Commit Graph

273 Commits

Author SHA1 Message Date
Manos Koukoutos
4d9d851899 [wasm-gc][bug] Fix signature canonicalization
We used not to emit canonical indexes for arrays and structs into
WasmModule::signature_ids, which resulted in signature_ids not referring
to the correct type indices in a WasmModule.

Changes:
- Rename signature_ids to canonical_type_ids.
- Emit trivial canonical type ids for structs and arrays.
- Add a test to catch the existing bug.
- Improve DCHECKs for module type accessors.

Bug: v8:7748
Change-Id: I67ad58865e35b459b21db12557564b652035db75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2444989
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70318}
2020-10-05 16:16:51 +00:00
Manos Koukoutos
cdb3da7f5f [wasm-gc][bug] call_indirect should check for null table entries
This was not happening when there was no need to typecheck the entry.

Additional changes:
- Add tests with null table entries for typed and untyped function
  tables.
- Allow AddIndirectFunctionTable in wasm-run-utils to specify table
  type.
- Add possibility to define tables in test-gc.cc.
- Merge trapTableOutOfBounds with trapInvalidFunc.
- Use trapTableOutOfBounds in call_indirect as appropriate.
- Fix emission of table types in wasm-module-builder.cc.

Bug: v8:9495
Change-Id: I4a857ff4378e5a87dc0646d94b4c75635a43c55b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2442622
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70311}
2020-10-05 13:08:20 +00:00
Thibaud Michaud
1ff33c41b3 [wasm][fuzzer] Add missing signature check in interpreter runner
R=zhin@chromium.org

Bug: chromium:1134324
Change-Id: Ica1f8c290ba496c7c24d8ec46f963f389ad9e8fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2445875
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70291}
2020-10-02 18:08:28 +00:00
Clemens Backes
2a71b32062 [wasm] Rename {ValidateFlag} constants
As a preparation to add a "boolean validation" mode, rename the existing
flags. This removes many unrelated changes from the follow-up change and
makes it easier to review.

R=thibaudm@chromium.org

Bug: v8:10969
Change-Id: I5f71405b525a7caa91be46c035e31d4d960e4e4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440036
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70224}
2020-09-30 13:19:03 +00:00
Manos Koukoutos
21d954154c [wasm][cleanup] Rename kLocal<type> constants -> k<type>Code
Change-Id: I7bca3ed949a5dd036c3255cc5853819312387cce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436330
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70190}
2020-09-29 08:48:21 +00:00
Adam Klein
74794fb937 [wasm-simd] Rename shuffle & swizzle instructions to match spec
These instructions were changed from "s8x16" to "i8x16" prefixes in
https://github.com/WebAssembly/simd/pull/321.

This CL updates all V8 code, including arch-specific code, to match.

Bug: v8:10946, v8:10933
Change-Id: I26ef9ad77571f94501d42c1d65f57380fd507f3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432068
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70143}
2020-09-25 19:07:12 +00:00
Clemens Backes
18da08757f [wasm][memory64] Start implementing the memory64 proposal
This is a first small step for implementing the memory64 proposal:
1. Add a feature flag.
2. Add the 0x04 and 0x05 limits flag for memory64.
3. Read memory limits as LEB-encoded u64 (instead of u32) if a memory64
   limit flag was read.
4. Unify {MaximumFlag} and {MemoryFlag}, which was used inconsistently
   before.
5. Add test for memory limits encoded with >5 bytes.
6. Move some macros from module-decoder-unittest.cc to wasm-macro-gen.h.

Note that still the same limits for the maximum number of pages applies
as before, i.e. you cannot specify a memory >4GB yet. But you can encode
that small number in >5 bytes.

R=manoskouk@chromium.org

Bug: v8:10949
Change-Id: I90a4f08426ae714a67440281785eb00cfc24a349
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423712
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70110}
2020-09-24 09:38:08 +00:00
Ng Zhi An
f1530eddf9 [wasm-simd] Rename load splat and load extend
Rename opcodes based on the renaming in the proposal,
https://github.com/WebAssembly/simd/pull/322.

Bug: v8:10946
Change-Id: If267d6f8fb1b9deeff64cd9abcd7e4cd64a540a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422357
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70077}
2020-09-22 22:19:33 +00:00
Ng Zhi An
83fa52a543 [wasm-simd] Set default args for v128 values
Instantiating a module that contains a function (exported) with a v128
in its signature is fine, but then later calling it will trap.

So v128 values are technically not callable from JS, but we can give it
a default argument of 0, and will later trap anyway. This is useful when
fuzzers generate functions with v128 in the signature of the main
function that we then later try to call.

Bug: chromium:1129068
Change-Id: I93f239a0355b8059e25b8bd5f1274d151d71ee11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419657
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70038}
2020-09-21 21:12:57 +00:00
Thibaud Michaud
140271f269 [wasm] Fix interpreter Ref in unreachable code
For "else" and "catch" statements, the Ref to the end label should only
be added if the current block is unreachable, not the parent block.

In the added regression test, the "true" block ends in an unreachable
state with a stack height less than the target height of the end label.
This is valid due to the semantics of unreachable code, but we should
not add the Ref in this case because its stack height is invalid.

R=clemensb@chromium.org

Fixed: chromium:1092130
Change-Id: Iebaf5e7d6516278ccd3c8268ac331069e109d882
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412181
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69934}
2020-09-16 09:34:29 +00:00
Clemens Backes
a53c1e4bbf [wasm][fuzzer] Support functions returning i64
Those functions will return a BigInt, which we need to convert to int to
match the value returned by the interpreter.

R=ahaas@chromium.org

Bug: chromium:1127717
Change-Id: I328660ab73776de2bd90b19d18e46663efe6b6cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412177
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69922}
2020-09-15 17:23:22 +00:00
Ng Zhi An
86d01fb516 [wasm-simd][scalar-lowering] Fix more lowering of returns
Fix lowering of functions that returns the result of an
i8x16 or i16x8 operation.

Bug: v8:10507
Change-Id: Ia3b29e69cff7771f85dc5160937cbaf2bbc12b55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2399049
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69832}
2020-09-11 01:48:16 +00:00
Andreas Haas
6565eb09c8 [wasm] Increase cost of return-call in the interpreter
The wasm interpreter is slow on an arm simulator build with asan when
it comes to return calls. An infinite return-call recursion therefore
caused a timeout on ClusterFuzz. With this CL we increase the costs of
return calls, and thereby avoid the timeout.

R=clemensb@chromium.org

Bug: chromium:1124899
Change-Id: If88e060779fbe2569e289e60170cf487dd31d7db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2397615
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69740}
2020-09-08 13:54:17 +00:00
Ng Zhi An
1f7cb7e1c1 [wasm-simd][scalar-lowering] Fix lowering of functions returning f32x4
Functions with v128 in their signatures are always lowered to 4 word32.
So if a return happens to be have an input that is a f32x4 operation, we
get a register allocator error because it tries to fit a float into a
general register. To fix that we need to do some checks when lowering
kReturn, and for each input node, if we are returning a v128, and it is
to be lowered into 4 f32 nodes, we bitcast the floats to ints.

Bug: v8:10507
Change-Id: Iea2fdfc4057304ebf0898e6f7091124629c589f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391331
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69705}
2020-09-03 18:41:36 +00:00
Clemens Backes
2d78b3a72a [wasm][fuzzer] Fix BigInt parameters
The fuzzers were calling the compiled function without passing explicit
arguments. Thus all arguments were converted from the "undefined" value,
which typically results in a zero value, as expected.
For BigInt though, it's not allowed to pass "undefined". We have to pass
a proper BigInt.
This CL implements this by passing explicit parameter values for all
parameters.

This effectively unlocks testing BigInt parameters in all fuzzers, thus
may increase coverage and find new bugs.

R=ahaas@chromium.org

Bug: chromium:1120355
Change-Id: I4e451d2418eb73d460fa937d1cf95a1ab6c99cf5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377945
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69570}
2020-08-26 14:22:19 +00:00
Clemens Backes
f7d169c600 Reland "[wasm][fuzzer] Fix exception detection"
This is a reland of 899cb34868.
The new fuzzer regression test is skipped in jitless.

Original change's description:
> [wasm][fuzzer] Fix exception detection
>
> Exceptions were detected by checking for a pending exception on the
> isolate, but {CallWasmFunctionForTesting} was clearing any pending
> exception before returning.
> This CL fixes that by explicitly passing back a boolean which is set if
> an exception occurred during execution.
>
> R=ahaas@chromium.org
>
> Bug: chromium:1115280
> Change-Id: Ife71ceef0751d18e0870335b9520c2bf77e351cc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352787
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69404}

Bug: chromium:1115280
Change-Id: I9bb7300d423c53214e51e61233b0a6b09a21fd97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2361464
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69446}
2020-08-18 09:00:05 +00:00
Bill Budge
a2268e6e2a Revert "[wasm][fuzzer] Fix exception detection"
This reverts commit 899cb34868.

Reason for revert: Added regression test fails on Arm Sim:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/11584

Original change's description:
> [wasm][fuzzer] Fix exception detection
> 
> Exceptions were detected by checking for a pending exception on the
> isolate, but {CallWasmFunctionForTesting} was clearing any pending
> exception before returning.
> This CL fixes that by explicitly passing back a boolean which is set if
> an exception occurred during execution.
> 
> R=​ahaas@chromium.org
> 
> Bug: chromium:1115280
> Change-Id: Ife71ceef0751d18e0870335b9520c2bf77e351cc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352787
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69404}

TBR=ahaas@chromium.org,clemensb@chromium.org

Change-Id: I1d3c0e57df7ec25b09f2037c31c9b30eb0866548
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1115280
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2357189
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69405}
2020-08-14 18:31:28 +00:00
Clemens Backes
899cb34868 [wasm][fuzzer] Fix exception detection
Exceptions were detected by checking for a pending exception on the
isolate, but {CallWasmFunctionForTesting} was clearing any pending
exception before returning.
This CL fixes that by explicitly passing back a boolean which is set if
an exception occurred during execution.

R=ahaas@chromium.org

Bug: chromium:1115280
Change-Id: Ife71ceef0751d18e0870335b9520c2bf77e351cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352787
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69404}
2020-08-14 18:15:47 +00:00
Manos Koukoutos
dd152527d6 [wasm-gc] Implement call_ref, return_call_ref, add some basic tests
Drive-by: Add flag implications for wasm experimental features:
  gc -> typed_funcref, typed_funcref -> reftypes.

Bug: v8:9495
Change-Id: Ia6054886935d68e79b8f463289aa9e1e9d6484f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352777
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69403}
2020-08-14 17:58:27 +00:00
Clemens Backes
833662c74a [wasm][fuzzer] Fix return value of interpreter
Bring the return value of {InterpretWasmModule} in sync with
{CallWasmFunctionForTesting}, because the fuzzers now compare the two.

R=ahaas@chromium.org

Bug: chromium:1115431
Change-Id: I0abf79c4418a4e6cc7365a78148e5e71cf32231b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2351678
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69374}
2020-08-13 10:08:53 +00:00
Santiago Aboy Solanes
5e82bb633a [compiler] Remove persistent handles as a broker parameter
Since it will be patched in later in the cases where it will be used,
there is no need to have it as a parameter.

Bug: v8:7790
Change-Id: I93b27f3baf8c3841a60f5ac5ed09993d1caf19bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2351667
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69366}
2020-08-13 08:13:33 +00:00
Clemens Backes
5ec483c38e [wasm][fuzzer] Reuse more logic across fuzzers
This removes the {InterpretWasmModuleForTesting} function in favor of
{InterpretWasmModule}, and uses that in {InterpretAndExecuteModule}.
The latter again is reused in {WasmExecutionFuzzer::FuzzWasmModule},
such that all fuzzers execute the same checks now.

R=ahaas@chromium.org

Bug: chromium:1112099, chromium:1113681
Change-Id: Ia8818b93e9274266a81573edd6852e4e4734b150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346283
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69331}
2020-08-11 13:25:34 +00:00
Clemens Backes
14e55ad40f [wasm][fuzzer] Merge redundant functions
Remove the {ErrorThrower} parameter to {CallWasmFunctionForTesting} (it
was only populated in a subset of failures anyway), and merge it with
{RunWasmModuleForTesting}.

R=ahaas@chromium.org

Bug: chromium:1113681
Change-Id: I5391e2f911928641a907bc5dad5a54677c90acb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346279
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69327}
2020-08-11 12:30:53 +00:00
Clemens Backes
64dfb0b4ad [wasm][interpreter] Print float in hex representation
The interpreter is used for testing (including fuzzing) only, and in
these cases it's often important to see the exact value of a float. Both
decimal and scientific notation does not show the full value though, and
decimal representation can also be really long for large values, making
it hard to compare values.
This CL switches this debug output to hexadecimal float values, which
always shows the float value in full precision and is also much shorter
than decimal notation in many cases.

R=ahaas@chromium.org

Bug: chromium:1112099
Change-Id: Ia84824227fcd2f1e763ab89280a202ed44930a71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346646
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69323}
2020-08-11 10:12:20 +00:00
Clemens Backes
242df3a2ed [wasm][fuzzer] Check result of compiled code vs interpreter
The plain "wasm fuzzer" (which takes the fuzzer input as the wasm wire
bytes) was already running both the interpreter and compiled code, but
it did not compare the results of both.
This CL fixes this by reusing some logic that was already present in the
fuzzers based on the {WasmCompileFuzzer} class.

R=ahaas@chromium.org

Bug: chromium:1113681, chromium:1112099
Change-Id: I9d407f66dfcba0eec90f050630b028edd5fae1d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339624
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69310}
2020-08-10 14:59:46 +00:00
Clemens Backes
4b7521ea06 [wasm][fuzzer] Remove unused argument
The {name} parameter was unused, we always picked the exported "main"
function.

R=ahaas@chromium.org

Bug: chromium:1113681
Change-Id: Iee4b8f72e1137a7e366c3c31b4fa4e4ef81863b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2345964
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69307}
2020-08-10 11:53:35 +00:00
Jakob Kummerow
d3fab076a9 [wasm-gc] Implement {array,struct}.new_default_with_rtt
Bug: v8:7748
Change-Id: If876c9499373f091067299fe333e7b59d6cefb41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343077
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69305}
2020-08-10 10:50:26 +00:00
Clemens Backes
0c918bd841 [wasm] Remove ExecutionTier::kInterpreter
The interpreter is not an execution tier in production any more. It's
only used in tests.
Thus, remove {ExecutionTier::kInterpreter} and instead add a
{TestExecutionTier} that still has {kInterpreter}.

If needed (in {TestingModuleBuilder::execution_tier()}), we translate
back from {TestExecutionTier} to {ExecutionTier} (for {kLiftoff} and
{kTurboFan} only).

The {TraceMemoryOperation} method, which is shared between interpreter
and production code, now receives a {base::Optional<ExecutionTier>}, and
we will just pass en empty optional if called from the interpreter.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: Ibe133b91e8dca6d6edbfaee5ffa0d7fe72ed6d64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335186
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69260}
2020-08-06 09:31:18 +00:00
Manos Koukoutos
65530e72e1 [wasm-gc] Test improvements/additions.
Changes:
- Fix error message typo in function-body-decoder.
- Generalize wasm test macros related to reference types.
- Change wasm-gc test API to return bytes.
- Add unittests for ref.test/cast.

Bug: v8:7748
Change-Id: I361987e0b6ac90c4e89a49a8abc125757a5fc8d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2317319
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69220}
2020-08-04 09:51:24 +00:00
Thibaud Michaud
12c60417cb [wasm][interpreter] Add missing WasmCodeRefScope
R=clemensb@chromium.org

Change-Id: I3cedc8d27c9a597cd2e6013d3be479db513a0a3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2323356
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69113}
2020-07-28 16:54:31 +00:00
Manos Koukoutos
db6f0440f6 [wasm-gc][tests] Add supertype argument to WASM_RTT_SUB
Change-Id: I6a2ef3d1c46ea57b17234d050b8f0be12e27a197
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2315985
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69037}
2020-07-24 09:06:35 +00:00
Jakob Kummerow
ae7b6fcdaf [wasm-gc] Implement br_on_cast
Bug: v8:7748
Change-Id: I6e226888d84a790efc36ac6e7c2a32bc3426bd84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2308341
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69002}
2020-07-22 15:05:18 +00:00
Ng Zhi An
1d78645135 [wasm-simd][cleanup] Consolidate macros for SIMD loads
The load splat, load extend, load zero macros are essentially the same,
consolidate them into a single macro.

Change-Id: Ic812043b37524deb3a9e6ddc223bb95ae77e1d4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304715
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68978}
2020-07-21 22:14:12 +00:00
Ng Zhi An
7ca9fc8e68 [wasm-simd][x64] Prototype v128.load32_zero and v128.load64_zero
Prototype in TurboFan x64 and interpreter, bailout in Liftoff.

Suggested in https://github.com/WebAssembly/simd/pull/237.

Bug: v8:10713
Change-Id: I5346c351fb2ec5240b74013e62aef07c46d5d9b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300924
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68973}
2020-07-21 17:47:42 +00:00
Manos Koukoutos
0747681e41 [wasm-gc][cleanup] Remove array.new, struct.new
They have been replaced with {array,struct}.new_with_rtt.

Also, rework tests that used those instructions.

Bug: v8:7748
Change-Id: I2aaccb1958bf2b8d6cad4969abc612216856393d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307318
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68961}
2020-07-21 09:53:31 +00:00
Manos Koukoutos
c108d7a058 [wasm-gc] Implement array.new_with_rtt
Also remove traces of array.new_sub

Bug: v8:7748
Change-Id: I96a922a16406960a80af0788e9cad5aa5692000a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307237
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68956}
2020-07-21 08:35:17 +00:00
Santiago Aboy Solanes
2b873b94e9 [compiler] Don't serialize BytecodeArrayData's source_positions_
This CL adds functionality to read the source positions directly
from the JS heap rather than from serialized data.

In order to do this, we create a PersistentHandles container in the
OptimizedCompilationInfo which gets passed onto the JSHeapBroker. This
allows us to create the handles in the main thread and pass them safely
to the background thread.

In order to read safely from the background thread, we need a LocalHeap
which blocks the GC from running and potentially moving the handles.
This LocalHeap is created only when the JSHeapBroker has finalized
serializing and destroyed when retiring it.

Bug: v8:7790
Change-Id: I19f8b08d12e5be0a3df34d6af2043310c0c7b6fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277802
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68836}
2020-07-14 11:01:44 +00:00
Igor Sheludko
295ee7ef84 [zone] Cleanup zone allocations in src/wasm and tests
... by migrating old-style code
  MyObject* obj = new (zone) MyObject(...)

to the new style
  MyObject* obj = zone->New<MyObject>(...)

Bug: v8:10689
Change-Id: I2fc4a44ea05e4d087565811f343893f0e97dc660
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2288857
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68789}
2020-07-10 12:11:55 +00:00
Manos Koukoutos
0a819023d1 [wasm-gc] Test improvements
- Adapt subtyping unittest to the new HeapType API
- Generalize WASM_REF_TYPE macro

Bug: v8:7748
Change-Id: Ifdb24408d7a34a6470ddccdf3dc8536cbb93dece
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2274610
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68652}
2020-07-02 11:54:29 +00:00
Deepti Gandluri
871183ea12 [wasm-simd] Implement v128.const on x64, Arm64
- Add wasm opcode, decode and compiler code for v128.const
 - Add codegen implementations for v128.const on x64/Arm64
 - Reuse/Rename some shuffle specific methods to handle generic
 128-bit immediates
 - Tests

Bug: v8:8460
Change-Id: Idc365c8f6402c13259400eac92e0b75bd0f991a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2276176
Commit-Queue: Deepti Gandluri (OOO Till November) <gdeepti@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68643}
2020-07-02 01:26:09 +00:00
Jakob Kummerow
5902846347 Reland: [wasm-gc] Implement ref.test and ref.cast
No changes, just rebasing.
Original review: https://chromium-review.googlesource.com/c/v8/v8/+/2277889

Bug: v8:7748
Change-Id: Iea3bc881eaab28b14d4e2af9892ee74848c59f04
Tbr: ahaas@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2278463
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68642}
2020-07-01 21:45:47 +00:00
Jakob Kummerow
5629424781 Revert "[wasm-gc] Implement ref.test and ref.cast"
This reverts commit 3f74ece91b.

Reason for revert: build breakage, rebasing issue

Original change's description:
> [wasm-gc] Implement ref.test and ref.cast
> 
> Bug: v8:7748
> Change-Id: If0023edf2f27448c605bd8aa6402bf76c7983a6e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277889
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68640}

TBR=jkummerow@chromium.org,ahaas@chromium.org

Change-Id: Idd4eee1711aed3c0a9f89a36793738c72a34c783
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7748
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2278462
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68641}
2020-07-01 20:31:59 +00:00
Jakob Kummerow
3f74ece91b [wasm-gc] Implement ref.test and ref.cast
Bug: v8:7748
Change-Id: If0023edf2f27448c605bd8aa6402bf76c7983a6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277889
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68640}
2020-07-01 20:21:37 +00:00
Manos Koukoutos
5df74c351f [wasm] Properly implement parsing of s33 values
Motivation:
We used to approximate s33/i33 value parsing by first checking for
specific negative codes, and then parsing an u32 value if that failed.
This is not correct in all cases.

Changes:
- Implement i33 parsing in Decoder.
- Factor out parsing of heap types into read_heap_type.
- Introduce HeapType::kBottom.
- Introduce helper functions in WasmFeatures and value_type_reader.
- Remove macros from the parsing of value types.
- HeapType::code now returns an i32 for compatibility with the i33
  requirement.
- Introduce HeapType::Repr.
- Renamings: HeapType::type() -> representation(),
             ValueType::heap() -> heap_representation()

Bug: v8:7748
Change-Id: I04deabce8837a48af2226411cd706a397f9e5725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2274118
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68633}
2020-07-01 12:27:40 +00:00
Jakob Kummerow
26626f8731 [wasm-gc] Implement struct.new_with_rtt
Bug: v8:7748
Change-Id: I6bbb73ceb397b102783ecfcc553264d83e926df2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2273126
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68620}
2020-06-30 18:59:55 +00:00
Jakob Kummerow
7043ffa2f0 [wasm-gc] Implement i31ref
This patch does not include support for RTTs for i31ref yet.

Bug: v8:7748
Change-Id: Ifbeb8e305c2d0a57e4d5d6be761d046e330e0da1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2273135
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68613}
2020-06-30 12:41:25 +00:00
Jakob Kummerow
abe8edaf7f Reland: [wasm-gc] Implement rtt.sub
Relanding without changes, revert reason was fixed by:
https://chromium-review.googlesource.com/c/v8/v8/+/2272564

Originally reviewed at:
https://chromium-review.googlesource.com/c/v8/v8/+/2260566

Original description:
RTTs are internally represented as Maps. To store supertype information,
this patch introduces a WasmTypeInfo object, which is installed on Wasm
objects' Maps and points at both the off-heap type information and the
parent RTT.
In this patch, rtt.sub always creates a fresh RTT. The canonicalization
that the proposal requires will be implemented later.

Bug: v8:7748
Change-Id: I7fd4986efa3153ac68037ec418ea617f3f7636e8
Tbr: ulan@chromium.org
Tbr: tebbi@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2273123
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68581}
2020-06-29 14:55:45 +00:00
Manos Koukoutos
fe00ecb8ba [wasm-gc] Introduce HeapType class
Drive-by: Fix ref.is_null calling is_reference_type to typecheck its
argument (which would also allow rtts).

Bug: v8:7748
Change-Id: I2ad01d0f70ac15d37ac4cc344bd0280a7ca08073
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264094
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68572}
2020-06-29 10:00:44 +00:00
Shu-yu Guo
304565661b Revert "[wasm-gc] Implement rtt.sub"
This reverts commit 04ce88eae5.

Reason for revert: TSAN failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/32135

Original change's description:
> [wasm-gc] Implement rtt.sub
> 
> RTTs are internally represented as Maps. To store supertype information,
> this patch introduces a WasmTypeInfo object, which is installed on Wasm
> objects' Maps and points at both the off-heap type information and the
> parent RTT.
> In this patch, rtt.sub always creates a fresh RTT. The canonicalization
> that the proposal requires will be implemented later.
> 
> Bug: v8:7748
> Change-Id: I8286dd11f520966155cd95c2bd844ec34fccd131
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260566
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68564}

TBR=ulan@chromium.org,jkummerow@chromium.org,tebbi@chromium.org

Change-Id: I311732e1ced4de7a58b87d4a9b6056e0d62aa986
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7748
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270734
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68567}
2020-06-26 18:16:37 +00:00
Jakob Kummerow
04ce88eae5 [wasm-gc] Implement rtt.sub
RTTs are internally represented as Maps. To store supertype information,
this patch introduces a WasmTypeInfo object, which is installed on Wasm
objects' Maps and points at both the off-heap type information and the
parent RTT.
In this patch, rtt.sub always creates a fresh RTT. The canonicalization
that the proposal requires will be implemented later.

Bug: v8:7748
Change-Id: I8286dd11f520966155cd95c2bd844ec34fccd131
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260566
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68564}
2020-06-26 16:31:02 +00:00