Commit Graph

78560 Commits

Author SHA1 Message Date
Manos Koukoutos
d1a11dd15a [wasm-gc] array/struct.new_default should work with immutable fields
Bug: v8:7748
Change-Id: I05f97786f7a5f7b829ce66ba55ffd7c00bfa4d50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974509
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83868}
2022-10-24 08:54:16 +00:00
Igor Sheludko
cd8a02d508 [builtins] Add --use-qemu mode to tools/builtins-pgo/generate.py
... and prepare for using PGO profiles for arm builds.

Bug: v8:10470
Change-Id: If71d363195c60277a59dc68d0c18e361e24209c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3970665
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83867}
2022-10-24 08:52:36 +00:00
Michael Achenbach
37ee4ae068 [infra] Fix trybot names to follow naming conventions
The infra/config update is part of:
https://crrev.com/c/3970938

No-Try: true
Bug: chromium:890222
Change-Id: If0e5960266dc932d5566181785a66da685a4df5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973070
Reviewed-by: Liviu Rau <liviurau@google.com>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Alexander Schulze <alexschulze@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83866}
2022-10-24 08:04:22 +00:00
Simon Zünd
8090f2cd43 [inspector] Remove experimental_async_stack_tagging_api flag
The feature has been enabled since M106 so we can safely remove the
flag with M109.

R=bmeurer@chromium.org

Bug: chromium:1334585
Change-Id: Iefe0b10e3be59d6dde54d676b5f1e0cf938851ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959659
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83865}
2022-10-24 05:23:50 +00:00
Mark Seaborn
e7bef8d4cc [trap-handler] Fix the Windows ARM64 build when using MSVC
Fix by disabling the use of the trap handler in the "ARM64 simulator
running on x64" case.  (Note that the ARM64-simulator-on-x64 case gets
built for mksnapshot as a host tool even if we didn't specifically
want the simulator case.)

Using the trap handler in that case currently uses some inline
assembly (the top-level asm() statements in
src/trap-handler/handler-outside-simulator.cc), but MSVC does not
support that type of asm() statement.

Disable using that asm() code by conditionalising it on "#if
V8_TRAP_HANDLER_SUPPORTED".  Note that we're not putting this
condition into the GN build because it's complicated to keep the two
sets of conditions totally in sync.

Put the "#if V8_TRAP_HANDLER_SUPPORTED" into handler-inside-win.cc to
match the same #if in handler-inside.cc, otherwise we would get a link
error when the former refers to TryFindLandingPad(), which is defined
behind the #if in the latter.

Do the same in handler-inside-posix.cc for consistency.

Remove the earlier attempt at doing the fix by implementing
ProbeMemory in C++, which won't necessarily work.  This reverts:
https://chromium-review.googlesource.com/c/v8/v8/+/3913036

Change-Id: If8e1720a90f89175d730cf32ee5ac42451b9b5be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3964232
Reviewed-by: Mark Mentovai <mark@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Mark Seaborn <mseaborn@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83864}
2022-10-22 18:52:18 +00:00
Milad Fa
72fa21b52c PPC/s390: [wasm-gc] Fix WasmLiftoffSetupFrame::Iterate()
Port c84946e1e2

Original Commit Message:

    We pass the *declared* function index on the stack now, so we must
    convert it to a regular function index before using it to look up
    the function's signature.

R=jkummerow@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Ib7817344e0758fbfc005c37b8b11ad6509c4161b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971373
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#83863}
2022-10-22 00:52:48 +00:00
Adam Klein
9e55d25735 [cleanup] Remove Wasm SIMD flag & deprecate embedder-enabling API
It's been enabled by default since Chrome 91.

Bug: v8:6020
Change-Id: Id26b7fb0b7dffe19a88a6f0071dd59203b06415a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3957636
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83862}
2022-10-22 00:47:42 +00:00
Milad Fa
6c0716d8af PPC/s390: Reland "[wasm] Allocate feedback vectors on demand"
Port a02c56694f

Original Commit Message:

    This is a reland of commit 4804c4de31.

    There are major changes since the previous attempt:
    - The WasmLiftoffFrameSetup (formerly WasmGetFeedbackVector) builtin
      now performs as much of the frame setup work as possible, to reduce
      generated code size for each function.
    - The WasmLazyCompile builtin/runtime function no longer allocates,
      hence gets frame type INTERNAL, and is un-handlified.

    Original change's description:
    > [wasm] Allocate feedback vectors on demand
    >
    > We previously allocated feedback vectors when instantiating the module,
    > or when lazily compiling a function. That's not sufficient when there
    > are multiple instances of the same NativeModule, or when we eagerly
    > tier-down all code for debugging. This patch changes the "get vector from
    > instance" sequence at the beginning of every Liftoff function to "get
    > or allocate vector"; factored into a builtin call to avoid generating
    > more code for every function.
    >
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3939667
    > Cr-Commit-Position: refs/heads/main@{#83610}

R=jkummerow@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I7d7e65a32e89285cb583216455ea1b9a490cb16b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968705
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83861}
2022-10-21 20:15:38 +00:00
Jakob Kummerow
c84946e1e2 [wasm-gc] Fix WasmLiftoffSetupFrame::Iterate()
We pass the *declared* function index on the stack now, so we must
convert it to a regular function index before using it to look up
the function's signature.

Change-Id: Ib98d71a02ba8ca885136c010cf7dbb6ef7f62950
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971365
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83860}
2022-10-21 18:31:15 +00:00
Victor Gomes
f471ad0f8a [maglev] Monomorphic load access with similar shape maps
This enriches KnownNodeAspects to use a map from Node to a set of
Maps, instead of a single map. We update known maps with set
intersection. We recompute the set from scratch, since set removal
is expensive.

It also adapts CheckMaps and CheckMapsWithTransition to support
a set of maps.

Bug: v8:7700
Change-Id: I0c16a456a1a186aaedcbacf2491ec4f0cb8b0682
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966441
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83859}
2022-10-21 16:54:57 +00:00
Jakob Kummerow
dce8a257fd [tools] Add tools/memory/rss.py to sample RSS usage
Similar to how `time COMMAND` measures time, `rss.py COMMAND` measures
memory consumption, by sampling RSS (Resident Set Size) for the child
process in /proc at a configurable interval (default: every 1ms).

No-Try: true
Change-Id: I381cdd6325fae67944ee96e44ba09dd948d432cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971360
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83858}
2022-10-21 16:38:40 +00:00
Toon Verwaest
f150ead829 [maglev] Use CallFunction_* where possible
Basically when the feedback says it's a JSFunction.

Bug: v8:7700
Change-Id: Ieb8484f3de44e2600aa8af9cb564b0f09f8531ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971125
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83857}
2022-10-21 15:35:31 +00:00
Toon Verwaest
b9caf49c9a [maglev] Adjust interrupt budgets
Make maglev less aggressive, and TF a little more again. Maglev deopts
will ensure that we'll back off on TF as long as feedback changes.

Bug: v8:7700
Change-Id: I98b4c339de598d96329b79d7b6862605f9bfd87c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968703
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83856}
2022-10-21 15:28:47 +00:00
Dominik Inführ
b8a135521c [heap] Handle optional spaces in PagedSpaceIterator
PagedSpaceIterator just bailed out on first optional space.

Bug: v8:13267
Change-Id: I6f8dba6c510a641930b364698dc91529b2db1146
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971361
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83855}
2022-10-21 14:08:58 +00:00
Leszek Swirski
8fad1045e5 [test] Fix optimization marking for in-progress
%OptimizeFunctionOnNextCall could be called while compilation (Maglev or
Turbofan) was still on-going -- this would make DCHECKs fail when
attempting to save the compiled code on the feedback vector. This is not
an issue normally when tests are carefully crafted, but can easily
happen during fuzzing.

Unify the two %Optimize*OnNextCall paths, and make sure that they check
for in-progress compilation.

Fixed: v8:13404
Change-Id: I021e1305bc2ba769b7484f9a122792aeb22060ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971122
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83854}
2022-10-21 13:56:58 +00:00
Qifan Pan
7aa6a7e659 [turbofan] Extend typers of JSUnaryOps to BigInt
This CL fixes the types of JSUnaryOps with BigInt input.

Bug: chromium:1376930, v8:9407
Change-Id: I7a6603db08d3af1e40d440fe4c499e7f825b59d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971119
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#83853}
2022-10-21 13:16:57 +00:00
Lu Yahan
5d7bbeb5ec [riscv][wasm] Allocate feedback vectors on demand
Port commit a02c56694f

Bug: v8:12852

Change-Id: Id93e2c3550d677f7d5dad32de085cb73ff02b301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971517
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83852}
2022-10-21 13:11:17 +00:00
Nikolaos Papaspyrou
60dfddf03c [heap][test] Fix code coverage tests for conservative stack scanning
Code coverage tests invoke garbage collection, to test that coverage
data is not reclaimed by the garbage collector and that the native
%DebugTogglePreciseCoverage works as intended. One of them tests that
garbage collection indeed reclaims the coverage data, if the above
native is not used. When conservative stack scanning is used, this may
fail.

This CL fixes the tests, ensuring that a precise garbage collection
will be invoked, without scanning the stack. To achieve this, the
garbage collection is invoked not with %CollectGarbage but by using
--expose-gc and the asynchronous execution mode, which ensures that
it will be invoked from the event loop without a stack.

Bug: v8:13257
Change-Id: Id44ef0d442bfd0a8afda282c3345e5ebeb239356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968708
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83851}
2022-10-21 13:09:40 +00:00
Victor Gomes
1c972cff76 Revert "[bazel] Add hide symbols from release / fast builds"
This reverts commit 6e4dea75e8.

Reason for revert: This is blocking HEAD import in Copybara.
Let's test this there first, then backport the change.

Original change's description:
> [bazel] Add hide symbols from release / fast builds
>
>
> Our gn build files hide non-exported symbols by default, which results
> in smaller binaries and can improve build times.
>
> This was not ported to the bazel build and causes binary size
> regressions in google 3.
>
> Change-Id: I285914b83e75bd3bf406e6401f52ddb53230219a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925698
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83514}

Change-Id: I18561cfdd8a637c100be849c4d6a668c6f3b6080
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971120
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83850}
2022-10-21 13:08:38 +00:00
Clemens Backes
d4e517d6ba [wasm][memory64] Fix decoding of limits values
For memory64, we modified the {consume_resizable_limits} method to
support 64-bit LEBs. This method is not only used for memory limits
though, and other limits should be unaffected (they are always 32-bit
values, even in memory64).

This CL refactors decoding such that the {has_maximum} fields are
initialized earlier, and flags are only decoded once (in particular not
again inside {consume_resizable_limits}. Instead, the caller specifies
whether values should be decoded as 32-bit or 64-bit values.

R=jkummerow@chromium.org

Bug: v8:10949, v8:13401
Change-Id: I2fb76c3efcf153d1490d88c4456de1524fd508b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968482
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83849}
2022-10-21 13:04:57 +00:00
Nikolaos Papaspyrou
8c7c087812 [heap] Make stack thread-local and introduce stack markers
This CL makes the object keeping stack information thread-local, moving
it from Heap to ThreadLocalTop. In this way, stack scanning will work
correctly when switching between threads, e.g., using v8::Locker.

It also introduces a mechanism for setting a stack marker, to be used
for scanning only the part of stack between its start and the marker
(instead of the current stack top).

Bug: v8:13257
Change-Id: I01091f5f49d9a8143d50aeef53789a98bdb29048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3960991
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83848}
2022-10-21 13:02:07 +00:00
Marja Hölttä
724e7ce174 [arraybuffers, api] Implement [[ArrayBufferDetachKey]] support
Bug: chromium:1344595
Change-Id: Ic1075361b92c776789ce2fbf1e105dea174f3a2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925936
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83847}
2022-10-21 12:55:18 +00:00
Clemens Backes
c745dab977 [wasm][memory64] Support shared memory
For some reason we overlooked shared memory64 so far. Supporting it is
trivial, we just need to fix flag parsing.

To make parsing simpler, we replace the switch by a bit-decoding logic.

R=jkummerow@chromium.org

Bug: v8:10949, v8:13401
Change-Id: I1d884a174f901ed359c1d385055c9f2d24b0e2f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967904
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83846}
2022-10-21 12:40:17 +00:00
Omer Katz
92a7385171 [heap] Fix 32bit msvc builds
Size of ActiveSystemPages is 8 bytes even on 32bit builds, thus
forcing 8 bytes alignment for MemoryChunk.

Change-Id: I5ca1e18329d6e68a8b6811c3c27cb224c765cb63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966953
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83845}
2022-10-21 12:19:26 +00:00
Benedikt Meurer
b2892b5f24 [inspector] Add [[WeakRefTarget]] internal property.
This adds a new [[WeakRefTarget]] internal property to
`Runtime.getProperties` results for `JSWeakRef` results
(also included in the preview), which will be used by
DevTools to show the target of the weak reference without
having to explicitly call `deref()` on them. As part of
this we also have (temporary) strong references to the
target, slightly changing behavior, but that's consistent
with how DevTools deals with `JSWeakMap` and `JSWeakSet`.

Bug: chromium:1267690
Change-Id: I2a9ef9261996fcdee20fbd0fc728d11208c82459
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3970598
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83844}
2022-10-21 12:14:52 +00:00
Toon Verwaest
4802bdcc97 [maglev] Avoid checking known calltargets
If the call target is a known constant, we don't need to check the value
stored in the feedback array dynamically. Either it matches, in which
case we just perform the call, or it's different, in which case we
unconditionally deopt so we can update the feedback.

Bug: v8:7700
Change-Id: Iacfdd9f358aac9c1d4e5cc748f323c3d90597d41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971077
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83843}
2022-10-21 12:01:05 +00:00
Omer Katz
bab37060e9 [heap] Minor tweaks to evacuation code
A bit of restructuring to reduce branching on RememberedSetUpdatingMode.

Bug: v8:12612
Change-Id: Ia578b2045e13698d1545d16e5a0df75ee599e24d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966190
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83842}
2022-10-21 12:00:02 +00:00
Omer Katz
fd57c09480 [heap] Fix remembered set DCHECK
VerifyRememberedSetsAfterEvacuation DCHECKs that OLD_TO_SHARED
invalidated set is null. MinorMC does not filter OLD_TO_SHARED
remembered set and thus the DCHECK fails.

Bug: chromium:1376860
Change-Id: I0f17687b3c1bc74c3b1c4afa462c99de5a05f78c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968707
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83841}
2022-10-21 11:36:24 +00:00
Liu Yu
efd26eaece [loong64][mips64] Convert Opcode from enum to integer type
This fixes the error "bitwise operation between different
enumeration types".

Change-Id: I37c7896054f64033cab9ea73e2e5e1f29a40a951
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3969862
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#83840}
2022-10-21 11:35:22 +00:00
Manos Koukoutos
65c6a068d7 [wasm] Type inlined tail call nodes
When inlining a tail call node into a regular call, the tail call node
is transformed into a regular call. This new call node (or its
projections in the case of multi-return) has to be typed.

Bug: v8:13406, v8:12166
Change-Id: I39cc619e6ee4f0d16763699fe4facebe461a750f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968715
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83839}
2022-10-21 11:23:22 +00:00
Toon Verwaest
4d701a7205 [flags] Only overwrite default interrupt budget for maglev
Bug: v8:7700
Change-Id: If056cf4349a0b2965d6d6f52a10f79532e17d540
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968700
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83838}
2022-10-21 10:19:26 +00:00
Dominik Inführ
ee3a351c08 [heap] Remove AllocationSpace::MAP_SPACE enum constant
Bug: v8:12578
Change-Id: Ic504d3db5483601e3a4e50bfdc7c1e1cc11ad697
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967841
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83837}
2022-10-21 10:13:18 +00:00
Michael Achenbach
3c8baaccb7 Whitespace to test bots
Bug: chromium:890222
Change-Id: Ia9155be6d4de22256fbbc708d3786c59699ccd47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3970657
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83836}
2022-10-21 09:31:56 +00:00
v8-ci-autoroll-builder
7d7373d3b3 Update V8 DEPS (trusted)
Rolling v8/build: 8d71aab..35a1478

Rolling v8/buildtools: f45ca77..be63ea5

Rolling v8/buildtools/linux64: git_revision:57c352b2b03461c24b19c678c61d7aeacc6981f4..git_revision:27b90626701a112217a9244022c729231ebcc3a0

Rolling v8/buildtools/third_party/libc++/trunk: 9c5e35a..9f512cf

Rolling v8/buildtools/third_party/libc++abi/trunk: 685c4ad..519e9ef

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/62b4c4e..981585a

Rolling v8/third_party/depot_tools: bd0cea6..3b95525

Rolling v8/third_party/fuchsia-sdk/sdk: version:10.20221019.3.1..version:10.20221020.1.1

Rolling v8/third_party/instrumented_libraries: 5104b7e..459048b

Rolling v8/third_party/zlib: 3cec057..cff7208

Rolling v8/tools/luci-go: git_revision:2673c9d7d4a38bce69415221fe721f807e909d85..git_revision:50ab33853a8b220162f851dcb74a1519e106b3df

Rolling v8/tools/luci-go: git_revision:2673c9d7d4a38bce69415221fe721f807e909d85..git_revision:50ab33853a8b220162f851dcb74a1519e106b3df

Change-Id: I8c10c836da728f400838364c8fc451b781c6f862
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968513
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83835}
2022-10-21 04:10:08 +00:00
Liu Yu
c8b6657b72 [loong64][mips64][wasm] Allocate feedback vectors on demand
Port commit a02c56694f

Bug: v8:12852
Change-Id: I9cd9014ac6a5bf65664a342c068e7a2796d11d45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968013
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Auto-Submit: Liu Yu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83834}
2022-10-21 03:06:42 +00:00
Toon Verwaest
5226276546 [maglev] Don't track call feedback if we know the target
This can certainly be optimized further, but we just check the value
inline rather than calling into Call_*WithFeedback

Bug: v8:7700
Change-Id: I19daf5eba86e1fb42e02e3e598135e5e9ff9dfd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967842
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83833}
2022-10-20 20:39:32 +00:00
Leszek Swirski
313c9ed4c3 [maglev] Defer optimized code call
Move the OptimizeCodeOrTailCallOptimizedCodeSlot call into deferred
code. This moves ~300 bytes of code off the prologue path.

Bug: v8:7700
Change-Id: I499953b591420f25850d21326252f9e43382d684
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967843
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83832}
2022-10-20 19:26:22 +00:00
Frank Tang
3eba7d24de [test262] Roll test262
58b7a2358..eb67a768

Bug: v8:7834
Change-Id: I7a0aaa06561837d8cf1b11f0efd687d0d9b4edb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3940287
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83831}
2022-10-20 19:22:43 +00:00
Mark Seaborn
a5dfbcc897 [trap-handler] Add explicit check that this is not enabled on Android
Add a sanity check and a note to ensure that use of V8's trap handler
is not naively enabled for Android without seeing this note.

Using the trap handler on Android is potentially risky because V8 may
have to coexist in the same process with Android's Java
implementation, which may also use signal handling, and getting
different signal handlers to coexist safely is quite difficult.

Bug: v8:13383
Change-Id: I5caa52577bf0c74635171adac0dcaed32295d654
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3956130
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Mark Seaborn <mseaborn@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83830}
2022-10-20 17:40:02 +00:00
Victor Gomes
f22dea3c9e Revert "[NumFuzz] Skip processor and whitespaces test until issue is fixed"
This reverts commit 93f3f3369e.

Reason for revert: Tests should pass after:
https://crrev.com/c/3964754 and https://crrev.com/c/3964754

Original change's description:
> [NumFuzz] Skip processor and whitespaces test until issue is fixed
>
> No-Try: true
> Bug: v8:13397, v8:13396
> Change-Id: I7fdabc5f5c165b375d150b4228ff627fc13aacc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966429
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83801}

Change-Id: I858524c1c34be8d38c02615a3c043e6b792fd40c
Fixes: v8:13397, v8:13396
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968477
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83829}
2022-10-20 17:37:52 +00:00
Leszek Swirski
ae5463ebbb [maglev] Fix interrupt budget after Maglev tier-up
We were setting the interrupt budget before performing Maglev tier-up,
therefore ignoring that tiering state and resetting the interrupt budget
to the tier-to-maglev budget, not the tier-to-turbofan budget. Now, set
the interrupt budget

  a) only after the optimisation decision is made, and
  b) based on tiering state as well as the active tier -- in particular,
     any tiering state that isn't "none" is treated as needing the
     tier-to-turbofan budget.

Bug: v8:7700
Change-Id: Ife353b32c580cac92c051eb40f58294069930786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968479
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83828}
2022-10-20 16:58:02 +00:00
Adam Klein
e144483823 [api] Add documentation for v8::Platform::GetPageAllocator
Change-Id: I5760687fa9e8a7512d3946704f51f321ffa3676b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963718
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83827}
2022-10-20 16:32:42 +00:00
Victor Gomes
fb84e6c437 [maglev] Add character to set of saved registers in StringAt
... otherwise AllocateRaw can call the allocation builtin,
that can trigger a GC and read the character as a pointer.

Bug: v8:7700, v8:13397
Change-Id: If4e15fc8bfe0f94c53fe77022b18d5d4a6168702
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3964754
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83826}
2022-10-20 16:02:12 +00:00
Seth Brenith
d1dcdd9a21 Also copy scope info and flags when merging deserialized script
When merging a newly deserialized script into an existing one from the
compilation cache, it is often the case that a SharedFunctionInfo from
the cached script ("old SFI") has been flushed and the corresponding
SharedFunctionInfo from the new script ("new SFI") is compiled. In that
case, it is sufficient to copy the bytecode array and feedback metadata
from the new SFI to the old SFI, as already implemented.

However, there is another case to consider: perhaps the new SFI is
compiled and the old SFI was never compiled. In that case, the old SFI
has no ScopeInfo and some of its flags may be incorrect.

To fix the problem, this CL updates CompleteMergeInForeground to copy
everything except script_or_debug_info from the new SFI to the old SFI.

This change implies some duplication of ScopeInfos, since each ScopeInfo
can point to its parent, so matching parent ScopeInfos from the new and
old scripts will coexist. However, this isn't a new problem: similar
duplication is already caused by the portion of the merge algorithm
which attaches new compiled SFIs into the old Script where the old
Script doesn't have a matching SFI. I don't see any way in which this
duplication would cause incorrect behavior. In fact, it is possible to
get duplicated ScopeInfos without any merging at all, which indicates to
me that such duplication is safe. Duplication occurs if a SFI is flushed
or removed while one of its descendant functions is still alive, and
subsequently the same function literal is compiled again.

Bug: v8:12808, chromium:1359773
Change-Id: I2a3a720021c797c62a87d10e999603ff5e29a027
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3965723
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#83825}
2022-10-20 15:48:32 +00:00
Victor Gomes
f8b46ec083 [maglev] Fix scratch register in StringAt
Bug: v8:7700, v8:13397, chromium:1376856
Change-Id: I6b75658e41e7f1b44c62274011876a03ab8c8414
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967903
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83824}
2022-10-20 15:14:42 +00:00
Leszek Swirski
8918a05117 [x64] Micro-optimize TailCallBuiltin with condition
Use jcc where possible if using TailCallBuiltin with a condition (e.g.
in the BailoutIfDeoptimized call).

Change-Id: I160096919082b6535550c0e2053522a703c0c264
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963994
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83823}
2022-10-20 14:21:42 +00:00
Michael Achenbach
7cdad3f9c5 [fuzzing] Make simulated ubsan error work again
Fixed: chromium:1376123
Change-Id: I7e4be0982650c0ffbbae9539ede0444399e79e23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963276
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83822}
2022-10-20 13:53:22 +00:00
Leszek Swirski
2b0f687cc3 [maglev] Remove DECL_NODE_INTERFACE macro
It makes it more difficult to navigate code.

Bug: v8:7700
Change-Id: I18175dfa9b05261e1646410b041c2efaa009d191
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3967899
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83821}
2022-10-20 13:41:22 +00:00
Daniel Lehmann
27f68be5f3 [wasm] Remove unused code allocation space field
Removing the nowadays unused field `allocated_code_space_` from
`WasmCodeAllocator`. Formerly, it was used when setting the code space
of a `NativeModule` to writable, but nowadays we do that per-function.
Thus, `allocated_code_space_` is only written to, but never actually
used.

Change-Id: Ia57c377518ff177e72ec5e2945db34816bd02885
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963993
Commit-Queue: Daniel Lehmann <dlehmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83820}
2022-10-20 12:44:42 +00:00
Leszek Swirski
da4bfbb791 [maglev] Fast-path script context global loads.
Bug: v8:7700
Change-Id: Id8554ad55cf16513ddb453c50ef17f77e986427d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3963127
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83819}
2022-10-20 12:13:52 +00:00