8655
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1523369
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#16}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

Revision: 6516b1c

BUG=chromium:1051017
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Change-Id: I2c99e469e5ffae0b6f488ff50c0a56a75904a6b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056857
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#16}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

…es' into 'riscv-porting-dev'

Resolve "Separate RISCV32 and RISCV64 into separate directories"

Closes #16

See merge request swlab/swe/v8!115

For 64-bit binary operations, Liftoff on arm made the assumption that
register pairs are always ordered, i.e. the register code for the low
word is lower than the register code for the high word.
Ensuring this was only implemented in {GetUnusedRegister} in
https://crrev.com/c/2168875. Other cases were missing though, e.g.
return values, but also different places were we
construct register pairs internally.

Thus, this CL removes this constraint again and instead handles
unordered register pairs in 64-bit binary operations on arm.

TBR=​thibaudm@chromium.org

(cherry picked from commit b429b8f)

Bug: chromium:1101304
No-Try: true
No-Tree-Checks: true
No-Presubmit: true
Change-Id: Iecca3b4bec04a47c681f30bd0ac7bbe2348cdccb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292243
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#16}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I6e6abb8f25bf4635b2121cbdfe8ae2201c0483b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1821057
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#16}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

Revision: f16a3a7

BUG=chromium:997057
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I2cbdf028a5c4c50728477cc08e583094297deaa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768365
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#16}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I4ad592aa986b0a84825cdcdc8278d2f28e4a9616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871954
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#16}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

Revision: e7ddb89

BUG=chromium:1033407
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=sigurds@chromium.org

Change-Id: I30020b5fb76aebe0aa98cf8b4a134f9088184009
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1980703
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#16}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Bug: chromium:925216
Change-Id: I29d71df0c4c7850a80a86cd0719dea04fcc61816
Reviewed-on: https://chromium-review.googlesource.com/c/1436597
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#59146}(cherry picked from commit 1be577d)
Reviewed-on: https://chromium-review.googlesource.com/c/1456393
Reviewed-by: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#16}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

…tions

Revision: 6c703ff

BUG=chromium:897514
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ishell@chromium.org

Change-Id: I0dbcb1d3f61742321d0e537e7e1fd3e55cd7c817
Reviewed-on: https://chromium-review.googlesource.com/c/1298895
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#16}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

Revision: de6382d

BUG=chromium:972921
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=leszeks@chromium.org

Change-Id: Icc005e20dff08654be6475e163be17cd42a9d6d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669692
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#16}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

…ng it

Revision: be55c16

BUG=chromium:1263462
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=cbruni@chromium.org

Change-Id: I15a74db5bc3d4bf6a3a406200e42e47e8a7c953e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247031
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.6@{v8#16}
Cr-Branched-From: 0b7bda0-refs/heads/9.6.180@{#1}
Cr-Branched-From: 41a5a24-refs/heads/main@{#77244}

(cherry picked from commit b8b9013)

Bug: v8:12743
Change-Id: I4a36c0b794759d47eb9436714dfd2417fc45dcd2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3558327
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#79661}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571893
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.1@{v8#16}
Cr-Branched-From: b003970-refs/heads/10.1.124@{#1}
Cr-Branched-From: e62f556-refs/heads/main@{#79503}

Revision: 8bcc824

BUG=chromium:889460,v8:11619
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=gdeepti@chromium.org

Change-Id: Icc123dd5cd90da63f459dbad433f2e37ca19f853
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2940884
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.2@{v8#16}
Cr-Branched-From: 5123834-refs/heads/9.2.230@{#1}
Cr-Branched-From: 587a04f-refs/heads/master@{#74656}

Offsets in regular expressions are limited to 16 bits.
It was possible to exceed this limit when emitting greedy loops where
the length of text nodes exceeded 16 bits, resulting in overflowing
offsets.
With this CL we throw a SyntaxError "Regular expression too large" to
prevent this overflow.

Merge of CL reviewed at https://crrev.com/c/2629286

Bug: chromium:1166138
Change-Id: Ica624a243bf9827083ff883d9a976f13c8da02e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2642244
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.9@{v8#16}
Cr-Branched-From: 16b9bbb-refs/heads/8.9.255@{#1}
Cr-Branched-From: d16a2a6-refs/heads/master@{#72039}

Previously the LookupIterator ignores private symbols
(including private names) for the access check. This patch
removes these exceptions so that they are always checked.

Drive-by: removes the unused should_throw parameter in
Runtime::DefineObjectOwnProperty()

Bug: chromium:1321899
(cherry picked from commit bb98b38)

Change-Id: I906e30b7e6c741f8d71a02f55fd6e147f74225a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3680300
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.3@{v8#16}
Cr-Branched-From: 1a8f4ca-refs/heads/10.3.174@{#1}
Cr-Branched-From: 8fbefa4-refs/heads/main@{#80471}

... in JSObject::DefineOwnPropertyIgnoreAttributes().
Don't execute interceptor again if it declined to handle the operation.

Bug: chromium:1311641
(cherry picked from commit c4e66b8)

Change-Id: Ie9aef5a98959403f6a26e6bef7f4a77d312bd62a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563560
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.0@{v8#16}
Cr-Branched-From: 6ea73a7-refs/heads/10.0.139@{#1}
Cr-Branched-From: ccc6890-refs/heads/main@{#79131}

Revision: 43cfc62

BUG=v8:12225
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=clemensb@chromium.org

Change-Id: I8798e5eaff61c78e610b472eb9f836cd340bb947
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158324
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/branch-heads/9.5@{v8#16}
Cr-Branched-From: 4a03d61-refs/heads/9.5.172@{#1}
Cr-Branched-From: 9a60704-refs/heads/main@{#76741}

Offsets in regular expressions are limited to 16 bits.
It was possible to exceed this limit when emitting greedy loops where
the length of text nodes exceeded 16 bits, resulting in overflowing
offsets.
With this CL we throw a SyntaxError "Regular expression too large" to
prevent this overflow.

Merge of CL reviewed at https://crrev.com/c/2629286

(cherry picked from commit c9b71fa)

No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Bug: chromium:1166138
Change-Id: Ica624a243bf9827083ff883d9a976f13c8da02e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2642244
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Original-Commit-Position: refs/branch-heads/8.9@{v8#16}
Cr-Original-Branched-From: 16b9bbb-refs/heads/8.9.255@{#1}
Cr-Original-Branched-From: d16a2a6-refs/heads/master@{#72039}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2731531
Commit-Queue: Victor-Gabriel Savu <vsavu@google.com>
Reviewed-by: Jana Grill <janagrill@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.6@{v8#68}
Cr-Branched-From: a64aed2-refs/heads/8.6.395@{#1}
Cr-Branched-From: a626bc0-refs/heads/master@{#69472}

{AtomicSub} on x64 first negates the {value} register, then does an
atomic addition. For that reason, {value} should be a unique register.
So far, we only checked that it's not used in the value stack, but we
should also check for overlap with the destination address or the offset
register.

Drive-by: Remove unneeded handling of non-unique register index on arm,
as that cannot happen (LiftoffCompiler ensures that the result register
is unique).

R=thibaudm@chromium.org

(cherry picked from commit b5003a3)

Bug: chromium:1296876
Change-Id: I7eabf64fbb71494fb013a07eb3f250ed592a2862
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3490936
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.9@{v8#16}
Cr-Branched-From: c4208cc-refs/heads/9.9.115@{#1}
Cr-Branched-From: 19c6fd7-refs/heads/main@{#78682}

(cherry picked from commit dd3289d)

Bug: chromium:1321078
Change-Id: Ic7537cc5101b35018911c27a81e9b0e0a7da154b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3695262
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.2@{v8#16}
Cr-Branched-From: 374091f-refs/heads/10.2.154@{#1}
Cr-Branched-From: f0c353f-refs/heads/main@{#79976}

Change-Id: I07119bb81b5d243e01ed18c4daa0ac9f0081bae8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714985
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/10.4@{v8#16}
Cr-Branched-From: b1413ed-refs/heads/10.4.132@{#1}
Cr-Branched-From: 9d0a093-refs/heads/main@{#80972}

CompleteInobjectSlackTracking potentially shrinks multiple maps, and
the relation between these maps should be preserved in a concurrent
environment. Thus it is not enough to make each modification
atomically, but all related map modifications must be within a
critical section.

We do this by locking the map_updater_access mutex
CompleteInobjectSlackTracking, and hence moving the function to the
MapUpdater class.

(cherry picked from commit 4b8d048)

No-Try: true
No-Presubmit: true
No-Treechecks: true
Bug: chromium:1274445,v8:7990
Change-Id: If99bb8b55e03180128ee397d845fa4c269c4241e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3379819
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#78597}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3406537
Cr-Commit-Position: refs/branch-heads/9.8@{v8#16}
Cr-Branched-From: e218afa-refs/heads/9.8.177@{#1}
Cr-Branched-From: 86ebfc9-refs/heads/main@{#78312}

…yteArrays

(cherry picked from commit b63a596)

Bug: chromium:1228036
Tbr: hpayer@chromium.org
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I79db918b9c0b7ed7d001486738ffcf46902b478d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3067325
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.3@{v8#16}
Cr-Branched-From: 7744dce-refs/heads/9.3.345@{#1}
Cr-Branched-From: 4b6b4ca-refs/heads/master@{#75728}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Icc9c93a33d46fa977a3929f231321f57de41c1e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3293199
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/branch-heads/9.7@{v8#16}
Cr-Branched-From: 49162da-refs/heads/9.7.106@{#1}
Cr-Branched-From: a7e9b8f-refs/heads/main@{#77674}

Preparing for tail call is usually done by emitting the gap moves and
then moving the stack pointer to its new position. An optimization
consists in moving the stack pointer first and transforming some of the
moves into pushes. In the attached case it looks like this (arm):

138  add sp, sp, v8#40
13c  str r6, [sp, #-4]!
140  str r6, [sp, #-4]!
144  str r6, [sp, #-4]!
148  str r6, [sp, #-4]!
14c  str r6, [sp, #-4]!
...
160  vldr d1, [sp - 4*3]

The last line is a gap reload, but because the stack pointer was already
moved, the slot is now below the stack pointer. This is invalid and
triggers this DCHECK:

Fatal error in ../../v8/src/codegen/arm/assembler-arm.cc, line 402
Debug check failed: 0 <= offset (0 vs. -12).

A comment already explains that we skip the optimization if the gap
contains stack moves to prevent this, but the code only checks for
non-FP slots. This is fixed by replacing "source.IsStackSlot()" with
"source.IsAnyStackSlot()":

108  vldr d1, [sp + 4*2]
...
118  str r0, [sp, #+36]
11c  str r0, [sp, #+32]
120  str r0, [sp, #+28]
124  str r0, [sp, #+24]
128  str r0, [sp, #+20]
...
134  add sp, sp, v8#20

TBR=​jgruber@chromium.org
(cherry picked from commit 7506e06)

Change-Id: I34e3a693e3e25c19ae0ab8f7ac48c156a027ae72
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492328
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.7@{v8#16}
Cr-Branched-From: 0d81cd7-refs/heads/8.7.220@{#1}
Cr-Branched-From: 942c2ef-refs/heads/master@{#70196}

After computing the branch offset but before emitting the actual branch,
we should not emit a constant pool. Otherwise the previously computed
offset would be off.

Instead of handling this indirectly via the Assembler::branch_offset
method, do this directly in the Assembler::b method (and friends), so it
is not missed on other call sites.

R=nicohartmann@chromium.org

(cherry picked from commit 9be597d)
Bug: chromium:1399424

Change-Id: Ie7d3ea57bd8527280cc7309f7ff0040d576c5c17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4118865
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/10.9@{v8#16}
Cr-Branched-From: 8ade6bf-refs/heads/10.9.194@{aosp-riscv#1}
Cr-Branched-From: 9ff2515-refs/heads/main@{#84164}

Bug: v8:13647
Change-Id: If06d02880e4e069f004e8829bab38a0cd76d29c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147620
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.0@{v8#16}
Cr-Branched-From: 06097c6-refs/heads/11.0.226@{#1}
Cr-Branched-From: 6bf3344-refs/heads/main@{#84857}

…sts.

Revision: 1bbbc8c

BUG=chromium:747995
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=clemensh@chromium.org

Change-Id: I944029ee9498cb970ea8bf21d00b433b24abbc9d
Reviewed-on: https://chromium-review.googlesource.com/585533
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.1@{v8#16}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

Revision: 8584442

BUG=chromium:656037
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/2433863002 .

Cr-Commit-Position: refs/branch-heads/5.5@{v8#16}
Cr-Branched-From: 3cbd583-refs/heads/5.5.372@{#1}
Cr-Branched-From: b3c8b0c-refs/heads/master@{#40015}

Change-Id: I37e6460e29c3bc81106c5b31a1a82f61f0b33410
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4323894
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/11.2@{v8#16}
Cr-Branched-From: 755511a-refs/heads/11.2.214@{#1}
Cr-Branched-From: e6b1cce-refs/heads/main@{#86014}

Cr-Commit-Position: refs/branch-heads/5.4@{v8#16}
Cr-Branched-From: 5ce2827-refs/heads/5.4.500@{v8#2}
Cr-Branched-From: ad07b49-refs/heads/master@{#38841}

Cr-Commit-Position: refs/branch-heads/5.6@{v8#16}
Cr-Branched-From: bdd3886-refs/heads/5.6.326@{#1}
Cr-Branched-From: 879f659-refs/heads/master@{#41014}

…eNamedIC

The CheckIfCanDefine() used to check the attributes of the object
as well as reporting to access check failure callbacks can update
the lookup iterator, resulting in wrong store handlers being
installed. Restart the lookup iterator in this case to make
sure that slow handlers are installed.

Bug: chromium:1415249
(cherry picked from commit da2df21)

Change-Id: I9478b6de16968816ea9d254dec730c8deafac3fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4275661
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.1@{v8#16}
Cr-Branched-From: c77793a-refs/heads/11.1.277@{#1}
Cr-Branched-From: 95b79bf-refs/heads/main@{#85479}

The cloberring only happens if:
- we have more than one map
- object is not alived after CheckMapsWithMigration
- we failed the migration of the first map
- we don't have a deopting node emitted after CheckMapsWithMigration

Arm64 had already fixed this issue: there {object_map} is kept in
a temporary and added to the register snapshot.

Fixed: chromium:1442262
Bug: v8:7700
(cherry picked from commit 5462da2)

Change-Id: I2069baa1bacb4c584c6a0d72bc0588bc86f0fa7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4542821
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.4@{v8#16}
Cr-Branched-From: 8a8a1e7-refs/heads/11.4.183@{#1}
Cr-Branched-From: 5483d8e-refs/heads/main@{#87241}

Cr-Commit-Position: refs/branch-heads/5.9@{v8#16}
Cr-Branched-From: fe9bb7e-refs/heads/5.9.211@{#1}
Cr-Branched-From: 70ad237-refs/heads/master@{#44591}

Cr-Commit-Position: refs/branch-heads/5.8@{v8#16}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

This is a reland of commit 91fce33

Changes since revert:
- Skip added test in no-internalization builds.

Original change's description:
> [regexp] Handle empty ranges in unicode sets
>
> If a unicode set operation contains only an empty range, we generated a
> set expression without operands. However the expression should match
> nothing, so add the special operand not matching anything instead.
>
> Bug: chromium:1437346
> Change-Id: I8dd58884aaf6915277c80effbda43ea715049146
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4474547
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#87257}

Bug: chromium:1437346
(cherry picked from commit cb8697b)

Change-Id: Idea77d44a55bc42d065ff0cc985b8f5eb9f32ddf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4489304
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.3@{v8#16}
Cr-Branched-From: b0a3a06-refs/heads/11.3.244@{#1}
Cr-Branched-From: 0326cf6-refs/heads/main@{#86647}

Merged: [interpreter] Don't number non-lexicals in TDZ elision
Revision: 260b62d

Merged: [interpreter] Refine hole check numbering for initialization
Revision: f72cbd5

Merged: [interpreter] Use |= in Variable::ForceHoleInitialization
Revision: dc628cc

Bug: chromium:1448545,chromium:1450771,v8:13723
Change-Id: Ie08b443061b48545bb65b3acbe4044fe604aaae8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4610688
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#16}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

This commit cherry-picks small parts of:
crrev.com/c/4669597
crrev.com/c/4675296
crrev.com/c/4677170
that are suitable for backmerging.

Bug: chromium:1462951
Change-Id: I4b93518b896119768834272ab7642afa4cfabaaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4677662
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#16}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

Instead of doing a lookahead over bytecodes to decide whether a
test/compare should be fused with an upcoming branch, do a value
introspection when emitting a branch to see if the value is a test node,
and emit the equivalent branch node, relying on dead-code elimination to
remove unused tests.

This allows us to remove a bunch of complexity around the lookahead,
especially with figuring out whether the value is actually
materialised.

Bug: v8:7700
(cherry picked from commit a9a42ea)

Change-Id: Idd249543ef8003983f417b46462265b2bd5cd3ca
Bug: v8:14283
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4816367
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#16}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}