Commit Graph

25311 Commits

Author SHA1 Message Date
Clemens Backes
1d31558f54 [wasm] Move interpreter to test directory
The interpreter is not used in production code any more, hence move it
from src/wasm to test/common/wasm.
It's still used in unit tests, cctests, and in fuzzers.

Because of this move, a few more methods had to be exported via
V8_EXPORT_PRIVATE.

R=ahaas@chromium.org, yangguo@chromium.org

Bug: v8:10389
Change-Id: If626b940a721146c596fd7df4faaea633e710272
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257226
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68480}
2020-06-23 08:48:14 +00:00
Jakob Gruber
aa4e381bda [nci] Add feedback vector as input to binary ops
Following up on previous changes for unary ops:
https://crrev.com/c/2246576

Bug: v8:8888
Change-Id: Ie4dd9a307fb0415e93babf412e3d8d9e86791761
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257227
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68479}
2020-06-23 08:38:54 +00:00
Daniel Clifford
1052dfb387 [torque] generate Cast<> macros from Torque-defined classes
This change enables automatic generation of Cast<> operators for
classes that are defined in Torque.

* Cast<> macros are generated for all classes that are defined in
  Torque code that are neither shapes nor marked with a new
  @doNotGenerateCast annotation.

* Implicitly generated Cast macros simply call through to an
  internally-defined "DownCastForTorqueClass" macro that implements
  the cast using one of three strategies for efficiency. If the class
  has subclasses (i.e. a range of instance types including subtypes),
  the DownCastForTorqueClass checks for inclusion in the instance type
  range. If the class has a single instance type (i.e. no subclasses),
  then either 1) a map check is used if the class has a globally-
  defined map constant or 2) an equality check for the instance type
  is used.

* Added new intrinsics to introspect class information, e.g. fetching
  instance type ranges for a class, accessing the globally-defined map
  for a class.

* Removed a whole pile of existing explicit Cast<> operators that are
  no longer needed because of the implicitly generated Cast<> macros.

* Added tests for the new Cast<> implementations.

Bug: v8:7793
Change-Id: I3aadb0c62b720e9de4e7978b9ec4f05075771b8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250239
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68478}
2020-06-23 08:01:54 +00:00
Jakob Gruber
443e37acc9 [compiler] Refactor opcode macro lists
This extends the opcode macro lists to include both the long name
(e.g.: JSAdd) and short name (Add) to reduce duplication. The change
is only for JS operators for now but can be extended to others in the
future.

Drive-by: Base more predicates off the macro lists for robustness.

Bug: v8:8888
Change-Id: I10debdf86166dbe9dac63a6df57938820a8af8d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255468
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68477}
2020-06-23 07:54:14 +00:00
Jakob Gruber
5b5a519243 [coverage] Add a test to document crbug/v8/10628
Just a test for now to document how trailing space after async
functions is not removed by SourceRangeAstVisitor.

Bug: v8:10628
Change-Id: I40f0d911c59540ea835c807a2be5b0d1488291d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259852
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68476}
2020-06-23 07:32:34 +00:00
Ng Zhi An
50f4706c93 [wasm-simd][arm64] Prototype i32x4.dot_i16x8_s
This implements I32x4DotI16x8S for arm64.

Bug: v8:10583
Change-Id: Id55c57715b4050d54bbcdc18fc443f2332291651
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2231032
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68473}
2020-06-22 22:21:33 +00:00
Ulan Degenbaev
3e91957803 [heap] Randomize the timeout for forcing GC in the MeasureMemory API
Chrome may send memory measurement requests to multiple renderer
processes at the same time. This may lead to multiple GC happening at
the same time if the processes are idle. Randomization spreads out
the GCs over time to reduce the load on the system.

Bug: chromium:1049093
Change-Id: I5aa67fb07f8a55d0ba769bf823168b35cb3c23cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2208861
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68472}
2020-06-22 19:40:53 +00:00
Ng Zhi An
ad913fe4f3 [Respect] Prefer inclusive terms
This changes the use of "sane" to "sensible" or "valid". I tried to be
sensible in my choice of replacement, by trying to read the comments or
code to see which word matches the intention closest.

Referenced
https://fuchsia.dev/fuchsia-src/contribute/best-practices/respectful_code?hl=en#what_are_examples_of_terminology_to_be_avoided.

Bug: v8:10619
Change-Id: Id957b2e6ff11e95270e1372005e1006d8cf1008d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2254483
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68471}
2020-06-22 18:11:23 +00:00
Ng Zhi An
d21a35ef17 [wasm-simd][arm] Prototype f32x4.floor
Prototype f32x4.floor on ARM for both ARM v7 and ARM v8. ARM v8 has
support for vrintm, and for ARM v7 we fallback to runtime.

Since ARM v8 uses vrintm, which is the same instruction used for F32
Floor (scalar), wasm-compiler reuses the Float32RoundDown check.

Bug: v8:10553
Change-Id: I540e82a156131821f732cd427df2e5c68f4094d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252541
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68470}
2020-06-22 18:10:13 +00:00
Deepti Gandluri
895c52ddcb [wasm] Adjust atomics wait/notify semantics
Adjust atomics.wait, atomics.notify semantics for when they are used
with non-shared Wasm memory to mirror the spec change introduced
in: https://github.com/WebAssembly/threads/pull/147. This does not
need to be gated by the flag here, as this will only decode if
the flag is enabled.

Bug: v8:9921
Change-Id: I7f2e018fed6bd131ad4c386def1e838626c28a4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2256863
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68468}
2020-06-22 17:49:23 +00:00
Ng Zhi An
7c429d96f6 [wasm-simd][liftoff][arm] Implement s8x16shuffle
Bug: v8:9909
Change-Id: Icb4dd53f02bcd3b38511bb028768d276e3bfebaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2251041
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68467}
2020-06-22 17:08:12 +00:00
Georg Neis
7527169afb [test] Fully reenable test-api/MultipleIsolatesOnIndividualThreads
Let's see if this is still flaky after almost 5 years.

Bug: v8:4573
Change-Id: I4cd2779b2c4aefc7bb20597db2fccc0e7e7c39c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255467
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68465}
2020-06-22 15:46:01 +00:00
Dan Elphick
6574a7133d [Respect] Rename lists
This changes black/white list to block/allow list.

Bug: v8:10619
Change-Id: Id55d72f90891670ca57b62dfeb6b3251025927dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257228
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68464}
2020-06-22 15:15:31 +00:00
Clemens Backes
6a546bd967 [wasm] Minor cleanup in wasm module builder
This addresses a review comment from
https://github.com/WebAssembly/spec/pull/1214.

R=ahaas@chromium.org

Change-Id: Icd473aa16bbf35839556b052271489a2889fe0fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257229
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68461}
2020-06-22 14:01:41 +00:00
Thibaud Michaud
74f5de4f45 [wasm][mv] Enable WebAssembly multi-value
Intent to Ship thread on blink-dev:
https://groups.google.com/a/chromium.org/g/blink-dev/c/K4-P5rq7FbY

Spec repository:
https://github.com/WebAssembly/multi-value/

WebAssembly multi-value is ready to ship. The proposal is now merged
into the core WebAssembly spec, and is implemented in both TurboFan and
Liftoff.

R=ecmziegler@chromium.org

Bug: chromium:1097717
Change-Id: Id53ee318cacae1bc9dd9d9611f9223de594a99b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257225
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68459}
2020-06-22 12:41:39 +00:00
Anton Bikineev
03bb338960 Move stack walking to shared directory
This allows the implementation of different stack scanning mechanisms in
V8 (e.g. conservative scanning) while re-using the stack walking API.

Change-Id: I9b9c3b8ffe5d527ca3f7105776821776b509b187
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2238194
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68457}
2020-06-22 10:40:56 +00:00
Dan Elphick
65ae2a0f96 [heap] Check BasicMemoryChunk before initializing
Add nullptr guard for the return value of AllocateBasicChunk.

Bug: chromium:1097502
Change-Id: Ia4642151a119ccabe58d7084077808aac93e5d1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257221
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68454}
2020-06-22 10:01:25 +00:00
Andreas Haas
8086ca3062 [wasm] Ship WebAssembly BigInt Integration
R=adamk@chromium.org

Bug: v8:7741
Change-Id: Icf7247825bd10048cd198b910b8bd976a0a0b3d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241516
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68453}
2020-06-22 09:32:25 +00:00
Clemens Backes
542fac8589 [wasm][fuzzer] Fix SubVector call
This is a follow-up to https://crrev.com/c/2249928. The arguments for
{SubVector} are {from, to}, not {from, size}.

R=jkummerow@chromium.org

Bug: chromium:1097442
Change-Id: I3c5571ff7f0c6b8e235ecf4164591630dbd05739
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255465
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68451}
2020-06-22 08:55:19 +00:00
Milad Farazmand
edd381f7a9 [foozzie] Fix endianness problem with expected output
Change-Id: I70fa23a2491186d2bf94b26a292163efa1c23d61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2255503
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68446}
2020-06-21 01:38:07 +00:00
Ng Zhi An
08ccfb2002 [wasm-simd][ia32] Prototype i32x4.dot_i16x8_s
This implements I32x4DotI16x8S for ia32.

Also fixes instruction-selector for SIMD ops, they should all set operand1 to be a register, since we do not have memory alignment yet.

Bug: v8:10583
Change-Id: Id273816efd5eea128580f3f7bde533a8e1b2435d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2231031
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68444}
2020-06-19 18:05:47 +00:00
Manos Koukoutos
1c39569e2e [wasm-gc] Change reference type encoding to match proposal spec
Bug: v8:7748
Change-Id: I9af885e4c33541a8e065082ae7f07804bd11807a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252190
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68443}
2020-06-19 17:47:17 +00:00
Clemens Backes
5ae5ee8f53 [wasm][respect] Avoid 'sanity check'
Replace by "consistency check", or "validity check", or more specific
wording as appropriate.

R=ecmziegler@chromium.org

Bug: v8:10619
Change-Id: Ifd7852d8f703d5b784d53671b82d65db15722ede
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253855
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68440}
2020-06-19 14:32:15 +00:00
Michael Achenbach
891e1b6339 [foozzie] Mock out setting NaN values in DataViews
Bug: chromium:1091698
Change-Id: Ida82d262f409c54e59640bcaa026879d18ff178d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252184
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68439}
2020-06-19 14:16:45 +00:00
Milad Farazmand
07a6123c84 PPC/s390: [wasm] Enable Liftoff everywhere
Port c6642b5112

Original Commit Message:

    We rely on Liftoff for debugging, hence enable it everywhere by default.
    This follows a chromium finch experiment and a CL to enable it
    everywhere in chrome: https://crrev.com/c/2252100

R=clemensb@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I1a8e7a4acb9a5ce5a6d0ba96b105ba32e53f1b69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253464
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68438}
2020-06-19 14:07:55 +00:00
Peter Marshall
a7b3d8f95d [inspector] Name callback functions more descriptively
Change-Id: I37e241d9c62f1a7fed438ee8717f02f5b4f51bea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2253846
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68435}
2020-06-19 11:15:15 +00:00
Peter Marshall
f510c66b96 inspector: Add flag to Runtime.evaluate() for unsafe eval
evaluate() bypassed CSP for unsafe-eval by default. This is a useful
option for debugging clients, but is not always what we want.

e.g. in the devtools console we want to match the page's CSP settings
to make debugging CSP issues on the page easier.

Add a toggle that keeps the current behavior by default.

Bug: chromium:1084558
Change-Id: Ia01142d5be00f8ef5f65e5eeba17549efc6f9120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250245
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68432}
2020-06-19 10:24:20 +00:00
Clemens Backes
a2ef686f86 [wasm] Fix possible hang in compare-exchange tests
Make sure that the workers do not start running before the main thread
told them so by setting the memory to the first element in the sequence.
Otherwise it can happen that the main thread resets the memory after the
workers already started doing their updates, which results in a hang
(see linked bug).

R=marja@chromium.org

Bug: v8:10625
Change-Id: I959018279e0049900d44457b72146bc37a12bcb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252191
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68429}
2020-06-19 10:00:45 +00:00
Manos Koukoutos
36532d1beb [wasm-gc] Split and rename gc tests
Bug: v8:7748
Change-Id: I58e8216e3d51aa9da3e6a819cdf2614b4509e1a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250249
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68428}
2020-06-19 09:39:29 +00:00
Dan Elphick
30f409c751 [heap] Move BaseSpace into base-space.h
Bug: v8:10473
Change-Id: Ic53130ca5103ba219329f7b204b218bc021f07f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252178
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68427}
2020-06-19 09:38:24 +00:00
Michael Lippautz
8bdce52713 Reland "cppgc: Properly clear (Weak)Peristent and WeakMember pointers"
This is a reland of e0c1a349ea

The issue was passing SentinelPointer (== +1) through T*.

The fix is disabling cfi unrelated cast diagnostic for the bottlenecks
(Get()). This means that nullptr is treated the same as
kSentinelPointer.

The alternative would be a DCHECK that Get() does not return
kSentinelPointer and adjusting all Member and Persistent logic that
uses Get() to work on void*. This is quite intrusive as it involves
Swap(), heterogeneous assignments, comparisons, etc.

Original change's description:
> cppgc: Properly clear (Weak)Peristent and WeakMember pointers
>
> The CL addresses two issues with (Weak)Persistent and WeakMember:
> 1. (Weak)Persistent pointers are cleared on heap teardown. Before this
>    CL the pointers would contain stale values which could lead to UAF.
> 2. WeakPersistent and WeakMember are cleared using a combination of
>    internal clearing methods and mutable fields which avoids the use
>    of const_cast<>.
>
> Bug: chromium:1056170
> Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68394}

Bug: chromium:1056170
Change-Id: I3d74b43464c2973df1956f51b1419d755dd9f519
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250240
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68426}
2020-06-19 08:48:49 +00:00
Manos Koukoutos
c85800e2df [wasm-gc] Establish HeapType shorthands, rework signatures.
This CL introduces one-letter shorthands to HeapTypes, and fixes
signatures to be in sync with the ValueType and HeapType shorthands.

Bug: v8:7748
Change-Id: I4cc8e26d6523074bc36bf2d29289e63a23e80ddc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249672
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68425}
2020-06-19 08:43:44 +00:00
Frank Tang
6680837c8a Roll icu to fix sr-ME timeZoneName in Latin bug
Bug: v8:10599
Change-Id: I1248d365576c0bc8c01d8ce07f0c49654fabfc52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2251173
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68422}
2020-06-19 06:42:51 +00:00
Ng Zhi An
e20b05c643 Change octal number to hex
This was causing issues with strict mode when combined with fuzzers. See
https://crrev.com/c/2173952/7/test/mjsunit/wasm/wasm-module-builder.js#471

Change-Id: I164b24c35d7ba7c53a550dc3649eb7268dfb30e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2252540
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68420}
2020-06-18 23:57:49 +00:00
Ng Zhi An
d9381fd697 [wasm-simd][arm] Prototype f32x4.ceil
Prototype f32x4.ceil on ARM for both ARM v7 and ARM v8. ARM v8 has
support for vrintp, and for ARM v7 we fallback to runtime.

Since ARM v8 uses vrintp, which is the same instruction used for F32
Ceil (scalar), wasm-compiler reuses the Float32Round check, rather than
creating new F32x4Round optional operators.

Implementation for vrintp (Advanced SIMD version that takes Q
registers), assembler, disassembler support. Incomplete for now, but
more will be added as we add other rounding modes.

Bug: v8:10553
Change-Id: I4563608b9501f6f57c3a8325b17de89da7058a43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248779
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68419}
2020-06-18 19:55:39 +00:00
Ng Zhi An
7c232b8f61 [wasm-simd][fuzzer] Add i8x16 i16x8 i32x4 bit_mask
Bug: v8:10180
Change-Id: Ic341e0de315b7d7b33dbad265c8fda9145a669da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2243760
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68417}
2020-06-18 18:25:28 +00:00
Dan Elphick
92cd4d1ea2 [parser] Don't mark sloppy block functions as assigned
When preparsing and detecting a sloppy block function redefinition then
don't mark the variable as assigned to make it consistent with the eager
parser.

Bug: chromium:1053364
Change-Id: Iec7c24db80014bfe73ee41a4f3bb7a41a354cef2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241511
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68415}
2020-06-18 16:24:48 +00:00
Clemens Backes
fe3531c4c2 [wasm][fuzzer] Avoid creating temporary std::vectors
Instead of creating temporary {std::vector}s (which always allocate on
the heap) create more vectors on the stack, via initializer lists.

As this is "only" a fuzzer, performance is not really critical, but
still has some impact on the efficiency of the whole fuzzer.
That said, this CL is mostly a cleanup to replace unwanted code pattern
by better code.

R=jkummerow@chromium.org

Change-Id: I924c15e5d64ed584fc96c85715eef1dca5aef150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249928
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68413}
2020-06-18 14:36:38 +00:00
Manos Koukoutos
52f6529634 [wasm-gc] Change ValueType representation to account for new types
Motivation:
Changes to the typed function references and gc proposals solidified
the notion of heap type, clarified nullable vs. non-nullable reference
types, and introduced rtts, which contain an integer depth field in
addition to a heap type. This required us to overhaul our ValueType
representation, which results in extensive changes.

To keep this CL "small", we do not try to implement the binary encoding
as described in the proposals, but rather devise a simpler one of our
own (see below). Also, we do not try to implement additional
functionality for the new types.

Changes:
- Introduce HeapType. Move heap types from ValueType to HeapType.
- Introduce Nullability for reference types.
- Rework ValueType helper methods.
- Introduce rtts in ValueType with an integer depth field. Include depth
  in the ValueType encoding.
- Make the constructor of ValueType private, instead expose static
  functions which explicitly state what they create.
- Change every switch statement on ValueType::Kind. Sometimes, we need
  nested switches.
- Introduce temporary constants in ValueTypeCode for nullable types,
  use them for decoding.
- In WasmGlobalObject, split 'flags' into 'raw_type' and 'is_mutable'.
- Change IsSubtypeOfRef to IsSubtypeOfHeap and implement changes in
  subtyping.
- kWasmFuncRef initializers are now non-nullable. Initializers are
  only required to be subtypes of the declared global type.
- Change tests and fuzzers as needed.

Bug: v8:7748
Change-Id: If41f783bd4128443b07e94188cea7dd53ab0bfa5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247657
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68408}
2020-06-18 12:04:08 +00:00
Dan Elphick
32b911f96a Reland "[heap] Make ReadOnlySpace use bump pointer allocation"
This reverts commit f78d69fa5d.

With https://chromium-review.googlesource.com/c/v8/v8/+/2243216,
incorrect MemoryChunk::FromHeapObject uses are now fixed.

Original change's description:
> Revert "[heap] Make ReadOnlySpace use bump pointer allocation"
> 
> This reverts commit 81c34968a7 and also
> 490f3580a3 which depends on the former.
> 
> Reason for revert: Break CFI tests in chromium https://ci.chromium.org/p/chromium/builders/ci/Linux%20CFI/17438
> Original change's description:
> > [heap] Make ReadOnlySpace use bump pointer allocation
> >
> > This changes ReadOnlySpace to no longer be a PagedSpace but instead it
> > is now a BaseSpace. BasicSpace is a new base class that Space inherits
> > from and which has no allocation methods and does not dictate how the
> > pages should be held.
> >
> > ReadOnlySpace unlike Space holds its pages as a
> > std::vector<ReadOnlyPage>, where ReadOnlyPage directly subclasses
> > BasicMemoryChunk, meaning they do not have prev_ and next_ pointers and
> > cannot be held in a heap::List. This is desirable since with pointer
> > compression we would like to remap these pages to different memory
> > addresses which would be impossible with a heap::List.
> >
> > Since ReadOnlySpace no longer uses most of the code from the other
> > Spaces it makes sense to simplify its memory allocation to use a simple
> > bump pointer and always allocate a new page whenever an allocation
> > exceeds the remaining space on the final page.
> >
> > Change-Id: Iee6d9f96cfb174b4026ee671ee4f897909b38418
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2209060
> > Commit-Queue: Dan Elphick <delphick@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68137}
> 
> TBR=ulan@chromium.org,delphick@chromium.org
> 
> # Not skipping CQ checks because original CL landed > 1 day ago.
> 
> Change-Id: I68c9834872e55eb833be081f8ff99b786bfa9894
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2232552
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68211}

TBR=ulan@chromium.org,delphick@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Id5b3cce41b5dec1dca816c05848d183790b1cc05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250254
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68407}
2020-06-18 11:48:38 +00:00
Frank Tang
080a6c7775 Roll test262
f89ea875..8d3dd2d

8d3dd2d Sync the test w/ changes in intl-datetime-style 43 by Frank Tang · 15 hours ago master
2dcdba9 Simplify tests by Alexey Shvayka · 15 hours ago
23417d9 Test %TypedArray%.prototype.set with primitives by Alexey Shvayka · 15 hours ago

Bug: v8:7834
Change-Id: I39b62aa1f4800349a009035e704bd4a93223174b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2251174
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68404}
2020-06-18 09:39:51 +00:00
Michael Achenbach
3864e1f2da [fuzzing] Use --fuzzing flag for allowed runtime functions
This subsumes the old behavior of --allow-natives-for-fuzzing under
--fuzzing as well. Both flags are used in a redundant way in fuzz
configs. Only --allow-natives-for-fuzzing wasn't specified as a
required argument, leading to the bug below.

We still need the flag --allow-natives-for-differential-fuzzing
to allow different functions when using differential fuzzing.

Bug: chromium:1094866
Change-Id: I398791779e58ed4d80e896c1cfea343848159212
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2246568
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68401}
2020-06-18 08:09:48 +00:00
Shu-yu Guo
44a655c8af Forward the absence of the argument on AsyncFromSyncIterator prototype methods
https://github.com/tc39/ecma262/pull/1776 is a normative change that
reached consensus in the November 2019 TC39. It changes
%AsyncFromSyncIteratorPrototype% methods to forward the absence of
arguments to the underlying sync iterator. This is observable via
`arguments.length` inside the underlying sync iterator.

For example, .next is changed to, roughly:

```
%AsyncFromSyncIteratorPrototype%.next = function(value) {
  let res;
  if (arguments.length < 1) {
     res = [[SyncIteratorRecord]].[[Iterator]].next();
  } else {
     res = [[SyncIteratorRecord]].[[Iterator]].next(value);
  }
  // ...
};
```

Bug: v8:10395
Change-Id: Ib8127d08cd78b8d502e6510241f3f13fbbaba5c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247041
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68398}
2020-06-17 18:36:48 +00:00
Igor Sheludko
401513217a [ptr-compr] Disable mkgrokdump test when pointer compression is off
... because tools/v8heapconst.py was created for default x64 release
mode (with enabled pointer compression).

Bug: v8:7703, v8:10621
Change-Id: I1fbcd81aac26e0b357279b7dffa97c64a5415e40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250238
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68397}
2020-06-17 18:35:43 +00:00
Zhi An Ng
8a27d9f93e Revert "cppgc: Properly clear (Weak)Peristent and WeakMember pointers"
This reverts commit e0c1a349ea.

Reason for revert: Fails on Linux 64 cfi https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/25283?

TBR=omerkatz@chromium.org,mlippautz@chromium.org,bikineev@chromium.org,bikineev@chromium.org

Change-Id: I2b208c4019979735925bff5e0551291fae6a14d6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2250320
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68396}
2020-06-17 18:20:46 +00:00
Michael Lippautz
e0c1a349ea cppgc: Properly clear (Weak)Peristent and WeakMember pointers
The CL addresses two issues with (Weak)Persistent and WeakMember:
1. (Weak)Persistent pointers are cleared on heap teardown. Before this
   CL the pointers would contain stale values which could lead to UAF.
2. WeakPersistent and WeakMember are cleared using a combination of
   internal clearing methods and mutable fields which avoids the use
   of const_cast<>.

Bug: chromium:1056170
Change-Id: Ibf2b0f0856771b4f6906608cde13a6d43ebf81f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248190
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68394}
2020-06-17 17:00:38 +00:00
Dan Elphick
6f267e8a14 [heap] Use BasicMemoryChunk::FromHeapObject more
Since ReadOnlySpace pages will soon not be MemoryChunks, change most
uses of MemoryChunk::FromHeapObject and FromAddress to use the
BasicMemoryChunk variants and which use the new MemoryChunk::cast
function that takes a BasicMemoryChunk and DCHECKs !InReadOnlySpace().

To enable this, it also moves into BasicMemoryChunk several MemoryChunk
functions that just require a BasicMemoryChunk.

Bug: v8:10454
Change-Id: I80875b2c2446937ac2c2bc9287d36e71cc050c38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2243216
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68390}
2020-06-17 14:05:48 +00:00
Philip Pfaffe
8b160ca4ff Fix external_debug_info section name
According to the spec, the section name does not start with a dot:
https://yurydelendik.github.io/webassembly-dwarf/#external-DWARF

Change-Id: I4ac205332dd9612fe83c2e6322a98bdae3ffa79d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2249669
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68389}
2020-06-17 13:51:28 +00:00
Michael Lippautz
40cef10f26 Reland "cppgc,heap: Implement atomic unified heap GC"
This is a reland of 539f0ed23b

The reland fixes creating TimeDelta from double which requires
saturated_cast<>. Improvements to this constructions are tracked
in v8:10620.

Original change's description:
> cppgc,heap: Implement atomic unified heap GC
>
> Add v8::CppHeap as an implementation of a cppgc heap that
> integrates with V8's existing EmbedderHeapTracer API. The
> current implementation only supports non-incremental marking.
>
> Bug: chromium:1056170
> Change-Id: I4a09eb5ae57f5c7defe35eb3fe346627eb492473
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2245610
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68374}

Bug: chromium:1056170,v8:10620
Change-Id: I39e15790e5cafe24da2a14d0bae6543391ebb536
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2248191
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68387}
2020-06-17 11:02:38 +00:00
Jakob Gruber
d8cd725f7b [nci] Implement missing generic lowering bits
... for nci code, in which several phases of the compiler are not
active:

LowerJSCreateCatchContext
LowerJSCreateEmptyLiteralObject
LowerJSCreateIterResultObject
LowerJSCreateWithContext
LowerJSGetIterator
LowerJSGetTemplateObject

With this change, the nci variant passes the test suite. Tests
relying on turbofan-specific behavior (e.g. deopts) are skipped.

Bug: v8:8888
Change-Id: I709178241e9b25e7480a39b4fb64bdcf576483be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2245604
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68381}
2020-06-17 07:04:05 +00:00