Commit Graph

49883 Commits

Author SHA1 Message Date
Ross McIlroy
464dbb7e80 Revert "[Tests] Fix some OOM failures on Android by explicitly setting max_old_space_size."
This reverts commit bca38dbf29.

Reason for revert: Makes ODROIDs flaky.
BUG=v8:8086

Original change's description:
> [Tests] Fix some OOM failures on Android by explicitly setting max_old_space_size.
>
> BUG=v8:8040
>
> Change-Id: I8de22af3978f2a8eb844eabdb757bd635050f901
> Reviewed-on: https://chromium-review.googlesource.com/1181432
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55227}

TBR=ulan@chromium.org,rmcilroy@chromium.org

Bug: v8:8040
Change-Id: Ife980e8706ebbff4d86d87739c2f621d7a976039
Reviewed-on: https://chromium-review.googlesource.com/1188322
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55391}
2018-08-24 10:41:39 +00:00
Benedikt Meurer
f310c28bba [turbofan] Make backing store load eliminatable for %ArrayIteratorPrototype%.next().
Place the LoadField for the backing store of the [[IteratedObject]]
before the diamond to make it possible to eliminate this LoadField
in LoadElimination later, when used in `for..of` or destructing.

This further improves the performance of `for..of` in the micro
benchmark on the tracking bug from

  console.timeEnd: forOf, 191.726000
  console.timeEnd: traditional, 107.572000
  console.timeEnd: forOf, 137.288000
  console.timeEnd: traditional, 102.976000
  console.timeEnd: forOf, 137.506000
  console.timeEnd: traditional, 103.089000

to around

  console.timeEnd: forOf, 195.238000
  console.timeEnd: traditional, 107.078000
  console.timeEnd: forOf, 128.980000
  console.timeEnd: traditional, 103.106000
  console.timeEnd: forOf, 128.525000
  console.timeEnd: traditional, 103.072000

so roughly another ~7% improvement (with untrusted code mitigations
turned off).

Bug: v8:8070
Change-Id: I34831c503384f0cc44b95317dd84403f2ed8ecd5
Reviewed-on: https://chromium-review.googlesource.com/1188138
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55390}
2018-08-24 10:38:23 +00:00
Stephan Herhut
89bea4c050 Reland "Use new arraybuffer deleter interface in d8"
This is a reland of 524215be1a

Original change's description:
> Use new arraybuffer deleter interface in d8
> 
> With this cl we start using the custom deleter to free externalized
> array buffers. This also allows us to keep wasm memories registered
> with the wasm memory tracker and thereby to propagate that a memory
> is wasm allocated over postMessage calls.
> 
> Bug: v8:8073, chromium:836800
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I57e3ea44d9c6633ada7996677dd1de4da810ab64
> Reviewed-on: https://chromium-review.googlesource.com/1186681
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Stephan Herhut <herhut@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55361}

Bug: v8:8073, chromium:836800
Change-Id: Ia3c057ced496363cfdd07eed16ed1d0c7a3f3084
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1188222
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55389}
2018-08-24 10:37:09 +00:00
Florian Sattler
3268077990 [parser] PreParserIdentifier member reordering
Restricting the enum to uint8_t and reorder type for better alignment.

Bug: v8:7926
Change-Id: Ib37d600a189d12bac3c6aa8cf4b88970f8547548
Reviewed-on: https://chromium-review.googlesource.com/1188125
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55388}
2018-08-24 10:28:57 +00:00
Dominik Inführ
ff7434107c [heap-profiler] Location for object's constructor
Add location information in heap snapshot for objects where the
constructor can be determined.

Bug: chromium:854097
Change-Id: Ieb2ab70a65809ecc9dfa0d73a33fa57add430465
Reviewed-on: https://chromium-review.googlesource.com/1179156
Commit-Queue: Dominik Inführ <dinfuehr@google.com>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55387}
2018-08-24 10:01:48 +00:00
Tobias Tebbi
13565ee252 [turbofan] escape analysis: remove TypeGuard renamings of dematerialized allocations from the effect chain
Change-Id: Ie7b43feda381647523cb8cc3e7965823d3006063
Reviewed-on: https://chromium-review.googlesource.com/1188140
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55386}
2018-08-24 09:53:53 +00:00
Toon Verwaest
5e5d5df49a [scanner] Use TokenDesc* rather TokenDesc to keep track of the stream
This embeds LiteralBuffers in the TokenDesc directly so that we do not need to
figure out which one is free; as well as newline tracking. Instead of copying
around TokenDesc we now just update the pointer to keep track of the state.
Based on this architecture we'll be able to precompute more tokens at once.


Change-Id: Ie2e1a95f91713f7ab619fc8632f1eb644884a51f
Reviewed-on: https://chromium-review.googlesource.com/1184911
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55385}
2018-08-24 09:37:11 +00:00
Simon Zünd
3470086988 [array] Properly handle COW arrays in Array.p.reverse fast-path
Instead of using the slow-path for COW arrays, we now properly copy
them and use the fast-path.

R=jgruber@chromium.org

Change-Id: Iebbad5f761d97c5400c457877571c7930269d52f
Reviewed-on: https://chromium-review.googlesource.com/1188130
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55384}
2018-08-24 09:35:50 +00:00
Igor Sheludko
57c8c85b9f [ptr-compr] Fix assert in LayoutDescriptor which failed with 31-bit Smis.
Bug: v8:7703, chromium:876696
Change-Id: Ida3243414215b2ef75a9875ca31cf5a68274f7e0
Reviewed-on: https://chromium-review.googlesource.com/1185186
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55383}
2018-08-24 09:17:36 +00:00
Creddy
2856afccbb Change type elements kind in empty array boilerplate desc from PACKED_ELEMENTS to PACKED_SMI_ELEMENTS
The default array elements kind should be PACKED_SMI_ELEMENTS (top of type lattice)  to allow type
transitions to other types.

Change-Id: Icda969d0553628ef75d6c26bf6f32fef46512f0f
Reviewed-on: https://chromium-review.googlesource.com/1188133
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#55382}
2018-08-24 09:12:05 +00:00
Lei Zhang
ee062769e3 Fix the MSVC build.
In LiftoffCompiler::EmitTypeConversion() there is a DCHECK_EQ() where
one argument is implicitly converted to bool. This confuses MSVC, which
causes it to think the two arguments to DCHECK_EQ() do not have the same
type. Fix this with an explicit bool conversion!!

This does not affect the "v8_win64_msvc_compile_rel" bot, presumably
because it is a release bot with DCHECKs turned off.

Change-Id: I602ddae7a970e17388730e895eafd4ec78de7602
Reviewed-on: https://chromium-review.googlesource.com/1187702
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55381}
2018-08-24 09:02:33 +00:00
jgruber
0dee838293 Clean up stack argument handling in interface descriptors
Prior to this, it was possible to explicitly specify machine types for
stack arguments, but these were simply ignored and treated as
tagged-by-default when creating the actual CallDescriptor.

This verifies that all stack args specified in the descriptor are
actually given tagged types, and fails early if that is not the
case.

Bug: v8:6666
Change-Id: Idb543a11c976d0260fea60d31e30c21b15b32256
Reviewed-on: https://chromium-review.googlesource.com/1186642
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55380}
2018-08-24 08:53:45 +00:00
Bret Sepulveda
152c93d8fc Stop logging Builtin functions as LazyCompile (reland).
Builtin functions were being logged via both LogCodeObjects and
LogCompiledFunctions. The latter assumes the code in question has a
Name and so would end up logging an unattributable entry. This patch
stops logging that entry.

Bug: v8:8061
Change-Id: Iebc9bfa9618986afdbf8b1b71b64bf17a1f4196a
Reviewed-on: https://chromium-review.googlesource.com/1184923
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Bret Sepulveda <bsep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55379}
2018-08-24 08:44:01 +00:00
Florian Sattler
93d03643da [parser] Decreased size of Bailout/Abort reason.
This reduces the enum size to only take up one byte, hence decreasing
class size.

Bug: v8:7926
Change-Id: Ie50cfcd48541e44394814f375fd72f2b65722fdf
Reviewed-on: https://chromium-review.googlesource.com/1186582
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55378}
2018-08-24 08:42:50 +00:00
Michaël Zasso
91de4f500e [embedder-tracing] Fix usage of std::isinf
Introduced in https://chromium-review.googlesource.com/1183431.
The namespace was missing making compilation of Node.js with GCC fail.

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I55c1117ab347db17fd8acfa92c653e8cf737586f
Reviewed-on: https://chromium-review.googlesource.com/1188126
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Cr-Commit-Position: refs/heads/master@{#55377}
2018-08-24 08:39:03 +00:00
Michael Lippautz
cfa5fec62f [embedder-tracing] Only expose GC call when used with --expose_gc
Bug: chromium:843903
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ie959e443fdf5dce92c4cd42ef62ec914a13b867e
Reviewed-on: https://chromium-review.googlesource.com/1187151
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55376}
2018-08-24 08:35:20 +00:00
Florian Sattler
c8f9ba0687 Reland "[parser] Removed unnecessary copies"
This is a reland of d16bce9db8

Original change's description:
> [parser] Removed unnecessary copies
> 
> Bug: v8:8015
> Change-Id: I2ee074559484b9865dc1a27e6ea697ca311ee7ee
> Reviewed-on: https://chromium-review.googlesource.com/1185198
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#55327}

Bug: v8:8015
Change-Id: I63cf34898f4bbdba84f44e3769301d028ea49965
Reviewed-on: https://chromium-review.googlesource.com/1188142
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55375}
2018-08-24 08:11:42 +00:00
Benedikt Meurer
cfd752afa1 [turbofan] Fix --trace-turbo-load-elimination.
The LoadElimination must be able to print Maps, so we need to allow
handle dereferencing here.

Change-Id: Id39a6db5a4f40ec6212404b3aa30a36fdd1ba57e
Reviewed-on: https://chromium-review.googlesource.com/1188127
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55374}
2018-08-24 08:04:27 +00:00
Benedikt Meurer
280361d2b5 [turbofan] Handle initializing stores properly for alias analysis.
In LoadElimination leverage the fact that initializing stores (i.e.
stores to freshly allocated objects) cannot touch existing objects,
since the object can only escape once it's fully initialized and
then all accesses will happen on the FinishRegion node instead of
the naked Allocate node.

This helps to eliminate the redundant map checks and "length" accesses
to arrays, since TurboFan now knows that the iterated array cannot
alias with neither the freshly allocated ArrayIterator nor the
freshly allocated IterResultObject instances. This improves the times
on the benchmark in the tracking bug from

  console.timeEnd: forOf, 188.111000
  console.timeEnd: traditional, 116.380000
  console.timeEnd: forOf, 170.721000
  console.timeEnd: traditional, 108.209000
  console.timeEnd: forOf, 168.491000
  console.timeEnd: traditional, 108.839000

to

  console.timeEnd: forOf, 192.501000
  console.timeEnd: traditional, 106.909000
  console.timeEnd: forOf, 138.364000
  console.timeEnd: traditional, 103.232000
  console.timeEnd: forOf, 138.755000
  console.timeEnd: traditional, 102.928000

when running with untrusted code mitigations turned off, and thus
corresponds to a ~18% performance improvement, roughly cutting the
performance difference between the traditional for loop and the for..of
loop in half.

Besides for..of loops this will also help with array destructuring
patterns where TurboFan also emitted redundant map checks on the array
and didn't eliminate the redundant "length" accesses.

Bug: v8:8070
Change-Id: Iab283247f6d304d1e3c7c147f32ab957577aad21
Reviewed-on: https://chromium-review.googlesource.com/1188124
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55373}
2018-08-24 07:46:47 +00:00
Kanghua Yu
afff62b4ab [csa] Apply constant folding to remaining helper functions.
This also refactors CodeAssembler::Branch(condition,true_label,false_label)
to support constant folding, and adds Branch(condition,true_label,false_body)
variants for special cases.

Change-Id: Ifc04442657295124a95c60f76efde5c46de6f1b5
Reviewed-on: https://chromium-review.googlesource.com/1186136
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55372}
2018-08-24 07:36:29 +00:00
Simon Zünd
27040aac02 [jstest] Fix ElementsKind of the array that gets sorted
This CL fixes the "sort-lengths" benchmark so the ElementsKind of the
array to sort is PACKED_SMI again. This was somehow broken.

R=jgruber@chromium.org

Change-Id: I129e001eae4c88e9f99174b3494193232d933c3f
Reviewed-on: https://chromium-review.googlesource.com/1188122
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55371}
2018-08-24 07:35:07 +00:00
Maya Lekova
20f8e28eb9 Revert "Reland "[Intl] move Date.prototype.toLocale{,Date,Time}String to C++""
This reverts commit 8093b4f313.

Reason for revert: Breaks the following layout & non-layout bots in "fast/js/date-proto-generic-invocation.html" test
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Win/14570
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/25795
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064%20(dbg)/13317
https://ci.chromium.org/p/v8/builders/luci.v8.ci/Linux%20Tests%20(dbg)(1)/6565

Original change's description:
> Reland "[Intl] move Date.prototype.toLocale{,Date,Time}String to C++"
> 
> This is a reland of 8e57cd51fd
> 
> Original change's description:
> > [Intl] move Date.prototype.toLocale{,Date,Time}String to C++
> > 
> > Bug: v8:7961
> > Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> > Change-Id: Ie75eb443fc0907a4e1e4cafd4f5c06c23794f5a9
> > Reviewed-on: https://chromium-review.googlesource.com/1156123
> > Commit-Queue: Frank Tang <ftang@chromium.org>
> > Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55239}
> 
> Bug: v8:7961
> Change-Id: Ib7dd3b7b3d363b7b8cb2dcd89a5d591fab592c81
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/1185763
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55368}

TBR=jshin@chromium.org,gsathya@chromium.org,ftang@chromium.org

Change-Id: I9ba94daecaca38e86a1f07b649931079ca88b28d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7961
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1188143
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55370}
2018-08-24 07:28:08 +00:00
Simon Zünd
837fec91a4 [array] Replace JS Array.p.reverse with a Torque implementation
This CL adds a baseline implementation for Array.p.reverse in Torque,
as well as fastpaths for PACKED elements kinds.

Support for sparse JSArrays was removed.

R=jgruber@chromium.org, petermarshall@chromium.org

Bug: v8:7624
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I12900fbbb44746f1c5d36b78be826e14b88b4f69
Reviewed-on: https://chromium-review.googlesource.com/1185600
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55369}
2018-08-24 05:57:20 +00:00
Frank Tang
8093b4f313 Reland "[Intl] move Date.prototype.toLocale{,Date,Time}String to C++"
This is a reland of 8e57cd51fd

Original change's description:
> [Intl] move Date.prototype.toLocale{,Date,Time}String to C++
> 
> Bug: v8:7961
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ie75eb443fc0907a4e1e4cafd4f5c06c23794f5a9
> Reviewed-on: https://chromium-review.googlesource.com/1156123
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55239}

Bug: v8:7961
Change-Id: Ib7dd3b7b3d363b7b8cb2dcd89a5d591fab592c81
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1185763
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55368}
2018-08-24 00:27:17 +00:00
Michael Achenbach
5876d8f58d Revert "[heap] Reuse object evacuation information for slot recording in Scavenger."
This reverts commit adea021bbf.

Reason for revert:
https://crbug.com/v8/8087

Original change's description:
> [heap] Reuse object evacuation information for slot recording in Scavenger.
> 
> Bug: chromium:852420
> Change-Id: If092b5c8b093b313807687a27bc29bebd1c4ee5f
> Reviewed-on: https://chromium-review.googlesource.com/1187143
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55364}

TBR=ulan@chromium.org,hpayer@chromium.org

Change-Id: I480328e852c09f460a38e141eb7d2960c5001d35
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/1187301
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55367}
2018-08-23 19:15:07 +00:00
Michael Achenbach
eb1eaf6361 Revert "Use new arraybuffer deleter interface in d8"
This reverts commit 524215be1a.

Reason for revert: Breaks cfi:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20-%20cfi/16422

Original change's description:
> Use new arraybuffer deleter interface in d8
> 
> With this cl we start using the custom deleter to free externalized
> array buffers. This also allows us to keep wasm memories registered
> with the wasm memory tracker and thereby to propagate that a memory
> is wasm allocated over postMessage calls.
> 
> Bug: v8:8073, chromium:836800
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I57e3ea44d9c6633ada7996677dd1de4da810ab64
> Reviewed-on: https://chromium-review.googlesource.com/1186681
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Stephan Herhut <herhut@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55361}

TBR=mstarzinger@chromium.org,herhut@chromium.org

Change-Id: I64c4e76d8d68bad8df4ba3297c099b9b44eabc7c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8073, chromium:836800
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1187241
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55366}
2018-08-23 18:29:23 +00:00
Bruce Dawson
6930df0f1c Use PAGE_TARGETS_INVALID when allocating code pages
PAGE_TARGETS_INVALID tells CFG (Control Flow Guard) to mark all
addresses as invalid indirect branch targets. This makes exploits more
difficult. The benefit is minor because most of the code in the Chrome
process doesn't use the CFG checks, but this will close off a few
weaknesses and is the direction we will want to go in eventually
anyway (with specific targets or call sites opted-in to allowing
calls, using SetProcessValidCallTargets).

PAGE_TARGETS_INVALID may ultimately cause CFG to not allocate memory -
that is implied by Windows Internals 7th Edition - and if that is
implemented then this change will save some modest amount of memory.

PAGE_TARGETS_INVALID was introduced in Windows 10 - according to
Windows Internals Part 1 7th Edition - prior to that it will cause
VirtualAlloc to fail.

Bug: chromium:870054
Change-Id: Ib1784fba37cc0ecb5fe5df595f1519531b3b3a20
Reviewed-on: https://chromium-review.googlesource.com/1186025
Commit-Queue: Bruce Dawson <brucedawson@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55365}
2018-08-23 18:27:42 +00:00
Hannes Payer
adea021bbf [heap] Reuse object evacuation information for slot recording in Scavenger.
Bug: chromium:852420
Change-Id: If092b5c8b093b313807687a27bc29bebd1c4ee5f
Reviewed-on: https://chromium-review.googlesource.com/1187143
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55364}
2018-08-23 17:40:24 +00:00
Ben L. Titzer
ab6d5ed574 Reland "[wasm] Add feature counter for threads and shared memory"
This is a reland of b10a967f4b

Original change's description:
> [wasm] Add feature counter for threads and shared memory
> 
> This adds a feature counter for WASM shared memory (i.e. the presence
> of the "shared" bit in a WASM module's memory section) and the usage
> of WASM threads opcodes (i.e. wake/wait and atomics).
> 
> This CL also plumbs the WasmFeatures through the compilation pipeline
> to detect features as functions are being compiled.
> 
> R=ahaas@chromium.org, ulan@chromium.org
> BUG=chromium:868844
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I854f932d3adb16e4fd87196fe2a193950295b856
> Reviewed-on: https://chromium-review.googlesource.com/1186329
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55337}

Bug: chromium:868844
Change-Id: Iac3a38d80fa71aadd7147704669a8fd671ecfae8
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1186343
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55363}
2018-08-23 16:51:23 +00:00
Michael Starzinger
50e142c984 [wasm] Simplify Runtime_DeserializeWasmModule implementation.
R=herhut@chromium.org

Change-Id: I572a240f0d8f4598e3b4357d50329bcdafd7c60c
Reviewed-on: https://chromium-review.googlesource.com/1186585
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55362}
2018-08-23 15:54:38 +00:00
Stephan Herhut
524215be1a Use new arraybuffer deleter interface in d8
With this cl we start using the custom deleter to free externalized
array buffers. This also allows us to keep wasm memories registered
with the wasm memory tracker and thereby to propagate that a memory
is wasm allocated over postMessage calls.

Bug: v8:8073, chromium:836800
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I57e3ea44d9c6633ada7996677dd1de4da810ab64
Reviewed-on: https://chromium-review.googlesource.com/1186681
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55361}
2018-08-23 15:47:17 +00:00
Simon Zünd
fa11e2ac03 Reland ^2 "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
This is a reland of 9e48a24fd9

Original change's description:
> Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
>
> The CL was reverted because it broke some tests in ChromeOS.
>
> > [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> >
> > This CL changes the sorting algorithm used in Array.p.sort from
> > QuickSort to TimSort (implemented in Torque).
> >
> > Detailed performance results can be found here: https://goo.gl/4E733J
> >
> > To save on code space, fast-paths are implemented as sets of
> > function pointers instead of specializing generics.
> >
> > R=cbruni@chromium.org, jgruber@chromium.org
> >
> > Bug: v8:7382, v8:7624
> > Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> > Reviewed-on: https://chromium-review.googlesource.com/1151199
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55003}
>
> Bug: v8:7382, v8:7624
> Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
> Reviewed-on: https://chromium-review.googlesource.com/1184901
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55325}

Bug: v8:7382, v8:7624
Change-Id: I297611f45c09967e0f6961156b0c9ebdebc7053f
Reviewed-on: https://chromium-review.googlesource.com/1186801
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55360}
2018-08-23 15:43:29 +00:00
Bill Budge
d67d91dbe6 [memory] Replace Memory class with templated Memory functions.
Change-Id: I0870a13fd257e014a3b6dca8ee7ccb3aa5485066
Reviewed-on: https://chromium-review.googlesource.com/1183525
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55359}
2018-08-23 15:20:21 +00:00
Ben L. Titzer
1a5df8ebeb [wasm] Remove WasmCompilationData
The WasmCompilationData was a struct that served as an input/output
mechanism for communicating with the code generator. In particular,
it contained a flag for enabling runtime exception for WASM in the code
generator and it also gathered the protected instruction info from
the code generator to be communicated to the WasmCodeManager.

This CL inlines the exception support flag into OptimizedCompilationInfo
and the protected instruction information into the code generator,
along the lines of other flags and data structures created by the
code generator.

R=mstarzinger@chromium.org

Change-Id: If436636067f1a829a095310a73045fe3301cb694
Reviewed-on: https://chromium-review.googlesource.com/1186409
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55358}
2018-08-23 14:31:43 +00:00
Ben L. Titzer
faa6cfbbf1 [api] Counters for WASM shared memory and threads opcodes
Note that this splits off counters added in
https://chromium-review.googlesource.com/c/v8/v8/+/1186343

R=ahaas@chromium.org

Bug: chromium:868844
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I263c63a51d8ce3418eacabb6beb11fa1b3dfaa96
Reviewed-on: https://chromium-review.googlesource.com/1186721
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55357}
2018-08-23 14:30:40 +00:00
Sigurd Schneider
873810fe75 [assembler-arm] Remove unneeded padding for predictable code size
This CL removed padding from Abort on ARM, which is no longer needed.

Bug: v8:8054
Change-Id: I7ff0b88ba90e10d15b67b5ae8ca80f2cf7460498
Reviewed-on: https://chromium-review.googlesource.com/1183664
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55356}
2018-08-23 14:21:05 +00:00
Maya Lekova
8e43b9c01d Revert "Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort""
This reverts commit 9e48a24fd9.

Reason for revert: Possibly breaking the V8-Blink Mac bot - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15097

Original change's description:
> Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
> 
> The CL was reverted because it broke some tests in ChromeOS.
> 
> > [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> >
> > This CL changes the sorting algorithm used in Array.p.sort from
> > QuickSort to TimSort (implemented in Torque).
> >
> > Detailed performance results can be found here: https://goo.gl/4E733J
> >
> > To save on code space, fast-paths are implemented as sets of
> > function pointers instead of specializing generics.
> >
> > R=cbruni@chromium.org, jgruber@chromium.org
> >
> > Bug: v8:7382, v8:7624
> > Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> > Reviewed-on: https://chromium-review.googlesource.com/1151199
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55003}
> 
> Bug: v8:7382, v8:7624
> Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
> Reviewed-on: https://chromium-review.googlesource.com/1184901
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55325}

TBR=jgruber@chromium.org,szuend@google.com

Change-Id: Ie7e2af57a6480aa0504ba21ec98ee825d7ac74fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382, v8:7624
Reviewed-on: https://chromium-review.googlesource.com/1186601
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55355}
2018-08-23 13:08:13 +00:00
Maya Lekova
027074fd78 [mjsunit] Skip slow test on arm sim
The test is timing out on the Arm simulator when TimSort is disabled.

NOTRY=true
TBR=sigurds@chromium.org

Bug: v8:7783
Change-Id: I51e159822d0010253a458f0c380c52f27f7fe972
Reviewed-on: https://chromium-review.googlesource.com/1186583
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55354}
2018-08-23 13:01:55 +00:00
Sigurd Schneider
f5bc82f72b [ia32] Add root register checks at StackCheck
This change writes a magic number into the root register,
and checks that we have the number still in at StackChecks.

Change-Id: Ib00d2a7ede651997ae9459cf4bdcc6be3952353b
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/1186402
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55353}
2018-08-23 13:00:52 +00:00
Florian Sattler
55383e2b78 [parser] Reverted bitfield change
Removing bitfields because they regressed code-load performance on arm.

Bug: v8:7926
Change-Id: Id7f8b26b76203c6a45ba408945abb1a2d1ad9d5b
Reviewed-on: https://chromium-review.googlesource.com/1186419
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55352}
2018-08-23 12:50:56 +00:00
Michael Starzinger
1be73abae2 [cleanup] Remove dead {CommuteCondition} helper.
R=sigurds@chromium.org

Change-Id: Ib024d099946d4351bfce9de8eb61be1dba5e1ce5
Reviewed-on: https://chromium-review.googlesource.com/1186415
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55351}
2018-08-23 12:27:23 +00:00
Michael Starzinger
abfddfd3fe Scrub 'Crankshaft|Hydrogen|Lithium' from code-base.
R=titzer@chromium.org
BUG=v8:6408

Change-Id: I277beafaace334883ddbe63b9615e3f18085ce5e
Reviewed-on: https://chromium-review.googlesource.com/1186411
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55350}
2018-08-23 12:20:38 +00:00
Creddy
365e241780 [interpreter][runtime] Avoid AllocationSites for Array literals in oneshot code
No need to create allocation site for array literals in oneshot code since
they are executed only once. The interpreter emits a runtime call to
CreateArrayLiteralWithoutAllocationSite for creating literals in
oneshot code instead.

Change-Id: I285879c84759ff9e2ce281e9548112f52ce5e7d1
Reviewed-on: https://chromium-review.googlesource.com/1167843
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#55349}
2018-08-23 12:00:43 +00:00
Peter Marshall
3a80af309f [parser] Reserve initial vector memory rather than default construction
The constructor that accepts a size for vector default initializes the
elements. Using reserve() instead avoids this but still ensures the
capacity.

Change-Id: I8effb62ba1f9598a0081c2c959b2f7a5d6c587e6
Reviewed-on: https://chromium-review.googlesource.com/1186407
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55348}
2018-08-23 11:48:22 +00:00
Stephan Herhut
c74babee50 Add custom deleter for externalized arraybuffers
Currently, we use an AllocationKind to signal to the embedder how v8
has allocated the backingstore of an array buffer. The embedder then has
to implement matching logic to free an exernalized buffer. By Using
custom deleters v8 can communicate how to free an externalized array
buffer without requiring all embedders to implement corresponding
freeing logic.

Bug: v8:8073
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I553dec31ba167d6a7b342ded50d685be7dffd1c5
Reviewed-on: https://chromium-review.googlesource.com/1183484
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55347}
2018-08-23 11:44:38 +00:00
Benedikt Meurer
69985ac527 [turbofan] Optimize index checking for DataView accesses.
Use CheckBounds and reduce the number of checks required to sanitize the
indices for DataView accesses in optimized code. Also constant-fold the
[[ByteLength]] if the DataView is a known compile-time constant (similar
to what we do for TypedArrays already). This further improves performance
of DataViews by 2-7% depending on the exact test case.

With this change DataView and TypedArray accesses themselves are mostly
on par performance wise.

Since this CL introduces proper CheckBounds for the DataViews, instead
of the hand-craftet bounds checks, it is expected to regress performance
when untrusted code mitigations are on, since DataViews are also guarded
in optimized now. Without untrusted code mitigations, there's no negative
performance impact.

Tbr: sigurds@chromium.org
Bug: chromium:225811, chromium:876005
Change-Id: I4a69f81124635c9ba2c7e4c2dc912e2fd601061a
Reviewed-on: https://chromium-review.googlesource.com/1186408
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55346}
2018-08-23 11:36:17 +00:00
Simon Zünd
28afdca683 Revert "[array] Prepare Array.p.shift for removal of the JavaScript fall-back"
This reverts commit f4ca3fc56e.

Reason for revert: Since TF (js-call-reducer) calls into the C++ builtin, it is easier (cleaner for now) to implement the baseline version in C++ instead of Torque.

Original change's description:
> [array] Prepare Array.p.shift for removal of the JavaScript fall-back
> 
> This CL changes the ArrayPrototypeShift builtin to a CSA macro which
> is used in a newly created Torque builtin.
> 
> This is in preparation for removing the JavaScript fall-back, which
> will be replaced by a baseline Torque implementation.
> 
> R=​cbruni@chromium.org, jgruber@chromium.org
> 
> Bug: v8:7624
> Change-Id: I9b7898beea2802cc02d394e040a1e500387cf108
> Reviewed-on: https://chromium-review.googlesource.com/1169172
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#55036}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7624
Change-Id: I4929eefaa90ff8681bc8ae20e3ea3fe84ee7f1e8
Reviewed-on: https://chromium-review.googlesource.com/1186342
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55345}
2018-08-23 11:34:07 +00:00
Florian Sattler
44180f55af [parser] Fixed FunctionState alignment
Changes the alignment so we don't have to pad after the first int.

Bug: v8:7926
Change-Id: I8fba9b415ef85118c6abf19902fb857584535a6e
Reviewed-on: https://chromium-review.googlesource.com/1186321
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55344}
2018-08-23 11:27:31 +00:00
Sigurd Schneider
f40ef474ea Speculative Revert "[parser] Removed unnecessary copies"
This reverts commit d16bce9db8.

Reason for revert: Investigating what caused the redness here:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15097

Original change's description:
> [parser] Removed unnecessary copies
> 
> Bug: v8:8015
> Change-Id: I2ee074559484b9865dc1a27e6ea697ca311ee7ee
> Reviewed-on: https://chromium-review.googlesource.com/1185198
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#55327}

TBR=marja@chromium.org,sattlerf@google.com

Change-Id: I0344b11c2538a2755315dae7dd1f1ab62b8e069c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8015
Reviewed-on: https://chromium-review.googlesource.com/1186441
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55343}
2018-08-23 11:26:29 +00:00
Ross McIlroy
9512119641 [Cleanup] Remove some unused functions and variables from ParseInfo.
Removes some unused functions in ParseInfo and makes the associated fields unique_ptr instead
of shared_ptr. Also removes an unused zone in Compiler.

Change-Id: Idf1fbfb523cfc2b9a265d2855b1167770203cfd5
Reviewed-on: https://chromium-review.googlesource.com/1185193
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55342}
2018-08-23 11:16:55 +00:00