This CL fixes the NumberDictionary fast-path in Array.p.sort, when
storing to a read-only property that was never read from.
R=jgruber@chromium.org
Bug: v8:7907
Change-Id: I2b772fb5b1619a94a7d239ba4417ecb7902a167c
Reviewed-on: https://chromium-review.googlesource.com/1119910
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54109}
Since the wire bytes are now stored on the C++ heap, referenced
directly from the {NativeModule}, there is no need any more for the
additional copy in the {CompilationState}.
R=mstarzinger@chromium.org
Bug: v8:7868
Change-Id: I3ca25981b37bc14037a83a199354b70b4e52f8c7
Reviewed-on: https://chromium-review.googlesource.com/1118886
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54107}
Just a refactoring to make clear that we are talking about function
names. Note that there are also names for locals inside functions,
which we currently don't use.
Drive-by: Remove style-guide violation by {WasmModule::names_} field.
R=mstarzinger@chromium.org
Bug: v8:7754
Change-Id: I9c47ea01893f128e1716be01032adfaf006ae28a
Reviewed-on: https://chromium-review.googlesource.com/1118271
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54105}
This change somehow got lost when relanding an earlier CL in
https://crrev.com/c/1118139
Bug: v8:7891
Change-Id: I31244be136322cccfb465c24356f1d0fd5e0c6d6
Reviewed-on: https://chromium-review.googlesource.com/1119786
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54104}
Commit edec05ea73
Usage of Print function was not consistent with it's signature,
which caused failures in compilation.
Original commit message:
`All Object::Print functions now take an Isolate* parameter. Various
XX::XXPrint functions now take an Isolate if it's needed rather than
calling GetIsolate(). Such method use DECL_PRINTER_WITH_ISOLATE rather
than DECL_PRINTER.
The _v8_internal_Print_ function (intended for use in gdb) now uses
Isolate::Current() to get hold of an Isolate.
Reduces the GetIsolate and GetHeap count by 9 and 5 respectively.
Also removes unneeded gdb/lldb macros (along with their support
functions), jfv, jfm, jda and jta, since job does the same thing.`
Cr-Original-Commit-Position: refs/heads/master@{#54029}
Change-Id: I5d4eb974340159ae91a50c1c2272ab195fc514ea
Reviewed-on: https://chromium-review.googlesource.com/1116965
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#54103}
No need to go via the {ModuleEnv} in the {CompilationState}.
R=mstarzinger@chromium.org
Change-Id: I11ff647824ad107131ce329453b365d6ecaec7fb
Reviewed-on: https://chromium-review.googlesource.com/1118561
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54102}
This is a reland of 20f33823c9.
The flakes that lead to the revert are hopefully fixed with
https://crrev.com/c/1118171.
Original change's description:
> [wasm] Enable Liftoff by default on ia32 and x64
>
> R=titzer@chromium.org, hablich@chromium.org
>
> Bug: v8:6600, chromium:787421
> Change-Id: Ia8ae56ddef3b27b0721d5a66ff19abe098a2c6ca
> Reviewed-on: https://chromium-review.googlesource.com/1109899
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53965}
TBR=titzer@chromium.org, hablich@chromium.org
Bug: v8:6600, chromium:787421
Change-Id: Icfc6f5c7701f18891ede34edb2bc22a7c01c8d6d
Reviewed-on: https://chromium-review.googlesource.com/1118485
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54099}
- Adds some unit tests for InstructionSelector::TryMatch* methods.
- Adds a TryMatchIdentity method. We should detect identity shuffles
and emit no code in that case.
Bug: v8:6020
Change-Id: I5dea84738bf87db7112eb7d19f91b1e6b20811c7
Reviewed-on: https://chromium-review.googlesource.com/1116058
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54097}
When storing an indexed property in a typed array, it's necessary to
convert the value to a Number (or to a Bigint) before performing the
bounds check, per
https://tc39.github.io/ecma262/#sec-integerindexedelementset.
This CL adds appropriate type conversions in
Object::SetPropertyInternal (which technically is reached after the
bounds check has already occurred, but this isn't observable yet ---
In the future, once OOB accesses on TypedArrays actually throw, this
will need to be refactored again), and in StoreFastElementStub, and
ElementsTransitionAndStoreStub (via CSA::EmitElementStore).
The change was not necessary in TurboFan, as
JSNativeContextSpecialization already performs the value conversion
before the boundscheck.
The result is some fixed test262 tests, and some new test coverage
for this behaviour in mjsunit.
BUG=v8:7896, v8:5327
R=neis@chromium.org, jkummerow@chromium.org, gsathya@chromium.org
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibe6bec24c72ef6a4fd3e77d5bcafa03737f4c5e3
Reviewed-on: https://chromium-review.googlesource.com/1117372
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54096}
Supporting postMessage from WebAssembly.Module requires implementing
some logic in the ValueSerializer and ValueDeserializer delegates. This
change implements some simple logic for d8.
This change also fixes a DCHECK that occurs when sending a shared
WebAssembly.Memory object to two Workers.
Bug: chromium:857049
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Idddb23a48175c7175967af3fbc03d8572452a069
Reviewed-on: https://chromium-review.googlesource.com/1117871
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54093}
We should only cancel asynchronous compilation jobs for the isolate
which is being recycled.
R=titzer@chromium.org
Bug: chromium:854755
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I31d6c3ccb648f5465e52f4bc47c4261894458e60
Reviewed-on: https://chromium-review.googlesource.com/1118378
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54092}
Another pair of {std::unique_ptr} and {size_t} that can be stored as
one {OwnedVector}, which allows to pass it as one thing.
R=mstarzinger@chromium.org
Bug: v8:7754
Change-Id: Ideac0dbd390ba8147b6620daa86f0d3da6c3b609
Reviewed-on: https://chromium-review.googlesource.com/1118236
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54091}
Instead of storing both the {NativeModule} and the {WasmModule} in a
{Managed} object, just store the {WasmModule} in the {NativeModule}
directly. This fixes crashes that happen if the {Managed<WasmModule>}
dies before the {Managed<NativeModule>}.
R=mstarzinger@chromium.org
Bug: chromium:854794, v8:7879, v8:7889
Change-Id: I6b11729943fe7a03d225138782655ee5dafd26a6
Reviewed-on: https://chromium-review.googlesource.com/1118171
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54090}
This CL adds the newline character as a valid character
in Torque strings.
You can now write Print('Hello, World!\n') in Torque and it works!
Change-Id: I2a1f87cfef492fedd3d24086e226d3ebaf882115
Reviewed-on: https://chromium-review.googlesource.com/1118229
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Théotime Grohens <theotime@google.com>
Cr-Commit-Position: refs/heads/master@{#54089}
When run locally, one times out and the other runs out of stack space.
R=sigurds@chromium.org
Change-Id: I7cc1aa9bb0857f12ac46baf80de18a2c5175b8b9
Reviewed-on: https://chromium-review.googlesource.com/1118231
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54087}
This CL removes the friendship between {NativeModule} and
{NativeModuleSerializer}/{NativeModuleDeserializer}.
Instead, it adds a new public method ({AddDeserializedCode}) which is
being called from the deserializer.
Drive-by: Unify the argument order to {AddCode}, {AddOwnedCode} and
{WasmCode}.
R=mstarzinger@chromium.org
Bug: chromium:856938
Change-Id: I88943c90c45650e21ae6bc17395a17f86319c046
Reviewed-on: https://chromium-review.googlesource.com/1117075
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54084}
This CL complements commit f2695f7363
for MIPS32. That commit addressed problem for MIPS64.
Original message:
>ArraySpliceTorque builtin triggers generation of MIPS specific
>trampolines due to its large size, and this code is not PIC
>and cannot be isolate independent.
>
>This CL is a workaround that marks ArraySpliceTorque as
>isolate dependent on MIPS64.
>
>Bug: v8:7882
>Change-Id: I0b5764236268c2529e149b275dcf382dab709682
>Reviewed-on: https://chromium-review.googlesource.com/1111847
>Commit-Queue: Jakob Gruber <jgruber@chromium.org>
>Reviewed-by: Michael Stanton <mvstanton@chromium.org>
>Reviewed-by: Jakob Gruber <jgruber@chromium.org>
>Cr-Commit-Position: refs/heads/master@{#53968}
Bug: v8:7882
Change-Id: Iffdfab673781cca1eb14d11428ffcf7a01c21f27
Reviewed-on: https://chromium-review.googlesource.com/1117186
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54083}
Merges DebugInfo field into the function_identifier field, storing the function
identifier in the DebugInfo. Also moves some debugging_hints bits to the SFI flags,
and others to the DebugInfo. Finally, changes the logic to store debugger patched
bytecode array on the SFI instead of the DebugInfo, simplifying the logic in the
InterpreterEntryTrampoline.
BUG=chromium:818642,chromium:783853
TBR=hpayer@chromium.org
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: If440080c0f08fac4fb96f5e18dcc0eb9b86d4821
Reviewed-on: https://chromium-review.googlesource.com/1115819
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54081}
This is a reland of 7a0d6a5000
Original change's description:
> [build] Disable slow asserts for v8_enable_fast_mksnapshot
>
> Slow asserts double the time spent in mksnapshot. While we want them
> enabled on our bot builds, local builds should be fast and don't
> necessarily need them.
>
> This also adds v8_enable_fast_mksnapshot as default in gm.py.
>
> Bug: v8:7891,v8:6688
> Change-Id: I5ab1491f3396c4351de30dbbb80a81e2242c5db9
> Reviewed-on: https://chromium-review.googlesource.com/1116552
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54074}
TBR=jkummerow@chromium.org
Bug: v8:7891, v8:6688
Change-Id: I3b1e80b3ca156b7d571ebc7f04e341f0ba716691
Reviewed-on: https://chromium-review.googlesource.com/1118139
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54080}
The multi-snapshot feature is only used on bots, where we need the
ability to execute tests with/without mitigations controllable through a
runtime flag.
This disables the flag by default and only enables it on bot configs.
Note: standard single-snapshot builds silently use the available
snapshot regardless of the value of --untrusted-code-mitigations.
Bug: v8:7891,v8:6688
Change-Id: I0d1a91e5c1c17b4d91b42d176b50ea44d2128d48
Reviewed-on: https://chromium-review.googlesource.com/1117687
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54079}
We pass the {WasmModule} by non-const pointer and by non-const
reference a lot. This violates the style guide, and adds the risk of
accidentally modifying it.
This CL makes the {WasmModule} const during compilation and
instantiation.
R=mstarzinger@chromium.org
Bug: v8:7754
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ie1878322828b63284b341d97da595e8e91dd4f51
Reviewed-on: https://chromium-review.googlesource.com/1117194
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54078}
This reverts commit 7a0d6a5000.
Reason for revert: Breaks no-slow-assert builds.
Original change's description:
> [build] Disable slow asserts for v8_enable_fast_mksnapshot
>
> Slow asserts double the time spent in mksnapshot. While we want them
> enabled on our bot builds, local builds should be fast and don't
> necessarily need them.
>
> This also adds v8_enable_fast_mksnapshot as default in gm.py.
>
> Bug: v8:7891,v8:6688
> Change-Id: I5ab1491f3396c4351de30dbbb80a81e2242c5db9
> Reviewed-on: https://chromium-review.googlesource.com/1116552
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54074}
TBR=jkummerow@chromium.org,jgruber@chromium.org
Change-Id: I6b048e819846c4bd9a064f82e2f3c7609369cd33
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7891, v8:6688
Reviewed-on: https://chromium-review.googlesource.com/1118138
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54077}
This loads the stack limit address from the instance object instead of
embedding it into the instruction stream. It is another piece towards
making the generated code independent of the Isolate.
R=clemensh@chromium.org
BUG=v8:7424
Change-Id: I9381956adf2d7c42f6626708229cfdd5c4ca114f
Reviewed-on: https://chromium-review.googlesource.com/1117189
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54076}
This reverts commit 9cd33e9eed.
Reason for revert: Didn't add value.
Original change's description:
> [build] Temporarily make ubsan bot use no snapshot
>
> Currently mksnapshot fails due to ubsan issues. With a nosnap build it
> will be easier to track down failures initially as normal test
> failures, since mksnapshot isn't called with the sanitizer
> environment variables.
>
> NOTRY=true
> TBR=jgruber@chromium.org
>
> Bug: v8:7860
> Change-Id: I897a8d307d90f545c80a90e1e1a2a632ffae1c3e
> Reviewed-on: https://chromium-review.googlesource.com/1116783
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54051}
TBR=machenbach@chromium.org,jgruber@chromium.org
Change-Id: I31e06fafb845c07bbaeb7a104d130f923d3be062
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7860
Reviewed-on: https://chromium-review.googlesource.com/1118039
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54075}
Slow asserts double the time spent in mksnapshot. While we want them
enabled on our bot builds, local builds should be fast and don't
necessarily need them.
This also adds v8_enable_fast_mksnapshot as default in gm.py.
Bug: v8:7891,v8:6688
Change-Id: I5ab1491f3396c4351de30dbbb80a81e2242c5db9
Reviewed-on: https://chromium-review.googlesource.com/1116552
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54074}
This reverts commit fdf69d53b6.
Reason for revert: Speculative revert for broken GPU bots:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/Linux%20V8%20FYI%20Release%20%28NVIDIA%29/1638https://ci.chromium.org/p/v8/builders/luci.v8.ci/Mac%20V8%20FYI%20Release%20%28Intel%29/1624
Original change's description:
> [heap] Adds a young generation large object space
>
> This CL adds the young generation lage object spaces and a flag
> --young-generation-large-objects that by default allocates all
> large objects in this space. This is a preparation CL. The space
> is not fully functional.
>
> Bug: chromium:852420
> Change-Id: Ib66d26fa52cda89bf04787084826aeb84b6ec1ac
> Reviewed-on: https://chromium-review.googlesource.com/1099164
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54056}
TBR=ulan@chromium.org,yangguo@chromium.org,hpayer@chromium.org
Change-Id: I175514f806a19c7837022795210625ca40e3c318
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/1118038
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54072}
This is required for jumbo builds to work before the stable jumbo chunk
algorithm[*] can reland.
[*] https://chromium-review.googlesource.com/c/chromium/src/+/1102218
Bug: chromium:856964, chromium:782863
Change-Id: Ibbe0994980eb554acd4e1557e733d07526a90608
Reviewed-on: https://chromium-review.googlesource.com/1117059
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Mostyn Bramley-Moore <mostynb@vewd.com>
Cr-Commit-Position: refs/heads/master@{#54070}
The name itself does not make sense any more since the {NativeModule} is
shared across instances. It is also only used for debugging, so remove
it, and replace it by the address of the {NativeModule} itself in debug
output.
R=mstarzinger@chromium.org
Bug: v8:7754
Change-Id: I02f9252981b776934811a904287be31c7076e90b
Reviewed-on: https://chromium-review.googlesource.com/1114965
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54064}
The motivation for this CL were the expensive UnhandledIsSorted() checks,
which increase mksnapshot time (v8:7895).
In addition, it is a cleanup and removes a potential for quadratic
performance.
Change-Id: I33e734e4e20183768dbf8222adcbb3abc1f1a6bf
Reviewed-on: https://chromium-review.googlesource.com/1116960
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54063}
