Commit Graph

78536 Commits

Author SHA1 Message Date
Leszek Swirski
46a5e5a750 [maglev] Optimize parallel moves from stack slots
Add a small local optimisation for parallel moves from a stack slot,
which tries to cache the stack slot value on a target register before
moving it, and otherwise only saves it to the scratch register once.

Bug: v8:7700
Change-Id: I8074732ca03c3f7fc71aed2b4f7cc926d4e157ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4001771
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84044}
2022-11-03 15:47:46 +00:00
Victor Gomes
b564f7cbfe [maglev] Cleanup StringAt and BuiltinStringFromCharCode
... to share codegen code.

Bug: v8:7700
Change-Id: I2bf6915578b9fc7646e7aa5678e64107f9140304
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4001770
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84043}
2022-11-03 15:10:55 +00:00
Milad Fa
0307340553 PPC[liftoff]: Implement simd extract mul ops
Change-Id: I17cd7278f7ff00369263ac57b9338ff91808dfe8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000191
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#84042}
2022-11-03 14:44:55 +00:00
Simon Zünd
8c49cbbe82 [debug] Fix breakpoints on lazy accessor for context snapshots
This CL partially reverts https://crrev.com/c/2731527.

When we bootstrap a new context we need to force instantiate lazy
accessors so the debugger is able to set breakpoints on them.
Normally this happens automatically when we instantiate function
templates that have the "BreakAtEntry" bit set on them, but context
snapshots are just deserialized.

This means we need to do a heap walk and instantiate any lazy
accessor that we find and install the `DebugBreakTrampoline` should
the accessor require it.

Note that we keep the fix from the original CL: Instantiate
accessors only once and keep using that JSFunction.

R=bmeurer@chromium.org, leszeks@chromium.org

Bug: chromium:1368554
Change-Id: I4acde361ac021b082af62e895a7f43fd54de95f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4001520
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84041}
2022-11-03 14:41:07 +00:00
Victor Gomes
bd01548286 [maglev] Inline builtin StringPrototypeCharCodeAt
- Create a macro StringCharCodeAt to share code between nodes.
- Rename InlinedBuiltin<Name> to just Builtin<Name>.

Bug: v8:7700
Change-Id: I66d000a9a4395eb0acc4c2f392437a9dc968b8a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4001523
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84040}
2022-11-03 14:04:08 +00:00
Maya Lekova
6411212237 [compiler] Fix mutable heap number object reference leak
Bug: chromium:1380063
Change-Id: Ide7622be38f575327693599bb4719f361105a0bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998653
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84039}
2022-11-03 14:03:05 +00:00
Leszek Swirski
ef1ac478bf [test] %PrepareFunctionForOptimization is permanent
Change the test helper, %PrepareFunctionForOptimization, to permanently
mark functions for manual optimization (rather than being marked only up
to their next optimization). These functions will now never be heuristic
optimized, and will always require tier-up via intrinsics.

This prevents variants with low interrupt budgets from messing with
tests that are carefully controlling optimization state across
multiple optimisations, as well as simplifying the mechanism since we
no longer have to maintain the state machine of 'function state'.

Change-Id: I9a45312c70ba4a03b57924c3b3ee17e892ede5a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990787
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84038}
2022-11-03 13:44:45 +00:00
Milad Fa
a593addab7 [buildtools] skip fetching ninja and reclient on ppc/s390 platforms
Above binaries do not exist on infra repositories for ppc/s390 and
cause errors while fetching V8.

Change-Id: I300127a71fc7c43426bc2140b5f24a63fa4a0c11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3992966
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#84037}
2022-11-03 12:54:25 +00:00
Nikolaos Papaspyrou
514de317fb [heap] Introduce a conservative stack scanning pass
This CL introduces the mechanism for conservative stack scanning (CSS).
Behind a compile-time flag, it also introduces a CSS pass which scans
the stack during the GC marking phase and marking verification. This
pass is now redundant, i.e., it is not needed for the correctness of
garbage collection. It will be used for experimenting with CSS and for
benchmarking.

Bug: v8:13257
Change-Id: If35bc24fde3bc08c5735d9e2f1b67724f7e31ef7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968710
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84036}
2022-11-03 12:10:45 +00:00
Clemens Backes
6c937e9c38 [wasm][decoder] Skip the name parameter if it is unused
In release builds the name will only be used for producing an error
message. For decoder instantiations that do not run full validation, it
is thus never used. Eliminating the unused parameter (by passing an
empty object instead) saves >3kB of binary size on x64, and also makes
the decoder slightly faster.

Drive-by: Inline {validate_size} into the only caller to simplify the
code.

R=ahaas@chromium.org

Change-Id: If50a118789c3e9c56ee24b68f35fdd3920e59e9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998815
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84035}
2022-11-03 11:25:56 +00:00
Michael Lippautz
25d19e6031 cppgc: Prevent using HeapHandle by value
HeapHandle is an opaque handle that refers to the internal
implementation of the heap and as such should never be used by value.

Bug: v8:13429
Change-Id: I1c369911adfc623fe2c32f06b985a5d8accc0e55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000485
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84034}
2022-11-03 11:02:35 +00:00
Victor Gomes
a95e014d78 [maglev] Do not include clobbered registers in snapshot
These registers are not live at the end of a node codegen,
so it usually does not need to be included in the snapshot.

Bug: v8:7700
Change-Id: Ie5b8d936842db1377f9ae3b11665ff5e552f04d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000701
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84033}
2022-11-03 10:21:39 +00:00
Simon Zünd
cfec66ea12 [debug] Fix breakpoints on lazy accessors sometimes not getting hit
V8 implements accessors defined in C++ via FunctionTemplates in a lazy
manner. When userland JS uses the accessor, V8 calls the corresponding
C++ code directly. Only when the user JS obtains a reference to the
function object itself (e.g. via Reflect.getOwnPropertyDescriptor) does
V8 instantiate a JSFunction object.

This makes breakpoint logic tricky. The debugger requires a JSFunction
when the user wants to set a breakpoint on such an accessor.
There is already some logic in place that forces instantiation of
accessors with a breakpoint on them.

Unfortunately that logic forgot to also install the
"DebugBreakTrampoline" on the instantiated JSFunction that will
actually pause execution. This CL fixes that.

Note that this is not the whole fix. Contexts deserialized from
snapshots need a heap walk that also forces instantation of the
accessors.

R=bmeurer@chromium.org

Bug: chromium:1368554
Change-Id: I346f614f380859b6419ae1df0ec6b0ca8234120a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000702
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84032}
2022-11-03 10:14:29 +00:00
Clemens Backes
94f6f5ef80 [wasm] Add assumptions about opcode ranges
The {WasmOpcodes::Signature} method dispatches on the prefix byte.
Adding assumptions about opcode ranges in the decoding functions for
prefixed opcodes avoids this dispatch, and might also enable more such
small optimizations.

R=ahaas@chromium.org

Change-Id: Ice18b7b0e6fb71023c532422f2e8655837428d5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990654
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84031}
2022-11-03 10:12:30 +00:00
Leszek Swirski
c4d027e8a4 [maglev] Load eliminate context slot loads
Context slot loads don't participate in the existing load elimination
mechanism, which is keyed by Name, so add another load elimination
mechanism specifically for context slots.

Bug: v8:7700
Change-Id: Ie39b3e42e3d6ae3841c239e271e67adc495d3f89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990846
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84030}
2022-11-03 09:43:30 +00:00
Victor Gomes
91d83cf32a [maglev] Move Allocate and ToBoolean to MaglevAssembler
The idea is that later maglev-ir.cc would invoke higher
level macros (AllocateString, CharCodeAt, etc)
and these inline computations can then be shared.

Bug: v8:7700
Change-Id: Icb279cc335515263e1ec29c61ba318f33143f9b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000484
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84029}
2022-11-03 09:38:39 +00:00
Marja Hölttä
2adb1df7ab [compiler] Fix the type of JSFindNonDefaultConstructorOrConstruct more
Bug: v8:13091,v8:13445
Change-Id: I2d9ed6fe2cec75bfb3146f8b47aeeef8a95bfc29
Fixed: v8:13445
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998818
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84028}
2022-11-03 09:36:04 +00:00
Darius M
8a55fb8046 [compiler] Fix wrong usage of Machine op in frontend
`LoadMap` calls `Load` and `Int32Constant`, which are machine
operators. While doing this in the frontend is somewhat supported, it
should be protected with EnterMachineGraph/ExitMachineGraph. So far
this doesn't seem to have broken anything, but we're not confident
that this will always work.

Rather than going through the complexity adding the
Enter/ExitMachineGraph nodes, I've removed the LoadMap to use a simple
LoadField instead.

Bug: chromium:1377775
Change-Id: I0ff5fe44e7b4827cf2c249f17a6deec8b4e2d4d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998812
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84027}
2022-11-03 09:35:00 +00:00
v8-ci-autoroll-builder
cbec729e90 Update V8 DEPS (trusted)
Rolling v8/build: f75f7c9..c977012

Rolling v8/third_party/depot_tools: 1adbbff..b52683f

Change-Id: Id68c29be14d8df16a0077d63b3809a548b1e1a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000447
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84026}
2022-11-03 03:46:09 +00:00
Igor Sheludko
b28a701fee [heap] Fix broken --track-retaining-path
Std hash tables where keys are HeapObjects which can be both Code and
non-Code objects must use Object::KeyEqualSafe equality comparator.

Bug: v8:11880
Change-Id: Ib6b04ffc1eb8cb42ef0ba54a37707a7144819a4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990967
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84025}
2022-11-02 22:09:59 +00:00
v8-ci-autoroll-builder
33f7913c98 Update V8 DEPS (trusted)
Rolling v8/build: dad0f9c..f75f7c9

Rolling v8/buildtools: 74edfb8..33b52ea

Rolling v8/buildtools/third_party/libc++/trunk: 37a5b4f..fc6bbc5

Rolling v8/third_party/depot_tools: 6f2321d..1adbbff

Rolling v8/third_party/fuchsia-sdk/sdk: version:10.20221028.1.1..version:10.20221102.0.1

Rolling v8/third_party/instrumented_libraries: 7410f80..a8992bf

Rolling v8/tools/clang: 38497db..b147cbb

Rolling v8/tools/luci-go: git_revision:50ab33853a8b220162f851dcb74a1519e106b3df..git_revision:765f51c332c38e9b8d7981f23640b9df59371cd5

Rolling v8/tools/luci-go: git_revision:50ab33853a8b220162f851dcb74a1519e106b3df..git_revision:765f51c332c38e9b8d7981f23640b9df59371cd5

Change-Id: Ie4b1116b75a88a0a7f64cd98aa4133ec37e9565e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000189
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84024}
2022-11-02 19:16:29 +00:00
Jakob Kummerow
8d7f885ff1 [wasm] Fix disassembler for imported globals
More precisely: when imported globals shift the indices of non-imported
globals, fix OOB accesses when disassembling the latter.

This CL is a refactoring of crrev.com/c/3994346 by andih@google.com.

Fixed: chromium:1380432
Change-Id: Ib9e3b52e03b3004d5b703bf8e3f74815b476ebf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998659
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84023}
2022-11-02 19:14:29 +00:00
Shu-yu Guo
381b8f55e9 [shared-struct] Fix in/out-of-object property storage
In a few places, shared structs currently incorrectly assume all storage
is in-object. This CL fixes those and rename
CSA::StoreJSSharedStructInObjectField to CSA::StoreSharedObjectField to
reflect the genericity.

Bug: v8:12547
Change-Id: I7c155b6bc584fbdcdbd484fda38f9f8a1940953d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3997700
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84022}
2022-11-02 18:50:49 +00:00
Anton Kirilov
103c34991b [wasm-simd][arm64] Improve the v128.any_true lowering
Use instructions that have lower latency and/or higher throughput.

Change-Id: Ibadb82a1470327105ba349f1e40175ea7044f2db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3968478
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84021}
2022-11-02 18:32:39 +00:00
Milad Fa
067ede0ad4 PPC [simd]: correct the lane order of ext mul result
Change-Id: I5718bac0374a25600eb4d791af792eb6ab01a035
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3997699
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#84020}
2022-11-02 18:18:29 +00:00
Michael Achenbach
bcf8d26426 Revert "[handles] Return node blocks for traced handles"
This reverts commit 7caf58b5fd.

Reason for revert: crashy gpu and blink tests:
https://ci.chromium.org/ui/p/v8/builders/ci/Linux%20V8%20FYI%20Release%20(NVIDIA)/21849/overview
https://ci.chromium.org/ui/p/v8/builders/ci/Mac%20V8%20FYI%20Release%20(Intel)/19094/overview
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Blink%20Linux/20919/overview

Original change's description:
> [handles] Return node blocks for traced handles
>
> Return empty node blocks back to the OS. Keep one block around to
> support local allocation/deallocation patterns for up to 256 nodes.
>
> Bug: v8:13372
> Change-Id: Ib9e3a1b9a70fa4ad2b52e8479cc46e3c7316cd18
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973270
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84011}

Bug: v8:13372
Change-Id: Ib1c765649b63ae5ae5924d9c3c711aae7af7719b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999549
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84019}
2022-11-02 18:07:09 +00:00
Daniel Lehmann
28f63891a8 [wasm] add partial disassembler test for Wasm MVP
The output of the disassembler is compared against a WebAssembly text
file that is also used to generate the module bytes given as input to
the disassembler.

This will be extended to cover all instructions/constructs of Wasm MVP
in the future. Also more tests are to be added, e.g., for the Wasm SIMD
and GC extensions.

Change-Id: I44648b295accfe91bbd0780170a2705f8a38b766
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3985913
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Daniel Lehmann <dlehmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84018}
2022-11-02 17:22:50 +00:00
Leszek Swirski
be5c44aff0 [maglev] Fix LogicalNot fast-path
We forgot to negate the boolean.

Bug: v8:7700
Change-Id: Ieac12c8102385714342af83cf3f44f4fe23000d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999286
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84017}
2022-11-02 16:46:49 +00:00
Leszek Swirski
334c5e71b0 [maglev] Use the lookup_start_object for constant load
Make sure to look up whether the lookup_start_object is a Constant when
calculating access infos, rather than the receiver, as it's the
lookup_start_object that we actually want to start the lookup on.

Bug: v8:7700
Change-Id: I7ec5b547d343ef04659fd5df56fceb5b8e05f928
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4000320
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84016}
2022-11-02 16:43:18 +00:00
Leszek Swirski
e2bfe48702 [maglev] Fix inlining id for source positions
Bug: v8:7700
Change-Id: I121b6445a877d7c21932a293d5e7f3bad21200d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999285
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84015}
2022-11-02 16:37:19 +00:00
Victor Gomes
9dd724080d [maglev] Add support to clobbered input to reg alloc
We use USED_AT_START to encode when a register needs to be clobbered.
As an example, we simplify StringAt.

Bug: v8:7700
Change-Id: I05fe852415c696b76e23950949772dc5cdd2ecca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999731
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84014}
2022-11-02 16:33:18 +00:00
Olivier Flückiger
5a2eb4a2aa [ycm] Fix YouCompleteMe config
The .ycm_extra_conf.py is out of date with the current build settings
and ycm versions. In particular, ycm expects a `Settings` function,
a couple of more flags need to be passed and some includes are marked
-isystem now. Also, we can use the C++ standard from the ninja files
instead of hard-coding it.

Change-Id: Ibaed29eb341346a86b6b736f95c97b41957f62de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3980257
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84013}
2022-11-02 15:59:48 +00:00
Leszek Swirski
cecd01ac18 [maglev] Fast path instanceof
Copy the instanceof fast path from TurboFan, which emits an
'OrdinaryHasInstance' when there is no @@hasInstance symbol (which can
eventually become a constant true/false if we can look through the
prototype chain), and a direct call of @@hasInstance otherwise.

In particular, the call to @@hasInstance requires a continuation builtin
(to call ToBoolean), so add support for these too.

Bug: v8:7700
Change-Id: I14aee4346e98cd650f190b811cc7a733e33addae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990844
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84012}
2022-11-02 14:37:48 +00:00
Michael Lippautz
7caf58b5fd [handles] Return node blocks for traced handles
Return empty node blocks back to the OS. Keep one block around to
support local allocation/deallocation patterns for up to 256 nodes.

Bug: v8:13372
Change-Id: Ib9e3a1b9a70fa4ad2b52e8479cc46e3c7316cd18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973270
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84011}
2022-11-02 14:02:00 +00:00
Michael Lippautz
c0dba826d8 [handles] Improve node bounds allocation
Reserve node bounds upfront instead of growing the vector.

Bug: v8:13372, chromium:1379837
Change-Id: Ibf2e9b984c476358f9f5cc7f11feeac620ae40ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998817
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84010}
2022-11-02 13:45:19 +00:00
Anton Bikineev
2792a669e4 cppgc: young-gen: Support young generation with stack
Before this CL Oilpan young generation didn't support running with
stack. The problem was in initializing stores that don't have the write
barrier. If a GC happens during object initialization, the following
pointer stores can be missed:

struct GCed: GarbageCollected<GCed> {
  GCed():
    m1(MakeGarbageCollected<>()),  // calls GC
    m2(MakeGarbageCollected<>())   // old-to-young ref missing barrier
  {}
  ...
};

The CL solves it by recording in-construction objects in a dedicated
remembered-set, which is retraced on next GCs.

Bug: chromium:1029379
Change-Id: I17975e2e2253b2792f71fb64a639e5bdb2ef4935
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990829
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84009}
2022-11-02 13:03:18 +00:00
Victor Gomes
07864a633e [maglev] Fix calling a js class constructor
When skipping the Call stub, we should make sure that
the target is a callable different than a JS class constructor.

If it is a class constructor, then we need to thrown
an exception, see:
https://source.chromium.org/chromium/chromium/src/+/main:v8/src/builtins/x64/builtins-x64.cc;drc=a02c56694fd5e0c64072293040e51837204c7955;l=2462

Bug: v8:7700, chromium:1379570
Change-Id: I5b78866b4fa3ec4620fad23aa504d7cbf1088c3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999132
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84008}
2022-11-02 11:58:15 +00:00
Leszek Swirski
16ed725c09 [maglev] Fix ToName/ToObject node re-use
The maglev graph builder assumes that values stored on registers were
created while visiting that bytecode, so that it can install the
appropriate lazy deopt information. For value re-use, moving between
registers, we therefore have to use the MoveNodeBetweenRegisters method,
otherwise we get DCHECK failures (and might install incorrect lazy deopt
info).

Fixed: v8:13444
Change-Id: I3b85ca20550f3224811c8505a727c32a500ac5c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3999280
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84007}
2022-11-02 11:22:39 +00:00
Pan, Tao
ef2cc0d66d [lookup] Fix condition of concurrent read ThinStrings
The CL (crrev.com/c/2905608) make ThinStrings concurrently readable, but
the condition was set incorrectly.

Change-Id: I1cc2c824f75fde7ec6a2343b8650cdfeb475427c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973071
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Tao Pan <tao.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#84006}
2022-11-02 10:26:30 +00:00
Leszek Swirski
88511bb101 Revert "[tiering] Reset profiler ticks after OSR compilation"
This reverts commit 35c0931420.

Reason for revert: Looks like this is regressing our benchmarks (see https://crbug.com/1379440)

Original change's description:
> [tiering] Reset profiler ticks after OSR compilation
>
> After concurrent OSR was enabled, JS execution may stop not at OSR entry
> when concurrent OSR compilation finish. If no more feedback change,
> without reset profiler ticks, OSR urgency is increased from 0 by 1 per
> profiler tick after concurrent OSR compilation finish, it makes new
> OSR compilation can be quickly triggered, reset profiler ticks after OSR
> compilation for triggering the later OSR compilation under the same
> condition with the first OSR compilation. For example:
> for (;;) {
>   for (;;) {
>   } // OSR entry
>   for (;;) {
>     <- Executing JS code here when the OSR compilation finish
>   }
> }
> 1. We start executing the nesting loop.
> 2. We reset profiler ticks once feedback change.
> 3. If the first inner loop happens to be executing after accumulating
> enough no feedback change profiler ticks, we start concurrent OSR whose
> entry belongs to the first inner loop.
> 4. We continue executing the nesting loop, if no new feedback change,
> increasing profiler ticks again.
> 5. Concurrent OSR whose entry belongs to the first inner loop completes.
> 6. If the second inner loop happens to be executing, without reset
> profiler ticks, we immediately start concurrent OSR whose entry belongs
> to the second inner loop.
> The second OSR code is almost same quality with the first OSR code.
> This CL can reduce OSR compilation amount by ~3.9% (2311 -> 2224) when
> running JetStream2.1.
>
> Change-Id: I4d64cd8963fd2b99d88a3c218841fe5d7c4dc34f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819421
> Commit-Queue: Tao Pan <tao.pan@intel.com>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83944}

Fixed: chromium:1379440
Change-Id: Icc578316aa259b5e8e4a470cae2106c85594e4ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3998651
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84005}
2022-11-02 10:05:48 +00:00
Marja Hölttä
1e463aca7c [rab/gsab] Fix %TypedArray%.from
Bug: v8:11111, chromium:1378900
Change-Id: I01548502e9aa101e9e60bae01d9b24f8aa417bca
Fixed: chromium:1378900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3991492
Auto-Submit: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84004}
2022-11-02 09:25:20 +00:00
Marja Hölttä
9d0de43f39 Try 2: Land --omit-default-ctors
Bug: v8:13091
Change-Id: Ie7919904852043765c346630d0435458d437962e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3991026
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84003}
2022-11-02 09:21:35 +00:00
Dominik Inführ
6eb8316e7a [execution] Report first old space page as CrashKey
Maps are now in old space, so start to report the first page in old
space now.

Bug: v8:12578
Change-Id: Icf08c9074558a2d47bb9f1f8df72cec9668d2b4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3986087
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84002}
2022-11-02 08:26:30 +00:00
Milad Fa
08c5a39495 PPC[liftoff]: Implement simd integer to fp extension
Change-Id: I64520cd3a93821ad51f846cb2ed5475a49015734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3996805
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#84001}
2022-11-01 17:17:14 +00:00
Maya Lekova
c2c2ef3775 [test] Proper fix for float overflow in uint64 tests
Bug: chromium:1379467
Change-Id: Ie82162b2a04a1b52edba21765e6d9c68a6fb7313
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3991016
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84000}
2022-11-01 09:39:49 +00:00
Clemens Backes
2f5fbb1381 [liftoff][arm64] Remove frame size padding to 4k
Before https://crrev.com/c/3054114 we needed to pad the frame size to 4k
so that it fits into a 'sub' instruction as an immediate.
Since frame sizes larger than 4k use special OOL code now, this is not
required any more.
We thus remove the padding to save stack space.

R=ahaas@chromium.org

Bug: chromium:1379364
Change-Id: I155628141d2c0438415ccff36a4de8f7d1ad4fd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3991050
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83999}
2022-10-31 16:44:29 +00:00
Victor Gomes
01a368bb49 [cleanup][x64] Remove unused label from InvokePrologue
Change-Id: I2b11ec593e59d631bc4ad6fad75651d4f9db593a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3991014
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83998}
2022-10-31 14:56:49 +00:00
Andreas Haas
055d2d877e [wasm] Unify builtins for AtomicWait for 32-bit and 64-bit
The timeout parameter of WebAssembly's Atomic.Wait is of type I64. There
existed two sets of builtins to pass this I64 parameter from generated
code to a runtime function: one set for 64-bit platforms where the
parameter was passed directly, and one set for 32-bit platforms where
the parameter was passed as two I32 values.

With this CL we first convert the timeout parameter to a BigInt in the
generated code and then pass the BigInt to a unified builtin. Thereby
the builtin can be written completely in Torque instead of CSA.

For I64AtomicWait also the expected parameter is of type I64, so the
same handling is added for the expected parameter.

R=clemensb@chromium.org
CC=​​manoskouk@chromium.org

Bug: v8:13427
Change-Id: Ia2bb77081cf0db3615d965dbe0e5b97b806a8d1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3990690
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83997}
2022-10-31 14:34:55 +00:00
Pan, Tao
b571605b00 [tiering] Don't mark optimization for big function
Compilation job for big function is aborted in compilation pipeline
currently, compilation job for big funciton can be avoided by not
marking optimization. Furthermore, set big interrupt budget for decrease
times of interrupt budget underflow.

Change-Id: I2940f0d5529a665abbfef165b93568e210217082
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973639
Commit-Queue: Tao Pan <tao.pan@intel.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83996}
2022-10-31 14:33:50 +00:00
Clemens Backes
763393fe77 [wasm] Clean up atomic opcode decoding
Instead of storing the return type in a local variable separately, just
get it from the signature when needed.

R=ahaas@chromium.org

Change-Id: If4c47fb77508b94ed65a2c27abc660e62235d18d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3991015
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83995}
2022-10-31 14:32:48 +00:00