Commit Graph

31485 Commits

Author SHA1 Message Date
Dominik Inführ
303facf5e1 [heap] Also promote strings in large objects into shared heap
With --shared-string-table all in-place internalizable strings are
directly promoted from new space into the shared heap. However, this
wasn't the case with large objects. This CL fixes this and adds test
to guide fuzzers.

Bug: v8:13267, chromium:1400048
Change-Id: I6f850d480956c63bfbe1a7060140df850e284933
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096818
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84805}
2022-12-13 12:25:14 +00:00
Leszek Swirski
f051f773f4 [heap] Remove optimized code list
Code objects are linked in a custom per-native-context weak list of
optimized code (previously there was also a list of deoptimized code,
but this was recently removed).

There used to be reasons for this list, but at this point it is only
used by the debugger to mark code for deoptimization. The debugger can
do this with a heap walk instead, so we can remove this list and indeed
the next_code_links from Code objects themselves.

Change-Id: Iebbed4adacd31b8ddc442ae6355ea45c691cc856
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4061515
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84804}
2022-12-13 11:58:32 +00:00
Nico Hartmann
0efdcf6f38 [turboshaft] Fix type refinement on branches with implicit truncation
Bug: v8:12783, chromium:1400056
Change-Id: Ie522a308f49b92c8438ae102559a763f8912c1d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094420
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84801}
2022-12-13 09:35:50 +00:00
Jaroslav Sevcik
00c8f93df1 [debug] Fix removing instrumentation breakpoint on pause
Bug: chromium:1354043
Change-Id: Ib30aaa6e799eb3cda611e1ec63cd8e049befc75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100485
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84799}
2022-12-13 08:18:44 +00:00
Jaroslav Sevcik
d46662c084 [test] Move inspector stopping to session
This patch moves the stop method from context group to session to enable
stopping each session independently. This is useful for testing that
stopping does not interact badly with other sessions.

Bug: chromium:1354043
Change-Id: I885cf49f2d4cf006fa5228edf2954099e45cfc6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100484
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84797}
2022-12-13 06:59:09 +00:00
Qifan Pan
c27adbd631 [turbofan] Fix bugs of ToBigIntConvertNumber
This CL fixes two bugs:

- The monotonicity violation in the typers of ToBigIntConvertNumber and
  Integral32OrMinusZeroToBigInt.
- The missing handling of conversion from Tagged output with the type
  DoubleRepresentableInt64OrMinusZero to Word64.

Bug: v8:9407, v8:13580, chromium:1399951, chromium:1400053
Change-Id: I669820b52e5b82bddc9853cfd97a2361c344a2cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096990
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84793}
2022-12-12 17:01:54 +00:00
Clemens Backes
67377c13c0 [wasm] Use WasmEngine's allocator for validation
We already exclusively use the WasmEngine's AccountingAllocator for all
decoded Wasm modules. Except for tests, the same allocator will also be
used for validation. Thus do not pass it down explicitly, but get it
from the WasmEngine when needed.

R=ahaas@chromium.org

Bug: v8:13447
Change-Id: Idaa9d6c3e0ab0051bf85bb2667accac89e8b5607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092738
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84792}
2022-12-12 16:59:04 +00:00
Olivier Flückiger
f834ce3ae4 [static-roots] Skip a slow serializer test on windows debug build
A new test added in https://crrev.com/c/4092575 times out on ASan
windows builds and is slow.

Superseeds https://crrev.com/c/4096677.

No-Tree-Checks: true
No-Try: true
Bug: v8:13466
Change-Id: I40d61459437434cf739fbff8c223871012a23010
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096817
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84784}
2022-12-12 14:22:02 +00:00
Matthias Liedtke
4760f9292c [test] Skip flaky unittest TyperTest.Monotonicity_Operation_Integral32OrMinusZeroToBigInt
Bug: v8:13580
Change-Id: I96680f9e12515fa1f2885edc6fbdf754fed6b40b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096986
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84783}
2022-12-12 14:19:28 +00:00
Maya Lekova
10ae2e4a59 [turboshaft] Fix a crash in branch elimination
The current reduction of blocks that are branch targets with a known
condition assumes that this is the first time we're seeing the given
condition with the given value. That's no longer the case, so updating
the expectation accordingly.

Bug: chromium:1399627
Change-Id: Id84d80a38801cf6178b476e62160d616b948d8d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096984
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84780}
2022-12-12 14:16:20 +00:00
Shu-yu Guo
d1d100d4ef [shared-struct] Disallow Symbol field names
Bug: chromium:1394408, v8:12547
Change-Id: If98e6f0e7048a7d218010eb2859bb986a20917ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094374
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84779}
2022-12-12 12:45:34 +00:00
Matthias Liedtke
1bf670ef20 [wasm-gc] ref.cast null: Always produces a null type independent of input type
This is required to be spec-compliant.
The previously implemented behavior was more relaxed allowing one to use
`ref.cast null` on non-nullable inputs and still getting a non-nullable
result on cast success.

Bug: v8:7748
Change-Id: I1297314389b0445a7c8d5a74f37d07a723d7a133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091549
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84776}
2022-12-12 11:30:33 +00:00
Olivier Flückiger
bd7458cb7f Reland "[static-roots] Allow creating isolates from exist. r/o snapshot"
This is a reland of commit 331c577e1d

Fix DCHECK for single generation builds.

Original change's description:
> [static-roots] Allow creating isolates from existing r/o snapshot
>
> This adds the ability to create an isolate from scratch, except the
> read only roots, which are initialized from a read_only_data snapshot.
> To do this we split the heap setup in a read/only part and the rest.
> The goal of these changes is to later support writing serializer tests,
> even if the read only roots are static and have to be loaded from a
> fixed snapshot.
>
> Bug: v8:13466
> Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Olivier Flückiger <olivf@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84750}

Bug: v8:13466
Change-Id: Ic680b7620fc3176260c5d550e474412afef5f598
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092575
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84773}
2022-12-12 10:44:23 +00:00
Marja Hölttä
bf998bdf47 [rab/gsab] Fix TA.p.slice even more
The previous fix was using the wrong getter for accessing the length.

It also threw an error when the created TA was length-tracking but in
bounds.

Bug: v8:11111,chromium:1399799
Change-Id: I5a94b1b49b2e30cf33999be7ff0ee8e4f5323849
Fixed: chromium:1399799
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4090984
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84771}
2022-12-12 08:37:34 +00:00
Leszek Swirski
c5dc2fc9c1 [mjsunit] Make Array deepEquals respect holes
Don't let holes compare equal to undefined, to avoid tests accidentally
succeeding when operating on the wrong holeyness.

Change-Id: I5fe1eea8b3e718389b46d542be45cca578a1080c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091024
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84769}
2022-12-10 13:19:33 +00:00
Shu-yu Guo
08e95d81d5 [rab/gsab,api] Add v8::BackingStore::MaxByteLength
I originally thought MaxByteLength would only be needed for
v8::ArrayBuffer and v8::SharedArrayBuffer, but it is also needed on
v8::BackingStore.

In particular, blink uses Mojo to serialize ArrayBuffers' contents via
v8::BackingStore when doing cross-process postMessage.

Bug: chromium:1396361, v8:11111
Change-Id: I86d44829175ad760fb43294d386483a16044fc3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4090708
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84767}
2022-12-09 22:45:18 +00:00
Choongwoo Han
2dcb0a1a1e Fix Array.toReversed to create properties for holes
Array.toReversed always creates properties even for holes, but the
optimization paths for HOLEY_* arrays did not respect the spec. This CL
fixes the fast paths to set `undefined` value instead of the hole.

Bug: chromium:1395672
Change-Id: I51584829caf312a1864f93928315782bb120ee14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4081689
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Choongwoo Han <choongwoo.han@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#84766}
2022-12-09 18:00:55 +00:00
Qifan Pan
753584c74b [turbofan] Inline BigInt Constructor for Integral32 input
This CL introduces two JS operators JSToBigInt and
JSToBigIntConvertNumber and one simplified operator
Integral32OrMinusZeroToBigInt.

- BigInt constructors are lowered to JSToBigIntConvertNumber in the
  inlining phase.
- JSToBigIntConvertNumber is replaced with
  Integral32OrMinusZeroToBigInt if the input is typed as Integral32
  in typed lowering.
- In simplified lowering, Integral32OrMinusZeroToBigInt is lowered
  to conversion to word64 accordingly.
- If the input is not Integral32 or BigInt, JSToBigIntConvertNumber
  is lowered to a builtin call in generic lowering.

Bug: v8:9407
Change-Id: I8539d742e82cce515bd9350797f5f9b0876ee6f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055670
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84761}
2022-12-09 15:08:34 +00:00
Dominik Inführ
458cda96fe Revert "[heap] Iterate promoted pages during sweeping"
This reverts commit 1e3dd39d09.

Reason for revert: Causes failures with --shared-string-table

https://bugs.chromium.org/p/chromium/issues/detail?id=1399489
https://bugs.chromium.org/p/chromium/issues/detail?id=1399491
https://bugs.chromium.org/p/chromium/issues/detail?id=1399488
https://bugs.chromium.org/p/v8/issues/detail?id=13574

Original change's description:
> [heap] Iterate promoted pages during sweeping
>
> Promoted pages are iterated to record slots containing old to new and
> old to shared references. This takes a significant amount of time during
> the atomic pause.
> Instead we offload this task to the concurrent sweepers, record slots to
> a local cache, and merge it when finalizing sweeping.
>
> Array buffer sweeping depends on iteration of promoted pages, so it is
> frozen until iteration is done.
>
> See design doc at https://docs.google.com/document/d/1JzXZHguAnNAZUfS7kLeaPVXFfCYbf5bGCtyKgyiMDH4/edit?usp=sharing
>
> Bug: v8:12612
> Change-Id: Icdc79a7a70c53352e3a1b3961cfe369e8563b65b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4062041
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Auto-Submit: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84706}

Bug: v8:12612
Change-Id: I4ed4a6ad954cb294b569c94b4d8ea25a0956a223
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092734
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84760}
2022-12-09 14:53:05 +00:00
Simon Zünd
fb02c04d48 [debug] Only pause once when we throw in an async generator
Similar to the `AsyncFunctionReject` builtin, the
`AsyncGeneratorReject` should also mark the promise rejection as a
non-debuggable event.

That is because the initial throw that causes the generator rejection
downstream alreay triggered the debuggable event.

We can re-use one of the existing tests as a regression test here:
If we wait for the Runtime.evaluate promise to resolve after the first
pause, we ensure that we already paused once. The test in its current
form swallowed the second pause implicitly by disabling the debugger.

R=bmeurer@chromium.org

Bug: chromium:1270780
Change-Id: I97ab08934804fefd097e9bd01081469da5379154
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084925
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84756}
2022-12-09 12:49:29 +00:00
Clemens Backes
068536f109 [wasm] Remove thread timings (CPU time)
On Mac, we spend around 30% of lazy compile time in {ThreadTicks::Now}.
On Linux it's less severe, but still around 10%.
That's too much overhead for measurements that only show up in UKM, so
remove that.

The unused fields will be removed from the UKM events after the plumbing
on the chromium side has been removed.

R=ahaas@chromium.org, mlippautz@chromium.org
CC=​ecmziegler@chromium.org

Bug: v8:13565
Change-Id: I2dad88d899482801888940499d2d1761ff075578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078966
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84754}
2022-12-09 12:11:22 +00:00
Jaroslav Sevcik
f4fb8fc1f7 [inspector] Introduce debugger session stop API
We introduce V8InspectorSession::stop API to enable safe
detach from the session. In particular, after calling 'stop',
the session will leave any instrumentation pause it might
be in and disarm all its instrumentation breakpoints.

This is useful when the session disconnect request is registered
on V8 interrupt (so it is unsafe to disconnect at that point),
and the execution should first get to the message loop
where the disconnect can be handled safely.

Bug: chromium:1354043
Change-Id: I3caab12a21b123229835e8374efadc1f4c9954c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085143
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84753}
2022-12-09 12:08:58 +00:00
Toon Verwaest
f3c20276ed [compiler] Use CheckIf instead of DeoptimizeIf to fix the framestate
Bug: chromium:1399695
Change-Id: Id2aae902d1ce483b4d0a1e4953074a7539cf7058
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092264
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84752}
2022-12-09 12:07:48 +00:00
Nico Hartmann
1d733b97a2 Revert "[static-roots] Allow creating isolates from existing r/o snapshot"
This reverts commit 331c577e1d.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20debug%20-%20single%20generation%20-%20builder/9912/overview

Original change's description:
> [static-roots] Allow creating isolates from existing r/o snapshot
>
> This adds the ability to create an isolate from scratch, except the
> read only roots, which are initialized from a read_only_data snapshot.
> To do this we split the heap setup in a read/only part and the rest.
> The goal of these changes is to later support writing serializer tests,
> even if the read only roots are static and have to be loaded from a
> fixed snapshot.
>
> Bug: v8:13466
> Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Olivier Flückiger <olivf@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84750}

Bug: v8:13466
Change-Id: I91512140abb98993578d27e65e6080e1d3f317e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089967
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84751}
2022-12-09 12:06:43 +00:00
Olivier Flückiger
331c577e1d [static-roots] Allow creating isolates from existing r/o snapshot
This adds the ability to create an isolate from scratch, except the
read only roots, which are initialized from a read_only_data snapshot.
To do this we split the heap setup in a read/only part and the rest.
The goal of these changes is to later support writing serializer tests,
even if the read only roots are static and have to be loaded from a
fixed snapshot.

Bug: v8:13466
Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84750}
2022-12-09 11:43:52 +00:00
Nikolaos Papaspyrou
710f2a4da2 Revert "[heap] Fix conservative stack scanning for client isolates"
This reverts commit 36bac1bcae.

Reason for revert: This possibly caused clusterfuzz issues and test flakiness.

Original change's description:
> [heap] Fix conservative stack scanning for client isolates
>
> With this CL, the context of stacks corresponding to all client isolates
> are saved, so that conservative stack scanning can be used correctly
> during a shared garbage collection. This happens:
>
> 1) in Heap::PerformSharedGarbageCollection, for the stacks of the shared
>    isolate and the initiator;
> 2) when an isolate's main thread is waiting in a safepoint; and
> 3) when an isolate's main thread is parked.
>
> Bug: v8:13257
> Change-Id: I9ff060f2c0c1ec12977c70d67d65d9c543e2d165
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4027210
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84712}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:13257
Change-Id: I7eb50b24243084d45b3f1bcc37a559b9f92e0318
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092363
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84749}
2022-12-09 10:50:35 +00:00
Al Muthanna Athamina
fe89c47a68 [test] Mark slow tests as slow on debug mode
Bug: v8:13572
Change-Id: Ib23cfc4c3b69ffc7c89d0dde47323a03980452f0
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092223
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84748}
2022-12-09 10:24:47 +00:00
Deepti Gandluri
f5fc2d7fe2 [wasm-relaxed-simd] Implement Dot add instructions on x64/ia32
Bug: v8:12284
Change-Id: Ieb92206cb9b2df296bd9ba1ef88d1183752c4bc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3866610
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84744}
2022-12-09 01:26:26 +00:00
Shu-yu Guo
1f306a9666 [rab/gsab] Do not optimize objects in shared space as prototypes
Bug: chromium:1393515, v8:12547
Change-Id: I6d0a7c32cf367976524eec56b824600eecc911ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4086127
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84741}
2022-12-08 21:36:31 +00:00
Toon Verwaest
54256360ff [runtime] Don't stay const on store to field
This was a slightly overzealous optimization that ended up being more
tricky than expected without measurable value on the benchmarks (as far
as we know). Let's try to remove it and see whether an important
benchmark notices.

Bug: chromium:1385941
Change-Id: If2e81f6cb6758f9c373e7c2c8beaa308ed323f93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4088624
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84739}
2022-12-08 17:52:22 +00:00
Matthias Liedtke
c2a1261355 [wasm-gc] Add new br_on_cast_fail variant taking a heap type immediate
Adds new `br_on_cast_fail <branch depth> <heap type>` instruction
with opcode 0xfb43.
The instruction branches if the cast fails. `null` is treated as a cast
failure (meaning the branch is taken).
The heap type may be any concreate heap type index or an abstract
type like `(ref null eq)`.

Bug: v8:7748
Change-Id: I97a78d6d0872703ab825016cab4e737f8f79995f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084981
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84733}
2022-12-08 14:53:37 +00:00
Manos Koukoutos
ba6be821c9 [wasm-gc] Change MatchesSignature to use canonical types
Specifically, the methods in {WasmJSFunction} and {WasmCapiFunction}.
Drive-by:
- Fix a bug in {WasmCapiFunction::GetSignature}.
- Fix a bug in wasm-module-builder.js.

Bug: v8:7748
Change-Id: I7408d07766536ed37f23b97ad210212b986412bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079097
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84728}
2022-12-08 12:38:41 +00:00
Marja Hölttä
3f17de8d3a [rab/gsab] Add full RAB / GSAB support to ValueSerializer, attempt 2
Keep the ValueSerializer version number the same but add a separate
value type for resizable ArrayBuffers.

Bug: v8:11111
Change-Id: I895e9ffcc63cce2e83a09d4be81312fdcffa67f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4083067
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84718}
2022-12-08 08:10:28 +00:00
Shu-yu Guo
90742c6040 [api] Add resizable getters to ArrayBuffer APIs
Adds v8::[Shared]ArrayBuffer::MaxByteLength and
v8::BackingStore::IsResizableByUserJavaScript.

This is needed for embedders who need to check if a buffer is resizable
by user JS, like blink, to check for the [AllowResizable] WebIDL
extended attribute.

Bug: v8:11111
Change-Id: Ie7e03979ef3884123df8a3eeb5c3516c4a6967c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4082276
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84715}
2022-12-07 21:32:31 +00:00
Nikolaos Papaspyrou
36bac1bcae [heap] Fix conservative stack scanning for client isolates
With this CL, the context of stacks corresponding to all client isolates
are saved, so that conservative stack scanning can be used correctly
during a shared garbage collection. This happens:

1) in Heap::PerformSharedGarbageCollection, for the stacks of the shared
   isolate and the initiator;
2) when an isolate's main thread is waiting in a safepoint; and
3) when an isolate's main thread is parked.

Bug: v8:13257
Change-Id: I9ff060f2c0c1ec12977c70d67d65d9c543e2d165
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4027210
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84712}
2022-12-07 15:52:42 +00:00
Omer Katz
1e3dd39d09 [heap] Iterate promoted pages during sweeping
Promoted pages are iterated to record slots containing old to new and
old to shared references. This takes a significant amount of time during
the atomic pause.
Instead we offload this task to the concurrent sweepers, record slots to
a local cache, and merge it when finalizing sweeping.

Array buffer sweeping depends on iteration of promoted pages, so it is
frozen until iteration is done.

See design doc at https://docs.google.com/document/d/1JzXZHguAnNAZUfS7kLeaPVXFfCYbf5bGCtyKgyiMDH4/edit?usp=sharing

Bug: v8:12612
Change-Id: Icdc79a7a70c53352e3a1b3961cfe369e8563b65b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4062041
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84706}
2022-12-07 14:33:34 +00:00
Matthias Liedtke
3241896c87 [wasm-gc] Fix opcode name in errors for new cast null variants
Bug: v8:7748
Change-Id: Ia7a1ce7032761cd2fea7bf421b73eb015edc8576
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085003
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84705}
2022-12-07 12:48:43 +00:00
Matthias Liedtke
ac4c5c468d [wasm-gc] Add new br_on_cast null variant taking a heap type immediate
Adds new `br_on_cast null <branch depth> <heap type>` instruction
with opcode 0xfb4a.
The instruction branches on null.
The heap type may be any concreate heap type index or an abstract
type like `(ref null eq)`.

Bug: v8:7748
Change-Id: I0f1debacc80a304f7cfc262fd2cde7f43fc804d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4075086
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84703}
2022-12-07 10:17:02 +00:00
Francis McCabe
72f7c31e23 Revert "Use BigInts in processor.mjs and related code to avoid unsafe ints in"
This reverts commit efc1a98c53.

Reason for revert: breaks gc stress tests: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20gc%20stress/1928/overview

Original change's description:
> Use BigInts in processor.mjs and related code to avoid unsafe ints in
> calculations
>
> Bug: v8:13440
> Change-Id: Ie03b831b511a49fb475b9f303ef8662189bdaf3d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4017455
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84698}

Bug: v8:13440
Change-Id: Ida91f184e24a09e873388cd7c6d35849a5734178
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Owners-Override: +1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4083964
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Francis McCabe <fgm@chromium.org>
Owners-Override: Francis McCabe <fgm@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84699}
2022-12-07 01:14:08 +00:00
Vasili Skurydzin
efc1a98c53 Use BigInts in processor.mjs and related code to avoid unsafe ints in
calculations

Bug: v8:13440
Change-Id: Ie03b831b511a49fb475b9f303ef8662189bdaf3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4017455
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84698}
2022-12-06 22:06:33 +00:00
Frank Tang
959b243e53 [Intl] Throw errow while passing roundingIncrement
Implement the changes in
https://github.com/tc39/proposal-intl-numberformat-v3/pull/102

Bug: v8:13538
Change-Id: I76d6c90c2b09a274a7b12cbb2e9ddbddc14dc3ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4063666
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84696}
2022-12-06 20:01:33 +00:00
Clemens Backes
918e478354 [wasm][fuzzer] Reduce number of instructions in simulator
It turned out that executing 1 million (wasm) instructions can take way
over a minute on a simulator.
Thus changing this back to 16k instructions (as it was before
https://crrev.com/c/4078983). This takes around 5 seconds on my machine.

R=jkummerow@chromium.org

Bug: chromium:1396351, chromium:1396237
Change-Id: Ibf2ae2c81816be93807e564876b75aec18a57c42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079195
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84691}
2022-12-06 16:14:23 +00:00
Clemens Backes
ea6e09b5c1 [wasm] Remove indirection to WasmModule::signature_zone
The zone should just be a member of {WasmModule} instead of a
heap-allocated second object.

R=ahaas@chromium.org

Change-Id: I9cf7d5145ea9131a5ae3382c6f5aa63b816d9aa4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4080032
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84690}
2022-12-06 15:45:52 +00:00
pthier
c6eb40d762 Reland "[heap] Invoke GC callbacks in safepoint for shared GCs"
This is a reland of commit eeed2ebadb

Changes since revert:
- Disable test for builds that don't support shared heap.

Original change's description:
> [heap] Invoke GC callbacks in safepoint for shared GCs
>
> After a shared GC, trigger all registered callbacks while the global
> safepoint is active.
>
> Bug: chromium:1395117
> Change-Id: I16c61533d44fbeddda18414d2256203848420a99
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079624
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84653}

Bug: chromium:1395117
Change-Id: I145dadac39d81342d7fbc2bad8b87f3518b0100e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4081130
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84687}
2022-12-06 15:17:10 +00:00
Victor Gomes
4feb9a1c0e [maglev] Add a TopmostFrameIsMaglev status
... so that we can check that we correctly installed a maglev
code during OSR.

Bug: v8:7700
Change-Id: I6f1d12e8b43cb7c0639e75c43400c5000c090a00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078937
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84686}
2022-12-06 14:01:41 +00:00
pthier
9ac5afe9f3 Include write barrier in JS shared heap buildrunner config
Shared heap is not available without write barriers, therefore skip all
tests that require shared heap when write barriers are disabled.

Change-Id: I66a9a94941ffab792ced964f12df6930b13c92cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079120
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84682}
2022-12-06 12:45:34 +00:00
Aapo Alasuutari
8d5630c7d6 [fastcall] Fix test code crash in ExternalPointerTable::RelaxedLoad
Bug: chromium:1395617, chromium:1395521
Change-Id: I23355e14c879532c699084fff7d9d1fcf6489941
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4075578
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84677}
2022-12-06 09:52:29 +00:00
Jakob Kummerow
dbbc07b828 [stringrefs] string.new_wtf16_array: call runtime for long strings
This reverts part of crrev.com/c/4020425, because it turns out that the
runtime call pays off for strings above a certain length.

Bug: v8:12868
Change-Id: I1c4d5a01bb0f1303c2385c7707b3e5fff6936b02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4075728
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84668}
2022-12-05 19:27:10 +00:00
Michael Achenbach
5073ba7d52 Revert "[wasm] Compile debug code lazily"
This reverts commit 7b138dd30d.

Reason for revert: Causes multiple flakes:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/22932/overview
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/41934/overview

Original change's description:
> [wasm] Compile debug code lazily
>
> Currently V8 recompiles all functions of a WebAssembly module when a
> debugging session starts. This is outdated behavior and
> causes OOMs for developers. With this CL all compiled code just gets
> removed when a debugging session starts, and debugging code gets
> compiled lazily.
>
> This behavior may lead to small delays whenever a new function gets
> entered by the debugger. However, developers are used to debugging code
> being slightly slower, and the small delays should be in the order of
> few milliseconds. On the other hand, debug modules can be big,
> sometimes even more than 1'000'000 functions, and developers reported
> OOMs when debugging.
>
> R=​clemensb@chromium.org
>
> Bug: v8:13541, chromium:1372621, v8:13224
> Change-Id: Ia36d9b8743523b1c89221c59f989268e27f6ce98
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4067302
> Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84662}

Bug: v8:13541, chromium:1372621, v8:13224
Change-Id: Ic5442462d158618f2d43b8e0ebdfb90017ed378a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4080034
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84665}
2022-12-05 18:55:17 +00:00
Nico Hartmann
3573da0bc8 Revert "[heap] Invoke GC callbacks in safepoint for shared GCs"
This reverts commit eeed2ebadb.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20debug%20-%20single%20generation/7836/overview

Original change's description:
> [heap] Invoke GC callbacks in safepoint for shared GCs
>
> After a shared GC, trigger all registered callbacks while the global
> safepoint is active.
>
> Bug: chromium:1395117
> Change-Id: I16c61533d44fbeddda18414d2256203848420a99
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079624
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84653}

Bug: chromium:1395117
Change-Id: I91682e6c19d1e22c85ba64fb0a6cc263abb77e75
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4079034
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84664}
2022-12-05 16:49:26 +00:00