One more place behind a non-default build flag that needs updating
after the recent Address typedef change.
Change-Id: Ica5022966e7773c621624d1cd5c20296c52c0b39
Reviewed-on: https://chromium-review.googlesource.com/1014320
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52650}
In a recent CL (https://crrev.com/c/1012039) I removed the only valid
use case of {external_reference_redirector}. In this CL I remove the
remaining uses, which are more or less checks if there is a simulator
or not.
R=mstarzinger@chromium.org
Change-Id: I96203b7b112d57bb3feb9d6863b036747b1963f0
Reviewed-on: https://chromium-review.googlesource.com/1014126
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52649}
With this CL we do the redirection of ExternalReferences for simulators
independent of the isolate but instead use the redirector provided by
the simulator directly. Thereby we make the code independent of the
isolate.
I plan to remove the redirector from the isolate in a separate CL.
R=mstarzinger@chromium.org
Change-Id: I2ae0b2184da214cf7606fabeabc9bec35bf0616e
Reviewed-on: https://chromium-review.googlesource.com/1012039
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52648}
These tests fail since instructions were implemented in Liftoff.
Problem was with NaN cases, where additional job has to be done on
MIPS r2, r1 and Longsoon.
Change-Id: Id02462aa08e79b03d66b5083b81f19dc1c88cc3e
Reviewed-on: https://chromium-review.googlesource.com/1015001
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52647}
Class fields needs to be initialized after `this` is bound, as per the
new spec change:
https://github.com/tc39/proposal-class-fields/pull/92
This CL moves the initialization of `this` from parser desugaring to
the bytecode generator.
Bug: v8:7647
Change-Id: I20f749403e5a4d2f06a39726cf39012ceb541987
Reviewed-on: https://chromium-review.googlesource.com/1014383
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52646}
Throw a TypeError if the length of a concat-spreadable object makes the
total length too large, as specified.
Bug: v8:7652
Change-Id: Ie3f694d64c949703edd733c0310cfb3f64b78a15
Reviewed-on: https://chromium-review.googlesource.com/1013714
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52644}
Flattening the string upfront has performance benefits and we can
also simplify the implementation quite a bit.
Bug: v8:6780
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic75bdfdf900d30e51e95cdf1cb8d09aab06332c6
Reviewed-on: https://chromium-review.googlesource.com/1014102
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52643}
This is a reland of f8ae62fe14
Original change's description:
> [heap] Move initial objects into RO_SPACE
>
> This moves:
> * the main oddballs (null, undefined, hole, true, false) as well as
> their supporting maps (also adds hole as an internalized string to make
> this work).
> * most of the internalized strings
> * the struct maps
> * empty array
> * empty enum cache
> * the contents of the initial string table
> * the weak_cell_cache for any map in RO_SPACE (and eagerly creates the
> value avoid writing to it during run-time)
>
> The StartupSerializer stats change as follows:
>
> RO_SPACE NEW_SPACE OLD_SPACE CODE_SPACE MAP_SPACE LO_SPACE
> old 0 0 270264 32608 12144 0
> new 21776 0 253168 32608 8184 0
> Overall memory usage has increased by 720 bytes due to the eager
> initialization of the Map weak cell caches.
>
> Also extends --serialization-statistics to print out separate instance
> type stats for objects in RO_SPACE as shown here:
>
> Read Only Instance types (count and bytes):
> 404 16736 ONE_BYTE_INTERNALIZED_STRING_TYPE
> 2 32 HEAP_NUMBER_TYPE
> 5 240 ODDBALL_TYPE
> 45 3960 MAP_TYPE
> 1 16 BYTE_ARRAY_TYPE
> 1 24 TUPLE2_TYPE
> 1 16 FIXED_ARRAY_TYPE
> 1 32 DESCRIPTOR_ARRAY_TYPE
> 45 720 WEAK_CELL_TYPE
>
> Bug: v8:7464
> Change-Id: I12981c39c82a7057f68bbbe03f89fb57b0b4c6a6
> Reviewed-on: https://chromium-review.googlesource.com/973722
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52435}
Bug: v8:7464
Change-Id: I50427edfeb53ca80ec4cf46566368fb2213ccf7b
Reviewed-on: https://chromium-review.googlesource.com/999654
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52638}
Add a new permission kRead to PageAllocator::Permission and
OS::MemoryPermission and implement it in platform-*.
Not used yet, because it needs corresponding changes in chromium.
Bug: v8:7464
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I9f84251eff593536cbcc1cde04641d696c79d65c
Reviewed-on: https://chromium-review.googlesource.com/1006756
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52636}
Consolidate nearly identical implementations and move them to
TurboAssembler, such that they can be reused for Liftoff.
R=neis@chromium.org
Bug: v8:6600
Change-Id: I197445404df033ac1a05f4aa88501263ae4b75f3
Reviewed-on: https://chromium-review.googlesource.com/1013561
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52634}
Make values which are referenced via ExternalReference constexpr, and
initialize them statically. This avoids dynamic initialization and
protects them against being overwritten from generated code.
R=neis@chromium.org
Bug: v8:7570
Change-Id: I1c6c10fbffea12dc1f5bf726313bf8388e6530a1
Reviewed-on: https://chromium-review.googlesource.com/1013518
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52633}
This doesn't change the API, it just makes it functional: the
functions were declared already, but they lacked an implementation
so far. Trying to use them in Blink detects that issue.
Bug: v8:6791
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I48902a5bba4a42f2922eafd22858d584731fc777
Reviewed-on: https://chromium-review.googlesource.com/1014668
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52632}
Casting from a floating-point type to an integer type is undefined behavior
if the integral part of the float cannot be represented in the range of the
int.
Bug: v8:3770, chromium:831145
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2e85ea8b0f09bbeeb3e0dcc1135fc747fa312f6d
Reviewed-on: https://chromium-review.googlesource.com/1011651
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52631}
Now that tables and stack frames properly root instances, there is no
longer any need to disallow mutations that could unroot instances
while their code is on the stack.
Bug: v8:7232
Change-Id: I907b9522ac12ad7a67fb4124774713b6b3b40bb7
Reviewed-on: https://chromium-review.googlesource.com/1007004
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52629}
This removes the support to serialize copies of {CodeStub} codes during
native module serialization. It is still possible to serialize builtins
and all code objects copied from the GC heap are builtins by now.
R=ahaas@chromium.org
Change-Id: If009a82a9d7c7080f70f344040ebb91f20b8cc1a
Reviewed-on: https://chromium-review.googlesource.com/1012081
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52628}
This will give us much better testing coverage for trap-based bounds
checks.
Note that this will not enable the trap handler by default in Chrome.
Instead, Chrome will need to explicitly enable the feature using
V8::EnableWebAssemblyTrapHandler.
Bug: v8:5277
Change-Id: I7d81f40c6f831c6fe7926375c677908952b78fa2
Reviewed-on: https://chromium-review.googlesource.com/964711
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52627}
This adds another fixed spill slot to the {WasmCompiledFrame} layout,
holding a reference to the current {WasmInstanceObject}. This slot
allows the stack walker to retrieve instances for WebAssembly frames
without having each code object be coupled to an instance. Hence it
enables sharing code across instances in the future.
R=titzer@chromium.org
BUG=v8:7424
Change-Id: I7fa095c6255754caf564edce4ee7e84dea666783
Reviewed-on: https://chromium-review.googlesource.com/1005516
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52626}
The Cvtui2ss method did overwrite the {src} register, and the given
{tmp} register. Because of this, the Turbofan code generator passed two
temporary registers.
This CL fixes this to avoid the overwrite of the {src} register (which
is now an Operand).
R=neis@chromium.org
Change-Id: I33e523ac3d7bb377899739e95058b87adefa6b65
Reviewed-on: https://chromium-review.googlesource.com/1014082
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52625}
If the new length is too large, we must throw a TypeError.
Bug: v8:7652
Change-Id: I47268c04405f7a5f5bbc971cd434f2d786af9ca1
Reviewed-on: https://chromium-review.googlesource.com/1013563
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52624}
At is used in Macro Assembler, so we need other registers to hold temporary values.
Change-Id: Iffeddba7b3319666a605eea62ecc3cd01b065ad7
Reviewed-on: https://chromium-review.googlesource.com/1013978
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52623}
First version which can compile a very basic code.
Change-Id: I3b98412a5ca39a28f8fe5b60516b82c6981dd187
Reviewed-on: https://chromium-review.googlesource.com/993232
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52622}
Name type conversions from int to float and vice versa consistently,
and move them to the TurboAssembler, such that we can reuse them for
Liftoff.
R=jarin@chromium.org
Bug: v8:6600
Change-Id: Idced658a228eeb611dd4785aa277bd758c201eea
Reviewed-on: https://chromium-review.googlesource.com/1014037
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52620}
An overview of motivation behind Torque and some of its principles
can be found here: https://bit.ly/2qAI5Ep
Note that there is quite a bit of work left to do in order to get
Torque production-ready for any non-trivial amount of code, but
landing the prototype as-is will allow for much faster iteration.
Bugs will be filed for all of the big-ticket items that are not
landing blockers but called out in this patch as important to fix.
Cq-Include-Trybots: luci.v8.try:v8_linux_nosnap_rel;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ib07af70966d5133dc57344928885478b9c6b8b73
Reviewed-on: https://chromium-review.googlesource.com/845682
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52618}
The recent changes related to the Address type broke this.
R=bmeurer@chromium.org
Change-Id: I404930435e9f48750a735beed7d79108b9cc96ee
Reviewed-on: https://chromium-review.googlesource.com/1014081
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52616}
Previously Isolate and Factory relied on the undefined behavior of
reinterpret_cast to switch between the two unrelated classes (which worked
because Factory had no data members).
With Isolate inheriting from Factory, it's now possible to switch between the
two classes using c-style casts. These are allowed under the C++ standard.
The inheritance is private which allows the continuing separation of the
Factory and Isolate namespaces.
This is a defensive clean-up, since ubsan does not yet detect the previous
undefined behavior.
Bug: v8:3770
Change-Id: I0ccf09f1d34f747550812ce698ab7e182812409e
Reviewed-on: https://chromium-review.googlesource.com/1010122
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52615}
The embedder should not need to keep track of the source string.
R=jgruber@chromium.org
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ie27df755a22fbcae7b6e87a435419d2d8f545558
Reviewed-on: https://chromium-review.googlesource.com/1013482
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52614}
This adds tests for 'oddly' behaving comparison functions.
I.e. functions that cause an element kind change and/or
modify the array. The tests check that sort does not crash in these
instances.
R=jgruber@chromium.org
Bug: v8:7382
Change-Id: I4ac9aa081fda9088d1848a960dc66aba671872e5
Reviewed-on: https://chromium-review.googlesource.com/1010062
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52612}
Per the spec change at [1], Abstract Relational Comparison between a
BigInt and a String converts the String to BigInt via StringToBigInt
before performing the comparison. Before this change, the String was
converted to a Number, and a BigInt/Number comparison was performed.
[1] https://github.com/tc39/proposal-bigint/pull/139
Bug: v8:6791
Change-Id: I40b4f4ddc78977adb0d44180eb58e0f9a8a70cb6
Reviewed-on: https://chromium-review.googlesource.com/1004117
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52609}
Port 2459046c1d
Original Commit Message:
The "Address" type is V8's general-purpose type for manipulating memory
addresses. Per the C++ spec, pointer arithmetic and pointer comparisons
are undefined behavior except within the same array; since we generally
don't operate within a C++ array, our general-purpose type shouldn't be
a pointer type.
R=jkummerow@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: Ic30ef19019e5b39b01f90587011c6a1b06c4b7a1
Reviewed-on: https://chromium-review.googlesource.com/1012461
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52607}
Port a3b6067525
Original Commit Message:
This is mostly a simple copy & paste of the stub implementation from
code-stubs-arch.cc to builtins-arch.cc.
The conversion allows removal of a special case for the DoubleToIStub
within the compiler & wasm pipelines, and also makes the following
builtins isolate-independent (in conjunction with
https://crrev.com/c/1006581):
TFC BitwiseAnd
TFC BitwiseOr
TFC BitwiseXor
TFC Exponentiate
TFC ShiftLeft
TFC ShiftRight
TFC ShiftRightLogical
TFJ AtomicsAdd
TFJ AtomicsAnd
TFJ AtomicsCompareExchange
TFJ AtomicsExchange
TFJ AtomicsLoad
TFJ AtomicsOr
TFJ AtomicsStore
TFJ AtomicsSub
TFJ AtomicsXor
TFJ MathClz32
TFJ MathImul
TFJ MathPow
TFJ NumberParseInt
TFJ StringFromCharCode
TFJ TypedArrayFrom
TFJ TypedArrayOf
TFJ TypedArrayPrototypeMap
R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: Iee9fc5671646772625556717db052b78089c5c66
Reviewed-on: https://chromium-review.googlesource.com/1013247
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52606}
Port 87557649e4
Original Commit Message:
This changes DoubleToIStub to return its result on the stack instead
of a specific return register.
In a follow-up, the DoubleToIStub could be converted into a builtin.
R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: I952fec4fbe004e2734a84ba853f4f5a33c8dd8ce
Reviewed-on: https://chromium-review.googlesource.com/1013418
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52605}
