Commit Graph

66321 Commits

Author SHA1 Message Date
Mike Stanton
139f23501d [api] Its sufficient for the holder in api call to be a JSReceier
Bug: chromium:1158124
Change-Id: Ic23f4b2ffb9436771afcc0090f2179b48851c39d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2596336
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71829}
2020-12-17 15:25:33 +00:00
Clemens Backes
c5b567042b [tasks] Cleanup OperationsBarrier
The class disallows copy construction, but still allows copy assignment.
This is fixed in this CL.

Drive-by: Fix punctuation.
Drive-by 2: Fix indentation in code example.

R=etiennep@chromium.org

Bug: v8:11074
Change-Id: I09e993a69d72e262d7b220200ef94b36d346548e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2584246
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71828}
2020-12-17 14:56:33 +00:00
Patrick Thier
1314d2b859 [interpreter] Use LdaSmi when possible.
When we know a value passed to BytecodeArrayBuilder::LoadLiteral(double)
can be encoded as a Smi, we create LdaSmi instead of LdaConstant.

Driven by a forgotten Smi::FromInt() in BytecodeGenerator, also fixed in
this CL.

Bug: v8:11278
Change-Id: I4a1ad48e2c9aff8391113812e34dae838a1a38d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595437
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71827}
2020-12-17 14:51:13 +00:00
Sathya Gunasekaran
cce533bac9 [runtime] Use range checks for function instance type checks
This allows the JSFunctionOrBoundFunction instance type range to no
longer be stuck at the last of the JSObject instance type range. This
will be useful in the future where we extend the function instance
types and include them in fast protector cell checks.

Bug: v8:11256
Change-Id: I955991576b3cca76b10f76c87748016fe527e3d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595275
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71826}
2020-12-17 14:02:03 +00:00
Nico Hartmann
de50785ed5 Revert "Faster JS-to-Wasm calls"
This reverts commit 860fcb1bd2.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/13831/overview

Original change's description:
> Faster JS-to-Wasm calls
>
> This replaces https://chromium-review.googlesource.com/c/v8/v8/+/2376165/.
>
> Currently JS-to-Wasm calls go through a wrapper/trampoline, built on
> the basis of the signature of a Wasm function to call, and whose task
> is to:
> - set "thread_in_wasm_flag" to true
> - convert the arguments from tagged types into Wasm native types
> - calculate the address of the Wasm function to call and call it
> - convert back the result from Wasm native types into tagged types
> - reset "thread_in_wasm_flag" to false.
>
> This CL tries to improve the performance of JS-to-Wasm calls by
> inlining the code of the JS-to-Wasm wrappers in the call site.
>
> It introduces a new IR operand, JSWasmCall, which replaces JSCall for
> this kind of calls. A 'JSWasmCall' node is associated to
> WasmCallParameters, which contain information about the signature of
> the Wasm function to call.
>
> WasmWrapperGraphBuilder::BuildJSToWasmWrapper is modified to avoid generating code to convert the types for the arguments
> of the Wasm function, when the conversion is not necessary.
> The actual inlining of the graph generated for this wrapper happens in
> the simplified-lowering phase.
>
> A new builtin, JSToWasmLazyDeoptContinuation, is introduced to manage
> lazy deoptimizations that can happen if the Wasm function callee calls
> back some JS code that invalidates the compiled JS caller function.
>
> Bug: v8:11092
> Change-Id: I3174c1c1f59b39107b333d1929ecc0584486b8ad
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557538
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Georg Neis (ooo until January 5) <neis@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Paolo Severini <paolosev@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#71824}

TBR=neis@chromium.org,ahaas@chromium.org,jgruber@chromium.org,tebbi@chromium.org,ishell@chromium.org,mslekova@chromium.org,nicohartmann@chromium.org,paolosev@microsoft.com

Change-Id: I214cbdee74c1a2aaad907ffc84662ed25631983e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11092
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595438
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71825}
2020-12-17 13:55:35 +00:00
Paolo Severini
860fcb1bd2 Faster JS-to-Wasm calls
This replaces https://chromium-review.googlesource.com/c/v8/v8/+/2376165/.

Currently JS-to-Wasm calls go through a wrapper/trampoline, built on
the basis of the signature of a Wasm function to call, and whose task
is to:
- set "thread_in_wasm_flag" to true
- convert the arguments from tagged types into Wasm native types
- calculate the address of the Wasm function to call and call it
- convert back the result from Wasm native types into tagged types
- reset "thread_in_wasm_flag" to false.

This CL tries to improve the performance of JS-to-Wasm calls by
inlining the code of the JS-to-Wasm wrappers in the call site.

It introduces a new IR operand, JSWasmCall, which replaces JSCall for
this kind of calls. A 'JSWasmCall' node is associated to
WasmCallParameters, which contain information about the signature of
the Wasm function to call.

WasmWrapperGraphBuilder::BuildJSToWasmWrapper is modified to avoid generating code to convert the types for the arguments
of the Wasm function, when the conversion is not necessary.
The actual inlining of the graph generated for this wrapper happens in
the simplified-lowering phase.

A new builtin, JSToWasmLazyDeoptContinuation, is introduced to manage
lazy deoptimizations that can happen if the Wasm function callee calls
back some JS code that invalidates the compiled JS caller function.

Bug: v8:11092
Change-Id: I3174c1c1f59b39107b333d1929ecc0584486b8ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557538
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis (ooo until January 5) <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71824}
2020-12-17 10:57:53 +00:00
Jakob Kummerow
f475e99021 Reland "[wasm-gc] Liftoff support part 4: subtyping"
This is a reland of dc369749c7
Changes: relaxed --liftoff-only mode to still allow bailing
out due to missing CPU support.

Original change's description:
> [wasm-gc] Liftoff support part 4: subtyping
>
> This adds support for the following instructions:
> struct.new_default, rtt.sub, ref.test, ref.cast
>
> Bug: v8:7748
> Change-Id: I7423ddd7a83c80cb1e82c620780c27bec59ec762
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593341
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71805}

Bug: v8:7748
Change-Id: If31fcee5e7e173d7c2a6e1c624f4ff04cec7fe9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2596338
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71823}
2020-12-17 10:02:43 +00:00
Clemens Backes
63b78f2b01 [wasm] Optimize bounds checking bounds
For bounds checking, we have a special path which avoids one conditional
branch. This path can actually be one value wider, which will avoid some
unneeded code if that case it hit. This will in particular be the case
for single-byte loads at offset 0 with a minimum memory size of 0.

R=jkummerow@chromium.org

Bug: v8:10949
Change-Id: Id16af8debc38c56c520183aec81a48249979ec96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595290
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71822}
2020-12-17 09:38:53 +00:00
Zhi An Ng
8f02ad408e [ia32][x64] Detect AVX2
- Add the appropriate cpuid checks to detect AVX2 in base/cpu
- Add FLAG_enable_avx2

AVX2 depends on AVX support, + a cpuid check with eax=7. This is similar
to chromium/src/base/cpu.cc check for AVX2.

Bug: v8:11258
Change-Id: Ia547c22e51b03fec823f5e48ebb055139632c942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589050
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71821}
2020-12-17 05:44:54 +00:00
Zhi An Ng
46ce9b0554 [wasm-simd][x64] Optimize arch shuffle if AVX supported
AVX has 3-operands shuffle/unpack operations. We currently always
require that dst == src0 in all cases, which is not required if we have
AVX. For the arch shuffles that map to a single native instruction, add
support to check for AVX in the instruction-selector, to not require
same as first, and in the code-gen to support generating AVX.

The other arch shuffles are slightly more complicated, and can be
optimized in a future change.

Bug: v8:11270
Change-Id: I25b271aeff71fbe860d5bcc8abb17c36bcdab32c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2591858
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71820}
2020-12-17 05:13:04 +00:00
Zhi An Ng
3d83638c3c [wasm-simd] Remove ifdef guards for extended multiply
These instructions have been accepted into the proposal.

Bug: v8:11262
Change-Id: Iec0bb9b9b1b0f8ed76ed78e254c64b96981a5f2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589433
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71819}
2020-12-17 04:56:44 +00:00
Zhi An Ng
12e37399e8 [x64][wasm-simd] Only require unique registers for shuffles that use temps
An improvement to generic shuffle improvement
(https://crrev.com/c/2152853) required a temporary SIMD register to hold
the mask, rather than pushing it onto a stack. The temporary register
requires that we UseUniqueRegister on the inputs, to prevent aliasing,
as we will write to the temp. However, we only need this for the generic
shuffle. We accidentally over-constraint all other pattern matched
shuffles, since they don't use any temps.

On a ~2000 line function containing ~150 shuffles (not all of which are
generic shuffles), we get 16 less instruction in the native code, and
actually see a very small improvement in the overall benchmarks.

Bug: v8:11270
Change-Id: I09974f7615e4b8f5e2416ed17ca47cc7613fd6b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2591857
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71818}
2020-12-17 04:31:24 +00:00
v8-ci-autoroll-builder
a8b215dab0 Update V8 DEPS.
Rolling v8/build: bd6da36..d50897f

Rolling v8/third_party/aemu-linux-x64: ijHjc7kfgeuh7rvjQtk93a5SuvO23dABp_CeotpPcMAC..j06MN21Z7_ISpAwWL3mLbbrGDGsSKnxGaEYTCDtE-RIC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f22b977..92c7710

Rolling v8/third_party/depot_tools: 867d99d..67e1228

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I17ecc3f2e992a530c1d6cc61d0233836dd081179
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2596389
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71817}
2020-12-17 04:14:24 +00:00
Zhi An Ng
8d5f1511a4 [wasm-simd][ia32] Pattern match 32x4 rotate
Same pattern matching and implementation as x64 here:
https://crrev.com/c/2589062.

Change-Id: I11f8df79ab9910af9c7a97e2382144703be5916d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2591851
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71816}
2020-12-17 03:51:14 +00:00
LiuYu
132d7bd426 [mips][wasm-gc] Liftoff support part 2
Port: 5e18ab5019

Bug: v8:7748
Change-Id: I1ac349cf80b6689971bd6c686c6795daf85c5637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2594536
Auto-Submit: Liu yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#71815}
2020-12-17 03:38:24 +00:00
Zhi An Ng
53b9ee3765 [wasm-simd] Add extended multiply to fuzzer
Bug: v8:11262
Change-Id: Ic83cf2752ebaffb589ac72206c25005145b0b8c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589067
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71814}
2020-12-17 03:29:14 +00:00
Zhi An Ng
741e5a66de [wasm-simd][ia32][x64] More optimization for f32x4.extract_lane
We can have more optimizations for this instruction, they leave some
junk in the top lanes of dst, but that doesn't matter:

- when lane is 1: we use movshdup, this is 4 bytes long
- when lane is 2: use movhlps, this is 3 bytes long
- otherwise use shufps (4 bytes) or pshufd (5 bytes)

All of which are better than insertps (6 bytes).

Change-Id: I0e524431d1832e297e8c8bb418d42382d93fa691
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2591850
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71813}
2020-12-17 01:58:52 +00:00
Zhi An Ng
08c2c0059d [wasm-simd] Move extended multiply out of post-mvp
Bug: v8:11262
Change-Id: Iefe32dbf20e4c511a3f1d56ce7dc53c2bc2da112
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589066
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71812}
2020-12-17 01:44:12 +00:00
Zhi An Ng
1f2cc01a1b [wasm-simd][x64] Use Movaps to get AVX version if supported
Use Movaps so that when AVX is supported we get vmovaps, this avoids
mixing SSE and AVX code.

Change-Id: Icbcefa42bd368bed1a30f5f790ea6c5cea564e26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2591856
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71811}
2020-12-17 00:45:32 +00:00
Jakob Kummerow
362e4c0866 Revert "[wasm-gc] Liftoff support part 5: i31"
This reverts commit a3ce2f6da2.

Reason for revert: speculative revert due to waterfall unhappiness (looks like bot weirdness though?)

Original change's description:
> [wasm-gc] Liftoff support part 5: i31
>
> This implements support for i31.get_s and i31.get_u.
>
> Bug: v8:7748
> Change-Id: Icbfddbc2ff46b4eb6bf3edf7b3a794f9797361d4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595309
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71808}

TBR=jkummerow@chromium.org,clemensb@chromium.org

Change-Id: I5050f16fdaf355d178935f523a9bec516302d2a1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7748
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2596337
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71810}
2020-12-17 00:03:14 +00:00
Milad Fa
07f0b7a4c8 PPC/s390: Reland "[Turboprop] Move dynamic check maps immediate args to deopt exit."
Port 7bdb0fbb81

Original Commit Message:

    This is a reland of b2a611d815

    Original change's description:
    > [Turboprop] Move dynamic check maps immediate args to deopt exit.
    >
    > Rather than loading the immediate arguments required by the
    > dynamic check maps builtin into registers in the fast-path,
    > instead insert them into the instruction stream in the deopt
    > exit and have the builtin load them into registers itself.
    >
    > BUG=v8:10582
    >
    > Change-Id: I66716570b408501374eed8f5e6432df64c6deb7c
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589736
    > Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
    > Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
    > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#71790}

R=rmcilroy@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I83fc0f3e3ebcf19ca4303e50aae94d7b353cd0ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595708
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71809}
2020-12-16 23:44:12 +00:00
Jakob Kummerow
a3ce2f6da2 [wasm-gc] Liftoff support part 5: i31
This implements support for i31.get_s and i31.get_u.

Bug: v8:7748
Change-Id: Icbfddbc2ff46b4eb6bf3edf7b3a794f9797361d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595309
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71808}
2020-12-16 23:29:52 +00:00
Milad Fa
45414e119a PPC/s390: [wasm-gc] Liftoff support part 3: arrays
Port 3dffdf037b

Original Commit Message:

    This adds support for the following instructions:
    ref.eq, array.new_with_rtt, array.new_default_with_rtt,
    array.get, array.set, array.len.

R=jkummerow@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I5e517967648251f9babbabe4dc9148a5432aa58e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595927
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71807}
2020-12-16 23:28:32 +00:00
Shu-yu Guo
03446c6e4b Revert "[wasm-gc] Liftoff support part 4: subtyping"
This reverts commit dc369749c7.

Reason for revert: nosse variant failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/33279/overview

Original change's description:
> [wasm-gc] Liftoff support part 4: subtyping
>
> This adds support for the following instructions:
> struct.new_default, rtt.sub, ref.test, ref.cast
>
> Bug: v8:7748
> Change-Id: I7423ddd7a83c80cb1e82c620780c27bec59ec762
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593341
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71805}

TBR=jkummerow@chromium.org,clemensb@chromium.org

Change-Id: I06bb493852223aecf221c9149bc7b034b1fb13ad
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7748
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2596497
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71806}
2020-12-16 23:26:06 +00:00
Jakob Kummerow
dc369749c7 [wasm-gc] Liftoff support part 4: subtyping
This adds support for the following instructions:
struct.new_default, rtt.sub, ref.test, ref.cast

Bug: v8:7748
Change-Id: I7423ddd7a83c80cb1e82c620780c27bec59ec762
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593341
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71805}
2020-12-16 19:34:42 +00:00
Ross McIlroy
e63347c511 [Turboprop] Enable turbo_direct_heap_access with Turboprop
Concurrent inlining is enabled for TurboProp compiles, but we don't
enable the --concurrent-inlining flag so don't also set the implied
turbo_direct_heap_access flag. This CL fixes this.

BUG=v8:9684

Change-Id: I298febdf7c466385047f420d4c33ca0162778210
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593344
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71804}
2020-12-16 19:06:03 +00:00
Ross McIlroy
7bdb0fbb81 Reland "[Turboprop] Move dynamic check maps immediate args to deopt exit."
This is a reland of b2a611d815

Original change's description:
> [Turboprop] Move dynamic check maps immediate args to deopt exit.
>
> Rather than loading the immediate arguments required by the
> dynamic check maps builtin into registers in the fast-path,
> instead insert them into the instruction stream in the deopt
> exit and have the builtin load them into registers itself.
>
> BUG=v8:10582
>
> Change-Id: I66716570b408501374eed8f5e6432df64c6deb7c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589736
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71790}

TBR=tebbi@chromium.org,gsathya@chromium.org

Bug: v8:10582
Change-Id: Ieda0295ee135bff983c67c3f04bb47115f0a2739
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595311
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71803}
2020-12-16 18:38:52 +00:00
Sathya Gunasekaran
7bf6d477d4 [runtime] Use instance type checks in LookupIterator::UpdateProtector
Instead of looking up the specific maps in every native context, just
check against the instance type.

Bug: v8:11256
Change-Id: Ib50d599c014c95b03ba3260014dfcbd9ec82982c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593337
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71802}
2020-12-16 17:56:10 +00:00
Milad Fa
67ac2a7d55 PPC/s390: [macro-assembler] Avoid using the isolate in CallRecordWriteStub
Port 6b3994e850

Original Commit Message:

    CallRecordWriteStub is used in a background compile thread for
    JS-to-Wasm wrapper compilation, so it should avoid accessing the
    isolate.
    Call the builtin using CallBuiltin which does not require a Handle<Code>
    object and instead gets the call target directly from the embedded data.

R=thibaudm@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ibf3cb676b15d3ab946c673e38c454c8050ff1435
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595292
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71801}
2020-12-16 17:09:10 +00:00
Victor Gomes
ae78e0c02a [codegen] Add DCHECK in GetRegisterParameter
Change-Id: I49fad3cef572a1f5b3d01d8245335622cbb4be0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2594778
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71800}
2020-12-16 17:02:20 +00:00
Sathya Gunasekaran
15c227befb [runtime] Fix TypedArrayPrototype protector cell checks
Previously, we were looking up the prototype of the receiver and
checking that against %TypedArrayPrototype% before invalidating the
protector cell.

This is incorrect as it's possible to patch the prototype and then
change the constructor property, bypassing this check.

This CL adds a new instance type to prototype of all TypedArray
constructors and checks the receiver against this instance type.

TBR: tebbi@chromium.org
Bug: v8:11274, v8:11256
Change-Id: I2ff6280e4cf820b06c5593fe4addd36f7ac656c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2594776
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71799}
2020-12-16 16:31:00 +00:00
Manos Koukoutos
62355eeb2c [turbofan] Add MachineRepresentation argument to LoopExitValue
LoopExitValue nodes can be used as inputs to Phis in loop optimizations.
To do this, we need to know the machine representation that needs to be
passed to the new Phi node. This CL adds a MachineRepresentation
argument to LoopExitValue nodes, as well as a helper to extract it.
Since the MachineRepresentation is not used by JS compilation, nodes
generated during JS compilation are passed kTagged as a default value.

Change-Id: I925f382d5e6988d8fad3de7a6db231e871d6ed36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2578983
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Georg Neis (ooo until January 5) <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71798}
2020-12-16 16:27:50 +00:00
Peter Marshall
106a47fd90 [cpu-profiler] Enable deopt test
There is a race in the way we handle deopts that made this test flaky.
The race is not hugely important to fix, and is difficult without
breaking something else.

The best thing to do here is update the test to reflect reality so we
can get the test coverage back.

This updates the test so that the deopt reason can be found either
on the first or second level function. The test assumed it would
always be available on the second level function in the profile,
but if we get a regular profile tick at the exact wrong time, we
could end up with the deopt info getting attached to the first level
function. So we accept either.

Bug: v8:5193
Change-Id: Ia43880ebafd1341a514b3143dc215514b5dccf15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2594775
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71797}
2020-12-16 16:21:10 +00:00
Jakob Kummerow
3dffdf037b [wasm-gc] Liftoff support part 3: arrays
This adds support for the following instructions:
ref.eq, array.new_with_rtt, array.new_default_with_rtt,
array.get, array.set, array.len.

Bug: v8:7748
Change-Id: I93c4a6676acc8b0ac035dd50762be6a1cc545a57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593340
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71796}
2020-12-16 16:10:58 +00:00
Pierre Langlois
3650b36542 [perf-prof] Make sure filenames are correctly null-terminated.
JS script names in debug info entries need to be null-terminated, the
terminator included in the length. However, SeqOneByteString's GetChars
returns raw pointer that's not null terminated.

Bug: chromium:1159164
Change-Id: Id00f72dc831fa1ae48a458a1d4476ada4730be54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593345
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#71795}
2020-12-16 15:58:04 +00:00
Dominik Inführ
9aaf874a1c [heap] Move completion of sweeping before actual GC
This CL completes sweeping in Heap::PerformGarbageCollection before
invoking the actual collection. Collection code can now assume that
sweeping was already finished.

This helps with emitting the right epoch for sweeping and avoids a
data-race when updating the epoch while sweeping tasks are still running.

Bug: chromium:1154636
Change-Id: Ic9c4ac49568199d0ea48f17eea132079defe74a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2573478
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71794}
2020-12-16 15:32:54 +00:00
Clemens Backes
a1ec77e610 Revert "[Turboprop] Move dynamic check maps immediate args to deopt exit."
This reverts commit b2a611d815.

Reason for revert: Several failures on https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20CFI/3743/overview

Original change's description:
> [Turboprop] Move dynamic check maps immediate args to deopt exit.
>
> Rather than loading the immediate arguments required by the
> dynamic check maps builtin into registers in the fast-path,
> instead insert them into the instruction stream in the deopt
> exit and have the builtin load them into registers itself.
>
> BUG=v8:10582
>
> Change-Id: I66716570b408501374eed8f5e6432df64c6deb7c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589736
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71790}

TBR=rmcilroy@chromium.org,gsathya@chromium.org,tebbi@chromium.org

Change-Id: I4c56bee156ffcea8de0aeaff9ac1bf03e03134c9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10582
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2595308
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71793}
2020-12-16 15:31:09 +00:00
Jakob Kummerow
e7be15c7b5 [wasm-gc][builtins] Migrate WasmAllocateArrayWithRtt to Torque
This is useful in particular as preparation for calling
this builtin from Liftoff code (where we don't have access
to a Context).

Bug: v8:7748
Change-Id: Ie1a10a0487a99a1e6b75693da1554d7af28e7924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593256
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71792}
2020-12-16 15:04:14 +00:00
Sathya Gunasekaran
33fb2319b2 [runtime] Add new instance types for common prototype objects
In the future, these instance types will be used for fast range checks
rather than the current slow individual map checks.

Bug: v8:11256
Change-Id: I4ad7d5259fbd46c3272a80996a5ac45a400d1f5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2590040
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71791}
2020-12-16 14:46:14 +00:00
Ross McIlroy
b2a611d815 [Turboprop] Move dynamic check maps immediate args to deopt exit.
Rather than loading the immediate arguments required by the
dynamic check maps builtin into registers in the fast-path,
instead insert them into the instruction stream in the deopt
exit and have the builtin load them into registers itself.

BUG=v8:10582

Change-Id: I66716570b408501374eed8f5e6432df64c6deb7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589736
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71790}
2020-12-16 14:44:05 +00:00
Milad Fa
30eef5475a [wasm-gc] skip tests on unsupported platforms.
Change-Id: I1109da446b53179b366a30db3ddc1cd1973d0d28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593647
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71789}
2020-12-16 14:13:04 +00:00
Dominik Inführ
666418d54b [test] Disable test with stress_concurrent_allocation
Test creates out-of-memory condition. Running that test in the
stress_concurrent_allocation variant might lead to "ineffective GCs"
failure before going OOM. Simply do not run this test for that variant.


Bug: v8:11272
Change-Id: I114686ec345f7a38f871347b62983d7591dc6ba3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2594769
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71788}
2020-12-16 13:49:14 +00:00
Zhi An Ng
76f9ee6137 [wasm-simd][ia32] Fix DCHECK in f64x2.extract_lane
f64x2.extract_lane can only extract lane 0 or 1. Fix the DCHECK to check
for the appropriate lane values.

Change-Id: I62d5e34ce01e0fa66609fb1fed7979bf2782bb74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2589057
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71787}
2020-12-16 13:27:34 +00:00
Andreas Haas
8656a594ab [wasm][liftoff] Fix stack check safepoints for arm, arm64, and ia32
Registers are spilled differently on arm and intel platforms.
Additionally, on arm64 registers are spilled with padding. Therefore
the code for safepoint information for spilled registers is platform-
dependent now.

Additionally the alignment of the frame size is done before the
out-of-line code now, so that the safepoint indices can be calculated
correctly for spilled registers in out-of-line code.

Finally, some code was unimplemented on ia32 and arm, which I added
now.

R=thibaudm@chromium.org

Bug: v8:7581, v8:10929
Change-Id: Ia9b824dfc74cafa9ec3cc0d308fb18b485afd715
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2584952
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71786}
2020-12-16 13:21:29 +00:00
Thibaud Michaud
6b3994e850 [macro-assembler] Avoid using the isolate in CallRecordWriteStub
CallRecordWriteStub is used in a background compile thread for
JS-to-Wasm wrapper compilation, so it should avoid accessing the
isolate.
Call the builtin using CallBuiltin which does not require a Handle<Code>
object and instead gets the call target directly from the embedded data.

R=clemensb@chromium.org

Bug: chromium:1146813
Change-Id: I4ee59084e4184f2e9039208e4e6db43482cefde6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593333
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71785}
2020-12-16 13:20:24 +00:00
Clemens Backes
43d61196b0 [wasm] Remove unused parameter from Drop
Neither Liftoff nor the WasmGraphBuildingInterface use the parameter,
hence drop it.

R=jkummerow@chromium.org

Change-Id: Ia7f2b81dfc95f31c27e12d4ada07c5603a34abff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593335
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71784}
2020-12-16 13:17:44 +00:00
Almothana Athamneh
56354ab357 Add official builder for mac-arm64 release and debug
Bug: v8:11264
Change-Id: I9e1302a499ba6b32e9d93d81e922c9f318c2ba07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593252
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71783}
2020-12-16 13:02:24 +00:00
Clemens Backes
8619422e2c [wasm][test] Remove an unneeded pointer
We were storing the pointer to the WasmModule both as a shared_ptr and
as a raw pointer. Maybe this had historical reasons, but now it's just
redundant.

R=thibaudm@chromium.org

Change-Id: Id72d102b6df804f93e3ab0235eeceef91a6dd8fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593334
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71782}
2020-12-16 12:43:04 +00:00
Clemens Backes
1f7e126fdd [wasm] Move members from WasmRunner to WasmRunnerBase
This moves some fields and methods from the WasmRunner template to the
WasmRunnerBase base class. This avoids repeated compilation for the
different instantiations of the WasmRunner template.

Additional changes:
- SetUpTrapCallback, SetThreadInWasmFlag, and ClearThreadInWasmFlag are
  static now.
- CheckUsedExecutionTier is unused, and did not even compile any more.
  In the template class this was OK, because it's only compiled on first
  use.

R=thibaudm@chromium.org

Change-Id: I485729cf4a1fd93fe6abb0be269694f0179fc4ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593331
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71781}
2020-12-16 10:44:39 +00:00
Jakob Kummerow
67f0733e32 [cleanup] Add .cache to .gitignore
Recent versions of clangd put lots of stuff into .cache,
cluttering `git status` output.

No-Try: true
Change-Id: I0b5d78a8b2813bd11ad1f0d32bc8ea314103fe19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2593255
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71780}
2020-12-16 10:37:28 +00:00