Commit Graph

23 Commits

Author SHA1 Message Date
clemensh
6572b5622e [wasm] Remove raw byte pointers from WasmModule
These byte pointers (module_start and module_end) were only valid
during decoding. During instantiation or execution, they can get
invalidated by garbage collection.
This CL removes them from the WasmModule struct, and introduces a new
ModuleStorage struct as interface to the wasm wire bytes.
Since the storage is often needed together with the ModuleEnv, a new
ModuleStorageEnv struct holds both a ModuleEnv and a ModuleStorage.
The pointers in the ModuleStorage should never escape the live range of
this struct, as they might point into a SeqOneByteString or ArrayBuffer.
Therefore, the WasmInterpreter needs to create its own copy of the
whole module.
Runtime functions that previously used the raw pointers in WasmModule
(leading to memory errors) now have to use the SeqOneByteString in the
WasmCompiledModule.

R=titzer@chromium.org
BUG=chromium:669518

Review-Url: https://codereview.chromium.org/2540133002
Cr-Commit-Position: refs/heads/master@{#41388}
2016-11-30 15:03:06 +00:00
ahaas
480a65738c [wasm] Add a flag to generate an mjsunit test out of a wasm-code fuzzer test case.
R=titzer@chromium.org
CC=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2520853003
Cr-Commit-Position: refs/heads/master@{#41155}
2016-11-21 18:00:28 +00:00
ahaas
1bde83046e [wasm] Reimplement function verification in the module decoder.
This CL adds the function verification option to the module decoder.
Therefore we can remove the verification in wasm-module-runner.cc

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2496203002
Cr-Commit-Position: refs/heads/master@{#40977}
2016-11-14 19:46:19 +00:00
ulan
3505406bc7 [wasm] Fix -Wsign-compare warnings.
BUG=v8:5614

Review-Url: https://codereview.chromium.org/2487673004
Cr-Commit-Position: refs/heads/master@{#40891}
2016-11-10 12:51:05 +00:00
ahaas
57b14b0606 [wasm] Track in the interpreter if a NaN could have been produced.
The wasm specification does not fully specify the binary representation
of NaN: the sign bit can be non-deterministic. The wasm-code fuzzer
found a test case where the wasm interpreter and the compiled code
produce a different sign bit for a NaN, and as a consequence they
produce different results.

With this CL the interpreter tracks whether it executed an instruction
which can produce a NaN, which are div and sqrt instructions. The
fuzzer uses this information and compares the result of the interpreter
with the result of the compiled code only if there was no instruction
which could have produced a NaN.

R=titzer@chromium.org

TEST=cctest/test-run-wasm-interpreter/TestMayProduceNaN
BUG=chromium:657481

Review-Url: https://chromiumcodereview.appspot.com/2438603003
Cr-Commit-Position: refs/heads/master@{#40474}
2016-10-20 14:27:45 +00:00
titzer
418b239f0b [wasm] Use a Managed<WasmModule> to hold metadata about modules.
This CL refactors the handling of metadata associated with WebAssembly
modules to reduce the duplicate marshalling of data from the C++ world
to the JavaScript world. It does this by wrapping the C++ WasmModule*
object in a Foreign that is rooted from the on-heap WasmCompiledModule
(which is itself just a FixedArray). Upon serialization, the C++ object
is ignored and the original WASM wire bytes are serialized. Upon
deserialization, the C++ object is reconstituted by reparsing the bytes.

This is motivated by increasing complications in implementing the JS
API, in particular WebAssembly.Table, which must perform signature
canonicalization across instances.

Additionally, this CL implements the proper base + offset initialization
behavior for tables.

R=rossberg@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org,yangguo@chromium.org
BUG=v8:5507, chromium:575167, chromium:657316

Review-Url: https://chromiumcodereview.appspot.com/2424623002
Cr-Commit-Position: refs/heads/master@{#40434}
2016-10-19 13:07:22 +00:00
heimbuef
e7fa9b0129 Named all zones in the project
This adds more useful information to the v8-heap-stats tool.

BUG=v8:5489

Review-Url: https://codereview.chromium.org/2394213003
Cr-Commit-Position: refs/heads/master@{#40361}
2016-10-17 12:12:42 +00:00
clemensh
4f9976aa68 [wasm] Decouple function name and exported name in WasmFunctionBuilder
This is needed for the asm.js -> WASM pipeline. A single exported
function is exported as __single_function__, but we still want to see
the correct function name on the stack, so the underlying wasm function
has to carry the original name.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2406133003
Cr-Commit-Position: refs/heads/master@{#40159}
2016-10-11 10:36:02 +00:00
ahaas
90080f2a6b [wasm] Move test-signatures.h from test/cctest to test/common
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2395743003
Cr-Commit-Position: refs/heads/master@{#39988}
2016-10-05 12:00:03 +00:00
ahaas
55da769baf [wasm] Adjust crash message of the correctness fuzzer to avoid clustering.
The correctness fuzzer executes the input array in two different
execution engines and compares the results. If the results don't match,
the correctness fuzzer crashes.

Since the crash signature is always the same if the results don't match,
cluster fuzz would group all inputs which lead to non-matching results.

To avoid the grouping a base64 hash has to be appended to the crash
signature. This CL changes the text which is appended to the crash
signature to a base64 hash.

Note that I do not create a base64 hash directly because the base64
class is not available in V8. Instead I create a string which looks
like a base64 hash.

R=mmoroz@chromium.org, aarya@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2390233002
Cr-Commit-Position: refs/heads/master@{#39953}
2016-10-04 12:18:14 +00:00
titzer
c1e320b074 [wasm] Rename encoder.(cc,h) to wasm-module-builder.(cc,h)
R=bradnelson@chromium.org,mtrofin@chromium.org,mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2383463002
Cr-Commit-Position: refs/heads/master@{#39861}
2016-09-29 11:29:19 +00:00
titzer
28392ab196 [wasm] Master CL for Binary 0xC changes.
[0xC] Convert to stack machine semantics.
[0xC] Use section codes instead of names.
[0xC] Add elements section decoding.
[0xC] Decoding of globals section.
[0xC] Decoding of memory section.
[0xC] Decoding of imports section.
[0xC] Decoding of exports section.
[0xC] Decoding of data section.
[0xC] Remove CallImport bytecode.
[0xC] Function bodies have an implicit block.
[0xC] Remove the bottom label from loops.
[0xC] Add signatures to blocks.
[0xC] Remove arities from branches.
Add tests for init expression decoding.
Rework compilation of import wrappers and how they are patched.
Rework function indices in debugging.
Fix ASM->WASM builder for stack machine.
Reorganize asm.js foreign functions due to import indices change.

R=ahaas@chromium.org,rossberg@chromium.org,bradnelson@chromium.org
BUG=chromium:575167
LOG=Y

Committed: https://crrev.com/76eb976a67273b8c03c744f64ad850b0432554b9
Review-Url: https://codereview.chromium.org/2345593003
Cr-Original-Commit-Position: refs/heads/master@{#39678}
Cr-Commit-Position: refs/heads/master@{#39795}
2016-09-27 20:46:30 +00:00
machenbach
e1eee748dd Revert of [wasm] Master CL for Binary 0xC changes. (patchset id:490001 of https://codereview.chromium.org/2345593003/ )
Reason for revert:
Main suspect for tsan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/11893

Also changes layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10036

+mips builder:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/4032

Original issue's description:
> [wasm] Master CL for Binary 0xC changes.
>
> [0xC] Convert to stack machine semantics.
> [0xC] Use section codes instead of names.
> [0xC] Add elements section decoding.
> [0xC] Decoding of globals section.
> [0xC] Decoding of memory section.
> [0xC] Decoding of imports section.
> [0xC] Decoding of exports section.
> [0xC] Decoding of data section.
> [0xC] Remove CallImport bytecode.
> [0xC] Function bodies have an implicit block.
> [0xC] Remove the bottom label from loops.
> [0xC] Add signatures to blocks.
> [0xC] Remove arities from branches.
> Add tests for init expression decoding.
> Rework compilation of import wrappers and how they are patched.
> Rework function indices in debugging.
> Fix ASM->WASM builder for stack machine.
> Reorganize asm.js foreign functions due to import indices change.
>
> R=ahaas@chromium.org,rossberg@chromium.org,bradnelson@chromium.org
> BUG=chromium:575167
> LOG=Y
>
> Committed: https://crrev.com/76eb976a67273b8c03c744f64ad850b0432554b9
> Cr-Commit-Position: refs/heads/master@{#39678}

TBR=ahaas@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org,rossberg@chromium.org,bradnelson@google.com,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2361053004
Cr-Commit-Position: refs/heads/master@{#39685}
2016-09-23 17:58:24 +00:00
titzer
76eb976a67 [wasm] Master CL for Binary 0xC changes.
[0xC] Convert to stack machine semantics.
[0xC] Use section codes instead of names.
[0xC] Add elements section decoding.
[0xC] Decoding of globals section.
[0xC] Decoding of memory section.
[0xC] Decoding of imports section.
[0xC] Decoding of exports section.
[0xC] Decoding of data section.
[0xC] Remove CallImport bytecode.
[0xC] Function bodies have an implicit block.
[0xC] Remove the bottom label from loops.
[0xC] Add signatures to blocks.
[0xC] Remove arities from branches.
Add tests for init expression decoding.
Rework compilation of import wrappers and how they are patched.
Rework function indices in debugging.
Fix ASM->WASM builder for stack machine.
Reorganize asm.js foreign functions due to import indices change.

R=ahaas@chromium.org,rossberg@chromium.org,bradnelson@chromium.org
BUG=chromium:575167
LOG=Y

Review-Url: https://codereview.chromium.org/2345593003
Cr-Commit-Position: refs/heads/master@{#39678}
2016-09-23 15:56:54 +00:00
ahaas
78b048c077 [wasm] Add hash to the crash message of the correctness fuzzer.
The hash in the crash message is necessary to keep cluster fuzz from
grouping all result mismatches.

R=titzer@chromium.org, mmoroz@chromium.org

Review-Url: https://codereview.chromium.org/2363663002
Cr-Commit-Position: refs/heads/master@{#39625}
2016-09-22 12:55:29 +00:00
heimbuef
7a4f8e4d83 Moved zones and zone related stuff in its own directory.
This is some initial cleanup to keep /src clean. The
AccountingAllocator is actually exclusively used by zones and this
common subfolder makes that more clear.

BUG=v8:5409

Review-Url: https://codereview.chromium.org/2344143003
Cr-Commit-Position: refs/heads/master@{#39558}
2016-09-20 16:08:07 +00:00
gdeepti
dd3b14b7b4 [wasm] Fix test-run-wasm-module tests in debug mode.
test-run-wasm-module cctests broken in debug since recent refactoring changes for moving Compilation/Instantiation off the module object (https://codereview.chromium.org/2320723005). The problem here is that SetupIsolateForWasm tries to add the same property to a module_object multiple times and hits a DCHECK when this property is found on a lookup.
 - Fixed to use the setup method only once when CcTest::InitIsolateOnce is used.
 - Move setup method to test as this is only used for cctests/fuzzers. The install method should take care of this in the regular JS pipeline.

 R=mtrofin@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2342263002
Cr-Commit-Position: refs/heads/master@{#39484}
2016-09-17 01:31:07 +00:00
mtrofin
f87dfb8135 [wasm] C++ style: ErrorThrower& -> ErrorThrower*
All parameters passed by reference must be labeled const.
If the object is mutable, then we pass by pointer.

BUG=

Review-Url: https://codereview.chromium.org/2336233006
Cr-Commit-Position: refs/heads/master@{#39451}
2016-09-15 16:20:07 +00:00
ahaas
cc7926d672 [wasm] Move the wasm-module-runner from test/cctest to test/common
The wasm-module-runner is used both in cctests and in fuzzers. As
discussed offline, it is weird to include cctest header files in
fuzzers, so I introduce a new test/common directory which contains the
common files.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2335193002
Cr-Commit-Position: refs/heads/master@{#39411}
2016-09-14 10:31:53 +00:00
ahaas
19522d8e0f [wasm] Pass the same parameters to the interpreter and the compiled module in the fuzzer.
BUG=chromium:646564

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2336363003
Cr-Commit-Position: refs/heads/master@{#39405}
2016-09-14 08:26:53 +00:00
mtrofin
8e5ac62ddf [wasm] Compilation/Instantiation pipeline works off module object
Moved the compilation/instantiation pipeline to work off the
module object (JSObject), making the compiled module data (the
FixedArray) an implementation detail. This:
- simplifies the code by removing duplicate decode->compile->instantiate
sequences
- sets up the stage for "dressing up" the runtime model with
stronger typed APIs
- helps relanding this CL: https://codereview.chromium.org/2305903002/.
  It turns out that GCs during the cloning/instantiation events cause
trouble, and centering the source of truth on the module object helps
address this issue.

In the process, clarified cctest setup for wasm-capable isolates,
and changed signatures for consistency (using ModuleOrigin througout).

BUG=

Review-Url: https://codereview.chromium.org/2320723005
Cr-Commit-Position: refs/heads/master@{#39360}
2016-09-12 22:11:56 +00:00
ahaas
1521fe9c3c [wasm] Call the wasm interpreter from the wasm-code-fuzzer.
With this CL the wasm-code-fuzzer first decodes and interprets the test
case generated by the fuzzer. It then compiles the test case, but only
executes the compiled instance if the interpretation of the test case
was successful. If the compiled instance is executed, then the result of
the execution is compared with the result of the interpretation.

Additionally this CL refactors the CompileAndRunWasmModule function in
wasm-module.cc to resuse code in the call to the interpreter.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2321443002
Cr-Commit-Position: refs/heads/master@{#39351}
2016-09-12 12:26:46 +00:00
ahaas
cb259fbd39 [wasm] Create a new fuzzer for wasm code.
The new fuzzer constructs a dummy module header and uses the fuzzer
data only as function code.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2280623002
Cr-Commit-Position: refs/heads/master@{#38983}
2016-08-29 13:56:00 +00:00