Commit Graph

24938 Commits

Author SHA1 Message Date
Jakob Gruber
6817e07428 [snapshot] Properly deserialize JSGlobalProxy.map references
Upon deserialization, serialized references to the global proxy are
replaced by the actual global proxy object. We must do the same for
the global proxy map.

Drive-by: Updated other outdated test skips.

Bug: v8:10504,v8:10416
Change-Id: Ib47ae2d08bbea2ca916f53152e9d4f75bb0a0e15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183913
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67596}
2020-05-06 11:05:01 +00:00
Ross McIlroy
66e1c84d77 [TurboProp] Fully remove successors from schedule on unreachable.
Fully remove the successor blocks when effect-control-linearization
reaches an unreachable node and is maintaining the schedule. Previously
we just updated the current_block_'s successor and removed any
unreachable predecessors from end, however if the current_block_ is not
an original block in the schedule, but a new one added due to control
flow from effect control linearization lowering, the removed successor
blocks could still be re-connected to the end block when they were
lowered. Instead, entirely remove these unreachable blocks from the
predecessor / successor chains, and have the effect-control-linearizer
avoid lowering these blocks entirely.

BUG=chromium:1076569,v8:9684

Change-Id: I4b4216019d55aef5363d88255726b85df8e7ada5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179842
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67595}
2020-05-06 10:55:30 +00:00
Andreas Haas
90fa771dc3 [wasm][liftoff][arm] Implement CompareExchange
This CL implements all variants of CompareExchange on arm.

Implementing 64-bit CompareExchange on arm requires a lot of registers,
with the additional constraint that the low-word register of new_value
and result have to have an even register code, and that the corresponding
high-word registers have a register code that is by one higher than the
register code of the low-word register.

This register allocation is achieved by assigning fixed registers to
all values.

R=clemensb@chromium.org, v8-arm-ports@googlegroups.com

Bug: v8:10108
Change-Id: I2edfde15e80db0d45621a461793018d88e997431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172791
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67592}
2020-05-06 10:11:49 +00:00
Tobias Tebbi
a3e97c41ff [torque] improve formatting of try-label
Bug: v8:10421, v8:7793
Change-Id: If11fc7666f04ed0914f5fdfcdaa87acb8655d956
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169100
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67591}
2020-05-06 09:51:39 +00:00
Jakob Gruber
3c422d1c5e [snapshot] Clear reconstructable data prior to d8 stress_snapshot run
The serializer currently cannot handle a heap state containing
arbitrary compiled Code objects. As a quick fix for the
--stress-snapshot d8 flag, we clear compiled data from the isolate
prior to the serialize-deserialize-verify pass.

With this change, mjsunit tests pass on x64.

The %SerializeDeserializeNow() runtime function would require more
work, since it is not possible to mutate the heap to this extent while
still preserving a runnable host context and isolate. We will need
another solution there.

Drive-by: Skip the stress_snapshot variant except for the mjsunit
suite.

Tbr: machenbach@chromium.org
Bug: v8:10493,v8:10416
Change-Id: Ie110da8b51613fcd69c7f391d3cf8589d6b04dd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182429
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67585}
2020-05-06 07:11:22 +00:00
Jakob Gruber
e7e10aa70c [snapshot] Sanitize isolate during serialization
The isolate snapshot must not contain context-dependent objects, thus
root visitation must not reach context-dependent objects. This CL
sanitizes the isolate around serialization by clearing & later
restoring two lists: 1. feedback vectors for profiling tools, 2.
detached contexts.

Drive-by: Set an array buffer allocator for
SerializeDeserializeAndVerify.
Drive-by: Allow serialization of *another* native context when
serializing a native context.

Bug: v8:10416,v8:10493
Change-Id: I1c49bda364eccd6d44f9499a9926f4bcd31f665d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179008
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67584}
2020-05-06 06:22:39 +00:00
Ng Zhi An
833b113ce9 [wasm-simd][fuzzer] Add more f64x2 ops to fuzzer
Bug: v8:10180
Change-Id: I8026a25d9b1a62a7c5d7b20b99f6474374333445
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2171551
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67582}
2020-05-05 23:00:30 +00:00
Anton Bikineev
d5e0e5cb21 cppgc: Introduce Sweeper
This ports sweeper logic from Blink into a separate entity - Sweeper.
Concurrent sweeping is in a followup.

Bug: chromium:1056170
Change-Id: I41196225f0d882cb0ab5190d23e297ee2498df6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167858
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67581}
2020-05-05 22:38:59 +00:00
Seth Brenith
23719f6dbe [torque] Don't crash when failing to find a non-constexpr type
Marja pointed out that the following code causes a Torque crash:

Convert<Smi>(MessageTemplate::kFoo)

This change is a small fix to not crash in that case.

Bug: v8:7793, v8:10475
Change-Id: I7856366856a4cd7facdb19686a2d4c92b0d04516
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182175
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#67580}
2020-05-05 22:32:48 +00:00
Deepti Gandluri
dd1b1de11f Revert "[compiler,api] Pass non-strings to the modifying callback when unconditional codegen is on."
This reverts commit 0c9a0072db.

Reason for revert: Breaks tests on the blink bots, will block roll.
https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux/4465

Original change's description:
> [compiler,api] Pass non-strings to the modifying callback when unconditional codegen is on.
> 
> In the current state, when unconditional compilation is on, strings are evaluated and other objects are passed through unchanged. After this, non-strings are passed to the modifying callback which could unwrap and eval them. eval(string) is not affected.
> 
> If a non-modifying callback is set, it still takes the precedence, and the non-string object is returned as it would be currently (line 1933).
> 
> Change-Id: I835b976b3420635baba245c08f8563a9e5b3b246
> Bug: chromium:1024786
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917147
> Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67570}

TBR=vogelheim@chromium.org,mvstanton@chromium.org,ssanfilippo@chromium.org,verwaest@chromium.org

Change-Id: I75637347e92e805361f954be3515f84ca55d756b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1024786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182178
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67577}
2020-05-05 20:17:24 +00:00
Clemens Backes
e337fc687a [platform] Remove DefaultPlatform::SetThreadPoolSize
This function is always called right after creating the DefaultPlatform,
hence merge it into the constructor.

R=mlippautz@chromium.org

Change-Id: I4afb14c83740224056157665db6b854c659da0c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182635
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67573}
2020-05-05 17:57:49 +00:00
Philip Pfaffe
37cdcdf421 Support .external_debug_info symbol references
Wasm modules generated by emscripten today have two ways to point to
debug symbol files, the source mapping url and external debug info
custom sections. To support both, this CL extends CDP to appropriately
report the symbol type and location.

Bug: chromium:1064248
Change-Id: I9076034f6d73901d8a9c5cfd7c2988fb30bb14c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2116208
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67571}
2020-05-05 16:45:49 +00:00
Stefano Sanfilippo
0c9a0072db [compiler,api] Pass non-strings to the modifying callback when unconditional codegen is on.
In the current state, when unconditional compilation is on, strings are evaluated and other objects are passed through unchanged. After this, non-strings are passed to the modifying callback which could unwrap and eval them. eval(string) is not affected.

If a non-modifying callback is set, it still takes the precedence, and the non-string object is returned as it would be currently (line 1933).

Change-Id: I835b976b3420635baba245c08f8563a9e5b3b246
Bug: chromium:1024786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917147
Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67570}
2020-05-05 16:27:29 +00:00
Philip Pfaffe
abad484607 [wasm-debug-eval] expose wasm debug eval on the inspector protocol
Allow the DevTools frontend to evaluate variables in a wasm frame context by
reusing the existing Debugger expression evaluation API. Where previously the
API expected JavaScript expressions, which would in general just fail, now the
expression is expected to be base64 encoded Wasm that creates a JSON string in
linear memory.

Bug: chromium:1020120 chromium:1068571
Change-Id: I4b31fdb9d3b21b4e08c4995ec2f07880923959e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2087396
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67568}
2020-05-05 15:50:39 +00:00
Manos Koukoutos
1ba5766f5e [wasm][gc] Implement struct.set and switch struct.get to optref
Work towards adding heap-allocated object support for wasm, according to
the gc proposal.

Changes:
- Implement subtyping for reference types (ref s) and (optref s),
  where 's' is a struct type.
  This CL does *not* implement subtyping between struct and function
  types. Also, it does not handle i31refs and eqrefs.
- Implement struct.set.
- Change struct.get to accept an optref as argument, as required by the
  standard.
- Allow locals to store objects of ref and optref types.
- Add a test for struct.set and optref locals. Modify the test for
  struct.get accordingly.

Reference: https://github.com/WebAssembly/gc

R=jkummerow@chromium.org
R=clemensb@chromium.org

Bug: v8:7748
Change-Id: I708626fa5f90a6e24e667d66eed1c7697f458a23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172089
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67562}
2020-05-05 12:57:42 +00:00
Clemens Backes
61c2a0f4ba [wasm] Remove interpreter entry code
This removes the interpreter entry stubs, which are used to redirect
specific wasm functions to the interpreter. It is only needed when
mixing JS code with interpreted Wasm code, otherwise the test functions
just call the interpreter directly.
Thus a lot of tests that contain such interaction between JS and Wasm
need to be restricted to execute in Liftoff and TurboFan only.

After this CL, the WASM_INTERPRETER_ENTRY frame type and the
corresponding WasmInterpreterEntryFrame are dead, and will be removed in
a follow-up CL.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: I8e50d350dbc2afcc1cddaeb98baf23711117af2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172962
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67559}
2020-05-05 11:18:05 +00:00
Samuel Groß
843c8de823 [sandbox] Access microtask queue in NativeContext via bottlenecks
Bug: v8:10391
Change-Id: I29393ebcb58b1000040d7f7ba205895a8ba363f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148782
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67558}
2020-05-05 09:11:14 +00:00
Michael Lippautz
69110a7758 cppgc: Add PostConstructionCallbackTrait
This adds PostConstructionCallbackTrait which can be used to get a
callback that is executed right after an object instance is created.
This can be useful for hooks that require to be able to call into
virtual methods.

Bug: chromium:1074061
Change-Id: Idd5ef677fed291bcba81b9a47f2932c9bb5832b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179385
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67557}
2020-05-05 07:59:12 +00:00
Andreas Haas
849b2239e8 [wasm][arm] Correctly handle AtomicExchange without used outputs
The existing implementation needed uses of the outputs of an
AtomicExchange to allocate registers for the result value. However,
these uses are not guaranteed to exist. With this CL temp registers
get allocated if the uses don't exist.

R=gdeepti@chromium.org

Bug: chromium:1077130
Change-Id: I058ee53b87c6e995c9f490f3aebbfdba69934f3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179503
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67556}
2020-05-05 06:50:57 +00:00
Shu-yu Guo
701b317161 Make %GetUndetectable()'s [[Call]] return null
%GetUndetectable() is used for testing document.all's wacky "emulates
undefined" behavior both in mjsunit tests and in test262. mjsunit
doesn't rely its [[Call]] behavior, while test262 relies on its [[Call]]
returning null [1]. So, make it return null.

[1] https://github.com/tc39/test262/blob/master/INTERPRETING.md search
for IsHTMLDDA

Bug: v8:7184
Change-Id: I93d15715303deb0a932545d919bc281f5f4d5829
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181475
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67555}
2020-05-05 06:43:53 +00:00
Shu-yu Guo
50ee1df474 Support $262.IsHTMLDDA
There is already a %GetUndetectable runtime test function, so use that.

Bug: v8:7184
Change-Id: I04af03d95c4245ab9c7061cb00d5890972b82f46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181195
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67553}
2020-05-05 06:19:02 +00:00
Dan Elphick
3795f5bbfc [heap] Split out memory-chunk.h etc from spaces.h
Also makes memory-chunk.h accessible from outside heap which allows
removal of some heap-inl.h includes.

Bug: v8:10473, v8:10496
Change-Id: Iec4fc5ce8ad201f6ee5fd924cc3cd935324429fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172088
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67551}
2020-05-05 05:44:42 +00:00
Deepti Gandluri
12263212c1 Revert "[wasm-simd] Remove interpreter tier of SIMD tests"
This reverts commit 3c40082543.

Reason for revert: Re-enable interpreter tests

Original change's description:
> [wasm-simd] Remove interpreter tier of SIMD tests
> 
> As per the all-hands a couple of weeks ago, the interpreter will
> be removed soon. Remove running tests on this tier, so we no longer
> put effort into maintaining tests for this tier.
> 
> Change-Id: I9fce0f3a7cd869d6ccecf1c1f820b794e89858e1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2175021
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67520}

TBR=gdeepti@chromium.org,zhin@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Iac0f21311769157c5ae303e8078c25d96fbc7c93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2180343
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67546}
2020-05-04 17:09:51 +00:00
Thibaud Michaud
7b582b615e [wasm] Store the source URL in CompiledWasmModule
This allows us to preserve the script URL when importing a module in a
worker.

R=ahaas@chromium.org,clemensb@chromium.org
CC=kimanh@chromium.org

Bug: chromium:1064548
Change-Id: Id5e48c840e2dba8eadb5c854fcb389787ce11215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167866
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67543}
2020-05-04 15:07:21 +00:00
Tobias Tebbi
f1400e43f1 [torque] improve GC visitors
Summary of changes:

- GC visitors no longer rely on superclass visitors, but instead visit
  everything themselves. This enables generating better code.
- Try to match simple body descriptors to reduce the amount of generated
  code.
- Turn SizeFor(instance) into an AllocatedSize() method.
- Remove the special handling of resizable object sizes from Torque
  and instead overwrite AllocatedSize in classes that need special
  handling in C++.
- Split the visitor id lists depending on whether the class has pointer
  fields.
- Turn Torque-generated body descriptors into an .inc file to
  simplify includes.
- Fix generated size functions to properly align the size.
- Generate GC visitors (and C++ class definitions) for all string
  classes and FixedArray, WeakFixedArray, and WeakArrayList.
- Store generated instance types in Torque class types. This is only
  used to determine if a type has a single instance type in this CL.

Bug: v8:7793
Change-Id: I4d362e96b047c305bd6d065247734957b8958c42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2110014
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67542}
2020-05-04 14:55:12 +00:00
Igor Sheludko
0d44905481 [ic] Fix KeyedHasIC_SloppyArguments implementation
... to be in sync with KeyedLoadIC_SloppyArguments in handling OOB
accesses which may involve prototype chain walk.

Bug: chromium:1063796
Change-Id: I8421c19085dfd2f3b6360c64fd04f53b1351576c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2174504
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67541}
2020-05-04 14:22:51 +00:00
Jakob Gruber
fe8ff5f1c1 [test] Add stress_snapshot test variant
This variant passes the --stress-snapshot d8 flag. There's a large
initial list of skips, these should be removed as issues are fixed
over time. The variant is currently not enabled on any bots.

Bug: v8:10416
Change-Id: I80aea80600c51b2f5d28b8ec8a09ff0ba2ebaa7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179002
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67536}
2020-05-04 12:19:50 +00:00
Jakob Gruber
22861ce609 [snapshot] Skip serialization of 'other strong roots'
... and weak context code lists. These are non-empty when an isolate
is running and the serializer cannot handle them.

Bug: v8:10416
Change-Id: I11a3d25dfd1980bcddae8b65c429df3c2cf16b19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172423
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67535}
2020-05-04 12:13:51 +00:00
Dan Elphick
0b8d4bda0c [heap] Factor out read-only-spaces.h from spaces.h
Moves ReadOnlyPage, ReadOnlyArtifacts, ReadOnlySpace and
SharedReadOnlySpace out of spaces.h and into read-only-spaces.h, as well
as creating a corresponding .cc file.

Bug: v8:10473
Change-Id: I9d8b49d61ed643fd6e16919d571a909ab6fce407
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2171197
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67531}
2020-05-04 11:16:40 +00:00
Nico Hartmann
987ada7b09 [js-perf-test] Benchmark for sloppy equality
Bug: v8:5660
Change-Id: I8952535b2a361d56ae6822b1efbda88a4149c593
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162166
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67526}
2020-05-04 08:29:00 +00:00
Deepti Gandluri
3c40082543 [wasm-simd] Remove interpreter tier of SIMD tests
As per the all-hands a couple of weeks ago, the interpreter will
be removed soon. Remove running tests on this tier, so we no longer
put effort into maintaining tests for this tier.

Change-Id: I9fce0f3a7cd869d6ccecf1c1f820b794e89858e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2175021
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67520}
2020-05-01 18:25:36 +00:00
Seth Brenith
3c20dfeda1 [debug] Don't crash when breaking on entry to functions with heap vars
Any function with heap-allocated variables starts by creating and
pushing a new context for its execution. When entering the debugger due
to the stack check in the beginning of InterpreterEntryTrampoline, the
function has not yet had a chance to push that new context. The code in
ScopeIterator currently assumes that any function which needs a context
already has one by the time the debugger attempts to iterate scopes, but
in this case that assumption is invalid, which can cause a null deref.

This change introduces a new function ScopeIterator::NeedsAndHasContext
to replace previous calls to current_scope_->NeedsContext(). This new
function checks for the case where the current scope matches the closure
scope but the context matches the containing context for the function,
which implies that the function has not yet pushed its own context.

Bug: v8:10319, chromium:1038747
Change-Id: I29636f269c44d35b68d8446769d17170eed50e89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168021
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67519}
2020-05-01 18:21:36 +00:00
Z Nguyen-Huu
c0eee179b3 Add bit left-rotation machine operator
ROL will be optional operator as arm, arm64 only have ROR.

The reason for this CL is inefficient Wasm codegen for 64-bit
left-rotation.

Bug: v8:10216
Change-Id: I0cd13e4b6de5276a0d0b80eac5ed9c2e52ba1f96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157648
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67518}
2020-05-01 18:09:16 +00:00
Deepti Gandluri
41fbbd12a3 [wasm-simd] Update SIMD opcode numbers as per the Spec change
- Update opcode numbers, tests
 - As the wasm-module-builder currently assumes opcode bytes, skip
   the test that needs a multi-byte leb128 opcode
 - Renumber post-MVP opcodes

Change-Id: I6531e954e63986dc6f7a3144ec054d16e6dc1b05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2173952
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67517}
2020-05-01 18:05:46 +00:00
Tobias Tebbi
7e7b24eb25 [torque] avoid ambiguity if a catch catches from other handlers
Torque desugars try-catch/label constructs with several handlers
into nested try structures, with the first handler ending-up
innermost. So currently, if you write

try {
...
} label Foo {
  Throw(...);
} catch (e) {

}

The catch will catch the preceding Throw in another handler.
This is different from how multiple try-catch handlers are done in
languages like Java, where throwing from a preceding catch handler
is not caught by a later one. To avoid this possible ambiguity, this
CL prohibits this pattern, enforcing that a catch handler comes first,
before any other label-handler attached to the same try.
This way, a catch handler never catches from any other handler on the
same try, since they have to come later.

Bug: v8:7793
Change-Id: I943f14b2393d307c4254a3fc3a78f236dbcf86df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169098
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67516}
2020-05-01 14:47:01 +00:00
Ng Zhi An
84a06b5915 [wasm-simd][fuzzer] Add more f32x4 ops to fuzzer
Bug: v8:10180
Change-Id: I71a5c63abdcca2b11d29a1d25844cda738384161
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2173815
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67511}
2020-04-30 22:21:40 +00:00
Igor Sheludko
a4cf332116 [runtime] Fix miscalculated number of properties for derived class
... when an error occurs during super constructor compilation.

Bug: chromium:1072947
Change-Id: I8acf461de1f3c141e45d3b61b3ac2f5c990e106a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172964
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67505}
2020-04-30 15:22:27 +00:00
Frank Tang
31ce84b287 Roll test262
31dabb56..6a18c27c

6a18c27 Generate test files from templates by Alexey Shvayka · 10 hours ago master
10a8c04 Test throw() called w/o arguments by Alexey Shvayka · 10 hours ago
75a0c1b Test return() called w/o arguments by Alexey Shvayka · 10 hours ago
4d9dccf Remove invalid feature, fix lint by Gus Caplan · 10 hours ago
850c653 Revert "Correct the expectation of zh-Hant" by Frank Yung-Fong Tang · 11 hours ago
fd90d58 Change `alphanum` to character class by Alexey Shvayka · 11 hours ago
d3b3e5e Make `alphanum` a non-capturing group by Alexey Shvayka · 11 hours ago
4371e3a Remove unnecessary capture group by Alexey Shvayka · 11 hours ago
af05e8e Revert "Simplify alphanum regex in testIntl.js" by Alexey Shvayka · 11 hours ago
a3c7d30 Add AsyncGeneratorFunction test by Alexey Shvayka · 3 days ago
69de665 Add GeneratorFunction test by Alexey Shvayka · 3 days ago
43bc9f1 Add Function test by Alexey Shvayka · 3 days ago
e8dfe54 Correct the expectation of zh-Hant by Frank Yung-Fong Tang · 4 days ago
76b3891 Correctly tag AggregateError proto-from-ctor-realm test by Shu-yu Guo · 4 days ago
c3e980a correct style-short.js by Frank Yung-Fong Tang · 4 days ago
df861e4 correct style-narrow.js by Frank Yung-Fong Tang · 4 days ago
d6c1b36 style-long.js by Frank Yung-Fong Tang · 4 days ago
17fe569 correct style-short.js by Frank Yung-Fong Tang · 4 days ago
81de828 correct style-narrow.js by Frank Yung-Fong Tang · 4 days ago
79c1818 Correct pl-pl*.js test for minimumGroupingDigits by Frank Yung-Fong Tang · 4 days ago
39ed5d9 Add object rest destructuring test by Alexey Shvayka · 4 days ago
b08380c Add object spread test by Alexey Shvayka · 4 days ago
c9ce3be Add Object.seal test by Alexey Shvayka · 4 days ago
feaa555 Add Object.isSealed test by Alexey Shvayka · 4 days ago
a65d0bf Add Object.isFrozen test by Alexey Shvayka · 4 days ago
521446b Add Object.freeze test by Alexey Shvayka · 4 days ago
07ff2ff Add Object.defineProperties test by Alexey Shvayka · 4 days ago
56cbc61 Add Object.getOwnPropertyDescriptors test by Alexey Shvayka · 4 days ago
2183fa7 Add Object.assign test by Alexey Shvayka · 4 days ago
0942fe1 correct comments by Frank Yung-Fong Tang · 4 days ago
9b54c22 correct comments by Frank Yung-Fong Tang · 4 days ago
aabf688 correct comment by Frank Yung-Fong Tang · 4 days ago
e72a965 Change the compareArray to allow new property by Frank Yung-Fong Tang · 4 days ago
21440c7 Change compareArray to allow new property by Frank Yung-Fong Tang · 4 days ago
fc55e45 Change the compareArray to allow new property by Frank Yung-Fong Tang · 4 days ago
8ad1225 Change compareArray to allow new property by Frank Yung-Fong Tang · 4 days ago
4fb0e70 add "fractionalSecondDigits" by Frank Yung-Fong Tang · 4 days ago
9c6ab18 Add fractionalSecondDigits by Frank Yung-Fong Tang · 4 days ago

Bug: v8:7834
Change-Id: If455a1d5b3629aba45060f97672ff829ce112fa8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2174068
Auto-Submit: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67504}
2020-04-30 15:09:27 +00:00
Toon Verwaest
9107cdd9fd [mjsunit] Disable compiler/number-divide on gc-stress
This test fails if GC happens in the wrong moment.

Change-Id: I3bab2c3a2670d5868cfad545b1a4d45b9567b3a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2174421
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67503}
2020-04-30 14:47:06 +00:00
Marja Hölttä
6f994a0bdf [Promise.any] Add Promise.any
CL adopted from joshualitt@: https://chromium-review.googlesource.com/c/v8/v8/+/2002932

Link to explainer is here: https://github.com/tc39/proposal-promise-any

Co-authored-by: Joshua Litt <joshualitt@chromium.org>

Bug: v8:9808
Change-Id: I6872020e857d4b131d5663f95fd58e6271ccb067
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2124834
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67502}
2020-04-30 14:24:47 +00:00
Michael Lippautz
fe0c91cb6c heap: Rework forced GCs
Forced GCs can either be invoked internally or communicate the fact that
they are forced externally via API. Before this CL, all uses were
passing kGCCallbackFlagForced to indicate that the GC was forced.

This flag is used by embedders though to trigger followup actions. E.g.,
it can be used to trigger a follow up call to
GarbageCollectionForTesting() call which requires --expose-gc.

This patch changes the semantics as follows:
- Internal forced GCs use a Heap GC flag (kForcedGC)
- External forced GCs and GC extension use kGCCallbackFlagForced

Bug: chromium:1074061
Change-Id: Ide7ea0ccdf88b8c8cac002289aef5b7eb0f9748c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172747
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67498}
2020-04-30 11:23:15 +00:00
Dominik Inführ
5bbca548e9 [heap] Allow background threads to request GC
When a background thread fails to allocate, it requests a GC and
retries the allocation afterwards. Make second allocation more likely
to succeed by allowing those allocations to expand the old space.

TLABs of LocalHeaps also need to be invalidated before the GC.

Bug: v8:10315
Change-Id: Idaea2c4ee25642d508c72ae274b06d60c6e225e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154193
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67496}
2020-04-30 11:21:05 +00:00
Andreas Haas
0e1ac4e749 [wasm][liftoff][arm] Guarantee scratch register for spilling
Spilling a register in Liftoff require a scratch register when the
offset of the stack slot from fp is greater than 2^12. This CL adds
a check to LiftoffAssembler::Spill on arm to check that a scratch
register is available. It also fixes one case where the scratch register
was not available.

R=clemensb@chromium.org
CC=zhin@chromium.org

Bug: chromium:1075953
Change-Id: Idb2bc7e26e3d4fbd6bb0eb6c9a9b8cfd8b3c569e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172424
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67494}
2020-04-30 11:05:25 +00:00
Frank Tang
e270b6d615 Roll ICU from 65.1 to 67.1 (f2223961) & correct tests
Rolling to chrome/src is in
https://chromium-review.googlesource.com/c/chromium/src/+/2155530

Since auto rolling stop after 3/24/2020 and the rolling will cause
change of test status, I get this cl ready (but not running trybot due
to 1074260) and plan to hand roll after the submission of 2155530.

Bug: chromium:1064326, v8:9515, v8:10379, v8:10380, v8:10437
Change-Id: I19554f68cfdc5b717dfc7fc4b1222e9dc25b8d69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158486
Auto-Submit: Frank Tang <ftang@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67493}
2020-04-30 10:45:15 +00:00
Clemens Backes
0e2e00f44e [wasm] Remove interpreter compilation hint
The interpreter will be un-shipped soon, hence we cannot have a
compilation hint for interpreted execution.
This CL removes the respective enum value, removes a test which
specifically tested this one option, and adapts other code to use one of
the remaining hints.

R=ahaas@chromium.org

Bug: v8:10389
Change-Id: Ia754f7de95be271000a9e4e10ef2a3ee171da627
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172748
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67491}
2020-04-30 09:50:15 +00:00
Philip Pfaffe
4a98a3cce3 Implement protocol::Binary to/from base64 conversion
Supporting WebAssembly evaluator modules requires support for passing
binary data as a parameter to CDP methods. Currently, the required base64
conversions are not implemented.

Bug: chromium:1020120
Change-Id: Ie74f93ee5accfa369aac428e5c5b5f882c921c52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152645
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67490}
2020-04-30 08:46:05 +00:00
Zhao Jiazhong
fc03e548b0 [regexp] Loosen limit in UnicodePropertyEscapeCodeSize test
The UnicodePropertyEscapeCodeSize test set the max code size as 150KB,
which is too strict for mips64. This CL loosen the limit to 200KB.

Bug: v8:10441
Change-Id: I8532d4d51eedd7713075d86e84c52a58d2412861
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172927
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67489}
2020-04-30 08:24:14 +00:00
Frank Tang
2a0505eda9 Roll ICU to tz2020a on top of 65.1
Somehow the auto rolling of ICU does not happen after 2020/3/24
(see https://bugs.chromium.org/p/v8/issues/detail?id=10481) so I hand roll
ICU now.

For example, the following icu hash into chrome/src/DEPS was not yet
auto rolled after ~4 weeks:
2020/4/1 https://chromium-review.googlesource.com/c/chromium/src/+/2109133
2020/4/28 https://chromium-review.googlesource.com/c/chromium/src/+/2162266

Bug: chromium:1074578
Change-Id: I7ba0d240351f7458997e66a1e580564684a8b5a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2173670
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67485}
2020-04-30 00:25:02 +00:00
Ng Zhi An
1a872d1951 [wasm-simd][fuzzer] Add some i32x4 ops to fuzzer
Bug: v8:10180
Change-Id: I30d7eb8201701c081dc72f6d47f50133e496bdf9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169013
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67484}
2020-04-29 22:07:42 +00:00
Igor Sheludko
b9eda86337 [sandbox][x64] Add build flag for V8 heap sandbox feature
... and bottlenecks for C++, CSA, Torque, TurboFan and hand-written
assembly.

Bug: v8:10391
Change-Id: I62f8c6f9c934b2cd492e550b7c25f1078c2c6a71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134140
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67479}
2020-04-29 16:44:02 +00:00