Commit Graph

12354 Commits

Author SHA1 Message Date
Maya Lekova
11a304ffeb [megadom] Fix crash in d8 when realm is entered
Bug: chromium:1329234
Change-Id: I59f171d3e2ab0c07f79f631971b1695b9f706600
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3677294
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80850}
2022-05-31 12:09:38 +00:00
Darius M
7c4461add3 Reland "[builtins] use SIMD IndexOf/includes on large arrays"
This is a reland of commit ab76ffc8bd.

Original change's description:
> [builtins] use SIMD IndexOf/includes on large arrays
>
> Change-Id: If751e813c7f45a4d18b84e8c0314a54c84894d61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3639203
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80771}

Change-Id: I81dcf3c97a15b95fd42927ff8e91602f109db315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3672418
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80840}
2022-05-31 09:19:50 +00:00
Marja Hölttä
171ee1a7d4 [web snap] Support objects with dictionary elements
Bug: v8:11525
Change-Id: I0196169d5bfe80df23179414f37c418db775cefb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3663341
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80838}
2022-05-31 08:38:22 +00:00
Andy Wingo
ec8b247201 [stringrefs] Implement string.new_wtf16
Bug: v8:12868
Change-Id: Ied5e985db139517ec34446bcb8b16041e5d79af7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3663092
Commit-Queue: Andy Wingo <wingo@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80823}
2022-05-30 15:12:46 +00:00
Leszek Swirski
31925e51de [test] Disable mjsunit/regress/regress-crbug-620253 on TSAN
Bug: v8:12920
Change-Id: Iec1f4a2effc45299e30ecf8a586c535dbb22ee20
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3676860
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80815}
2022-05-30 12:18:29 +00:00
Shu-yu Guo
60e02cfb0c Revert "[shared-struct] Add Atomics.Mutex"
This reverts commit ea9a1f1cbe.

Reason for revert: arm64 pointer alignment issue
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8812962856609920785/+/u/Check/mutex-workers

Original change's description:
> [shared-struct] Add Atomics.Mutex
>
> This CL adds a moving GC-safe, JS-exposed mutex behind the
> --harmony-struct flag. It uses a ParkingLot-inspired algorithm and
> each mutex manages its own waiter queue.
>
> For more details, please see the design doc: https://docs.google.com/document/d/1QHkmiTF770GKxtoP-VQ1eKF42MpedLUeqiQPfCqus0Y/edit?usp=sharing
>
> Bug: v8:12547
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> Change-Id: Ic58f8750d2e14ecd573173d17d5235a136bedef9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595460
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80789}

Bug: v8:12547
Change-Id: I226e16b743dc4b157fac33a9cbabab4d72cf290b
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3673353
Owners-Override: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80790}
2022-05-28 01:31:54 +00:00
Shu-yu Guo
ea9a1f1cbe [shared-struct] Add Atomics.Mutex
This CL adds a moving GC-safe, JS-exposed mutex behind the
--harmony-struct flag. It uses a ParkingLot-inspired algorithm and
each mutex manages its own waiter queue.

For more details, please see the design doc: https://docs.google.com/document/d/1QHkmiTF770GKxtoP-VQ1eKF42MpedLUeqiQPfCqus0Y/edit?usp=sharing

Bug: v8:12547
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Change-Id: Ic58f8750d2e14ecd573173d17d5235a136bedef9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595460
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80789}
2022-05-28 01:04:34 +00:00
Frank Tang
e85a0243ce [Temporal] Add PlainDate(Time)?.(compare|prototype.equals)
Also add AO CalendarEquals, CompareISODateTime

Remove Isolate from CompareISODate argument
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindate.compare
https://tc39.es/proposal-temporal/#sec-temporal.plaindate.prototype.equals
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.compare
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.equals
https://tc39.es/proposal-temporal/#sec-temporal-calendarequals
https://tc39.es/proposal-temporal/#sec-temporal-compareisodatetime

Bug: v8:11544
Change-Id: I5505c7923e3c1f76d44e292135b489ea20fbf13c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534458
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80787}
2022-05-27 23:02:04 +00:00
Shu-yu Guo
5299e11bda [change-array-by-copy] Add RAB/GSAB tests for toReversed
Bug: v8:12764
Change-Id: I51130143494e6442b335660d2fdcbc75f289fd92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3671759
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80785}
2022-05-27 21:00:34 +00:00
Leszek Swirski
9ed9dff9dd Revert "[builtins] use SIMD IndexOf/includes on large arrays"
This reverts commit ab76ffc8bd.

Reason for revert: Breaks on UBSan: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/21444/overview

Original change's description:
> [builtins] use SIMD IndexOf/includes on large arrays
>
> Change-Id: If751e813c7f45a4d18b84e8c0314a54c84894d61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3639203
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80771}

Change-Id: I62dd4249df122af567680cbaa18deb3c9ed44c90
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3672416
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80773}
2022-05-27 09:17:44 +00:00
Darius M
ab76ffc8bd [builtins] use SIMD IndexOf/includes on large arrays
Change-Id: If751e813c7f45a4d18b84e8c0314a54c84894d61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3639203
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80771}
2022-05-27 08:40:25 +00:00
Frank Tang
4ad4ba1dff [Temporal] Add Plain(Date)?Time.prototype.with
Refactor ToTemporalTimeRecord to a new routine
ToTemporalTimeRecordOrPartialTime to share code with ToPartilTime
Change the return type of ToTemporalTimeRecord, RegulateTime

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaintime.prototype.with
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.with
https://tc39.es/proposal-temporal/#sec-temporal-topartialtime

Bug: v8:11544
Change-Id: I214147f497a405ee48e264833c7c0b9401596c01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3665269
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80769}
2022-05-27 04:00:13 +00:00
Frank Tang
86a219d9c9 [Temporal] Add Duration.prototype.with
Also add AO: ToPartialDuration
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal-topartialduration
https://tc39.es/proposal-temporal/#sec-temporal.duration.prototype.with

Bug: v8:11544
Change-Id: I43282f5285a3c884229445547add6db2cde4fbe4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3380102
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80767}
2022-05-27 00:53:03 +00:00
Adam Klein
2c2280554e Enable mjsunit/wasm/shared-memory-worker-gc
This test had been skipped since it was added in
4a416dbbe1.

Bug: v8:9380
Change-Id: I700f83fa4242baf44dd260fbc74520abf05101dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3670052
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80766}
2022-05-26 22:19:29 +00:00
Frank Tang
1b13172df3 [Temporal] Add PlainDateTime.prototype.withPlainDate
Also add AO: ConsolidateCalendars

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.withplaindate
https://tc39.es/proposal-temporal/#sec-temporal-consolidatecalendars

Bug: v8:11544
Change-Id: I98084f7cc92a837f6401a88ad10389a7c5df8b3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563541
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80764}
2022-05-26 20:42:09 +00:00
Manos Koukoutos
66d3d28149 [wasm-gc] Improve array allocation
We inline array allocation for wasm-gc in the TF graph by using
AllocateRaw nodes. Additionally, we use memset to initialize large,
zero-initialized arrays. These changes give measurable speedup in some
benchmarks.

Bug: v8:7748
Change-Id: Icbd37d0fe673c673379139b96d0e1c175e95e357
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3666618
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80762}
2022-05-26 17:19:19 +00:00
Frank Tang
cc8b442773 [Temporal] Add PlainTime.prototype.toPlainDateTime
Spec Text: https://tc39.es/proposal-temporal/#sec-temporal.plaintime.prototype.toplaindatetime

Bug: v8:11544
Change-Id: I95bab9814471bb9347101d654f6dc902159f8fe3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538670
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80757}
2022-05-26 04:45:19 +00:00
Frank Tang
600cebb4d0 [Temporal] Add Date.prototype.toTemporalInstant
Spec Text:
https://tc39.es/proposal-temporal/#sec-date.prototype.totemporalinstant

Bug: v8:11544
Change-Id: I65315152333291f76edc05cc41a528912a185d02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609214
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80755}
2022-05-25 18:20:10 +00:00
Manos Koukoutos
fe44d70604 [test] Skip failing test
Bug: v8:12907
Change-Id: I8a6da86b4c88b5cfcc9bbb349841c422ac81b64e
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3667082
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80751}
2022-05-25 15:04:47 +00:00
Andy Wingo
e4941131f1 [stringrefs] Implement string.new_wtf8
Bug: v8:12868

Also adds the equivalent of Utf8Decoder, but for WTF-8.

Change-Id: I1548a44b0aea912cdd429eb85be4dfc606355cad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3660257
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80750}
2022-05-25 14:38:38 +00:00
Maya Lekova
5480e036d2 [megadom] Add TF inlining for Megadom
The generated code checks if the receiver is a JS_API_OBJECT and if the
receiver requires an access check, and if not it lowers the call to an
API call.

We also add compilation dependencies on the protector cell to deopt if
our invariants change. (Note - the actual invalidation of these cells
will be implemented in a follow up CL)

Bug: v8:11321
Change-Id: I15722f1e5fac7176e292da4a35186e4609636aba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2719563
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80748}
2022-05-25 14:07:01 +00:00
Darius M
702f0ff111 [compiler] Inline Array.prototype.at in JSCallReducer
Bug: v8:12865
Change-Id: I539a5b0a9c3c78ef9a767de75b71dd06de337d9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647351
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80740}
2022-05-25 10:01:03 +00:00
Frank Tang
702f874a3b [Temporal] Add PlainDateTime.prototype.toPlain(Date|Time)
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.toplaindate
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.toplaintime

Bug: v8:11544
Change-Id: Ifb7115823d1d3d1ff53806f1b376d69302e00ae1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3385761
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80731}
2022-05-25 01:17:21 +00:00
Patrick Thier
9964283126 Re-enable shared-memory tests under tsan/stress_incremental_marking
The underlying issue was fixed with https://crrev.com/c/3660258

Bug: v8:12883
Change-Id: If7a1fdaf122396396cfbaaae3a68ef89bafc1703
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3663342
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80728}
2022-05-24 18:05:03 +00:00
jameslahm
560ce080fe [test] split websnapshot tests to avoid
... timeout in the big websnapshot tests.

Bug: v8:12891
Change-Id: I7837ba985f835e20af294ea0206dfafb5def7619
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3660705
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80713}
2022-05-24 09:57:58 +00:00
Solomon Kinard
ab2aa72dc7 v8: Copyright: Remove extra slashes
Change-Id: I924a2b4dc4ab5e7be22fd2a9a1084473ba65fc35
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3651039
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80711}
2022-05-24 09:40:28 +00:00
Frank Tang
3c53e9adae [Temporal] Add PlainDateTime.prototype.withPlainTime
Spec text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.withplaintime

Bug: v8:11544
Change-Id: I5277fb88675bb6d99b028a289329db06b95cc003
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565026
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80706}
2022-05-24 05:11:48 +00:00
Shu-yu Guo
116e6a528d [change-array-by-copy] Implement toReversed
Bug: v8:12764
Change-Id: I7e76647be838749b723400914b144b9ec2a27cd7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3656520
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80703}
2022-05-24 00:57:21 +00:00
Joyee Cheung
bb98b38735 [ic] handle access check for private names
Previously the LookupIterator ignores private symbols
(including private names) for the access check. This patch
removes these exceptions so that they are always checked.

Drive-by: removes the unused should_throw parameter in
Runtime::DefineObjectOwnProperty()

Bug: chromium:1321899
Change-Id: I9677b1e377f01d966daa1603eee1ed9535ffab92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623419
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80700}
2022-05-23 18:30:07 +00:00
Leszek Swirski
9ec29a4428 [maglev] Implement BranchIfInt32Compare
Add an implementation of BranchIfInt32Compare, which is emitted whenever
a compare op is immediately followed by a branch.

Bug: v8:7700
Change-Id: I2c56d9de199bac8de33b33201f8614aee8e9894e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647693
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80694}
2022-05-23 11:40:57 +00:00
Frank Tang
a2f22f4355 [Temporal] Add PlainDate(Time)? toPlain*Month*
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindate.prototype.toplainmonthday
https://tc39.es/proposal-temporal/#sec-temporal.plaindate.prototype.toplainyearmonth
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.toplainyearmonth
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.prototype.toplainmonthday


Bug: v8:11544
Change-Id: Ia97de3b4dde183ae4ee514deb4d13da5d5ff9bae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534451
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80680}
2022-05-21 00:26:07 +00:00
Frank Tang
74aa5e7d68 [Temporal] Add Temporal.Duration.prototype.toJSON
Also add AO: TemporalDurationToString

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.duration.prototype.tojson
https://tc39.es/proposal-temporal/#sec-temporal-temporaldurationtostring

Bug: v8:11544
Change-Id: I7dfdb5458b88646a4ac7b7713e7c8e63352f7539
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3438375
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80677}
2022-05-20 22:38:35 +00:00
Andy Wingo
44932c1689 [stringrefs] Parse the string literals section
Bug: v8:12868

Also adds wtf8.cc, wtf8.h to src/wasm, to implement WTF-8 validation and
possibly other utilities.  Also fixes a bug when parsing the string
literals section; I had misunderstood the way the unordered/ordered
sections mechanism worked.

Change-Id: I3c4205e0872379a69575f84ba33e0090a9d8d656
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652789
Commit-Queue: Andy Wingo <wingo@igalia.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80674}
2022-05-20 20:04:35 +00:00
Marja Hölttä
e819612aaf [web snap] Enable context referring to function
Bug: v8:11525,v8:12820
Change-Id: Ic4cd3172a4d6884b8234ca6b6463dfc405e10ba1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652793
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80672}
2022-05-20 16:10:44 +00:00
Tobias Tebbi
6e1fcf22f3 [test] remove flaky isOptimized check in regress-crbug-1323114.js
Bug: v8:12893
Change-Id: Ibc2068011243b2ec811cd90646f0ec2a0d93cc05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3657433
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80671}
2022-05-20 14:50:02 +00:00
Leszek Swirski
47090774a4 [maglev] Add more Int32/Float64 arithmetic nodes
Add Int32/Float64 nodes for:

  * Subtract
  * Multiply
  * Divide

and additionally Int32 nodes for

  * BitwiseOr/And/Xor
  * ShiftLeft/Right/RightLogical

The latter ones don't have Float64 equivalents since they're implicitly
Int32 operations. In the future we'll add support for Number feedback by
adding Float64-to-Int32 conversions and using the Int32 nodes.

The divide node does an Int32 division and deopts if there's a remainder
to the division -- we may want to make it output a Float64 instead if we
think that's more likely in real-world code. There's also no peephole
optimisations for constant operations, which would generate much better
code, especially for shifts.

Bug: v8:7700
Change-Id: Ief1d24b46557cf4d2b7929ed50956df7b0d25992
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652301
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80670}
2022-05-20 14:48:59 +00:00
Marja Hölttä
0d57c9a863 [web snap] Fix context tree serialization
Enforce the parent context has a smaller id, this time more forcefully.

Bug: v8:11525,v8:12820
Change-Id: I05bf675545b81b818eebfcaa40ee6bb93f5bcf9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652792
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80666}
2022-05-20 12:21:50 +00:00
Jakob Kummerow
86be87df9c [bigint] Fix object literal property keys like 0x0n
Fixed: chromium:1327321
Change-Id: I4868e0127b9dd14a0812cafca1681280534faa46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652788
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80661}
2022-05-20 11:21:15 +00:00
Issack John
a679edbb6e JSON.parse errors made user-friendly part 2
Part of the improve error messages initiative.

Based on a resource of JSON.parse() errors found at
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/JSON_bad_parse

added support for:
- 'Bad control character in string literal'
- 'Bad Unicode escape'

Previously JSON.parse('"a\bz"') would output:
SyntaxError: Unexpected token  in JSON at position 2
Now the output is:
SyntaxError: Bad control character in string literal in
JSON at position 2

Previously JSON.parse("[\"\\t\\u") would output:
SyntaxError: Unexpected end of JSON input
Now the output is:
SyntaxError: Bad Unicode escape in JSON at position 6

Bug: v8:6551
Change-Id: I3ba5450c41b8a388643a15bc58e4e3fc75855d13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652254
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Issack John <issackjohn@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#80642}
2022-05-19 15:07:03 +00:00
Frank Tang
5354d8a1c6 [Temporal] Add PlainYearMonth.prototype.toJSON
Also add AOs: TemporalYearMonthToString

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plainyearmonth.prototype.tojson
https://tc39.es/proposal-temporal/#sec-temporal-temporalyearmonthtostring

Bug: v8:11544
Change-Id: Ibe8bd20ae5eb5b7721e50cf5386c20d8d23e18e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3437894
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80627}
2022-05-19 05:06:23 +00:00
Frank Tang
0b44a86009 [Temporal] Add PlainMonthDay.prototype.toJSON
Also add AO: TemporalMonthDayToString

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plainmonthday.prototype.tojson
https://tc39.es/proposal-temporal/#sec-temporal-temporalmonthdaytostring

Bug: v8:11544
Change-Id: Ibbc5b28a9c73474f7edc1b67c9beabf5bca54dbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3437891
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80624}
2022-05-19 02:44:13 +00:00
Frank Tang
a5697616eb [Temporal] Add PlainDate.prototype.toJSON
Also add AOs: PadISOYear, FormatCalendarAnnotation, TemporalDateToString
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindate.prototype.tojson
https://tc39.es/proposal-temporal/#sec-temporal-padisoyear
https://tc39.es/proposal-temporal/#sec-temporal-formatcalendarannotation
https://tc39.es/proposal-temporal/#sec-temporal-temporaldatetostring

Change the ISODateTimeWithinLimits from
-8.64 × 10^21 - 8.64 × 10^16, 8.64 × 10^21 + 8.64 × 10^16
to
-8.64 × 10^21 - 8.64 × 10^13, 8.64 × 10^21 + 8.64 × 10^13
per https://github.com/tc39/proposal-temporal/pull/1723

Change to use AppendCStringLiteral instead of AppendCharacter when
appropriate.

Bug: v8:11544
Change-Id: I01f22657b2c3e5aacbea790593d7e9f60076ec74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3438379
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80622}
2022-05-19 01:22:23 +00:00
Adam Klein
09c1012b21 Skip shared-memory tests under tsan/stress_incremental_marking
Goal is to keep the tree green while the issue is investigated.
No impact on shipped product since shared-memory is flag-guarded off.

Bug: v8:12883
Change-Id: I9a434bdebc781023fa6693eef47db6dbe81cd4bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3653320
Auto-Submit: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80619}
2022-05-18 18:48:01 +00:00
Marja Hölttä
2cb5a08f43 [web snapshot] Add support for derived constructors
Especially, this requires having the __proto__s of functions serialized.

Drive-by fix (gc stress): Handlify IterateBuiltinObjects.

Bug: v8:11525
Change-Id: I8dc50b9144d17134a7c9b8fdbabe23f5e44f197f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644613
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80608}
2022-05-18 07:42:21 +00:00
Frank Tang
972d7e5abf [Temporal] Add TimeZone getOffset(Nanoseconds|String)For
Also add the non-intl version of AO
GetIANATimeZoneOffsetNanoseconds which only implement for UTC.
(intl version implement other tz come later)

Also fix bug in JSTemporalTimeZone::offset_nanoseconds() that
"1000000L * offset_milliseconds()" may overflow int32_t before returning as int64_t by first casting offset_milliseconds() to int64_t in the operation so the whole formula is calculating under 64 bits not 32 bits. This bug fix some  *timezone-string-datetime tests.

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getoffsetnanosecondsfor
https://tc39.es/proposal-temporal/#sec-temporal.timezone.prototype.getoffsetstringfor
https://tc39.es/proposal-temporal/#sec-temporal-getianatimezoneoffsetnanoseconds

Bug: v8:11544
Change-Id: I2227dbfc8d6ed3ef83edcef5a9b903b8642b5902
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534622
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80606}
2022-05-18 07:15:48 +00:00
Andy Wingo
010de10eb8 [stringref] Add support for stringrefs in tables
Bug: v8:12868
Change-Id: I42ef3e15b2a7fd2ef157aa0e657ddf98973e8d79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644956
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80605}
2022-05-18 06:11:20 +00:00
Andy Wingo
59b7d6a0c1 [stringref] Add test for wasm-to-js calls
Bug: v8:12868
Change-Id: I8d789457c725708e06f482d362d17c16a802a1f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644950
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80603}
2022-05-17 19:14:37 +00:00
Solomon Kinard
87b4acd3d6 v8: Remove extra slashes
Change-Id: Ib5d2e24ee4a83547b9d403d5d8b5d75173b8310b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3648093
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Solomon Kinard <solomonkinard@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80597}
2022-05-17 15:27:27 +00:00
Manos Koukoutos
2a606bdb27 [wasm-gc][turbofan] Allow incompatible mutability in CsaLoadElimination
Loading from/storing to the same field with incompatible mutabilities
is possible in unreachable code, specifically when a value is cast to
two different types with incompatible mutability for the same field
offset. Therefore, we allow this pattern in CsaLoadElimination.
When we detect it, we emit an Unreachable node to immediately crash the
program in case this unreachable code is somehow executed.

Bug: v8:7748, v8:12874
Change-Id: Ieb359d3e1b9f7bc4a91c556af2bba0507526d20e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644806
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80587}
2022-05-17 13:06:28 +00:00
Andy Wingo
1a3edfb7e5 [stringref] Add support for stringref globals, with JS interface
Bug: v8:12868
Change-Id: I955155db468b2ecd86fa6c5a73c616b0e4c66446
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644949
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80584}
2022-05-17 11:35:47 +00:00
Marja Hölttä
eb56775a69 [rab/gsab]: RAB/GSAB support for Function.p.apply
Bug: v8:11111, chromium:1321013
Change-Id: Iec45b885e844ab02059470dd514f47133b0a6efe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650596
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80583}
2022-05-17 10:50:27 +00:00
Solomon Kinard
b5c95961bd v8: Copyright: Remove extra slashes
Change-Id: I3d3b1f0b86714e0d654ed18c055d394002dbec2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650832
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80582}
2022-05-17 10:18:24 +00:00
Andy Wingo
e5af9c4f97 [stringref] Add support for passing stringref values to/from JS
Bug: v8:12868
Change-Id: Ib4540352c7db4b4bdbf88b559da44b08e71dd483
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650603
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80580}
2022-05-17 09:42:28 +00:00
Solomon Kinard
f54408434b v8: Copyright: Remove extra slashes
Change-Id: Ib8ca0c771b50b712e5fd6acb470213235f69a99b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650833
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Solomon Kinard <solomonkinard@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80569}
2022-05-16 18:19:06 +00:00
Issack John
718f743750 JSON.parse errors made user-friendly
Part of the improve error messages initiative.

Based on a resource of JSON.parse() errors found at
https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Errors/JSON_bad_parse

Previously JSON.parse(NaN) would output:
SyntaxError: Unexpected token N in JSON at position 0
Now the output is:
SyntaxError: "NaN" is not valid JSON

Previously JSON.parse("{a:1}") would output:
SyntaxError: Unexpected token a in JSON at position 1
Now the output is:
SyntaxError: Expected property name or '}' in JSON at position 1

Bug: v8:6551
Change-Id: Ic9fad1fdbd295e1302805b81e6603fc526121960
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3513684
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Issack John <issackjohn@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#80567}
2022-05-16 17:02:37 +00:00
Tobias Tebbi
b209cdf5bb [compiler] add test for crbug-1323114
This is a follow-up to
https://chromium-review.googlesource.com/c/v8/v8/+/3630081

Bug: chromium:1323114
Change-Id: Ie6e3cbdecf370c5fdf9544c2f47f7b4f8f27bd70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647826
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80550}
2022-05-16 11:50:56 +00:00
Jakob Kummerow
48a4195370 [wasm-gc] Fix type checking of null/undefined
The LookupIterator only handles JSReceivers, so special-case oddballs.

Change-Id: I03d2875124775390c9b928fb7cfe4d938213b5d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3645409
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80548}
2022-05-16 10:44:46 +00:00
Andy Wingo
7d8b8b4f2f [stringref] Add support for parsing stringref instructions
Bug: v8:12868

This wires up the parser and the decoder interface for stringref.  All
of the interfaces throw UNIMPLEMENTED, however.

Change-Id: If8cb131032e425a5672f793c6e4c24ddd188aebc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3645115
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80545}
2022-05-16 10:10:06 +00:00
Marja Hölttä
36565f6b5c [rab/gsab] Fix memory size computations close to size_t limit
Bug: v8:11111,v8:1321980
Change-Id: I4dead5d50a2e1a9c1011c16d13aad2722598e456
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3642297
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80541}
2022-05-16 09:13:38 +00:00
Andy Wingo
59518b083a [stringref] Add stringref type, section, feature flag definitions
Bug: v8:12868
Change-Id: I69e149aa607ee77dd00267a0bbe4e5828dceb75e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647350
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80526}
2022-05-13 14:28:43 +00:00
Andy Wingo
94ba69011e [stringref] Add tests that stringrefs are unsupported by default
Bug: v8:12868
Change-Id: I9008da5f89c4c18ea45ddbe44cae832087c76b01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647349
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andy Wingo <wingo@igalia.com>
Cr-Commit-Position: refs/heads/main@{#80523}
2022-05-13 13:44:24 +00:00
jameslahm
557cc8a464 [web snapshot] Add support for double array
This CL adds serialization and deserialization for
packed double array and holey double array.

Bug: v8:11525
Change-Id: Idce22e1c5d707e45127ae972587c6b7808ca2cda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3640751
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80514}
2022-05-13 09:22:45 +00:00
Tobias Tebbi
b16d2a4e2f [wasm] add experimental string/Wasm GC array conversion fast-path
This CL adds two experimental JS builtins to convert between
i16 Wasm GC and JS strings. This is a non-standard experimental
feature only available with the flag --wasm-gc-js-interop.

WebAssembly.experimentalConvertArrayToString(array, start, count)
Convert the `count`-many WTF-16 code units starting at index `start`
into a JS string. Throws a TypeError if `array` is not an i16 array,
or if `start` and `count` are not numbers or not in range.

WebAssembly.experimentalConvertStringToArray(string, sampleArray)
Convert `string` to an i16 array. The `sampleArray` parameter needs
to be an arbitrary i16 array, which is only used to extract the rtt.
Throws a TypeError if `string` is not a string or `sampleArray` is not
an i16 array.

Change-Id: I7ac2f6bd89b8f638427f61da1bb01ccba90d735b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3642301
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80505}
2022-05-12 20:12:53 +00:00
Jakob Kummerow
8f3581125a [wasm-gc] Fix instantiation of modules with no types
Fixed: v8:12866
Change-Id: Icba2ffc7837bf4942fd4bc741abeb7c98694c2d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644607
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andy Wingo <wingo@igalia.com>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80500}
2022-05-12 17:48:17 +00:00
Jakob Kummerow
2f8f536b55 [wasm] Properly reject modules with unknown sections
The IsValidSectionCode function shouldn't include internally-used
numeric identifiers of well-known optional sections.

Fixed: v8:12867
Change-Id: I9d894ee57157455e92a17ddcde94f32f05fb038d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644612
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80494}
2022-05-12 15:08:02 +00:00
Jakob Kummerow
c875e86df1 [bigint] Convert BigInt property names to decimal
Hexadecimal/octal/binary BigInt property names should be converted
to decimal, i.e. the following object literals should all be equivalent:
var o = {0xF: 1}, p = {0xFn: 1}, q = {15: 1}, r = {15n: 1}.

Test case by yangwenming@bytedance.com, uploaded at
https://chromium-review.googlesource.com/c/v8/v8/+/3634937

Fixed: v8:10600
Change-Id: Ie1d8a16e95697cd31cbc0784843779c921ce91fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3642302
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80490}
2022-05-12 13:28:02 +00:00
Marja Hölttä
94b4391dab [web snap] Support inheriting from builtins
Side product: enable null as __proto__.

Bug: v8:11525,v8:12820
Change-Id: I2b9508d0f3563d9000ddede24e7684aab18c2b5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3637791
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80474}
2022-05-11 14:54:43 +00:00
Jakob Kummerow
8fbefa4797 [wasm-gc] Experiment: ref.cast_nop_static
This adds a non-standard, unsafe instruction for performance
experiments: ref.cast_nop_static behaves like ref.cast_static
as far as static types are concerned, but emits no code.

Bug: v8:7748
Change-Id: Ic5797a941146a06d7c6ff249d8e29919145d8ea1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3639206
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80471}
2022-05-11 13:19:12 +00:00
Nico Hartmann
338c12b3af [turbofan] Fix length accessor for RAB/GSAB in compiled code
Bug: v8:11111, chromium:1307340
Change-Id: I7c68d4985c080bf5c595a4ae3360fc924b1bdefb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3627595
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80452}
2022-05-10 15:34:25 +00:00
jameslahm
abe1b97dd2 [web snapshot] Add support for sparse array
This CL adds the array type flag to distinguish between
sparse array and dense array and adds serialization
and deserialization for sparse array.

Bug: v8:11525
Change-Id: Ia302af017d6f52924256a2b3fa9e3d2b34caa442
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629739
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80449}
2022-05-10 12:40:58 +00:00
Marja Hölttä
395350c064 [web snap] Fix: allow empty objects to have non-trivial prototypes
Bug: v8:11525
Change-Id: I226ba870cee7df20a7960defb0c03607d64e27b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634962
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80445}
2022-05-10 10:29:16 +00:00
Marja Hölttä
ce488c0156 Reland: [web snapshot] Recognize builtins
Builtins are not snapshotted, but instead we insert "builtin wrappers"
into the snapshot, and create references to the corresponding builtin
when deserializing.

Subclassing builtins will be implemented in a follow-up CL.

First version: https://chromium-review.googlesource.com/c/v8/v8/+/3630080
Fix: initialize builtin_objects_handle_

Bug: v8:11525,v8:12820
Change-Id: Ia2b5d41af5d7f577f1b02356b22a8760963009e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3635718
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80430}
2022-05-09 16:41:25 +00:00
Clemens Backes
d48558e6b7 Revert "[web snapshot] Recognize builtins"
This reverts commit 71dbb03e21.

Reason for revert: gc-stress failures: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38357

Original change's description:
> [web snapshot] Recognize builtins
>
> Builtins are not snapshotted, but instead we insert "builtin wrappers"
> into the snapshot, and create references to the corresponding builtin
> when deserializing.
>
> Subclassing builtins will be implemented in a follow-up CL.
>
> Bug: v8:11525,v8:12820
> Change-Id: If72695d46bdfc8bf7e477471be1264b668551854
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630080
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80419}

Bug: v8:11525,v8:12820
Change-Id: I49f65103ad7b367c5bccb498f698e9afb29b1fec
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3634799
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80422}
2022-05-09 12:25:24 +00:00
Marja Hölttä
71dbb03e21 [web snapshot] Recognize builtins
Builtins are not snapshotted, but instead we insert "builtin wrappers"
into the snapshot, and create references to the corresponding builtin
when deserializing.

Subclassing builtins will be implemented in a follow-up CL.

Bug: v8:11525,v8:12820
Change-Id: If72695d46bdfc8bf7e477471be1264b668551854
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3630080
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80419}
2022-05-09 10:45:44 +00:00
Al Muthanna Athamina
9694663248 Skip failing tests due to stress-concurrent-inlining flag
NOTRY=true

Bug: v8:12842
Change-Id: If3cac473407fc60523de5924170b7c3b99074d54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629546
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80375}
2022-05-05 14:36:58 +00:00
jameslahm
e43cfdd800 Reland "[web snapshot] Add support for object with dictionary mode"
This is a reland of commit 507fa4d7f5

This CL moves the NewJSObjectFromMap after deserializing object properties with dictionary map and fixes the DCHECK failure in JSReceiver::HasFastProperties when triggering GC.

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I88422d698aa03fb7d3b21b5709eec2d0cf306256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629738
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80374}
2022-05-05 14:33:09 +00:00
Al Muthanna Athamina
82339990dc Move skipped tests on Numfuzz to a separate section to reduce duplication
NOTRY=true

Bug: v8:12826
Change-Id: Ibe1bad5837221903a7a47af7f2cc49963952a67e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629335
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80372}
2022-05-05 13:35:49 +00:00
Leszek Swirski
dc92fe0931 [maglev] Fix result regalloc clobbering inputs
Consider the following

  * A ValueNode has inputs A and B
  * Input A has later uses, input B doesn't
  * The ValueNode's result must be in the same register as A

It can then happen that UpdateUses frees B, and the result allocation
emits a gap move from A's register to B's old register (now free) to
preserve the value of A when the ValueNode writes into its register.
This gap move is emmitted before the ValueNode start, which means that
it clobbers B.

Now, UpdateUses only clears registers _after_ node result allocation, so
that the known free registers are still the ones before updating uses.

Done naively, this would have bad consequences -- in the case where A
has no later uses, it would still force the regalloc to save its value
thinking that it is still live. So, this patch also introduces a concept
of "AllocationStage" where we're either allocating at the start or end
of a Node. Inputs are allocated at the start, results at the end. When
walking registers during an allocation, nodes whose lifetimes end at the
current node are considered to be dead at the "end" allocation stage,
and we are allowed to a) use their registers, and b) drop them without
preserving their value.

Bug: v8:7700
Change-Id: I5ca764ed04b12269f189577e81eb7e2a27cd1b09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3625978
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80371}
2022-05-05 13:07:16 +00:00
Al Muthanna Athamina
c56edd3eba Skip mjsunit/turboshaft/simple on numfuzz until flake is solved
NOTRY=true

Bug: v8:12826
Change-Id: I08be2980f92c69504290bb6152e48595e6a6c9aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629540
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80369}
2022-05-05 12:34:33 +00:00
Nico Hartmann
f479b0163f Revert "[web snapshot] Add support for object with dictionary mode"
This reverts commit 507fa4d7f5.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/38308/overview

Original change's description:
> [web snapshot] Add support for object with dictionary mode
>
> This CL adds the serialization support for object properties
> with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.
>
> Bug: v8:11525
> Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80366}

Bug: v8:11525
Change-Id: I0d236a9937a5942b387553a61991716321b063e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3629541
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80368}
2022-05-05 12:33:29 +00:00
jameslahm
507fa4d7f5 [web snapshot] Add support for object with dictionary mode
This CL adds the serialization support for object properties
with dictionary map. Shape id is used to distinguish between if the object has dictionary map. And add TODO to support “no map objects” which can have fast map and “objects with map” which needs to be turned to dictionary mode.

Bug: v8:11525
Change-Id: If3eb4195115a41d4a3f6cc7372924b982ca96fc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3621593
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80366}
2022-05-05 11:33:48 +00:00
Frank Tang
10bbb38fed [Temporal] Add Temporal.Calendar.prototype.month
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.month

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.month
will be implemented in later cl.

Bug: v8:11544
Change-Id: Ibbbb00faa0bdb4d49784cd9aae69fb779d95f924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531554
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80359}
2022-05-04 21:35:58 +00:00
Frank Tang
08a5a57311 [Temporal] Add Temporal.Calendar.prototype.monthCode
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.monthcode

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.monthcode
will be implemented in later cl.

Bug: v8:11544
Change-Id: I52dfc1bda6d2ed8c0aba735c64d7ae8227844ed1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531555
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80348}
2022-05-03 21:07:47 +00:00
Frank Tang
97122a4838 [Temporal] Add Temporal.Calendar.prototype.day
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.day

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.day
will be implemented in later cl.

Bug: v8:11544
Change-Id: If56182cf65b3b8cc91ed843f0e20edeb6a065954
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531556
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80347}
2022-05-03 19:58:20 +00:00
Frank Tang
e86bde3dfa Revert "[test] Skip flaking test"
This reverts commit 0a5fcd8a78.

Reason for revert: reenable TSAN test after moving best_fit out from stage

Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng,v8_linux64_tsan_no_cm_rel_ng,v8_linux64_tsan_rel_ng,v8_numfuzz_tsan_ng;luci.chromium.try:linux_chromium_tsan_rel_ng,linux_chromium_tsan_rel_ng-compilator

Original change's description:
> [test] Skip flaking test
>
> Bug: v8:12697
> Change-Id: I124f2f0fd3c98d6a5233a0e2a8236a2b15d791fd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532261
> Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79518}

Bug: v8:12697
Change-Id: I53d109674ecd938d8be915099c412d174600edfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3624464
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80346}
2022-05-03 19:16:37 +00:00
Marja Hölttä
80d8f0c06e [web snap] Support Symbols as property keys
Bug: v8:11525,v8:12820
Change-Id: I58bde48322c89bf33f3b28080659387a3c14de91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620277
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80341}
2022-05-03 12:54:37 +00:00
Marja Hölttä
d762376714 [rab/gsab] Skip a test in predictable mode
No-Try: true
Bug: v8:12847, v8:11111
Change-Id: Id0c2749970333b82650b33c9cddcb028ac03709c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3623541
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80339}
2022-05-03 12:31:57 +00:00
Camillo Bruni
e3e8ea5d65 [flags] Rename --opt to --turbofan
To be consistent with the all the other tiers and avoid confusion, we
rename --opt to ---turbofan, and --always-opt to --always-turbofan.

Change-Id: Ie23dc8282b3fb4cf2fbf73b6c3d5264de5d09718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610431
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80336}
2022-05-03 12:10:30 +00:00
Marja Hölttä
1ac6b3a662 Reland: [web snap] Support Symbols
Fix: copy-paste error in raw ptr GC update function.

Bug: v8:11525
Change-Id: I915ae92191b2add60962395a2d0ad28f57e02fd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3622915
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80328}
2022-05-03 09:03:39 +00:00
jameslahm
c4281cd933 [web snapshot] Add support for arrays w/holes
This CL adds serialization and deserialization support
for HOLEY_ELEMENTS and HOLEY_SMI_ELEMENTS kind arrays.

Bug: v8:11525
Change-Id: Ib6fdcd1916badd02e567571e1c0748dce85cd8a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620753
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80313}
2022-05-02 17:07:19 +00:00
Patrick Thier
ee247818e6 [string] Fix string table lookup with SlicedStrings
https://crrev.com/c/3571817 introduced a bug that string table lookups
failed on SlicedStrings with a start offset of 0.
This CL fixes the issue by re-using the already computed hash only
if the length of the source string matches the length of the string to
lookup.

Bug: chromium:1320179, chromium:1321573
Change-Id: Ic8755a0266a9ec67fe5eb9c96fdab1b55d5009f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616723
Auto-Submit: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80309}
2022-05-02 14:47:44 +00:00
Jakob Linke
0e9a55d24f Reland "Reland "[osr] Use the new OSR cache""
This is a reland of commit 9145388055

Fixed: properly reference the ClearedValue in CSA (i.e. without
the cage_base upper 32 bits).

Original change's description:
> Reland "[osr] Use the new OSR cache"
>
> This is a reland of commit 91da38831d
>
> Fixed: Use an X register for JumpIfCodeTIsMarkedForDeoptimization
> on arm64.
>
> Original change's description:
> > [osr] Use the new OSR cache
> >
> > This CL switches over our OSR system to be based on the feedback
> > vector osr caches.
> >
> > - OSRing to Sparkplug is fully separated from OSR urgency. If
> >   SP code exists, we simply jump to it, no need to maintain an
> >   installation request.
> > - Each JumpLoop checks its dedicated FeedbackVector cache slot.
> >   If a valid target code object exists, we enter it *without*
> >   calling into runtime to fetch the code object.
> > - Finally, OSR urgency still remains as the heuristic for
> >   requesting Turbofan OSR compile jobs. Note it no longer has a
> >   double purpose of being a generic untargeted installation
> >   request.
> >
> > With the new system in place, we can remove now-unnecessary
> > hacks:
> >
> > - Early OSR tierup is replaced by the standard OSR system. Any
> >   present OSR code is automatically entered.
> > - The synchronous OSR compilation fallback is removed. With
> >   precise installation (= per-JumpLoop-bytecode) we no longer
> >   have the problem of 'getting unlucky' with JumpLoop/cache entry
> >   mismatches. Execution has moved on while compiling? Simply spawn
> >   a new concurrent compile job.
> > - Remove the synchronous (non-OSR) Turbofan compile request now
> >   that we always enter available OSR code as early as possible.
> > - Tiering into Sparkplug no longer messes with OSR state.
> >
> > Bug: v8:12161
> > Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
> > Commit-Queue: Jakob Linke <jgruber@chromium.org>
> > Auto-Submit: Jakob Linke <jgruber@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#80147}
>
> Bug: v8:12161
> Change-Id: Ib3597cf1d99cdb5d0f2c5ac18e311914f376231d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606232
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80167}

Bug: v8:12161,chromium:1320189
Change-Id: Ibd9a2ab61f51ebb32a3f5a66f7c602faead71c3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620273
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80306}
2022-05-02 14:26:14 +00:00
Leszek Swirski
9b78282370 Revert "[web snap] Support Symbols"
This reverts commit 1267e51873.

Reason for revert: Turned out to not support them: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8815278972589078465/+/u/Bisect_1267e518/Retry/web-snapshot-4

Original change's description:
> [web snap] Support Symbols
>
> Bug: v8:11525,v8:12820
> Change-Id: Ie8b1bbe209d8bb6f759623ea01223a05d11090aa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616514
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80299}

Bug: v8:11525,v8:12820
Change-Id: Ia0107dfec12e72dc976348985e5c35dac28c170a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3620278
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80302}
2022-05-02 13:04:14 +00:00
Marja Hölttä
1267e51873 [web snap] Support Symbols
Bug: v8:11525,v8:12820
Change-Id: Ie8b1bbe209d8bb6f759623ea01223a05d11090aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616514
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80299}
2022-05-02 11:18:05 +00:00
Rohan Pavone
896f6e749a Revert "Reland "[osr] Use the new OSR cache""
This reverts commit 9145388055.

Reason for revert: Breaking the Fuchsia Deterministic Builder

Original change's description:
> Reland "[osr] Use the new OSR cache"
>
> This is a reland of commit 91da38831d
>
> Fixed: Use an X register for JumpIfCodeTIsMarkedForDeoptimization
> on arm64.
>
> Original change's description:
> > [osr] Use the new OSR cache
> >
> > This CL switches over our OSR system to be based on the feedback
> > vector osr caches.
> >
> > - OSRing to Sparkplug is fully separated from OSR urgency. If
> >   SP code exists, we simply jump to it, no need to maintain an
> >   installation request.
> > - Each JumpLoop checks its dedicated FeedbackVector cache slot.
> >   If a valid target code object exists, we enter it *without*
> >   calling into runtime to fetch the code object.
> > - Finally, OSR urgency still remains as the heuristic for
> >   requesting Turbofan OSR compile jobs. Note it no longer has a
> >   double purpose of being a generic untargeted installation
> >   request.
> >
> > With the new system in place, we can remove now-unnecessary
> > hacks:
> >
> > - Early OSR tierup is replaced by the standard OSR system. Any
> >   present OSR code is automatically entered.
> > - The synchronous OSR compilation fallback is removed. With
> >   precise installation (= per-JumpLoop-bytecode) we no longer
> >   have the problem of 'getting unlucky' with JumpLoop/cache entry
> >   mismatches. Execution has moved on while compiling? Simply spawn
> >   a new concurrent compile job.
> > - Remove the synchronous (non-OSR) Turbofan compile request now
> >   that we always enter available OSR code as early as possible.
> > - Tiering into Sparkplug no longer messes with OSR state.
> >
> > Bug: v8:12161
> > Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
> > Commit-Queue: Jakob Linke <jgruber@chromium.org>
> > Auto-Submit: Jakob Linke <jgruber@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#80147}
>
> Bug: v8:12161
> Change-Id: Ib3597cf1d99cdb5d0f2c5ac18e311914f376231d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606232
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80167}

Bug: v8:12161
Change-Id: I73e2d98660e9edfbe07a152a14402380ea9227de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3615219
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80287}
2022-04-29 21:53:02 +00:00
Victor Gomes
bf5e9512a7 [maglev] Add CreateObjectLiteral nodes
Bug: v8:7700
Change-Id: Ia76a091e013aa7649da132c113fcefef06534f3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3616511
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80278}
2022-04-29 12:20:11 +00:00
Victor Gomes
4837f37279 [maglev] Float64 box/unbox elision
- Supports Float64 Add for SmiAdd bytecode
- Adds a Float64Constant and ChangeInt32ToFloat64 nodes
- Converts floats to tagged in Phi node inputs
- Fixes spill double representation
- Fixes materialisation during a deopt of a double in the stack

Bug: v8:7700
Change-Id: I9217a64313b4bd5d0015f935c23771ecf9a2c7ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610426
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80255}
2022-04-28 13:17:48 +00:00
Marja Hölttä
a64bb79987 [rab/gsab] Atomics.*: Support RAB / GSAB
Bug: v8:11111
Change-Id: I3c350dd98b3da995b52c8366876d66b87fc47c28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605611
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80244}
2022-04-28 08:05:18 +00:00
Camillo Bruni
b4165a3590 [d8] Add ValueSerializer JS api for better fuzzing
Change-Id: Ib94979f4cf7f52a1544f2b3c0d51c0266a4fa14c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586985
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80223}
2022-04-27 15:05:07 +00:00
Leszek Swirski
7ada6c8bbc [maglev] Add LoadDoubleField
Add an unboxing double field load node, and fix a couple of locations
where it might be used enough to pass tests.

Bug: v8:7700
Change-Id: Ic134484e87a4fa363cbd8a3de667ac8e8116d502
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610623
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80221}
2022-04-27 13:12:17 +00:00
Leszek Swirski
fb3b972c32 [maglev] Drop register values before adding them to the free list
This fixes the ordering of DCHECKs which expect the value to not be in
the free list yet when it is dropped.

Bug: v8:7700
Change-Id: Ifb85d0e20cfe5c083d1f2bc971817143265fdc7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610444
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80218}
2022-04-27 12:15:41 +00:00
Victor Gomes
5f77a1b30b [maglev] Fix float64 add deoptimization
CheckedFloat64Unbox mutates the input value, but the register allocator
does not expects this behaviour and propagates a wrong value in the register.
In particular we deopt with the wrong value if the second Float64Unbox
in a Float64Add needs to deopt.

This fixes the input value after we convert to double.

Bug: v8:7700
Change-Id: Ib89573e9f728dc3a34b817fc84f1afcb96f14d18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610422
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80214}
2022-04-27 12:01:17 +00:00
Thibaud Michaud
3f695391b3 [wasm] Fix stack-switching import wrapper return
The JS import returns a tagged value, not a value of the machine
representation that corresponds to the signature's return type, since it
hasn't been converted yet.

R=ahaas@chromium.org

Bug: v8:12191
Change-Id: I0783af85eed9c5d25347200540e3e4eee48edfd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3464036
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80213}
2022-04-27 10:19:01 +00:00
Jakob Gruber
4ac65c1b11 [osr] Fix DeoptExitIsInsideOsrLoop in presence of inlining
This logic was confused in the presence of inlined frames; the
deopt exit offset would point inside the innermost inlined frame
while we incorrectly assumed it points at the outermost frame.

Fix this by always referring to the bytecode offset of the outermost
frame.

Bug: v8:12161
Fixed: chromium:1320094
Change-Id: I2eb28498639432c5344859f64a9388d93ee23bde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608630
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80212}
2022-04-27 10:11:15 +00:00
yufeng.freeman
40605a3ddb Include count value to InvalidCountValue error message
This CL includes count value to InvalidCountValue error message to make
it easier to dignoise RangeError of String.prototype.repeat. When
InvalidCountValue error throw, we could not know it's
caused by which count value if count value is not included.

Bug: none
Change-Id: I16e6693da0fc3b181241cb90daca27957f59c77c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3593574
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80198}
2022-04-27 06:32:35 +00:00
Frank Tang
9143c55387 [Temporal] Add Temporal.Duration.from
Also add AOs:
IsIntegralNumber, ToIntegerWithoutRounding, ToTemporalDurationRecord,
ToTemporalDuration, ParseTemporalDurationString, CreateDurationRecord

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.duration.from
https://tc39.es/ecma262/#sec-isintegralnumber
https://tc39.es/proposal-temporal/#sec-temporal-totemporaldurationrecord
https://tc39.es/proposal-temporal/#sec-temporal-totemporalduration
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporaldurationstring
https://tc39.es/proposal-temporal/#sec-temporal-createdurationrecord

Bug: v8:11544
Change-Id: I0f4176921e088bd2f2fd48ddd28f22f3b454bd3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3379233
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80195}
2022-04-26 20:09:13 +00:00
Jakob Kummerow
bac984e69a [wasm-gc] Fix roundtrips of JS functions through Wasm
When passing anyref-typed things to Wasm, we cannot expect that
all functions are WasmExternalFunctions. Instead of adding a
relatively expensive type check to such calls, this patch disables
function unwrapping for anyref-typed values.

Fixed: v8:12789
Change-Id: Ied57187bac7fde0326634f7b4fc428ad21dc9c2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605231
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80179}
2022-04-26 11:02:22 +00:00
Victor Gomes
755b7d863f [maglev] Add Box/UnboxNumbers and Float64Add nodes
- For simplicity we call a builtin when allocating a number.
- Elision of boxing/unboxing nodes will be done in a followup CL.

Bug: v8:7700
Change-Id: Iec4422d84c6597d3369ab512a1662adb0f077c98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602514
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80178}
2022-04-26 10:56:22 +00:00
Andreas Haas
2f535cdf89 [wasm] Fix argument count of Table.set
Table.set has two arguments, the table index and the value. Therefore
Table.set was defined with a length of 2. However, the value argument is
optional, so the length should actually be 1.

Change-Id: Ica2ea13a8e78c974cb011df2b5dc99f8e7eb4bcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398496
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80176}
2022-04-26 10:40:22 +00:00
Jakob Gruber
9145388055 Reland "[osr] Use the new OSR cache"
This is a reland of commit 91da38831d

Fixed: Use an X register for JumpIfCodeTIsMarkedForDeoptimization
on arm64.

Original change's description:
> [osr] Use the new OSR cache
>
> This CL switches over our OSR system to be based on the feedback
> vector osr caches.
>
> - OSRing to Sparkplug is fully separated from OSR urgency. If
>   SP code exists, we simply jump to it, no need to maintain an
>   installation request.
> - Each JumpLoop checks its dedicated FeedbackVector cache slot.
>   If a valid target code object exists, we enter it *without*
>   calling into runtime to fetch the code object.
> - Finally, OSR urgency still remains as the heuristic for
>   requesting Turbofan OSR compile jobs. Note it no longer has a
>   double purpose of being a generic untargeted installation
>   request.
>
> With the new system in place, we can remove now-unnecessary
> hacks:
>
> - Early OSR tierup is replaced by the standard OSR system. Any
>   present OSR code is automatically entered.
> - The synchronous OSR compilation fallback is removed. With
>   precise installation (= per-JumpLoop-bytecode) we no longer
>   have the problem of 'getting unlucky' with JumpLoop/cache entry
>   mismatches. Execution has moved on while compiling? Simply spawn
>   a new concurrent compile job.
> - Remove the synchronous (non-OSR) Turbofan compile request now
>   that we always enter available OSR code as early as possible.
> - Tiering into Sparkplug no longer messes with OSR state.
>
> Bug: v8:12161
> Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80147}

Bug: v8:12161
Change-Id: Ib3597cf1d99cdb5d0f2c5ac18e311914f376231d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606232
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80167}
2022-04-26 07:26:52 +00:00
Shu-yu Guo
0407423bd0 Plumb Isolate through own property enumeration functions
Currently the Isolate is gotten off of the object that the operation is
being performed on. Shared objects return the shared Isolate, which is
incorrect as it shouldn't be used to run JS, nor does it have
HandleScopes open. Plumb the executing Isolate through.

Bug: v8:12547
Change-Id: I3d960751c798ac657a6122598154e36d9d504c31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606489
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80163}
2022-04-25 22:54:22 +00:00
Nico Hartmann
c34b7b41a7 Revert "[osr] Use the new OSR cache"
This reverts commit 91da38831d.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression%20-%20builder/21150/overview

Original change's description:
> [osr] Use the new OSR cache
>
> This CL switches over our OSR system to be based on the feedback
> vector osr caches.
>
> - OSRing to Sparkplug is fully separated from OSR urgency. If
>   SP code exists, we simply jump to it, no need to maintain an
>   installation request.
> - Each JumpLoop checks its dedicated FeedbackVector cache slot.
>   If a valid target code object exists, we enter it *without*
>   calling into runtime to fetch the code object.
> - Finally, OSR urgency still remains as the heuristic for
>   requesting Turbofan OSR compile jobs. Note it no longer has a
>   double purpose of being a generic untargeted installation
>   request.
>
> With the new system in place, we can remove now-unnecessary
> hacks:
>
> - Early OSR tierup is replaced by the standard OSR system. Any
>   present OSR code is automatically entered.
> - The synchronous OSR compilation fallback is removed. With
>   precise installation (= per-JumpLoop-bytecode) we no longer
>   have the problem of 'getting unlucky' with JumpLoop/cache entry
>   mismatches. Execution has moved on while compiling? Simply spawn
>   a new concurrent compile job.
> - Remove the synchronous (non-OSR) Turbofan compile request now
>   that we always enter available OSR code as early as possible.
> - Tiering into Sparkplug no longer messes with OSR state.
>
> Bug: v8:12161
> Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80147}

Bug: v8:12161
Change-Id: I4a6955f4f20b6f3b13e98d5600c7c6a5205915bc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605608
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80148}
2022-04-25 14:47:22 +00:00
Jakob Gruber
91da38831d [osr] Use the new OSR cache
This CL switches over our OSR system to be based on the feedback
vector osr caches.

- OSRing to Sparkplug is fully separated from OSR urgency. If
  SP code exists, we simply jump to it, no need to maintain an
  installation request.
- Each JumpLoop checks its dedicated FeedbackVector cache slot.
  If a valid target code object exists, we enter it *without*
  calling into runtime to fetch the code object.
- Finally, OSR urgency still remains as the heuristic for
  requesting Turbofan OSR compile jobs. Note it no longer has a
  double purpose of being a generic untargeted installation
  request.

With the new system in place, we can remove now-unnecessary
hacks:

- Early OSR tierup is replaced by the standard OSR system. Any
  present OSR code is automatically entered.
- The synchronous OSR compilation fallback is removed. With
  precise installation (= per-JumpLoop-bytecode) we no longer
  have the problem of 'getting unlucky' with JumpLoop/cache entry
  mismatches. Execution has moved on while compiling? Simply spawn
  a new concurrent compile job.
- Remove the synchronous (non-OSR) Turbofan compile request now
  that we always enter available OSR code as early as possible.
- Tiering into Sparkplug no longer messes with OSR state.

Bug: v8:12161
Change-Id: I0a85e53d363504b7dac174dbaf69c03c35e66700
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596167
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80147}
2022-04-25 13:01:43 +00:00
Marja Hölttä
2176ead6dc [rab/gsab] Atomics.wait + waitAsync: Support GSAB
Bug: v8:11111
Change-Id: Ifb3776bce308d869064120d5e28a2ea7df943757
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578652
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80142}
2022-04-25 11:05:33 +00:00
jameslahm
fce1047f00 Reland "[interpreter] Optimize strict equal boolean"
This is a reland of commit 62632c0805.
Reason for previous revert: Performance regressions crbug.com/1315724.
The reland only optimizes strict equal boolean literal like "a===true"
or "a===false", and we generate TestReferenceEqual rather than
TestStrictEqual for the comparasion. And also add typed optimization
for ReferenceEqual when all inputs are boolean with boolean constant.

Original change's description:
> [interpreter] Optimize strict equal boolean
>
> For strict equal boolean literal like "a===true"
> or "a===false", we could generate TestReferenceEqual
> rather than TestStrictEqual. And in `execution_result()->IsTest()`
> case, we could directly emit JumpIfTrue/JumpIfFalse.
>
> E.g.
> ```
> a === true
> ```
> Generated Bytecode From:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestEqualStrict
> ```
> To:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestReferenceEqual
> ```
>
> E.g.
> ```
> if (a === true)
> ```
> Generated Bytecode From:
> ```
> LdaGlobal
> Star1
> LdaTrue
> TestEqualStrict
> JumpIfFalse
> ```
> To
> ```
> LdaGlobal
> JumpIfTrue
> Jump
> ```
>
>
> Bug: v8:6403
> Change-Id: Ieaca147acd2d523ac0d2466e7861afb2d29a1310
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568923
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#79935}

Bug: v8:6403
Change-Id: I2ae3ab57dce85313af200fa522e3632af5c3a554
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3592039
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80141}
2022-04-25 10:02:05 +00:00
Tobias Tebbi
e4cc6ed44b [turboshaft] initial commit
TurboShaft is a new, CFG-based IR for TurboFan.
This CL adds the basic IR and bidirectional translation from/to
TurboFan's sea-of-nodes-based IR for some common operators (still
incomplete even for JS).

Bug: v8:12783
Change-Id: I162fdf10d583a9275a9f655f5b44b888faf813f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563562
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80136}
2022-04-25 09:12:15 +00:00
jameslahm
0dbe725713 [web-snapshot] Fix snapshot scope info in Context
- In DeserializeContext, scope info local values
snapshot is in order of `name,value,name,value`,
and we should ReadValue after ReadString.

- Support non-inlined ScopeInfo locals, use
NameToIndexHashTable to serialize and deserialize
scope info local values when its local count is
more than kScopeInfoMaxInlinedLocalNamesSize.

Bug: v8:11525, v8:12820
Change-Id: I6ea2c498b594bed7ba8ca5be6af2ab9f0d39aa2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3600531
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80130}
2022-04-25 08:11:45 +00:00
Frank Tang
5c3627754e [Temporal] Add Calendar.prototype.fields
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.fields


Bug: v8:11544
Change-Id: I8df987ddbbf08372da637d7c4620c428fce97cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3534619
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80127}
2022-04-22 21:50:26 +00:00
legendecas
9135859a91 [ShadowRealm] Implement ShadowRealm.prototype.importValue
As per https://tc39.es/ecma262/#sec-hostimportmoduledynamically defined,
referencingScriptOrModule in HostImportModuleDynamically can be a Script
Record, a Module Record, or null.
So to https://tc39.es/proposal-shadowrealm/#sec-shadowrealmimportvalue,
the HostImportModuleDynamicallyCallback is been invoked with a `null`
resource_name. This may not be considered a breaking change as the
parameter resource_name is defined as Local<Value>.

Updates d8's DoHostImportModuleDynamically to handle null resource_name,
and resolve the dynamically imported specifier relative to the executing
script's origin. In this way, we have to set ModuleEmbedderData.origin
even if the JavaScript source to be evaluated is Script. Also, a
ModuleEmbedderData is created for each ShadowRealm to separate their
module maps from the initiator context's.

Bug: v8:11989
Change-Id: If70fb140657da4f2dd92eedfcc4515211602aa46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3522883
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#80118}
2022-04-22 15:04:26 +00:00
jameslahm
4a285a2549 [iterator] Extend GetIterator to Check iterator type
This CL extends GetIterator to check whether the result of
calling @@iterator is JSReceiver and throw SymbolIteratorInvalid
if it's not JSReceiver.

GetIterator bytecode involves 3 steps now:
- method = GetMethod(obj, @@iterator)
- iterator = Call(method, obj)
- if(!IsJSReceiver(iterator)) throw SymbolIteratorInvalid [Added]

New Builtin: CallIteratorWithFeedbackLazyDeoptContinuation, which
is used when lazy deopt is triggered by call @@iterator.

Related spec: https://tc39.es/ecma262/#sec-getiterator.
Related doc: https://docs.google.com/document/d/1s67HC2f-4zxA_s1Bmm7dfwMFv_KDUfMiWIKkNSeQNKw/edit#heading=h.kdzv8mq4g4ks.

Bug: v8:9489
Change-Id: I17952c0f3e24e1e600ee1348809fb188c2c70f8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563447
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#80112}
2022-04-22 12:58:56 +00:00
Tobias Tebbi
4e9cb635b5 [test] skip regress/regress-crbug-1239907 on TSAN
Bug: v8:12822
Change-Id: Idc8225640e132d175d2c06b530d77fcda7362b55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599486
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80092}
2022-04-21 16:35:35 +00:00
Leszek Swirski
88976125a6 [maglev] Implement LdaContextSlot
In the simplest way possible.

Bug: v8:7700
Change-Id: I155aaf85192b75c89617820d6f127a2ae04c7d9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599484
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80089}
2022-04-21 16:06:15 +00:00
Leszek Swirski
c0a63243e9 [maglev] Start implenting inlining
Add a --maglev-inlining flag, and add some half-baked support for
inlining functions when there is call feedback.

When the flag is enabled and there is call feedback, we create a nested
MaglevGraphBuilder for the current graph, and pause building the graph
of the outer function. We manually set up its prologue to set up its
frame with the arguments pass into the call, build the body with the
nested graph builder. This inner builder knows that it is building an
inlined function, and all Return bytecodes will instead emit a Jump to a
single merge block at the end of the function, where execution of the
outer function can resume.

These inner function basic blocks are wired into the outer graph with
new JumpToInline and JumpFromInline control nodes. The idea is that
subsequent passes will know what the inline function is, and will use
these to manage the function stack (particularly for codegen and
especially deopts).

Bug: v8:7700
Change-Id: I4e9b153f8cf4d06c56e7be6365e7a18b86a773c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585958
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80077}
2022-04-21 10:43:35 +00:00
legendecas
c779a08f7c [builtins] Handle broken promises in AsyncGenerator.prototype.return
As ecma262 normative change https://github.com/tc39/ecma262/pull/2683,
exception thrown on PromiseResolve the broken promises need to be caught
and use it to reject the promise returned by
`AsyncGenerator.prototype.return`.

AsyncGeneratorReturn didn't handle the exception thrown by Await. This
CL add an exception handler around it and pass through the caught
exception to the returned promise and resume the generator by
AsyncGeneratorAwaitResume if the generator is not closed, otherwise
reject the promise by AsyncGeneratorReject and drain the queue.

Bug: v8:12770
Change-Id: Ic3cac4ce36a6d8ecfeb5d7d762a37a2e0524831c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3581158
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#80066}
2022-04-20 17:14:14 +00:00
Marja Hölttä
c071cc96b3 [web snapshots] Add a JS API for deserializing Web snapshots
This enables downloading web snapshots with XMLHttpRequest and
deserializing them.

Bug: v8:11525
Change-Id: I498f1e99795d474a1715fce9aa1d8c1a34651c42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585961
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80064}
2022-04-20 16:02:20 +00:00
Clemens Backes
71ed79beb3 [wasm] Add regression test for 1314184
The fix is merged to all channels, add the regression test.

R=thibaudm@chromium.org

Bug: chromium:1314184
Change-Id: I7b7ca13ff34b19c3dbb727d248619dc1ff874873
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596161
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80044}
2022-04-20 11:40:19 +00:00
jameslahm
a544b4967e [runtime] Fix arguments length DCHECK
... in Runtime::kCopyDataPropertiesWithExcludedPropertiesOnStack.

Bug: v8:11614
Change-Id: Ief6d62fff242d3d38c4e586c7252935d3527ddf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3581534
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#79937}
2022-04-12 10:23:15 +00:00
Clemens Backes
d3db97f8ce [codegen] Bring back path for non-sse4.1 and non-avx
The roundss / vroundss instruction is only available on AVX or SSE4_1
hardware. Thus bring back the old code path with much longer code for
such old hardware.

R=tebbi@chromium.org

Bug: chromium:1314363
Change-Id: I79a58627c8b406817330e9f9601234cea28182c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3578642
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79914}
2022-04-11 12:53:04 +00:00
jameslahm
14718889ee [error] Improve error message for static methods
This CL changes frame message from `Function.${staticMethodName}`
to `${className}.${staticMethodName}` for stack trace in class
static methods.

Bug: v8:12778
Change-Id: Ie2b9471066a6ba38265412f4af471789bd375c98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3575759
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#79898}
2022-04-09 01:56:02 +00:00
Clemens Backes
0a1bf43d19 [test] Remove flag that causes contradictions
Some test variants and fuzzers set their own GC interval, so the flag
specified in the regression test causes flag contradictions.
The test failure was flaky anyway, so this change is only a slight
reduction in reproducability, and the test will still be used as seed
for the fuzzers.

R=machenbach@chromium.org

Bug: chromium:1313475
Change-Id: I7c7084ab34fe46d691b841921d42a487cc8a1cad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3576114
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79845}
2022-04-07 10:30:04 +00:00
Marja Hölttä
a1ff91207e [RAB/GSAB] Object.freeze: Support RAB / GSAB
Bug: v8:11111
Change-Id: I722702faa062e6083496d55cd96ee33d3952998b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571809
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79840}
2022-04-07 06:00:44 +00:00
Shu-yu Guo
1ac9280d50 Do not consult Symbol.species when constructing TypedArray from TypedArrays
Bug: v8:12744
Change-Id: I3e356c16554e8bc19afc06b18f4afd7fed2f228e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563540
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79833}
2022-04-06 18:57:18 +00:00
Clemens Backes
65a8d2dea1 [d8] Fix termination while creating realm
A worker might be terminated while creating a new Realm. While this was
handled mostly correctly already, a DCHECK was places slightly too
early, which is fixed by this CL.
Also, we avoid printing an error message if we fail to install an
extension due to isolate termination. As this is externally triggered,
it's not really an error condition.

R=jkummerow@chromium.org

Bug: chromium:1313475
Change-Id: I67b7fd27002d9b9a33439378d8336fefb2a2371a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571811
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79825}
2022-04-06 14:06:03 +00:00
yangwenming
d961501d4f [wasm] Place spilled params as WasmCallDescriptor expects.
With this CL, spilled parameters with ref type in a call to wasm
function, will be placed at a consecutive area in the generic
JSToWasmWrapper frame as WasmCallDescriptor expected.

Bug: v8:12722
Change-Id: I8b82f35b712a32b87abf5100ec46ee499a8178bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563445
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79805}
2022-04-06 08:59:53 +00:00
Jakob Gruber
30ba798cdc [osr] Remove the --function-context-specialization flag
This flag was a leftover from very early Turbofan days and serves no
purpose. Non-OSR TF code automatically uses function context
specialization (FCS) when appropriate without looking at the flag
value. OSR TF code should never use FCS since it is cached by the
SharedFunctionInfo (not by the JSFunction).

Bug: v8:12161
Change-Id: Ifb5a10918dbdf34a7164f7e665a230698b793e9e
Fixed: chromium:1313419
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571895
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79802}
2022-04-06 08:14:53 +00:00
Frank Tang
519267b325 [Temporal] Add Calendar.prototype.mergeFields
Add AO: DefaultMergeFields
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.mergefields
https://tc39.es/proposal-temporal/#sec-temporal-defaultmergefields


Bug: v8:11544
Change-Id: I270f8bffb79e57ef50736ae7ce87cfa53f9cafb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3388428
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79795}
2022-04-06 05:30:23 +00:00
Shu-yu Guo
908e7ac767 [typedarray] Remove per-iteration detach check in TypedArray.prototype.set
Bug: v8:12750, v8:11111
Change-Id: I3e9947ec8e2883364178b497a49299a3a96332e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569879
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79792}
2022-04-06 02:28:33 +00:00
Shu-yu Guo
f3dfbe59ed [typedarray] Remove per-comparator call detach check in TypedArray.prototype.sort
For the normative change, see https://github.com/tc39/ecma262/pull/2723

Bug: v8:12750, v8:11111
Change-Id: I8e8a2e9b443622b20bb5a4c2d453f782dfbd2ed6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570865
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79789}
2022-04-06 00:56:03 +00:00
Shu-yu Guo
9f7277413f [builtins] Fix Array#groupBy fast path assumptions
The FastArray path for Array#groupBy and Array#groupByToMap does not
recheck the input array's length each iteration. This is incorrect since
the grouping callback can truncate the length, and we should deopt to the
generic path when this happens.

Bug: chromium:1312838, v8:12499
Change-Id: Id3a4973e9960500a2f29ed63281ea721777d4dd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570342
Reviewed-by: Marja Hölttä <marja@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79787}
2022-04-05 19:46:42 +00:00
Dominik Inführ
1b17e087a8 [heap] Fix disabling of map space with --no-use-map-space flag
HeapAllocator didn't fall back to old space allocation when the
heap had no map space.

Bug: v8:12578, chromium:1313119
Change-Id: Ic02334f42f9fb80a8a9dcf99a94a7ac16da24053
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570423
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79776}
2022-04-05 13:14:53 +00:00
Victor Gomes
3eeea13cf7 [maglev] Addition Smi nodes
If we have a smi operation in the feedback vector, we emit SmiTag
Int32AddWithOverflow and SmiUntag nodes, instead of a generic
operation binary node.


Change-Id: Idb9ce2b60289fbe492bf269793660b32de23e2b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560641
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79775}
2022-04-05 12:34:42 +00:00
Clemens Backes
43232bf024 [wasm] Fix interrupt of empty loop
This includes two fixes:
1. For dynamic tiering, the budget must always be reduced when jumping
   backwards, otherwise we might never trigger tier up, which makes the
   loop non-interruptible (because the tier-up check replaces the stack
   check).
2. The d8 worker implementation also needs to terminate the isolate via
   an interrupt, in addition to scheduling a task, because the worker
   might never return to the event queue.

This CL also fixes one of the failure modes of the inspector fuzzer
(see https://crbug.com/1180018).

R=jkummerow@chromium.org, marja@chromium.org

Bug: v8:12767, chromium:1180018

Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Change-Id: Ia01d1725fc14931d2ea54c4769c4ee93f866ed63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568470
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79773}
2022-04-05 10:55:04 +00:00
Benedikt Meurer
ad21d212fc Preserve "proper method names" as-is in error.stack.
This changes the logic for generating method names in `error.stack` to
prepend an inferred type name only when the function name is a valid
ECMAScript identifiers and does not equal the inferred type name, to

(1) give developers more control over the exact name shown in
    `error.stack`, as well as
(2) avoid confusion in the presence of renaming of local variables.

Previously we'd leave the function name as-is if it was prefixed by the
inferred type name, but that condition is unnecessarily strict, and led
to a bunch of inconsistencies around special names like
`<instance_member_initializer>` where this dynamic approached often
prefixed it with the correct type name, but also sometimes got it wrong
and prepended `Object.`, which is very unfortunate and misleading.
Specifically for these special names, we'll add logic later in the
parser to infer a useful (complete) name.

The design doc (https://bit.ly/devtools-method-names-in-stack-traces)
contains more background and examples of why we do this change.

Doc: https://bit.ly/devtools-method-names-in-stack-traces
Fixed: chromium:1294619
Bug: chromium:1283435
Change-Id: Ib8b528ba25255dcd07e9d11044c562c11d699bcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565724
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79748}
2022-04-04 14:08:56 +00:00
Jakob Gruber
d187c6c291 Reland "[osr] Basic support for concurrent OSR"
This is a reland of commit 3ce690eef2

Changed for the reland:
- Remove the currently-unused BytecodeArray member to avoid MSAN
  failures.
- s/return/continue/ in optimizing-compile-dispatcher.

Original change's description:
> [osr] Basic support for concurrent OSR
>
> This CL adds basic support behind --concurrent-osr,
> disabled by default.
>
> When enabled:
> 1) the first OSR request starts a concurrent OSR compile job.
> 2) on completion, the code object is inserted into the OSR cache.
> 3) the next OSR request picks up the cached code (assuming the request
>    came from the same JumpLoop bytecode).
>
> We add a new osr optimization marker on the feedback vector to
> track whether an OSR compile is currently in progress.
>
> One fundamental issue remains: step 3) above is not guaranteed to
> hit the same JumpLoop, and a mismatch means the OSR'd code cannot
> be installed. This will be addressed in a followup by targeting
> specific bytecode offsets for the install request.
>
> This change is based on fanchen.kong@intel.com's earlier
> change crrev.com/c/3369361, thank you!
>
> Bug: v8:12161
> Change-Id: Ib162906dd4b6ba056f62870aea2990f1369df235
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548820
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79685}

Bug: v8:12161
Change-Id: I48b100e5980c909ec5e79d190aaea730c83e9386
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565720
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79746}
2022-04-04 13:48:26 +00:00
Nikolaos Papaspyrou
173885cda8 test: Remove two obsolete regression tests
This CL removes two obsolete regression tests that were taking too
long on debug engine builds.

Bug: v8:12753
Bug: v8:12754
Change-Id: I818101725caa22fb4b2ed22381f01a2dd9436fe4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563563
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79727}
2022-04-04 08:36:06 +00:00
jameslahm
6693641e70 [runtime] Check AvailableOptimizedCode in DisassembleFunction
In DisassembleFunction runtime, function may have available
optimized code and we could directly set the optimized code
for the function like in CompileLazy if it's not compiled,
which avoids calling Compiler::Compile and failed in
DCHECK(!function->HasAvailableOptimizedCode()).

Bug: v8:12762
Change-Id: I00001fc598f3fc96dfe86b2367e8ba88f0085fd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563448
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79722}
2022-04-04 06:46:06 +00:00
Frank Tang
b214cb7d72 [Temporal] Add Calendar.prototype.daysInWeek
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.daysinweek

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.daysinweek
will be implemented in later cl.

Bug: v8:11544
Change-Id: If54733ae7c902b4d189fc22b0800942f8748981c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3439186
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79721}
2022-04-02 01:50:20 +00:00
Frank Tang
63f9f0fab5 [Temporal] Add Calendar.prototype.daysInMonth
Spect Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.daysinmonth

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.daysinmonth
will be implemented in later cl.

Bug: v8:11544
Change-Id: Id5d426d9c5fe1db94c15433afbad443c7056abe3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3441703
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79720}
2022-04-01 22:22:30 +00:00
Dominik Inführ
5bc471f47f [heap] Support safepoint->AssertActive() for shared isolates
Lock mutex for shared isolate in global safepoints, such that e.g. the
StringTable can use isolate->heap()->safepoint()->AssertActive() even
for shared isolates.

Bug: v8:11708, v8:12749
Change-Id: I8d99203581dfa2d7225846e19fa981300f88589e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3563138
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79715}
2022-04-01 17:05:41 +00:00
jameslahm
182a82832c Reland "[serialize] Fix serializing wasm backed ArrayBuffer"
Skipped test: https://crrev.com/c/3561199.
This is a reland of commit 6e2c9bb265

Original change's description:
> [serialize] copy bytes for non detachable array_buffer
> in WriteJSArrayBuffer when array_buffer is not in
> array_buffer_transfer_map_
>
> According to https://html.spec.whatwg.org/multipage/structured-data.html#structuredserializeinternal
> steps 13.3.2-4, should normally serialize array buffer which
> is not detachable.
>
> Bug: v8:12703
> Change-Id: I4554c5d07ae85e1a96a728ebba04c6a071575f6f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518910
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79466}

Bug: v8:12703
Change-Id: I1ad1b8159ac7b13011831a4590e8577e954db946
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557689
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79714}
2022-04-01 14:59:50 +00:00
Manos Koukoutos
c3ed607d63 [wasm-gc] Implement runtime-type canonicalization
Add an array of canonical rtts on the isolate. Each wasm instance
copies its rtts from there, based on the type index -> canonical index
mapping in the module.

Bug: v8:7748
Change-Id: I0958686c51ecab15a3215a0da3bee1ad6d543cb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548821
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79712}
2022-04-01 13:49:01 +00:00
Thibaud Michaud
d36f596e8a [sim] Increase the simulator's stack limit margin
The current safety margin between the JS stack limit and the actual
boundary of the stack space reserved by the simulator can be overrun by
a large frame.
Raise this margin to 4KiB, corresponding to the "large frame" threshold.
This ensures that the stack check is executed before the frame is
allocated if the frame is larger than this margin.

R=clemensb@chromium.org

Bug: chromium:1308333
Change-Id: I3e1a51bb36c630c7e37e58679971392dada2a83e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560435
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79711}
2022-04-01 12:01:14 +00:00
Marja Hölttä
3fd463c6f9 [rab / gsab] Fix .maxByteLength for wasm memory buffers
Bug: v8:11111,v8:12746,chromium:1307480
Change-Id: I7775776ae98c3727b435aca4f269400ff8e31c53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560440
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79705}
2022-04-01 08:12:41 +00:00
Adam Klein
32f285533e Revert "[osr] Basic support for concurrent OSR"
This reverts commit 3ce690eef2.

Reason for revert: failures on CrOS MSan build: https://crbug.com/1312188

Original change's description:
> [osr] Basic support for concurrent OSR
>
> This CL adds basic support behind --concurrent-osr,
> disabled by default.
>
> When enabled:
> 1) the first OSR request starts a concurrent OSR compile job.
> 2) on completion, the code object is inserted into the OSR cache.
> 3) the next OSR request picks up the cached code (assuming the request
>    came from the same JumpLoop bytecode).
>
> We add a new osr optimization marker on the feedback vector to
> track whether an OSR compile is currently in progress.
>
> One fundamental issue remains: step 3) above is not guaranteed to
> hit the same JumpLoop, and a mismatch means the OSR'd code cannot
> be installed. This will be addressed in a followup by targeting
> specific bytecode offsets for the install request.
>
> This change is based on fanchen.kong@intel.com's earlier
> change crrev.com/c/3369361, thank you!
>
> Bug: v8:12161
> Change-Id: Ib162906dd4b6ba056f62870aea2990f1369df235
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548820
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Jakob Linke <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79685}

Bug: v8:12161, chromium:1312188
Change-Id: Iac1e3fd67ecc658a1cdee8f4d13354c097ed6697
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3564983
Auto-Submit: Adam Klein <adamk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79702}
2022-04-01 00:13:40 +00:00
Frank Tang
05a58f2687 [Temporal] Add Calendar.prototype.inLeapYear
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.inleapyear

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.inleapyear
will be implemented in later cl.


Bug: v8:11544
Change-Id: I0f30d45ed6d742acaeaa2f7ddf5b393ef7fa5437
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531561
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79699}
2022-03-31 23:57:53 +00:00
Frank Tang
3f3a427f48 [Temporal] Add Calendar.prototype.dayOfWeek
Also add AO: ToISODayOfWeek
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.dayofweek
https://tc39.es/proposal-temporal/#sec-temporal-toisodayofweek

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.dayofweek
will be implemented in later cl.


Bug: v8:11544
Change-Id: I0b3448209741e4aa56cd8170a331d837853bff17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531564
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79698}
2022-03-31 23:56:49 +00:00
Manos Koukoutos
cfa8d0b35a Reland "[wasm-gc] Implement isorecursive canonicalization"
This is a reland of commit e76ad5c6d9

Changes compared to original:
- Move invocation of LAZY_INSTANCE_INITIALIZER to a static global
  variable, as some builds were failing with a function-level static.
- Drive-by: Improve documentation a bit.

Original change's description:
> [wasm-gc] Implement isorecursive canonicalization
>
> This implements isorecursive canonicalization for static types.
>
> Not implemented in this CL:
> - Runtime type canonicalization.
> - Cross-module signature canonicalization for purposes of call_indirect.
>
> Bug: v8:7748
> Change-Id: I6214f947444eea8d7b15a29b35c94c3d07ddb525
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541925
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79665}

Bug: v8:7748
Change-Id: I493fba1906491762f7d8bae50108e3e4a743391d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560480
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79692}
2022-03-31 15:45:49 +00:00
Leszek Swirski
0df9606dca [maglev] Add lazy deopts
Nodes can now hold a LazyDeoptSafepoint which stores the frame state in
case they trigger a lazy deopt. OpProperties have a new CanLazyDeopt
bit, and codegen emits a safepoint table entry + lazy deopt for all
nodes with this bit. Also, we now check the deoptimized code bit on
entry into the maglev compiled function.

An example use of these lazy deopts is added as a PropertyCell fast path
for LdaGlobal, which adds a code dependency on the property cell.

Bug: v8:7700
Change-Id: I663db38dfa7325d38fc6d5f079d263a958074e36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557251
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79688}
2022-03-31 11:48:40 +00:00
Jakob Gruber
3ce690eef2 [osr] Basic support for concurrent OSR
This CL adds basic support behind --concurrent-osr,
disabled by default.

When enabled:
1) the first OSR request starts a concurrent OSR compile job.
2) on completion, the code object is inserted into the OSR cache.
3) the next OSR request picks up the cached code (assuming the request
   came from the same JumpLoop bytecode).

We add a new osr optimization marker on the feedback vector to
track whether an OSR compile is currently in progress.

One fundamental issue remains: step 3) above is not guaranteed to
hit the same JumpLoop, and a mismatch means the OSR'd code cannot
be installed. This will be addressed in a followup by targeting
specific bytecode offsets for the install request.

This change is based on fanchen.kong@intel.com's earlier
change crrev.com/c/3369361, thank you!

Bug: v8:12161
Change-Id: Ib162906dd4b6ba056f62870aea2990f1369df235
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548820
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79685}
2022-03-31 09:58:40 +00:00
Frank Tang
803d1d3961 [Temporal] Add Calendar.prototype.monthsInYear
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.monthsinyear

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.monthsinyear
will be implemented in later cl.


Bug: v8:11544
Change-Id: Ibf7a9f1e64ce638f745df2649ee3a69dc9e08139
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531559
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79682}
2022-03-31 00:18:23 +00:00
Frank Tang
eb9a19a0a1 [Temporal] Add Calendar.prototype.dayOfYear
Also add AO: ToISODayOfYear
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.dayofyear
https://tc39.es/proposal-temporal/#sec-temporal-toisodayofyear

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.dayofyear
will be implemented in later cl.



Bug: v8:11544
Change-Id: I5e5f9ea93cc0577df8d9b228efe5c3a97d118b88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531566
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79681}
2022-03-30 22:16:50 +00:00
Adam Klein
ac4c2afc7f Skip mjsunit/shared-memory/shared-struct-atomics-workers under stress_snapshot
Bug: v8:12749
Change-Id: I33d0313625c38f9634ffba5ed358c1782811ddde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3561184
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Adam Klein <adamk@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79680}
2022-03-30 17:35:20 +00:00
Dominik Inführ
3eb8671edb [heap] Fix global safepoint when waiting in event loop
When starting a global safepoint, it could happen that one isolate is
waiting/blocking in the event loop, which prevents this isolate from
reaching a safepoint. As a consequence we therefore deadlock when
performing the safepoint. We can solve this by simply posting a task
for each isolate that when run performs a safepoint check.

This CL also renames IncludeMainThreadUnlessInitiator to
ShouldIncludeMainThread.

Bug: v8:11708, v8:12645
Change-Id: Ide956b3c39b350c2bb0279a7dd94ff79cb9d771b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555771
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79675}
2022-03-30 12:59:31 +00:00
Nico Hartmann
98db200c3d Revert "[wasm-gc] Implement isorecursive canonicalization"
This reverts commit e76ad5c6d9.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20shared/19438/overview

Original change's description:
> [wasm-gc] Implement isorecursive canonicalization
>
> This implements isorecursive canonicalization for static types.
>
> Not implemented in this CL:
> - Runtime type canonicalization.
> - Cross-module signature canonicalization for purposes of call_indirect.
>
> Bug: v8:7748
> Change-Id: I6214f947444eea8d7b15a29b35c94c3d07ddb525
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541925
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79665}

Bug: v8:7748
Change-Id: I9e26696a7113b1bacafa800c8d6ef24df38c41fd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557233
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79667}
2022-03-30 07:47:00 +00:00
Manos Koukoutos
e76ad5c6d9 [wasm-gc] Implement isorecursive canonicalization
This implements isorecursive canonicalization for static types.

Not implemented in this CL:
- Runtime type canonicalization.
- Cross-module signature canonicalization for purposes of call_indirect.

Bug: v8:7748
Change-Id: I6214f947444eea8d7b15a29b35c94c3d07ddb525
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541925
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79665}
2022-03-30 06:23:30 +00:00
Shu-yu Guo
21cfbf047e [rab/gsab] Support RAB/GSABs in context snapshot
Bug: v8:11111, v8:12731, v8:12742
Change-Id: I2679c0e64faca25a2c16e15fd3a5c727eb941c92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3551894
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79662}
2022-03-29 22:37:49 +00:00
Adam Klein
7cc6e6a4e0 Skip failing mjsunit/regress/regress-crbug-1307310 in stress_snapshot
Bug: v8:12742
Change-Id: If96908f8585a5789c09d98bb8ca06f9a9fb6fc7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3558310
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79659}
2022-03-29 17:21:30 +00:00
Toon Verwaest
ecc3c6367f [maglev] CompactInterpreterFrameState fixes
Bug: v8:7700
Change-Id: I1efa298a25bf15c104a57db3ec7cc4d7e36861eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3553102
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79655}
2022-03-29 13:59:48 +00:00
Leszek Swirski
4fd61de7c1 [maglev] Fix over application return stack cleanup
Under over-application (passing more arguments into a function than its
formal parameter count), we need to use the passed argc to clean up the
stack, rather than the formal parameter count. Fix Maglev's Return node
code to do the appropriate check and dynamic sized return.

Bug: v8:7700
Change-Id: I36037d29e14323b336974d4b75b75f5702ce8a28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555767
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79649}
2022-03-29 10:39:28 +00:00
jameslahm
9641ce6438 [compiler] Optimize String#includes
This CL adds the reduction for String#includes
and merges the reduction of String#indexOf and
String#includes in JSCallReducer.

This CL does two things:
- Add StringIndexOfIncludesVariant to distinguish
String#indexOf and String#includes.
- Add ReduceStringPrototypeIndexOfIncludes to reduce
for String#indexOf and String#includes.

Bug: v8:12732
Change-Id: Ied75485cf1511956e97ef986fc34a711aae3d1ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3552279
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79648}
2022-03-29 10:24:08 +00:00
Marja Hölttä
8c94b7ec7b [rab/gsab] Fix the rab gsab TA initial map
Bug: v8:11111,chromium:1307310
Change-Id: I41175d759e71d2016880eae1cd42e420ee9cc229
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540262
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79646}
2022-03-29 07:31:41 +00:00
jameslahm
bd7f4823c1 [error] Improve GetExport error message
According to https://tc39.es/ecma262/#sec-InnerModuleLinking
step 10 and https://tc39.es/ecma262/#sec-source-text-module-record-initialize-environment
step 8-25, variables must be declared in Link. And according
to https://tc39.es/ecma262/#sec-module-namespace-exotic-objects-get-p-receiver,
accessing the exported variable with the hole value should
throw uninitialized error.

Bug: v8:12729
Change-Id: I6fd2fcc580f7bafca986448b37adb8ba8f077929
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3552281
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79637}
2022-03-28 09:03:45 +00:00
Frank Tang
8b663818fc [Temporal] Add Temporal.Calendar.prototype.year
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.year

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.year
will be implemented in later cl.

Bug: v8:11544
Change-Id: Ifadcdb4efe00a9954d5ac4c1154420c4903f28d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531553
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79635}
2022-03-26 23:18:06 +00:00
Frank Tang
cdafded496 [Temporal] Add Calendar.prototype.daysInYear
Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.calendar.prototype.daysinyear

Note- this is only the non-intl version. intl version in
https://tc39.es/proposal-temporal/#sup-temporal.calendar.prototype.daysinyear
will be implemented in later cl.

Bug: v8:11544
Change-Id: I627fcf82641659c4697395057ee664a37f237228
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3531557
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79634}
2022-03-26 22:16:54 +00:00
Frank Tang
c232d789c7 [Temporal] Add Duration.prototype.(abs|negated)
Also add AO: CreateNegatedTemporalDuration

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.duration.prototype.abs
https://tc39.es/proposal-temporal/#sec-temporal.duration.prototype.negated
https://tc39.es/proposal-temporal/#sec-temporal-createnegatedtemporalduration

Bug: v8:11544
Change-Id: Ie522a7446f40c946c30f2e90c5f6c7fbc96c41eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3380101
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79633}
2022-03-26 22:15:14 +00:00
jameslahm
89ed081c17 [runtime] Add async-stack-trace support for Promise.allSettled
... with zero cost.

Bug: v8:9357
Change-Id: I66985c3fd3e7b4efa354eb564c641562cf55ab49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518909
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79632}
2022-03-26 12:04:24 +00:00
legendecas
0a0ad98a5a [ShadowRealm] WrappedFunction properties
Implement WrappedFunction properties name/length.

Bug: v8:11989
Change-Id: I050af5814537552ef6c2077802ffc726f2e08fa3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507201
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#79628}
2022-03-25 16:00:33 +00:00
Shu-yu Guo
bcf43eb780 [string] Add additional ThinString test
Add a test for the case where SlicedStrings of ThinStrings are looked up
in the string table, testing the path that the original string's length
differs from the actual string's length.

Bug: chromium:1309767
Change-Id: I909c64397bf28ec33c3324d94882fbfe81ac4109
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3549837
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79610}
2022-03-24 16:46:12 +00:00
Nico Hartmann
fa374fc934 [turbofan] Fix a rare false positive in SLVerifier
Bug: chromium:1309769, v8:12619
Change-Id: I880c7326f2ec91f1aa985d6b7ed67f8f5afc074b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548897
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79608}
2022-03-24 15:04:23 +00:00
Marja Hölttä
0129218b08 [rab/gsab] Disable a test in stress-snapshot mode
It's hitting unimplemented code paths.

Bug: v8:11111, v8:12731
Change-Id: Icbffced6cbe207426363daa5f3b9ff5677b58b6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548816
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79605}
2022-03-24 13:35:42 +00:00
Joyee Cheung
4ee68d81b9 [ic] fix handling of existing properties in Define{Keyed|Named}OwnIC
- When the property being defined with DefineKeyedOwnIC or
  DefineNamedOwnIC already exists, we should use the slow path to
  check if the operation is allowed in case the property is
  non-configurable or Object.preventExtensions() has been called on
  the property.
- Since KeyedStoreIC:Store() reuses StoreIC::Store() when the key is a
  name, we should use Runtime::DefineObjectOwnProperty() for
  DefineKeyedOwnIC too.
- When dealing with public fields, Runtime::DefineObjectOwnProperty()
  should use JSReceiver::CreateDataProperty() instead of
  Object::SetProperty() for the specified semantics. This patch also
  adds JSReceiver::AddPrivateField() for it and StoreIC::Store to
  define private fields without triggering traps or checking
  extensibility.
- To emit a more specific error message when redefining properties
  on non-extensible objects, Object::AddDataProperty() now also takes
  a EnforceDefineSemantics enum to distinguish between set and define.
- Drive-by: fix JSReceiver::CheckIfCanDefine() which should check for
  extensibility even if the configurability check passes.

Bug: chromium:1259950, v8:9888
Change-Id: Ib1bc851ffd4b9c3a0e98cac96dafe743c08ee37e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3517934
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#79603}
2022-03-24 12:36:42 +00:00
Thibaud Michaud
672bf4ee6a Reland "[wasm][liftoff] Spill regs for multi-value merges"
This is a reland of commit d9e1f2aee5

Change: disable regression test on non-SIMD hardware

Original change's description:
> [wasm][liftoff] Spill regs for multi-value merges
>
> If there is more than one value in the merge region, a stack-to-stack
> move can overwrite the source of a stack-to-register move. To avoid
> this, spill all registers.
>
> R=clemensb@chromium.org
>
> Bug: chromium:1299183
> Change-Id: I10495434d0a18c9072ee3882e00a687edd8c592a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3523044
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79584}

Bug: chromium:1299183
Change-Id: I6f2af786ab91194a93945f5030575d1b8abee7fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548716
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79601}
2022-03-24 12:15:43 +00:00
Clemens Backes
a18b1606d2 [wasm] Add validation of compilation hints
Before productionizing this, we probably want to just ignore the whole
section if it contains invalid data, but for now failing with a decode
error is more consistent with existing checks.

R=ecmziegler@chromium.org

Bug: v8:12537
Change-Id: I7fc5933573a4d6eddd039bf51361c5bee5c5170d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3545177
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79593}
2022-03-24 07:12:53 +00:00
Shu-yu Guo
7566979213 Revert "[wasm][liftoff] Spill regs for multi-value merges"
This reverts commit d9e1f2aee5.

Reason for revert: Linux test failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux/45960/overview

Original change's description:
> [wasm][liftoff] Spill regs for multi-value merges
>
> If there is more than one value in the merge region, a stack-to-stack
> move can overwrite the source of a stack-to-register move. To avoid
> this, spill all registers.
>
> R=​clemensb@chromium.org
>
> Bug: chromium:1299183
> Change-Id: I10495434d0a18c9072ee3882e00a687edd8c592a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3523044
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79584}

Bug: chromium:1299183
Change-Id: I465129695cfc1c5678923f7eefe5b91e31383798
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3546745
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Owners-Override: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79585}
2022-03-23 19:35:32 +00:00
Thibaud Michaud
d9e1f2aee5 [wasm][liftoff] Spill regs for multi-value merges
If there is more than one value in the merge region, a stack-to-stack
move can overwrite the source of a stack-to-register move. To avoid
this, spill all registers.

R=clemensb@chromium.org

Bug: chromium:1299183
Change-Id: I10495434d0a18c9072ee3882e00a687edd8c592a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3523044
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79584}
2022-03-23 18:08:31 +00:00
Joyee Cheung
639c09a341 [class] fix read-only private references in logical assignments
Since assignments to read-only private references can be skipped due
to short-circuiting in logical assignments, we should not eagerly
emit the error of invalid writes, and should instead load the values
as usual, only emitting an error when the assignment happens,
which can be handled by BytecodeGenerator::BuildAssignment().

Bug: v8:12680, v8:8330, v8:10372
Change-Id: Ia5fea9090bc48b0af8a9c8d6f95174f7aa2d86f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3509298
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#79583}
2022-03-23 16:16:32 +00:00
Marja Hölttä
b35964839c [rab/gsab] RAB/GSAB support for Object.DefinePropert(y|ies)
Bug: v8:11111,chromium:1306929
Change-Id: I26e4c5d7e87f75844e60952f30e8fe20189910c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3535783
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79577}
2022-03-23 14:17:17 +00:00
David Sanders
cabf441d12 Fix typos, intial* -> initial*
Change-Id: Ia5066069304ae2eee442cd3e224c0c0c0816fd75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3543179
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79574}
2022-03-23 13:20:33 +00:00
Victor Gomes
d423178dba [maglev] Create test variant
Bug: v8:7700
Change-Id: Icd9c0ce6fce727759beec246253dbd16756abc09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3545166
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79567}
2022-03-23 10:12:52 +00:00
Nico Hartmann
87d73a3ae0 Reland "[turbofan] Enable --verify-simplified-lowering in debug"
This reverts commit aaedd8b788.

Changes in the reland:
The inital problem was caused by nodes that were removed during SL
because they are no-ops but have an effect on typing (in the repro, this
was e.g. PlainPrimitiveToNumber). The reland introdocues a new operator
SLVerifierHint that is used exclusively in SL to provide hints to the
verifier and that solves this problem. SLVerifierHint also replaces the
previous use of TypeGuard to type constant nodes for the verifier.

Bug: v8:12619, chromium:1302572
Change-Id: I0957645c03d8b7c26cd6d630a1ecbd0a6a8223ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3512574
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79564}
2022-03-23 09:33:11 +00:00
jameslahm
39c3a97e84 [builtin] Throw type error when HasAccessCheckFailed in PromiseConstructor.
When cross realm invoke PromiseConstructor and realm not
allowed to CrossRealmAccess, PromiseConstructor will
silently return undefined, which will cause crash in
ConstructJSWithTarget type cast, Change to throw type
error when HasAccessCheck failed.

Bug: v8:12705
Change-Id: I18f697a1897c31163dd60522db12449033419f9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3521174
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79548}
2022-03-21 13:55:03 +00:00
jameslahm
bba8bc2bb1 [errors] Improve error message for Promise constructor
Originally, 'Promise()' without 'new' will throw "undefined is not a
promise". Now it will throw "Promise constructor cannot be invoked
without 'new'".

Bug: v8:10817
Change-Id: Ic8b72a902ed395e44dbb32ccf96a2130a4a9422f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3459924
Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79547}
2022-03-21 13:54:00 +00:00
Jakob Gruber
0b28b6e6c1 Reland [maglev] Finish & enable basic Maglev concurrent tierups
This implements the last bits of basic concurrent Maglev compilation.
When jobs have been processed, schedule an interrupt to trigger codegen
and building the Code object on the main thread.

Changed since the initial version:
- Put the include behind V8_ENABLE_MAGLEV.
- Skip 18.js until we have deterministic test helpers for concurrent
  tiering.

Bug: v8:7700
Change-Id: Ibc103f097fe00f7df93a33a785939e43901f3734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536662
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79539}
2022-03-21 08:26:29 +00:00
Milad Fa
83a7f0d4e4 S390: disable baseline compiler with compressed pointers
Will re-enable once a few issues have been resolved.

Change-Id: Ieed60efcb6d59cc5ca10931913dd4d9ffea8b9f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532202
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#79533}
2022-03-19 03:32:15 +00:00
jameslahm
d8c9b08925 [d8] Don't call WaitForRunningWorkers in quit()
There are problems calling WaitForRunningWorkers when we
call quit().
First, suppose the main thread first calls quit(),
and the worker thread calls quit() after the main
thread calls quit(), then sched_yield to wait for
quit_once_ updated to ONCE_STATE_DONE. However
the main thread is WaitForRunningWorkers to wait
for the worker thread to join, thus causing deadlock.

Second, suppose the worker thread calls quit() and empty
the running_workers_ by WaitForRunningWorkers, then
the main thread calls `onExit(isolate, true)` to dispose
the platform and other global data, which will crash other
running workers.

Bug: v8:12219
Change-Id: I333e5aad431daefb1c163f69e66d8e9d5e9bf754
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518908
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79525}
2022-03-18 07:58:38 +00:00
Manos Koukoutos
0a5fcd8a78 [test] Skip flaking test
Bug: v8:12697
Change-Id: I124f2f0fd3c98d6a5233a0e2a8236a2b15d791fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532261
Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79518}
2022-03-17 15:53:37 +00:00
jameslahm
e66a1116fb [compiler] Fix RepresentationChangerError in Array.p.shift
In JSCallReducer::ReduceArrayPrototypeShift, add Unsigned32
TypeGuard for index Node used in fast path, avoid representing
kRepFloat64 (Range(1, inf)) to kRepWord64 when converting
input for kLoadElement.

Bug: v8:12632
Change-Id: I2e4b00840dc5462e4351e13a372c33b6272b9ea1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528373
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79514}
2022-03-17 12:16:06 +00:00
王澳
4557c3f42b Revert "[call reducer] inline Array.prototype.indexOf/includes in js-call-reducer."
This reverts commit 9f9f36f875.

Reason for revert: regressed ai-astar on the M1

Original change's description:
> [call reducer] inline Array.prototype.indexOf/includes in js-call-reducer.
>
> - inline Array.prototype.indexOf in js-call-reducer
> - inline Array.prototype.includes in js-call-reducer
>
> Bug: v8:12390
> Change-Id: Idb5669da3019f0f56af0084fccd1d616d4c5098e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3473994
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79461}

Bug: v8:12390, chromium:1306250
Change-Id: I91c666c2f56c30db4f43bb009ee6206ad219f51a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532399
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79511}
2022-03-17 11:39:46 +00:00
Michael Achenbach
33bf4c4bca [test] Clean up Py2 code
Bug: chromium:1292013
Change-Id: If50c18249afe8b75154d4b111485280d158a5582
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3525137
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79506}
2022-03-17 09:12:36 +00:00
Shu-yu Guo
67044edf08 [shared-struct] Support shared structs in Atomics.exchange
Bug: v8:12547
Change-Id: Ie27831b793f214368a003adac24b7c92f1a5fc11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3518426
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79504}
2022-03-17 05:40:36 +00:00