Commit Graph

57793 Commits

Author SHA1 Message Date
Georgia Kouveli
7cb9984ef9 [arm64] Add support for pointer authentication instructions
Change-Id: I29c88d9e5de34e9a940b76ab76a40376d251c25f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1373781
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62901}
2019-07-24 17:00:26 +00:00
Bill Budge
95c7148d82 [wasm simd] Fix two reversing swizzles.
- Fixes bugs in x64 and ia32 reversing swizzles.

Change-Id: Iea0beccab804fd8e68dc58bc0fa11db46ac391c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1330104
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62900}
2019-07-24 16:41:15 +00:00
Zhi An Ng
6747e3a186 Revert "Add postmortem debugging helper library"
This reverts commit 517ab73fd7.

Reason for revert: Test failures https://bugs.chromium.org/p/v8/issues/detail?id=9538

Original change's description:
> Add postmortem debugging helper library
> 
> This change begins to implement the functionality described in
> https://docs.google.com/document/d/1evHnb1uLlSbvHAAsmOXyc25x3uh1DjgNa8u1RHvwVhk/edit#
> for investigating V8 state in crash dumps.
> 
> This change adds a new library, v8_debug_helper, for providing platform-
> agnostic assistance with postmortem debugging. This library can be used
> by extensions built for debuggers such as WinDbg or lldb. Its public API
> is described by debug-helper.h; currently the only method it exposes is
> GetObjectProperties, but we'd like to add more functionality over time.
> The API surface is restricted to plain C-style structs and pointers, so
> that it's easy to link from a debugger extension built with a different
> toolchain.
> 
> This change also adds a new cctest file to exercise some basic
> interaction with the new library.
> 
> The API function GetObjectProperties takes an object pointer (which
> could be compressed, or weak, or a SMI), and returns a string
> description of the object and a list of properties the object contains.
> For now, the list of properties is entirely based on Torque object
> definitions, but we expect to add custom properties in future updates so
> that it can be easier to make sense of complex data structures such as
> dictionaries.
> 
> GetObjectProperties does several things that are intended to generate
> somewhat useful results even in cases where memory may be corrupt or
> unavailable:
> - The caller may optionally provide a type string which will be used if
>   the memory for the object's Map is inaccessible.
> - All object pointers are compared against the list of known objects
>   generated by mkgrokdump. The caller may optionally provide the
>   pointers for the first pages of various heap spaces, to avoid spurious
>   matches. If those pointers are not provided, then any matches are
>   prefixed with "maybe" in the resulting description string, such as
>   "maybe UndefinedValue (0x4288000341 <Oddball>)".
> 
> Bug: v8:9376
> 
> Change-Id: Iebf3cc2dea3133c7811bcefcdf38d9458b02fded
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628012
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62882}

TBR=yangguo@chromium.org,mvstanton@chromium.org,jgruber@chromium.org,tebbi@chromium.org,seth.brenith@microsoft.com

Change-Id: Ia078f2e8d101d2375b5db88021b2d65d28f1b075
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9376
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716033
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62899}
2019-07-24 16:31:54 +00:00
Leszek Swirski
db37c0fb95 [parser] Templaterificate ScopedPtrList into ScopedList
This will allow us to use ScopedPtrList for other contents than just
pointers.

Change-Id: Ib16d388d5dd556f5e01593279f463ae25510f2be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715455
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62898}
2019-07-24 15:09:43 +00:00
Milad Farazmand
6cd231bc41 PPC/s390: [wasm] Access "CEntryStub" from the root set.
Port 55643564a6

Original Commit Message:

    This removes a shortcut to a "CEntryStub" from the instance object and
    instead loads those values via the root set which is also referenced
    from the instance. It makes instance objects smaller.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2ad2f3479431dae71f47af7ad5c722e46fd592d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716368
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62897}
2019-07-24 14:09:03 +00:00
Sathya Gunasekaran
cceeba8f5d Revert "[turbofan] Brokerize Function.prototype.bind"
This reverts commit 49f8323f7c.

Reason for revert: breaks https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/21302

Original change's description:
> [turbofan] Brokerize Function.prototype.bind
> 
> Bug: v8:7790
> Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62895}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I7cf4ca1ef50d5d467484b94e067f7fc1b54d7a94
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715454
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62896}
2019-07-24 13:50:34 +00:00
Maya Lekova
49f8323f7c [turbofan] Brokerize Function.prototype.bind
Bug: v8:7790
Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62895}
2019-07-24 13:20:03 +00:00
Maya Lekova
629d3c8521 Reland "[turbofan] Make code and comment match in FastFunctionPrototypeBind"
This is a reland of 7ba8e662cc

Fixed unresolved symbol error on CFI build.

Original change's description:
> [turbofan] Make code and comment match in FastFunctionPrototypeBind
>
> Additionally, used number of own descriptors in both CSA and the
> reduction of Function.prototype.bind.
>
> Change-Id: I7b86e059d20faa1160cdc0126932fff924226eee
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714655
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62885}

Change-Id: If4d6b4c963a089dca09dd9aa9ec94784b3a21825
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715450
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62894}
2019-07-24 12:36:43 +00:00
Rong Wang
b2140c59d0 Add a flag for enabling the single generation mode in V8
This flag ensures that all allocations are performed in the old generation. This only works when inline allocation and allocation folding are both disabled.

Bug: v8:9533

Change-Id: I9ad5e8bf492c43603ab2a4a1292198e1b9882dfe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710335
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62893}
2019-07-24 11:25:03 +00:00
Maya Lekova
e8571c6ab1 [turbofan] Brokerize array builtins reductions
Bug: v8:7790
Change-Id: I3f0cf874eb77b803e35ee934b7b18bc0f64dc23f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714651
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62892}
2019-07-24 10:47:23 +00:00
Simon Zünd
4a0cf0b92d [stack-trace] Cache source position for JavaScript stack frames
Retrieving the source position for a JavaScript stack frame is a
costly operation (it requires decoding the source position table).

The source position is usually retrieved twice, once for the line
number, and once for the column number.

This CL caches the resolved source position the first time around,
improving relevant stack trace serialization micro benchmarks by ~6%.

R=jgruber@chromium.org

Bug: v8:8742
Change-Id: Ife9903208d2be100e272ccad805a77c33e0df93a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715447
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62891}
2019-07-24 10:33:32 +00:00
Santiago Aboy Solanes
bd70a600ba [turbofan][cleanup] Remove redundant clause in WriteBarrierKindFor
The if above asks for field_representation to have Compressed or Any
Machine Representation. Therefore, it can never be Signed.

The functionality doesn't change. If field_representation is Signed,
it will hit the kNoWriteBarrier at the bottom.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:9396
Change-Id: I39eff3ae082e91d0494134b053c353a2c0ff02c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1702615
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62890}
2019-07-24 10:12:35 +00:00
Clemens Hammacher
f6dfd2dcd3 [Liftoff] Runtime call arguments are always on the stack
This removes dead code handling register arguments to runtime calls,
which do not exist currently.

R=mstarzinger@chromium.org

Change-Id: Ia5fdd60d0036f87a335bbe42b5790d1b86aa0add
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715448
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62889}
2019-07-24 10:07:04 +00:00
Michael Starzinger
55643564a6 [wasm] Access "CEntryStub" from the root set.
This removes a shortcut to a "CEntryStub" from the instance object and
instead loads those values via the root set which is also referenced
from the instance. It makes instance objects smaller.

R=clemensh@chromium.org

Change-Id: I2e77cf2cb6949873bb461fb1ed0787e4a413aa5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714656
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62888}
2019-07-24 10:04:05 +00:00
Santiago Aboy Solanes
8881fac82e [ptr-compr] Specialize decompression with known Machine Representation
If we already know it has CompressedPointer representation, let's use
that information to decompress more efficiently.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I3591bf67a7c0369c40ca6e7af16183530f8cd269
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709049
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62887}
2019-07-24 09:32:05 +00:00
Maya Lekova
a2e2ee8775 Revert "[turbofan] Make code and comment match in FastFunctionPrototypeBind"
This reverts commit 7ba8e662cc.

Reason for revert: Breaks CFI - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/21295

Original change's description:
> [turbofan] Make code and comment match in FastFunctionPrototypeBind
> 
> Additionally, used number of own descriptors in both CSA and the
> reduction of Function.prototype.bind.
> 
> Change-Id: I7b86e059d20faa1160cdc0126932fff924226eee
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714655
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62885}

TBR=neis@chromium.org,jgruber@chromium.org,mslekova@chromium.org

Change-Id: I6a92741c214f8b86702445c60a311cc4800593e9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715449
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62886}
2019-07-24 09:18:46 +00:00
Maya Lekova
7ba8e662cc [turbofan] Make code and comment match in FastFunctionPrototypeBind
Additionally, used number of own descriptors in both CSA and the
reduction of Function.prototype.bind.

Change-Id: I7b86e059d20faa1160cdc0126932fff924226eee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714655
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62885}
2019-07-24 08:58:48 +00:00
Tianyou Li
2172f16cf0 fix windows build issue
In windows, even use clang build, the V8_LIBC_MSVCRT was set to indicate use MSVC runtime libraries. Change to use __clang__ to determine enable cpuid magic inline assembly or not.

Change-Id: I7372a27b311b695f019c5ff2d42b691d749eb607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715332
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Tianyou Li <tianyou.li@intel.com>
Cr-Commit-Position: refs/heads/master@{#62884}
2019-07-24 08:44:10 +00:00
Jakob Gruber
d267c3373f [compiler] Allocate in a temporary zone inside ComputeLoopState
Even in the most basic case (the task queue only ever contains a single
element), this function triggers ~4KB in zone allocations. These
allocations are basically lost and can never be reused. Avoid this by
allocating inside a new temporary zone that is only alive during the
ComputeLoopState function call.

This reduces allocation size for the zone used during load elimination
from ~30KB to ~15KB when compiling a trivial for-loop example.

An alternative solution would be to switch to something similar to
SmallVector (which uses a statically-sized stack storage before
switching to heap allocations), but based on zones instead of malloc.

Bug: v8:9427,v8:6150
Change-Id: Ic25abe6d48ac718c9ced2f9ef581f244030980fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714869
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62883}
2019-07-24 07:13:38 +00:00
Seth Brenith
517ab73fd7 Add postmortem debugging helper library
This change begins to implement the functionality described in
https://docs.google.com/document/d/1evHnb1uLlSbvHAAsmOXyc25x3uh1DjgNa8u1RHvwVhk/edit#
for investigating V8 state in crash dumps.

This change adds a new library, v8_debug_helper, for providing platform-
agnostic assistance with postmortem debugging. This library can be used
by extensions built for debuggers such as WinDbg or lldb. Its public API
is described by debug-helper.h; currently the only method it exposes is
GetObjectProperties, but we'd like to add more functionality over time.
The API surface is restricted to plain C-style structs and pointers, so
that it's easy to link from a debugger extension built with a different
toolchain.

This change also adds a new cctest file to exercise some basic
interaction with the new library.

The API function GetObjectProperties takes an object pointer (which
could be compressed, or weak, or a SMI), and returns a string
description of the object and a list of properties the object contains.
For now, the list of properties is entirely based on Torque object
definitions, but we expect to add custom properties in future updates so
that it can be easier to make sense of complex data structures such as
dictionaries.

GetObjectProperties does several things that are intended to generate
somewhat useful results even in cases where memory may be corrupt or
unavailable:
- The caller may optionally provide a type string which will be used if
  the memory for the object's Map is inaccessible.
- All object pointers are compared against the list of known objects
  generated by mkgrokdump. The caller may optionally provide the
  pointers for the first pages of various heap spaces, to avoid spurious
  matches. If those pointers are not provided, then any matches are
  prefixed with "maybe" in the resulting description string, such as
  "maybe UndefinedValue (0x4288000341 <Oddball>)".

Bug: v8:9376

Change-Id: Iebf3cc2dea3133c7811bcefcdf38d9458b02fded
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628012
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62882}
2019-07-23 20:02:16 +00:00
Ulan Degenbaev
1320c917dd [snapshot] Fix clearing of feedback vector in serializer (follow-up 2)
Bug: v8:7857
Change-Id: I3940ae2830adb6c572e079551b7bba7d84462afd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715444
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62881}
2019-07-23 18:55:07 +00:00
Ulan Degenbaev
0edea399dc [snapshot] Fix clearing of feedback vector in serializer (follow-up)
The fix in https://chromium-review.googlesource.com/c/v8/v8/+/1698383
was not complete. We can have a case when a function is neither
optmized or intepreted but still has a feedback vector. This can
happen when the code of the function was flushed.

Bug: v8:7857
Change-Id: I9cb6e474d79a5d4956301e87705af136baeaeb8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714875
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62880}
2019-07-23 15:56:56 +00:00
Mythri A
21f796df44 [ic] Pass the converted value to the runtime when storing to a typed array
Preparing the value for storing into a typed array is user visible
operation in some cases (for ex: calling ToNumber). To avoid doing this
conversion twice pass the converted to the runtime when bailing out
from the handlers.

Bug: chromium:981236
Change-Id: I3de23d317d22cd6c201fe8a4db30014f4cf76251
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692932
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62879}
2019-07-23 15:53:56 +00:00
Georg Schmid
1d9a5d88b0 [torque] Add Generic Structs
This CL introduces generic Torque structs. Generics are grounded early in the Torque compilation pipeline, meaning that every instantiation of a generic struct with concrete types will be turned into a distinct StructType.

As an example, consider a Tuple of types T1, T2:

  struct Tuple<T1: type, T2: type> {
    const fst: T1;
    const snd: T2;
  }

which can be manipulated using generic macros, such as

  macro Swap<T1: type, T2: type>(tuple: Tuple<T1, T2>): Tuple<T2, T1> {
    return Tuple<T2, T1>{fst: tuple.snd, snd: tuple.fst};
  }

Currently there is no type inference for struct instantiation sites, so type arguments have to be provided explicitly:

  const intptrAndSmi = Tuple<intptr, Smi>{fst: 1, snd: 2};

R=sigurds@chromium.org, tebbi@chromium.org

Change-Id: I43111561cbe53144db473dc844a478045644ef6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714868
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62878}
2019-07-23 15:26:16 +00:00
Sathya Gunasekaran
bbb833c9e2 [test262] Triage weakref tests status
Bug: v8:8179
Change-Id: Iccc3569fd59a2fdf7af708aacb404452289d5225
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714874
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62877}
2019-07-23 15:05:05 +00:00
Sathya Gunasekaran
15df975e08 [WeakRefs] Fix toStringTag
Bug: v8:8179
Change-Id: I45f9b1c462edcc984d2b8cdc6c767c00e9f8cf64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714873
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62876}
2019-07-23 14:26:41 +00:00
Maya Lekova
62c9ad5b0f Revert "[d8] Cleanup message queues"
This reverts commit 26dad80ff5.

Reason for revert: Breaks d8, see https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/22272

Original change's description:
> [d8] Cleanup message queues
> 
> Simplifies some of the logic of message queues in d8 and makes sure
> to delete any in-flight messages upon worker termination. Drive-by
> cleanups of some other small d8 vestiges.
> 
> R=​clemensh@chromium.org
> BUG=v8:9524
> 
> Change-Id: I587c0cb3eeed88107e7dba552389057f07c15c43
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710673
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62873}

TBR=titzer@chromium.org,clemensh@chromium.org

Change-Id: Ibc15d9fb76698a2bad51e3842392634fb2f0246b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9524
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714877
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62875}
2019-07-23 14:25:38 +00:00
Sathya Gunasekaran
c0943a50ad [test262] Expose gc() to test262 harness
test262 tests use this to trigger a gc and test WeakRefs

Bug: v8:8179
Change-Id: I84ca88f0bf11734ea65d7f6c2a5e5e2d13dccb7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714871
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62874}
2019-07-23 14:09:05 +00:00
Ben L. Titzer
26dad80ff5 [d8] Cleanup message queues
Simplifies some of the logic of message queues in d8 and makes sure
to delete any in-flight messages upon worker termination. Drive-by
cleanups of some other small d8 vestiges.

R=clemensh@chromium.org
BUG=v8:9524

Change-Id: I587c0cb3eeed88107e7dba552389057f07c15c43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710673
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62873}
2019-07-23 14:01:26 +00:00
Santiago Aboy Solanes
02c81cbecb [ptr-compr][arm64] Update poison test regex
We now have branchful decompression so this needs to be updated. Also,
the sxtw doesn't happen so it is not included in the regex.

I don't know why this didn't block the other CL's submission.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I7044878c4811f1ba39e957bfcb9bc9c77ccba172
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1706482
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62872}
2019-07-23 13:22:55 +00:00
Santiago Aboy Solanes
d6b6565829 [ptr-compr] Add CheckedInt32ToCompressedSigned and use it
Also add tests for it.

Drive-by fix: Use ChangeInt32ToCompressedSmi since we have it

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I45f04f8857acfc57b69eb4022a24ba082d28a91f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708480
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62871}
2019-07-23 13:19:55 +00:00
Sathya Gunasekaran
dabbe5ee24 [WeakRefs] Make FinalizationGroup#register throw if token isn't an object
Bug: v8:8179
Change-Id: I6a4d7e899076fadf848c187f9f4d86a676455215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714865
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62870}
2019-07-23 12:38:55 +00:00
Sathya Gunasekaran
f0c5edcdeb [WeakRefs] Install native context slot index on constructors
This will be used when the [[NewTarget]] is from another realm and
it's prototype is not an object.

Bug: v8:8179
Change-Id: Ic69db3cd95753c77ef6f1e677e71e1e20da0a6c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714864
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62869}
2019-07-23 12:29:46 +00:00
Sathya Gunasekaran
2d4e4fdc1c [WeakRefs] Allow WeakRef and FinalizationGroups to be subclassable
Bug: v8:9433, v8:8179
Change-Id: I10a643cac348a5a76b137427e5e0565db81e3dbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714649
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62868}
2019-07-23 12:27:15 +00:00
Ben L. Titzer
845b47a1d2 Revert "Reland "Reland "[arraybuffer] Rearchitect backing store ownership"""
This reverts commit 306cf40344.

Reason for revert: performance regressions / too near branch point

TBR=mslekova@chromium.org
BUG=v8:9380

Change-Id: If77630b73eafbf1190c823199fe2a34361da303f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714867
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62867}
2019-07-23 12:25:16 +00:00
Ben L. Titzer
9f1a7d3aa0 [arraybuffer] Use relaxed load/store for bitfield
A benign datarace can occur between the array buffer tracker and
using an arraybuffer as an asm.js memory. The former reads the
{is_shared} bit, which should never change, and the latter writes
the {is_asmjs_memory} bit, but no other bits. Since these bits are
packed into a single word, TSAN reports a race.

R=ulan@chromium.org
BUG=v8:9531

Change-Id: Icceff211368e13794b6678b5fd7748fb5b3235bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714647
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62866}
2019-07-23 10:12:26 +00:00
Sathya Gunasekaran
b6477a7ff9 [WeakRefs] Fix FinalizationGroup.prototype.{register, cleanupSome}.length
Bug: v8:8179
Change-Id: I4db5412b5ed60aa100198628bfa09903c89a5c0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710675
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62865}
2019-07-23 09:21:34 +00:00
Mythri A
2c95484ae7 Reland [cleanup][test] split es6/classes.js into different tests
Reland after splitting large classes further.

es6/classes.js is large and causes timeouts and OOM on some of the
configurations.

Bug: v8:9246
Change-Id: I51952447eb6a6b46d78410d5d3798292f5a8d87d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1706061
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62864}
2019-07-23 09:13:26 +00:00
Ulan Degenbaev
1c2141aea5 [runtime] Read and write layout descriptor words with atomics
This fixes benign data races reported by TSAN when a shared layout
descriptor is updated at the end.

Change-Id: I76662cb5fc2b8ab1728e3d1bf42a55a107442eed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709422
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62863}
2019-07-23 09:10:44 +00:00
Maya Lekova
b9d3651e3c [turbofan] Fix wrong expectation when serializing API calls
Bug: v8:7790, chromium:985660
Change-Id: I4e931a4a23421982f05e16c8ffa2ccc68fb34b63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709423
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62862}
2019-07-23 08:54:54 +00:00
Pierre Langlois
f641d987a4 [ptr-compr][arm64] Use correct immediate range for kArchStoreWithBarrier.
With compressed pointers, `kArchStoreWithBarrier` is a 32-bit store instead of
64-bit, and this means the index has a differerent immediate range.

Bug: v8:7703
Change-Id: If61c8544b0da87ba2779ba2c1a6963b52e3e5d9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710674
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62861}
2019-07-23 07:57:14 +00:00
Michael Starzinger
953f373265 [wasm] Access "undefined" and "null" from the root set.
This removes two shortcuts ("UndefinedValue" and "NullValue") from the
instance object and instead loads those values via the root set which is
also referenced from the instance. It makes instance objects smaller.

Note that this also contains an optimization to make sure "undefined" is
only loaded once and then re-used within a single wrapper.

R=clemensh@chromium.org

Change-Id: I421f202230e91790fa9c8263770b4e4bbd3c47bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710670
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62860}
2019-07-23 07:38:44 +00:00
Yang Qin
c3e7eb19e8 [s390]tm family test: change a label name
Change-Id: I43f342c3552e195fe5d96b07c93be7bfef5a708a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1713006
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62859}
2019-07-22 20:05:10 +00:00
Debrian Figueroa
15103f0933 Add json output arg to mg gen and analyze.
Allows writing of output error to json output path specified.

Bug: chromium:985959
Change-Id: I4bbc94dbc8b0c21f1ce75e722c69fab18eeb1f01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710205
Commit-Queue: Debrian Figueroa <debrian@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62858}
2019-07-22 19:33:20 +00:00
Deepti Gandluri
a942ed2762 Add DCHECKS for SSE instructions
Change-Id: I27f960268ae3aaf61ae8d7903e1b3b057e5d5ac8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710158
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62857}
2019-07-22 18:55:10 +00:00
Frank Tang
76f789c334 [Intl] Fix crash bug of formatToParts and -0
1. Fix formatToParts show "plusSign" for -0 by using signbit instead of < 0
2. Fix crash bug of formatToParts while notation is either "engineering" or
   "scientific".

Bug: v8:9513
Change-Id: I36b0b995c157dc642b9c201694d0ac0bb0396988
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710148
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62856}
2019-07-22 17:28:20 +00:00
Adam Klein
40624b5b41 [runtime] Always throw when asked to make an array's length configurable
Previously, if the new length was less than the current length, we ignored
the "configurable" value and set the length as requested. We already threw
if the new length was greater than or equal to the current length.

New behavior matches the spec and other implementations.

Bug: v8:9460
Change-Id: Idb92fd121bdaa707f6abd2d2082628bbf3541b83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709336
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62855}
2019-07-22 17:16:10 +00:00
Ng Zhi An
c172ab13b6 [wasm simd] Refactor F64x2 Neg and Abs to reuse existing SSE codegen
Bug: v8:8460
Change-Id: I1d05e8a832d1b70f07c6782669c7b07764c7341d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708454
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62854}
2019-07-22 17:14:00 +00:00
Milad Farazmand
99169dbfc3 PPC: [wasm][tests] Add proposal tests to the wasm spec tests
Port cd34523b9b

Original Commit Message:

    With this CL we add proposal tests to the wasm-spec-tests. For this I
    extended the update-wasm-spec-tests.sh script. Additionally to
    generating the spec tests it does the following:

    For each proposal it identifies those tests that are different to the
    spec tests, and then copies those tests also to the wasm-spec-tests
    directory.

    Additionally I adjusted the test runner of the wasm spec test to
    run the proposal tests with the correct flags.

R=ahaas@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ia976d8017cacb61b46fe076c39ade6bc6137b7e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708989
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62853}
2019-07-22 16:54:20 +00:00
Yang Qin
dffa5284b6 s390: add if statement to check if SIMD instructions are available
Added if statements to check if VECTOR_FACILITY are supported in order to avoid “illegal instruction” errors during SIMD tests on old s390 machines.

Change-Id: I1ab841db02e6c47de54d4a15b973e5366f88e117
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1704937
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62852}
2019-07-22 14:37:56 +00:00