…s://codereview.chromium.org/2847923003/ )

Reason for revert:
Linux-nosnap failures:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/13282

Original issue's description:
> [csa] Add assertions to CSA
>
> This adds a bunch of assertions to CSA, mostly about documenting and checking
> parameter types.
>
> Drive-by-change: Removed unused function.
>
> BUG=v8:6325
>
> Review-Url: https://codereview.chromium.org/2847923003
> Cr-Original-Commit-Position: refs/heads/master@{#45398}
> Committed: https://chromium.googlesource.com/v8/v8/+/b14a981496ad1f841683479d2f9188dfa2d6b4bd
> Review-Url: https://codereview.chromium.org/2847923003
> Cr-Commit-Position: refs/heads/master@{#45443}
> Committed: https://chromium.googlesource.com/v8/v8/+/62b0de1ef53816d6dae3fa519a846f942b701dda

[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6325

Review-Url: https://codereview.chromium.org/2893253002
Cr-Commit-Position: refs/heads/master@{#45445}

Cr-Commit-Position: refs/branch-heads/5.8@{v8#14}
Cr-Branched-From: eda659c-refs/heads/5.8.283@{#1}
Cr-Branched-From: 4310cd0-refs/heads/master@{#43429}

…ring to LAP. (patchset v8#14 id:540001 of https://codereview.chromium.org/2770003002/ )

Reason for revert:
Speculative: Seems to break webkit_unit_tests:
https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/23247
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/11038

Original issue's description:
> Set the current context to the function's context when entering to LAP.
>
> In case of LAP(lazy accessor pair), the function's creation context
> must be equal to the accessor holder's creation context, so this CL
> changes the current context to the accessor holder's creation context.
>
> BUG=v8:6156
>
> Review-Url: https://codereview.chromium.org/2770003002
> Cr-Commit-Position: refs/heads/master@{#46406}
> Committed: https://chromium.googlesource.com/v8/v8/+/18e73287dc65452bc2f952fc005b2251fc32c15a

[email protected],[email protected],[email protected],[email protected],[email protected]
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6156

Review-Url: https://codereview.chromium.org/2973593002
Cr-Commit-Position: refs/heads/master@{#46408}

Revision: d8e1477

Partially cherry-picked 2bce488 for last_index
accessor.

BUG=chromium:747825,v8:6556,v8:6605
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I1e8192a24700fe1468ae6c5d75510c01d19112a8
Reviewed-on: https://chromium-review.googlesource.com/584845
Reviewed-by: Jakob Gruber <[email protected]>
Commit-Queue: Jakob Gruber <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.1@{#14}
Cr-Branched-From: 1bf2e10-refs/heads/6.1.534@{#1}
Cr-Branched-From: e825c43-refs/heads/master@{#46746}

[email protected]

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic57b5e89499d59d608535dab7b1c44be2e3a90b0
Reviewed-on: https://chromium-review.googlesource.com/661079
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.2@{#14}
Cr-Branched-From: efa2ac4-refs/heads/6.2.414@{#1}
Cr-Branched-From: a861ebb-refs/heads/master@{#47693}

Merged: [ic] Do access checks when storing via JSGlobalProxy.
Revision: 5ea95fe

Merged: [ic] Fix storing to JSGlobalProxy having JSProxy in prototype chain.
Revision: b19a1ba

BUG=chromium:764219
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: Icc7dde6ba3faae1aee29c4f3ac1aaa27d94f3124
Reviewed-on: https://chromium-review.googlesource.com/721443
Reviewed-by: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.3@{#14}
Cr-Branched-From: 094a7c9-refs/heads/6.3.292@{#1}
Cr-Branched-From: 18b8fbb-refs/heads/master@{#48432}

Revision: 80c9b69

BUG=680637
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Review-Url: https://codereview.chromium.org/2641183002
Cr-Commit-Position: refs/branch-heads/5.7@{v8#14}
Cr-Branched-From: 975e9a3-refs/heads/5.7.492@{#1}
Cr-Branched-From: 8d76f0e-refs/heads/master@{#42426}

Revision: 9a6f442

BUG=chromium:787301
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I58698edad5431b87f15614afec8e133f2bc1f7d4
Reviewed-on: https://chromium-review.googlesource.com/828993
Reviewed-by: Benedikt Meurer <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.4@{#14}
Cr-Branched-From: 0407506-refs/heads/6.4.388@{#1}
Cr-Branched-From: a5fc4e0-refs/heads/master@{#49724}

[email protected]

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I33ab8c30247d7863986fadf6f35ff116013cb6c9
Reviewed-on: https://chromium-review.googlesource.com/893682
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.5@{#14}
Cr-Branched-From: 73c55f5-refs/heads/6.5.254@{#1}
Cr-Branched-From: 594a1a0-refs/heads/master@{#50664}

[email protected]

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I7e8771da46fc9d3d4cc8e4eef565d751bb5cf6b4
Reviewed-on: https://chromium-review.googlesource.com/958210
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.6@{#14}
Cr-Branched-From: d500271-refs/heads/6.6.346@{#1}
Cr-Branched-From: 265ef0b-refs/heads/master@{#51624}

Revision: fcb8061

NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true

Change-Id: I8bc32f31b873d144ad99eb70474c71cb7e27b252
Reviewed-on: https://chromium-review.googlesource.com/1013560
Commit-Queue: Ivica Bogosavljevic <[email protected]>
Reviewed-by: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.7@{#14}
Cr-Branched-From: 8457e81-refs/heads/6.7.288@{#2}
Cr-Branched-From: e921be5-refs/heads/master@{#52547}

Cr-Commit-Position: refs/branch-heads/6.0@{v8#14}
Cr-Branched-From: 97dbf62-refs/heads/6.0.286@{#1}
Cr-Branched-From: 12e6f1c-refs/heads/master@{#45439}

[email protected]

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I8e1e64323e815121dcb141a3f62d7fa181e183c7
Reviewed-on: https://chromium-review.googlesource.com/1086973
Reviewed-by: v8 autoroll <[email protected]>
Cr-Commit-Position: refs/branch-heads/6.8@{#14}
Cr-Branched-From: 44d7d7d-refs/heads/6.8.275@{#1}
Cr-Branched-From: 5754f66-refs/heads/master@{#53286}

This reverts commit 52a10e5.

Reason for revert: https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/12434/layout-test-results/results.html

Crash e.g. in http/tests/devtools/oopif/oopif-performance-cpu-profiles.js

crash log for devtools (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/compilation-dependencies.cc, line 281
STDERR: # Debug check failed: descriptor == owner->LastAdded() (10 vs. 22).
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7fff86878630#0 0x0000031c642c base::debug::StackTrace::StackTrace()
STDERR: #1 0x0000046a56bb gin::(anonymous namespace)::PrintStackTrace()
STDERR: v8#2 0x00000469c528 V8_Fatal()
STDERR: v8#3 0x00000469c285 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x000001cc5253 v8::internal::CompilationDependencies::DependOnFieldType()
STDERR: v8#5 0x000001cdcc46 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfo()
STDERR: v8#6 0x000001cde661 v8::internal::compiler::AccessInfoFactory::ComputePropertyAccessInfos()
STDERR: v8#7 0x000001dd982b v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccess()
STDERR: v8#8 0x000001ddb715 v8::internal::compiler::JSNativeContextSpecialization::ReduceNamedAccessFromNexus()
STDERR: v8#9 0x000001dd656d v8::internal::compiler::JSNativeContextSpecialization::ReduceJSLoadNamed()
STDERR: v8#10 0x000001d53872 v8::internal::compiler::GraphReducer::Reduce()
STDERR: v8#11 0x000001d534a5 v8::internal::compiler::GraphReducer::ReduceTop()
STDERR: v8#12 0x000001d52e58 v8::internal::compiler::GraphReducer::ReduceNode()
STDERR: v8#13 0x000001e4c201 v8::internal::compiler::InliningPhase::Run()
STDERR: v8#14 0x000001e44f79 v8::internal::compiler::PipelineImpl::Run<>()
STDERR: v8#15 0x000001e41058 v8::internal::compiler::PipelineImpl::CreateGraph()
STDERR: v8#16 0x000001e40c75 v8::internal::compiler::PipelineCompilationJob::PrepareJobImpl()
STDERR: v8#17 0x000001ccd437 v8::internal::OptimizedCompilationJob::PrepareJob()
STDERR: v8#18 0x000001cd071e v8::internal::(anonymous namespace)::GetOptimizedCode()
STDERR: v8#19 0x000001cd0c6f v8::internal::Compiler::CompileOptimized()
STDERR: v8#20 0x00000231fb62 v8::internal::__RT_impl_Runtime_CompileOptimized_Concurrent()
STDERR: v8#21 0x00000288e535 <unknown>

Original change's description:
> [turbofan] Rewrite CompilationDependencies
> 
> Instead of installing code dependencies during graph reduction,
> install them after code generation.
> 
> Bug: v8:7902, v8:7790
> Change-Id: I8a3798254abb5b9ec7c295a1592aeb6b51f24c7a
> Reviewed-on: https://chromium-review.googlesource.com/1119913
> Commit-Queue: Georg Neis <[email protected]>
> Reviewed-by: Jaroslav Sevcik <[email protected]>
> Reviewed-by: Michael Starzinger <[email protected]>
> Cr-Commit-Position: refs/heads/master@{#54170}

[email protected],[email protected],[email protected]

Change-Id: Ic58c2bfadbd34bb6ba7dc0d2b74871cc90b0a74f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7902, v8:7790
Reviewed-on: https://chromium-review.googlesource.com/1125680
Reviewed-by: Yang Guo <[email protected]>
Commit-Queue: Yang Guo <[email protected]>
Cr-Commit-Position: refs/heads/master@{#54192}

[email protected]

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ie5783e9198c62b16e0534c460d6b9f982fc0d691
Reviewed-on: https://chromium-review.googlesource.com/1155262
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/6.9@{#14}
Cr-Branched-From: d7b61ab-refs/heads/6.9.427@{#1}
Cr-Branched-From: b7e108d-refs/heads/master@{#54504}

This reverts commit caed2cc.

Reason for revert: Breaks layout tests, e.g.

https://test-results.appspot.com/data/layout_results/V8-Blink_Linux_64__dbg_/14924/webkit_layout_tests%20%28with%20patch%29/layout-test-results/results.html

crash log for renderer (pid <unknown>):
STDOUT: <empty>
STDERR: 
STDERR: 
STDERR: #
STDERR: # Fatal error in ../../v8/src/base/platform/elapsed-timer.h, line 24
STDERR: # Debug check failed: !IsStarted().
STDERR: #
STDERR: #
STDERR: #
STDERR: #FailureMessage Object: 0x7ffc46707640#0 0x565409263b6f base::debug::StackTrace::StackTrace()
STDERR: #1 0x56540a8a32fb gin::(anonymous namespace)::PrintStackTrace()
STDERR: #2 0x56540a8980d8 V8_Fatal()
STDERR: #3 0x56540a897e35 v8::base::(anonymous namespace)::DefaultDcheckHandler()
STDERR: v8#4 0x565407971f02 v8::base::ElapsedTimer::Start()
STDERR: v8#5 0x565407d08edf v8::internal::TimedHistogram::Start()
STDERR: v8#6 0x565407e500d5 v8::internal::IncrementalMarking::AdvanceIncrementalMarkingOnAllocation()
STDERR: v8#7 0x565407e4f977 v8::internal::IncrementalMarking::Observer::Step()
STDERR: v8#8 0x565407e48092 v8::internal::AllocationObserver::AllocationStep()
STDERR: v8#9 0x565407eb0751 v8::internal::SpaceWithLinearArea::InlineAllocationStep()
STDERR: v8#10 0x565407eb3e44 v8::internal::NewSpace::EnsureAllocation()
STDERR: v8#11 0x565407e258ff v8::internal::NewSpace::AllocateRaw()
STDERR: v8#12 0x565407e06b2d v8::internal::Heap::AllocateRaw()
STDERR: v8#13 0x565407e432ef v8::internal::Heap::AllocateRawWithLightRetry()
STDERR: v8#14 0x565407e433cf v8::internal::Heap::AllocateRawWithRetryOrFail()
STDERR: v8#15 0x565407e04d48 v8::internal::Factory::NewFixedArrayWithFiller()
STDERR: v8#16 0x565407fd6339 v8::internal::HashTable<>::New()
STDERR: v8#17 0x565407fd7be8 v8::internal::HashTable<>::EnsureCapacity()
STDERR: v8#18 0x565407fc7e95 v8::internal::Dictionary<>::Add()
STDERR: v8#19 0x565407fcf453 v8::internal::BaseNameDictionary<>::Add()
STDERR: v8#20 0x565407f89ee4 v8::internal::LookupIterator::ApplyTransitionToDataProperty()
STDERR: v8#21 0x5654080036e2 v8::internal::Object::AddDataProperty()
STDERR: v8#22 0x56540793061f v8::internal::(anonymous namespace)::DefineDataProperty()
STDERR: v8#23 0x56540792da59 v8::internal::(anonymous namespace)::InstantiateObject()
STDERR: v8#24 0x56540792b75a v8::internal::(anonymous namespace)::InstantiateFunction()
STDERR: v8#25 0x56540792b4db v8::internal::ApiNatives::InstantiateFunction()
STDERR: v8#26 0x5654079594bf v8::FunctionTemplate::GetFunction()
STDERR: v8#27 0x56540a7af74e blink::V8ObjectConstructor::CreateInterfaceObject()
STDERR: v8#28 0x56540a7afe01 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#29 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#30 0x56540a7afdd6 blink::V8PerContextData::ConstructorForTypeSlowCase()
STDERR: v8#31 0x56540a7afcb4 blink::V8PerContextData::CreateWrapperFromCacheSlowCase()
STDERR: v8#32 0x56540a7aef73 blink::V8DOMWrapper::CreateWrapper()
STDERR: v8#33 0x56540a7abf6b blink::ScriptWrappable::Wrap()
STDERR: v8#34 0x56540a677199 blink::V8Document::documentElementAttributeGetterCallback()
STDERR: v8#35 0x565407a0aec3 v8::internal::FunctionCallbackArguments::Call()
STDERR: v8#36 0x565407a097be v8::internal::(anonymous namespace)::HandleApiCallHelper<>()
STDERR: v8#37 0x565407a0877b v8::internal::Builtins::InvokeApiFunction()
STDERR: v8#38 0x565407fe785a v8::internal::Object::GetPropertyWithAccessor()
STDERR: v8#39 0x565407fe697e v8::internal::Object::GetProperty()
STDERR: v8#40 0x565407ec8c71 v8::internal::LoadIC::Load()
STDERR: v8#41 0x565407ed6401 v8::internal::__RT_impl_Runtime_LoadIC_Miss()
STDERR: v8#42 0x5654087593f2 <unknown>
STDERR: [16162:16185:1122/143518.356897:WARNING:crash_handler_host_linux.cc(341)] Could not translate tid, attempt = 1 retry ...


Original change's description:
> [heap] Improve embedder tracing during incremental marking
> 
> Add a path into embedder tracing on allocation. This is safe as as Blink
> is not allowed to call into V8 during object construction.
> 
> Bug: chromium:843903
> Change-Id: I5af053c3169f5a33778ebce5d7c5c43e4efb1aa4
> Reviewed-on: https://chromium-review.googlesource.com/c/1348749
> Commit-Queue: Michael Lippautz <[email protected]>
> Reviewed-by: Ulan Degenbaev <[email protected]>
> Cr-Commit-Position: refs/heads/master@{#57757}

[email protected],[email protected]

Change-Id: Ide2c0b284b52bee17573adcc89f14be4e40dab91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:843903
Reviewed-on: https://chromium-review.googlesource.com/c/1349189
Reviewed-by: Yang Guo <[email protected]>
Commit-Queue: Yang Guo <[email protected]>
Cr-Commit-Position: refs/heads/master@{#57759}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: Icc4497632fc30b0a2bc57c07dc61e6f4f0060413
Reviewed-on: https://chromium-review.googlesource.com/c/1370007
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.2@{v8#14}
Cr-Branched-From: 6acd03c-refs/heads/7.2.502@{#1}
Cr-Branched-From: b03041d-refs/heads/master@{#57910}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I2593fb4e859f5a477d33cab19f8115fdd2a48a16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1523367
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.4@{v8#14}
Cr-Branched-From: 3e8a733-refs/heads/7.4.288@{#1}
Cr-Branched-From: d077f9b-refs/heads/master@{#60039}

Check aliased FP registers when constructing the {to_be_live} set from
multiple predecessors.

[email protected]
(cherry picked from commit 8c050b7)

Bug: chromium:1029642
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Change-Id: I7beb22d5c4cc62be4e6b8453fb00f9c16a564433
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1969899
Reviewed-by: Thibaud Michaud <[email protected]>
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.0@{v8#14}
Cr-Branched-From: 69827db-refs/heads/8.0.426@{v8#2}
Cr-Branched-From: 2fe1552-refs/heads/master@{#65318}

Revision: 8738ab8

BUG=v8:10198,v8:9706,chromium:1045034
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: Ic7c5a705a841a8f55407bd1caebaea4300e2b14a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2056852
Reviewed-by: Ulan Degenbaev <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.1@{v8#14}
Cr-Branched-From: a4dcd39-refs/heads/8.1.307@{#1}
Cr-Branched-From: f22c213-refs/heads/master@{#66031}

When filling stack slots, the start offset can be too large to fit into
the immediate of a str instruction (which is used to handle remainders
after stp). For example, a function with 32 i64 params will require 256
bytes reserved for the params, so the offset starts at 256 + 16
(instance) = 272. This does not fit into a int9, so we hit an
UNREACHABLE case when emitting str.

The fix here checks that start can fit in an unscaled immediate, and if
it doesn't fallback to the general case. We could use the Str
from macro-asesmbler, but that uses another instruction, so we are not
saving anything.

A check for IsImmLSUnscaled(-start-12) is sufficient because 12 is the
largest possible value for remainder. So if -start-12 fits, everything
else will fit.

[email protected]

(cherry picked from commit c92e74f)

Bug: v8:10645
Change-Id: Ibde69e667693e9c2c267469181db79c91e4aa765
No-Try: true
No-Presubmit: true
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2274084
Reviewed-by: Zhi An Ng <[email protected]>
Commit-Queue: Zhi An Ng <[email protected]>
Cr-Commit-Position: refs/branch-heads/8.5@{v8#14}
Cr-Branched-From: a7f8bc4-refs/heads/8.5.210@{#1}
Cr-Branched-From: dd58472-refs/heads/master@{#68510}

…x field

Revision: 35d8b9a

BUG=chromium:1003286
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: Icdf6e132f3a7b39ae8532f878923e373500d3f33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1820937
Reviewed-by: Michael Stanton <[email protected]>
Commit-Queue: Georg Neis <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.8@{v8#14}
Cr-Branched-From: 73694fd-refs/heads/7.8.279@{#1}
Cr-Branched-From: 2314928-refs/heads/master@{#63555}

This reverts commit a22b7b5.

Reason for revert: Breaks presubmit bot - https://ci.chromium.org/p/v8/builders/ci/V8%20Presubmit%20-%20beta%20branch/252

Original change's description:
> Merged: [turbofan] Fix memory corruption
> 
> Revision: f16a3a7
> 
> BUG=chromium:997057
> LOG=N
> NOTRY=true
> NOPRESUBMIT=true
> NOTREECHECKS=true
> R=​[email protected]
> 
> Change-Id: I179a853f4e8765d251ac59c2a31a554bc9bb0041
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768362
> Reviewed-by: Michael Hablich <[email protected]>
> Cr-Commit-Position: refs/branch-heads/7.7@{v8#12}
> Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
> Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

[email protected],[email protected]

Change-Id: I827ff48d9400c24b400defa437d17f21faf0da8e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:997057
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1768364
Reviewed-by: Maya Lekova <[email protected]>
Commit-Queue: Maya Lekova <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.7@{v8#14}
Cr-Branched-From: 4035531-refs/heads/7.7.299@{#1}
Cr-Branched-From: 1320c91-refs/heads/master@{#62881}

TBR=v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com

Change-Id: I7870cad33c16bd5378c81b013dbee4c8a55f6f53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1871953
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/7.9@{v8#14}
Cr-Branched-From: be181e2-refs/heads/7.9.317@{#1}
Cr-Branched-From: 0d7889d-refs/heads/master@{#64307}

…al memory

Revision: dfa7e3f

BUG=chromium:914304
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I9a71b14cf80594550d9cd9770fdc8a908425467f
Reviewed-on: https://chromium-review.googlesource.com/c/1456103
Reviewed-by: Ulan Degenbaev <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.3@{v8#14}
Cr-Branched-From: 9df9418-refs/heads/7.3.492@{v8#2}
Cr-Branched-From: be213cf-refs/heads/master@{#59024}

Revision: 78e5763

BUG=chromium:881247
LOG=N
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
[email protected]

Change-Id: I22f54875f6ee8db7aa15f2d92d25495baa808e3c
Reviewed-on: https://chromium-review.googlesource.com/c/1297964
Reviewed-by: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/7.1@{v8#14}
Cr-Branched-From: f70aaa8-refs/heads/7.1.302@{#1}
Cr-Branched-From: 1dbcc78-refs/heads/master@{#56462}

We usually use t9 as the jump target register in mips64 (t7 in
loong64), and change PushAllRegistersAndIterateStack to be so.

Besides, fix an error in loong64, the frame pointer is fp instead
of s8.

(cherry picked from commit ff2e308)

Bug: v8:14138
Change-Id: I4b2618adc0ed78da9a8a9580f15d68ef2940eb11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4629799
Auto-Submit: Liu Yu <[email protected]>
Reviewed-by: Lutz Vahl <[email protected]>
Commit-Queue: Lutz Vahl <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.6@{v8#14}
Cr-Branched-From: e29c028-refs/heads/11.6.189@{v8#3}
Cr-Branched-From: 95cbef2-refs/heads/main@{#88340}

The ParallelMoveResolver is instantiated separately for Registers and
DoubleRegisters. Thus we cannot detect cycles between stack slots used
for spilling Registers and DoubleRegisters at the same time. To avoid
getting into this situation we don't share spill slots between the two.

Bug: v8:14271
(cherry picked from commit ae96bf3)

Change-Id: I21911c66d8a31bcab4ee4506d6a45e0abef3e53b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4813326
Commit-Queue: Olivier Flückiger <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.7@{v8#14}
Cr-Branched-From: fe60869-refs/heads/11.7.439@{#1}
Cr-Branched-From: aeb4552-refs/heads/main@{#89415}

along with two follow-up fixes that were backmerged previously.
This optimization needs some more time for getting stabilized.

This reverts the following commits:
79330c6
1783814
55bd79c

Bug: chromium:1485324, chromium:1481564, chromium:1481363
Change-Id: I3cdc741138c8194c3497ba78176faa4ace29d3f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4886918
Commit-Queue: Michael Achenbach <[email protected]>
Auto-Submit: Jakob Kummerow <[email protected]>
Reviewed-by: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/11.8@{v8#14}
Cr-Branched-From: 935bdbf-refs/heads/11.8.172@{#1}
Cr-Branched-From: b82a911-refs/heads/main@{#89779}

Pass argument in register instead of the stack.

Bug: chromium:1488199, v8:14415
(cherry picked from commit ad30a54)

Change-Id: I7ae75d2434eb871afa1964877151a60f6c05a499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5046793
Auto-Submit: Patrick Thier <[email protected]>
Commit-Queue: Camillo Bruni <[email protected]>
Reviewed-by: Camillo Bruni <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.0@{v8#14}
Cr-Branched-From: ed7b4ca-refs/heads/12.0.267@{#1}
Cr-Branched-From: 210e75b-refs/heads/main@{#90651}

…riptor

Bug: v8:12783, chromium:1489500, chromium:1507235
(cherry picked from commit 7d12441)

Change-Id: I27bcba187b0044763c4b62e998dda15933bbec51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5103872
Commit-Queue: Patrick Thier <[email protected]>
Commit-Queue: Nico Hartmann <[email protected]>
Reviewed-by: Patrick Thier <[email protected]>
Auto-Submit: Nico Hartmann <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.1@{v8#14}
Cr-Branched-From: b74ef6f-refs/heads/12.1.285@{#1}
Cr-Branched-From: 32857fb-refs/heads/main@{#91313}

This CHECK does not hold when the profiler is enabled and code is
deoptimized.

Bug: chromium:324553974
Change-Id: I5907be8233825074b4b80e92c4a3f53eb9975a9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5355686
Reviewed-by: Michael Lippautz <[email protected]>
Commit-Queue: Dominik Inführ <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.3@{#14}
Cr-Branched-From: a86e197-refs/heads/12.3.219@{#1}
Cr-Branched-From: 21869f7-refs/heads/main@{#92385}

…ap had one

If any previous map in the transition tree had an enum cache, then we
recreate one when updating the map.

Bug: 330760873
(cherry picked from commit 807cf7d)

Change-Id: Icebbac878376667fc81f06c587292fd82b933bcc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5401784
Reviewed-by: Igor Sheludko <[email protected]>
Auto-Submit: Darius Mercadier <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.4@{#14}
Cr-Branched-From: 309640d-refs/heads/12.4.254@{#1}
Cr-Branched-From: 5dc2470-refs/heads/main@{#92862}

…ged_base

Bug: v8:12783, chromium:1520362
(cherry picked from commit 7c0f4cc)

Change-Id: Ie76b54d1596ff15e1abe91e1ea0f2d9ef6283bfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5237382
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Auto-Submit: Darius Mercadier <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.2@{v8#14}
Cr-Branched-From: 6eb5a96-refs/heads/12.2.281@{#1}
Cr-Branched-From: 44cf56d-refs/heads/main@{#91934}

Bug: 340221135
(cherry picked from commit b3c01ac)

Change-Id: Icdad4aa5cd0e95f6ae9c4ea84d5b7b7bd70fd039
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5536211
Reviewed-by: Adam Klein <[email protected]>
Commit-Queue: Shu-yu Guo <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.5@{#14}
Cr-Branched-From: 15b9756-refs/heads/12.5.227@{#1}
Cr-Branched-From: 497d857-refs/heads/main@{#93350}

Patch #1 contains a local staging implementation of a test262 staging test. The test gets to run twice (once for every locations), but it uses the local staging implementation for both runs. Things break on resultdb as we generate the same key for both runs. In the CQ for patch #1 we error out:
 - task https://chromium-swarm.appspot.com/task?id=6966b3197f9bf810 with key test262/staging/set-is-subset-table-transition.VariantProc-default-0.Rerun-1
 - task https://chromium-swarm.appspot.com/task?id=6966b31d4d1d8110 with test262/staging/set-is-subset-table-transition.VariantProc-default-strict-0.Rerun-1

Patch #2-13 implements and tests the shadowing mechanism where we exclude test262 staging tests that have an equivalent V8 staging test. CQ passes.

Patch #13 runs with a shadowing test that fails.

Patch #14 removes the shadowing test.


Bug: 339207824
Change-Id: Ie299f5d9e364fb396801426f629840ca73b8ce14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5518172
Reviewed-by: Michael Achenbach <[email protected]>
Commit-Queue: Liviu Rau <[email protected]>
Reviewed-by: Alexander Schulze <[email protected]>
Cr-Commit-Position: refs/heads/main@{#93893}

Fixed: 339736513
(cherry picked from commit 8a69c78)

Change-Id: I6f886d44e754d39b584d6bf8c0582e88032603d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5555845
Commit-Queue: Adam Klein <[email protected]>
Reviewed-by: Adam Klein <[email protected]>
Auto-Submit: Shu-yu Guo <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.6@{#14}
Cr-Branched-From: 3c9fa12-refs/heads/12.6.228@{#2}
Cr-Branched-From: 981bb15-refs/heads/main@{#93835}

Turboshaft's loop unrolling has some logic to remove loops with 0
iterations, and it was broken.

The idea is that is there is a loop whose termination condition is
something like "stop when i <= 0" where `i` is a loop phi and `i`'s
initial value is less than or equal to 0, then this loop has 0
iterations. EXCEPT that this is only true if `i` is a loop phi FOR
THIS LOOP. And, in the repro, the `i` comes from a previous loop, so
what matters is not its initial value but rather its "final" value
(which is not known unless we know how many iterations this previous
has, but regardless, the current loop doesn't have 0 iterations!).

Bug: chromium:347905990, chromium:42202729
(cherry picked from commit 73be673)

Change-Id: I6e09a3445ab24e3c9e707dac1c126dc8331e2408
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5644841
Auto-Submit: Darius Mercadier <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Commit-Queue: Matthias Liedtke <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.7@{#14}
Cr-Branched-From: 35cc908-refs/heads/12.7.224@{#1}
Cr-Branched-From: 6d60e67-refs/heads/main@{#94324}

This reverts commit fcf8d2a.

Reason for revert: https://crbug.com/355460997

Original change's description:
> [regexp] Improvements to Unicode case independent.
>
> Case-desugar the regexp later for better performance.
>
> We used to expand into case variants at a very early
> stage, in the parser. This has two disadvantages.
>
> Firstly, it means we do all the case work even when
> just checking the syntax of a regexp, which happens
> multiple places in order to give early errors.
>
> Secondly, it disables some of the optimizations that
> Irregexp can do, because now instead of literal strings
> we have sequences of character classes, which are not
> treated in the same way.
>
> For character classes we have to desugar early to get
> the specified semantics, but for literal texts outside
> of character classes we can mostly go back to the old
> behaviour that is used without the /u and /v flags.
> The exception is for surrogate pairs (code points
> above 0x10000) where we still desugar early.  Luckily
> there are no alpha letters below 0x10000 that have
> case equivalents above 0x10000.
>
> Running https://gist.github.com/erikcorry/dd5b08dd5abdf4f592628dd08db17701 I get the following output:
>
> Before:
> With 7000 terms, took 1674ms, 253ms, 28ms, 26.857142857142858ms per iteration
>
> After:
> With 7000 terms, took 332ms, 145ms, 0ms, 0ms per iteration
>
> Bug: 40261789
> Change-Id: I16dca4830c3145f436f537c1db1a0de6def9045c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5643119
> Reviewed-by: Patrick Thier <[email protected]>
> Commit-Queue: Erik Corry <[email protected]>
> Reviewed-by: Toon Verwaest <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#94770}

Bug: 40261789, 355460997
(cherry picked from commit 9e16fce)

Change-Id: I94b8de7ca877b4d285146005181a3ea08615ed73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5766374
Auto-Submit: Patrick Thier <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.8@{#14}
Cr-Branched-From: 70cbb39-refs/heads/12.8.374@{#1}
Cr-Branched-From: 451b63e-refs/heads/main@{#95151}

... And forward the exception to the parent stack instead.

[email protected]

Fixed: 361717714
(cherry picked from commit 9495e79)

Change-Id: Ib70e14e8d48bdcba401f01a62fa48bddb1e8e7cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5828865
Reviewed-by: Jakob Kummerow <[email protected]>
Commit-Queue: Thibaud Michaud <[email protected]>
Cr-Commit-Position: refs/branch-heads/12.9@{#14}
Cr-Branched-From: 64a21d7-refs/heads/12.9.202@{#1}
Cr-Branched-From: da4200b-refs/heads/main@{#95679}

This reverts commit 9144af8.

Reason for revert: https://issues.chromium.org/issues/364340219

Original change's description:
> [cppgc] Make clearing of weak persistents concurrent
>
> Oilpan's weakness clearing phase often takes around 10% of the overall
> mark-compact pause. A small portion is taken by the clearing of
> same-thread WeakPersistent handles. This CL introduces a concurrent job
> for clearing such handles, in parallel to weak container callbacks.
>
> Bug: 349952799
> Change-Id: I497b199edd674379d552281125cdca65bc766bd3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5822092
> Reviewed-by: Anton Bikineev <[email protected]>
> Reviewed-by: Michael Lippautz <[email protected]>
> Commit-Queue: Nikolaos Papaspyrou <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#95872}

(cherry picked from commit cbbe873)

Bug: 349952799
Bug: 364340219
Change-Id: I81a5db34fa30cfddcb586b2265abe7239bd52140
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5877010
Commit-Queue: Nikolaos Papaspyrou <[email protected]>
Reviewed-by: Michael Lippautz <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#96207}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5881774
Cr-Commit-Position: refs/branch-heads/13.0@{#14}
Cr-Branched-From: 4be854b-refs/heads/13.0.245@{#1}
Cr-Branched-From: 1f5183f-refs/heads/main@{#96103}

The variable is already properly allocated, so we shouldn't try to
reallocate it. Notable this would be wrong in the case where we reparse
a class body for one of its initializers. The function in which the
class body actually lives might not have required a context, but
computed property names might have referred to its receiver. When we
reparse the class that function might not be on the outer scope chain of
the class (since it didn't require a context).

Bug: 371237564
(cherry picked from commit 0d75c4e)

Change-Id: Ie395a151927dd2afb2bf3232717de2739103e002
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6012364
Auto-Submit: Toon Verwaest <[email protected]>
Commit-Queue: Igor Sheludko <[email protected]>
Reviewed-by: Igor Sheludko <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.1@{#14}
Cr-Branched-From: 7998da6-refs/heads/13.1.201@{#1}
Cr-Branched-From: 5e9af2a-refs/heads/main@{#96554}

This is an exceptional case, and the code won't work for debugging, but
we need to allow Turbofan to produce for_debugging code.

[email protected]

Bug: 377971725
(cherry picked from commit f7ce6d6)

Change-Id: I6c30c7c4ae191fcbe77d8b2e9871cfc6e404b65b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6032972
Commit-Queue: Clemens Backes <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.2@{#14}
Cr-Branched-From: 24068c5-refs/heads/13.2.152@{#1}
Cr-Branched-From: 6054ba9-refs/heads/main@{#97085}

Fixed: 386487312

(cherry picked from commit 245b6b0)

Change-Id: I57d68c0da7524941bac31b7f79e2d3d442697a27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6172041
Commit-Queue: Patrick Thier <[email protected]>
Reviewed-by: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Auto-Submit: Patrick Thier <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.3@{#14}
Cr-Branched-From: 41dacff-refs/heads/13.3.415@{#1}
Cr-Branched-From: 3348638-refs/heads/main@{#97937}

…ring

Bug: 382005099
Fixes: 394644268
(cherry picked from commit 6f0419a)

Change-Id: I366e64d838d2aecd4cec3f48ecae666ae1cea786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6253081
Reviewed-by: Jakob Kummerow <[email protected]>
Auto-Submit: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.4@{#14}
Cr-Branched-From: 0f87a54-refs/heads/13.4.114@{#1}
Cr-Branched-From: 27af2e9-refs/heads/main@{#98459}

and disable the new and more capable variant for now.

Bug: 400944465
(cherry picked from commit f7bf2ff)

Change-Id: Iac163bda338abefbdf5d86e0093fd060643d7a97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6354785
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Auto-Submit: Olivier Flückiger <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.5@{#14}
Cr-Branched-From: c206c46-refs/heads/13.5.212@{#1}
Cr-Branched-From: af3cadc-refs/heads/main@{#99020}

and disable the new and more capable variant for now.

Bug: 400944465
(cherry picked from commit f7bf2ff)

Change-Id: Iac163bda338abefbdf5d86e0093fd060643d7a97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6354785
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Auto-Submit: Olivier Flückiger <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.5@{v8#14}
Cr-Branched-From: c206c46-refs/heads/13.5.212@{#1}
Cr-Branched-From: af3cadc-refs/heads/main@{#99020}

A packed array whose FixedArray has larger capacity than the length of
the Array should be filled with holes at the end, in case we extend
it sparsely. The Wasm imports array wasn't setting this correctly, and
this was exposed by Array.p.fill changing the elements kind to Smi.

Also add extra verification which should catch this earlier in the
future.

Fixed: 408253898
(cherry picked from commit daf86ce)

Change-Id: I3725fcda9a23a267d5f9cb47decb9740338bd2e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6480173
Auto-Submit: Leszek Swirski <[email protected]>
Commit-Queue: Leszek Swirski <[email protected]>
Reviewed-by: Michael Lippautz <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.6@{#14}
Cr-Branched-From: 04fa9cb-refs/heads/13.6.233@{#1}
Cr-Branched-From: f6be482-refs/heads/main@{#99571}

Add the chrome-cherry-picker service account email to the bot_allowlist
to prevent the presubmits from identifying this as an external account
attempting to commit to V8.

Security review bug: https://b.corp.google.com/issues/416458709

(cherry picked from commit 3dc6e7a)

Bug: 414375475
Change-Id: I52418a970f407f0c1d395627f25dd3cbc9234b82
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6552818
Reviewed-by: Michael Achenbach <[email protected]>
Reviewed-by: Matthias Liedtke <[email protected]>
Commit-Queue: Michael Achenbach <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#100301}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6552378
Auto-Submit: Gennady Tsitovich <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.7@{#14}
Cr-Branched-From: dd5370d-refs/heads/13.7.152@{#1}
Cr-Branched-From: fa9b753-refs/heads/main@{#99927}

(cherry picked from commit a8c92dd)

Bug: 414724525
Change-Id: I6323a40d7b1756593284e6164771f9842a61a394
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6606959
Reviewed-by: Liviu Rau <[email protected]>
Commit-Queue: Michael Achenbach <[email protected]>
Cr-Original-Commit-Position: refs/heads/main@{#100584}
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6607587
Commit-Queue: Liviu Rau <[email protected]>
Auto-Submit: Michael Achenbach <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.8@{#14}
Cr-Branched-From: 61ddd47-refs/heads/13.8.258@{#1}
Cr-Branched-From: fdb5de2-refs/heads/main@{#100480}

Add FPU state to the code cache hash, and ensure deserialization threads
preserve it.

Fixed: 425703809
(cherry picked from commit 7e9d594)

Change-Id: I421969d258fea139030dd70f958ae5594902d606
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6713476
Auto-Submit: Leszek Swirski <[email protected]>
Commit-Queue: Jakob Kummerow <[email protected]>
Reviewed-by: Jakob Kummerow <[email protected]>
Cr-Commit-Position: refs/branch-heads/13.9@{#14}
Cr-Branched-From: 76ea409-refs/heads/13.9.205@{#1}
Cr-Branched-From: 2824212-refs/heads/main@{#100941}

… are 0

Because Arm64 doesn't have a flag-setting 32-bit multiplication,
which means that instead with use a 64-bit multiplication, and compare
result.X() and result.W() to check if an overflow happened. But this
leads to the upper 32-bit not being zeroed.

(cherry picked from commit ec6c184)

Fixed: 445380761
Change-Id: Ib1cf9bd78b81947939f99de1b0e1c3339da47999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6955268
Reviewed-by: Darius Mercadier <[email protected]>
Commit-Queue: Darius Mercadier <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.0@{#14}
Cr-Branched-From: 4ec2f43-refs/heads/14.0.365@{#1}
Cr-Branched-From: a88b570-refs/heads/main@{#101731}

Version incremented at https://cr-buildbucket.appspot.com/build/8703292345856378289

Change-Id: I0b37fde051d1aeef6eb7fc3f6f312604cb5ba703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6965513
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.1@{#14}
Cr-Branched-From: 1f4839b-refs/heads/14.1.146@{#1}
Cr-Branched-From: cd6944c-refs/heads/main@{#102149}

Version incremented at https://cr-buildbucket.appspot.com/build/8700833390482118289

Change-Id: I46d4326d43ebe21f051bbf36059c44ac060026cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7049822
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/branch-heads/14.2@{#14}
Cr-Branched-From: 37f82db-refs/heads/14.2.231@{#1}
Cr-Branched-From: d1a6089-refs/heads/main@{#102804}

Original change's description:
> [wasm] Fix data race on `AsyncCompileJob::native_module_`
> 
> The `AsyncCompileJob::native_module_` field was written both from
> foreground and background tasks, and for empty modules this could lead
> to actual data races and crashes.
> 
> This CL only uses this field to store a *newly allocated*
> `NativeModule`, and never updates it later (when finding another module
> in the cache).
> Instead, we pass around the final `NativeModule` more now.
> 
> [email protected]
> 
> Bug: 455126321, 452200374, 456342369
> Change-Id: I543e71642d28f75cbe3007efa8c04ade1c13f8d8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7096821
> Reviewed-by: Jakob Kummerow <[email protected]>
> Commit-Queue: Clemens Backes <[email protected]>
> Cr-Commit-Position: refs/heads/main@{#103408}

(cherry picked from commit 93fdd4a)

Bug: 459383032,455126321,452200374,456342369
Change-Id: I543e71642d28f75cbe3007efa8c04ade1c13f8d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7138543
Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Rubber Stamper <[email protected]>
Bot-Commit: Rubber Stamper <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.3@{#14}
Cr-Branched-From: 13c7e31-refs/heads/14.3.127@{#1}
Cr-Branched-From: 01af089-refs/heads/main@{#103352}

... broken by https://crrev.com/c/7184979.

The issue was that
 - for "contextual" accesses to JSGlobalObject properties V8 needs to
   provide respective JSGlobalProxy as the "holder" to the
   accessor/interceptor callbacks,
 - the "holder" was computed via JSGlobalObject::global_proxy() which
   in case of detached context might already be backed by another
   instance of JSGlobalObject.
 - as a result if an Api callback would try to access the detached
   global object via such "holder" it'd access wrong JSGlobalObject
   instance - it'd be the current one instead of original one.

The fix is to create a new JSGlobalProxy instance during context
detaching, wire it properly with the old JSGlobalObject instance and
pass it as a "holder" value to Api callbacks. This other global proxy
is stored in a new JSGlobalObject::global_proxy_for_api field.

Thus, the detached global object gets new identity which can be
observed only in accessor/interceptor callbacks as the "holder" will
no longer be equal to any of the `v8::Context::Global()`.

To summarize behavior changes related to Holder()->HolderV2() migration
(avoid exposing JSGlobalObject through Api) for accessor/interceptors
on the global object, previously we had the following:
  CHECK_NE(attached_context->Global(), info.Holder());
  CHECK_NE(detached_context->Global(), info.Holder());

but now we'll have:
  CHECK_EQ(attached_context->Global(), info.HolderV2());
  CHECK_NE(detached_context->Global(), info.HolderV2());

Additionally, this CL adds Realm.navigateSameOrigin(i) for testing.

Bug: 464961493
Bug: 463593768
Bug: 333672197
Fixed: 466990858
(cherry picked from commit 32fd863)

Change-Id: I60c1c7bf882da5eee12c5090feaac3fca6e03300
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/7245590
Commit-Queue: Igor Sheludko <[email protected]>
Commit-Queue: Toon Verwaest <[email protected]>
Auto-Submit: Igor Sheludko <[email protected]>
Reviewed-by: Toon Verwaest <[email protected]>
Cr-Commit-Position: refs/branch-heads/14.4@{#14}
Cr-Branched-From: 80acc26-refs/heads/14.4.258@{#1}
Cr-Branched-From: ce7e597-refs/heads/main@{#104020}