Commit Graph

65199 Commits

Author SHA1 Message Date
Dominik Inführ
494eef3b5d [heap] Add trace events for time-to-collection
Measure time from requesting GC on background thread until the main
thread starts the collection. Also add trace event for the GC on the
background thread.

Bug: v8:10315
Change-Id: I765ce0df8a1c31e4f64661ea8dc0b6a4685a3132
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489681
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70707}
2020-10-22 13:29:54 +00:00
Maya Lekova
b63d4841a1 [fastcall] Turn the options pointer to a reference
Refactor the {options} output parameter of the fast callback to a
reference, since it can never be nullptr for functions created with
MakeWithFallbackSupport. This allows embedders to spare the nullptr
check.

Bug: chromium:1052746
Change-Id: I3e22f07af4740ebe8522691da51b6addbc980f24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491026
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70706}
2020-10-22 12:44:54 +00:00
Santiago Aboy Solanes
71df56fd66 [cleanup][object] Use field_address instead of FIELD_ADDR macro
From `FIELD_ADDR(*this, abc)`, to `field_address(abc)`;

Bug: v8:10933
Change-Id: I49c3b19db3ca05947fbe7113642a85ba59da6cef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491029
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70705}
2020-10-22 12:36:08 +00:00
Victor Gomes
a6a301b735 [builtins] Remove faster-calls-with-arguments-mismatch optimization
Since JS arguments are always reversed now (https://crrev.com/c/2466116), the logic for skipping the arguments adapter is dead.
It has been subsumed by the complete removal of the adaptor frame (https://crrev.com/c/2440098).

Doc: bit.ly/v8-faster-calls-with-arguments-mismatch

Change-Id: Ia02e0807b7d23a9de371650fa6357113e409d338
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489684
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70704}
2020-10-22 11:42:42 +00:00
Sathya Gunasekaran
bf8d0e79c0 Reland "[ic] Append deprecated maps after appending new map"
This is a reland of 517a306933

Original change's description:
> [ic] Append deprecated maps after appending new map
>
> Previously, we would append the deprecated maps and then append the
> new valid map causing minimorphic map checks to miss this new map in
> the case that we exceeded the FLAG_max_minimorphic_map_checks size.
>
> Bug: v8:10582
> Change-Id: Ie3d7da73f7bdbdd822241fae7879817889a72b43
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2484513
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70676}

Bug: v8:10582
Change-Id: Ie951f364406063becb659a0151093e6c9f69e0f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491283
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70703}
2020-10-22 11:04:52 +00:00
johnx
ae91dacbc2 Introduce libc wrappers like v8::base::Malloc
The Cobalt project has its own Starboard equivalent of libc APIs like
`malloc` and `free`. This CL introduces the wrappers for some libc
functions. In followup CLs, for example occurences of malloc will all
be replaced by base::Malloc in V8.

See b/156155426 for more information.

Bug: v8:10927
Change-Id: Ida3d161a1da56755b681e18b4827e277e6cb4c4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416150
Commit-Queue: John Xu <johnx@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: John Xu <johnx@google.com>
Cr-Commit-Position: refs/heads/master@{#70702}
2020-10-22 10:46:22 +00:00
Jakob Gruber
0d0a3416f0 [code] Prepare to move metadata out of the instructions area
No major functional changes in this CL, mostly it moves code around
to make follow-up CLs less messy.

 - Document Code layout.
 - New concepts: 'body' and 'metadata' areas of Code objects. The
   metadata area contains metadata tables, the body area includes
   both instructions and metadata (this is currently the 'instructions'
   area). Add accessors for these new areas.
 - An interesting detail: embedded builtins will have non-adjacent
   instruction and metadata areas, thus a concept of 'body' doesn't
   make sense there.
 - Also add raw_instruction_X_future accessors; these are used where
   we are actually interested in the instructions range, not the entire
   body. In a follow-up, current raw_instruction_X accessors will be
   replaced by raw_body_X, and raw_instruction_X_future by
   raw_instruction_X.

Bug: v8:11036
Change-Id: I1d85146b652e0c097c3602d4db1862d5d3898a7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491023
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70701}
2020-10-22 10:42:27 +00:00
Clemens Backes
729235c21a [wasm][memory64] Prepare atomic builtins for i64 indexes
The offset (also called "address") passed to the atomic builtins was
32-bit until now. With memory64, we will have to also accept 64-bit
values there, or at least values within the allocatable memory range.
This CL thus changes the builtins to receive uintptr values instead of
uint32, and pass them on to the runtime functions as double (as before).
The runtime then casts them back to uintptr_t instead of uint32_t.

Liftoff is extended to zero-extend the uint32 value if needed. TurboFan
already passed a machine-word sized integer before.

Drive-by: Rename some "address" to "offset" to make the semantics more
clear.

R=ahaas@chromium.org
CC=​​manoskouk@chromium.org

Bug: v8:10949
Change-Id: I66968cc99a908775156c952da46d2f26219ffb58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489685
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70700}
2020-10-22 10:41:22 +00:00
Zhao Jiazhong
365948ed6e [mips][unwinder] Restore callee saved registers after unwinding
Port d6c586f756
https://chromium-review.googlesource.com/c/v8/v8/+/2472000

Change-Id: I1dce1dcdcc80897371c122aa73ef8fc290e923ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491600
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70699}
2020-10-22 08:59:42 +00:00
Seth Brenith
50d474a268 [torque] Strict verification of abstract types
Originally, the Torque-generated verifier for a field with type
Undefined|Zero|NonNullForeign would check `f.IsUndefined() || f.IsZero()
|| f.IsNonNullForeign()`. At some point, we changed Torque so that it
now generates the much weaker `f.IsOddball() || f.IsSmi() ||
f.IsForeign()`. This change returns the verifiers to their initial
precision. Mostly we can use the names of abstract types to build up the
correct type check expression, but a few abstract types like
PodArrayOfWasmValueType have no way that we can tell them apart from
their parent type at runtime. It would be confusing to have a function
Object::IsPodArrayOfWasmValueType which actually just checks whether the
object is a ByteArray, so this change introduces a new annotation which
allows abstract type declarations to state that they should use their
parent type during verification.

This change also adds new test cases to help avoid future regressions of
this logic.

Bug: v8:7793
Change-Id: Ie5046d742fd45e0e0f6c2ba387d909e9f2ac6df1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469960
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#70698}
2020-10-22 08:52:24 +00:00
Sathya Gunasekaran
bcfb8e3fc5 Revert "[ic] Append deprecated maps after appending new map"
This reverts commit 517a306933.

Reason for revert: regresses perf

Original change's description:
> [ic] Append deprecated maps after appending new map
>
> Previously, we would append the deprecated maps and then append the
> new valid map causing minimorphic map checks to miss this new map in
> the case that we exceeded the FLAG_max_minimorphic_map_checks size.
>
> Bug: v8:10582
> Change-Id: Ie3d7da73f7bdbdd822241fae7879817889a72b43
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2484513
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70676}

TBR=mythria@chromium.org,gsathya@chromium.org

Change-Id: Ifcb45e2cca16929f9f43f0116994f913bfb34730
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10582
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491281
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70697}
2020-10-22 07:34:24 +00:00
v8-ci-autoroll-builder
566947abec Update V8 DEPS.
Rolling v8/build: c052192..27ce505

Rolling v8/third_party/aemu-linux-x64: exAX_yeKLNYEK0NGmhD6PCExVZm6XY2aCPioGGLAHlYC..dfMpR8E7Ie1gS4Mf_DWloGOmZIegnZWNA0kcMr7jPlkC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2fb0633..982bf51

Rolling v8/third_party/depot_tools: 792630c..b3a1dba

Rolling v8/tools/clang: 3491655..df55bc4

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I50db9e4abf83b5b27e8caa31c8c02be6e4f6c485
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2490826
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70696}
2020-10-22 03:40:31 +00:00
Zhao Jiazhong
dfb2f77e18 [mips][TurboProp] Avoid marking the output of a call live in its catch handler
Port 0403beb4bb
https://chromium-review.googlesource.com/c/v8/v8/+/2479009

Bug: v8:9684
Change-Id: I26762154dd24bd50f6277bad842352ca83b64cb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489339
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70695}
2020-10-22 01:09:51 +00:00
Bill Budge
7f01d6ff41 Revert "[wasm-simd] Add more tests for v128 load zero"
This reverts commit 61b56d1650.

Reason for revert: Breaks tests on MSVC bot:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20-%20msvc/15485

Original change's description:
> [wasm-simd] Add more tests for v128 load zero
>
> Add tests for all valid alignments, and using memarg immediate offset
> instead of i32 index.
>
> Also randomize the memory to help catch cases where we are loading more
> than we should, and accidentally get correct values with zero-ed memory.
>
> Bug: v8:10713
> Change-Id: I443c2799ba0d539bf23c63760c08e18c4d36607f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487880
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70693}

TBR=bbudge@chromium.org,zhin@chromium.org

Change-Id: I9391c5e948c528f00dc966bbf33f709da30d1b17
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10713
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2490479
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70694}
2020-10-22 01:08:44 +00:00
Ng Zhi An
61b56d1650 [wasm-simd] Add more tests for v128 load zero
Add tests for all valid alignments, and using memarg immediate offset
instead of i32 index.

Also randomize the memory to help catch cases where we are loading more
than we should, and accidentally get correct values with zero-ed memory.

Bug: v8:10713
Change-Id: I443c2799ba0d539bf23c63760c08e18c4d36607f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487880
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70693}
2020-10-22 00:54:21 +00:00
Shu-yu Guo
81d168d012 Implement string literal module export names
Implements https://github.com/tc39/ecma262/pull/2154, which allows
module export names to be string literals.

Semantics highlights:
  - It is a SyntaxError for string literal export names to have unpaired
    UTF16 surrogates.
  - It is a SyntaxError for string literal export names to be used as
    the local name without being followed by a 'from' clause. For example,
    `export { "foo" }` and `export { "foo" as "bar" }` are errors, but
    `export { "foo" } from "./module.js"` is allowed.

The remaining failing test262 test is wrong:
https://github.com/tc39/test262/issues/2866

Bug: v8:10964
Change-Id: Ib3e06e1ee6b3f1b60ed7f24e21902e17ddfc0351
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2482335
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70692}
2020-10-21 21:39:10 +00:00
Andreas Haas
757f043130 [wasm] Enable --wasm-opt
This CL enables basic optimizations in TurboFan for WebAssembly code,
like dead code elimination (DeadCodeElimination), constant folding
(MachineOperatorReducer), and control flow optimizations
(CommonOperatorReducer).

These optimizations were disabled originally to improve startup time,
at the expense of slower generated code. However, with Liftoff as the
baseline compiler, startup time is not so important anymore for
TurboFan.

R=clemensb@chromium.org
CC=manoskouk@chromium.org

Change-Id: I2a81f66929c43fbbdfc3625359772c8ea0f2235f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488684
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70691}
2020-10-21 19:05:39 +00:00
Ng Zhi An
b49a04a6c8 [x64] Introduce helpers to print xmm operands
XMM registers/operands can be mixed with normal operands. We introduce 4
new enums to handle this case:

- xmmreg, oper
- oper, xmmreg
- xmmreg, xmmoper
- xmmoper, xmmreg

The different between op and xmmop is what type of register to print if
the modrm byte ends up decoding into a register.

The only difference between the output of the DisasmX64 test is pinsrd,
pinsrq, and pshuflw which had extras spaces. This is fixed with this
patch.

Test: cctest test-disasm-x64/DisasmX64 --random-seed=-1547905187

Bug: v8:10933
Change-Id: I2904c0fe83579e8df83ff2f304409278f1874c2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480619
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70690}
2020-10-21 19:01:19 +00:00
Milad Fa
195b9dfd57 PPC: [regexp] Use cmp to compare large backtrack_limit inputs
cmpi only takes in a 16 bit signed integer. For larger
inputs we must use cmp with a register input.

Change-Id: I318d714930553fbad4c34097c7530055308f331a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2490460
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70689}
2020-10-21 17:50:59 +00:00
Milad Fa
ff9c41bb38 [wasm-simd] Prototype load32_zero and load64_zero on BE machines
Bug: v8:10713
Change-Id: I8d909ae13aecf113e1082a0f29392c169eee8aaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487480
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70688}
2020-10-21 17:42:19 +00:00
Seth Brenith
e1fff28b49 [wasm][arm64] Fix crash on atomic cmpxchg with large offset
Liftoff can currently run out of registers when compiling an atomic
compare-exchange instruction. In order to see this crash, the following
conditions must be met:

- The offset in the instruction doesn't fit in a 12-bit immediate
- Either FLAG_untrusted_code_mitigations is false, or trap handlers are
  enabled, so that AddMemoryMasking decides to do nothing

The fix proposed in this CL is just to defer allocation of a temporary
register until after CalculateActualAddress has finished, because it
might have also needed a temporary register.

Change-Id: I28225614dcdbe2bcc9e52208f1e806baac89c5f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488840
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70687}
2020-10-21 17:02:59 +00:00
Clemens Backes
90a18f42d0 [wasm][cleanup] Use GraphAssembler for number conversions
Using the GraphAssembler instead of creating nodes "manually" results in
much smaller code. This allows us then to use ternary operators to make
the implementation even more concise.

R=ahaas@chromium.org

Bug: v8:10123
Change-Id: I154ffb436f414da14e932138911f35d251363083
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489686
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70686}
2020-10-21 16:44:29 +00:00
Santiago Aboy Solanes
0b5ceda473 [unwinder] Copy constructor cleanups
There were some cleanups to be done after crrev.com/c/v8/v8/+/2472000/
was merged.

Bug: v8:10799
Change-Id: I09bc2d123f89b88c74c3aecfa97c82d1925a1f2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488686
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70685}
2020-10-21 16:00:09 +00:00
Manos Koukoutos
cf1bb76181 [wasm] Emit error for invalid memory limits flag
Additional changes:
- Add reproducing unit test.
- Add parsed memory limit flag to error message.
- Improve naming in memory API in wasm-module-builder.js.

Change-Id: Id9ec5750cdc03560874e6c0219741127182e0c9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485227
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70684}
2020-10-21 15:50:19 +00:00
Almothana Athamneh
cd988502a4 Whitespace CL
NOTRY=true

Bug: v8:11037
Change-Id: I8c97d9d83dc4e9ff935b8e70ff33002c4e5d19bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489690
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70683}
2020-10-21 13:46:19 +00:00
Manos Koukoutos
33298c6d6f [wasm] Rename and change message for TypeError trap
This trap now used for all runtime type errors thrown when interfacing
with JS. Its name and message have been changed to reflect this.

Additional change: Remove the trap from the list of traps used
exclusively for RuntimeError (as opposed to TypeError) in
wasm-module-builder.js.

Change-Id: I517766837a60d94b562d4c0de922d52db786b635
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488688
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70682}
2020-10-21 13:37:49 +00:00
Milad Fa
370f64c0c9 PPC/s390: [unwinder] Restore callee saved registers after unwinding in arm32
Port d6c586f756

R=solanes@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I73098589bc2246e389432be18b11bcf3242df308
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488021
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70681}
2020-10-21 13:15:29 +00:00
Michael Lippautz
e3b55b3745 cppgc: Allow MarkingVerifier to be specialized for unified heap
Follow the marker pattern where actual logic is moved into a dedicated
state class and the visitors merely forward to that class.

Change-Id: Id3c6b7414343da82759bdba3dbb8286adee44cf4
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480502
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70680}
2020-10-21 12:58:49 +00:00
Martin Bidlingmaier
8ed25cf306 [regexp] Add regression test for chromium:1139782
Bug: chromium:1139782,v8:10765
Change-Id: I417cd037b2587599b925cce08d8652b2df1985ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488687
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Cr-Commit-Position: refs/heads/master@{#70679}
2020-10-21 11:43:09 +00:00
Liu Yu
d7d629d77b [mips64][wasm][liftoff] Implement write barrier for global.set on mips64 platform
R=thibaudm@chromium.org, ulan@chromium.org

Bug: v8:7581
Change-Id: Id984082bf0219e8edc70945536d82d523411cf78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488845
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70678}
2020-10-21 11:16:38 +00:00
Camillo Bruni
77c8a3ce19 [tools] Improve system-analyzer map view
- Limit transition view to 200 maps
- Avoid displaying parent maps multiple times
- Fix timeline-track selection, slow dragging works now

Bug: v8:10644
Change-Id: I2106ea8240977e0ea65083d296977ab0272304d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485851
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70677}
2020-10-21 10:59:49 +00:00
Sathya Gunasekaran
517a306933 [ic] Append deprecated maps after appending new map
Previously, we would append the deprecated maps and then append the
new valid map causing minimorphic map checks to miss this new map in
the case that we exceeded the FLAG_max_minimorphic_map_checks size.

Bug: v8:10582
Change-Id: Ie3d7da73f7bdbdd822241fae7879817889a72b43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2484513
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70676}
2020-10-21 10:41:22 +00:00
Omer Katz
346b7937d9 cppgc: Support allocation with additional bytes
Bug: chromium:1056170
Change-Id: I548f27d29250f0e5ca01c8ec30cc2a85eee92f52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488681
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70675}
2020-10-21 08:50:58 +00:00
Marja Hölttä
7cd040a164 [runtime callstats] Helpers for using runtime callstats in mjsunit tests
Change-Id: I1b350c797093454b0b64dca81ed1d28c35d3ada1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488685
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70674}
2020-10-21 08:43:09 +00:00
Martin Bidlingmaier
1e0b92aea9 [regexp] Increase number of backtracks before fallback
This commit increases the number of backtracks before we fall back to
the experimental engine.  The previous limit was reached just before
irregexp finished in sunspider/string-tagcloud and
web-tooling-benchmark/coffeescript.  This meant that we aborted
execution and started over with a slower (but asymptotically faster)
engine just before we would've finished, causing a performance
regression.

Bug: chromium:1138975,v8:10765
Change-Id: I10a4b149300f88680084604310730ee91758bfa0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2479010
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70673}
2020-10-21 08:05:48 +00:00
Jakob Gruber
c7cb9beca1 Reland "Reland "[deoptimizer] Change deopt entries into builtins""
This is a reland of fbfa9bf4ec

The arm64 was missing proper codegen for CFI, thus sizes were off.

Original change's description:
> Reland "[deoptimizer] Change deopt entries into builtins"
>
> This is a reland of 7f58ced72e
>
> It fixes the different exit size emitted on x64/Atom CPUs due to
> performance tuning in TurboAssembler::Call. Additionally, add
> cctests to verify the fixed size exits.
>
> Original change's description:
> > [deoptimizer] Change deopt entries into builtins
> >
> > While the overall goal of this commit is to change deoptimization
> > entries into builtins, there are multiple related things happening:
> >
> > - Deoptimization entries, formerly stubs (i.e. Code objects generated
> >   at runtime, guaranteed to be immovable), have been converted into
> >   builtins. The major restriction is that we now need to preserve the
> >   kRootRegister, which was formerly used on most architectures to pass
> >   the deoptimization id. The solution differs based on platform.
> > - Renamed DEOPT_ENTRIES_OR_FOR_TESTING code kind to FOR_TESTING.
> > - Removed heap/ support for immovable Code generation.
> > - Removed the DeserializerData class (no longer needed).
> > - arm64: to preserve 4-byte deopt exits, introduced a new optimization
> >   in which the final jump to the deoptimization entry is generated
> >   once per Code object, and deopt exits can continue to emit a
> >   near-call.
> > - arm,ia32,x64: change to fixed-size deopt exits. This reduces exit
> >   sizes by 4/8, 5, and 5 bytes, respectively.
> >
> > On arm the deopt exit size is reduced from 12 (or 16) bytes to 8 bytes
> > by using the same strategy as on arm64 (recalc deopt id from return
> > address). Before:
> >
> >  e300a002       movw r10, <id>
> >  e59fc024       ldr ip, [pc, <entry offset>]
> >  e12fff3c       blx ip
> >
> > After:
> >
> >  e59acb35       ldr ip, [r10, <entry offset>]
> >  e12fff3c       blx ip
> >
> > On arm64 the deopt exit size remains 4 bytes (or 8 bytes in same cases
> > with CFI). Additionally, up to 4 builtin jumps are emitted per Code
> > object (max 32 bytes added overhead per Code object). Before:
> >
> >  9401cdae       bl <entry offset>
> >
> > After:
> >
> >  # eager deoptimization entry jump.
> >  f95b1f50       ldr x16, [x26, <eager entry offset>]
> >  d61f0200       br x16
> >  # lazy deoptimization entry jump.
> >  f95b2b50       ldr x16, [x26, <lazy entry offset>]
> >  d61f0200       br x16
> >  # the deopt exit.
> >  97fffffc       bl <eager deoptimization entry jump offset>
> >
> > On ia32 the deopt exit size is reduced from 10 to 5 bytes. Before:
> >
> >  bb00000000     mov ebx,<id>
> >  e825f5372b     call <entry>
> >
> > After:
> >
> >  e8ea2256ba     call <entry>
> >
> > On x64 the deopt exit size is reduced from 12 to 7 bytes. Before:
> >
> >  49c7c511000000 REX.W movq r13,<id>
> >  e8ea2f0700     call <entry>
> >
> > After:
> >
> >  41ff9560360000 call [r13+<entry offset>]
> >
> > Bug: v8:8661,v8:8768
> > Change-Id: I13e30aedc360474dc818fecc528ce87c3bfeed42
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465834
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#70597}
>
> Tbr: ulan@chromium.org, tebbi@chromium.org, rmcilroy@chromium.org
> Bug: v8:8661,v8:8768,chromium:1140165
> Change-Id: Ibcd5c39c58a70bf2b2ac221aa375fc68d495e144
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485506
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70655}

Tbr: ulan@chromium.org, tebbi@chromium.org, rmcilroy@chromium.org
Bug: v8:8661
Bug: v8:8768
Bug: chromium:1140165
Change-Id: I471cc94fc085e527dc9bfb5a84b96bd907c2333f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488682
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70672}
2020-10-21 06:01:38 +00:00
v8-ci-autoroll-builder
b745392745 Update V8 DEPS.
Rolling v8/build: d68ca6a..c052192

Rolling v8/third_party/aemu-linux-x64: Dg0s5PKnfzzCVjDNe8EuKAnOGVVpKvB-dKqia-IpGkgC..exAX_yeKLNYEK0NGmhD6PCExVZm6XY2aCPioGGLAHlYC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d384f36..2fb0633

Rolling v8/third_party/icu: 84fb34e..715ec35

Rolling v8/tools/clang: 4135c06..3491655

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Icadb0aebf416c8e32a57ddd4108402848a22e046
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487976
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70671}
2020-10-21 03:53:38 +00:00
Milad Fa
534bd6ee6d [wasm-simd] Fix interpreter implementation on BE
Change-Id: I8a9322ef3c7ebaa4f8827a65dca3215f16d70454
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488024
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70670}
2020-10-21 00:01:08 +00:00
Edward Lesmes
e5c6a3bd75 Add DIR_METADATA files to v8.
Generate DIR_METADATA files and remove metadata from OWNERS
files for v8.

R=jkummerow@chromium.org, ochang@chromium.org, yangguo@chromium.org

Bug: chromium:1113033
Change-Id: I82cbb62e438d82dbbc408e87120af39fa9da0afa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476680
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Edward Lesmes <ehmaldonado@chromium.org>
Auto-Submit: Edward Lesmes <ehmaldonado@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70669}
2020-10-20 22:12:28 +00:00
Omer Katz
75049771c3 cppgc, heap: Add Clear and IsEmpty methods to Worklist::Local
Bug: v8:10990
Change-Id: I5166d9ecd6d8d8c55ecb17015d99d88ed60effa2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488680
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70668}
2020-10-20 21:59:38 +00:00
Ng Zhi An
7da1a952c7 [wasm-simd] Add OOB tests for v128 load zero
Bug: v8:10713
Change-Id: I7b123347e00f31d071d45e3b807354610b71ed2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2486238
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70667}
2020-10-20 21:04:53 +00:00
Ng Zhi An
83348261fc [wasm-simd] Fix typo in ext mul interpreter implementation
There is a typo getting the values of the lanes, only on big-endian
systems. (On little-endian systems, the use of LANE macro hides the
error).

Bug: v8:11008
Change-Id: I99efde506dab443efd336346ec920fcd957daae2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2486614
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70666}
2020-10-20 21:03:48 +00:00
Ng Zhi An
68e8621d7e Use safe conversion helper to check conversion limits
This is similar to https://crrev.com/c/2466377, for all other checks for
numeric_limits found in the same file.

The check for float/double to uint32/uint64 doesn't seem to be
replaceable, due to this check:
https://source.chromium.org/chromium/chromium/src/+/master:v8/src/base/safe_conversions_impl.h;l=361;drc=c10c83c31ba0b774c3c05c73bb4894ba2495394b
We probably need something specific for converting to float/doubles.
I'll leave those as they are first.

Bug: v8:10933
Change-Id: I5ea95fd04caa7b5963bb3cb8e5870cd8e790fb19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2477039
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70665}
2020-10-20 17:45:48 +00:00
Pierre Langlois
402806e87f [cppgc][unittests] Only expect guard pages support on 4k platforms.
Arm64 supports 16k and 64k OS pages, in which case the CPPGC doesn't use
guard pages.

Bug: v8:10808
Change-Id: I36efba687c50b348eda62e9f9094b57bd58b55b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485494
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70664}
2020-10-20 16:54:38 +00:00
Victor Gomes
958d8e9f32 Reland "[ia32] Remove arguments adaptor frame"
This is a reland of 403390ec60

Original change's description:
> [ia32] Remove arguments adaptor frame
>
> Change-Id: Id66d2c57fc92c00b033bc53231313f477cceca75
> Bug: v8:10201
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2448463
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70652}

Bug: v8:10201
Change-Id: I2c50b22fbe565e8ad6a510c02bfbd79c145d284e
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485225
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70663}
2020-10-20 16:14:47 +00:00
Victor Gomes
1d83f52ca9 [builtins] Fix argument size DCHECK in StringPrototypeLocaleCompare
Change-Id: I8cb9f7860bb7b3cfc8ee291910c2f219309606dd
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485224
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70662}
2020-10-20 15:34:37 +00:00
Almothana Athamneh
f1dfe854c4 stop gcc debug builder from closing the tree
Bug: v8:11037
Change-Id: I39c790bc435ab2c9fde7f17c8c6fa42a920e16d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485509
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70661}
2020-10-20 15:27:07 +00:00
Georg Neis
8f0ab47101 [ia32,x64] Make more use of the 'leave' instruction
It is a little shorter and cheaper[1] than the equivalent
"mov sp,bp; pop bp".

Also remove support for the 'enter' instruction, since
- it is unused,
- it is neither shorter nor cheaper than the corresponding
  push and mov (in fact more expensive[1]), and
- our disassembler doesn't support it.

[1] See https://www.agner.org/optimize/instruction_tables.pdf

Change-Id: I6c99c2f3e53081aea55445a54e18eaf45baa79c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2482822
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70660}
2020-10-20 15:05:07 +00:00
Shu-yu Guo
949025df1d Roll test262
ad8a5e9940..0e7319c015

Bug: v8:7834
Change-Id: If9bb92b37e6dac0b1f14b5813e56a4ed478d9b06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2486222
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70659}
2020-10-20 14:50:04 +00:00
Maya Lekova
7c7aa4fa94 Revert "Reland "[deoptimizer] Change deopt entries into builtins""
This reverts commit fbfa9bf4ec.

Reason for revert: Seems to break arm64 sim CFI build (please see DeoptExitSizeIfFixed) - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20CFI/2808

Original change's description:
> Reland "[deoptimizer] Change deopt entries into builtins"
>
> This is a reland of 7f58ced72e
>
> It fixes the different exit size emitted on x64/Atom CPUs due to
> performance tuning in TurboAssembler::Call. Additionally, add
> cctests to verify the fixed size exits.
>
> Original change's description:
> > [deoptimizer] Change deopt entries into builtins
> >
> > While the overall goal of this commit is to change deoptimization
> > entries into builtins, there are multiple related things happening:
> >
> > - Deoptimization entries, formerly stubs (i.e. Code objects generated
> >   at runtime, guaranteed to be immovable), have been converted into
> >   builtins. The major restriction is that we now need to preserve the
> >   kRootRegister, which was formerly used on most architectures to pass
> >   the deoptimization id. The solution differs based on platform.
> > - Renamed DEOPT_ENTRIES_OR_FOR_TESTING code kind to FOR_TESTING.
> > - Removed heap/ support for immovable Code generation.
> > - Removed the DeserializerData class (no longer needed).
> > - arm64: to preserve 4-byte deopt exits, introduced a new optimization
> >   in which the final jump to the deoptimization entry is generated
> >   once per Code object, and deopt exits can continue to emit a
> >   near-call.
> > - arm,ia32,x64: change to fixed-size deopt exits. This reduces exit
> >   sizes by 4/8, 5, and 5 bytes, respectively.
> >
> > On arm the deopt exit size is reduced from 12 (or 16) bytes to 8 bytes
> > by using the same strategy as on arm64 (recalc deopt id from return
> > address). Before:
> >
> >  e300a002       movw r10, <id>
> >  e59fc024       ldr ip, [pc, <entry offset>]
> >  e12fff3c       blx ip
> >
> > After:
> >
> >  e59acb35       ldr ip, [r10, <entry offset>]
> >  e12fff3c       blx ip
> >
> > On arm64 the deopt exit size remains 4 bytes (or 8 bytes in same cases
> > with CFI). Additionally, up to 4 builtin jumps are emitted per Code
> > object (max 32 bytes added overhead per Code object). Before:
> >
> >  9401cdae       bl <entry offset>
> >
> > After:
> >
> >  # eager deoptimization entry jump.
> >  f95b1f50       ldr x16, [x26, <eager entry offset>]
> >  d61f0200       br x16
> >  # lazy deoptimization entry jump.
> >  f95b2b50       ldr x16, [x26, <lazy entry offset>]
> >  d61f0200       br x16
> >  # the deopt exit.
> >  97fffffc       bl <eager deoptimization entry jump offset>
> >
> > On ia32 the deopt exit size is reduced from 10 to 5 bytes. Before:
> >
> >  bb00000000     mov ebx,<id>
> >  e825f5372b     call <entry>
> >
> > After:
> >
> >  e8ea2256ba     call <entry>
> >
> > On x64 the deopt exit size is reduced from 12 to 7 bytes. Before:
> >
> >  49c7c511000000 REX.W movq r13,<id>
> >  e8ea2f0700     call <entry>
> >
> > After:
> >
> >  41ff9560360000 call [r13+<entry offset>]
> >
> > Bug: v8:8661,v8:8768
> > Change-Id: I13e30aedc360474dc818fecc528ce87c3bfeed42
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465834
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#70597}
>
> Tbr: ulan@chromium.org, tebbi@chromium.org, rmcilroy@chromium.org
> Bug: v8:8661,v8:8768,chromium:1140165
> Change-Id: Ibcd5c39c58a70bf2b2ac221aa375fc68d495e144
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485506
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70655}

TBR=ulan@chromium.org,rmcilroy@chromium.org,jgruber@chromium.org,tebbi@chromium.org

Change-Id: I4739a3475bfd8ee0cfbe4b9a20382f91a6ef1bf0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8661
Bug: v8:8768
Bug: chromium:1140165
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485223
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70658}
2020-10-20 14:14:12 +00:00