Commit Graph

78384 Commits

Author SHA1 Message Date
Lei Zhang
3cc6fc8538 Remove unused code in swiss-hash-table-helpers.h.
This code looks like it was copied over of Abseil. However, parts of it
are not used anywhere, aside from their own unit tests, so delete them.
The unused functions are:

- MatchEmptyOrDeleted()
- CountLeadingEmptyOrDeleted()
- ConvertSpecialToEmptyAndFullToDeleted()

In turn, _mm_cmpgt_epi8_fixed() is also unused and can be deleted.

Bug: v8:11388
Change-Id: I35b84600690e6f044a1d5ab4bf41e7f67fb76d87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3965230
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83892}
2022-10-24 17:31:02 +00:00
Victor Gomes
815b33f3a4 [maglev] Inline StringFromCharCode
... as an example of a simple builtin.

Bug: v8:7700
Change-Id: I4eb3479c04066cf4860d1fc28d5f7e9c758a6375
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974773
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83891}
2022-10-24 17:30:00 +00:00
Matthias Liedtke
8f3047531d [wasm] ref.call: Consume sig index immediate
Follow-up to commit 6168782925
With this change 0x14 now also consumes a sig index immediate.
This will allow users to switch from 0x17 back to 0x14 without
breaking changes. After another grace period, 0x17 can be removed.

Change-Id: I5d0039fd1ca9d62c3d42e5834fe7924de45ad7ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974512
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83890}
2022-10-24 17:28:54 +00:00
Clemens Backes
35cc93aa42 [wasm] Detemplatize immediates
The wasm decoder immediates are currently templatized by the {validate}
enum value. They do not need to be though; the only difference is in the
constructor, so the constructor should be templatized instead.

This CL implements that, and also changes the {validate} enum to be a
tag (a typename) instead. This is needed in order to enable template
parameter deduction for the constructor calls (C++ does not allow to
explicitly define the template parameter at constructor calls).

As a nice side effect, this produces nicer symbolized stack traces.
Before:
v8::internal::wasm::Decoder::read_u32v<(v8::internal::wasm::Decoder::ValidateFlag)1>
After:
v8::internal::wasm::Decoder::read_u32v<v8::internal::wasm::Decoder::BooleanValidationTag>

R=jkummerow@chromium.org

Change-Id: I013c909ebaf2c8c495f32b5ce598905f3eccc3ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973267
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83889}
2022-10-24 17:27:49 +00:00
Michael Achenbach
4b28d53011 Revert "[turbofan] Optimize rab/gsab-backed TypedArrays and DataViews"
This reverts commit bd590292b3.

Reason for revert:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/25069/overview

Original change's description:
> [turbofan] Optimize rab/gsab-backed TypedArrays and DataViews
>
> This CL adds TurboFan optimizations for length and element access
> of TypedArrays and DataViews that are rab/gsab-backed.
>
> To enable this optimization, this CL builds the necessary machinery
> required to allow machine operators at the front of the pipeline
> (before simplified lowering). Some key changes to allow this are:
>  - Introduce Type::Machine() to allow the typer and the verifier to
>    provide a type to those machine operators in parts of the pipeline
>    that require nodes to be typed.
>  - Add EnterMachineGraph and ExitMachineGraph operators that define
>    the boundary between early machine graphs and the normal graph with
>    JS semantics.
>  - Give Branch operators a BranchSemantics parameter to distinguish
>    between machine branches (condition is a machine level value) and
>    JS branches (condition is a JS boolean value) and have phases that
>    handle branches decide on the branch's semantics based on this
>    parameter instead of the position in the pipeline.
>  - Extend SimplifiedLowering and SimplifiedLoweringVerifier to handle
>    machine graphs. In particular, constants required special handling,
>    because they are cached in the graph but they may have uses in both
>    a machine and the JS graph, which prevents consistent typing of
>    them.
>  - Moved lots of logic from JSCallReducerAssembler into
>    [JS]GraphAssembler such that functionality can be shared between
>    different phases (e.g. JSNativeContextSpecialization and
>    JSCallReducer need to generate logic to compute a TypedArray's
>    byte length). Extended assembler interface in general with
>    additional TNode<> overloads.
>
>
> Bug: v8:11111, chromium:1358505
> Change-Id: Ife006b8c38a83045cd3b8558acbfdcb66408891f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3898690
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83881}

Bug: v8:11111, chromium:1358505
Change-Id: Ifa7b81523237ebda941cab2feed42c176846b618
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3976028
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83888}
2022-10-24 17:09:09 +00:00
Andreas Haas
66ba7b54eb [wasm] Update spec tests
R=clemensb@chromium.org

Bug: v8:10994
Change-Id: I1eb84b1eb35b546473db0c843f11ac965b4f7b2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974689
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83887}
2022-10-24 14:27:58 +00:00
Maya Lekova
bf0bd4868d [fastcall] Disable fast calls with stack args on M1
Bug: v8:13171
Change-Id: I549d942d8ae24e2de0aa3202d7400b587254fb75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963995
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83886}
2022-10-24 14:23:17 +00:00
Qifan Pan
1806ad7313 [mjsunit] Fix flaky deopt loop tests
Bug: v8:13408, v8:9407
Change-Id: I2f7eefde11c63517bb59036b38ca20173a0adf03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971367
Auto-Submit: Qifan Pan <panq@google.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#83885}
2022-10-24 14:19:18 +00:00
Victor Gomes
1438c36db7 [maglev] Fix clobbering inputs in StringAt
We should not clobber the input registers in the codegen
of a Maglev IR.

We use a new temporary register instead.

Bug: v8:7700
Change-Id: Icacbee4e030f426001c224e25aed6ce86ad8b811
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973311
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83884}
2022-10-24 14:05:18 +00:00
Fanchen Kong
086d92d4f3 [turbofan] Fix bug in gasm and add tests.
This CL fixes bug introduced with https://chromium-review.googlesource.com/c/v8/v8/+/3799214 and add tests.

Bug: chromium:1377095
Change-Id: I98d05efb88a75bd3eac378abe2bc60522aba0781
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973811
Commit-Queue: Fanchen Kong <fanchen.kong@intel.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83883}
2022-10-24 14:00:28 +00:00
Seth Brenith
251512981d Reland "Enable background merging of deserialized scripts"
This reverts commit 9dedaaf313.

Reason for revert: crashes have been fixed:
- https://crrev.com/c/v8/v8/+/3888198
- https://crrev.com/c/v8/v8/+/3965723

Original change's description:
> Revert "Enable background merging of deserialized scripts"
>
> This reverts commit f388f96fdb.
>
> Reason for revert: Crashes in canary (https://crbug.com/1360024)
>
> Original change's description:
> > Enable background merging of deserialized scripts
> >
> > This can save memory in cases where multiple frames in a process use the
> > same script, with sufficient time between loads that the script's
> > top-level SharedFunctionInfo is no longer present in the compilation
> > cache. Merging is relatively fast; it generally takes about one tenth as
> > long as deserialization.
> >
> > Bug: v8:12808
> > Change-Id: I7366a51f1d2ca6a9f551cdf2bdbe0441450cf1bb
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3868088
> > Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#82920}
>
> Bug: v8:12808
> Change-Id: If160173afaab351d995ddcf4b60d6efe656cf70b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3871208
> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/main@{#82983}

Bug: v8:12808
Change-Id: I1d19a0e9ff4172435f4b2b9bbe3bf72a93e2411c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3972179
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83882}
2022-10-24 13:56:57 +00:00
Nico Hartmann
bd590292b3 [turbofan] Optimize rab/gsab-backed TypedArrays and DataViews
This CL adds TurboFan optimizations for length and element access
of TypedArrays and DataViews that are rab/gsab-backed.

To enable this optimization, this CL builds the necessary machinery
required to allow machine operators at the front of the pipeline
(before simplified lowering). Some key changes to allow this are:
 - Introduce Type::Machine() to allow the typer and the verifier to
   provide a type to those machine operators in parts of the pipeline
   that require nodes to be typed.
 - Add EnterMachineGraph and ExitMachineGraph operators that define
   the boundary between early machine graphs and the normal graph with
   JS semantics.
 - Give Branch operators a BranchSemantics parameter to distinguish
   between machine branches (condition is a machine level value) and
   JS branches (condition is a JS boolean value) and have phases that
   handle branches decide on the branch's semantics based on this
   parameter instead of the position in the pipeline.
 - Extend SimplifiedLowering and SimplifiedLoweringVerifier to handle
   machine graphs. In particular, constants required special handling,
   because they are cached in the graph but they may have uses in both
   a machine and the JS graph, which prevents consistent typing of
   them.
 - Moved lots of logic from JSCallReducerAssembler into
   [JS]GraphAssembler such that functionality can be shared between
   different phases (e.g. JSNativeContextSpecialization and
   JSCallReducer need to generate logic to compute a TypedArray's
   byte length). Extended assembler interface in general with
   additional TNode<> overloads.


Bug: v8:11111, chromium:1358505
Change-Id: Ife006b8c38a83045cd3b8558acbfdcb66408891f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3898690
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83881}
2022-10-24 13:02:36 +00:00
Manos Koukoutos
12d8e6a54a [wasm-gc] Remove --wasm-gc-js-interop
This removes the temporary option and sets its value to {true}
everywhere.

Bug: v8:7748
Change-Id: Icbc3071b531b130c0eb007758452d09b65491c04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974510
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83880}
2022-10-24 12:58:36 +00:00
Dominik Inführ
57a84e1e63 [heap] Do not shrink pages in shared space
Shared space is used concurrently and thus pages cannot shrink like
we do for old or code space.

Bug: v8:13267
Change-Id: I646120b1690d6fe628e524a4926e5648871b960e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974808
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83879}
2022-10-24 12:54:57 +00:00
Dominik Inführ
5ab609f916 [heap] Allow heap expansion during isolate deserialization
Isolates need to be deserialized to run a GC. Similarly all client
isolates need to be deserialized for a shared GC.

This CL allows heap expansion during isolate deserialization.
Previously shared heap allocations could fail which would have led to a
CHECK failure in the subsequent GC.

Bug: v8:13267
Change-Id: Iae6934e9372063fcbe7de37128b7e783b09bb3c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974669
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83878}
2022-10-24 12:52:07 +00:00
v8-ci-autoroll-builder
9337909ba5 Update V8 DEPS (trusted)
Rolling v8/build: b8f0bc7..cb6dbd1

Rolling v8/buildtools: 10c7a0a..32851f2

Rolling v8/buildtools/third_party/libc++/trunk: 997e036..166132d

Rolling v8/third_party/depot_tools: 9879712..61ef3d8

Rolling v8/third_party/fuchsia-sdk/sdk: version:10.20221021.3.1..version:10.20221023.3.1

Rolling v8/tools/clang: 7b9e2e2..bc55ae7

Change-Id: Ie718d51122809672447c1d8e7fcb2ff46ce68c01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974078
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83877}
2022-10-24 12:28:28 +00:00
Victor Gomes
c04df4ccfc [maglev] Add a fast path for Int32 mod
Bug: v8:7700
Change-Id: I8f8f6e277f86212615f647ada7944c34601528f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971366
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83876}
2022-10-24 11:21:46 +00:00
Andreas Haas
8c6b0779e8 [wasm] Update spec tests
R=clemensb@chromium.org

Bug: v8:10994
Change-Id: I88133cb023cf0d62bee72d2c4eaf751dad42bd64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974709
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83875}
2022-10-24 11:19:46 +00:00
Michael Achenbach
b0644d42b8 Update V8 DEPS (trusted)
This also temporarily resets to C++17 with MSVC
(https://crbug.com/1377771).

Rolling v8/build: 35a1478..b8f0bc7

Rolling v8/buildtools: be63ea5..10c7a0a

Rolling v8/buildtools/third_party/libc++/trunk: 9f512cf..997e036

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/981585a..cf46d16

Rolling v8/third_party/depot_tools: 3b95525..9879712

Rolling v8/third_party/fuchsia-sdk/sdk: version:10.20221020.1.1..version:10.20221021.3.1

Rolling v8/tools/clang: 2619cde..7b9e2e2

Bug: chromium:1377771
Change-Id: I140715f6b808a04192372c797fac5cbb0a3ac759
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3972912
Reviewed-by: Liviu Rau <liviurau@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83874}
2022-10-24 11:03:06 +00:00
Victor Gomes
defc4088cc [turbofan] Fix algorithm comment in Int32Mod
We don't currently try the fast path if left side
is negative. See {if_lhs_negative} branch.

Change-Id: Ieea2977209902ad90c29ff3b305ca047fafbdd80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974511
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83873}
2022-10-24 10:34:36 +00:00
Michael Lippautz
c23bc72c83 [handles] Split off traced handles from regular global handles
v8::TracedReference and their underlying traced handles are not
actually phantom references but have been historically represented as
such. This patch splits off their backing implementaton into
`TracedHandles`.

As a drive-by, re-organize the free list to rely on indices instead of
pointers, saving a full word for each node. In additon, the setup also
allows for freeing fully empty node blocks after GCs.

Allocation/free of nodes is also organized in a way that avoids
jumping between handles/blocks/nodes for accounting purposes.

Removing CRTP in GlobalHandle internals is left for a follow up.

Bug: v8:13372
Change-Id: Ib55aa9ba71202d5918b486c161fe6f747d31c719
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966952
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83872}
2022-10-24 10:04:08 +00:00
Michael Achenbach
01c4c92bb8 [infra] Fix builder naming conventions in test configs
No-Try: true
Bug: chromium:890222
Change-Id: Idd44ad016d85a4da8d2b19f714c5705d91bc53e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974668
Reviewed-by: Liviu Rau <liviurau@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83871}
2022-10-24 09:53:37 +00:00
Manos Koukoutos
a6b54d4dc0 [wasm-gc] Store from- and to-types on typecheck nodes
These generalize {object_can_be_null} and {null_succeeds}
respectively. With this feature, we can eliminate redundant i31 checks.

Bug: v8:7748
Change-Id: Ib06b2b0d8a07f5c4ca30c88ccd6d92d67bba0d00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3972559
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83870}
2022-10-24 09:45:36 +00:00
Dominik Inführ
7e30365c1e [heap] Remove SnapshotSpace::kMap
Map space is gone now so we can use SnapshotSpace::kOld instead.

Bug: v8:12578
Change-Id: If7509ee6bea04fed263a6d8b15597fd051697e4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968480
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83869}
2022-10-24 09:15:36 +00:00
Manos Koukoutos
d1a11dd15a [wasm-gc] array/struct.new_default should work with immutable fields
Bug: v8:7748
Change-Id: I05f97786f7a5f7b829ce66ba55ffd7c00bfa4d50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974509
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83868}
2022-10-24 08:54:16 +00:00
Igor Sheludko
cd8a02d508 [builtins] Add --use-qemu mode to tools/builtins-pgo/generate.py
... and prepare for using PGO profiles for arm builds.

Bug: v8:10470
Change-Id: If71d363195c60277a59dc68d0c18e361e24209c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3970665
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83867}
2022-10-24 08:52:36 +00:00
Michael Achenbach
37ee4ae068 [infra] Fix trybot names to follow naming conventions
The infra/config update is part of:
https://crrev.com/c/3970938

No-Try: true
Bug: chromium:890222
Change-Id: If0e5960266dc932d5566181785a66da685a4df5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973070
Reviewed-by: Liviu Rau <liviurau@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83866}
2022-10-24 08:04:22 +00:00
Simon Zünd
8090f2cd43 [inspector] Remove experimental_async_stack_tagging_api flag
The feature has been enabled since M106 so we can safely remove the
flag with M109.

R=bmeurer@chromium.org

Bug: chromium:1334585
Change-Id: Iefe0b10e3be59d6dde54d676b5f1e0cf938851ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959659
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83865}
2022-10-24 05:23:50 +00:00
Mark Seaborn
e7bef8d4cc [trap-handler] Fix the Windows ARM64 build when using MSVC
Fix by disabling the use of the trap handler in the "ARM64 simulator
running on x64" case.  (Note that the ARM64-simulator-on-x64 case gets
built for mksnapshot as a host tool even if we didn't specifically
want the simulator case.)

Using the trap handler in that case currently uses some inline
assembly (the top-level asm() statements in
src/trap-handler/handler-outside-simulator.cc), but MSVC does not
support that type of asm() statement.

Disable using that asm() code by conditionalising it on "#if
V8_TRAP_HANDLER_SUPPORTED".  Note that we're not putting this
condition into the GN build because it's complicated to keep the two
sets of conditions totally in sync.

Put the "#if V8_TRAP_HANDLER_SUPPORTED" into handler-inside-win.cc to
match the same #if in handler-inside.cc, otherwise we would get a link
error when the former refers to TryFindLandingPad(), which is defined
behind the #if in the latter.

Do the same in handler-inside-posix.cc for consistency.

Remove the earlier attempt at doing the fix by implementing
ProbeMemory in C++, which won't necessarily work.  This reverts:
https://chromium-review.googlesource.com/c/v8/v8/+/3913036

Change-Id: If8e1720a90f89175d730cf32ee5ac42451b9b5be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3964232
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Mark Seaborn <mseaborn@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83864}
2022-10-22 18:52:18 +00:00
Milad Fa
72fa21b52c PPC/s390: [wasm-gc] Fix WasmLiftoffSetupFrame::Iterate()
Port c84946e1e2

Original Commit Message:

    We pass the *declared* function index on the stack now, so we must
    convert it to a regular function index before using it to look up
    the function's signature.

R=jkummerow@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ib7817344e0758fbfc005c37b8b11ad6509c4161b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971373
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83863}
2022-10-22 00:52:48 +00:00
Adam Klein
9e55d25735 [cleanup] Remove Wasm SIMD flag & deprecate embedder-enabling API
It's been enabled by default since Chrome 91.

Bug: v8:6020
Change-Id: Id26b7fb0b7dffe19a88a6f0071dd59203b06415a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3957636
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83862}
2022-10-22 00:47:42 +00:00
Milad Fa
6c0716d8af PPC/s390: Reland "[wasm] Allocate feedback vectors on demand"
Port a02c56694f

Original Commit Message:

    This is a reland of commit 4804c4de31.

    There are major changes since the previous attempt:
    - The WasmLiftoffFrameSetup (formerly WasmGetFeedbackVector) builtin
      now performs as much of the frame setup work as possible, to reduce
      generated code size for each function.
    - The WasmLazyCompile builtin/runtime function no longer allocates,
      hence gets frame type INTERNAL, and is un-handlified.

    Original change's description:
    > [wasm] Allocate feedback vectors on demand
    >
    > We previously allocated feedback vectors when instantiating the module,
    > or when lazily compiling a function. That's not sufficient when there
    > are multiple instances of the same NativeModule, or when we eagerly
    > tier-down all code for debugging. This patch changes the "get vector from
    > instance" sequence at the beginning of every Liftoff function to "get
    > or allocate vector"; factored into a builtin call to avoid generating
    > more code for every function.
    >
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3939667
    > Cr-Commit-Position: refs/heads/main@{#83610}

R=jkummerow@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I7d7e65a32e89285cb583216455ea1b9a490cb16b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968705
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83861}
2022-10-21 20:15:38 +00:00
Jakob Kummerow
c84946e1e2 [wasm-gc] Fix WasmLiftoffSetupFrame::Iterate()
We pass the *declared* function index on the stack now, so we must
convert it to a regular function index before using it to look up
the function's signature.

Change-Id: Ib98d71a02ba8ca885136c010cf7dbb6ef7f62950
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971365
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83860}
2022-10-21 18:31:15 +00:00
Victor Gomes
f471ad0f8a [maglev] Monomorphic load access with similar shape maps
This enriches KnownNodeAspects to use a map from Node to a set of
Maps, instead of a single map. We update known maps with set
intersection. We recompute the set from scratch, since set removal
is expensive.

It also adapts CheckMaps and CheckMapsWithTransition to support
a set of maps.

Bug: v8:7700
Change-Id: I0c16a456a1a186aaedcbacf2491ec4f0cb8b0682
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966441
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83859}
2022-10-21 16:54:57 +00:00
Jakob Kummerow
dce8a257fd [tools] Add tools/memory/rss.py to sample RSS usage
Similar to how `time COMMAND` measures time, `rss.py COMMAND` measures
memory consumption, by sampling RSS (Resident Set Size) for the child
process in /proc at a configurable interval (default: every 1ms).

No-Try: true
Change-Id: I381cdd6325fae67944ee96e44ba09dd948d432cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971360
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83858}
2022-10-21 16:38:40 +00:00
Toon Verwaest
f150ead829 [maglev] Use CallFunction_* where possible
Basically when the feedback says it's a JSFunction.

Bug: v8:7700
Change-Id: Ieb8484f3de44e2600aa8af9cb564b0f09f8531ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971125
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83857}
2022-10-21 15:35:31 +00:00
Toon Verwaest
b9caf49c9a [maglev] Adjust interrupt budgets
Make maglev less aggressive, and TF a little more again. Maglev deopts
will ensure that we'll back off on TF as long as feedback changes.

Bug: v8:7700
Change-Id: I98b4c339de598d96329b79d7b6862605f9bfd87c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968703
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83856}
2022-10-21 15:28:47 +00:00
Dominik Inführ
b8a135521c [heap] Handle optional spaces in PagedSpaceIterator
PagedSpaceIterator just bailed out on first optional space.

Bug: v8:13267
Change-Id: I6f8dba6c510a641930b364698dc91529b2db1146
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971361
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83855}
2022-10-21 14:08:58 +00:00
Leszek Swirski
8fad1045e5 [test] Fix optimization marking for in-progress
%OptimizeFunctionOnNextCall could be called while compilation (Maglev or
Turbofan) was still on-going -- this would make DCHECKs fail when
attempting to save the compiled code on the feedback vector. This is not
an issue normally when tests are carefully crafted, but can easily
happen during fuzzing.

Unify the two %Optimize*OnNextCall paths, and make sure that they check
for in-progress compilation.

Fixed: v8:13404
Change-Id: I021e1305bc2ba769b7484f9a122792aeb22060ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971122
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83854}
2022-10-21 13:56:58 +00:00
Qifan Pan
7aa6a7e659 [turbofan] Extend typers of JSUnaryOps to BigInt
This CL fixes the types of JSUnaryOps with BigInt input.

Bug: chromium:1376930, v8:9407
Change-Id: I7a6603db08d3af1e40d440fe4c499e7f825b59d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971119
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#83853}
2022-10-21 13:16:57 +00:00
Lu Yahan
5d7bbeb5ec [riscv][wasm] Allocate feedback vectors on demand
Port commit a02c56694f

Bug: v8:12852

Change-Id: Id93e2c3550d677f7d5dad32de085cb73ff02b301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971517
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83852}
2022-10-21 13:11:17 +00:00
Nikolaos Papaspyrou
60dfddf03c [heap][test] Fix code coverage tests for conservative stack scanning
Code coverage tests invoke garbage collection, to test that coverage
data is not reclaimed by the garbage collector and that the native
%DebugTogglePreciseCoverage works as intended. One of them tests that
garbage collection indeed reclaims the coverage data, if the above
native is not used. When conservative stack scanning is used, this may
fail.

This CL fixes the tests, ensuring that a precise garbage collection
will be invoked, without scanning the stack. To achieve this, the
garbage collection is invoked not with %CollectGarbage but by using
--expose-gc and the asynchronous execution mode, which ensures that
it will be invoked from the event loop without a stack.

Bug: v8:13257
Change-Id: Id44ef0d442bfd0a8afda282c3345e5ebeb239356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968708
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83851}
2022-10-21 13:09:40 +00:00
Victor Gomes
1c972cff76 Revert "[bazel] Add hide symbols from release / fast builds"
This reverts commit 6e4dea75e8.

Reason for revert: This is blocking HEAD import in Copybara.
Let's test this there first, then backport the change.

Original change's description:
> [bazel] Add hide symbols from release / fast builds
>
>
> Our gn build files hide non-exported symbols by default, which results
> in smaller binaries and can improve build times.
>
> This was not ported to the bazel build and causes binary size
> regressions in google 3.
>
> Change-Id: I285914b83e75bd3bf406e6401f52ddb53230219a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925698
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83514}

Change-Id: I18561cfdd8a637c100be849c4d6a668c6f3b6080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971120
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83850}
2022-10-21 13:08:38 +00:00
Clemens Backes
d4e517d6ba [wasm][memory64] Fix decoding of limits values
For memory64, we modified the {consume_resizable_limits} method to
support 64-bit LEBs. This method is not only used for memory limits
though, and other limits should be unaffected (they are always 32-bit
values, even in memory64).

This CL refactors decoding such that the {has_maximum} fields are
initialized earlier, and flags are only decoded once (in particular not
again inside {consume_resizable_limits}. Instead, the caller specifies
whether values should be decoded as 32-bit or 64-bit values.

R=jkummerow@chromium.org

Bug: v8:10949, v8:13401
Change-Id: I2fb76c3efcf153d1490d88c4456de1524fd508b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968482
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83849}
2022-10-21 13:04:57 +00:00
Nikolaos Papaspyrou
8c7c087812 [heap] Make stack thread-local and introduce stack markers
This CL makes the object keeping stack information thread-local, moving
it from Heap to ThreadLocalTop. In this way, stack scanning will work
correctly when switching between threads, e.g., using v8::Locker.

It also introduces a mechanism for setting a stack marker, to be used
for scanning only the part of stack between its start and the marker
(instead of the current stack top).

Bug: v8:13257
Change-Id: I01091f5f49d9a8143d50aeef53789a98bdb29048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3960991
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83848}
2022-10-21 13:02:07 +00:00
Marja Hölttä
724e7ce174 [arraybuffers, api] Implement [[ArrayBufferDetachKey]] support
Bug: chromium:1344595
Change-Id: Ic1075361b92c776789ce2fbf1e105dea174f3a2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925936
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83847}
2022-10-21 12:55:18 +00:00
Clemens Backes
c745dab977 [wasm][memory64] Support shared memory
For some reason we overlooked shared memory64 so far. Supporting it is
trivial, we just need to fix flag parsing.

To make parsing simpler, we replace the switch by a bit-decoding logic.

R=jkummerow@chromium.org

Bug: v8:10949, v8:13401
Change-Id: I1d884a174f901ed359c1d385055c9f2d24b0e2f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967904
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83846}
2022-10-21 12:40:17 +00:00
Omer Katz
92a7385171 [heap] Fix 32bit msvc builds
Size of ActiveSystemPages is 8 bytes even on 32bit builds, thus
forcing 8 bytes alignment for MemoryChunk.

Change-Id: I5ca1e18329d6e68a8b6811c3c27cb224c765cb63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966953
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83845}
2022-10-21 12:19:26 +00:00
Benedikt Meurer
b2892b5f24 [inspector] Add [[WeakRefTarget]] internal property.
This adds a new [[WeakRefTarget]] internal property to
`Runtime.getProperties` results for `JSWeakRef` results
(also included in the preview), which will be used by
DevTools to show the target of the weak reference without
having to explicitly call `deref()` on them. As part of
this we also have (temporary) strong references to the
target, slightly changing behavior, but that's consistent
with how DevTools deals with `JSWeakMap` and `JSWeakSet`.

Bug: chromium:1267690
Change-Id: I2a9ef9261996fcdee20fbd0fc728d11208c82459
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3970598
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83844}
2022-10-21 12:14:52 +00:00
Toon Verwaest
4802bdcc97 [maglev] Avoid checking known calltargets
If the call target is a known constant, we don't need to check the value
stored in the feedback array dynamically. Either it matches, in which
case we just perform the call, or it's different, in which case we
unconditionally deopt so we can update the feedback.

Bug: v8:7700
Change-Id: Iacfdd9f358aac9c1d4e5cc748f323c3d90597d41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971077
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83843}
2022-10-21 12:01:05 +00:00