On arm64, the stack pointer has to be aligned all the time. This
alignment was not considered in the creation of the CallDescriptor in
the fuzzer and thereby caused a mismatch between the CallDescriptor and
code generator. In other words, a callee put return values in a stack
slot which was different than the stack slot where the caller expected
the return value.
With this CL we consider this alignment in the fuzzer.
R=clemensh@chromium.org
Change-Id: I8c78c24c682b7b8678c0d4d112bae99cf405b184
Reviewed-on: https://chromium-review.googlesource.com/864682
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50574}
Mixing SSE and AVX instructions can cause severe slowdowns, so always
use AVX instructions if available.
The {Movss} method of {TurboAssembler} automatically does this,
emitting either {vmovss} or {movss}.
R=titzer@chromium.org
Bug: v8:6600
Change-Id: I45124944964e5a970814c7b50dfbfca333137dc1
Reviewed-on: https://chromium-review.googlesource.com/865910
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50572}
Every JS function has a bailout check at the beginning which makes sure it was
not lazily deoptimized. We can improve the check slightly:
- Load the code data container directly with a pc-relative load instead of
ADR+LDR.
- Check the deoptimization bit with TBZ directly, saving us a TST instruction.
- Use one of the macro-assembler's dedicated scratch registers instead of x2.
Bug:
Change-Id: Iea4824c74ed5a01b18595d5e980788f9745bbb6e
Reviewed-on: https://chromium-review.googlesource.com/864446
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#50570}
If a NumberConstant can be represented as a Smi, then lower it to a
IntPtrConstant node during simplified lowering. Thanks to this, all backends can
match Smi values that can also be encoded as immediates in the instruction
selector. Additionally, we can apply the same lowering to the CodeAssembler for
the snapshot.
As a result, we can remove `mov` instructions generated because Int32Matcher and
Int64Matcher didn't not recognize Smis:
For 32-bit target, it's common for Smis also be immediates: "if (a < 100) {}"
~~~
mov r1, #200 -> cmp r0, #200
cmp r0, r1 -> blt <>
blt <> ->
~~~
On Arm64 particularly, we lose opportunites to use `cbz`: "if (a == 0) {}"
~~~
movz x0, #0x0 -> cbz x1 <>
cmp x1, x0 ->
b.eq <> ->
~~~
Overall, we do not see an impact on benchmarks such as webtooling. However, we
do see noteworthy code size reduction, from 0.5% to 1.5%.
Bug:
Change-Id: I7fbb718ad51b9036c3514fa31c1326bdd6f2b0e6
Reviewed-on: https://chromium-review.googlesource.com/848814
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#50569}
Instead of passing four arguments to the runtime function, just pass
one pointer to a struct containing all information. This makes it much
easier to implement memory tracing in Liftoff in a follow-up CL.
Also fix a few other minor things like the namespace and the include
guards.
R=titzer@chromium.org
Change-Id: I47d8827cbb896a581585947f594af52f42bdb37c
Reviewed-on: https://chromium-review.googlesource.com/863673
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50568}
The fast variants set got the same as no variants after crankshaft
deprecation and there is no plan to extend it again. Hence we remove
the modifier now.
TBR=yangguo@chromium.org
Bug: v8:7264
Change-Id: Ib577542741841b5b9542327b90afea8d5a62c879
Reviewed-on: https://chromium-review.googlesource.com/866496
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50566}
For JSCreate nodes with constant inputs we cannot simply assume that the
new.target input is a JSFunction, since it can essentially be any
JSReceiver that is a constructor, i.e. it can also be a JSBoundFunction.
Bug: chromium:801627
Change-Id: Ia37bf9c0a751e4665e1167a3771fbe166473c979
Reviewed-on: https://chromium-review.googlesource.com/866493
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50563}
This moves the funky conditional code in ScheduleAndSelectInstructions to
the caller (the caller mostly knows statically what it wants).
My hidden agenda is to prepare the pipeline for post-scheduling passes.
Change-Id: Ia6009a6b2472d7211ef213eb4eb551957ae9709c
Bug: v8:5267
Reviewed-on: https://chromium-review.googlesource.com/863663
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50562}
This reverts commit 42667bab5b.
Reason for revert: Breaks msvc compile:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/908
Original change's description:
> Simplify FunctionKind, saving 4 bits in SharedFunctionInfo
>
> Since we only need to store 18 different function kinds,
> the bitfield approach was wasting space (requiring 11 bits).
>
> This patch replaces the bitfield with a regular enum, and
> updates all the FunctionKind predicates to use comparisons
> instead of bitwise ops.
>
> For the small amount of builtin code that depended upon being
> able to do masking to determine whether something is a class
> constructor, we still store two extra bits on FunctionKind,
> which are computed when the SFI is initialized.
>
> If this approach causes performance regressions (i.e., if it
> turns out that other code was implicitly depending on masking
> for fast checks), we can revert this or address it in
> other ways (e.g., by doing similar caching of repeated checks
> in the caller).
>
> Change-Id: Iebb3214f564ea8bd7b21e78fda33517d63247124
> Reviewed-on: https://chromium-review.googlesource.com/860896
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50559}
TBR=adamk@chromium.org,gsathya@chromium.org
Change-Id: I8e1faa0ca6213d1e70a00fcb417b1bfa35ebd643
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/866310
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50561}
Since we only need to store 18 different function kinds,
the bitfield approach was wasting space (requiring 11 bits).
This patch replaces the bitfield with a regular enum, and
updates all the FunctionKind predicates to use comparisons
instead of bitwise ops.
For the small amount of builtin code that depended upon being
able to do masking to determine whether something is a class
constructor, we still store two extra bits on FunctionKind,
which are computed when the SFI is initialized.
If this approach causes performance regressions (i.e., if it
turns out that other code was implicitly depending on masking
for fast checks), we can revert this or address it in
other ways (e.g., by doing similar caching of repeated checks
in the caller).
Change-Id: Iebb3214f564ea8bd7b21e78fda33517d63247124
Reviewed-on: https://chromium-review.googlesource.com/860896
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50559}
It was shipped in Chrome 63.
Bug: v8:5855
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Icc00b8300622d1c7b5662be8ac5e425b9781f666
Reviewed-on: https://chromium-review.googlesource.com/858381
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50558}
This reverts commit 2de796fc57.
Reason for revert: message test suite doesn't work with code
serializer step and predictable mode:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/18708
Looks like the flag doesn't exist anymore and the output comparison in
message tests doesn't like that.
Original change's description:
> [test] Add more d8-based test suites to d8_default
>
> This will run those suites with gc stress, code serializer, and verify-
> predictable mode.
>
> TBR=sergiyb@chromium.org
>
> Bug: v8:7285
> Change-Id: I4184376cf3fc9dd161b1e85ec562ed4266f5b8cf
> Reviewed-on: https://chromium-review.googlesource.com/864922
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50555}
TBR=machenbach@chromium.org,yangguo@chromium.org,sergiyb@chromium.org,majeski@google.com
Change-Id: Id0f26fcef246ed59ce3352c476b0643a64251ba1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7285
Reviewed-on: https://chromium-review.googlesource.com/864685
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50557}
This reverts commit 2de796fc57.
Reason for revert: Fails tests on Linux dbg:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/18708
Original change's description:
> [test] Add more d8-based test suites to d8_default
>
> This will run those suites with gc stress, code serializer, and verify-
> predictable mode.
>
> TBR=sergiyb@chromium.org
>
> Bug: v8:7285
> Change-Id: I4184376cf3fc9dd161b1e85ec562ed4266f5b8cf
> Reviewed-on: https://chromium-review.googlesource.com/864922
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50555}
TBR=machenbach@chromium.org,yangguo@chromium.org,sergiyb@chromium.org,majeski@google.com
Change-Id: I8d769829bdb96820e57b1cefcf92fb6976a1031d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7285
Reviewed-on: https://chromium-review.googlesource.com/865334
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50556}
This will run those suites with gc stress, code serializer, and verify-
predictable mode.
TBR=sergiyb@chromium.org
Bug: v8:7285
Change-Id: I4184376cf3fc9dd161b1e85ec562ed4266f5b8cf
Reviewed-on: https://chromium-review.googlesource.com/864922
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50555}
With --jit-to-native, we current don't disassemble any Liftoff code.
This CL adds that, and also adds printing of relocation info of native
wasm code.
R=mstarzinger@chromium.orgCC=titzer@chromium.org
Bug: v8:6600
Change-Id: Icb1249868224180171107b82e2dd7dc69e23db16
Reviewed-on: https://chromium-review.googlesource.com/863762
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50553}
These opcodes will always call out to a C function for now.
R=titzer@chromium.org
Bug: v8:6600
Change-Id: I0ba8984d593c0203b46c2814dec4c091754df99a
Reviewed-on: https://chromium-review.googlesource.com/860924
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50551}
Add tests with a few Array.of invocations in preparation for adding a
CodeStubAssembler generated version.
Change-Id: I5aee3f32a584ae31cebcbbe6b0e5491a4bc1da34
Reviewed-on: https://chromium-review.googlesource.com/861884
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50550}
This CL shares most of the implementation in the string
builtins String.prototype.charAt/charCodeAt/codePointAt.
Bug: v8:7270
Change-Id: Ibe43a0a22aa17fb5cd7f0519fd877fa8ae483863
Reviewed-on: https://chromium-review.googlesource.com/861786
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50546}
This adds a reduced version of bot_default with only d8-based test suites.
Those can be used for gc stress testing, fuzzing and predictable mode.
This also adds a missing explicit build rule for the debugger test suite.
It's working as it's part of the isolate file, but incremental
re-isolation might break on code changes.
Running the tests is still commented out to allow the infra-side to
land. Afterwards, we'll activate the extra testing as a V8 CL
commenting the lines back in.
Bug: v8:7285
Change-Id: I7b758c212f0c4ae3d2f79beea5ec597cee479565
Reviewed-on: https://chromium-review.googlesource.com/864045
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50545}
This changes the return type of
- StringBuiltinsAssembler::LoadSurrogatePairAt
- CodeStubAssembler::StringCharCodeAt
from TNode<Uint32T> to TNode<Int32T>.
This is justified because both functions only
return values in the positive range of signed
integer. This improves interoperatability, as
Int32T can be SmiTagged, while this is not
allowed for Uint32T.
Bug: v8:7270
Change-Id: I2768b6ec320fa0fbcf3e55af784339472fa4909e
Reviewed-on: https://chromium-review.googlesource.com/861782
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50542}
Flag getters (e.g. RegExp.p.get global) are defined on the prototype and
thus we need to use the more general BranchIfFastRegExp here instead of
IsFastRegExpNoPrototype.
Bug: chromium:800538
Change-Id: Ib6bc8a4fd3bf2f7dd31538c8dbb61814106c184b
Reviewed-on: https://chromium-review.googlesource.com/859767
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50538}
Liftoff could only call to code object on the gc heap so far. This CL
extends this to support calls to the native wasm heap. This became
urgent since --jit-to-native is enabled by default now.
R=titzer@chromium.org
Bug: v8:6600
Change-Id: Ie07416a4041d4e6ea26a8c315008a41d81f52aab
Reviewed-on: https://chromium-review.googlesource.com/863667
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50537}
This fixes a spec bug in which the order of calls to 1) the flag getter
and 2) ToUint32(limit) was incorrect if ToUint32 pushes the regexp
instance onto the slow path. We are now more restrictive and completely
avoid ToUint32 on the fast path.
Bug: chromium:801171
Change-Id: I21d15fe566754d2bc05853f895636bb882fbf599
Reviewed-on: https://chromium-review.googlesource.com/863644
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50533}
This CL makes a fuzzer out of the cctest
test-multiple-return/ReturnMultipleRandom. The fuzzer creates a
CallDescriptor with input parameters and returns, and a function which
maps input parameters to returns. The fuzzer then calls this function
with a wrapper which checks that the correct mapping happened.
R=clemensh@chromium.org
Change-Id: Ib89c4063638baae69540a44486d7b2e9d13f8c1f
Reviewed-on: https://chromium-review.googlesource.com/859768
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50532}
Each of those types have to split off a single actual instance type.
There can be many that split off the same instance type.
Bug: v8:7266
Change-Id: Ic78b707e26e67bdd2072cd8a716c89eaae024e48
Reviewed-on: https://chromium-review.googlesource.com/860651
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50530}
Instead of bailing out and assuming everything will be fine if a builtin
hasn't been deserialized yet, deserialize eagerly and perform the full
check.
Change-Id: I60b0d33786a266e124358e2eebe926d8f785881d
Reviewed-on: https://chromium-review.googlesource.com/859998
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50529}
This adds support for i32.popcnt. If no hardware instruction for popcnt
is available, call out to C.
R=titzer@chromium.org
Bug: v8:6600
Change-Id: I9ae9e1d1e1392168d19c0eedcdd33eeea609a54f
Reviewed-on: https://chromium-review.googlesource.com/860658
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50528}
