Commit Graph

63632 Commits

Author SHA1 Message Date
Santiago Aboy Solanes
29f1ad2835 [cctest][turboprop] Disable DisasmPoisonMonomorphicLoadFloat64 for arm
Due to dynamic map checks we generate different code and the pattern
fails. As a note, the other tests have already been disabled for
TurboProp.

Bug: v8:9684, v8:9820
Change-Id: Ib8be11ae10bc801116d6a17d1c6b08d8026287b3
Fixes: v8:9820
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2328784
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69140}
2020-07-30 10:41:36 +00:00
Ross McIlroy
88f3e03161 [TurboProp] Add support for Phis to fast reg alloc.
Adds support for Phis to be allocated to the fast register
allocator. Registers used for Phis are marked specially between
the point where the Phi is defined, and the gap-move's in the
predecessor blocks which populate the Phi value, since if the
Phi is spilled then all predecessor blocks must also spill the
Phi even if they were already allocated.

BUG=v8:9684

Change-Id: Iebe90495b83df655d3335a7d55874123f3b27f8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299366
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69139}
2020-07-30 10:36:46 +00:00
Dominik Inführ
3c6d9aac45 [handles] Add PersistentHandlesScope
PersistentHandlesScope works similar to the DeferredHandleScope, but
returns PersistentHandles instead of DeferredHandles on Detach().

Since PersistentHandlesScope takes over filled blocks from the
main thread local handle, remove the block_size_ field and use
kHandleBlockSize instead. This way all blocks have exactly the same size.

Bug: v8:10315
Change-Id: I295cad6f84852f87c55d95572905069443f5698c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324254
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69138}
2020-07-30 10:30:26 +00:00
Santiago Aboy Solanes
7bf85afc02 [compiler] Add the DecompressionOptimization phase to TurboProp
The DecompressionOptimizationPhase performs MachineRepresentation
changes in the nodes, which causes the node's instruction selection
to avoid decompression.

It is safe to run after we already have a schedule since it does not
drop any nodes.

Bug: v8:9684, v8:7703
Change-Id: I636ae80fa82d0c78878756e9f39e7a14c02803b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324252
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69137}
2020-07-30 09:01:08 +00:00
Z Nguyen-Huu
b975187e63 Add micro-benchmark for toString(16)
Bug: v8:10477
Change-Id: I0ce6cd46d3886a37e96bdd62df263addc5b9631f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2327186
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69136}
2020-07-30 07:15:32 +00:00
Milad Farazmand
226a48196f PPC: [wasm-simd] Allow simd load/store on unaligned addresses
lvx and stvx require 16-byte aligned addresses.
This CL enables loading and storing to addresses which are not
16-byte aligned.

Change-Id: I5635e857a979520822c8b30bb5477a159e97e6e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2327648
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69135}
2020-07-29 22:11:41 +00:00
Bill Budge
80396fd3e5 Revert "[api] Add a SharedArrayBuffersEnabled callback."
This reverts commit 76b53b66b0.

Reason for revert: Can't be used easily in embedder (Chromium).

Original change's description:
> [api] Add a SharedArrayBuffersEnabled callback.
> 
> - Adds a SharedArrayBuffersEnabled callback and uses it to
>   enable/disable SABs per context. The feature flag is used
>   if no callback is registered.
> 
> Bug: chromium:923807
> Change-Id: I4d3472fcd79b158cb50dc98793aece6dbbb81d93
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316901
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69057}

TBR=bbudge@chromium.org,adamk@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:923807
Change-Id: I6e3ddfa9cd64ba3106b4a75ea7a5185f873facc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2326952
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69134}
2020-07-29 18:47:17 +00:00
Daniel Clifford
b09b838bbb Augment jump threading to handle redundant returns
Although the code generator already combines return instructions late
in the pipeline into a common site, there were still superfluous jumps
to that common site left in the code.

Change-Id: I06c885fb0ab6a2c078f9dabdc6616c6881f42c75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2284984
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69133}
2020-07-29 18:36:07 +00:00
Georg Neis
db2d98cda8 Introduce --trace-flush-bytecode
This prints a message whenever we discard compiled metadata of an SFI.
The message identifies the SFI. I've found this helpful when debugging.

Change-Id: Ib34266199ade2ef88a6bafe32295ab505ce7c899
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324260
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69132}
2020-07-29 16:39:33 +00:00
Nico Hartmann
18350fc295 [cctest] Disable failing test
Temporarily disable cctest DisasmPoisonMonomorphicLoadFloat64.

Bug: v8:9820
Change-Id: I3208a7f85aa7ab2c09602107b2f0954f02b15a45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2326332
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69131}
2020-07-29 16:13:23 +00:00
Georg Neis
e31678dfc3 [compiler,x64] Be more permissive in CanBeMemoryOperand
I noticed that, with pointer-compression enabled, in map checks we no
longer load the map as part of the cmp instruction:

movl rcx,[rdx-0x1]
movl rdi,0x8286f8d  ;; (compressed) object: <Map(HOLEY_ELEMENTS)>
cmpl rdi,rcx

This CL restores that:

movl rcx,0x82c6f8d  ;; (compressed) object: <Map(HOLEY_ELEMENTS)>
cmpl [rdx-0x1],rcx

Change-Id: Ifcc7f34fddf6aa423c0a26066ac124e9757cb9ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320653
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69130}
2020-07-29 15:18:03 +00:00
Georg Neis
49749bb976 [turbofan] Fix a lazy deopt bug in Array.prototype.map
The bug was that the allocation of the result array (before the loop)
was using the outer frame state, thus returning the allocation's result
(an array full of holes) as the return value of the map operation in
case the allocation triggers a lazy deopt.

Bug: chromium:1104514
Change-Id: I9a6db8a5860472e1b438b6b54414938d61e166c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324249
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69129}
2020-07-29 14:39:23 +00:00
Mythri A
989a90400d [turboprop] Enable DynamicMapChecks for TurboProp
Bug: v8:10582, v8:9684
Change-Id: Ib29e9b56d4c722cb572e86def7eeb3f588dc9c2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316079
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69128}
2020-07-29 13:36:53 +00:00
Leszek Swirski
fc0cbc1445 [runtime] Don't add slack capacity to StringTable shrink
Since we now add the additional required capacity when assessing
StringTable shrinking during LookupKey-caused string insertion, we no
longer have to add a slack capacity. This more closely matches previous
behaviour, which didn't consider the additional required capacity but
did add slack (which, because of rounding to the next power of two,
amounts to the same thing).

Bug: chromium:1108258
Change-Id: I81f513fdc800a2caab76e030c0c5e767cd1360d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324253
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69127}
2020-07-29 12:41:43 +00:00
Santiago Aboy Solanes
a6e93ab550 [compiler] Test background thread accessing old TransitionArray
If we don't have slack and we want to add an element to the
TransitionArray, we would create a new TransitionArray. The background
hread, however, can be holding a pointer to the old transitions. This
test tests that this is safe to do, i.e the background thread reading
the old TransitionArray.

To make sure that we are testing that, we can add more synchronization
via an extra semaphore.

Bug: v8:7790
Change-Id: Ie454d79282ac267d3527269e8490baced979aa45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323351
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69126}
2020-07-29 12:39:53 +00:00
Zeynep Cankara
f7273dd32c [tools][system-analyzer] Use private class fields
This CL aims to clean dead code across the app
and use private class fields for storing private
information.

Bug: v8:10644, v8:10735

Change-Id: I1129104925f230bed922cc76abdb432d536d2111
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323352
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Cr-Commit-Position: refs/heads/master@{#69125}
2020-07-29 12:25:03 +00:00
Jakob Gruber
980e224a81 [nci] Update interrupt budget from NCI code
This is the first step towards implementing a tier-up mechanism from
NCI code to TF. We will follow the existing Ignition-to-Turbofan
mechanics, which are, roughly:

1. Track a bytecode interrupt budget.
2. When exhausted, call the runtime profiler, which increments
   profiler ticks for the top frame's function.
3. When a function should tier up, it is marked as such using the
   FeedbackVector::optimized_code_weak_or_smi slot / the
   OptimizationMarker mechanism.
4. The InterpreterEntryTrampoline checks this slot and calls into
   runtime to compile if needed.
5. The finished code is also placed into this slot, as well as
   installed on the JSFunction.
6. Again, the IET checks the slot and tail-calls the code object if it
   exists.

This CL implements step 1 for NCI code by inserting the new simplified
UpdateInterruptBudget operator at the same spots (and using the same
offsets) as Ignition. When the budget is exhausted, we call a runtime
function that currently does nothing and will be implemented in the
next CL.

Bug: v8:8888
Change-Id: I98c0f8d96f32d515218dc2a76f961d44fe281c86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2312778
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69124}
2020-07-29 12:08:43 +00:00
Anton Bikineev
4f0b79eeda cppgc: mirror: Add copybara and migration scripts
The CL add two files:
1) copy.bara.sky - source file for copybara that needs to migrate cppgc
from v8 repo to GitHub;
2) export_to_github.sh - top level bash script that runs copybara and
generates CMake files if needed.

Bug: v8:10724
Change-Id: I6a5f0ed1d007533914d578203a37fab2c3e9774a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320651
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69123}
2020-07-29 11:53:33 +00:00
Victor Gomes
73dc8faed2 [compiler] Fix ArgumentsLength confusing semantics in EscapeAnalysisReducer
Change-Id: I41be2c5b0867739dbbe3667144bf6b479c609e53
Bug: chromium:1107221
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2322628
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69122}
2020-07-29 11:07:38 +00:00
Dominik Inführ
e5281ef477 [handle] Zap local and persistent handles
Zap freed local and persistent handles similar to main thread handles.
As a drive-by change, fix the creation of local handles without
LocalHandleScope.

Bug: v8:10315
Change-Id: Ia71bc5419c62ae073928751f57fc221ea11de254
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323362
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69121}
2020-07-29 11:06:33 +00:00
Santiago Aboy Solanes
328fb7f475 [csa][cleanup] Remove ParameterMode from ExtractFixedArray
Drive-by:
 * Updated nullptr to using base::Optional.
 * Remove ParameterMode use in CloneFixedArray.

Bug: v8:9708, v8:6949
Change-Id: I0a98ded0a5d25df078cccbba1385d177652d1cf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324242
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69120}
2020-07-29 10:49:33 +00:00
Santiago Aboy Solanes
1c8864cc85 [csa][cleanup] Remove ParameterMode from filling array methods
Remove from:
    * FillPropertyArrayWithUndefined
    * CopyPropertyArrayValues

Bug: v8:9708, v8:6949
Change-Id: I536df1dbcff9b29746ab561d2fd563e16ef9be76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324241
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69119}
2020-07-29 10:47:13 +00:00
Anton Bikineev
a0dfda884a cppgc: Fix gcc warning in sweeper-unittest.cc
Bug: v8:10724
Change-Id: I3f8c316818d4ec048143dc731b11808652612925
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324248
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69118}
2020-07-29 09:43:53 +00:00
Zhao Jiazhong
7d0fcda3a2 [mips][wasm] Add a generic js-to-wasm wrapper
Port 1250fd59aa
https://crrev.com/c/2307240

Original Commit Message:

  This generic wrapper builtin is currently used only when the wasm
  function has no parameters and no return value.

  Added a new V8 flag to use this generic wrapper.

  Also added a JS test function for this generic wrapper.

Change-Id: I2c515e095730ba3880b639bdd85504e644b64e53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2325258
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#69117}
2020-07-29 07:52:11 +00:00
Dominik Inführ
750e969931 [heap] Move LocalHeap::IsSafepointRequested into header
This will allow inlining of this function.

Bug: v8:10315
Change-Id: I6b9db641b00e215cf58b82a9a9a5cf9e676f3f02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323354
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69116}
2020-07-28 19:00:19 +00:00
Mythri A
c7643fe485 [Turboprop] Add tests for dynamic check maps operator
This cl also
1. Fixes a bug in effect-control-linearizer where we should have
converted fixed array length from Smi to integer
2. Also prints deopt location for the new "bailout" deopt type on
--trace-deopt.

Bug: v8:10582, v8:9684
Change-Id: Iafc5e8abbca5252a8783a5a1184a1667a7f708a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297460
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69115}
2020-07-28 17:28:32 +00:00
Dominik Inführ
2a4fec6194 [heap] Ensure that allocation happens on the right thread
LocalHeap should only be used on the heap it was created on.

Bug: v8:10315
Change-Id: Ia06f0169d39b4148b356568795f4e316361a1e9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323358
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69114}
2020-07-28 17:19:51 +00:00
Thibaud Michaud
12c60417cb [wasm][interpreter] Add missing WasmCodeRefScope
R=clemensb@chromium.org

Change-Id: I3cedc8d27c9a597cd2e6013d3be479db513a0a3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323356
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69113}
2020-07-28 16:54:31 +00:00
Mythri A
2f42dd8c6a [turboprop] Optimize minimorphic accesses using dynamic map checks
1. Adds a flag to specify if minimorphic accesses should be optimized
using dynamic map checks operators. This flag is disabled by default.
2. Builds the PropertyAccessInfo from handlers instead of reading it
from maps for minimorphic accesses
3. Uses DynamicMapChecks operator to lower the minimorphic accesses.

Bug: v8:10582, v8:9684
Change-Id: I0b7b26b876f9ad12d6fc38788137b66ee6455aeb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241524
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69112}
2020-07-28 16:37:01 +00:00
Thibaud Michaud
406b99c4d4 [wasm] Add indirect calls to compile fuzzer
Setup the function table exactly like the module's function table, so
that we can share most of the call generation logic.

R=clemensb@chromium.org

Bug: v8:10751
Change-Id: Ie74150af8cf79d00adcc59d6880d2ed3e7cf78f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323353
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69111}
2020-07-28 16:07:37 +00:00
Paolo Severini
e6414f6e24 [wasm] Faster wasm-to-js calls with arguments mismatch
Currently WebAssembly always goes through the ArgumentsAdaptorTrampoline
builtin for wasm-to-js calls as soon as there's a mismatch between the
actual number of arguments and the expected number of arguments.

This can be made faster in cases where:
1. the callee has "don't adapt arguments" set, which is often the case
for builtins, or
2. the callee has "skip adapt arguments" set, which is often the case
for strict mode functions.

TurboFan already supports this for JS calls:
https://chromium-review.googlesource.com/c/1482735;
explainer document:
http://bit.ly/v8-faster-calls-with-arguments-mismatch.

Even though it is probably not as common to have arity mismatches in
Wasm->JS calls as it is in JS->JS calls, this still seems a worthwhile
optimization to do.

This CL ports the TurboFan fix to WebAssembly. In particular, the CL
introduces a new WasmImportCallKind (kJSFunctionArityMismatchSkipAdaptor)
for the case where the call to  Builtins_ArgumentsAdaptorTrampoline
can be skipped, and modifies WasmImportWrapperCache::CacheKey to also
consider the arity of the imported JS function.

A micro-benchmark for this change can be found here:
- https://gist.github.com/paolosevMSFT/72c67591170d6163f67c9b03a7e12525#file-adapter-cc
- https://gist.github.com/paolosevMSFT/72c67591170d6163f67c9b03a7e12525#file-adapter_test-js

With this benchmark, we can save a 40% overhead of
Builtins_ArgumentsAdaptorTrampoline for calls that pass too many
arguments, while the savings for calls that pass too few arguments are
less impressive:

                            Before     After
callProperApplication:      563 ms     566 ms
callOverApplication1:       972 ms     562 ms
callOverApplication2:       962 ms     562 ms
callUnderApplication:       949 ms     890 ms


Bug: v8:8909
Change-Id: Id51764e7c422d00ecc4a48704323e11bdca9377f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2317061
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69110}
2020-07-28 15:53:21 +00:00
Santiago Aboy Solanes
97088422ea [compiler][heap] Add safepointing to TickCounter's tick method
This gives the GC a location where it can interrupt background
compilation.

Bug: v8:7790
Change-Id: I8cf40e9c9b69c00fdfd5d59ed87e83137e481fb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2310366
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69109}
2020-07-28 15:29:36 +00:00
Ross McIlroy
e9a37bf884 [TurboProp] Add reference map population to fast reg alloc.
Adds support for populating reference maps to the fast
register allocator. In order to calculate whether a stack slot
is live at a given instruction, we use the dominator tree to
build a bitmap of blocks which are dominated by each block.
A variable's spill operand is classed as alive for any blocks that are
dominated by the block it was defined in, until the instruction index
of the spill operand's last use. As such, it may be classified as live
down a branch where the spill operand is never used, however it is safe
since the spill slot won't be re-allocated until after it's last-use
instruction index in any case.

BUG=v8:9684

Change-Id: I772374599ef916f57d82d468f66429e32c712ddf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2298008
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69108}
2020-07-28 15:28:31 +00:00
Ross McIlroy
5b0c6cde37 [TurboProp] Add support for spill slot allocation to fast reg alloc
Adds support for tracking the instruction range of spilled operands,
and then allocating spill slots to these ranges. It also adds some
unittests covering spill slot allocation.

Spill slots are allocated in a linear fashion, running through the
instruction stream in a linear order, ensuring that no spill operand
is allocated to a same spill slot that is already assigned to during
this whole start / end range. This isn’t optimal, since it doesn’t
take into account holes in these ranges (e.g, blocks between start
and end that aren’t dominated by the start), but in practice rarely
leads to more than one extra spill slot being allocated compared to
the current allocator.

BUG=v8:9684

Change-Id: Iedee7bcf552080e5b4b6a2f4e96b78b6c1396cab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297470
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69107}
2020-07-28 14:30:51 +00:00
Georg Neis
6ef0ec94a2 [turbofan] Do more checks for dead nodes in BranchElimination
Bug: chromium:1109174
Change-Id: I25924afe9ad9c147e7f89299983032c82f74626d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320668
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69106}
2020-07-28 14:27:31 +00:00
Jakob Kummerow
a3f959b005 [tools] Add scripts for compile_commands.json and VSCode
This adds two convenience scripts:
- update-vscode.sh downloads/updates Visual Studio Code
- update-compile-commands.py prepares for code indexers like clangd
  by creating compile_commands.json (for all architectures), updating
  generated sources, and compiling the Torque Language Server.

No-try: true
Change-Id: I64a15dc298f4312a9b296762593234c40f542b06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2317355
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69105}
2020-07-28 14:26:26 +00:00
Igor Sheludko
446a827d5d [zone-stats] Track zone memory freed by container reallocations
Also use outer-function name as a ZONE_NAME instead of file:line
and give explicit names to parser and preparser zones.

Bug: v8:10572
Change-Id: I9b5acb23322889d8538a34bc888fd6f610eb6893
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2322627
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69104}
2020-07-28 14:25:21 +00:00
Milad Farazmand
02ad36a700 PPC/s390: [wasm] Add a generic js-to-wasm wrapper
Port 1250fd59aa

Original Commit Message:

    This generic wrapper builtin is currently used only when the wasm
    function has no parameters and no return value.

    Added a new V8 flag to use this generic wrapper.

    Also added a JS test function for this generic wrapper.

R=evih@google.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ib1f14081779adaf3668c4936ba6afde0a782ce0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323310
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69103}
2020-07-28 14:09:51 +00:00
Zeynep Cankara
ff4833f14c [tools][system-analyzer] Create timeline track component
This CL creates a timeline track component to
make the timeline view extensible as different
data sources added. The timeline track component will
take data source and display it with respect to time
axis of timeline overview.

Bug: v8:10644, v8:10735

Change-Id: I1c88dd2dc967be68e6235e517dcf8554a891eee4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2302053
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69102}
2020-07-28 13:54:51 +00:00
Dominik Inführ
385382097a [heap] Fix overflow in ComputeLimit on 32-bit
On 32-bit systems the calculation could overflow, leading to an illegal
limit of the LAB. Cast to uint64_t to avoid this. Add DCHECKs to
catch this earlier.

Bug: chromium:1110214, v8:10315
Change-Id: I73679a2daeb3b83bb303d411c77782a2172e98cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320654
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69101}
2020-07-28 13:44:31 +00:00
Milad Farazmand
3ae4a987b4 PPC/s390: [turbofan][wasm] Improved float32 to int32.
Port 51b53dd3ee

R=rstz@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ic2ee6e75afd5da8bb7f35dfde4b1d85231f1cf4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2318045
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69100}
2020-07-28 13:32:51 +00:00
Santiago Aboy Solanes
94cf4347e4 [compiler] Test transition from Uninitialized to kFullTransitionArray
Since we have an uninitialized TransitionArray that we want to insert
an element (map1), we can't guarantee that said element would exist at
the point of the search. Then, we search for an element guaranteed not
to be (map2) and we check that we did not find it.

If we have a data race, this would also trigger it.

Bug: v8:7790
Change-Id: Ib90044d7c0901d599aed041f608f2c0bce506d67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2319995
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69099}
2020-07-28 13:03:31 +00:00
Emanuel Ziegler
367da30543 [ukm] Add framework for collecting event-based metrics
Add a framework for collecting event-based metrics like UKMs in V8
that is independent of the actual implementation.

Design doc: https://docs.google.com/document/d/1vCZQCh4B05isqwJOwTPv7WqcnVp4KJITMgsHSBg35ZI/

R=ulan@chromium.org

Bug: chromium:1101749
Change-Id: If3a5b954d1f0bcee4e06a03467b651feae378a5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288231
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69098}
2020-07-28 12:09:21 +00:00
evih
1250fd59aa [wasm] Add a generic js-to-wasm wrapper
This generic wrapper builtin is currently used only when the wasm
function has no parameters and no return value.

Added a new V8 flag to use this generic wrapper.

Also added a JS test function for this generic wrapper.

Bug: v8:10701
Change-Id: Id8cd1771f26922927363b715d8a6ffd384a143ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307240
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69097}
2020-07-28 10:20:31 +00:00
Marja Hölttä
f97620b924 [Atomics.waitAsync] Follow-up: move code to .cc
As a downside, class-level static variables of FutexEmulation
now have to be local to the .cc file.

Bug: v8:10239
Change-Id: I3d00c65289f346cf2b16fea657f47bff69863b0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2319989
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69096}
2020-07-28 10:11:01 +00:00
Thibaud Michaud
c105b841d0 [wasm] Enable return calls in compile fuzzer
R=clemensb@chromium.org

Bug: chromium:1110190
Change-Id: I75c8e47d738266927d717a09670473dc8a7eb210
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320656
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69095}
2020-07-28 10:09:31 +00:00
Anton Bikineev
d9d37e5540 cppgc: mirror: Support cmake targets for tests and sample
Bug: v8:10724
Change-Id: Ia0b6d6d25e6b9d7b44b4dfa94705e9cd5103cc8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316303
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69094}
2020-07-28 10:00:41 +00:00
Zeynep Cankara
721dac7d32 [tools][system-analyzer] Add light theme
This CL use the introduce color variables
to adapt light theme feature to increase
accessibility.

Bug: v8:10644

Change-Id: I179831aef384527b0457c6ae93fa4d42a1814834
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2305891
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69093}
2020-07-28 09:43:11 +00:00
Leszek Swirski
1a80619843 [offthread] Fix flakiness with bg compile stress
If we're close to a stack overflow when starting a script compile, we
may get into a state where main-thread compilation would stack overflow,
but background-thread compilation wouldn't. This triggers a failure of a
CHECK under --stress-background-compile, but isn't actually an
interesting failure.

So, we loosen this CHECK to allow the main-thread having a stack
overflow (strictly speaking, a RangeError) to count as a "success" for
the purposes of comparing against a background compilation success.

Bug: v8:10757
Change-Id: I7d687b52d178973b421c42ca0d89b4da0357232a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320649
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69092}
2020-07-28 09:25:01 +00:00
Jakob Gruber
67cdacd941 Remove the js-function-inl.h inline header
As an experiment to see how performance is impacted when changing
inline definitions to normal definitions in a .cc file, this CL moves
js-function-inl.h to js-function.cc.

Bug: v8:10749
Change-Id: I97c3a0b7d20217f444c6891442bbe3c34f3b0cc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2315993
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69091}
2020-07-28 08:40:41 +00:00