Commit Graph

11595 Commits

Author SHA1 Message Date
Sathya Gunasekaran
1a1a9cca42 [ic] Do string to array index conversion in element loads only
Instead of changing all of TryToName to do the conversion to array
index, this patch narrows this fast path just to the element load IC
handler.

This patch also restores the HeapNumber conversion in TryToIntPtr and
in Turbofan inlining as per the original state of things.

Bug: v8:9449, chromium:1016738, chromium:1016709
Change-Id: Ibf3a2c38637fc36e0ee037dc740f273848d1e8a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1902386
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64896}
2019-11-11 21:02:49 +00:00
Jakob Gruber
cebfde6769 [interpreter] Move function-entry stack check to start of bytecode array
The function-entry stack check should dominate all other
instructions in a function. Prior to this CL it was possible to create
paths not including a stack check due to SwitchOnGeneratorState: the
generator-creation branch had a stack check, while generator-resume
branches did not.

  0 : af fb 00 01       SwitchOnGeneratorState r0, [0], [1] { 0: @22 }
  4 : 27 fe fa          Mov <closure>, r1
  7 : 27 02 f9          Mov <this>, r2
 10 : 64 0a fa 02       InvokeIntrinsic [_CreateJSGeneratorObject], r1-r2
 14 : 26 fb             Star r0
 16 : a7                StackCheck
 17 : b0 fb fb 01 00    SuspendGenerator r0, r0-r0, [0]
 22 : b1 fb fb 01       ResumeGenerator r0, r0-r0
                        [... no stack check here ...]

This CL moves the stack check to the beginning of the bytecode array,
i.e. before SwitchOnGeneratorState.

Bug: chromium:1020031
Change-Id: I8ba8cba99611ddbe50c76023129d926cc84b1d5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903440
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64888}
2019-11-11 15:00:09 +00:00
Santiago Aboy Solanes
421eaeefb9 [CSA][cleanup] TNodify builtins-string-gen
Bug: v8:9810
Change-Id: I915e0b1f903e8c5aa75280965819b2efb9fdc6dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906206
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64887}
2019-11-11 14:57:29 +00:00
Santiago Aboy Solanes
6e90f2f292 [ptr-compr] Remove Compressed mentions from in the pipeline
Including but not limiting to removing:
 * BitcastCompressedXXX
 * CheckedCompressedXXX
 * ChangeXXXToCompressedYYY
 * ChangeCompressedXXX

As a note, ChangeTaggedToCompressed can't be removed just yet as it
is still in use.

Bug: v8:7703
Change-Id: I98cf88a32adfa976d419e69702d1cac4d3e811a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903435
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64880}
2019-11-11 12:23:41 +00:00
Ng Zhi An
43244a06c9 [wasm-simd] Implement remaining load_splat for x64
Implements v32x4.load_splat and v64x2.load_splat.

Bug: v8:9886
Change-Id: I18f3b012f9980d258985edf2ff26577fe495eff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903747
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64866}
2019-11-08 18:07:33 +00:00
Ng Zhi An
5e514a9693 [wasm-simd] Implement i64x2 splat extract replace for arm
Bug: v8:9813
Change-Id: Ie99fdbf5307a1515a1838ac6902a5bcd99d11e14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900660
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64846}
2019-11-07 21:28:39 +00:00
Clemens Backes
dde3166beb [wasm] Remove one {NewNativeModule} method
This makes the {code_size_estimate} computation explicit in the caller,
and removes one of the two {NewNativeModule} constructors. It turns out
that the calculation is totally off in the streaming calculation phase,
since no function bodies have been parsed yet. So all
{WasmFunction::code} fields are still empty, and we compute an estimate
that is way too low.
This CL prepares the actual fix for that (by computing a better estimate
at specific call sites).

R=ahaas@chromium.org

Bug: v8:9950
Change-Id: I68a891c97e5f65a9c7e73e21684bdfa7e261e216
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901273
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64845}
2019-11-07 18:07:29 +00:00
Santiago Aboy Solanes
1bafcc6b99 [test] MultipleIsolates is only slow when not in pointer compression
Change-Id: Ia6b805c48f71cea7a0f0ada06c9a35713ed49f28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903968
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64843}
2019-11-07 16:56:26 +00:00
Ng Zhi An
465c97fe22 [wasm-simd] Implement load_splat and load_extend
Introduce new operator LoadTransform that holds a LoadTransformInfo param,
which describes the kind of load (normal, unaligned, protected), and a
transformation (splat or extend, signed or unsigned).

We have a new method that a full decoder needs to implement, LoadTransform,
which resuses the existing LoadType we have, but also takes a LoadTransform,
to distinguish between splats and extends at the decoder level.

This implements 4 out of the 10 suggested load splat/extend operations
(to keep the cl smaller), and is also missing interpreter support (will
be added in the future).



Change-Id: I1e65c693bfbe30e2a511c81b5a32e06aacbddc19
Bug: v8:9886
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863863
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64819}
2019-11-06 17:42:22 +00:00
Sathya Gunasekaran
bebe6314b8 [test] Skip slow MultipleIsolates test on arm64
Change-Id: Idc0cd3a96ba329cf8175f22eea60b7614d73d929
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901272
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64818}
2019-11-06 17:08:18 +00:00
Michael Starzinger
125f727c72 [wasm][test] Remove obsolete TODO from interpreter cctest.
The test coverage in question is by now provided by a different set of
mjsunit tests, namely the "mjsunit/wasm/anyref-globals-interpreter"
suite which run all globals tests in --wasm-interpret-all mode.

R=ahaas@chromium.org
TEST=cctest/test-run-wasm-interpreter/ReferenceTypeLocals

Change-Id: I439b1ee74da3c36995bb3d5819e35d4074400868
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901266
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64812}
2019-11-06 14:53:14 +00:00
Michael Starzinger
330445cee4 [test][x64] Test disassembly of indirect call again.
R=clemensb@chromium.org
TEST=cctest/test-disasm-x64/DisasmX64

Change-Id: I011d0d5e25c472c5a62ad73edd42165e55b34e2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900460
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64809}
2019-11-06 14:38:41 +00:00
Michael Starzinger
2679ebdc5f [wasm][test] Introduce separate test-api-wasm.cc file.
R=clemensb@chromium.org
TEST=cctest/test-api-wasm

Change-Id: I4f3c7e215304bd9b89bb7fd21cda06fa3a18abac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900458
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64805}
2019-11-06 14:11:43 +00:00
Joshua Litt
31813fbf61 Revert "[hole-check-elimination] Simplest possible hole check elimination"
This reverts commit 10883f561a.

Reason for revert: Causes bytecode mismatch

Bug:chromium:1020538, chromium:1021457

Original change's description:
> [hole-check-elimination] Simplest possible hole check elimination
>
> doc: https://docs.google.com/document/d/1Y9uF3hS2aUrwKU56vGxlvEs_IiGgmWSzau8097Y-XBM/edit
>
> Bug: v8:7427
> Change-Id: Iedd36c146cefff7e6687fdad48d263889c5c8347
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778902
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63913}

TBR=rmcilroy@chromium.org,leszeks@chromium.org,verwaest@chromium.org,joshualitt@chromium.org

Bug: v8:7427
Change-Id: Ib4369a3560e929692585c4546435684deae5ee9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1899163
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64789}
2019-11-05 22:22:54 +00:00
Ng Zhi An
b6edadc09b [wasm-simd] Implement f64x2 comparisons for arm
Bug: v8:9813
Change-Id: I716ed7c2802c38a4b4c8973db4e3bc50e16cec39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872930
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64788}
2019-11-05 22:05:54 +00:00
Ng Zhi An
92a5b3998d [wasm-simd] Implement i64x2 add sub mul for ia32
Bug: v8:9728
Change-Id: I6d8f096adc42a6d417f876d5805302b3bea3308b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1867381
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64787}
2019-11-05 22:01:54 +00:00
Eric Leese
5c23e6b5f2 V8 Wasm locations should always be based on byte offsets
Currently there are two ways wasm locations are represented in the
inspector. This remains unchanged for now. Also, currently there are
multiple ways location is represented within V8, with the line number
sometimes being a function index and sometimes being 0, and the column
number being a byte offset which is sometimes function relative and
sometimes module relative. With this change, the line number is never
used within V8 (it is always 0), and the column number is always a
byte offset from the beginning of the module. This simplifies
translation logic and keeps it in one place, and will simplify future
changes to wasm location representation in the inspector API.

Bug: chromium:1013527
Change-Id: I8813d47c881988f9ab49d7529fb81fe10dbbccff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886915
Commit-Queue: Eric Leese <leese@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64774}
2019-11-05 14:53:45 +00:00
Pierre Langlois
d8dd3d65bc [cctest] Use 'strtoull' when decoding an address from the log.
We were using 'strtoll' which returns a signed integer, we should have used
'strtoull' instead.

Change-Id: Ie2e48ecc1fa58cff4b61fcea30087608769a80bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893333
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#64765}
2019-11-05 12:46:39 +00:00
Stefano Sanfilippo
6c0825aaa7 [compiler, api] Allow modifying codegen hook to block non-strings.
Instead of inferring allow_codegen from the state of MaybeLocal<String>, return it separately. This allows to distinguish "could not stringify this object" from "block execution of this object", regardless of whether the object is a string or not. Currently, the hook can trigger an EvalError only if the original source was a string.

Modify the logic so that one of the three mechanisms (unconditional, non-modifying, modifying) decides alone. Before, if the non-modifying callback rejected a value, the value would be forwarded to the modifying callback, but the unconditional would not forward to the non-modifying callback. This introduces a more uniform behaviour where the three mechanisms act in decreasing priority.

Change-Id: Iaaa9873227052653d714df65f31c4de914f48b7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776082
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64763}
2019-11-05 11:49:19 +00:00
Santiago Aboy Solanes
b01d5be96f Re-marking two tests as SLOW
Bug: v8:6949
Change-Id: If147de926cdc0b03f1bba17974edfce21d7fb256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1897887
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64747}
2019-11-04 17:22:17 +00:00
Santiago Aboy Solanes
8e07c79de7 Un-marking tests that were marked SLOW due to TNodification
Bug: v8:6949
Change-Id: Ie26d89e3219a8ac54b643cc8817a85797000d1e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895557
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64734}
2019-11-04 13:30:30 +00:00
Dan Elphick
352bbb1279 Reland "Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE"
This is a reland of 855591a54d

Fixes break in builds that verify ReadOnlyHeap by relaxing the requirement for
Code objects to be in CODE_SPACE in PagedSpaceObjectIterator::FromCurrentPage.

Original change's description:
> Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE
>
> Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.
>
> [builtins] Move non-JS linkage builtins code objects into RO_SPACE
>
> Creates an allow-list of builtins that can still go in code_space
> including all TFJ builtins and a small manual list that should be pared
> down in the future.
>
> For builtins that go in RO_SPACE a Code object is created that contains an
> immediate trap instruction. Generally these Code objects are still no
> smaller than CODE_SPACE Code objects because of the Code object alignment
> requirements. This will hopefully be addressed in a follow-up CL either by
> relaxing them or removing the instruction stream completely.
>
> In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
> increases by the same amount.
>
> Change-Id: I76661c35c7ea5866c1fb16e87e87122b3e3ca0ce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893336
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64700}

Change-Id: I4eeb7dab3027b42fa58c5dfb2bad9873e9fff250
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893192
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64728}
2019-11-04 10:45:10 +00:00
Sigurd Schneider
05eb0e41aa [heap-profiler] Improve reporting for WeakMap entries
This CL improves reporting for WeakMap entries: If a retaining chain
goes through a WeakMap entry (i.e. key and weak map are alive, and keep
value alive) then both the key and the value are reported. Additionally
the phrasing is clarified, such that entries in retaining paths are
easier to understand.

Bug: chromium:1020096
Change-Id: Ib05cd6f7939c6de41b554c682ad1fbf685b87608
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893335
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64721}
2019-11-04 09:46:15 +00:00
Bartek Nowierski
63dc55568b Add a debug v8 API SetDetachedWindowReason
A window is a Blink concept. This API marks the context as backing
a detached window. This doesn't necessarily mean that the context is
detached.

Every time a JS function is called within a context that has a non-zero
DetachedWindowReason, Runtime::kReportDetachedWindowAccess is invoked,
which will report this call to Blink via a callback, which in turn can
report number of such calls via UKM metrics.

Bug: chromium:1018156
Change-Id: I67c89fef459f4efcb912229eed8a4f3ea3b60f54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1862829
Auto-Submit: Bartek Nowierski <bartekn@chromium.org>
Commit-Queue: Bartek Nowierski <bartekn@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64707}
2019-11-01 00:57:40 +00:00
Bill Budge
8b104dee9c Revert "Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE"
This reverts commit 855591a54d.

Reason for revert: Breaks arm64 sim tests
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/17957
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/16585

Original change's description:
> Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE
> 
> Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.
> 
> [builtins] Move non-JS linkage builtins code objects into RO_SPACE
> 
> Creates an allow-list of builtins that can still go in code_space
> including all TFJ builtins and a small manual list that should be pared
> down in the future.
> 
> For builtins that go in RO_SPACE a Code object is created that contains an
> immediate trap instruction. Generally these Code objects are still no
> smaller than CODE_SPACE Code objects because of the Code object alignment
> requirements. This will hopefully be addressed in a follow-up CL either by
> relaxing them or removing the instruction stream completely.
> 
> In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
> increases by the same amount.
> 
> Change-Id: I76661c35c7ea5866c1fb16e87e87122b3e3ca0ce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893336
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64700}

TBR=ulan@chromium.org,jgruber@chromium.org,delphick@chromium.org

Change-Id: I4211c3bb7fe4741e0ba3898f92ce382dfc93c4f3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893636
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64701}
2019-10-31 20:30:07 +00:00
Dan Elphick
855591a54d Reland: [builtins] Move non-JS linkage builtins code objects into RO_SPACE
Reland of https://chromium-review.googlesource.com/c/v8/v8/+/1795358.

[builtins] Move non-JS linkage builtins code objects into RO_SPACE

Creates an allow-list of builtins that can still go in code_space
including all TFJ builtins and a small manual list that should be pared
down in the future.

For builtins that go in RO_SPACE a Code object is created that contains an
immediate trap instruction. Generally these Code objects are still no
smaller than CODE_SPACE Code objects because of the Code object alignment
requirements. This will hopefully be addressed in a follow-up CL either by
relaxing them or removing the instruction stream completely.

In the snapshot, this reduces code_space from ~152k to ~40k (-112k) and
increases by the same amount.

Change-Id: I76661c35c7ea5866c1fb16e87e87122b3e3ca0ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893336
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64700}
2019-10-31 18:18:56 +00:00
Ng Zhi An
ceb0aef09e Move some instructions into to sse macro list
Move rcpps, rsqrtps, sqrtps to SSE_INSTRUCTION_LIST.

Bug: v8:9810
Change-Id: Ib95a789dbeb4fc4472da11359cafe76db2027934
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874513
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64697}
2019-10-31 17:04:35 +00:00
Ng Zhi An
82144cf3bc [wasm-simd] Implement i64x2 shifts for ia32
Bug: v8:9728
Change-Id: If45c7f9fcadef1c18d4889e407920861892cff1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1866684
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64695}
2019-10-31 16:58:45 +00:00
Ng Zhi An
a742d8fb2f Create a macro list for X-sd instructions
These are SSE2 instructions that deal with scalar double precision
values, and look like the packed double precision variant of the
instructions, but with a prefix.

E.g. sqrtpd is 66 0F 51, sqrtss is F2 0F 51.

We don't put this in the same list, even though the implementation
is very similar, because SSE2_INSTRUCTION_LIST is used in other
macros which generate AVX versions of this, and that overlaps with
another macro which generates AVX versions of these X-sd instructions.
I will tease this apart and clean it up in subsequent changes.

Bug: v8:9810
Change-Id: I0db64fe0d37df5685158331ce9f48bd1c763cc59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874510
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64688}
2019-10-31 15:59:00 +00:00
Maya Lekova
45a2058b48 [turbofan] Allow for multiple re-serializations of a function
Implement the possibility to revisit the same function in the
serializer using equality of its arguments.

Bug: v8:7790
Change-Id: I609a6009bf503e378e50d0b32c6f1c13721d2557
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863198
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64683}
2019-10-31 14:21:09 +00:00
Michael Achenbach
e6f62a41f5 [build] Remove jumbo build configs
Bug: chromium:994387
Change-Id: I7b37a416ce6cc79903fe04923e86af1d0065ac37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1890090
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64669}
2019-10-31 09:43:47 +00:00
Deepti Gandluri
3097891464 Reduce some duplication in the x64 assembler
Bug: v8:9810
Change-Id: I585d35d01acf77d15ccb0e7334786d15ba07fb41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876634
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64660}
2019-10-30 19:53:36 +00:00
Santiago Aboy Solanes
93c8a25339 Regex replaced "TNode<_> const" to "const TNode<_>"
Bug: v8:9810
Change-Id: I2893c3066616b8fb5b3bebde4797adb0dac109c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1889878
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64659}
2019-10-30 18:34:36 +00:00
Ng Zhi An
71958d2abf Create a macro list for X-ss instructions
These are SSE instructions that deal with scalar single precision
values, and look like the packed single precision variant of the
instructions, but with a prefix.

E.g. sqrtps is NP 0F 51, sqrtss is F3 0F 51.

Bug: v8:9810
Change-Id: I417ea6d4d85d8618ad6602a1b32d4428db0d66d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874509
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64658}
2019-10-30 18:27:58 +00:00
Joshua Litt
5a0e3df6f3 [promises] Port NewPromiseCapability to torque.
Bug: v8:9838
Change-Id: Ibdb985243fe121057f982712b2909f45e0ae175c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1869490
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64656}
2019-10-30 17:24:05 +00:00
Gus Caplan
7bd4068101 Rename and retype Symbol name to description
Change-Id: I2a1ad1835b751237b350e56d64e3475459bfb7a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1873715
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64636}
2019-10-30 10:38:55 +00:00
Ulan Degenbaev
52a7ae362a [heap] Extracts parts of ConcurrentMarkingVisitor into a base class
This is the first step in unification of concurrent and main thread
marking visitors. The new MarkingVisitorBase will become a base class
for all marking visitors and will remove the existing code duplication.

This is a refactoring without behavior change.

Subsequent CL will change the main thread marking visitor to derive
from the new base class.

Bug: chromium:1019218

Change-Id: I3d47030d396e0ba6706882fbd922bbcac46181b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886920
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64632}
2019-10-30 10:05:45 +00:00
Andreas Haas
bfe3d6bce7 [api] Deprecate [Shared]ArrayBuffer::Externalize/GetContents and constructors
The new API with v8::BackingStore should be used instead as explained in
https://docs.google.com/document/d/1sTc_jRL87Fu175Holm5SV0kajkseGl2r8ifGY76G35k

This also relaxes the pre-condition for [Shared]ArrayBuffer::Detach to
not require externalization first.

Bug: v8:9380, v8:9908
Change-Id: Idd119fcd28be84a2fae74ae86f7381fd997766f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859628
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64625}
2019-10-29 22:01:54 +00:00
Ng Zhi An
f3cbcdb24b [wasm-simd] Fix f64x2 replace lane
There are a couple of bugs here:

1. The immediate used for vinsertps is wrong when lane == 1, the first
two bits specify which element of the source is copied, and it should
always be 00, 01 to copy the first 2 lanes of source.
2. For both cases, the second insertps call should be using dst as the
src, since dst was already updated by the first insertps call, it was
incorrectly using the old value of src. This was probably working
correctly because in many cases dst and src happened to be the same
register.
3. rep cannot be same as dst, because dst is overwritten, and rep should
stay the same

I also modified the F64x2ReplaceLane to test separately for replacing
lane 0 and lane 1.

Fixed bug 3. for arm and arm64.

Bug: v8:9728
Change-Id: Iec6e48bcfbc7d27908dd86d5f113a8b5dedd499b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1877055
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64620}
2019-10-29 16:50:27 +00:00
Pierre Langlois
74565bf390 [test] Make full space simulation work with --no-inline-new.
When inlined allocations are disabled, the space->limit() does not point to the
end of the current page. Instead, it points to the current allocation pointer so
is the same as space->top().

See how the limit is computed, if heap()->inline_allocation_disabled(), then the
limit will be the same as the requested allocation area:

```
Address SpaceWithLinearArea::ComputeLimit(Address start, Address end,
                                          size_t min_size) {
  DCHECK_GE(end - start, min_size);

  if (heap()->inline_allocation_disabled()) {
    // Fit the requested area exactly.
    return start + min_size;
  } else if (SupportsInlineAllocation() && AllocationObserversActive()) {
    // ...
  } else {
    // The entire node can be used as the linear allocation area.
    return end;
  }
}
```

If we want to simulate filling up a whole page in the new space, we can instead
look at the ToSpace's page_high() which will be the end of the current page in
which we're allocating.

Bug: v8:9906
Change-Id: I81113d151bc083cd22d17ea1a4fbae7fef9dff6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886914
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#64612}
2019-10-29 13:28:46 +00:00
Seth Brenith
91e6421ccb [torque] Use generated instance types, part 1
This change begins making use of the fact that Torque now knows about
the relationship between classes and instance types, to replace a few
repetitive lists:

- Instance type checkers (single and range), defined in
  src/objects/instance-type.h
- Verification dispatch in src/diagnostics/objects-debug.cc
- Printer dispatch in src/diagnostics/objects-printer.cc
- Postmortem object type detection in
  tools/debug_helper/get-object-properties.cc

Torque is updated to generate four macro lists for the instance types,
representing all of the classes separated in two dimensions: classes
that correspond to a single instance type versus those that have a
range, and classes that are fully defined in Torque (with fields and
methods inside '{}') versus those that are only declared. The latter
distinction is useful because fully-defined classes are guaranteed to
correspond to real C++ classes, whereas only-declared classes are not.

A few other changes were required to make the lists above work:

- Renamed IsFiller to IsFreeSpaceOrFiller to better reflect what it does
  and avoid conflicts with the new macro-generated IsFiller method. This
  is the part I'm most worried about: I think the new name is an
  improvement for clarity and consistency, but I could imagine someone
  typing IsFiller out of habit and introducing a bug. If we'd prefer to
  keep the name IsFiller, my other idea is to rename FreeSpace to
  VariableSizeFiller and Filler to FixedSizeFiller.
- Made Tuple3 extend from Struct, not Tuple2, because IsTuple2 is
  expected to check for only TUPLE2_TYPE and not include TUPLE3_TYPE.
- Normalized the dispatched behavior for BigIntBase and HeapNumber.
- Added a few new object printers.

Bug: v8:7793
Change-Id: I5462bb105f8a314baa59bd6ab6ab6215df6f313c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1860314
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64597}
2019-10-28 18:30:31 +00:00
Sigurd Schneider
be0e2c26a0 [ordered-hash-table] Add missing argument to ::Delete
OrderedHashTableHandler::Delete was missed in the migration CL
crrev.com/c/1106160 because it had no callers. This CL also
migrates said function and adds usages in tests which force
instantiation (and ensure we catch these errors without MSVC).

Bug: v8:9905
Change-Id: Ieb1d1c89754f98e1d88d841d2933f46a6a4820d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1883891
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64595}
2019-10-28 16:51:51 +00:00
Anna Henningsen
e5dbc95cc0 [api] Fix handle leak when getting Context embedder data
The `Context::SlowGetAlignedPointerFromEmbedderData()` method returns
a pointer, so the fact that it allocates handles is not obvious to
the caller.

Since this is the slow path anyway, simply add a handle scope inside
of it.

The tests are also modified to perform the same check for the
`Object` equivalent of this method.

Change-Id: I5f03c9a7b70b3a17315609df021606a53c9feb2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879902
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64583}
2019-10-28 12:10:56 +00:00
Igor Sheludko
d36eee56b6 [builtins] Don't use ToSmiLength in TypedArray constructors
... and reimplement TryNumberToUintPtr.

Bug: v8:4153
Change-Id: I3b683b6a41ebf49229aee4ceea4910e94d35ccca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876817
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64566}
2019-10-25 14:00:59 +00:00
Leszek Swirski
eb66765125 [heap] Add base class for LargeObjectSpaces
Both LO_SPACE and NEW_LO_SPACE use the basic page management system of
LargeObjectSpace, but implement different AllocateRaw methods (with
the NEW_LO_SPACE version shadowing the LO_SPACE version).

To clean this up, and allow other future LargeObjectSpace implementations
(in particular, an off-thread variant), refactored the current
LargeObjectSpace into a base class, and make both LargeObjectSpace
(renamed to OldLargeObjectSpace) and NewLargeObjectSpace extend this
class.

Bug: chromium:1011762
Change-Id: I41b45b97f2611611dcfde677213131396df03a5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876824
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64560}
2019-10-25 09:22:57 +00:00
Michael Starzinger
9cb82371d0 [execution] Remove outdated {JavaScriptFrameConstants}.
This class used to describe unoptimized but compiled frames. All such
frames are by now covered via the architecture-independent description
in the {StandardFrameConstants} class (or one of its subclasses).

R=clemensb@chromium.org
BUG=v8:9810

Change-Id: I294cc6eec7d4a05e88e7aa336f1ebedfa0eb6e98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1878708
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64556}
2019-10-25 08:11:07 +00:00
Mike Stanton
3897678297 [turbofan] Handle bound function results in the serializer
Add VirtualBoundFunction to the serializer which takes care of
processing the result of Function.prototype.bind.

Add cctest and an mjsunit test.

Bug: v8:7790
Change-Id: Ic2b48d356cbe3b576eb22f58215cc886a8994e31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1859625
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64548}
2019-10-24 15:15:22 +00:00
Anna Henningsen
6b0a9535e6 [api] Add possibility for BackingStore to keep Allocator alive
Add an `array_buffer_allocator_shared` field to the
`Isolate::CreateParams` struct that allows embedders to share
ownership of the ArrayBuffer::Allocator with V8, and which in
particular means that when this method is used that the
BackingStore deleter will not perform an use-after-free access to the
Allocator under certain circumstances.

For Background:

tl;dr: This is necessary for Node.js to perform the transition to
V8 7.9, because of the way that ArrayBuffer::Allocators and their
lifetimes currently work there.

In Node.js, each Worker thread has its own ArrayBuffer::Allocator.
Changing that would currently be impractical, as each allocator
depends on per-Isolate state. However, now that backing stores
are managed globally and keep a pointer to the original
ArrayBuffer::Allocator, this means that when transferring an
ArrayBuffer (e.g. from one Worker to another through postMessage()),
the original Allocator has to be kept alive until the ArrayBuffer
no longer exists in the receiving Isolate (or until that Isolate
is disposed). See [1] for an example Node.js test that fails with
V8 7.9.

This problem also existed for SharedArrayBuffers, where Node.js
was broken by V8 earlier for the same reasons (see [2] for the bug
report on that and [3] for the resolution in Node.js).
For SharedArrayBuffers, we already had extensive tracking logic,
so adding a shared_ptr to keep alive the ArrayBuffer::Allocator
was not a significant amount of work. However, the mechanism for
transferring non-shared ArrayBuffers is quite different, and
it seems both easier for us and better for V8 from an API standpoint
to keep the Allocator alive from where it is being referenced.

By sharing memory with the custom deleter function/data pair,
this comes at no memory overhead.

[1]: https://github.com/nodejs/node/pull/30044
[2]: https://github.com/nodejs/node-v8/issues/115
[3]: https://github.com/nodejs/node/pull/29637

Bug: v8:9380
Change-Id: Ibc2c4fb6341b53653cbd637bd8cb3d4ac43809c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874347
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64542}
2019-10-24 10:56:03 +00:00
Shu-yu Guo
ae9c8c802a [regexp] Improve String.prototype.matchAll error message
Currently if the argument to matchAll has a null or undefined .flags
property, the error message will read "String.prototype.matchAll called
on null or undefined", which is very confusing.

Drive-by fix: Remove the related and unused
MethodInvokedOnNullOrUndefined error.

Bug: v8:9895
Change-Id: I3644545282ac8d2156c7a51086e37a0ab7f97a78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874619
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64530}
2019-10-24 01:54:58 +00:00
Ng Zhi An
4a716fea07 [wasm-simd] Add AVX codegen for some x64 instructions
This adds avx for extractps, insertps, and cvtdq2ps. These require
SSE4_1, so modified AvxHelper to take another template arg for sse4
operations, and open the proper cpu scope before calling this arg.

Bug: v8:9561
Change-Id: Iad2be7ebab41b96f7eb74f4e2bd9776002e6a76c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1874378
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64529}
2019-10-23 21:41:20 +00:00