Commit Graph

58799 Commits

Author SHA1 Message Date
Sigurd Schneider
0d7889d0b1 [coverage] Correctly report coverage for inline scripts
This fixes a bug where coverage for the inline script
  <script>function foo() {}<script>
started to get deterministically reported as covered
after crrev.com/c/1771776, while before it, we most of
the time reported it as uncovered (depending on heap
order of SFIs). The correct result is to report `foo`
as uncovered as it is never called.

The problem arose from the fact that v8:9212 needed to
handle extra-wrappers around scripts correctly. Those
wrappers have the same source range as the wrapped
script and a call count of zero even if the wrapped
script is executed. To filter them out, we previously
determined nesting for identical source ranges by
ascending call count. However, in the script case above,
the script has call count one, while `foo` (which has
the same source range) has call count zero. In this
case, nesting is decreasing order of call counts.

This CL is a minimal change that sorts SFIs which are
top-level to the front, only then considers call counts
in descending order. This preserves the behavior that
node's extra wrappers are sorted to the front (and
then filtered out by existing logic), but also ensures
that for the example above, we report the script's
coverage before the coverage for `foo`.


Bug: v8:9857, v9:9212
Change-Id: Id224b0d8f12028b1f586ee5039e126bb5b8d8d36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863197
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64307}
2019-10-16 08:23:55 +00:00
Jakob Gruber
ed40ab1583 [regexp] Fix the order of named captures on the groups object
Named capture properties on the groups object should be ordered by the
capture index (and not alpha-sorted). This was accidentally broken in
https://crrev.com/c/1687413.

Bug: v8:9822,v8:9423
Change-Id: Iac6f866f077a1b7ce557ba47e8ba5d7e7014b3ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864829
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64306}
2019-10-16 07:37:05 +00:00
Simon Zünd
69efc4c34c Reland "Unconditionally enable snapshot builds and remove 'v8_use_snapshot'"
This is a reland of 1c56974f2a

This is a plain reland of the original CL. The original CL was speculatively
reverted, but ended up not being the cause for bot failures.

Original change's description:
> Unconditionally enable snapshot builds and remove 'v8_use_snapshot'
>
> This CL removes 'v8_use_snapshot' and the usages of the implied
> V8_USE_SNAPSHOT define. One test runner unittest was updated to use the
> "asan" variant instead of the now obsolete "no_snap" variant.
>
> Related chromium CL: https://crrev.com/c/1796325.
>
> Bug: v8:8531
> Change-Id: I5da7c9f8e9110fe7bc0f4e4f821bcb7f7d98f927
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1784282
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Nico Weber <thakis@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64290}

TBR=thakis@chromium.org,machenbach@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,tmrts@chromium.org,szuend@chromium.org

Bug: v8:8531
Change-Id: Id75a802279238138f7aefec62e0b6425a5acc08d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864649
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64305}
2019-10-16 06:01:05 +00:00
v8-ci-autoroll-builder
17e34307c7 Update V8 DEPS.
Rolling v8/build: c1d5d48..082f11b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0b36537..b9fad2f

Rolling v8/third_party/depot_tools: c651221..ba97f60

Rolling v8/tools/clang: 6bc727d..c5d85f1

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Icd2741e2b01d6b49153dcee23c63883f8bf78193
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863442
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#64304}
2019-10-16 03:33:44 +00:00
Z Nguyen-Huu
958616da50 [builtins] Port RegExpExec function to Torque
Bug: v8:8976
Change-Id: I992b5527fc1d8f58b2fdb5a212651a933c25f856
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860998
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64303}
2019-10-16 01:07:53 +00:00
Deepti Gandluri
9a9fc1c112 [wasm-simd] Add AVX codegen for most I32x4 SIMD ops
Bug: v8:9854
Change-Id: Icb41622caa4a7e0a7262048f69b40cfbe8fa17bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860406
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64302}
2019-10-15 21:27:04 +00:00
Milad Farazmand
c314cf7466 PPC/s390: [Liftoff] Improve initialization for many locals
Port a8cdda9947

Original Commit Message:

    WebAssembly locals are specified to be zero on function entry. Liftoff
    implements this by just storing the constant 0 in the virtual stack for
    integer types, and using one floating point register initialized to
    zero for all floating point types.
    For big counts of locals this leads to problems (manifesting as huge
    blocks of code being generated) once we hit a merge point: All those
    constants (for int) and all duplicate register uses (for floats) need to
    be fixed up, by using separate registers for the locals or spilling to
    the stack if no more registers are available. All this spilling
    generates a lot of code, and can even happen multiple times within a
    function.

    This CL optimizes for such cases by spilling all locals to the stack
    initially. All merges within the function body get much smaller then.
    The spilled values rarely have to be loaded anyway, because the initial
    zero value is usually overwritten before the first use.

    To optimize the code size for initializing big numbers of locals on the
    stack, this CL also introduces the platform-specific
    {FillStackSlotsWithZero} method which uses a loop for bigger local
    counts.

    This often saves dozens of kilobytes for very big functions, and shows
    an overall code size reduction of 4-5 percent for big modules.

R=clemensb@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2459080a1f6acfdd212e9a93a868d028980c5554
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863370
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64301}
2019-10-15 17:50:29 +00:00
Adam Klein
e359c49b9d Add verwaest as an API owner
Previous API owners (adamk, yangguo) are less-involved with the JS API
then ever, so it seems appropriate to have an owner whose responsibility
is squarely in the JS domain.

Change-Id: I4235778fda8f55d0429e875d52ff74049024dad1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860328
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64300}
2019-10-15 17:40:59 +00:00
Sathya Gunasekaran
586ec99bf9 Revert "[runtime] Move Context::native_context to the map"
This reverts commit f05bae1e0d.

Reason for revert: broke arm sim debug
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/17714

https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8899519852984476944/+/steps/Check_-_trusted/0/logs/FunctionDetailsInlining/0

Original change's description:
> [runtime] Move Context::native_context to the map
> 
> Remove the native context slot from contexts by making context maps
> native-context-specific. Now we require 2 loads to go from a context to the
> native context, but we have 1 field fewer to store when creating contexts.
> 
> Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64296}

TBR=ulan@chromium.org,neis@chromium.org,petermarshall@chromium.org,ishell@chromium.org,verwaest@chromium.org,mslekova@chromium.org,victorgomes@google.com

Change-Id: Ie7b4086c3a9ab2627ecac599da36b20cf8d1f948
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863200
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64299}
2019-10-15 16:31:09 +00:00
Michael Starzinger
2e44cf7d64 [wasm] Remove dead declarations in wasm-module.h file.
R=clemensb@chromium.org

Change-Id: I9dab61c4260436d08171ac0ff084e05d75c5c5e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862573
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64298}
2019-10-15 15:57:40 +00:00
Dan Elphick
fe7f74e8aa [cleanup] Fix missing overrides on virtual functions
Add overrides to port specific assemblers and delete redundant empty
override.

Bug: v8:9810
Change-Id: I17e4614e06783867ae50e87bba83d35ebc9d0b51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862567
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64297}
2019-10-15 15:07:11 +00:00
Toon Verwaest
f05bae1e0d [runtime] Move Context::native_context to the map
Remove the native context slot from contexts by making context maps
native-context-specific. Now we require 2 loads to go from a context to the
native context, but we have 1 field fewer to store when creating contexts.

Change-Id: I3c0d7c50c94060c4129db684f46a567de6f30e8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859629
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64296}
2019-10-15 15:01:13 +00:00
Michael Achenbach
32ef0127fb Whitespace change to trigger builders
Change-Id: I3520bce4cc3ac2db55891b1ebe52782566d98f90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863189
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64295}
2019-10-15 14:41:50 +00:00
Seth Brenith
386ed8a9a0 Update postmortem tools to use unsigned compressed pointers
The tests were already passing because they happened to use objects
allocated in the lower half of the heap reservation, but this small
change should make behavior more consistent.

Change-Id: Ib6be3123d347234f4771c213f2209bfe6e19c569
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860332
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#64294}
2019-10-15 14:39:10 +00:00
Clemens Backes
609f566b34 Revert "Unconditionally enable snapshot builds and remove 'v8_use_snapshot'"
This reverts commit 1c56974f2a.

Reason for revert: Causes several bots to timeout, e.g. https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/27945

Original change's description:
> Unconditionally enable snapshot builds and remove 'v8_use_snapshot'
> 
> This CL removes 'v8_use_snapshot' and the usages of the implied
> V8_USE_SNAPSHOT define. One test runner unittest was updated to use the
> "asan" variant instead of the now obsolete "no_snap" variant.
> 
> Related chromium CL: https://crrev.com/c/1796325.
> 
> Bug: v8:8531
> Change-Id: I5da7c9f8e9110fe7bc0f4e4f821bcb7f7d98f927
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1784282
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Nico Weber <thakis@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64290}

TBR=thakis@chromium.org,machenbach@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,tmrts@chromium.org,szuend@chromium.org

Change-Id: I4024d818877e534b9f7908a2d14f33dca35b5924
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8531
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862572
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64293}
2019-10-15 14:20:52 +00:00
Clemens Backes
5c20da0768 [Liftoff] Merge i32.eqz and br_if instructions
We currently generate code for both separately, resulting in five
instructions (three for the i32_eqz, two for the br_if):
  test rax,rax
  seteq dl
  movzxb rdx,rdx
  test rdx,rdx
  jz <label>

After this CL, we just generate two instructions:
  test rax, rax
  jnz <label>

This is implemented by a look-ahead in the {kExprI32Eqz} handler. If the
opcode is followed by {kExprBrIf}, no code is emitted. Instead, a flag in
the {LiftoffCompiler} is set to signal to the {kExprBrIf} handler that
the previous instruction was not processed yet.
Note that this mechanism is designed to be reusable for more similar
improvements. For the single instance implemented in this CL, it is not
needed.

Plus some drive-by cleanup.

R=jkummerow@chromium.org

Bug: v8:9831
Change-Id: I47495fe763b7db7cef41aa207c88a2f1b74bf1a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862557
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64292}
2019-10-15 13:41:40 +00:00
Ulan Degenbaev
9de61eb477 [asmjs] Disallow AsmJs instantiation from a SharedArrayBuffer.
AsmJs does not support SharedArrayBuffers. This CL adds a check in
instantiation and reports a proper error.

Bug: chromium:1013920
Change-Id: Id7159f23ddcc2bde139c4c97bdb67ef3dc7f0e22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862563
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64291}
2019-10-15 12:45:29 +00:00
Simon Zünd
1c56974f2a Unconditionally enable snapshot builds and remove 'v8_use_snapshot'
This CL removes 'v8_use_snapshot' and the usages of the implied
V8_USE_SNAPSHOT define. One test runner unittest was updated to use the
"asan" variant instead of the now obsolete "no_snap" variant.

Related chromium CL: https://crrev.com/c/1796325.

Bug: v8:8531
Change-Id: I5da7c9f8e9110fe7bc0f4e4f821bcb7f7d98f927
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1784282
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64290}
2019-10-15 12:44:24 +00:00
Igor Sheludko
145a8f4416 [ubsan] Fix UB in StringHasher::GetTrivialHash()
... which broke with 32-bit Smis.

Tbr: verwaest@chromium.org
No-Tree-Checks: true
Bug: v8:9767
Change-Id: I459a5d807d87012ab72138f46b49362f16b6baa1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862562
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64289}
2019-10-15 12:00:22 +00:00
Igor Sheludko
1ec2ca266f [ptr-compr] Temporarily enable double fields unboxing
We are not shipping ptr-compr in M79 on x64 because chromium:1009439
blocks 31-bit Smis on 64-bit architectures, so these's no point in
disabling double fields unboxing.

This CL will be reverted after the M79 branch point.

Bug: v8:9799, chromium:1009439
Change-Id: I28d0013d3ab06ce41d5028ba4f66c9b249de52d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862556
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64288}
2019-10-15 10:09:35 +00:00
Leszek Swirski
6a597c672a [runtime] Fix Object.assign for in-place repr changes
Fix uses of cached descriptors arrays used in loops that map-check
to ensure validity of the cache to also reload the descriptor in
case there are missed in-place representation updates.

As a drive-by, introduce inner HandleScopes for these loops.

Bug: chromium:1012301
Change-Id: I17273caf629a181b846d3c09777b5c08fd8cbb0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859621
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64287}
2019-10-15 10:01:29 +00:00
Igor Sheludko
64c09f67d2 [ptr-compr] Temporarily disable 31 bit Smis on 64-bit architectures
The reason is to unblock M79 blocked by chromium:1009439 while full
solution is not ready yet.

This CL will be reverted after the M79 branch point.

Bug: v8:9767, chromium:1009439
Change-Id: I5302d86fe953ecd94d9a4bba0d29c807b7b9d703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862554
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64286}
2019-10-15 09:39:28 +00:00
Michael Starzinger
c01bfb1650 [wasm] Remove deprecated {WasmGraphBuilder::Buffer}.
This replaces all left-over uses of {WasmGraphBuilder::Buffer} with
proper alternatives (e.g. using {base::SmallVector} instead).

R=clemensb@chromium.org

Change-Id: I2607ce7e2638a1bb35daccbb5b38382d5b62a430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859626
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64285}
2019-10-15 09:33:53 +00:00
v8-ci-autoroll-builder
d9f230a65e Update V8 DEPS.
Rolling v8/build: 4250046..c1d5d48

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/1550399..0b36537

Rolling v8/third_party/depot_tools: 5abb9b7..c651221

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ib22d731a92b9e4bec2c4cf22476f3c4e01a2c3a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860559
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64284}
2019-10-15 09:32:48 +00:00
Michael Lippautz
55be65da15 api: Rely on v8::Data base type for garbage collection support
Use v8::Data as basetype for managed objects that can integrate with
v8::EmbedderHeapTracer.

Bug: v8:9841
Change-Id: Id3e06701207a23870cea89e1d7d334c48fcd3006
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856002
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64283}
2019-10-15 09:28:28 +00:00
Clemens Backes
a8cdda9947 [Liftoff] Improve initialization for many locals
WebAssembly locals are specified to be zero on function entry. Liftoff
implements this by just storing the constant 0 in the virtual stack for
integer types, and using one floating point register initialized to
zero for all floating point types.
For big counts of locals this leads to problems (manifesting as huge
blocks of code being generated) once we hit a merge point: All those
constants (for int) and all duplicate register uses (for floats) need to
be fixed up, by using separate registers for the locals or spilling to
the stack if no more registers are available. All this spilling
generates a lot of code, and can even happen multiple times within a
function.

This CL optimizes for such cases by spilling all locals to the stack
initially. All merges within the function body get much smaller then.
The spilled values rarely have to be loaded anyway, because the initial
zero value is usually overwritten before the first use.

To optimize the code size for initializing big numbers of locals on the
stack, this CL also introduces the platform-specific
{FillStackSlotsWithZero} method which uses a loop for bigger local
counts.

This often saves dozens of kilobytes for very big functions, and shows
an overall code size reduction of 4-5 percent for big modules.

R=jkummerow@chromium.org

Bug: v8:9830
Change-Id: I23fa4145847827420f09e043a11e0e7b606e94cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856004
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64282}
2019-10-15 09:06:43 +00:00
Deepti Gandluri
12d84b69dd [wasm-simd] Add AVX codegen for some integer SIMD operations
Bug: v8:9854
Change-Id: I8450e6456321f3be2badeccac61414e005df2c65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860327
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64281}
2019-10-14 23:08:51 +00:00
Ng Zhi An
031193b4c5 [wasm-simd] Convert some codegen to use macros
The macros will use AVX variants when available.

Bug: v8:9561
Change-Id: I06872a08184983adc8018ffdf03916feac02016f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857422
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64280}
2019-10-14 20:49:35 +00:00
Z Nguyen-Huu
74996b4e8b [builtins] Port IsRegExp function to Torque
Bug: v8:8976
Change-Id: I7b215adda82f9982d38e35ab5c80c86eeca81487
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856921
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64279}
2019-10-14 18:11:13 +00:00
Ng Zhi An
d518f6dafe [wasm-simd] Implement v8x16.swizzle for arm64
Bug: v8:8460
Change-Id: I2ca4b4aa5d7755f09252bdec6885013c84ea469c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1850612
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64278}
2019-10-14 17:30:13 +00:00
Michael Starzinger
c79af35585 [wasm] Use {SmallVector} for call arguments and returns.
This switches the {WasmGraphBuilder} to use {SmallVector} for passing
argument and return values. It deprecates {WasmGraphBuilder::Buffer},
which is a dangerous construct as it makes it easy to accidentally use
the single buffer for two vectors at the same time. This also removes
the by now unused {WasmGraphBuilder::Realloc} method.

R=clemensb@chromium.org

Change-Id: I6bd9be437a99c23bb403a046a75c148ac4a14451
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859619
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64277}
2019-10-14 15:15:24 +00:00
Michael Starzinger
b67f096eb3 [wasm] Switch {GetExceptionValues} away from {Buffer}.
This switches the {WasmGraphBuilder::GetExceptionValues} to use a proper
vector instead of the deprecated {Buffer} method. This also addresses a
TODO about missing landing pads for the above affected method.

R=clemensb@chromium.org

Change-Id: I33ba7d712a00f2a284ec159a501bcd90e02a3a51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859620
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64276}
2019-10-14 14:47:23 +00:00
Milad Farazmand
a4677f3af6 [torque] explicitly constructing the std::pair
older gcc compilers (tested on PPC gcc 6) may throw the following error if
a non-copyable element is added to std::map:

src/torque/instance-type-generator.cc:192:76:   required from here
/usr/include/c++/6/ext/new_allocator.h:120:4: error: use of deleted
function 'constexpr std::pair<_T1, _T2>::pair(const std::pair<_T1, _T2>&)
[with _T1 = v8::internal::torque::{anonymous}::InstanceTypeTree* const; _T2 =
std::unique_ptr<v8::internal::torque::{anonymous}::InstanceTypeTree>]'

explicitly constructing the std::pair will fix the compilation error.

Bug: v8:9850

Change-Id: I1e69e804be8bb9c16d013a90b532d670a97ed055
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857552
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64275}
2019-10-14 14:35:23 +00:00
Tobias Tebbi
164d0d3af0 [torque] fix dangling pointer into std::vector for index fields
Bug: v8:7793

Change-Id: Id2e03e7d42aeab155572fa9cc3093dcff16f5668
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859622
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64274}
2019-10-14 14:12:33 +00:00
Clemens Backes
def681de00 [api] Deprecate old tasks API
It was marked V8_DEPRECATE_SOON in https://crrev.com/c/1261936 (part of
M-71).

R=ahaas@chromium.org, ulan@chromium.org

Bug: v8:9810
Change-Id: I64a7937b518dbf2a75361bbbecd514618922d543
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1849523
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64273}
2019-10-14 12:17:02 +00:00
Thibaud Michaud
9be57e86de [wasm][decoder] Update merge values for one-armed if blocks
R=ahaas@chromium.org

Change-Id: Iea0fe775eb8c101200fe41e5e188bbdc85c03df7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856000
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64272}
2019-10-14 11:17:00 +00:00
Michael Starzinger
47f3a53f70 [wasm] Fix bogus uses of {WasmGraphBuilder::Buffer}.
With exception handling enabled new call paths open up, which will
perform environment merging while a "call" or "call_indirect" is
currently being emitted. This will lead to double-use of the buffer
returned by calls to {Buffer} or {Realloc}. In general we should
transition away from this optimization to safer constructs such as
{base::SmallVector} to avoid such bugs.

R=clemensb@chromium.org
TEST=mjsunit/regress/regress-9832
BUG=v8:9832

Change-Id: I4c862ac1bc7dc34ad62279c82f6414153e8cbddb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1856006
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64271}
2019-10-14 09:32:37 +00:00
Tobias Tebbi
e58cd93543 [torque] fix unused code errors for code used in asserts
The assert code gets put into an unreachable block in release builds
to make sure it's type-checked and torque knows the code it contains is
used, but still it doesn't emit actual machine code.

Bug: v8:7793
Change-Id: I580fdd7ac059e0dbe85283fd35c3038634a7228e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857226
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64270}
2019-10-14 09:21:07 +00:00
Maya Lekova
31da5d197a [turbofan] Analysis of the broker Refs distribution
This analysis shows the number of used/unused refs
as well as their by-type distribution and outputs the broker zone
memory. It introduces a new flag --trace-heap-broker-memory.

Doc: https://docs.google.com/document/d/1oUMxlC2YbficEVkQ1X8TK9WNCWRmLqzDRFy4z3cJsII/edit#heading=h.3sde9siqk2yw

Bug: v8:9720
Change-Id: I4fafc225134d0548e976ce00d67bd5cabeda60c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1849526
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64269}
2019-10-14 08:10:05 +00:00
Michael Achenbach
4a1a23f093 [test] Skip slow tests
TBR=gsathya@chromium.org
NOTRY=true

Change-Id: I6ddb04fe4aec3596bfc70170310745924909de52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857222
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64268}
2019-10-14 07:37:15 +00:00
Michael Achenbach
9a035110d4 [test] Fix test-skip config
NOTRY=true
TBR=gdeepti@chromium.org

Bug: v8:9845
Change-Id: I973521ae0d1fc3706c23f664e47962ac29e0196c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857223
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64267}
2019-10-14 06:59:24 +00:00
v8-ci-autoroll-builder
754cdc6af1 Update V8 DEPS.
Rolling v8/build: 34b1290..4250046

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I774107b9e6408832b63d9171e26a3dfbf6231f79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857432
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#64266}
2019-10-14 03:19:15 +00:00
v8-ci-autoroll-builder
af86670a48 Update V8 DEPS.
Rolling v8/build: f48946c..34b1290

Rolling v8/third_party/depot_tools: 2cbae8a..5abb9b7

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ia24eb083291276b5f4e8a2535bb16e21204ee05e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857430
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#64265}
2019-10-13 03:32:23 +00:00
Michael Achenbach
ae1c62a8ef Whitespace change to test bots
TBR=santa

Change-Id: I32f9eaa4006c235064d077de47cf7ae48f881502
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857220
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64264}
2019-10-12 16:27:42 +00:00
David Carlier
1b94fcac4d Small fixes for OS::SignalCodeMovingGC on OpenBSD
This patch stores the result of sysconf() in a long integer and
checks the result of Free().

Change-Id: If77e46a2f188e6bc36ef2e98eac36bf7a7d67dff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1855942
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64263}
2019-10-12 08:51:42 +00:00
v8-ci-autoroll-builder
da34e54e2e Update V8 DEPS.
Rolling v8/build: b68f5d6..f48946c

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/788d15f..1550399

Rolling v8/third_party/depot_tools: 8e57b4b..2cbae8a

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I6f7895a5b3de6384eb0f6156b53f3945aa0667f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857426
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#64262}
2019-10-12 03:41:12 +00:00
Zhang, Shiyu
4693fdf9b7 [runtime] Add fast path for ConvertToKeysArray
... for the case we haven't seen any elements on the entire prototype chain.

Contributed by tao.pan@intel.com

Change-Id: Ied7d1a918b545e71d94ab1521bf0d233ea15cfce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1848960
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Cr-Commit-Position: refs/heads/master@{#64261}
2019-10-12 02:12:11 +00:00
Deepti Gandluri
568d510083 [test262] Skip failing related-year test on android
Bug: v8:9845
Change-Id: I638f9bc41023cd4faef46dcafe646c13f3e14573
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857208
Reviewed-by: Frank Tang <ftang@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64260}
2019-10-11 23:51:11 +00:00
Ng Zhi An
8069c8c481 [cleanup] Change scratch to temp simd register
This requires a change to instruction selector to UseUnique so that it
does not shadow the temporary register.

Bug: v8:9810
Change-Id: Iaceadbc39f0c51a92c2a73c4b1097d49a7397876
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1850614
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64259}
2019-10-11 23:14:31 +00:00
Seth Brenith
8c7ae31456 [torque] Generate instance types
Design doc:
https://docs.google.com/document/d/1ZU6rCvF2YHBGMLujWqqaxlPsjFfjKDE9C3-EugfdlAE/edit

Changes from the design doc:
- Changed to use 'class' declarations rather than 'type' declarations
  for things that need instance types but whose layout is not known to
  Torque. These declarations end with a semicolon rather than having a
  full set of methods and fields surrounded by {}. If the class's name
  should not be treated as a class name in generated output (because
  it's actually a template, or doesn't exist at all), we use the
  standard 'generates' clause to declare the most appropriate C++ class.
- Removed @instanceTypeName.
- @highestInstanceType became @highestInstanceTypeWithinParentClassRange
  to indicate a semantic change: it no longer denotes the highest
  instance type globally, but only within the range of values for its
  immediate parent class. This lets us use it for Oddball, which is
  expected to be the highest primitive type.
- Added new abstract classes JSCustomElementsObject and JSSpecialObject
  to help with some range checks.
- Added @lowestInstanceTypeWithinParentClassRange so we can move the new
  classes JSCustomElementsObject and JSSpecialObject to the beginning of
  the JSObject range. This seems like the least-brittle way to establish
  ranges that also include JSProxy (and these ranges are verified with
  static assertions in instance-type.h).
- Renamed @instanceTypeValue to @apiExposedInstanceTypeValue.
- Renamed @instanceTypeFlags to @reserveBitsInInstanceType.

This change introduces the new annotations and adds the ability for
Torque to assign instance types that satisfy those annotations. Torque
now emits two new macros:
- TORQUE_ASSIGNED_INSTANCE_TYPES, which is used to define the
  InstanceType enumeration
- TORQUE_ASSIGNED_INSTANCE_TYPE_LIST, which replaces the non-String
  parts of INSTANCE_TYPE_LIST

The design document mentions a couple of other macro lists that could
easily be replaced, but I'd like to defer those to a subsequent checkin
because this one is already pretty large.

Bug: v8:7793
Change-Id: Ie71d93a9d5b610e62be0ffa3bb36180c3357a6e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1757094
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64258}
2019-10-11 22:37:22 +00:00