Commit Graph

74827 Commits

Author SHA1 Message Date
Jakob Gruber
2f4b0737e2 [osr] Relaxed accessors for Code::osr_offset
.. since they may be written from background threads (for SP concurrent
codegen).

Bug: v8:12161
Fixed: chromium:1319857
Change-Id: I11860137ea4d79645821df69e61b62836f7c8283
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605818
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80185}
2022-04-26 13:35:12 +00:00
jameslahm
823a221a36 [web-snapshot] Allocate Context after setting up ScopeInfo
... in DeserializeContexts.

Allocate the context before filling the scope info with the correct
variable name may cause DCHECK failure in TorqueGeneratedClassVerifiers::ScopeInfoVerify.
This CL changes the context variables serialization order from
"name, value, name, value" to "name, name... value, value...".
And only allocate and fill the context after setting up the correct
scope info.

Bug: v8:12832
Change-Id: I6e91aa867a528b7ffcae85de0f2364d0f9ea1bd7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607374
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80184}
2022-04-26 12:52:45 +00:00
Patrick Thier
fa1caae9ea Reland "[string] Non-transitioning shared strings"
This is a reland of commit 8ba60b7a8e

Changes to original:
- Weaken DCHECK in MakeThin to allow direct transitions of shared
  strings during deserialization. This is safe as the string to be
  transitioned is freshly created and hasn't escaped the thread yet.
  - To enable this, add has_active_deserializer() to LocalIsolate

- Shared thin string transitions are subject to the same layout changes
  as non-shared thin string transitions, thus treat them equally when
  checking if a map transition is safe.

Original change's description:
> [string] Non-transitioning shared strings
>
> Instead of transitioning shared strings to ThinString on
> internalization, use a forwarding table to the internalized string and
> store the index into the forwarding table in the string's hash field.
>
> This way we don't need to handle concurrent string transitions that
> modify the underlying string data.
>
> During stop-the-world GC, live strings in the forwarding table are
> migrated to regular ThinStrings.
>
> Bug: v8:12007
> Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79801}

Bug: v8:12007
Change-Id: I022e5c4768b763a86bb28c9c82218c3b807371a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571817
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80183}
2022-04-26 11:56:15 +00:00
Andreas Haas
3790b0edd8 [wasm] Update spec tests
Drive-by change: fix stray "//".

R=clemensb@chromium.org

Change-Id: I614bbc545ab8cd803f0c64f04e01fa55c4c2ec7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605610
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80182}
2022-04-26 11:55:12 +00:00
Clemens Backes
40036a1e41 [wasm] Implement cached PKU-protected assembler buffers
This adds the implementation of the {AssemblerBufferCache} class.
PKU-protected memory is allocated via the {WasmCodeManager}, which has
access to the actual protection key.

R=thibaudm@chromium.org

Bug: v8:12809
Change-Id: Id26abd6f98248d5c646ae337ccb903d3e168bed1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593137
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80181}
2022-04-26 11:29:52 +00:00
Clemens Backes
393cf994af [liftoff] Use kSimd bailout reason consistently
Other places use the {kSimd} bailout reason for bailouts because of
missing CPU support for SIMD. We should do the same when encountering
SIMD locals or parameters.

R=thibaudm@chromium.org

Change-Id: I7ea6ff32927a035cdafe437d581a79f67ff0b30f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605243
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80180}
2022-04-26 11:22:32 +00:00
Jakob Kummerow
bac984e69a [wasm-gc] Fix roundtrips of JS functions through Wasm
When passing anyref-typed things to Wasm, we cannot expect that
all functions are WasmExternalFunctions. Instead of adding a
relatively expensive type check to such calls, this patch disables
function unwrapping for anyref-typed values.

Fixed: v8:12789
Change-Id: Ied57187bac7fde0326634f7b4fc428ad21dc9c2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605231
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80179}
2022-04-26 11:02:22 +00:00
Victor Gomes
755b7d863f [maglev] Add Box/UnboxNumbers and Float64Add nodes
- For simplicity we call a builtin when allocating a number.
- Elision of boxing/unboxing nodes will be done in a followup CL.

Bug: v8:7700
Change-Id: Iec4422d84c6597d3369ab512a1662adb0f077c98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602514
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80178}
2022-04-26 10:56:22 +00:00
Jakob Gruber
12284536d6 [osr] Opportunistically keep deoptimized OSR code in the cache
.. when deoptimization occurs after the outermost loop containing the
loop that triggered OSR compilation. The reasoning is that the main
benefit of OSR'd code is speeding up the OSR'd loop; the speedup of
the OSR'd loop is assumed to be higher than deoptimization overhead.

This is a slightly modified version of crrev.com/c/3521361, credit
goes to tao.pan@intel.com for most of the investigation and
implementation work.

Bug: v8:12161
Change-Id: Ie729dd5d1df9c7f529a1cf1b9471bb60ce76c41a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607988
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80177}
2022-04-26 10:52:33 +00:00
Andreas Haas
2f535cdf89 [wasm] Fix argument count of Table.set
Table.set has two arguments, the table index and the value. Therefore
Table.set was defined with a length of 2. However, the value argument is
optional, so the length should actually be 1.

Change-Id: Ica2ea13a8e78c974cb011df2b5dc99f8e7eb4bcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398496
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80176}
2022-04-26 10:40:22 +00:00
Anton Bikineev
7ae52c1521 cppgc: young-gen: Take into account ages of adjacent cards
When setting a range for a newly allocated lab, consider adjacent cards.
If either is young, don't mark it as kMixed.

Bug: chromium:1029379
Change-Id: If7d1d920dd5769679de68800eae61f3a8dc1eb17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3584116
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80175}
2022-04-26 10:36:12 +00:00
jameslahm
237116d99d [test] Move cctest/test-concurrent-transition-array to
... unittests/objects/concurrent-transition-array-unittest.

Bug: v8:12781
Change-Id: Ic6fbef71e1439c0a0056b122a4b42dcad674ca3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3604961
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80174}
2022-04-26 09:46:06 +00:00
Nico Hartmann
95dab01426 Revert "[heap] Store size with invalidated object"
This reverts commit 5d235def26.

Reason for revert: Speculative revert because of https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38153/overview

Original change's description:
> [heap] Store size with invalidated object
>
> When updating pointers during a full GC, a page might not be swept
> already. In such cases there might be invalid objects and slots recorded
> in free memory. Updating tagged slots in free memory is fine even though
> it is superfluous work.
>
> However, the GC also needs to calculate the size of potentially dead
> invalid objects in order to be able to check whether a slot is within
> that object. But since that object is dead, its map might be dead as
> well which makes size calculation impossible on such objects. The CL
> changes this to cache the size of invalid objects. A follow-up CL will
> also check the marking bit of invalid objects.
>
> Bug: v8:12578, chromium:1316289
> Change-Id: Ie773d0862a565982957e0dc409630d76552d1a32
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599482
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80169}

Bug: v8:12578, chromium:1316289
Change-Id: I6949412c5d6e1aa15718d027043d9528137a60a0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605812
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80173}
2022-04-26 08:45:13 +00:00
jameslahm
acd134dea1 [test] Move cctest/test-conversions to unittests
... /numbers/conversions-unittest.

Bug: v8:12781
Change-Id: I81043f8bcebf5ce1292111211af1bea297c9eea4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3604962
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80172}
2022-04-26 08:17:34 +00:00
jameslahm
1b68c62b98 [test] Move cctest/test-date to unittests
... /date/date-unittest.

Bug: v8:12781
Change-Id: Id5c7fd1ec11a427849c01acf992c7e398c456a4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599655
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80171}
2022-04-26 08:14:32 +00:00
Tobias Tebbi
e0158560a6 [turboshaft] workaround for bug in GCC 7
It seems that GCC 7 doesn't support constructor calls with curly braces
inside of expressions.

Bug: v8:12827
Change-Id: I7b8ff792de1f67a45af6e2e2d82808f57d23b66c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606230
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80170}
2022-04-26 07:55:52 +00:00
Dominik Inführ
5d235def26 [heap] Store size with invalidated object
When updating pointers during a full GC, a page might not be swept
already. In such cases there might be invalid objects and slots recorded
in free memory. Updating tagged slots in free memory is fine even though
it is superfluous work.

However, the GC also needs to calculate the size of potentially dead
invalid objects in order to be able to check whether a slot is within
that object. But since that object is dead, its map might be dead as
well which makes size calculation impossible on such objects. The CL
changes this to cache the size of invalid objects. A follow-up CL will
also check the marking bit of invalid objects.

Bug: v8:12578, chromium:1316289
Change-Id: Ie773d0862a565982957e0dc409630d76552d1a32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599482
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80169}
2022-04-26 07:37:42 +00:00
jameslahm
9080b8acf7 [test] Move cctest/test-concurrent-prototype to unittests
... /objects/concurrent-prototype-unittest.

Bug: v8:12781
Change-Id: Id283af4940a8cff19da78e0404022bc0faf2412e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599654
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80168}
2022-04-26 07:27:55 +00:00
Jakob Gruber
9145388055 Reland "[osr] Use the new OSR cache"
This is a reland of commit 91da38831d

Fixed: Use an X register for JumpIfCodeTIsMarkedForDeoptimization
on arm64.

Original change's description:
> [osr] Use the new OSR cache
>
> This CL switches over our OSR system to be based on the feedback
> vector osr caches.
>
> - OSRing to Sparkplug is fully separated from OSR urgency. If
>   SP code exists, we simply jump to it, no need to maintain an
>   installation request.
> - Each JumpLoop checks its dedicated FeedbackVector cache slot.
>   If a valid target code object exists, we enter it *without*
>   calling into runtime to fetch the code object.
> - Finally, OSR urgency still remains as the heuristic for
>   requesting Turbofan OSR compile jobs. Note it no longer has a
>   double purpose of being a generic untargeted installation
>   request.
>
> With the new system in place, we can remove now-unnecessary
> hacks:
>
> - Early OSR tierup is replaced by the standard OSR system. Any
>   present OSR code is automatically entered.
> - The synchronous OSR compilation fallback is removed. With
>   precise installation (= per-JumpLoop-bytecode) we no longer
>   have the problem of 'getting unlucky' with JumpLoop/cache entry
>   mismatches. Execution has moved on while compiling? Simply spawn
>   a new concurrent compile job.
> - Remove the synchronous (non-OSR) Turbofan compile request now
>   that we always enter available OSR code as early as possible.
> - Tiering into Sparkplug no longer messes with OSR state.
>
> Bug: v8:12161
> Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80147}

Bug: v8:12161
Change-Id: Ib3597cf1d99cdb5d0f2c5ac18e311914f376231d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606232
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80167}
2022-04-26 07:26:52 +00:00
Frank Tang
07601b124e [Temporal] Add Calendar.prototype.dateUntil
Also add AOs: ToLargestTemporalUnit, ToISODayOfYear, RegulateISODate,
AddISODate, DifferenceISODate

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.dateuntil
https://tc39.es/proposal-temporal/#sec-temporal-tolargesttemporalunit
https://tc39.es/proposal-temporal/#sec-temporal-toisodayofyear
https://tc39.es/proposal-temporal/#sec-temporal-regulateisodate
https://tc39.es/proposal-temporal/#sec-temporal-addisodate
https://tc39.es/proposal-temporal/#sec-temporal-differenceisodate

Bug: v8:11544
Change-Id: I03a28bf07ddfae036491e49cb06278d050ddebf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534620
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80166}
2022-04-26 06:49:32 +00:00
Liu Yu
7095683a7e [osr] Load FeedbackVector::kFlagsOffset by load_halfword
The size of flag is now 16 bits.

Bug: v8:12161
Change-Id: I5db5e05171281f27cce739c7b76e1d4b9ebf20b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602236
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Yu Liu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#80165}
2022-04-26 06:18:03 +00:00
Shu-yu Guo
6c6fc948cf [ShadowRealm] Make filenames consistent
Make the file names consistent on "shadow-realm" (i.e. singular, with a
dash).

Bug: v8:11989
Change-Id: Id0a6f417fd9b53b9f7ddf9677da7396fa2481af6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606392
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80164}
2022-04-25 23:49:02 +00:00
Shu-yu Guo
0407423bd0 Plumb Isolate through own property enumeration functions
Currently the Isolate is gotten off of the object that the operation is
being performed on. Shared objects return the shared Isolate, which is
incorrect as it shouldn't be used to run JS, nor does it have
HandleScopes open. Plumb the executing Isolate through.

Bug: v8:12547
Change-Id: I3d960751c798ac657a6122598154e36d9d504c31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606489
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80163}
2022-04-25 22:54:22 +00:00
Igor Sheludko
3eead7e32e [rwx][muc] Prepare BoundedPageAllocator for fast W^X on M1
This CL extends BoundedPageAllocator with PageFreeingMode parameter
which controls how pages should be freed: by setting permissions to
kNoAccess (preferred) or by discarding pages (Apple Silicon specific
behavior for RWX pages). The latter mode allows to ensure that once
pages are configured with RWX permissions they are never reconfigured
to anything else again.

The new mode will be used in a follow-up CL.

Bug: v8:12797
Change-Id: I3277f56ea6fee9c9b38b1682e68c22e66e9a02a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606228
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80162}
2022-04-25 20:09:22 +00:00
Michael Lippautz
bb5c4b5101 [handles, heap] Process young GlobalHandle nodes in GC
Young GlobalHandle nodes were processed during post processing which
required a logic to defend against recursive GCs. This was originally
designed in a delayed way as the list itself was only treated as an
optimization and could thus be lazily cleared.

Since this still happens in the atomic pause and every node needs to
be visited, there's no advantage over just keeping it correct at all
times.

Bug: chromium:1319213
Change-Id: I199fc0be5e4b6ed5cbb60cf3b1452e37108cd4f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605281
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80161}
2022-04-25 18:33:52 +00:00
Camillo Bruni
69e7f23062 [tools][system-analyzer] Fix timeline zooming
Bug: v8:10644
Change-Id: Iff48e762fd895df63d599cf4663f8b6f44373a00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605241
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80160}
2022-04-25 17:37:52 +00:00
Leszek Swirski
1dc3b908f2 [maglev] Only add Call node to graph after arguments
Make sure that Call nodes are only added to the graph after their
arguments are processed. Previously we were already doing this for the
undefined constant, but forgot to also do it for tagging nodes.

Now rather than trying to add those nodes before creating the Call node,
we create the Call node without adding it to the graph, then add it only
after setting up its inputs.

Bug: v8:7700
Change-Id: Id8c4c381f42fdd3c86d19d0fa2eb57163771060b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605248
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80159}
2022-04-25 17:01:32 +00:00
Leszek Swirski
d94f8343fb [maglev] Add maglev CodeKind to function logging
Bug: v8:7700
Change-Id: If0ae8dce83d91b159c345bdeef74d902593cd185
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605247
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80158}
2022-04-25 16:40:02 +00:00
Leszek Swirski
65d29d321b [maglev] Fix deopt vs translation index
Correct use the lazy deopt's deopt index in safepoints, instead of the
index in the translation array.

Bug: v8:7700
Change-Id: I4a99ceb8bb54f2fba5bee0e6ddd6629b44439ce1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605609
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80157}
2022-04-25 16:35:33 +00:00
Junliang Yan
07ec534d29 ppc64: [baseline] implement AddSmi
Change-Id: I94f3f02e2214437d8320d31c8be24f41698f136c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3604752
Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80156}
2022-04-25 16:14:12 +00:00
legendecas
d8bc4702d3 [builtins] Use builtin context for SourceTextModule closures
Invoking a JSBoundFunction is slightly slower than a normal
JSFunction (since we don't have to first jump to the
target_function).

The closure steps in SourceTextModule ExecuteAsyncModule is
controlled by the engine so it is better to create dedicated
context slots for the captured values.

Change-Id: I8163fc4b302d6d22906e578164470c9e28e768e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3584601
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#80155}
2022-04-25 15:30:52 +00:00
Camillo Bruni
19a991d578 [tools] Fix linux-perf-chrome.py renderer command path
Drive-by-fix:
- Wait for linux-perf to flush large profile files

No-try: True
Change-Id: I729aa897e3f55fc92a9412208322ee099029453f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605282
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80154}
2022-04-25 14:55:32 +00:00
Milad Fa
983046cf67 Fix compilation with gcc
gcc version 8.4 is currently throwing the following compilation
error:
```
 error: variable 'first' set but not used
```

Change-Id: I25e1197b8deaa0089adee2e736448976705c7497
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602060
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80153}
2022-04-25 14:52:33 +00:00
Clemens Backes
be72cc8b7f [wasm] Open a CodeSpaceWriteScope for assembler buffers
Once we start protecting assembler buffers via PKU, the background
compile threads need to enable write permissions during compilation in
order to access them.
This CL adds that, with a little trick to allow passing {nullptr} to the
{CodeSpaceWriteScope} for configurations where we do not actually use
the provided {NativeModule}. This is needed because the background
compile threads do not keep the {NativeModule} alive during compilation,
so they also should not pass the potentially dangling pointer to the
{CodeSpaceWriteScope}.

R=thibaudm@chromium.org

Bug: v8:12809
Change-Id: I1a1d4d41239a6b4497f8a12fb252d7da76e72e1a
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593117
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80152}
2022-04-25 14:51:31 +00:00
Andreas Haas
bfc3ce262a [bazel] Only add traphandler if wasm is enabled
Additionally this CL adds some #if V8_ENABLE_WEBASSEMBLY
that were missing.

Change-Id: I7c840ebfa800ad62f0b6f075c997bd1989a007e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596169
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80151}
2022-04-25 14:50:29 +00:00
jameslahm
48ac33bea6 [test] Move cctest/test-circular-queue to unittests
... /profiler/circular-queue-unittest.

Bug: v8:12781
Change-Id: Ic74c49cf25462fccae63435ff09f70c09de2506e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599402
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80150}
2022-04-25 14:49:26 +00:00
Michael Lippautz
aa63019b43 [handles] Read is-on-stack bit atomically
The bit is immutable and set during construction of the meta data. The
main thread needs to query this bit while the concurrent marker may be
running.

Bug: chromium:1319210
Change-Id: I811d8048a61a3c682245b34302b6078d91f9662a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599489
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80149}
2022-04-25 14:48:24 +00:00
Nico Hartmann
c34b7b41a7 Revert "[osr] Use the new OSR cache"
This reverts commit 91da38831d.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression%20-%20builder/21150/overview

Original change's description:
> [osr] Use the new OSR cache
>
> This CL switches over our OSR system to be based on the feedback
> vector osr caches.
>
> - OSRing to Sparkplug is fully separated from OSR urgency. If
>   SP code exists, we simply jump to it, no need to maintain an
>   installation request.
> - Each JumpLoop checks its dedicated FeedbackVector cache slot.
>   If a valid target code object exists, we enter it *without*
>   calling into runtime to fetch the code object.
> - Finally, OSR urgency still remains as the heuristic for
>   requesting Turbofan OSR compile jobs. Note it no longer has a
>   double purpose of being a generic untargeted installation
>   request.
>
> With the new system in place, we can remove now-unnecessary
> hacks:
>
> - Early OSR tierup is replaced by the standard OSR system. Any
>   present OSR code is automatically entered.
> - The synchronous OSR compilation fallback is removed. With
>   precise installation (= per-JumpLoop-bytecode) we no longer
>   have the problem of 'getting unlucky' with JumpLoop/cache entry
>   mismatches. Execution has moved on while compiling? Simply spawn
>   a new concurrent compile job.
> - Remove the synchronous (non-OSR) Turbofan compile request now
>   that we always enter available OSR code as early as possible.
> - Tiering into Sparkplug no longer messes with OSR state.
>
> Bug: v8:12161
> Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80147}

Bug: v8:12161
Change-Id: I4a6955f4f20b6f3b13e98d5600c7c6a5205915bc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605608
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80148}
2022-04-25 14:47:22 +00:00
Jakob Gruber
91da38831d [osr] Use the new OSR cache
This CL switches over our OSR system to be based on the feedback
vector osr caches.

- OSRing to Sparkplug is fully separated from OSR urgency. If
  SP code exists, we simply jump to it, no need to maintain an
  installation request.
- Each JumpLoop checks its dedicated FeedbackVector cache slot.
  If a valid target code object exists, we enter it *without*
  calling into runtime to fetch the code object.
- Finally, OSR urgency still remains as the heuristic for
  requesting Turbofan OSR compile jobs. Note it no longer has a
  double purpose of being a generic untargeted installation
  request.

With the new system in place, we can remove now-unnecessary
hacks:

- Early OSR tierup is replaced by the standard OSR system. Any
  present OSR code is automatically entered.
- The synchronous OSR compilation fallback is removed. With
  precise installation (= per-JumpLoop-bytecode) we no longer
  have the problem of 'getting unlucky' with JumpLoop/cache entry
  mismatches. Execution has moved on while compiling? Simply spawn
  a new concurrent compile job.
- Remove the synchronous (non-OSR) Turbofan compile request now
  that we always enter available OSR code as early as possible.
- Tiering into Sparkplug no longer messes with OSR state.

Bug: v8:12161
Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80147}
2022-04-25 13:01:43 +00:00
jameslahm
3deb0ec34f [test] Move cctest/test-code-layout to unittests
... /codegen/code-layout-unittest.

Bug: v8:12781
Change-Id: I39d2af33f38dc2f06668b6b390b15e607e2dbb73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599403
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80146}
2022-04-25 12:57:44 +00:00
Clemens Backes
af7c307d82 [wasm] Introduce AssemblerBufferCache
This introduces an AssemblerBufferCache class which will (later) cache
the backing store of AssemblerBuffers. This is needed for PKU-protected
assembler buffers, which are expensive to allocate and deallocate.

For now, the AssemblerBufferCache does not do any caching, this will be
added in a follow-up CL.

R=thibaudm@chromium.org

Bug: v8:12809
Change-Id: I4a7ccff49c9930584a9fcda8899cfe38cfc61419
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593136
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80145}
2022-04-25 11:56:51 +00:00
Victor Gomes
f025148e31 [maglev] Support double registers in register allocator
This assumes that Phi nodes never point to untagged values and
TemporaryRegisters are always general registers.

Bug: v8:7700
Change-Id: I74a6c43ff9f1ba87dd258e90a193f683d666b8ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3598883
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80144}
2022-04-25 11:52:31 +00:00
Pierre Langlois
76b40ef6c0 [gdbinit] Do not enable ASLR if not possible.
The `set disable-randomization off` command may fail on some platforms,
such as the `rr` debugger. We can just ignore the error and carry on.

Change-Id: I9b8dae183a9852178a3d3411172bf3aef173c995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602519
Auto-Submit: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80143}
2022-04-25 11:43:32 +00:00
Marja Hölttä
2176ead6dc [rab/gsab] Atomics.wait + waitAsync: Support GSAB
Bug: v8:11111
Change-Id: Ifb3776bce308d869064120d5e28a2ea7df943757
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578652
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80142}
2022-04-25 11:05:33 +00:00
jameslahm
fce1047f00 Reland "[interpreter] Optimize strict equal boolean"
This is a reland of commit 62632c0805.
Reason for previous revert: Performance regressions crbug.com/1315724.
The reland only optimizes strict equal boolean literal like "a===true"
or "a===false", and we generate TestReferenceEqual rather than
TestStrictEqual for the comparasion. And also add typed optimization
for ReferenceEqual when all inputs are boolean with boolean constant.

Original change's description:
> [interpreter] Optimize strict equal boolean
>
> For strict equal boolean literal like "a===true"
> or "a===false", we could generate TestReferenceEqual
> rather than TestStrictEqual. And in `execution_result()->IsTest()`
> case, we could directly emit JumpIfTrue/JumpIfFalse.
>
> E.g.
> ```
> a === true
> ```
> Generated Bytecode From:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestEqualStrict
> ```
> To:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestReferenceEqual
> ```
>
> E.g.
> ```
> if (a === true)
> ```
> Generated Bytecode From:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestEqualStrict
> JumpIfFalse
> ```
> To
> ```
> LdaGlobal
> JumpIfTrue
> Jump
> ```
>
>
> Bug: v8:6403
> Change-Id: Ieaca147acd2d523ac0d2466e7861afb2d29a1310
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568923
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#79935}

Bug: v8:6403
Change-Id: I2ae3ab57dce85313af200fa522e3632af5c3a554
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3592039
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80141}
2022-04-25 10:02:05 +00:00
Victor Gomes
2c4d1b4c0a [maglev] Properly use MachineRepresentation in RegAlloc
We need to use MachineRepresentation to properly distinguish
the types in compiler::UnallocatedOperand.

Bug: v8:7700
Change-Id: I4273512a00290bb85b09aeb3788643e346be03f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602515
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80140}
2022-04-25 10:01:03 +00:00
Jakob Kummerow
fe12d2d1ec [wasm] Process feedback for multi-level call_direct inlining
For call_direct, feedback (for the first level of inlining) only
records call counts, not the statically-known target. So to be
able to make feedback for potential additional inlining levels
available, the feedback processor must look to the wire bytes
to extract the call targets. Without feedback and hence unknown
call counts, such multi-level inlining would not happen.

Bug: v8:12166
Change-Id: I84ca58019e927a8bf9dad4e4aceddd341f945c04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3579105
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80139}
2022-04-25 09:47:46 +00:00
jameslahm
2e3fb275e7 [test] Move cctest/test-bignum to unittests
... /base/bignum-unittest.

Bug: v8:12781
Change-Id: I217dd7c4ef59cf1fdbe83a268d0288c38f0e9d4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599401
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80138}
2022-04-25 09:39:19 +00:00
Nico Hartmann
e1705d4755 [unittest] Temporarily disable ConservativeGCTracesWeakContainer test
Bug: v8:12824
Change-Id: I96adf6c5d930b1476f7f1063ede4fc2344fb5885
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605242
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80137}
2022-04-25 09:38:16 +00:00
Tobias Tebbi
e4cc6ed44b [turboshaft] initial commit
TurboShaft is a new, CFG-based IR for TurboFan.
This CL adds the basic IR and bidirectional translation from/to
TurboFan's sea-of-nodes-based IR for some common operators (still
incomplete even for JS).

Bug: v8:12783
Change-Id: I162fdf10d583a9275a9f655f5b44b888faf813f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563562
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80136}
2022-04-25 09:12:15 +00:00