TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: If077b25ad9c08f9f5c896a1b3e1a36417d0feb97
Reviewed-on: https://chromium-review.googlesource.com/663399
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.2@{#16}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

Parser creates a FunctionState for default ctors, which affects the
next_function_is_likely_called logic. PreParser needs to match that logic, so
that Parser and PreParser agree about which functions are skippable.

BUG=v8:5515, chromium:773576
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I96cb6f5aa68e74389a863355f70a34693a2d1329
Reviewed-on: https://chromium-review.googlesource.com/712579
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#48511}(cherry picked from commit dd18faf)
Reviewed-on: https://chromium-review.googlesource.com/723519
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.3@{#16}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

…e case - Currently WebAsse ...

Revision: 6934db7

BUG=chromium:680938
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2649743002 .
Cr-Commit-Position: refs/branch-heads/5.7@{v8#16}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Merged: AIX: [Memory] Use madvise on POSIX to allow OS to reclaim memory.
Revision: 3c5cb5e

Merged: Fix SmartOS compilation errors
Revision: c8ffe74

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Bug: v8:7191
Bug: v8:7198
Change-Id: Iab37e7fca0fdfdd58dab87c518976903e3b87d09
Reviewed-on: https://chromium-review.googlesource.com/829174
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/branch-heads/6.4@{#16}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

TBR=machenbach@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9490893636c0c773899db61162c59fa9b3696199
Reviewed-on: https://chromium-review.googlesource.com/894226
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.5@{#16}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I59dde4143a091fdd5daa58082a746abe057f6eaf
Reviewed-on: https://chromium-review.googlesource.com/957908
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.6@{#16}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

This is to fix an assertion failure in formatToParts when
Chinese calendar is specified with 'u-ca-chinese'.

See tc39/ecma402#225 . This CL
is a temporary work-around to get v8 match the spec in terms
of the external behavior, but it's not taking the steps in
the spec, yet.

Moreover, the spec may have to be revised as to how to pick the best
match pattern when the default calendar for a locale is different from
the calendar specified via 'u-ca'. How to handle 'related year' part
also needs to be specified.

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Bug: chromium:826549
Test: intl/date-format/format-with-extensions
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I1f9a2467e86e71e024bc9babe18f16e49746008e
Reviewed-on: https://chromium-review.googlesource.com/1006915
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#52556}(cherry picked from commit 98c0cd9)
Reviewed-on: https://chromium-review.googlesource.com/1014277
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.7@{#16}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

Cr-Commit-Position: refs/branch-heads/6.0@{v8#16}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I5024e003d04e843851d69d2f4d99c2ccd9892031
Reviewed-on: https://chromium-review.googlesource.com/1088752
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/branch-heads/6.8@{#16}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54170}

TBR=mstarzinger@chromium.org,jarin@chromium.org,neis@chromium.org

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54192}

TBR=machenbach@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic9a9f12a4285cb4cfce163804a6d3e85d2337b53
Reviewed-on: https://chromium-review.googlesource.com/1155381
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#16}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57757}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Ibb776078902de6e5fe4597e1ac0f2f8cccc4ef04
Reviewed-on: https://chromium-review.googlesource.com/c/1370009
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#16}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

Improve code generation for stores with write barriers slightly by using the
assembler's dedicated scratch registers (x16 and x17 on Arm64, ip on Arm)
instead of allocating temporaries.

To do this, we've done two things:

  - Use ip as a scratch register when loading page flags.

  - TurboAssembler::CallRecordWriteStub() now takes the offset of the slot
    that's written to rather than its address, removing the need to allocate a
    temporary register for it.

In essence, we've gone from:

```
;; Do the store.
stur x19, [x9, v8#15]
;; Check *destination* object page flags and jump out-of-line.
and x4, x9, #0xfffffffffff80000
ldr x4, [x4, v8#8]
tbnz x4, v8#2, #+0x1e7c
|     ;; Check *source* object page flags.
| `-> and x4, x19, #0xfffffffffff80000
|     ldr x4, [xM, v8#8]
|,--- tbz x4, #1, #-0x1e80
|     ;; Compute address of slot.
|     add x5, x9, #0xf (15)
|     ;; Setup arguments to RecordWrite
|     stp x2, x3, [sp, #-32]!
|     stp x4, lr, [sp, v8#16]
|     stp x0, x1, [sp, #-16]!
|     mov x0, x9 ;; Object address in x9
|     mov x1, x5 ;; Slot address in x5
|     movz x2, #0x0
|     movz x3, #0x100000000
|     ;; Call RecordWrite
|     ldr x16, pc+2056
|     blr x16
```

Which allocates x4 and x5 as temporaries.

To:

```
stur x19, [x9, v8#15]
and x16, x9, #0xfffffffffff80000 ;; Using x16 instead of allocating x4.
ldr x16, [x16, v8#8]
tbnz x16, v8#2, #+0x1e7c
| `-> and x16, x19, #0xfffffffffff80000
|     ldr x16, [xM, v8#8]
|,--- tbz x16, #1, #-0x1e80
|     stp x2, x3, [sp, #-32]!
|     stp x4, lr, [sp, v8#16]
|     stp x0, x1, [sp, #-16]!
|     mov x0, x9            ;; Object address still in x9.
|     add x1, x9, #0xf (15) ;; Compute the slot address directly.
|     movz x2, #0x0
|     movz x3, #0x100000000
|     ldr x16, pc+2056
|     blr x16
```

Finally, `RecordWriteField()` does not need an extra scratch register anymore.

Change-Id: Icb71310e7b8ab1ca83ced250851456166b337d00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1505793
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61153}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I0e7a881faff7ddf8f4ce65f2e91ef0c6357c8655
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1523369
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#16}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

Revision: 6516b1c

BUG=chromium:1051017
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=hablich@chromium.org

Change-Id: I2c99e469e5ffae0b6f488ff50c0a56a75904a6b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056857
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#16}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

…es' into 'riscv-porting-dev'

Resolve "Separate RISCV32 and RISCV64 into separate directories"

Closes #16

See merge request swlab/swe/v8!115

For 64-bit binary operations, Liftoff on arm made the assumption that
register pairs are always ordered, i.e. the register code for the low
word is lower than the register code for the high word.
Ensuring this was only implemented in {GetUnusedRegister} in
https://crrev.com/c/2168875. Other cases were missing though, e.g.
return values, but also different places were we
construct register pairs internally.

Thus, this CL removes this constraint again and instead handles
unordered register pairs in 64-bit binary operations on arm.

TBR=​thibaudm@chromium.org

(cherry picked from commit b429b8f)

Bug: chromium:1101304
No-Try: true
No-Tree-Checks: true
No-Presubmit: true
Change-Id: Iecca3b4bec04a47c681f30bd0ac7bbe2348cdccb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292243
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#16}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I6e6abb8f25bf4635b2121cbdfe8ae2201c0483b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1821057
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#16}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

Revision: f16a3a7

BUG=chromium:997057
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=hablich@chromium.org

Change-Id: I2cbdf028a5c4c50728477cc08e583094297deaa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768365
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#16}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I4ad592aa986b0a84825cdcdc8278d2f28e4a9616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871954
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#16}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

Revision: e7ddb89

BUG=chromium:1033407
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
TBR=sigurds@chromium.org

Change-Id: I30020b5fb76aebe0aa98cf8b4a134f9088184009
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1980703
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#16}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Bug: chromium:925216
Change-Id: I29d71df0c4c7850a80a86cd0719dea04fcc61816
Reviewed-on: https://chromium-review.googlesource.com/c/1436597
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#59146}(cherry picked from commit 1be577d)
Reviewed-on: https://chromium-review.googlesource.com/c/1456393
Reviewed-by: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#16}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

…tions

Revision: 6c703ff

BUG=chromium:897514
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=ishell@chromium.org

Change-Id: I0dbcb1d3f61742321d0e537e7e1fd3e55cd7c817
Reviewed-on: https://chromium-review.googlesource.com/c/1298895
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#16}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

Revision: de6382d

BUG=chromium:972921
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=leszeks@chromium.org

Change-Id: Icc005e20dff08654be6475e163be17cd42a9d6d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669692
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/7.6@{v8#16}
Cr-Branched-From: 2cb2573-refs/heads/7.6.303@{#1}
Cr-Branched-From: 201c509-refs/heads/master@{#61902}

Merged: [interpreter] Don't number non-lexicals in TDZ elision
Revision: 260b62d

Merged: [interpreter] Refine hole check numbering for initialization
Revision: f72cbd5

Merged: [interpreter] Use |= in Variable::ForceHoleInitialization
Revision: dc628cc

Bug: chromium:1448545,chromium:1450771,v8:13723
Change-Id: Ie08b443061b48545bb65b3acbe4044fe604aaae8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4610688
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.5@{v8#16}
Cr-Branched-From: 0c4044b-refs/heads/11.5.150@{#1}
Cr-Branched-From: b71d303-refs/heads/main@{#87781}

This commit cherry-picks small parts of:
crrev.com/c/4669597
crrev.com/c/4675296
crrev.com/c/4677170
that are suitable for backmerging.

Bug: chromium:1462951
Change-Id: I4b93518b896119768834272ab7642afa4cfabaaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4677662
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#16}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

Instead of doing a lookahead over bytecodes to decide whether a
test/compare should be fused with an upcoming branch, do a value
introspection when emitting a branch to see if the value is a test node,
and emit the equivalent branch node, relying on dead-code elimination to
remove unused tests.

This allows us to remove a bunch of complexity around the lookahead,
especially with figuring out whether the value is actually
materialised.

Bug: v8:7700
(cherry picked from commit a9a42ea)

Change-Id: Idd249543ef8003983f417b46462265b2bd5cd3ca
Bug: v8:14283
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4816367
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#16}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

Maglev is holding strong references of objects in InstructionStream
while TurboFan is managing them as weak objects with
`RegisterWeakObjectsInOptimizedCode` function. Thus, the objects
referenced by Maglev code is not freed until the code is freed.

This CL updates Maglev to run the same function as TurboFan in the
finalize step.

Bug: chromium:1485367

(cherry picked from commit b076402)

Change-Id: I47bd1de05e9014f277fd43bf58e184553f4966c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4892378
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Choongwoo Han <choongwoo.han@microsoft.com>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#16}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

…input

All inputs into struct.get should have been typed either during graph
building or from the wasm-typer.cc.
All untyped input should only be the jsgraph()->Dead() node.
There are a few crashes in the wild with struct.get and an input node
typed "None".

(cherry picked from commit 66b4d8d)

Bug: chromium:1507106
Change-Id: Iea440080b86a586cc1fb1c5e235ccbceb87adf11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5103508
Commit-Queue: Eva Herencsárová <evih@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Eva Herencsárová <evih@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#16}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

…all_ref

This patch addresses two distinct but related issues:
(1) For the custom control flow we set up for inlining call_ref calls,
    the InstanceCache system must properly track this control flow
    (simulating what a SnapshotTable would do).
(2) When catching exceptions, we must reload the memory size at the
    beginning of the catch block. And similar to (1), the InstanceCache
    must properly track the control flow between regular return block,
    catch block, and their merge.

Original review at crrev.com/c/5095095
This merges patch set 1 of that gerrit issue, which was created
before an unrelated refactoring happened on the main branch.

Bug: chromium:1507751
Change-Id: Ic8e5734d44d3fbb0b6ef49a2353e467fd896ea29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5110200
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#16}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

Revision: 06a64da

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=mfarazma@redhat.com

Bug: v8:14598
Change-Id: I4ae32f9a312deb7cd2a659752db7d04daefdee15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5245726
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.2@{v8#16}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

...instead of the concept of "implicit internalization".

(cherry picked from commit cfe1ccc)

Change-Id: I3bc8ac7e3204a3ba4f71af526f433829d12bb920
Fixed: 326091470
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5339903
Reviewed-by: Eva Herencsárová <evih@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.3@{#16}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

Bug: v8:12783, 331241020
(cherry picked from commit fab3ba3)

Change-Id: Ia5e317d3b383761baf58394d30cda6ba918b5cec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5423128
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.4@{#16}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

Bug: 338908243
(cherry picked from commit cc05792)

Change-Id: I698ac073ca2c05ec2174058a9601acd7b5e9a61c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5545378
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.5@{#16}
Cr-Branched-From: 15b9756-refs/heads/12.5.227@{#1}
Cr-Branched-From: 497d857-refs/heads/main@{#93350}

... stack overflow

Bug: v8:7700, 339759428
(cherry picked from commit f2c5458)

Change-Id: Ie1aa873d23d0f8c4cdb98a1d5f17dec7216e3ead
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5596527
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Owners-Override: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.6@{#16}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

This is a reland of https://crrev.com/c/5630530.

The reland disables the new unit tests when the single_generation
variant is used, since SimulateNewspaceFull needs to young
generation.

Original CL description:
> [turboshaft] Lower LoadStackArgument to a Tagged load
>
> If we start with a graph that looks like
>
> ```
> x = LoadStackArgument(a, 40)
> ...
> Allocate()
> ...
> y = LoadStackArgument(a, 40)
> ```
>
> This used to be lowered to
>
> ```
> x1 = Load<WordPtr>(a, 40)
> x2 = TaggedBitcast(x1, WordPtr->Tagged)
> ...
> Allocate()
> ...
> y1 = Load<WordPtr>(a, 40)
> y2 = TaggedBitcast(y1, WordPtr->Tagged)
> ```
>
> And then, Load Elimination would remove the second Load, and we'd get:
>
> ```
> x1 = Load<WordPtr>(a, 40)
> x2 = TaggedBitcast(x1, WordPtr->Tagged)
> ...
> Allocate()
> ...
> y2 = TaggedBitcast(x1, WordPtr->Tagged)
> ```
>
> And now we would be in trouble: if the allocation in the middle
> triggers a GC, then `x1` could move, and thus `y2` could refer to a
> stale pointer. In theory, Turbofan knows where tagged values are, and
> can thus update them when the GC moves things, but here, `x1` is not
> marked as Tagged (but rather as a raw WordPtr).
>
> This CL fixes this issue by doing a Tagged load from the start, since
> the value we're loading is clearly tagged.
>
> Fixed: chromium:347724915
> Change-Id: Ia659155fbc602907ab9a50fb992c79df6ccdaa44
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5630530
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#94527}

Bug: chromium:347724915
(cherry picked from commit 96493c7)

Change-Id: I2448728ac75b026f396af51b7caa3bdbc17b09c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5644921
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.7@{#16}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

Merged: [loong64][mips64][wasm] Introducing F16 SIMD lane instructions
Revision: b011be7

Merged: [loong64][mips64][wasm] Add support for I16 load/store on liftoff
Revision: 4e2fbf1

Merged: [loong64][turboshaft] Properly handle UncompressedTagged representations in ISel
Revision: 2699cdb

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
R=vahl@chromium.org

Bug: 357648050
Change-Id: Ic2c7203d40d206d220cab3155525935b1f065ba9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5759670
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/branch-heads/12.8@{#16}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

…ments

When the generic js-to-wasm wrapper converts tagged parameters, it has
to store the converted parameters somewhere to protect them from
potential GCs. The existing implementation stored the converted
parameters in the incoming arguments array. However, the incoming
arguments array is observable from JavaScript through
Function.prototype.arguments, which means that writing converted
parameters (i.e. WebAssembly references) into the arguments array means
that WebAssembly objects leak into JavaScript.

With this CL the converted parameters are not written into the arguments
array anymore, but instead a FixedArray is allocated to store converted
parameters.

R=thibaudm@chromium.org

Bug: 359949835

(cherry picked from commit aa2cbd9)

Change-Id: I3493954ef20dc2c03b38d3e47aaf7b0bc61962c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5830783
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/branch-heads/12.9@{#16}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}

UpdateSourceAndBytecodePosition already advances the
SourcePositionIterator, which means the existing code was advancing it
twice on each step. This code was also passing in the code offset to
make sure that the iterator advances, because the helper would check
whether the given offset matches the current code offset.

Instead, inline the current_source_position_ setting from the
UpdateSourceAndBytecodePosition helper, and do the advancement manually.
Also, make sure to advance _after_ setting the source position, to avoid
reading off the end of the iterator.

Fixed: 366350753
(cherry picked from commit e0ad8d5)

Change-Id: Ieb75afa417fbb6d6dee02b4762639e89a9afe9df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5886311
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.0@{#16}
Cr-Branched-From: 4be854b-refs/heads/13.0.245@{#1}
Cr-Branched-From: 1f5183f-refs/heads/main@{#96103}

Handle stack switching for a missing frame type, WASM_TO_JS_FUNCTION.

R=jkummerow@chromium.org

Fixed: 377384894
(cherry picked from commit ef6ed15)

Change-Id: I01ccd63b2ae4735eb1c68cda48710556c93bfa78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6023136
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.1@{#16}
Cr-Branched-From: 7998da6-refs/heads/13.1.201@{#1}
Cr-Branched-From: 5e9af2a-refs/heads/main@{#96554}

Maglev uses scope infos to detect if two contexts may alias. This is
only correct if we are guaranteed to have unique scope infos. This in
turn relies on the machinery behind `v8_flags.reuse_scope_infos`.

Bug: 379758212
(cherry picked from commit 30de523)

Change-Id: I399b63f9eed85d819bd0b98b3a5d8f16d1c9c4be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6038623
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.2@{#16}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

A part of this commit is simply running the code through clang-format,
which was not done before. However, the intended functional change here
is to correctly calculate the size which we need to shift a scaled
immediate by. Since in the current version of V8, LDR_c and LDRB_w
conflict in terms of their representations, we can't just use the opcode
to determine the shift size, and instead need to know if it's a
capability or not.

This issue would manifest itself in a fairly unfortunate way, e.g. if
the correct instruction was
  ldrb w5, [c4, v8#16]
it would generate instead
  ldrb w5, [c4, #1]
and we would now be working with the wrong value in w5, usually crashing
far down the line with a CSA_DCHECK (usually because an array index was
out of bounds, but it was causing other issues too).

This whole backend will at some point need to be reworked (or perhaps
scrapped in favour of a new version of CHERI for arm64 at some point in
the future).

Bug: 385155406
(cherry picked from commit d357708)

Change-Id: I885419cccbbff103afdfee51fb7220aad863e90f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6179420
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.3@{#16}
Cr-Branched-From: 41dacff-refs/heads/13.3.415@{#1}
Cr-Branched-From: 3348638-refs/heads/main@{#97937}

by remembering the CPU's configuration at the time of module
instantiation.

Bug: 382005099
(cherry picked from commit 6d15c06)

Change-Id: I329d24465e370e9d8f4ae07f137dc6a1e12547cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6253083
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.4@{#16}
Cr-Branched-From: 0f87a54-refs/heads/13.4.114@{#1}
Cr-Branched-From: 27af2e9-refs/heads/main@{#98459}

Bug: 388844115, 402646504
(cherry picked from commit dd4c05c)

Change-Id: Ib60fa740616c0b349ccc09a0ac0a46bbdc5a19ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6368521
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.5@{#16}
Cr-Branched-From: c206c46-refs/heads/13.5.212@{#1}
Cr-Branched-From: af3cadc-refs/heads/main@{#99020}

Bug: 414516598
(cherry picked from commit a6f67c2)

Change-Id: I184c0cafde0868a7131c8708a47aafa424ff5469
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6516173
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.6@{#16}
Cr-Branched-From: 04fa9cb-refs/heads/13.6.233@{#1}
Cr-Branched-From: f6be482-refs/heads/main@{#99571}

Original change's description:
> [infra] Add an infra-owned whitespace file
> 
> This file is not known to rubber stamper and owned by the infra
> team only. We'll use it to test the auto cherry picker.
> 
> Bug: 414375475
> No-Try: true
> Change-Id: Ic670ce34dc365fe5a6a2881609a56211bbd3404f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6547016
> Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#100273}

Bug: 417903965,414375475
Change-Id: Ic670ce34dc365fe5a6a2881609a56211bbd3404f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6551885
Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.7@{#16}
Cr-Branched-From: dd5370d-refs/heads/13.7.152@{#1}
Cr-Branched-From: fa9b753-refs/heads/main@{#99927}

Bug: 414724525
Change-Id: Ib6e1c89f5e2d4e718e04dc34edf2f871e24e8590
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6607410
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/13.8@{#16}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

Bug: 424617297
(cherry picked from commit ddee520)

Change-Id: Icd10a594e807f6a5e247a138a4a96a1984be023b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6711555
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/branch-heads/13.9@{#16}
Cr-Branched-From: 76ea409-refs/heads/13.9.205@{#1}
Cr-Branched-From: 2824212-refs/heads/main@{#100941}

Fixed: 443765373
(cherry picked from commit a5f18bb)

Change-Id: Icb252c17beb5dfb98039d9ebbdf5bedc3ca0fe0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6969005
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/branch-heads/14.0@{#16}
Cr-Branched-From: 4ec2f43-refs/heads/14.0.365@{#1}
Cr-Branched-From: a88b570-refs/heads/main@{#101731}

Version incremented at https://cr-buildbucket.appspot.com/build/8703279509973770017

Change-Id: Ic3475ca112b14bbab3aa0971227f167f8d9ca459
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6965372
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.1@{#16}
Cr-Branched-From: 1f4839b-refs/heads/14.1.146@{#1}
Cr-Branched-From: cd6944c-refs/heads/main@{#102149}

Version incremented at https://cr-buildbucket.appspot.com/build/8700752988806380801

Change-Id: Ib2095d55a4081fa1b0e442d156ba03c19a4a5cc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7054746
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.2@{#16}
Cr-Branched-From: 37f82db-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089-refs/heads/main@{#102804}

Original change's description:
> [wasm] Set wire bytes before finishing a module
> 
> https://crrev.com/c/7096821 moved the `DecrementAndCheckFinisherCount`
> before setting the wire bytes. If another thread then decrements the
> finisher count *before* the first thread sets the wire bytes, we will
> try to add a module to the cache which has no wire bytes set, resulting
> in various DCHECK errors.
> 
> R=jkummerow@chromium.org
> 
> Bug: 456440561
> Change-Id: I53c977e75c1ad195b360e6bf6a49b355bfc155b3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7105522
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#103443}

(cherry picked from commit 1868e5f)

Bug: 459383032,456440561
Change-Id: I53c977e75c1ad195b360e6bf6a49b355bfc155b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7138544
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.3@{#16}
Cr-Branched-From: 13c7e31-refs/heads/14.3.127@{#1}
Cr-Branched-From: 01af089-refs/heads/main@{#103352}

It is required for chromium builds.

(cherry picked from commit 8d5aed8)

Change-Id: Id66a225a3345a0d81286b870a5acf30c539aaded
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7232592
Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Original-Commit-Position: refs/heads/main@{#104161}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7247890
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/branch-heads/14.4@{#16}
Cr-Branched-From: 80acc26-refs/heads/14.4.258@{#1}
Cr-Branched-From: ce7e597-refs/heads/main@{#104020}