Condition register might need to be cleared before
running instructions to assure sticky bits are cleared.
Change-Id: Id18e5759e4cc9f03c2e9334f41b5ff179639ad22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562747
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71460}
Reason for revert: Data race:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34121
It was assume that MockPlatform runs everything on 1 thread. However,
MockPlatform::PostJob previously would schedule the job through
TestPlatform, which eventually posts concurrent tasks, thus causing
data race.
Fix: Manually calling NewDefaultJobHandle and passing the MockPlatform
ensures the jobs also run sequentially.
Additional change:
- CancelAndDetach is now called in ~CompilationStateImpl() to make sure
it's called in sequence with ScheduleCompileJobForNewUnits
Original CL description:
To avoid keeping around a list of job handles, CancelAndDetach() is
used in CancelCompilation. Dependency on WasmEngine is handled by a
barrier that waits on all jobs to finish.
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498659
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#71074}
Change-Id: Ie9556f7f96f6fb9a61ada0e5cbd58d4fb4a0f571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2559137
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71459}
Remove TRACE_BACKGROUND_GC which was used to emit events on the
background thread. It is replaced by TRACE_GC1, which uses the ThreadKind
argument to work both on main and background threads.
This CL also removes the dedicated BackgroundScope enum, all scopes
are now in GCTracer::Scope.
Change-Id: Ie377082d6a278dd46f2fa359611fdd99a08afcea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560203
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71458}
We used to update profiler ticks after tiering up decisions when tiering
up from Ignition and update the ticks before when tiering up from
mid-tier optimized code. This meant we added special cases to account for
this difference. This cl makes updating the ticks uniform by always
updating the ticks before tiering up decisions. Also adjusts the
heuristics to take this into account.
Bug: v8:9684
Change-Id: I2c63ba3499c542bb4a69e55d6cc4bebe4612793f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563659
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71457}
Otherwise, its behaviour is undefined and shouldn't be permitted.
Bug: v8:7790, v8:11135
Change-Id: I9fa5ec02b9126f776ad3ef095e8c70fc5d3620dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547293
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71456}
Like https://crrev.com/c/v8/v8/+/2555001 for v8.h. Done in a separate
CL in case it needed to be reverted.
Change-Id: I0c7a7cb24e8f0855c8b80ddeeaab979f10011c4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562252
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71455}
cppgc_unittests uses tracing (e.g. when setting the TracingController in
tests.h) and thus needs to depend on v8_tracing. It cannot inherit the
dependency since the cppgc_unittests_sources v8_source_set doesn't
depend on cppgc.
Bug: v8:11203
Change-Id: I7227f696f841132f174435751a42a02ff865df26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563658
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71453}
The error simulation works and crashes during the smoke test are
detected. But now this masks real crashes (https://crbug.com/1153200),
therefore this change subsumes smoke-test crashes with
--simulate-errors under a separate crash state.
Now Clusterfuzz will detect the case "unexpected crash" as fixed, but
create a new bug for "simulated crash". Which we will keep open
forever.
No-Try: true
Bug: chromium:1152412
Change-Id: I511af167d33430d9b89692151cb8abaf3a90c715
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563270
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71452}
This CL extends the TruncateFloat64ToInt64 machine operator with a
TruncateKind, allowing EffectControlLinearizer to request truncating
to INT64_MIN in case of overflow. The CL adds the necessary low-level
support when generating code for kArm64Float64ToInt64. It also enables
relevant tests as part of the fast API call suite.
Bug: v8:11121
Change-Id: I0cb9964cc3c2ff49e6b0bbfe4a20f280e4aab337
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560718
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71449}
Currently MockPlatform has shorter lifetime than the isolate that uses
it. Creating isolate before MockPlatform leads to races in concurrent
tasks that were scheduled before the MockPlatform replaced the default
TestPlatform. This caused issues after landing
https://chromium-review.googlesource.com/c/v8/v8/+/2561198
This CL ensures that MockPlatform is valid throughout the whole
lifetime of the isolate
Bug: v8:11198
Change-Id: I79f82712165d1f1fbe0fe9af68aedf126e54b241
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562121
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71443}
Avoid virtual call on the fast path when invoking
Heap::MonotonicallyIncreasingTimeInMs by using base::TimeTicks directly.
With --predictable we need to fall back to
Heap::MonotonicallyIncreasingTimeInMs though.
Convert base::TimeTicks to milliseconds as double, since this was
the format GCTracer was using internally.
Change-Id: I25ab6f1a77ffc8a317782b5754521c39ccb46e48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562240
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71440}
1. Don't optimize small functions early when tiering up from ignition
to Turboprop.
2. When tiering up from Turboprop to Turbofan scale the ticks so we
optimize small functions at roughly same time as default.
3. Adjust for the fact that profiler ticks are updated before performing
the ShouldOptimize check when tiering up from TP -> TF.
Bug: v8:9684
Change-Id: I6b68eed70abb9a86f9b99eac9c0b9a1fe6346027
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560725
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71436}
Make the IsEqualTo equality type parameter a template parameter, and add
an option to skip the length check for cases where the length is known
(e.g. in string table key comparisons).
Change-Id: I893ac880ec1e830a50ba6d8f58f375ed96d6e14e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562247
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71435}
- Add ToolTip helper that tracks scrolling target elements
- Auto hide if the target scrolls out of view
- ToolTip position depends on target position
- Add basic tooltips for maps in the transition view, entries in
timeline tracks and the source panel
Drive-by-fix:
- Move events.mjs to view/ folder
- Add basic toString methods on various log entries
- Add requestAnimationFrame update support for V8CustomElement
Bug: v8:10644
Change-Id: I1059733cd094a986b715547b3d5747eefbc54bc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551103
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71434}
Because actual condition code used by s390/ppc does not distinguish
between signed and unsigned, we need to use a generic enum class for
liftoff which needs to deal with signed/unsigned case differently.
Change-Id: Ia870dc30788037996dc1c65de0117eac7d941697
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560603
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71433}
This passes the --simulate-errors flag for differential fuzzing with
a probability of 0.01%.
No-Try: true
Bug: chromium:1152412
Change-Id: I3146c0ea5706be8b5ec13ee8740e1d185e008075
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562248
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71432}
Use the overload of NativeModule::PublishCode that accepts a vector of
codes to only lock/unlock once per batch.
R=ahaas@chromium.org
Bug: v8:11164
Change-Id: I6428d3d9cec8526bdfef223d7ba03b35bad9e1eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562251
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71431}
This adds a d8 flag --simulate-errors, which on shutdown will cause
certain errors. This enables testing the reliability of sanitizers.
This will cause a fatal error, a dcheck (if available) or a
violation that can be detected with one of the following sanitizers:
ASAN, UBSAN, MSAN, CFI.
The same flag used in differential fuzzing will cause an error
subsumed with the error state "fake_difference".
Bug: chromium:1152412
Change-Id: I4b36c6fe716797004d634263617d22ca67b05600
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2554999
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71430}
This specific case was not implemented or tested before. Implementing it
actually simplifies some of the existing logic, since StepOut can now
reuse the generic logic in debug.cc for all cases (Wasm->Wasm, Wasm->JS,
JS->Wasm).
Drive-by:
1) Fix typo ("skip" -> "step").
2) Move the check for Liftoff code from debug.cc to wasm-debug.cc, where
it fits better.
3) Remove a TODO which is done already.
R=thibaudm@chromium.org, szuend@chromium.org
Bug: chromium:1145176
Change-Id: I415ca1d8bacef5b21bf1dafd9e16417ec2d12c7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2560719
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71428}
This CL re-enables use of the generic js-to-wasm wrapper for asm.js
modules.
Bug: v8:10982
Change-Id: I0aa6cd9387bfd7b3fc3cab18f09c7f78ec24fbb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562238
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#71426}
Scopes in V8 are used to guarantee one or more properties during its
lifetimes. If a scope is not named e.g MyClassScope(args) instead of
MyClassScope scope(args) it will get created and automatically destroyed
and therefore, being useless as a scope. This CL would produce a
compiling warning when that happens to ward off this developer error.
Follow-up to ccrev.com/2552415 in which it was introduced and
implemented for Guard classes.
Change-Id: Ifa0fb89cc3d9bdcdee0fd8150a2618af5ef45cbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2555001
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71425}
Fixed: chromium:1151890
Change-Id: I26f5c76494a9ff3f5a141f381e1c9a543e368571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2561618
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71422}
Both sample are essentially the same up to string constants since
cppgc's default platform started using libplatform.
The only diff between the sample is whether we call
v8::V8::IntializePlatform or cppgc::InitializeProcess.
Drive-by: replace CPPGC_BUILD_IN_V8 with CPPGC_IS_STANDALONE which is
more descriptive.
Bug: chromium:1056170
Change-Id: I8fdeb59c3345af77f1bccd8b93255ab39b4d3181
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557516
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71421}
