Commit Graph

897 Commits

Author SHA1 Message Date
Andreas Haas
d7cd9051ad [wasm][anyref] Introduce anyfunc globals
Anyfunc globals are very similar to anyref globals. This CL is mostly
about extending the conditions which guard the anyref globals code.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: Ia92ac4560102cc3ed0060342f92758db28f415ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1526004
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60281}
2019-03-18 12:01:52 +00:00
Andreas Haas
644556e6ed [wasm][anyref] Implement table.[get|set] wasm instructions
R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: Ica85ba80c29d6d5c5b9163df8cf743c0f1da7f4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520715
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60280}
2019-03-18 11:04:07 +00:00
Aseem Garg
07f94555fb [wasm] Add minimum to MemoryDescriptor and TableDescriptor
This CL allows for either of 'minimum' or 'initial' for MemoryDescriptor
and TableDescriptor. It also adds a flag for the reflection features.

R=binji@chromium.org,adamk@chromium.org
Bug=v8:7742

Change-Id: Icfd4825f63e1eb784a39d10f740d55e81489eba7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1485243
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60256}
2019-03-15 06:14:39 +00:00
Ben Smith
94f22de62e [wasm] Implement bulk memory in interpreter
This CL only provides the implementation of memory.{init,copy,fill} and
data.drop.

Bug: v8:8965
Change-Id: I439f2520bfee8f147e4b0d1d31f954aaad2e14ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1510575
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60253}
2019-03-15 05:29:59 +00:00
Aseem Garg
74714df2cc [wasm] Add type function to WebAssembly.Global
R=binji@chromium.org,adamk@chromium.org
Bug=v8:7742

Change-Id: I5b9a614dd0c8b028d756cbd401c803de4cb9437f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1513159
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60252}
2019-03-15 05:16:29 +00:00
Aseem Garg
a0bdda2495 [wasm] Add type function to WebAssembly.Table
This CL also changes the constructor for WasmTableObject so that the
maximum_length is set to undefined instead of a default value if there's
no maximum provided.

R=binji@chromium.org,adamk@chromium.org
Bug=v8:7742

Change-Id: I6310224e9997464bf69c198e2694a6cd76e01e8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1513156
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60250}
2019-03-15 04:22:29 +00:00
Clemens Hammacher
eb1d2d7098 [wasm] Make error messages deterministic
Compilation only stores whether an error has been found, but not the
exact error or it's location. This is generated by running a validation
pass once all wire bytes have been received.
This unifies error messages by removing one more location where we
generate compilation error messages, and makes it deterministic because
a) we always report the error in the first failing function, and
b) if names are present, the error message will always contain the
   function name.

R=titzer@chromium.org

Bug: chromium:926311, v8:8814
Change-Id: I79551b8bb73dcee503484de343a3ada60a6add4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1521112
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60242}
2019-03-14 15:05:18 +00:00
Andreas Haas
e8af602dd2 [wasm] Add test for element section with non-zero table indices
R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: Id8b9c3596eb6caf5ee7048a87a676a85dba0c5dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520711
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60239}
2019-03-14 14:28:06 +00:00
Andreas Haas
6b650574fc [wasm] Allow multi-table initialization in the wasm-module-builder
This CL just adds a parameter to addElementSegment and adjusts all
existing tests.

Note that addElementSegment contains some convenience code to construct
one initial table if it does not exist yet. I did not extend that code
to multiple tables. If you want to use multiple tables, you have to
create them first before calling addElementSegment.

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: Ie131fd5dc19856703ab5cfb2fa8f7d576f70a18b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1520709
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60211}
2019-03-13 10:39:41 +00:00
Andreas Haas
4cbc5a4dff [wasm][anyref] Implement WebAssembly.Table.[get|set]
This Cl adds a type to {WasmTableObject}, and extends
{WasmTableObject::Set} and {WasmTableObject::Get} to support anyref
tables. I did it in one CL so that I can write tests.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I6c6d78f84715a7805f7bb881a63d3c1174f6a6ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511332
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60206}
2019-03-13 08:23:13 +00:00
Aseem Garg
f6acafd7de [wasm] Add type function to WebAssembly.Memory
R=binji@chromium.org,adamk@chromium.org
Bug: v8:7742

Change-Id: I13a317372fa06c706e2c648b92d2f2dd3c5a337b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1513152
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60200}
2019-03-13 03:45:02 +00:00
Clemens Hammacher
1a81a3920e [wasm] Sync wasm-module-builder.js back to spec version
In particular, remove {toUint8Array} method and make {toBuffer} return
a {Uint8Array} view to the buffer like before
https://crrev.com/c/1508352. Also, the returned view does not need to be
another copy of the bytes, it can really just be a view.

As a follow-up, this requires the test-only DeserializeWasmModule
runtime method to receive the wire bytes as Uint8Array, and also
requires the {IsWasmCompileAllowed} callback to handle
{ArrayBufferView} (like chromium's version already does).

R=ahaas@chromium.org

Change-Id: I87296cdbac14b74e7c8b38a372aa3df572ca6ad6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1518172
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60195}
2019-03-12 16:29:41 +00:00
Andreas Haas
e162eb4443 [wasm] Fix insufficient bounds check in WebAssembly.get
According to the wasm js-spec, the table index can be uint32. The
implementation in our implementation expected an int though. We did not
check for the int overflow.

I replaced the throwing of the exception in WasmTableObject::Get to use
the ErrorThrower instead of throwing the exception with Isolate::Throw
directly. The reason is that I see with other CL's that I have to throw
several errors, and I don't want to introduce a new message and
MessageId for every error. Moreover, the ErrorThrower is a standard way
in wasm to throw errors. It feels right to throw the error the same way
here.

R=mstarzinger@chromium.org

Bug: chromium:940296
Change-Id: Idb77c813506fe66a3192b66fe0e8e807b80580ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1514496
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60181}
2019-03-12 11:29:02 +00:00
Andreas Haas
f3d1777dbf [wasm] Add tests for table.[get|set] instructions
I forgot to add the test file to https://crrev.com/c/1463519.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I88d50fe83ae60a8170110504ce7f765aa28db517
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511480
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60148}
2019-03-11 11:24:50 +00:00
Deepti Gandluri
7c3ee1c852 [wasm] Rename Atomics Wake operator to Notify.
Change-Id: Ie080683af1d990e5205c75a2a199f0581d826811
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511630
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60135}
2019-03-09 01:46:44 +00:00
Clemens Hammacher
1b7eacdcff [wasm] Speed up generation of module with many functions
Reusing the same {Binary} object (with the same {ArrayBuffer}
underneath) speeds up the limits test with 1M functions by a factor of
11x in an optdebug build.

R=titzer@chromium.org

Change-Id: I36d032d652c66f5b7f5a80399588652d7e3946ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511475
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60127}
2019-03-08 14:18:14 +00:00
Clemens Hammacher
c9576a8175 [wasm] Several fixes in wasm-module-builder.js
This CL cleans up a few things as noted by binji in
https://github.com/WebAssembly/spec/pull/979, plus a few more I found
along the way.
In particular:
1) Remove the unused and incorrect {bytesWithHeader} method.
2) Introduce kMaxVarInt32Size and kMaxVarInt64Size constants.
3) Remove redundant {ensure_space} calls (irrelevant for performance).
4) Use {toModule} method instead of duplicating code.
5) Merge two identical leb encoding implementations.

R=titzer@chromium.org
CC=​binji@chromium.org

Change-Id: Idec74e2e46a71766107c182a4176c516d883adad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511273
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60124}
2019-03-08 13:16:33 +00:00
Clemens Hammacher
913efea62c [wasm] Improve f32 and f64 encoding
A minor improvement to copy over all bytes at once.

R=titzer@chromium.org
CC=binji@chromium.org

Change-Id: Ia9264a28afa76a5ed51d378d0db5bb192aeef2b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1511272
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60121}
2019-03-08 12:46:52 +00:00
Andreas Haas
275402260c [wasm] Construct WasmExportedFunctions for table elements lazily
We have to create WasmExportedFunction objects for any WebAssembly
function which may escape a WebAssembly instance. Up until now we
created these WasmExportedFunction objects eagerly during instantiation
time: for any exported function, and any element in an exported table we
create such an object.

With the anyref proposal, the table.get instruction can allow any
function in a table to escape its instance. Therefore we would have to
create a WasmExportedFunction object for any function which is put into
a table.

With this CL we create WasmExportedFunctions for table entries lazily.
We initialize tables with placeholders consisting of the instance and
the function index. If we encounter a placeholder in table.get, we
create the WasmExportedFunction for the expected function to return it.

R=mstarzinger@chromium.org
CC=titzer@chromium.org

Bug: v8:7581
Change-Id: I4f32bd7433285d0b04a22c0fb70b736bac55b3f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1505575
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60115}
2019-03-08 10:40:41 +00:00
Francis McCabe
d735882d2d [wasm] ReturnCall Implementation (TurboFan)
Implement ReturnCall functionality for TurboFan compiler.

Bug: v8:7431
Change-Id: I1e20473a9b3eba9ee48c0c11f89029356dd9b9eb
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1467344
Commit-Queue: Francis McCabe <fgm@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60103}
2019-03-07 19:36:29 +00:00
Clemens Hammacher
41aa8a6082 [wasm] Speed up WasmModuleBuilder
Emitting bytes to the Uint8Array directly speeds up generation of
binaries enormously.
On the limits-any.js spec test (which creates huge modules), the
execution time of an optdebug build reduces from 286 seconds to 61
seconds.

R=titzer@chromium.org
CC=​ahaas@chromium.org, ssauleau@igalia.com

Change-Id: I5b473b7dc7b0853e54d2406f3db3658bb2abed40
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1508352
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60096}
2019-03-07 14:51:52 +00:00
Deepti Gandluri
365b637cc0 Reland "[wasm] Lazy update instances on a shared Memory.Grow"
This is a reland of 80f06d6fb3

Original change's description:
> [wasm] Lazy update instances on a shared Memory.Grow
> 
>  - Introduce a GROW_SHARED_MEMORY interrupt, and handler
>  - Memory objects for isolates are updated on a stack check, add
>    tracking for isolates that hit the stack check
>  - When enough memory is not reserved ahead of time, fail to grow
>  - Add tracking for externalized buffers in the MemoryTracker so
>    that the MemoryTracker will know when backing_stores can be freed.
>  - For shared buffer, do not always allocate a new buffer when
>    growing an externalized buffer
> 
> 
> Change-Id: I9cf1be19f2f165fa6ea4096869f7d6365304c8c4
> Bug: v8:8564
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1472430
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60064}

Bug: v8:8564
Change-Id: Id0cf8e42a9d54ac702dba351e248a1b92713c98a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1506357
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60071}
2019-03-06 18:41:19 +00:00
Bill Budge
e15bb0b308 Revert "[wasm] Lazy update instances on a shared Memory.Grow"
This reverts commit 80f06d6fb3.

Reason for revert: failing grow-memory tests

Original change's description:
> [wasm] Lazy update instances on a shared Memory.Grow
> 
>  - Introduce a GROW_SHARED_MEMORY interrupt, and handler
>  - Memory objects for isolates are updated on a stack check, add
>    tracking for isolates that hit the stack check
>  - When enough memory is not reserved ahead of time, fail to grow
>  - Add tracking for externalized buffers in the MemoryTracker so
>    that the MemoryTracker will know when backing_stores can be freed.
>  - For shared buffer, do not always allocate a new buffer when
>    growing an externalized buffer
> 
> 
> Change-Id: I9cf1be19f2f165fa6ea4096869f7d6365304c8c4
> Bug: v8:8564
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1472430
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60064}

TBR=binji@chromium.org,titzer@chromium.org,gdeepti@chromium.org,ahaas@chromium.org

Change-Id: I2ed0b59bcbb285b701172b401d606963261d375c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1506355
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60068}
2019-03-06 17:49:45 +00:00
Deepti Gandluri
80f06d6fb3 [wasm] Lazy update instances on a shared Memory.Grow
- Introduce a GROW_SHARED_MEMORY interrupt, and handler
 - Memory objects for isolates are updated on a stack check, add
   tracking for isolates that hit the stack check
 - When enough memory is not reserved ahead of time, fail to grow
 - Add tracking for externalized buffers in the MemoryTracker so
   that the MemoryTracker will know when backing_stores can be freed.
 - For shared buffer, do not always allocate a new buffer when
   growing an externalized buffer


Change-Id: I9cf1be19f2f165fa6ea4096869f7d6365304c8c4
Bug: v8:8564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1472430
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60064}
2019-03-06 16:46:28 +00:00
Ben Smith
5f4f57eb07 [wasm] Fix out-of-bound behavior for bulk ops
The bulk memory operations should not bounds check ahead of time, but
instead should write as many bytes as possible until the first
out-of-bounds access.

Bug: v8:8890
Change-Id: Ia8179fe268fc65816c34a8f3461ed0a0d35600aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1497520
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60040}
2019-03-05 20:36:18 +00:00
Sven Sauleau
f4e322c3dd [wasm] correct Table limit
Align the Table implementation limits with the JavaScript Embedding
limits defined in the specification (from MAX_UINT32 to 1e7).

Introduce a new helper (max_table_init_entries) that returns the
maximum number of Table entry at initialization. It takes into account
the maximum Table size, which can be passed by a flag.

Bug: v8:8633
Change-Id: Idfa19418e81f478f7886a30876e66c9b216e25ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1496971
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60036}
2019-03-05 15:22:20 +00:00
Ben Smith
a3ac513b5e [wasm] Implement passive element binary format
Passive elements have a different binary format, where the contents are
instructions instead of function indexes:

    0xd0 0x0b       -> (ref.null)
    0xd2 var:x 0x0b -> (ref.func x)

Bug: v8:8891
Change-Id: Ie7e8efe7b5acdf99622880dd97d28d3c13744dff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1497516
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60020}
2019-03-04 20:05:13 +00:00
Sven Sauleau
5bdb6b8345 Replace assertErrorMessage in mjsunit test
Replaces assertErrorMessage by assertThrows. Previously
assertErrorMessage didn't assert the error message that was
provided.

Change-Id: I30410b43ff16db448776d9f3cae817b1c0966b3d
Reviewed-on: https://chromium-review.googlesource.com/c/1496973
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#59982}
2019-03-01 18:15:13 +00:00
Francis McCabe
4c9c6c5804 [wasm] ReturnCall Implementation (interpreter)
Implement the ReturnCall functionality for the interpreter.

Note that some tests have had to be deferred to the implementation
of ReturnCall for TurboFan.

This a reland of https://chromium-review.googlesource.com/c/v8/v8/+/1467343

Bug: v8:7431
Change-Id: Iac9392a6a81995e30009dac74035e4d728ac3dbb
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/1484905
Commit-Queue: Francis McCabe <fgm@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59925}
2019-02-27 19:34:50 +00:00
Michael Starzinger
f94cd449e4 [wasm] Flip section code for exception and data-count.
This flips the section codes for the exception section (part of the
exception handling proposal) and the data-count section (part of the
bulk memory proposal).

Also see the following discussions for the underlying motivation:
https://github.com/WebAssembly/bulk-memory-operations/pull/42
https://github.com/WebAssembly/exception-handling/issues/70

R=binji@chromium.org
BUG=v8:8868

Change-Id: I9f5f524e7aec067720346a5bb8d45c7c80a4c7a2
Reviewed-on: https://chromium-review.googlesource.com/c/1478207
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59856}
2019-02-26 10:38:42 +00:00
Deepti Gandluri
5d0f5bd739 Revert "[wasm] ReturnCall Implementation (interpreter)"
This reverts commit 6a88f0b1e4.

Reason for revert: Fails UBSAN bots - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20UBSan/4866

Original change's description:
> [wasm] ReturnCall Implementation (interpreter)
> 
> Implement the ReturnCall functionality for the interpreter.
> 
> Note that some tests have had to be deferred to the implementation
> of ReturnCall for TurboFan.
> 
> Bug: v8:7431
> Change-Id: I091528e72f9113ddf1929bd1a5650b490bc8cc0c
> Reviewed-on: https://chromium-review.googlesource.com/c/1467343
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Francis McCabe <fgm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59803}

TBR=adamk@chromium.org,ahaas@chromium.org,clemensh@chromium.org,fgm@chromium.org

Change-Id: Ib2a85e586549e9c36f94d70f04f6e103a8272367
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7431
Reviewed-on: https://chromium-review.googlesource.com/c/1484574
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59804}
2019-02-22 23:31:54 +00:00
Francis McCabe
6a88f0b1e4 [wasm] ReturnCall Implementation (interpreter)
Implement the ReturnCall functionality for the interpreter.

Note that some tests have had to be deferred to the implementation
of ReturnCall for TurboFan.

Bug: v8:7431
Change-Id: I091528e72f9113ddf1929bd1a5650b490bc8cc0c
Reviewed-on: https://chromium-review.googlesource.com/c/1467343
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59803}
2019-02-22 19:27:10 +00:00
Sven Sauleau
6f8bd2eb2f [wasm] change test name
Change-Id: Ib45690bb03b9c76502afed89a71e1dc9a545893b
Reviewed-on: https://chromium-review.googlesource.com/c/1481213
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59756}
2019-02-21 12:02:47 +00:00
Aseem Garg
f5c0361abc [wasm] fix alignment issue for WasmI64AtomicWait
WasmI64AtomicWait checked alignment at 32 bit instead of 64 bit.

Bug=v8:8075

Change-Id: Ibd668ad8440e928d14a1fcae1577c4aae345151b
Reviewed-on: https://chromium-review.googlesource.com/c/1475918
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59713}
2019-02-20 03:19:27 +00:00
Clemens Hammacher
15a621a2f9 [wasm][test] Check streaming decoder error messages
In the wasm streaming decoder error position test, do also check the
error messages generated. This revealed messages that were not quite
fitting and some that were formatted differently than the majority.

R=ahaas@chromium.org

Bug: v8:8814
Change-Id: If157f1083a104413bf14797ac56e756baac98c17
Reviewed-on: https://chromium-review.googlesource.com/c/1463780
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59604}
2019-02-14 16:06:43 +00:00
Andreas Haas
01dc5707e4 [wasm] Generate code for the table.get and table.set instructions
This CL contains the following changes:
(1) Allocate memory for WasmTables in the WasmInstance.
    - We extend the WasmInstance by a FixedArray which stores
      references to the WasmTables.
(2) Rename the name of the backing store of WasmTables from `functions`
    to `elements`.
    - The name `functions` just does not fit anyref tables.
(3) Generate code with TurboFan for table.get and table.set.
(4) Extend wasm-module-builder.js to be able to generate modules with
    multiple tables.
(5) Add  mjsunit tests to test table.get and table.set.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I44af4838ee7a37b394841a2f673ecae5734a4d1c
Reviewed-on: https://chromium-review.googlesource.com/c/1463519
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59529}
2019-02-12 13:10:53 +00:00
Clemens Hammacher
7a8cd55146 [wasm] Check that sync and async errors match
This makes the existing error message tests also test the error
produced by asynchronous compilation and instantiation.
It also slightly tweaks the error message to contain the name of the
API function invoked instead of "WebAssembly Instantiation".

R=titzer@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Bug: chromium:926311
Change-Id: If4ab963cee8267d43b289169d21b31637c471d6d
Reviewed-on: https://chromium-review.googlesource.com/c/1456085
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59442}
2019-02-07 16:41:47 +00:00
Clemens Hammacher
82d240c736 [test] Introduce assertThrowsAsync
We often use raw assertPromiseResult with {success ==
assertUnreachable} for that. Having a separate helper increases
readability and allows us to generate consistent (and better) error
messages.

R=titzer@chromium.org

Bug: chromium:926311
Change-Id: I507941eacaafe6c576098d7829a76b27384a4fb6
Reviewed-on: https://chromium-review.googlesource.com/c/1456039
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59417}
2019-02-06 15:35:04 +00:00
Sven Sauleau
764815811d [wasm] remove [[HasProperty]] in memory/constructor when threads
Remove the call to [[HasProperty]] for the shared property when threads
feature is enabled.

Bug: v8:8782
Change-Id: I492ed3726ea846a1a52dc3a0e0a183d9ee506e96
Reviewed-on: https://chromium-review.googlesource.com/c/1451826
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#59352}
2019-02-04 19:48:27 +00:00
Clemens Hammacher
ac73e1d52b Reland "[test] Check for illegal uses of mjsunit methods"
This is a reland of a9e93572d4

Original change's description:
> [test] Check for illegal uses of mjsunit methods
> 
> The assertThrows and assertDoesNotThrow methods expect either a
> function to execute, or a string to eval. In several tests however we
> accidentally passed the *result* of the statement to be tested instead
> of the code.
> This CL adds check to catch such error early, and removes wrong uses.
> In most places, we do not need to use assertDoesNotThrow anyway,
> because exceptions are handled as test failures.
> 
> Drive-by: Unify catch syntax in mjsunit.js and make sure to propagate
> MjsUnitAssertionErrors correctly.
> 
> R=mathias@chromium.org
> 
> Bug: v8:8562
> Change-Id: I88894a667cbe0570774f748a9a23e8a527887a49
> Reviewed-on: https://chromium-review.googlesource.com/c/1439238
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59277}

Bug: v8:8562
Change-Id: I3b26935f7b35302d499266155273ea271bf8151d
Reviewed-on: https://chromium-review.googlesource.com/c/1449792
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59328}
2019-02-04 10:45:18 +00:00
Clemens Hammacher
327fd140fd [wasm] Revise compile error messages
This CL revises some of our error messages, and removes unneeded parts
(like "AsyncCompilation: " or "(null): "). It also extends existing
tests to check for the precise error message more thoroughly to detect
changes or nondeterminism earlier.

R=titzer@chromium.org, ahaas@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Bug: chromium:926311
Change-Id: I1ccfb307d4a61291f4582330152a53fbadd0848f
Reviewed-on: https://chromium-review.googlesource.com/c/1445897
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59296}
2019-02-01 14:36:12 +00:00
Michael Achenbach
14c06a34db Revert "[test] Check for illegal uses of mjsunit methods"
This reverts commit a9e93572d4.

Reason for revert:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/23956
Happened already 2 builds earlier, but the output is corrupted due to
an outage.

Original change's description:
> [test] Check for illegal uses of mjsunit methods
> 
> The assertThrows and assertDoesNotThrow methods expect either a
> function to execute, or a string to eval. In several tests however we
> accidentally passed the *result* of the statement to be tested instead
> of the code.
> This CL adds check to catch such error early, and removes wrong uses.
> In most places, we do not need to use assertDoesNotThrow anyway,
> because exceptions are handled as test failures.
> 
> Drive-by: Unify catch syntax in mjsunit.js and make sure to propagate
> MjsUnitAssertionErrors correctly.
> 
> R=​mathias@chromium.org
> 
> Bug: v8:8562
> Change-Id: I88894a667cbe0570774f748a9a23e8a527887a49
> Reviewed-on: https://chromium-review.googlesource.com/c/1439238
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#59277}

TBR=ahaas@chromium.org,clemensh@chromium.org,mathias@chromium.org

Change-Id: Iec06c95dd3223f27297e5c6e02835d26b5e753e7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8562
Reviewed-on: https://chromium-review.googlesource.com/c/1449634
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59284}
2019-02-01 12:12:41 +00:00
Clemens Hammacher
a9e93572d4 [test] Check for illegal uses of mjsunit methods
The assertThrows and assertDoesNotThrow methods expect either a
function to execute, or a string to eval. In several tests however we
accidentally passed the *result* of the statement to be tested instead
of the code.
This CL adds check to catch such error early, and removes wrong uses.
In most places, we do not need to use assertDoesNotThrow anyway,
because exceptions are handled as test failures.

Drive-by: Unify catch syntax in mjsunit.js and make sure to propagate
MjsUnitAssertionErrors correctly.

R=mathias@chromium.org

Bug: v8:8562
Change-Id: I88894a667cbe0570774f748a9a23e8a527887a49
Reviewed-on: https://chromium-review.googlesource.com/c/1439238
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59277}
2019-02-01 10:13:30 +00:00
Ben Smith
70c94dfab0 [wasm] Rename memory.drop and table.drop
The new names for memory.drop and table.drop are data.drop and elem.drop
respectively. See
https://github.com/WebAssembly/bulk-memory-operations/issues/23 and
https://github.com/WebAssembly/bulk-memory-operations/pull/46.

Change-Id: I07aab8448fabe24eb9734dc7dac6f91c570cb553
Reviewed-on: https://chromium-review.googlesource.com/c/1446148
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59261}
2019-01-31 19:27:57 +00:00
Ben Smith
787d83c57c [wasm] Update bulk-memory instruction immediates
* There are now two indexes for table.copy and memory.copy, one for the
source and the one for the destination table/memory. (see
https://github.com/WebAssembly/bulk-memory-operations/pull/43)

* Reverse the order of the table.init and memory.init indexes, so the
segment index is first and the table/memory index is second. (see
https://github.com/WebAssembly/bulk-memory-operations/pull/45)

Change-Id: I1781edd4200a7b693e3d0814999e6292aafa58d3
Reviewed-on: https://chromium-review.googlesource.com/c/1446149
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59259}
2019-01-31 18:24:17 +00:00
Clemens Hammacher
659347f9aa [wasm] Slighly modify some error messages
This CL revises some of our error messages to be more precise or more
aesthetically appealing.

R=titzer@chromium.org, ahaas@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Bug: chromium:926311
Change-Id: I38eaee09fd37f9b67fdb08bc7b0df64a6eaf96f9
Reviewed-on: https://chromium-review.googlesource.com/c/1445980
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59249}
2019-01-31 15:52:42 +00:00
Sven Sauleau
5bdb13297f [wasm] merge js constants file in module-builder
We noticed that almost every call site were loading both files,
the split isn't necessary anymore.

In some message tests, removed the absolute line number to allow future
changes.

Bug: v8:8726
Change-Id: I8527f0a1ecfa685aa01a5e2f5f47ddf1cb13a545
Reviewed-on: https://chromium-review.googlesource.com/c/1446452
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59220}
2019-01-30 22:10:34 +00:00
Sven Sauleau
3c3233e6f8 [wasm] js module-builder and constants improvements
Changes made to the Wasm module builder:
- Create emit_u64v for emitting a LEB128 that conceptually represent
an 64-bits integer.
- Differentiate toBuffer and toUint8Array for returning respectively
ArrayBuffer and a Uint8Array.
- Moved wasmF32Const and wasmF64Const functions because we can take
advantage of the existing cached conversion buffers. Also, declaring
them in the constants file will collide with the module-builder since
they are loaded in the same scope.
- The byte_view buffer (used by some conversions to bytes) switched from
Int8Array to Uint8Array.

Changes made to the Wasm contants:
- Add a new kSharedHasMaximumFlag flag for shared memory with a maximum
value.

Bug: v8:8726
Change-Id: If16c59896cfa1d42008da413e2e144b73a0fa5ce
Reviewed-on: https://chromium-review.googlesource.com/c/1443062
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#59213}
2019-01-30 15:18:44 +00:00
Ben L. Titzer
3a638a57cf [wasm] 0-count is out-of-bounds for table.*
The spec wasn't clear (or I misunderstood). As per
(https://github.com/WebAssembly/bulk-memory-operations/issues/11),
zero-count table operations are also out of bounds.

R=mstarzinger@chromium.org
CC=binji@chromium.org
BUG=v8:7747

Change-Id: Iac689b93a040eb6eb06975bc2ba0facb85d24756
Reviewed-on: https://chromium-review.googlesource.com/c/1436022
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59121}
2019-01-28 13:13:34 +00:00
Andreas Haas
258371bd44 [wasm][anyref] Support anyref stack parameters
Anyref parameters can exist across GC runs. Therefore the GC has to
know where anyref parameters are on the stack so that it can mark them
in its marking phase, and update them in the compaction phase.

Already in a previous CL we grouped all anyref parameters so that they
can be found more easily in a stack frame, see
https://crrev.com/c/1371827. In this CL we implement the stack scanning
itself.

Note that anyref parameters are not scanned while iterating over the
caller's frame (to which they actually belong), but while iterating
over the callee's frame. The reason is that with tail-calls, only the
callee knows how many tagged stack parameters (aka anyref parameters)
there are.

R=mstarzinger@chromium.org
also-by=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I7a41ce11d06c0d420146fdb0bb8d5606f28824d7
Reviewed-on: https://chromium-review.googlesource.com/c/1424955
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59099}
2019-01-25 18:00:46 +00:00
Andreas Haas
5d587693a6 [wasm][anyref] Implement sub-typing of anyref, anyfunc, and nullref
For the reference types anyref, anyfunc, and nullref, there exist
sub-typing rules. The spec says

A reference type reftype1 matches a reference type reftype2 if and only
if:

* Either both reftype1 and reftype2 are the same.
* Or reftype1 is nullref.
* Or reftype2 is anyref.

This CL introduces the type nullref for ref-null, and implements the
sub-typing rules in the function-body-decoder.

Note that because of the sub-typing check validation performance may
regresses. In that case we can optimize the sub-typing check.

R=titzer@chromium.org, clemensh@chromium.org

Bug: v8:7581
Change-Id: I55bab72a109f3374da3770d141b0fc8067aad8b2
Reviewed-on: https://chromium-review.googlesource.com/c/1430061
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59043}
2019-01-23 16:11:15 +00:00
Andreas Haas
ed3738975b [wasm][anyref] Add test for the default value of anyfunc locals
The implementation already exists, but the test doesn't.

R=titzer@chromium.org

Bug: v8:7581
Change-Id: I42e1b0a1c930ec4cc1f1701d5613828acab4fc30
Reviewed-on: https://chromium-review.googlesource.com/c/1426123
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59038}
2019-01-23 15:53:45 +00:00
Ben L. Titzer
61ea7c48ad [wasm] Implement table.init bytecode
The table.init bytecode copies a range of elements from an element
segment into a table, trapping if the segment is not passive, is
dropped, or would cause out-of-bounds accesses.

R=mstarzinger@chromium.org
CC=binji@chromium.org
BUG=v8:7747

Change-Id: Ib27af9cca45a464fd1f876ddd092e99941481896
Reviewed-on: https://chromium-review.googlesource.com/c/1430063
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59037}
2019-01-23 15:45:27 +00:00
Andreas Haas
e7e61ce620 [wasm][anyref] Introduce anyfunc locals
R=titzer@chromium.org

Bug: v8:7581
Change-Id: I153b09ac1676c75590f37c4b7d1f8659c37bbe96
Reviewed-on: https://chromium-review.googlesource.com/c/1421837
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59029}
2019-01-23 13:45:07 +00:00
Sven Sauleau
d4831b31b8 [wasm] fix js-api memory/grow
Fix WebAssembly's memory/grow js-api. The argument is a unsigned long,
this change refactors most of arithmetic and bounds checks type from int64 to
uint32_t, according to the spec.

Bug: v8:8319
Change-Id: I662c704d1d50288ad68be70c72a3db7052a80014
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/1351028
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#59008}
2019-01-22 19:03:05 +00:00
Sven Sauleau
0e9e8164c2 [wasm] fix js-api table/get-set
Fix WebAssembly's table/get-set js-api. The argument is a unsigned long,
this change refactors most of arithmetic and bounds checks type from
int64 to uint32_t, according to the spec.

Bug: v8:8319
Change-Id: I088f631c6805b0e5ba29089b08ea15e78fe5852d
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/1414914
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#58941}
2019-01-19 09:15:37 +00:00
Sven Sauleau
fc27711780 [wasm] fix js-api table/grow
Fix WebAssembly's table/grow js-api. The argument is a unsigned long,
this change refactors most of arithmetic and bounds checks type from
int64 to uint32_t, according to the spec.

Bug: v8:8319
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Change-Id: Ia29121c930d7fb930668e54a5a769dae25234f2c
Reviewed-on: https://chromium-review.googlesource.com/c/1351006
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58936}
2019-01-18 20:19:51 +00:00
Ben L. Titzer
cb4e772921 [wasm] table.copy: handle overlap and zero count cases
This CL fixes the zero-count and overlapping cases for the table.copy
bytecode.

R=mstarzinger@chromium.org
CC=binji@chromium.org
BUG=v8:7747

Change-Id: I6211e4c899621069ebf8bc088b3ab4e80c7bbd0a
Reviewed-on: https://chromium-review.googlesource.com/c/1417172
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58887}
2019-01-17 13:55:20 +00:00
Andreas Haas
b565cda493 [wasm] Implement anyfunc parameters
Implementation of anyfunc parameters. Different to anyref parameters we
have to do a validation in the js-to-wasm wrapper: Only exported wasm
functions are allowed. I implemented this check in a runtime function.

R=titzer@chromium.org

Bug: v8:7581
Change-Id: I6145782fb8578124ddc21b50133c82235d666f19
Reviewed-on: https://chromium-review.googlesource.com/c/1417470
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58885}
2019-01-17 13:43:59 +00:00
Sven Sauleau
e65736241b [wasm] fix js-api global/value-get-set
Fix WebAssembly's global/value-get-set. The argument must not be
undefined.

mjsunit tests were updated.

Bug: v8:8319
Change-Id: Id3d3c9b18cbc8854e589481dfc7c52f35cfb7bf7
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/1411886
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#58863}
2019-01-16 18:56:51 +00:00
Ben L. Titzer
8a40e88db3 [wasm] Implement table.copy bytecode
The table.copy bytecode copies a range of table entries in a similar
way to memcopy. This CL implements the behavior in a runtime call
that calls into the wasm engine.

R=mstarzinger@chromium.org,binji@chromium.org
BUG=v8:7747

Change-Id: I420451202b1b78ea92cbd10387a644ed57e111c8
Reviewed-on: https://chromium-review.googlesource.com/c/1414919
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58858}
2019-01-16 16:55:31 +00:00
Michael Starzinger
aaee69584f [wasm] Switch to new 'catch' and 'br_on_exn' proposal.
This switches the experimental exception handling implementation to the
new proposal where 'catch' blocks behave in a catch-all fashion and a
new 'br_on_exn' operation is used to check for a certain exception type
and extract the exception values on a match.

R=clemensh@chromium.org
TEST=unittests/FunctionBodyDecoderTest,mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: Ib12ba28b3aa2a7d831312a83abcb00bf56d0adc3
Reviewed-on: https://chromium-review.googlesource.com/c/1409431
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58832}
2019-01-15 14:46:30 +00:00
Andreas Haas
51ad897d3f [wasm][anyref] Implement re-export of mutable anyref globals
R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: If469467663e632a1dba3bd55ace830e1b2f38f7e
Reviewed-on: https://chromium-review.googlesource.com/c/1409427
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58824}
2019-01-15 12:27:56 +00:00
Andreas Haas
b3e6013eb4 [wasm][anyref] Support importing mutable anyref globals
With this CL we support importing mutable anyref globals. The CL
contains the following changes:

* We store a reference to the buffer of the imported global in
  `WasmInstance::imported_mutable_globals_buffer`. This FixedArray is
  already used to keep the ArrayBuffers of value-typed imported
  mutable globals alive but was not accessed otherwise.

* We store the offset in the buffer of the imported global in
  `WasmInstance::imported_mutable_globals`. This `Address`-array is
  used for value-typed imported mutalbe globals to store direct
  pointers into the backing store of the ArrayBuffer of the imported
  global.

* In wasm-compiler.cc we generate code to load these fields and then
  load or store globals.

* in module-compiler.cc I removed the counter variable
  `next_imported_mutable_global_index`. The variable was only used for
  a DCHECK. I replaced the DCHECK with a slightly weaker DCHECK now.

* Tests.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I11f0f4d8637c98eded5fb2eec44bc8ead8ed5c7b
Reviewed-on: https://chromium-review.googlesource.com/c/1409169
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58822}
2019-01-15 11:40:24 +00:00
Ben L. Titzer
97cdf35f4a [wasm] Implement table.drop
The table.drop bytecode "drops" the backing storage for an element
initializer. In the V8 implementation, this is a nop, other than
updating a per-instance boolean array so that two drops of the same
segment or a drop of an active segment will trap.

This is implemented with inline code in TurboFan in order to be symmetric
to memory.drop, but could as easily be a runtime call to be supported in
Liftoff.

R=mstarzinger@chromium.org
CC=​binji@chromium.org
BUG=v8:7747

Change-Id: Ic017398eaa764dd3a9ff19523453ff7142c9abf6
Reviewed-on: https://chromium-review.googlesource.com/c/1408996
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58817}
2019-01-15 10:07:17 +00:00
Ben L. Titzer
6d3d8f7be6 [wasm] Add runtime call plumbing for Table operations.
This CL adds two new runtime calls for table operations:
  - Runtime_WasmTableInit
  - Runtime_WasmTableCopy

These runtime calls (will) implement the semantics for the corresponding
bytecodes from the bulk memory proposal. The actual implementation
of these runtime calls will be done in further CLs.

The third table operation, table.drop, will be implemented with inline
code, similar to memory.drop. This is also be done in a further CL.

R=mstarzinger@chromium.org
CC=​binji@chromium.org
BUG=v8:7747

Change-Id: I498aa054329baf9f72ae55d245b12c3ccd4157b7
Reviewed-on: https://chromium-review.googlesource.com/c/1408994
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58786}
2019-01-14 14:33:08 +00:00
Sven Sauleau
ae5c2ea8f9 [wasm] support calling an imported func that returns a i64
It removes the assertion that caused the bug report by introducing a new
trampoline (WasmBigIntToI64) for the conversion code stub between a Bigint
object and a Wasm i64 BigIntToI64).

The tests were updated to cover calling the stub from a Wasm callsite.

Bug: v8:8625
Change-Id: I55891001cfa72f6f2849792293b43bbb54147f1a
Reviewed-on: https://chromium-review.googlesource.com/c/1405028
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58767}
2019-01-14 10:28:45 +00:00
Andreas Haas
2755543ab3 [wasm] Remove --experimental-wasm-mut-global flag
The flag has been enabled by default since June 2018, see
https://crrev.com/c/1095650.

R=binji@chromium.org

Bug: v8:7625
Change-Id: I7cb4874db7f632b593f912e084b9fb7b8d568afe
Reviewed-on: https://chromium-review.googlesource.com/c/1402546
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58689}
2019-01-10 09:40:56 +00:00
Andreas Haas
0adcb82a8b [wasm][anyref] Allow export of mutable anyref globals
R=titzer@chromium.org

Bug: v8:7581
Change-Id: I4725eada889cc8cf6a3ca537f05b1da2f5e83f2b
Reviewed-on: https://chromium-review.googlesource.com/c/1400413
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58632}
2019-01-08 13:30:59 +00:00
Andreas Haas
741f2312d1 [wasm][anyref] Allow anyref values in WebAssembly.Global objects
This CL adds support for anyref in WebAssembly.Global objects. Note
that the specification is not complete yet in this area.

I did the following changes:
- I renamed the `array_buffer` field of WasmGlobalObject to
  `untagged_buffer`
- I added an additional field of type FixedArray, `tagged_buffer`.
  - In the constructor of WasmGlobalObject I allocate either the former
    or the latter, but not both.
- In the WebAssembly.Global constructor I added special handling for
  the case where no initial value is provided. In that case I set the
  inital value to `null` and not to `undefined`.

R=titzer@chromium.org

Bug: v8:7581
Change-Id: I7e4855d7e6c04a9bcdc7ebd450caca5819d060e2
Reviewed-on: https://chromium-review.googlesource.com/c/1398226
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58625}
2019-01-08 12:02:51 +00:00
Sven Sauleau
4365bf23aa [wasm] fix js-api global/constructor
Fix WebAssembly's global/constructor js-api. Globals with a value
of i64 is now valid even if Wasm BigInt feature isn't activated.

Bug: v8:8319
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Change-Id: Ia41ad69efa5253064ecdb8f59b149393cd672b68
Reviewed-on: https://chromium-review.googlesource.com/c/1382747
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58603}
2019-01-07 22:56:18 +00:00
Andreas Haas
122d8b5103 [wasm][anyref] Add support for importing anyref globals
With this CL it is possible to import any JavaScript object as an anyref
global. The exception is WasmGlobalObject, which cannot hold anyref
globals yet.

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: I5b0fc686a4ec5c579d1d635b53be5ccdf0a78f27
Reviewed-on: https://chromium-review.googlesource.com/c/1382452
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58557}
2019-01-04 16:10:18 +00:00
Clemens Hammacher
9f90c8dc43 [wasm] Force GC earlier to avoid running OOM
We currently trigger a GC when creating a module while the remaining
uncommitted code space is below 32MB. For bigger modules, this is not
enough. Instead, make this limit relative: Trigger GC if we fall below
50% of the available code space, and re-adjust this limit after each GC
to avoid repeated GCs that do not free anything.

R=ahaas@chromium.org

Bug: v8:8624
Change-Id: I7abfad3b57663d528a26d29232ad6bc2dc63cef4
Reviewed-on: https://chromium-review.googlesource.com/c/1391753
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58527}
2019-01-03 16:07:53 +00:00
Deepti Gandluri
29c1c5d6ca [wasm] Validate prefixed opcode reads
Identify validation fails to read the index of prefixed opcodes, and not
continue to decode the next bytes.

Change-Id: I2c737af55615ba69ba0c5f5adf18a06c6cdb951a
Bug: chromium:905815
Reviewed-on: https://chromium-review.googlesource.com/c/1390927
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58485}
2018-12-28 07:07:11 +00:00
Clemens Hammacher
f328613d04 [wasm] Fix i8 to i32 sign extension on ia32
The source register of {movsx_b} must be a byte register.

Drive-by: Add missing sign extension opcodes to wasm-constants.js.

R=herhut@chromium.org

Bug: chromium:916869
Change-Id: I571c1ea2a0e197afefc810f306eed238250cd5e0
Reviewed-on: https://chromium-review.googlesource.com/c/1386110
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58394}
2018-12-20 12:28:54 +00:00
Andreas Haas
32562e91af [wasm][anyref] Implement anyref globals
This CL implements the global.get and global.set instruction for anyref
globals. This includes:

* Properly decode anyref globals.
* Add a FixedArray to WasmInstanceObject to store anyref globals.
* Initialize the FixedArray.
* Generate code for global.get and global set.

This CL does not allow to import globals yet.

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: I62617409271d9b6f2253a191681189865aa1f459
Reviewed-on: https://chromium-review.googlesource.com/c/1380112
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58318}
2018-12-18 13:28:34 +00:00
Alessandro Pignotti
5f6b780374 OwnedByAddressingOperand should also allow uses by ProtectedLoad
ProtectedLoad/ProtectedStore opcodes are used in WebAssembly to represent memory
accesses. Since they are not part of the allowed opcodes in OwnedByAddressingOperand
it is not possible to take advantage of addressing modes to encode common patterns
for the pointer input value.

R=jarin@chromium.org

Bug: v8:8508
Change-Id: Ic62bf13fed7b1d86afb112d9aa59cd7073a28e72
Reviewed-on: https://chromium-review.googlesource.com/c/1354458
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58237}
2018-12-14 09:39:55 +00:00
Ben Smith
4084185b3c [wasm] Implement memory.init and memory.drop
`memory.init` copies bytes from a passive data segment to linear memory.

`memory.drop` is an instruction that informs the wasm VM that the instance no
longer needs access to the passive data segment.

Information about the passive data segments, including their contents, length,
and whether they are dropped, is stored in the `WasmInstanceObject` as primitive
arrays.

Bug: v8:7747
Change-Id: I1515c8868c9be227743456a539126c15280b5365
Reviewed-on: https://chromium-review.googlesource.com/c/1370691
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58196}
2018-12-12 17:33:05 +00:00
Andreas Haas
8f406d4403 [wasm][anyref] Add more tests
These are some tests I thought were missing. I wrote another test which
crashes because of missing safepoint maps. I will add it in a separate
CL which includes also the implementation.

R=herhut@chromium.org

Bug: v8:7581
Change-Id: Ibcc3b9ddab0f95580eb31fe78c84a26186a74db5
Reviewed-on: https://chromium-review.googlesource.com/c/1370039
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58159}
2018-12-11 15:28:33 +00:00
Sven Sauleau
2b92afd054 [wasm] Add WebAssembly's i64<>JavaScript's BigInt conversions - 64 bits
Uses the JavaScript BigInt Object to represent Wasm's 64bits integers.
Attention, 32 bits architectures are not supported yet.

Bug: v8:7741
Change-Id: I28b718fa567bca5103b2f38a879049cd20a46f12
Reviewed-on: https://chromium-review.googlesource.com/c/1355144
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58152}
2018-12-11 12:30:50 +00:00
Sven Sauleau
ff6544c5b0 [wasm] fix js-api Memory and Table constructor
Fix and re-enable tests for WebAssembly's memory/constructor and
table/constructor js-api.

It introduces the '[EnforceRange] unsigned long' algorithm used
to validate initial and maximum properties.

The initial property is now required, by the switch to the Web IDL
specification. Most of the input validations errors are now considered
TypeError instead of RangeError.

The WasmTableObject and WasmMemoryObject APIs use more consistently uint32_t
to ensure integer range and remove the need for bounds checks.

Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Bug: v8:8319
Change-Id: Iedd3ee6484ef688a5e96f93006eb6ca66d805a48
Reviewed-on: https://chromium-review.googlesource.com/c/1354043
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58138}
2018-12-10 23:32:05 +00:00
Ben Smith
e151479972 [wasm] Implement memory.copy and memory.fill
This implementation currently only supports the optimized tier.

Bug: v8:7747
Change-Id: Ia1af29b11a5d3e8a48b122f6cf3240c9f5948bfb
Reviewed-on: https://chromium-review.googlesource.com/c/1364710
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58137}
2018-12-10 21:21:50 +00:00
Clemens Hammacher
2c90935772 [wasm] Do not pop arguments for return
Just pass a pointer to the current stack. This makes it easier to reuse
the {DoReturn} method for breaks to the outermost block.

R=titzer@chromium.org

Bug: v8:8423
Change-Id: Ide8533b154daa227e044820bb9c181f836ba654a
Reviewed-on: https://chromium-review.googlesource.com/c/1370028
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58132}
2018-12-10 16:15:21 +00:00
Michael Starzinger
0c0d4c3934 Reland "[wasm] Support encoding s128 simd types in exceptions."
This is a reland of 9c2c8f15f8

Original change's description:
> [wasm] Support encoding s128 simd types in exceptions.
> 
> This adds support for having simd type values (i.e. s128) stored in an
> exception. It is the natural combination of the simd propsal and the
> exception handling proposal.
> 
> R=clemensh@chromium.org
> TEST=mjsunit/wasm/exceptions-simd
> BUG=v8:8390
> 
> Change-Id: I01079f82a6ba4d9152de4dae63e3db1584ca7cd8
> Reviewed-on: https://chromium-review.googlesource.com/c/1363141
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58098}

Bug: v8:8390
Change-Id: I333c50cd766055f74b023df626d0fd90fdef3bac
Reviewed-on: https://chromium-review.googlesource.com/c/1370024
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58122}
2018-12-10 11:27:31 +00:00
Michael Starzinger
2f55187e52 [wasm][test] Deduplicate assertWasmThrows helper method.
R=clemensh@chromium.org

Change-Id: Ie4f40314eb41957c6983796e43eeefe655458160
Reviewed-on: https://chromium-review.googlesource.com/c/1367806
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58118}
2018-12-10 09:56:17 +00:00
Clemens Hammacher
9efb53db20 Revert "[wasm] Support encoding s128 simd types in exceptions."
This reverts commit 9c2c8f15f8.

Reason for revert: New test crashes: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux/28948

Original change's description:
> [wasm] Support encoding s128 simd types in exceptions.
> 
> This adds support for having simd type values (i.e. s128) stored in an
> exception. It is the natural combination of the simd propsal and the
> exception handling proposal.
> 
> R=​clemensh@chromium.org
> TEST=mjsunit/wasm/exceptions-simd
> BUG=v8:8390
> 
> Change-Id: I01079f82a6ba4d9152de4dae63e3db1584ca7cd8
> Reviewed-on: https://chromium-review.googlesource.com/c/1363141
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58098}

TBR=mstarzinger@chromium.org,gdeepti@chromium.org,clemensh@chromium.org

Change-Id: Iedcfba36af925249131a2b0e9aebd92321ae72f5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8390
Reviewed-on: https://chromium-review.googlesource.com/c/1367808
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58102}
2018-12-07 15:58:02 +00:00
Michael Starzinger
9c2c8f15f8 [wasm] Support encoding s128 simd types in exceptions.
This adds support for having simd type values (i.e. s128) stored in an
exception. It is the natural combination of the simd propsal and the
exception handling proposal.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-simd
BUG=v8:8390

Change-Id: I01079f82a6ba4d9152de4dae63e3db1584ca7cd8
Reviewed-on: https://chromium-review.googlesource.com/c/1363141
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58098}
2018-12-07 15:10:35 +00:00
Sven Sauleau
0ad76c9709 Reland "[wasm] fix js-api interface"
This is a reland of 0e8f20d2ab

Original change's description:
> [wasm] fix js-api interface
> 
> Make sure WebAssembly's js-api exposes the correct attributes: writable,
> enumerable and configurable.
> 
> Bug: v8:8319
> Change-Id: I427533159d7975a42c0c5cb1babdc8a61f8198b5
> Reviewed-on: https://chromium-review.googlesource.com/c/1351002
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58053}

Bug: v8:8319
Change-Id: I2d0af568edab295ad8c01b64e588bbabf89bd251
Reviewed-on: https://chromium-review.googlesource.com/c/1365273
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58078}
2018-12-07 01:36:22 +00:00
Clemens Hammacher
588d1789ea Revert "[wasm] fix js-api interface"
This reverts commit 0e8f20d2ab.

Reason for revert: Breaks layout tests, blocks roll: https://ci.chromium.org/p/chromium/builders/luci.chromium.try/linux-blink-rel/3047

Original change's description:
> [wasm] fix js-api interface
> 
> Make sure WebAssembly's js-api exposes the correct attributes: writable,
> enumerable and configurable.
> 
> Bug: v8:8319
> Change-Id: I427533159d7975a42c0c5cb1babdc8a61f8198b5
> Reviewed-on: https://chromium-review.googlesource.com/c/1351002
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58053}

TBR=binji@chromium.org,adamk@chromium.org,gdeepti@chromium.org,ssauleau@igalia.com

Change-Id: I16fa44a0e79020850613751ae45a68d67602166d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8319
Reviewed-on: https://chromium-review.googlesource.com/c/1365270
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58061}
2018-12-06 06:52:23 +00:00
Sven Sauleau
0e8f20d2ab [wasm] fix js-api interface
Make sure WebAssembly's js-api exposes the correct attributes: writable,
enumerable and configurable.

Bug: v8:8319
Change-Id: I427533159d7975a42c0c5cb1babdc8a61f8198b5
Reviewed-on: https://chromium-review.googlesource.com/c/1351002
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58053}
2018-12-05 20:05:00 +00:00
Michael Starzinger
3fdc277323 [wasm] Restrict exception section according to spec.
The placement of the exceptipon section is by now restricted to be in
between the Global and the Import section. This changes our validation
to check this stricter requirement now.

R=clemensh@chromium.org
TEST=unittests/WasmModuleVerifyTest
BUG=v8:8091

Change-Id: Ib3ea625fd4df93bffda47ced09e6969159f7ac70
Reviewed-on: https://chromium-review.googlesource.com/c/1356504
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57962}
2018-11-30 11:22:07 +00:00
Aseem Garg
5b55ec2ac0 Reland "[wasm] Add I64AtomicWait implementation"
This is a reland of 9436e8a817

This CL simplifies the wasm/futex.js test so that it doesn't push the
limits of d8.

Original change's description:
> [wasm] Add I64AtomicWait implementation
>
> Bug=v8:8075
> R=adamk@chromium.org,binji@chromium.org
>
> Change-Id: I11ef5daccd043123b23e60c93ee0df79cabe9ccd
> Reviewed-on: https://chromium-review.googlesource.com/c/1342948
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57917}

Change-Id: Ifd26f1ecdb9fe24a1896162bb4d4285f9188a9ba
Reviewed-on: https://chromium-review.googlesource.com/c/1351304
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57953}
2018-11-30 02:24:04 +00:00
Michael Starzinger
69ab6954b1 [wasm] Fix exception section code for spec compliance.
R=clemensh@chromium.org
BUG=v8:8091

Change-Id: Ib0e0b50d1fe24b0e528a3dd9849829799b33f1bc
Reviewed-on: https://chromium-review.googlesource.com/c/1355139
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57945}
2018-11-29 16:21:58 +00:00
Aseem Garg
f4775f1c10 Revert "[wasm] Add I64AtomicWait implementation"
This reverts commit 9436e8a817.

Reason for revert: Breaks TSAN.

Original change's description:
> [wasm] Add I64AtomicWait implementation
> 
> Bug=v8:8075
> R=​adamk@chromium.org,binji@chromium.org
> 
> Change-Id: I11ef5daccd043123b23e60c93ee0df79cabe9ccd
> Reviewed-on: https://chromium-review.googlesource.com/c/1342948
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57917}

TBR=binji@chromium.org,adamk@chromium.org,aseemgarg@chromium.org

Change-Id: Ic82ce8794410a0d4d19de07abd9bb8a7aaff1c1c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1351303
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57919}
2018-11-29 01:10:39 +00:00
Aseem Garg
9436e8a817 [wasm] Add I64AtomicWait implementation
Bug=v8:8075
R=adamk@chromium.org,binji@chromium.org

Change-Id: I11ef5daccd043123b23e60c93ee0df79cabe9ccd
Reviewed-on: https://chromium-review.googlesource.com/c/1342948
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57917}
2018-11-28 20:03:04 +00:00
Clemens Hammacher
4516efa12d [wasm][test] Remove unspec'ed name section code
This constant is unused, and should never be used, since name sections
are encoded as an unknown section with the special name "name".

R=ahaas@chromium.org

Change-Id: I2fa1a21506dbe30033aecb3c1bf9ad84b6b872bc
Reviewed-on: https://chromium-review.googlesource.com/c/1352305
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57905}
2018-11-28 14:47:36 +00:00
Clemens Hammacher
2cdd38e57a [wasm][test] Remove redundant function
The {setTableLength} method is redundant and has a single user. Remove
it, use {setTableBounds} instead.

Drive-by: Add default to the table max, to document that this can
actually be {undefined}, in which case the table has no maximum.

R=binji@chromium.org

Bug: v8:8238
Change-Id: I0d7a2f4d49d083f7adadbb4b6cd4933bcb1dc174
Reviewed-on: https://chromium-review.googlesource.com/c/1350126
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57860}
2018-11-27 10:13:32 +00:00
Ben L. Titzer
99484e23cb [wasm] Intrinsify math imports
This CL adds new Wasm import call kinds that correspond to various
math functions that can be imported from JavaScript, such as trigonometry.
Instead of calling a special import wrapper that converts arguments
to tagged values by boxing, we can now generate calls to little WASM
stubs that contain a single WASM bytecode each.

R=mstarzinger@chromium.org
BUG=v8:8423

Change-Id: I59b1be2dd36d190a8b6c98b88c86cecc0ca7f4a2
Reviewed-on: https://chromium-review.googlesource.com/c/1349279
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57835}
2018-11-26 15:17:51 +00:00
Aseem Garg
2b9bd491ce [wasm] Add I32AtomicWait implementation
Bug=v8:8075
R=adamk@chromium.org,binji@chromium.org

Change-Id: I2367e24888a268ce93b1730195cb4767896861cc
Reviewed-on: https://chromium-review.googlesource.com/c/1341126
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57624}
2018-11-20 02:01:44 +00:00
Aseem Garg
de8609aaf5 [wasm] Prototype I32AtomicWake implementation
Bug=v8:8075
R=adamk@chromium.org

Change-Id: Ib7b18448d59e1f54f664e24908fbd3a8b4607a9f
Reviewed-on: https://chromium-review.googlesource.com/c/1332153
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57623}
2018-11-19 23:19:54 +00:00
Ben L. Titzer
c01bfa9af9 [turbofan] Implement loop rotation
This CL implements an assembly order optimization that moves blocks
that end a loop with an unconditional backedge to the beginning of
the loop, saving a branch.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:8423

Change-Id: I8a5d25f5472d71227af0f623277ea8d0a8d69867
Reviewed-on: https://chromium-review.googlesource.com/c/1335944
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57572}
2018-11-16 13:52:12 +00:00
Ben Smith
fd1b8bbf9e [wasm] Add bulk memory flag; parse passive segments
See the WebAssembly bulk memory proposal here:
https://github.com/WebAssembly/bulk-memory-operations

This initial CL adds a wasm experimental flag:
`--experimental-wasm-bulk-memory`, and also parsing of passive segments.

A passive segment is one that is not copied into the table/memory on
instantiation, but instead later via the `{table,memory}.init`
instructions.

The binary format of passive data segments is unlikely to change, but
the format for passive element segments may change (see
https://github.com/WebAssembly/bulk-memory-operations/pull/39).

Bug: v8:7747
Change-Id: I2a7fb9bc7648a722a8c4aab4185c68d3d0843858
Reviewed-on: https://chromium-review.googlesource.com/c/1330015
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57451}
2018-11-12 23:10:30 +00:00
Clemens Hammacher
126d1d7b66 [wasm] Avoid spread of huge arrays in module builder
I just ran into this when creating a test case. The huge spread caused
a RangeError (stack overflow). It's not causing problems for the tests
we currently have, but let's fix it anyway.

R=ahaas@chromium.org

Change-Id: Ib67f059f2981ccc6239ba4ae05611e20eb3aa191
Reviewed-on: https://chromium-review.googlesource.com/c/1329177
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57429}
2018-11-12 11:28:26 +00:00
Clemens Hammacher
233cb0bfc6 [wasm][test] Remove default --wasm-async-compilation flag
The flag is on by default, so we don't need to specify it. More
importantly, the tests are expected to work for any value of that flag.
So don't force the flag but use whatever the test variant chooses.

Note that in streaming-compile.js, the flag was accidentally specified
as '-async-compilation'. I also removed that one.

R=ahaas@chromium.org

Change-Id: Ifad31160d266dda38cdd9dd1d73dad69bd2c2f2c
Reviewed-on: https://chromium-review.googlesource.com/c/1325961
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57406}
2018-11-09 17:29:17 +00:00
Clemens Hammacher
1e1ca02865 [wasm] Slightly improve async tests
These tests are also used for streaming. This CL changes the test to
actually output the exception that unexpectedly happened.

R=ahaas@chromium.org

Bug: v8:7921
Change-Id: Ia9c91a7d3d9452f9c0180329a5434f049b56c3c8
Reviewed-on: https://chromium-review.googlesource.com/c/1319755
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57284}
2018-11-06 15:09:52 +00:00
Clemens Hammacher
fac176d813 [wasm] Fix memory limit checks
For memory limit checks, we should use the minimum of the
--wasm-max-mem-pages flag and kV8MaxWasmMemoryPages. The former is a
limit set by the user, the latter is the maximum we can handle
internally.

R=titzer@chromium.org

Bug: chromium:898677
Change-Id: I3c549f4e90dd016b5d07475d9353f30134f76dcc
Reviewed-on: https://chromium-review.googlesource.com/c/1305274
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57127}
2018-10-30 13:44:48 +00:00
Clemens Hammacher
cc70a6b050 [wasm] Rename GrowMemory to MemoryGrow
The "grow_memory" opcode was renamed to "memory.grow", and the spec
repo was updated to use kExprMemoryGrow internally instead of
kExprGrowMemory (https://github.com/WebAssembly/spec/pull/720).
This CL does the same change for v8.

Drive-by: Rename "current_size" to "memory.size", and a minor cleanup
in wasm-graph-builder.js to bring it in line with the version in the
js-api tests in the spec repo.

R=titzer@chromium.org

Change-Id: If525dba898b2c248890a616d3392c22b45f698ef
Reviewed-on: https://chromium-review.googlesource.com/c/1302057
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57089}
2018-10-29 14:06:24 +00:00
Clemens Hammacher
8808e03809 [wasm] Tidy up wasm-module-builder.js
Fix some JS smells as suggested in
https://github.com/WebAssembly/spec/issues/897.

R=ahaas@chromium.org

Bug: v8:8238
Change-Id: Idc4f738da849f28477563df628dcae2805b1b47e
Reviewed-on: https://chromium-review.googlesource.com/c/1301476
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57029}
2018-10-26 12:05:11 +00:00
Michael Starzinger
e893eb1403 [wasm] Support encoding reference types in exceptions.
This adds support for having reference type values (i.e. anyref) stored
in an exception. It is the natural combination of the reference type
proposal and the exception handling proposal.

Note that this also introduces support for having write barriers in
generated WasmCode, as this is the first time we are storing references
within generated code. Such write barriers will be needed for other uses
of reference types (e.g. mutable global) regardless.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-anyref
BUG=v8:8341

Change-Id: I1211d4a850954622cb873eede0b4024fecc3dd8b
Reviewed-on: https://chromium-review.googlesource.com/c/1296484
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56995}
2018-10-25 15:44:29 +00:00
Clemens Hammacher
ecbf6296c7 [wasm] Fix streaming instantiation with no code section
Because of ordering issues we didn't set the wire bytes on the
{NativeModule} during {OnFinishedStream}. We then failed during
instantiation when trying to read the import names from the wire bytes.

This CL fixes this locally without much code churn. I plan to clean up
the interaction between {AsyncCompileJob} and {AsyncStreamingProcessor}
in a follow-up CL.

R=ahaas@chromium.org

Bug: chromium:898310
Change-Id: I06337a04ba380f87b803f325323208298d363f41
Reviewed-on: https://chromium-review.googlesource.com/c/1296467
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56938}
2018-10-24 12:43:24 +00:00
Michael Starzinger
5ee459e855 [wasm] Add exception attributes to binary format.
This adds an attribute field to the binary encoding of exception types
in the exceptions and import section. Currently the attribute value is
not used and expected to be zero, but it ensures the binary encoding is
extensible for future changes.

R=clemensh@chromium.org
TEST=unittests/WasmModuleVerifyTest
BUG=v8:8153

Change-Id: I6f0e10cb1b6515177d8200ebf1f4f0b122832868
Reviewed-on: https://chromium-review.googlesource.com/c/1291075
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56841}
2018-10-22 09:23:02 +00:00
Stephan Herhut
9c00157351 [wasm] Add stress test for I64 atomics
This test is modelled after the atomics-stress test but supports 64 bit
operands.

Bug: v8:6532
Change-Id: I313b1ade74a58201b3fa097ba5b1515754a685db
Reviewed-on: https://chromium-review.googlesource.com/c/1234414
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56812}
2018-10-19 10:51:21 +00:00
Stephan Herhut
c7a1743115 [wasm] Add stress test of atomic opcodes.
This test runs random sequences of atomic wasm operations on multiple
threads and tries to compute an equivalent sequential interleaving that
would reproduce intermediate results.
By its nature, this test might time out and is flaky.

Bug: v8:6532
Change-Id: Iafdab4561cbf37a5c3fa9b8af9d0fbaaf5681608
Reviewed-on: https://chromium-review.googlesource.com/c/1195366
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56810}
2018-10-19 09:59:05 +00:00
Ben Smith
4347d0add1 Reland "[wasm] Add a new wasm-js testsuite to run js-api tests"
This is a reland of a12203c64b

Original change's description:
> [wasm] Add a new wasm-js testsuite to run js-api tests
> 
> These changes were necessary to run with the new style of jsapi tests
> introduced in https://github.com/WebAssembly/spec/pull/883.
> 
> Change-Id: I4629dd48d595ed97ed0607dec9e7d9808c706a7e
> Reviewed-on: https://chromium-review.googlesource.com/c/1277724
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56745}

Change-Id: I25fcd95bfc1aee1d21da390359423e5dfed112a4
Reviewed-on: https://chromium-review.googlesource.com/c/1286952
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56791}
2018-10-18 20:18:55 +00:00
Bill Budge
5c5dd02128 Revert "[wasm] Add a new wasm-js testsuite to run js-api tests"
This reverts commit a12203c64b.

Reason for revert: Breaks isolate_tests

https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20builder/36777

Original change's description:
> [wasm] Add a new wasm-js testsuite to run js-api tests
> 
> These changes were necessary to run with the new style of jsapi tests
> introduced in https://github.com/WebAssembly/spec/pull/883.
> 
> Change-Id: I4629dd48d595ed97ed0607dec9e7d9808c706a7e
> Reviewed-on: https://chromium-review.googlesource.com/c/1277724
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56745}

TBR=binji@chromium.org,machenbach@chromium.org,yangguo@chromium.org,ahaas@chromium.org,clemensh@chromium.org,mathias@chromium.org

Change-Id: I2edd0ca94cb5990322571879c81671fa835f3ecd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1286526
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56746}
2018-10-17 17:30:45 +00:00
Ben Smith
a12203c64b [wasm] Add a new wasm-js testsuite to run js-api tests
These changes were necessary to run with the new style of jsapi tests
introduced in https://github.com/WebAssembly/spec/pull/883.

Change-Id: I4629dd48d595ed97ed0607dec9e7d9808c706a7e
Reviewed-on: https://chromium-review.googlesource.com/c/1277724
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56745}
2018-10-17 17:07:53 +00:00
Michael Starzinger
c113f71a32 [wasm] Switch exception section encoding to new proposal.
This switches the encoding of the exceptions (in the exceptions as well
as the import section) to use a signature index instead of a flat type
vector encoding. Note that only signatures that have a void return type
can be used for declaring exceptions.

R=clemensh@chromium.org
BUG=v8:8153

Change-Id: I481ccbce9ddf29becdf4ed7ceffe80d6145446e1
Reviewed-on: https://chromium-review.googlesource.com/c/1280323
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56654}
2018-10-15 16:05:21 +00:00
Adam Klein
cc8c92a9ae Reduce wasm OWNERS to current team members
Change-Id: I982f3615136c7a4ba18e4a6d2cc06a3e24e22f54
Reviewed-on: https://chromium-review.googlesource.com/c/1277722
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56645}
2018-10-15 14:47:49 +00:00
Clemens Hammacher
f717e7f5b2 [wasm] Don't put interpreter entries in the code table
For serialization we are using the code table to find the code of all
functions. We want to serialize compiled code though, not interpreter
entries (we currently fail a DCHECK there).
This CL changes the logic to not update the code table with interpreter
entries but instead keeps a separate bit set of interpreted functions.

R=mstarzinger@chromium.org

Bug: v8:8177, chromium:735509
Change-Id: I69c59f92712135ddef667b54114614fad94cc6fc
Reviewed-on: https://chromium-review.googlesource.com/c/1278794
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56644}
2018-10-15 14:46:09 +00:00
Michael Starzinger
eac44d603b [wasm] Initial implementation of rethrow expressions.
R=titzer@chromium.org
TEST=mjsunit/wasm/exceptions-rethrow,unittests/FunctionBodyDecoderTest
BUG=v8:8091

Change-Id: If52be505fb9897af1bd59d17d1ab47b33b665be0
Reviewed-on: https://chromium-review.googlesource.com/c/1273050
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56563}
2018-10-11 12:54:22 +00:00
Michael Starzinger
b7f1334e74 [wasm] Fix corner cases with unreachable catch-all blocks.
This makes sure that catch blocks that are practically unreachable due
to missing exceptional projections are handled properly. Note that this
is independent of how reachability will be outlined in the final spec
for exception handling. Currently we just assume that all catch blocks
are spec-wise reachable.

R=titzer@chromium.org
TEST=mjsunit/wasm/exceptions-catchall
BUG=v8:8091

Change-Id: I13607a59bd76be146df836e88105a2fbafedb760
Reviewed-on: https://chromium-review.googlesource.com/c/1273018
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56556}
2018-10-11 10:27:47 +00:00
Ben Smith
bf3c8b8ff3 [wasm] Cleanup wasm-module-builder.js
Use naming similar to the spec: "table" instead of "function table",
"element segment" instead of "function table init".

Change-Id: Ib1b6cdfa566f8bd00017ccedf9440084204f10ff
Reviewed-on: https://chromium-review.googlesource.com/c/1273612
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56545}
2018-10-10 22:50:57 +00:00
Ben L. Titzer
a2b3480611 [wasm] Use a tuple as the instance for JS imports
This CL refactors the implementation of WASM->JS import wrappers in order
to make the wrapper code shareable. Instead of specializing to the import
index, we use a tuple as the object ref in the both the import and indirect
tables. The tuple allows the wrapper code to load both the calling
instance and the target callable, rather than relying on code specialization.

This requires some tricky codegen machinery, because WASM call descriptors
expect an instance argument in a given register, yet the wrappers receive
a tuple, the code generator must generate a prologue that loads the
instance (and the callable), since it is not possible to express this at
the graph level.

R=mstarzinger@chromium.org
CC=clemensh@chromium.org

Change-Id: Id67e307f7f5089e776f5439a53b5aee4b76934b6
Reviewed-on: https://chromium-review.googlesource.com/c/1268237
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56520}
2018-10-10 11:07:35 +00:00
Michael Starzinger
73250d9c88 [wasm] Fix corner cases with catch-all handling.
This fixes handling of two corner cases with catch-all blocks:
1) The catch-all blocks are conceptually outside the corresponding try.
2) Reachability of catch-all is determined by parent reachability.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-catchall
BUG=v8:8091

Change-Id: Idfd8310bc232f3ce389763023c5a33f1ef90e0b5
Reviewed-on: https://chromium-review.googlesource.com/c/1270816
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56486}
2018-10-09 14:15:13 +00:00
Michael Starzinger
2e007737ca [wasm] Add support for multiple catch blocks.
This adds support for multiple catch blocks being attached to a single
try block. The implemented semantics are that type checks are performed
in order from top to bottom.

Note that multiple catch blocks of the same type are not prohibited and
will be accepted, making the second such block essentially unreachable.
The current proposal neither explicitly allows nor prohibits it.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: I31e7a07a7cffdd909a58342e00f05e52ed1a3182
Reviewed-on: https://chromium-review.googlesource.com/c/1270591
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56478}
2018-10-09 12:26:55 +00:00
Michael Starzinger
d56e29d1c0 [wasm] Initial catch-all control flow wiring.
This adds support to wire control flow of catch-all expressions into an
existing try-catch cascade. Note that multiple typed catch blocks are
not yet supported, only one typed catch block followed by one catch-all
block is supported.

In case the explicit catch-all block is missing, we emulate the correct
semantics by internally always emitting a catch-all containing a simple
rethrow instruction.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-catchall
BUG=v8:8091

Change-Id: I6b29a98c4f1a558fabe6012f4ba6c7b7d43529bb
Reviewed-on: https://chromium-review.googlesource.com/c/1270585
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56476}
2018-10-09 11:09:58 +00:00
Stephan Herhut
94364486c6 [wasm] Add test for I64AtomicCompareExchange
This adds a stress test for the I64 variants of the
AtomicCompareExchange opcodes.

Bug: v8:6532
Change-Id: Iaba4f31f944a71393e5c3222d364d214ff482b9e
Reviewed-on: https://chromium-review.googlesource.com/1235913
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56261}
2018-09-27 11:46:35 +00:00
Deepti Gandluri
0423b9e330 [atomics] Fix I64CmpExchg for narrow width operations
Change-Id: I1cf8d697b5a4408fb75332dc39be12c0a2ee0e5a
Bug: v8:8202, v8:6532
Reviewed-on: https://chromium-review.googlesource.com/1240907
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56254}
2018-09-27 08:05:10 +00:00
Sam Clegg
505cccb9e9 [d8] Update new Worker API to match the Web API
Previously we only supported strings and not filenames.  This
changes the default to filename and adds a new `type: string` which can
be passed `options` to allow for strings to be passed in test code.

See: https://developer.mozilla.org/en-US/docs/Web/API/Worker/Worker

Bug: v8:8020
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ie8818885c5c5c071b6614852322cb45aeb01a647
Reviewed-on: https://chromium-review.googlesource.com/1185980
Commit-Queue: Sam Clegg <sbc@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56056}
2018-09-20 00:10:28 +00:00
Clemens Hammacher
5e94b2083a Reland "[wasm] Introduce a soft limit on reserved memory"
This is a reland of 3bb5cb63da

Original change's description:
> [wasm] Introduce a soft limit on reserved memory
> 
> Currently, wasm memory and wasm code use a shared limit for the total
> size of reservations. This can cause wasm code reservations to fail
> because wasm memories used all available reservation space.
> This CL introduces a soft limit which is used when allocating wasm
> memory with full guards. If this limit is reached and the respective
> flag is set, we fall back to allocation without full guards and check
> against the hard limit. Code reservations always check against the hard
> limit.
> 
> R=ahaas@chromium.org
> 
> Bug: v8:8196
> Change-Id: I3fcbaeaa6f72c972d408d291af5d6b788d43151d
> Reviewed-on: https://chromium-review.googlesource.com/1233614
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56028}

Bug: v8:8196
Change-Id: If8baf429b02e23b344346f7335bc911b99ae5579
Reviewed-on: https://chromium-review.googlesource.com/1233756
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56044}
2018-09-19 15:12:18 +00:00
Leszek Swirski
196874aa08 Revert "[wasm] Introduce a soft limit on reserved memory"
This reverts commit 3bb5cb63da.

Reason for revert: Breaks Win64 bot https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64/26418

Original change's description:
> [wasm] Introduce a soft limit on reserved memory
> 
> Currently, wasm memory and wasm code use a shared limit for the total
> size of reservations. This can cause wasm code reservations to fail
> because wasm memories used all available reservation space.
> This CL introduces a soft limit which is used when allocating wasm
> memory with full guards. If this limit is reached and the respective
> flag is set, we fall back to allocation without full guards and check
> against the hard limit. Code reservations always check against the hard
> limit.
> 
> R=​ahaas@chromium.org
> 
> Bug: v8:8196
> Change-Id: I3fcbaeaa6f72c972d408d291af5d6b788d43151d
> Reviewed-on: https://chromium-review.googlesource.com/1233614
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56028}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: If645e738b4a5800eceabd993738ac2285f4a63bc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8196
Reviewed-on: https://chromium-review.googlesource.com/1233834
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56031}
2018-09-19 13:07:09 +00:00
Clemens Hammacher
3bb5cb63da [wasm] Introduce a soft limit on reserved memory
Currently, wasm memory and wasm code use a shared limit for the total
size of reservations. This can cause wasm code reservations to fail
because wasm memories used all available reservation space.
This CL introduces a soft limit which is used when allocating wasm
memory with full guards. If this limit is reached and the respective
flag is set, we fall back to allocation without full guards and check
against the hard limit. Code reservations always check against the hard
limit.

R=ahaas@chromium.org

Bug: v8:8196
Change-Id: I3fcbaeaa6f72c972d408d291af5d6b788d43151d
Reviewed-on: https://chromium-review.googlesource.com/1233614
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56028}
2018-09-19 12:19:46 +00:00
Michael Starzinger
0074125486 Reland "[wasm] Implement handling of exported/imported exceptions."
This is a reland of a4105a437d

Original change's description:
> [wasm] Implement handling of exported/imported exceptions.
> 
> This implements the proper semantics for matching exported/imported
> exceptions by using the notion of an "exception tag" that is global to
> the system. It can be used to match exceptions in one module against
> exceptions declared and/or thrown in another module (or instance).
> 
> R=clemensh@chromium.org
> TEST=mjsunit/wasm/exceptions-shared
> BUG=v8:8091
> 
> Change-Id: I37586d7be5d5e6169b3418dfbc415b26dd4750dd
> Reviewed-on: https://chromium-review.googlesource.com/1226976
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55940}

Bug: v8:8091
Change-Id: Ib85f099b26a8323a8a00299b5aaeb05aaff3c3c6
Reviewed-on: https://chromium-review.googlesource.com/1227975
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55959}
2018-09-17 13:15:22 +00:00
Michael Starzinger
fe0361211f [wasm] Brush up mjsunit/wasm/exceptions test.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: I93227c29bb3591983f1901577afdf305637beb70
Reviewed-on: https://chromium-review.googlesource.com/1226803
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55954}
2018-09-17 11:57:10 +00:00
Leszek Swirski
00f8592d6b Revert "[wasm] Implement handling of exported/imported exceptions."
This reverts commit a4105a437d.

Reason for revert: GC stress failures (https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Mac64%20GC%20Stress/3097)

Original change's description:
> [wasm] Implement handling of exported/imported exceptions.
> 
> This implements the proper semantics for matching exported/imported
> exceptions by using the notion of an "exception tag" that is global to
> the system. It can be used to match exceptions in one module against
> exceptions declared and/or thrown in another module (or instance).
> 
> R=​clemensh@chromium.org
> TEST=mjsunit/wasm/exceptions-shared
> BUG=v8:8091
> 
> Change-Id: I37586d7be5d5e6169b3418dfbc415b26dd4750dd
> Reviewed-on: https://chromium-review.googlesource.com/1226976
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55940}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I5ef19ea3b67f470f2d7807810110d75415ba9ed6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8091
Reviewed-on: https://chromium-review.googlesource.com/1227933
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55942}
2018-09-17 09:35:43 +00:00
Michael Starzinger
a4105a437d [wasm] Implement handling of exported/imported exceptions.
This implements the proper semantics for matching exported/imported
exceptions by using the notion of an "exception tag" that is global to
the system. It can be used to match exceptions in one module against
exceptions declared and/or thrown in another module (or instance).

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-shared
BUG=v8:8091

Change-Id: I37586d7be5d5e6169b3418dfbc415b26dd4750dd
Reviewed-on: https://chromium-review.googlesource.com/1226976
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55940}
2018-09-17 09:02:28 +00:00
Stephan Herhut
7273a012a0 [wasm] Reduce number of workers in compare-exchange test
Reduce the number of workers in the atomic compare-exchange test to
make it run faster on systems with few cores.

Bug: v8:8164
Change-Id: I4de22863e1f2a44d9da4416161d08f5acfcece22
Reviewed-on: https://chromium-review.googlesource.com/1224771
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55887}
2018-09-14 08:16:08 +00:00
Stephan Herhut
d6b5ac8daf [wasm] Use wasm-function#%d consistently as debug name.
This also fixes a use where it should be a public name. For public
names, we use what is defined in the module or wasm-function[%d] as per
the wasm names spec.

Bug: v8:8015
Change-Id: Ie102db4e1114b20caeb4a990cb9e07cacf0666bc
Reviewed-on: https://chromium-review.googlesource.com/1215627
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55827}
2018-09-12 13:47:21 +00:00
Michael Starzinger
515fef86c3 [wasm] Perform signature check on exception import.
This checks the type signature during import against the expected
signature. For this the {WasmExceptionObject} now contains a serialized
version of the signature.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-import
BUG=v8:8091

Change-Id: I5a34ef87eccf4d2ed3a784620796ec009623fd90
Reviewed-on: https://chromium-review.googlesource.com/1219509
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55789}
2018-09-11 13:40:03 +00:00
Andreas Haas
cecd2ed5b7 [wasm] Return immediately if code generation is not allowed
There was a bug in WebAssembly.instantiate in the case where a CSP
disallows WebAssembly compilation. In this case the promise returned by
WebAssembly.instantiate was rejected immediately because of the CSP,
but then compilation was started anyways, and the promise was resolved
after compilation for a second time, which caused the crash. With this
CL we do not start compilation if CSP disallows WebAssembly compilation.

R=clemensh@chromium.org

Bug: chromium:881978
Change-Id: Iffdb3e02c3006eb7f86211ab197f81cf20438f0e
Reviewed-on: https://chromium-review.googlesource.com/1219706
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55788}
2018-09-11 13:15:20 +00:00
Michael Starzinger
a64e6b5062 [wasm][test] Add additional module builder checks.
R=clemensh@chromium.org

Change-Id: I9734259c9f41378ac216d5a222f0f7c71fcb5fa6
Reviewed-on: https://chromium-review.googlesource.com/1219023
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55781}
2018-09-11 09:56:44 +00:00
Michael Starzinger
8238a9b245 [wasm] Add preliminary support for imported exceptions.
This adds the ability to import exception into a module at instantiation
time. Only a {WasmExceptionObject} that has been exported by another
module instance can be imported, all other values are rejected.

Note that currently there is no signature check being performed to make
sure the imported exception matches the expected type. Also the identity
of imported exceptions is not yet preserved.

Furthermore the engine does not yet match thrown exception objects on a
global level across modules. Hence imported exceptions will (wrongly)
behave as completely new types within the module.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-import,unittests/WasmModuleVerifyTest
BUG=v8:8091

Change-Id: If247762b949a1ba4a87d13bc3e790a45dbc67815
Reviewed-on: https://chromium-review.googlesource.com/1216402
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55777}
2018-09-11 09:25:18 +00:00
Michael Starzinger
4e71b6ba36 [wasm] Introduce WASM_EXCEPTION_OBJECT instance type.
This new instance type will be used for wrapper objects representing
exported exceptions. Currently the objects are empty and only serve as
an identity for exported exceptions. Eventually they will also need to
reference the signature underlying the exception to perform a signature
check upon import.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-import
BUG=v8:8091

Change-Id: Ifdd561fc000090f4a985aeb45549fd7110849646
Reviewed-on: https://chromium-review.googlesource.com/1215166
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55752}
2018-09-10 11:26:25 +00:00
Stephan Herhut
47837cfc23 [wasm] Add d8 stress test for kExprI32AtomicCompareExchange
Add a test that runs multiple workers that concurrently try to advance
along a random sequence of numbers, using AtomicCompareExchange to
update the shared current position.

Change-Id: Ie073bbdce6fd6766ef1f73f996dd592b90b8b3c2
Reviewed-on: https://chromium-review.googlesource.com/1198769
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55722}
2018-09-07 12:07:57 +00:00
Michael Starzinger
c0a9f50c88 [wasm] Add preliminary support for exported exceptions.
This adds the ability to add exception types to the export section of a
module and reference them via the local exception index. Currently the
export object then just contains the local index as a number, which is
only temporary until we have proper export wrappers for exceptions.

Also note that this tightens the restriction for the modules exception
section to be located in between the import and the export section.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-export
BUG=v8:8091

Change-Id: Ie26081c3f94e71cb576057db7e45ec5bd0e112f9
Reviewed-on: https://chromium-review.googlesource.com/1206873
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55679}
2018-09-06 09:18:26 +00:00
Deepti Gandluri
2fcf6da494 [wasm] Add runtime checks for misaligned atomic accesses
BUG: v8:6532, chromium:874809
Change-Id: I55c00e8563741908cf0daf263152ce927ae18e7c
Reviewed-on: https://chromium-review.googlesource.com/1205812
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55666}
2018-09-05 22:39:58 +00:00
Michael Starzinger
1990798030 [wasm] Fix ordering check of exception section.
This fixes an off-by-one in the ordering restriction check for exception
sections in a module. It also adds proper testing for exception handling
of indirect calls. This in turn adds a table section that triggers the
aforementioned bug.

R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions,unittests/WasmModuleVerifyTest
BUG=v8:8091

Change-Id: Ie44ad4dee1b0c623f069fca7661c4282492b52d6
Reviewed-on: https://chromium-review.googlesource.com/1203993
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55615}
2018-09-04 14:45:14 +00:00
Michael Starzinger
1003fcc48e [wasm] Fix exception handling with empty try blocks.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: I866430e1f3d3e7b93001a4375a869f19de75e65e
Reviewed-on: https://chromium-review.googlesource.com/1203954
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55605}
2018-09-04 11:31:00 +00:00
Michael Starzinger
e8d79f070c [wasm] Make exception creation non-observable by JS.
This fixes exception creation (by the WebAssembly throw operation) so
that it is not observable by JavaScript. Internal properties are now
stored with symbol names instead of string names, which also prevents
them from being accessed or monkey-patched directly by JavaScript.

R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regress-8094
BUG=v8:8094

Change-Id: I33cb27f4373114cd4db28d9aef23560093e55242
Reviewed-on: https://chromium-review.googlesource.com/1203951
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55602}
2018-09-04 10:37:27 +00:00
Michael Starzinger
4e20a62a95 [wasm] Fix missing default value for anyref local.
R=titzer@chromium.org
TEST=mjsunit/wasm/anyref

Change-Id: Ia79c78038f6cc92f657ee1b48474323bde981155
Reviewed-on: https://chromium-review.googlesource.com/1201784
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55583}
2018-09-03 11:24:39 +00:00
Ben L. Titzer
09a717dbb9 [wasm] Fix dispatch table instance update
This CL fixes a bug where the receiving instance was updated improperly
in the dispatch table(s) of an imported table.

BUG=chromium:875322
R=mstarzinger@chromium.org

Change-Id: Ib5af238a0847bf332a12863523e897f59f137c1d
Reviewed-on: https://chromium-review.googlesource.com/1196886
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55534}
2018-08-30 15:54:14 +00:00
Michael Starzinger
f19a70681d [wasm] Add support for 'except_ref' value type.
This adds experimental support for an 'except_ref' value type for caught
exceptions as per the exception handling proposal. In the current for it
is only allowed to have such types in the stack or in a local, support
for having it as part of any signature was left out.

The default value for a local of type 'except_ref' is the 'ref_null'
value for now. Since this value cannot escape a wasm function, the
concrete value is not actually observable.

R=ahaas@chromium.org
TEST=unittests/LocalDeclDecoderTest.ExceptRef,mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: I7bd65274327a833262f8749cbe0e24e737f6e0c1
Reviewed-on: https://chromium-review.googlesource.com/1196510
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55526}
2018-08-30 13:39:37 +00:00
Andreas Haas
f738bb246e [wasm][cleanup] Remove kV8MaxPages from wasm-constants.js
It is better not to have V8-specific constants in mjsunit.js because it
also has V8-independent uses, e.g. in the spec tests.

R=gdeepti@chromium.org

Bug: v8:8015
Change-Id: I3b576f093f639c13e673cbd0bd5305c8101d7281
Reviewed-on: https://chromium-review.googlesource.com/1192843
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55485}
2018-08-29 11:16:03 +00:00
Michael Starzinger
c3baf49f24 [wasm] Fix missing exceptional projections from calls.
This makes sure that direct and indirect calls get proper {IfException}
projections attached to them if they appear within a try-block. It also
re-enables most of the corresponding test cases for this.

R=ahaas@chromium.org
TEST=mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: I111634759651ed47f76850e80c8754751310001b
Reviewed-on: https://chromium-review.googlesource.com/1195365
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55483}
2018-08-29 09:53:32 +00:00
Michael Starzinger
dd732b4fb0 [wasm] Cleanup and modularize mjsunit/wasm/exceptions.
R=ahaas@chromium.org
TEST=mjsunit/wasm/exceptions

Change-Id: I6301cf9bcb94e972f4e7eb3d096c650a5afc55ca
Reviewed-on: https://chromium-review.googlesource.com/1190343
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55453}
2018-08-28 12:19:02 +00:00
Michael Starzinger
91f3555fce [wasm] Re-enable a mjsunit/wasm/exceptions test case.
R=ahaas@chromium.org
TEST=mjsunit/wasm/exceptions
BUG=v8:8091

Change-Id: If811fdffe31df3ca94c70ff910603fab8d7e1ad4
Reviewed-on: https://chromium-review.googlesource.com/1190303
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55442}
2018-08-28 09:30:55 +00:00
Michael Starzinger
dc5cb1f077 [wasm][test] Fix typo in module-memory test.
R=sigurds@chromium.org
TEST=mjsunit/wasm/module-memory

Change-Id: I30b52a09d8655340199dc449aaa91e6a351e2111
Reviewed-on: https://chromium-review.googlesource.com/1188567
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55410}
2018-08-24 14:18:18 +00:00
Michael Starzinger
f1aef71dd5 [wasm][test] Make module-memory test thread resilient.
R=titzer@chromium.org
TEST=mjsunit/wasm/module-memory

Change-Id: If190f4f75feb0560bfb608b5ec01234c95e1f715
Reviewed-on: https://chromium-review.googlesource.com/1188464
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55400}
2018-08-24 12:27:15 +00:00
Ben L. Titzer
438e7ec6dc Reland "[asmjs] Properly validate asm.js heap sizes"
This is a reland of 5c3092718e
(the CL was reverted because of a Chromium test that is now fixed)

Original change's description:
> Reland "[asmjs] Properly validate asm.js heap sizes"
>
> This is a reland of 5d69010e26
>
> Original change's description:
> > [asmjs] Properly validate asm.js heap sizes
> >
> > Enforce both engine limitations and spec (http://asmjs.org/spec/latest/)
> > limitations on the size of asm.js heaps.
> >
> > R=clemensh@chromium.org
> > CC=​mstarzinger@chromium.org
> >
> > Bug: chromium:873600
> > Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd
> > Reviewed-on: https://chromium-review.googlesource.com/1174411
> > Commit-Queue: Ben Titzer <titzer@chromium.org>
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55163}
>
> Bug: chromium:873600
> Change-Id: Id24070bda3aafb9e1a32af0732a1b18f633ef932
> Reviewed-on: https://chromium-review.googlesource.com/1179681
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55193}

Bug: chromium:873600
Change-Id: I6eca2a89589070837b109278f964fc8e9a0fd6f1
Reviewed-on: https://chromium-review.googlesource.com/1183081
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55249}
2018-08-21 09:00:04 +00:00
Aseem Garg
dd65e4b837 Revert "Reland "[asmjs] Properly validate asm.js heap sizes""
This reverts commit 5c3092718e.

Reason for revert: Broke fast/workers/worker-shared-asm-buffer.html

Original change's description:
> Reland "[asmjs] Properly validate asm.js heap sizes"
>
> This is a reland of 5d69010e26
>
> Original change's description:
> > [asmjs] Properly validate asm.js heap sizes
> >
> > Enforce both engine limitations and spec (http://asmjs.org/spec/latest/)
> > limitations on the size of asm.js heaps.
> >
> > R=clemensh@chromium.org
> > CC=​mstarzinger@chromium.org
> >
> > Bug: chromium:873600
> > Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd
> > Reviewed-on: https://chromium-review.googlesource.com/1174411
> > Commit-Queue: Ben Titzer <titzer@chromium.org>
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55163}
>
> Bug: chromium:873600
> Change-Id: Id24070bda3aafb9e1a32af0732a1b18f633ef932
> Reviewed-on: https://chromium-review.googlesource.com/1179681
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55193}

TBR=mstarzinger@chromium.org,titzer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:873600
Change-Id: I5845c584c7ac399b9b7939f5fd50c09b7b2cc3d2
Reviewed-on: https://chromium-review.googlesource.com/1182616
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55242}
2018-08-21 00:51:54 +00:00
Michael Starzinger
2af2d88bc5 [wasm] Fix interpreter entry with shared code.
This makes sure that debug info and interpreter handle are created
lazily, even when interpretation is triggered by a different Isolate
sharing the same WasmEngine (and hence the native module).

R=titzer@chromium.org
TEST=mjsunit/wasm/worker-interpreter
BUG=v8:7424

Change-Id: Iba17e207a537007fd2e642cede22dad7a708c6c7
Reviewed-on: https://chromium-review.googlesource.com/1181045
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55220}
2018-08-20 14:20:20 +00:00
Michael Starzinger
2b89727539 [wasm] Preserve interpreter entry even on tier-up.
This makes sure that a tier-up from Ignition to TurboFan (or any other
code publishing) preserves redirections to the Interpreter. Currently an
interpreted function never switches back to compiled.

R=titzer@chromium.org
TEST=mjsunit/wasm/interpreter-mixed
BUG=v8:7921,v8:8018

Change-Id: Ifca479953509708c998c11cc00b481c232678e00
Reviewed-on: https://chromium-review.googlesource.com/1179661
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55195}
2018-08-17 13:21:59 +00:00
Ben L. Titzer
5c3092718e Reland "[asmjs] Properly validate asm.js heap sizes"
This is a reland of 5d69010e26

Original change's description:
> [asmjs] Properly validate asm.js heap sizes
> 
> Enforce both engine limitations and spec (http://asmjs.org/spec/latest/)
> limitations on the size of asm.js heaps.
> 
> R=clemensh@chromium.org
> CC=​mstarzinger@chromium.org
> 
> Bug: chromium:873600
> Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd
> Reviewed-on: https://chromium-review.googlesource.com/1174411
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55163}

Bug: chromium:873600
Change-Id: Id24070bda3aafb9e1a32af0732a1b18f633ef932
Reviewed-on: https://chromium-review.googlesource.com/1179681
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55193}
2018-08-17 12:49:21 +00:00
Leszek Swirski
c07c93f327 Revert "[asmjs] Properly validate asm.js heap sizes"
This reverts commit 5d69010e26.

Reason for revert: New test fails on ARM GC stress bot - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Arm%20GC%20Stress/8054

Original change's description:
> [asmjs] Properly validate asm.js heap sizes
> 
> Enforce both engine limitations and spec (http://asmjs.org/spec/latest/)
> limitations on the size of asm.js heaps.
> 
> R=​clemensh@chromium.org
> CC=​​mstarzinger@chromium.org
> 
> Bug: chromium:873600
> Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd
> Reviewed-on: https://chromium-review.googlesource.com/1174411
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55163}

TBR=mstarzinger@chromium.org,titzer@chromium.org,clemensh@chromium.org

Change-Id: I95ca5306a495bfc0f78d7a29f5d6269fc9c0bdfa
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:873600
Reviewed-on: https://chromium-review.googlesource.com/1178141
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55173}
2018-08-16 16:32:43 +00:00
Ben L. Titzer
5d69010e26 [asmjs] Properly validate asm.js heap sizes
Enforce both engine limitations and spec (http://asmjs.org/spec/latest/)
limitations on the size of asm.js heaps.

R=clemensh@chromium.org
CC=​mstarzinger@chromium.org

Bug: chromium:873600
Change-Id: I104c23bbd0a9a7c494f97f8f9e83ac5a37496dfd
Reviewed-on: https://chromium-review.googlesource.com/1174411
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55163}
2018-08-16 14:02:02 +00:00
Andreas Haas
1408e12772 [wasm] Check the isolate if WebAssembly threads are enabled.
With the origin trial for WebAssembly threads, threads can be turned on
and off by the embedder depending on the context we are currently in.
With this CL we call the embedder callback stored on the isolate to
determine whether threads are enabled in the current context or not.

Design decision:
I decided to extend the {WasmFeaturesFromIsolate} function to ask the
embedder if WebAssembly threads are enabled. This is the function which
defines dynamically which features are turned on. It would be awkward
to have two such functions, one which calls the embedder and one which
does not.
A downside is that in WasmJs::Install the embedder does not seem to be
ready to be called. That's why I changed the code there to call
{WasmFeaturesFromFlags} instead.

R=titzer@chromium.org, mstarzinger@chromium.org

Bug: chromium:868844
Change-Id: I6bfa89960a54cec71992756e3717bbb3a9fe195e
Reviewed-on: https://chromium-review.googlesource.com/1169180
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55076}
2018-08-13 09:16:33 +00:00
Michael Starzinger
46a49fdfab [asm.js] Split large asm.js test into parts.
R=sigurds@chromium.org
TEST=mjsunit/wasm/asm-wasm
BUG=v8:8038

NOTREECHECKS=true

Change-Id: Id12226116aae1b12c8cc948b28097c1dc126f17c
Reviewed-on: https://chromium-review.googlesource.com/1169046
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55023}
2018-08-09 14:02:04 +00:00
Andreas Haas
5f105141d5 [wasm] During instantiation, pending_exceptions dominate new exceptions
For async instantiation of WebAssembly code we had the assumption that
a pending exceptions (an exception which comes from
execution JS code) and an ErrorThrower error cannot occur at the same
time. This assumption turned out to be wrong. With this CL we handle
this case by prefering pending_exceptions over ErrorThrower errors.

In addition I extended the tests for failing instantiation to also
exercise async instantiation, and I added a regression test.

R=clemensh@chromium.org

Bug: chromium:870646
Change-Id: I4cb54ff8642ad4ea193b20f79905c9f6508c2b2e
Reviewed-on: https://chromium-review.googlesource.com/1163511
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54940}
2018-08-07 10:44:12 +00:00
Clemens Hammacher
e4f595c25e [wasm] Remove redundant cancelling of compile tasks
All compile tasks are already canceled when the {CompilationState}
dies. This happens when the {NativeModule} dies, and all
{NativeModule}s die before the {WasmEngine} dies. Thus, the WasmEngine
does not need to cancel any compile jobs, because there are none anyway.

R=mstarzinger@chromium.org

Bug: chromium:869420
Change-Id: I7e006392a1f9126333733c81c4c19985f626a470
Reviewed-on: https://chromium-review.googlesource.com/1158411
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54840}
2018-08-01 12:21:57 +00:00
Ben L. Titzer
bf066d8584 [wasm] Use "wasm-function[i]" for wasm function name
BUG=chromium:863205
R=clemensh@chromium.org

Change-Id: I15f3a09e15210a80b155def5761d9aead95d19b7
Reviewed-on: https://chromium-review.googlesource.com/1156386
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54811}
2018-07-31 11:20:44 +00:00
Ben L. Titzer
352e408b0e [wasm] Support 4GiB memories in Liftoff
Add codegen support for up to 4GiB memories in Liftoff code.

This CL also adds three new mjsunit tests that stress large WASM
memories (1, 2, and 4 GiB) and checks that accesses near these
boundaries properly generate traps.

Note there is still some trickiness around the setting of:
  1.) the flag --wasm-max-mem-pages
  2.) wasm-limits.h kSpecMaxWasmMemoryPages = 65536
  3.) wasm-limits.h kV8MaxWasmMemoryPages = 32767

In particular, the allocation of memories is still limited to
3.) and the runtime flag can only lower this limit.

The above means that the tests for 2GiB and 4GiB memories will silently
OOM by design until 3.) is changed (though they currently pass with
manual testing). I argue it is better to include these tests up front,
since they will immediately trigger if their memory allocation succeeds.

Therefore the plan is to lift the restriction on 3.) after removing
all other other internal V8 limitations including array buffers and views.

R=clemensh@chromium.org
CC=mstarzinger@chromium.org
BUG=v8:7881

Change-Id: I3205ac2daf5c9a84364c670a2c3ef2258e5649f6
Reviewed-on: https://chromium-review.googlesource.com/1151309
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54754}
2018-07-27 14:20:00 +00:00
Michael Starzinger
4dae7bf53b Revert "[wasm] Temporarily disable --wasm-shared-engine test."
This reverts commit 53fe5c4485.

Reason for revert: Test can be re-enabled, a fix for the flake landed by now.

Original change's description:
> [wasm] Temporarily disable --wasm-shared-engine test.
> 
> R=​leszeks@chromium.org
> 
> Change-Id: Ib037c43571cda0e2da3c6da3d763cfe27c797413
> Reviewed-on: https://chromium-review.googlesource.com/1150033
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54692}

TBR=mstarzinger@chromium.org,leszeks@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I406740898d896a18eef365cdd20581d5de84023a
Reviewed-on: https://chromium-review.googlesource.com/1151407
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54731}
2018-07-26 15:03:37 +00:00
Michael Starzinger
53fe5c4485 [wasm] Temporarily disable --wasm-shared-engine test.
R=leszeks@chromium.org

Change-Id: Ib037c43571cda0e2da3c6da3d763cfe27c797413
Reviewed-on: https://chromium-review.googlesource.com/1150033
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54692}
2018-07-25 12:44:45 +00:00
Michael Starzinger
4d921281e9 [wasm] Introduce --wasm-shared-engine flag.
This flag allows to share a single WasmEngine among all Isolates within
the same process. It will ultimately allow to share the WasmCode objects
associated with modules that are transferred via structured cloning.

R=clemensh@chromium.org
TEST=mjsunit/wasm/worker-module
BUG=v8:7424

Change-Id: I70d852d319b2a80bd02e0a2a838dcdfa071df6e1
Reviewed-on: https://chromium-review.googlesource.com/1138213
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54678}
2018-07-25 08:17:24 +00:00
Ben L. Titzer
dab1076535 [wasm] Prepare to support 4GiB memories
This is a preparatory CL that refactors the WASM memory allocation path,
the WasmGraphBuilder, and several points of contact for ArrayBuffers to
allow them to eventually be up to 4GiB.

1.) Refactor definition of constants to prepare for memories of size 2^32
2.) Refactor WasmInstanceObject fields memory_size and memory_mask to
    be stored as uintptr_t
3.) Refactor WasmGraphBuilder to use 64-bit comparisons for bounds checks
4.) Refactor JSArrayBuffer accessor methods to use size_t properly.
5.) Add empirical maximum memory and array buffer size tests

R=mstarzinger@chromium.org
BUG=v8:7881

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I78a49069cfa89757cc93f0a30b1c1a99c4b2edba
Reviewed-on: https://chromium-review.googlesource.com/1112003
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54646}
2018-07-24 13:55:43 +00:00
Michael Starzinger
ed8a119f35 [wasm] Actually run worker-module.js test case.
R=clemensh@chromium.org
TEST=mjsunit/wasm/worker-module

Change-Id: I56c274c67354d534f86312ee8fe7b7761da8ca44
Reviewed-on: https://chromium-review.googlesource.com/1138074
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54456}
2018-07-16 10:46:46 +00:00
Clemens Hammacher
cbe423467c [wasm][fuzzer] Test combinations of Turbofan and Liftoff
Currently the fuzzer only tests Turbofan and Liftoff in isolation. In
order to test that both tiers use the same ABI, it should also test
calls from one tier to the other.
This CL introduces a new flag which controls which function will be
compiled by which tier, and uses that in the fuzzer.

R=ahaas@chromium.org

Bug: chromium:862931, v8:6600
Change-Id: I450b906700972cfdb496b1734faed9f8208d652f
Reviewed-on: https://chromium-review.googlesource.com/1134775
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54409}
2018-07-12 12:56:30 +00:00
Clemens Hammacher
4174a68e84 [wasm] Fix importing exported function in interpreter
When calling an import which is an exported wasm function, the
interpreter needs to look through the jump table to find the
actual code object.
We already had that logic for indirect calls, but it was missing for
imported calls.

R=ahaas@chromium.org

Bug: chromium:860392
Change-Id: I6b5a0192f79c23cb1de55407fe93f6df9a17235a
Reviewed-on: https://chromium-review.googlesource.com/1127671
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54291}
2018-07-06 11:22:01 +00:00
Michael Starzinger
406f4ffaca [wasm] Fix serialization of {WasmCode} with jump tables.
This correctly serializes {RelocInfo::INTERNAL_REFERENCE} addresses in a
position-independent form, so that they can be properly relocated when
the code is deserialized again. We store the offset within the code in
the serialized stream.

R=clemensh@chromium.org
TEST=mjsunit/wasm/compiled-module-serialization
BUG=chromium:857049

Change-Id: Ie8c84ee67bdfc17a65faa159a21cc1f2a78ac924
Reviewed-on: https://chromium-review.googlesource.com/1122414
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54140}
2018-07-02 14:41:13 +00:00
Michael Starzinger
870e81a273 [wasm] Fix direct call tag computation during serialization.
This makes sure the reverse tag translation of direct call targets to
respective call tags is properly performed. Otherwise all direct call
end up being deserialized to call the function with index '0'. Ooops!

R=clemensh@chromium.org
TEST=mjsunit/wasm/compiled-module-serialization
BUG=chromium:857049

Change-Id: I37c1ee72b000daec87efdeed08d60a067b1a1b0c
Reviewed-on: https://chromium-review.googlesource.com/1120256
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54124}
2018-07-02 08:07:28 +00:00
Ben Smith
c9b4f805a3 [wasm] postMessage of WebAssembly.Module in d8
Supporting postMessage from WebAssembly.Module requires implementing
some logic in the ValueSerializer and ValueDeserializer delegates. This
change implements some simple logic for d8.

This change also fixes a DCHECK that occurs when sending a shared
WebAssembly.Memory object to two Workers.

Bug: chromium:857049
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Idddb23a48175c7175967af3fbc03d8572452a069
Reviewed-on: https://chromium-review.googlesource.com/1117871
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54093}
2018-06-28 16:54:06 +00:00
Clemens Hammacher
15428f19f2 [wasm] Register protected instructions after deserialization
R=mstarzinger@chromium.org

Bug: chromium:856938
Change-Id: I57699de23b5c35a531c7601fd14a91f075abb0da
Reviewed-on: https://chromium-review.googlesource.com/1117182
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54085}
2018-06-28 13:06:45 +00:00
Michael Starzinger
6d20218ed1 [wasm] Remove {WasmCompiledModule} object type.
R=clemensh@chromium.org

Change-Id: I01b0b4948973ebbe0386ae8ae08e722ad16bcab8
Reviewed-on: https://chromium-review.googlesource.com/1114616
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54058}
2018-06-27 14:02:51 +00:00
Clemens Hammacher
76ac6372fa [wasm] Prepare enabling liftoff by default on ia32 and x64
Before flipping the flag, some tests need to be adapted. This CL
prepares these tests, such that the flag flip CL really just flips a
flag.

R=titzer@chromium.org, hablich@chromium.org

Bug: v8:6600, chromium:787421
Change-Id: I8030df69cda5f3fb81354350a37f65c0d1c669bd
Reviewed-on: https://chromium-review.googlesource.com/1110363
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53959}
2018-06-22 11:06:26 +00:00
Clemens Hammacher
e0dc3d2962 [wasm] Reject an exception in the start function on the promise
We assumed that if the ErrorThrower is empty after instantiation, then
instantiation succeeded and an instance exists which we can return.
However, if the start function throws, no instance exists, which caused
a crash. With this CL we handle execeptions thrown by the start
function correctly.


R=clemensh@chromium.org

Bug: chromium:848966
Change-Id: I51dc94e6bc563aa4a4b88c44a14e831af913fbd8
Reviewed-on: https://chromium-review.googlesource.com/1092234
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53687}
2018-06-13 09:01:48 +00:00
Ben Smith
7ce76fbc34 [wasm] Enable mutable-global by default
Mutable globals are now included in the wasm v1 spec.

Bug: v8:7625
Change-Id: Ib9b92d8348102f99a3b92820d0057b2c11a1e49a
Reviewed-on: https://chromium-review.googlesource.com/1095650
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53683}
2018-06-12 23:08:48 +00:00
Ben Smith
da03262e4c [wasm] Fix for exporting imported mutable globals
Mutable globals are stored in the instance differently, so they must be
exported differently as well.

Also fix a counting bug that occurred when a module contained a global
and an imported mutable global (CalculateGlobalOffsets is called
twice).

Bug: v8:7625
Change-Id: I1cd7ef5d6ff7cb7e09239035f89d7b36d0436063
Reviewed-on: https://chromium-review.googlesource.com/1096673
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53681}
2018-06-12 21:26:27 +00:00
Clemens Hammacher
68bec6c3f7 [wasm] Fix serialization of lazily compiled modules
R=mstarzinger@chromium.org

Change-Id: If72df4425633cac8e98f0dd6adb80512e226f251
Reviewed-on: https://chromium-review.googlesource.com/1097323
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53677}
2018-06-12 17:07:36 +00:00
Eric Holk
b984b70c3a [wasm] Fall back on bounds checks when guarded memory unavailable
This CL adds the simplest version of a trap handler fallback. At
instantiation time, we check whether the module was compiled to use
trap handlers and the memory is guarded. If the memory is not guarded
but the module is supposed to use trap handlers, we recompile the
module with bounds checks so that we can use an unguarded memory.

The compiled module is replaced with a bounds checking version, meaning
future instances from this module will also use bounds checks.

Some likely desirable features that are current missing but can be
added future CLs include:
* Disabling trap handler mode entirely.
* Recompiling all old instances so that trap handler and bounds checked
  code does not coexist in the same process.

Bug: v8:7143

Change-Id: I161fc0d544133b07dc4a93cc6af813369aaf3efe
Reviewed-on: https://chromium-review.googlesource.com/1018182
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53566}
2018-06-07 01:29:53 +00:00
Andreas Haas
86a2720763 [test] Make assertThrowsEquals use assertSame
The typical use of assertThrowsEquals is to check that a specific
object is thrown. However, assertEquals only does a proper equality
check for primitive types, not for complex types. Using assertSame
does a reference equality check on objects, which is more what you
would expect from assertThrowsEquals. For exception kind testing,
assertThrowsEquals actually did not work correctly, assertThrows is
better for that case.

R=clemensh@chromium.org, mythria@chromium.org

Change-Id: I24fb22e75fa33ebe90eb4bae40825119a054bba5
Reviewed-on: https://chromium-review.googlesource.com/1087952
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53556}
2018-06-06 14:17:12 +00:00
Clemens Hammacher
dd8356020f [wasm] Add test for printing wasm code after deserialization
R=mstarzinger@chromium.org

Bug: chromium:849656
Change-Id: I4c1990e10905969c94913f434ec0013e5cbbfb19
Reviewed-on: https://chromium-review.googlesource.com/1087273
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53535}
2018-06-05 19:15:15 +00:00
Michael Starzinger
c96ac82c50 [wasm] Make stack check independent of the Isolate.
This makes stack checks in WasmCode independent of the underlying
Isolate by loading the limit address from the WasmInstanceObject instead
of embedding it into the instruction stream. It hence removes the last
use of the Isolate field from WasmGraphBuilder.

Additionally this introduces the notion of a "runtime stub" which
represents stub code global to the NativeModule that can be directly
called from each WasmCode in the same module. These stubs can act as
trampolines via which Isolate-independent WasmCode can enter other V8
builtins or runtime functions that remain Isolate-dependent. They will
eventually replace the current "trampoline" in a NativeModule.

R=titzer@chromium.org
BUG=v8:7424

Change-Id: Ie1f5582ee656b1ab7716ea06316d6e21a0268e74
Reviewed-on: https://chromium-review.googlesource.com/1078732
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53487}
2018-06-04 11:24:17 +00:00
Ben Smith
b466a99f91 [wasm] Rename type to value in Global constructor
This was renamed recently in the spec.

Change-Id: I825e47e8b4113ddb2c3356ee8e7663705ba65e1c
Reviewed-on: https://chromium-review.googlesource.com/1079851
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53448}
2018-05-30 21:08:03 +00:00
Clemens Hammacher
37e9017f8e [wasm] Use correct instance when calling start function
We were always using the instance we were currently building. If the
start function is an exported wasm function of another instance, use the
exporting instance instead.

R=titzer@chromium.org

Bug: chromium:843120
Change-Id: I141d272b947bef8e903be7208ddf6ce344e754c4
Reviewed-on: https://chromium-review.googlesource.com/1059620
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53190}
2018-05-15 16:17:29 +00:00
Clemens Hammacher
d171ed411a [wasm] Add tests for re-importing into different instances
Since the code around that is quite fragile, and I plan to refactor it,
just add some tests to ensure that everything is and keeps working as
intended.

R=mstarzinger@chromium.org

Bug: v8:7758
Change-Id: Ib3814b93b465286d70b5669ed0161eecb9fc925a
Reviewed-on: https://chromium-review.googlesource.com/1059616
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53187}
2018-05-15 14:52:26 +00:00
Michael Starzinger
8c57a54b86 [wasm] Create module object in async compilation earlier.
This makes sure that the {WasmModuleObject} has been allocated before
any debug events are fired. Since {WasmScript} objects reference the
module object, it needs to be allocated earlier by now.

R=ahaas@chromium.org
TEST=debugger/regress/regress-crbug-840288
BUG=chromium:840288

Change-Id: I02783ce126c463ac953eb2192acb65f3a5d420a1
Reviewed-on: https://chromium-review.googlesource.com/1050246
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53084}
2018-05-09 07:54:56 +00:00
Clemens Hammacher
5d11921320 [Liftoff] Stage Liftoff and tier up behind --future
In order to get more test coverage (also on ClusterFuzz), stage Liftoff
and tier up behind --future.

R=hablich@chromium.org
CC=​​titzer@chromium.org

Bug: v8:6600
Change-Id: I718e17957b26f60aa4c002333035f693344806e0
Reviewed-on: https://chromium-review.googlesource.com/1042385
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52987}
2018-05-04 11:48:18 +00:00
Michael Starzinger
56e8b09936 Reland "[wasm] Maintain link from Instance to Module."
This is a reland of a0c57368a9

Original change's description:
> [wasm] Maintain link from Instance to Module.
> 
> This moves the link from a {WasmInstanceObject} to its corresponding
> {WasmModuleObject} into the right place and also makes it strong. This
> ensures that an instance always keeps the underlying module alive and
> hence removes the situation of an "orphaned instance".
> 
> R=clemensh@chromium.org
> 
> Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
> Reviewed-on: https://chromium-review.googlesource.com/1041691
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52942}

Change-Id: I9854400bfc1d22bd258f17118fcb7460cdc3acd5
Reviewed-on: https://chromium-review.googlesource.com/1043786
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52985}
2018-05-04 10:16:58 +00:00
Michael Achenbach
79a99dfc10 Revert "[wasm] Maintain link from Instance to Module."
This reverts commit a0c57368a9.

Reason for revert: Speculative revert due to failures with custom
snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/19061

Local bisect also points to this change:
http://shortn/_IhVxU2FKLu

Original change's description:
> [wasm] Maintain link from Instance to Module.
> 
> This moves the link from a {WasmInstanceObject} to its corresponding
> {WasmModuleObject} into the right place and also makes it strong. This
> ensures that an instance always keeps the underlying module alive and
> hence removes the situation of an "orphaned instance".
> 
> R=​clemensh@chromium.org
> 
> Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
> Reviewed-on: https://chromium-review.googlesource.com/1041691
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52942}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I1830e6ce14314f06f918a0c428182bfd68354ad9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1041968
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52949}
2018-05-03 11:56:25 +00:00
Michael Starzinger
a0c57368a9 [wasm] Maintain link from Instance to Module.
This moves the link from a {WasmInstanceObject} to its corresponding
{WasmModuleObject} into the right place and also makes it strong. This
ensures that an instance always keeps the underlying module alive and
hence removes the situation of an "orphaned instance".

R=clemensh@chromium.org

Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
Reviewed-on: https://chromium-review.googlesource.com/1041691
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52942}
2018-05-03 09:36:38 +00:00