Commit Graph

484 Commits

Author SHA1 Message Date
Matthias Liedtke
7ff8d6eb9e [wasm-gc] Add new ref.cast taking any reference
The new ref.cast (opcode 0xfb41) takes any reference and
expects a Heaptype immediate. the HeapType can be a
concrete or an abstract type.
Differently to the old ref.cast instruction, it traps on
null. A variant which doesn't trap on null (ref.cast null)
will be added in a future CL.

Bug: v8:7748
Change-Id: Id5764a7553a57c5cb838682c9ec331d15d7d25c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3948663
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83724}
2022-10-14 16:24:16 +00:00
Clemens Backes
444e6e3482 Reland "[flags] Remove FLAG_* aliases"
This is a reland of commit e3096c31d6.
The one additional use of FLAG_turboshaft is also rewritten now.

Original change's description:
> [flags] Remove FLAG_* aliases
>
> This removes the deprecated FLAG_* aliases, and switches remaining uses
> to the new v8_flags syntax.
>
> R=jkummerow@chromium.org
>
> Bug: v8:12887
> Change-Id: Icde494a3819a9b1386c91e44f5d72a55666d9eae
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952350
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83686}

Bug: v8:12887
Change-Id: I978df89f51e11c9a101ff3c1e385b1eced697a74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3953292
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83717}
2022-10-14 13:13:55 +00:00
Matthias Liedtke
d4a3ebeb2b Reland "Reland "[wasm-gc] Ref types: Convert dataref to structref""
This is a reland of commit 3b883e787d

Fixed a test case that was merged in the meantime still using the old
kExprRefAsData which is now called kExprRefAsStruct.

Original change's description:
> Reland "[wasm-gc] Ref types: Convert dataref to structref"
>
> This is a reland of commit 20327d1599
>
> Changed in reland:
> - Added new flag wasm-gc-structref-as-dataref which defaults to true
>   and preserves the existing behavior.
> - Passing --no-wasm-gc-structref-as-dataref enables the new behavior.
> - The flag affects static subtyping information between structref and
>   arrays and the corresponding cast, test and br_on instructions.
> - Even with the old behavior the name still changed to "structref".
>
> Original change's description:
> > [wasm-gc] Ref types: Convert dataref to structref
> >
> > This change changes the type hierarchy in a non-backwards compatible
> > way: dataref is replaced with structref meaning that arrayref is
> > no longer a subtype of it.
> >
> > Bug: v8:7748
> > Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#83515}
>
> Bug: v8:7748
> Change-Id: I2d8dd49dbc56246c087ac93452a87f860ead2195
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945109
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83697}

Bug: v8:7748
Change-Id: I54f7b141ffc5b7597420fa0c838412be825a260b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952936
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83706}
2022-10-14 09:32:25 +00:00
Jakob Kummerow
8aa6006533 Revert "Reland "[wasm-gc] Ref types: Convert dataref to structref""
This reverts commit 3b883e787d.

Reason for revert: gc-optimizations test is broken due to in-flight collision with another CL: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8800403395649311857/+/u/Check/gc-optimizations

Original change's description:
> Reland "[wasm-gc] Ref types: Convert dataref to structref"
>
> This is a reland of commit 20327d1599
>
> Changed in reland:
> - Added new flag wasm-gc-structref-as-dataref which defaults to true
>   and preserves the existing behavior.
> - Passing --no-wasm-gc-structref-as-dataref enables the new behavior.
> - The flag affects static subtyping information between structref and
>   arrays and the corresponding cast, test and br_on instructions.
> - Even with the old behavior the name still changed to "structref".
>
> Bug: v8:7748
> Change-Id: I2d8dd49dbc56246c087ac93452a87f860ead2195
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945109
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83697}

Bug: v8:7748
Change-Id: Icb273a6d433c47a372563d0daf68725c6c5b15e3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952514
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83698}
2022-10-13 16:55:15 +00:00
Matthias Liedtke
3b883e787d Reland "[wasm-gc] Ref types: Convert dataref to structref"
This is a reland of commit 20327d1599

Changed in reland:
- Added new flag wasm-gc-structref-as-dataref which defaults to true
  and preserves the existing behavior.
- Passing --no-wasm-gc-structref-as-dataref enables the new behavior.
- The flag affects static subtyping information between structref and
  arrays and the corresponding cast, test and br_on instructions.
- Even with the old behavior the name still changed to "structref".

Original change's description:
> [wasm-gc] Ref types: Convert dataref to structref
>
> This change changes the type hierarchy in a non-backwards compatible
> way: dataref is replaced with structref meaning that arrayref is
> no longer a subtype of it.
>
> Bug: v8:7748
> Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83515}

Bug: v8:7748
Change-Id: I2d8dd49dbc56246c087ac93452a87f860ead2195
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945109
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83697}
2022-10-13 16:19:14 +00:00
Clemens Backes
54543299e5 Revert "[flags] Remove FLAG_* aliases"
This reverts commit e3096c31d6.

Reason for revert: In-flight collision (new usage of FLAG_turboshaft): https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Android%20Arm%20-%20builder/48026/overview

Original change's description:
> [flags] Remove FLAG_* aliases
>
> This removes the deprecated FLAG_* aliases, and switches remaining uses
> to the new v8_flags syntax.
>
> R=​jkummerow@chromium.org
>
> Bug: v8:12887
> Change-Id: Icde494a3819a9b1386c91e44f5d72a55666d9eae
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952350
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83686}

Bug: v8:12887
Change-Id: I7688143bde2c5890842fc6362e3f569f172f68b0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952594
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83689}
2022-10-13 14:09:58 +00:00
Clemens Backes
e3096c31d6 [flags] Remove FLAG_* aliases
This removes the deprecated FLAG_* aliases, and switches remaining uses
to the new v8_flags syntax.

R=jkummerow@chromium.org

Bug: v8:12887
Change-Id: Icde494a3819a9b1386c91e44f5d72a55666d9eae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952350
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83686}
2022-10-13 14:01:32 +00:00
Clemens Backes
fb3321ea27 [wasm] Store local types in a plain array
After the let instruction was removed again, the number and types of
locals stays constant throughout the decoding of a function. Hence store
it in a plain array instead of a ZoneVector. This makes the decoder
smaller and saves bounds checks for the "safe libc++".

R=thibaudm@chromium.org

Bug: chromium:1358853
Change-Id: Iad69aa0cfdc254710e1c2219cfb2c972241ef473
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3944929
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83671}
2022-10-13 09:24:42 +00:00
Clemens Backes
a134066748 [wasm][IWYU] Remove unused heavy includes
The function-body-decoder-impl.h header is really heavy, and a comment
at its beginning says that it should only be included for new
implementations of WasmFullDecoder.
While there are other nice reasons to include it (e.g. for the Immediate
types), many includes were not needed.

This CL removes them, and adds other needed includes as needed instead.

R=jkummerow@chromium.org

Bug: v8:13312
Change-Id: I84efab0814fc1a38643960f49c7641c824b75f71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3933055
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83561}
2022-10-06 14:46:13 +00:00
Matthias Liedtke
661f0220c7 Revert "[wasm-gc] Ref types: Convert dataref to structref"
This reverts commit 20327d1599.

Reason for revert: The code for structref/dataref is in use in
combination with array types, so the change breaks their use cases.
Reverting to restore the previous semantics of dataref.

Original change's description:
> [wasm-gc] Ref types: Convert dataref to structref
>
> This change changes the type hierarchy in a non-backwards compatible
> way: dataref is replaced with structref meaning that arrayref is
> no longer a subtype of it.
>
> Bug: v8:7748
> Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83515}

Bug: v8:7748
Change-Id: I2a0bcafafe6f67df87aac86813f74573b708cce4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3936156
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83544}
2022-10-05 16:48:37 +00:00
Matthias Liedtke
20327d1599 [wasm-gc] Ref types: Convert dataref to structref
This change changes the type hierarchy in a non-backwards compatible
way: dataref is replaced with structref meaning that arrayref is
no longer a subtype of it.

Bug: v8:7748
Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83515}
2022-10-04 12:51:17 +00:00
Matthias Liedtke
e4828a364e [wasm-gc] Add new ref.test taking any reference
The new ref.test (opcode 0xfb40) takes an any reference (vs. data on
the old instruction) and expects a HeapType immediate.
The HeapType can be a concrete or an abstract type.

Bug: v8:7748
Change-Id: Iaa2010af21d3fee76e27a5f4476ae00f5ca837a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3913028
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83475}
2022-09-28 13:43:36 +00:00
Manos Koukoutos
cab9ad05dc [wasm] Documentation and small cleanups
Change-Id: Ia3ef956926b54add138936e3e7d03a0faa457ff9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3913127
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83422}
2022-09-26 11:44:48 +00:00
Clemens Backes
c582eb4ee2 [wasm] Use a single source of truth for feedback vector size
The number of feedback vector slots is currently stored in the
{WasmFunction}, returned in the {WasmCompilationResult}, and implicitly
stored as the size of the {call_targets} vector in
{FunctionTypeFeedback}.

This CL uses the latter as the source of truth, encapsulated in a new
{NumFeedbackSlots} function. This can be updated when adding new kinds
of feedback that need additional slots.
For now, the implementation of {NumFeedbackSlots} requires taking a
mutex, which we can hopefully avoid when productionizing speculative
inlining. We also take the mutex on every Liftoff compilation, which
adds synchronization between concurrent compilation which we previously
tried very hard to avoid (because it introduced significant overhead for
eager compilation).

As a nice side-effect, this CL reduces the per-function overhead by 8
bytes, independent of enabled features.

R=jkummerow@chromium.org

Bug: v8:13209
Change-Id: I2fe5f7fe73154328032a3f0961e88d068c5d07ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899299
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83253}
2022-09-16 10:26:34 +00:00
Manos Koukoutos
7db6d76e97 [wasm] Enable --wasm-type-canonicalization, remove old code
Bug: v8:7748
Change-Id: I74041f23ac64a3e509d82f84b4a710d23bbecbaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893859
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83227}
2022-09-15 16:22:18 +00:00
Manos Koukoutos
b5919c416a [wasm-gc] Always use JSToWasmObject at the JS-to-Wasm boundary
- Remove the {ValueRepr} parameter from Wasm table and global object
  internals. It is now the responsibility of the user to transform
  to/from a JS object. This removes duplicate work in some cases (type
  checking in the caller, transforming in the callee).
- For the reverse direction in the JS API, introduce
  {WasmObjectToJSReturnValue}.

Bug: v8:7748
Change-Id: Ie7625cc0f08d38fe74dbe57e69004de2d93b8a11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876184
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83031}
2022-09-07 14:36:05 +00:00
Feng Yu
41df164a1a [test] Migrate cctest/test-run-tail-calls to unittests/
Bug: v8:12781
Change-Id: Ib2d7fe959f06cb750ccf419796002efb7e569623
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865062
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Feng Yu <f3n67u@gmail.com>
Cr-Commit-Position: refs/heads/main@{#82986}
2022-09-05 16:33:54 +00:00
George Wort
0d591e919d Reland "[turbofan][arm64] Emit Lsl for Int32MulWithOverflow when possible"
This is a reland of commit aa541f1c9c

Original change's description:
> [turbofan][arm64] Emit Lsl for Int32MulWithOverflow when possible
>
> Int32MulWithOverflow on arm64 uses a cmp to set flags rather than
> the multiply instruction itself, thus we can use a left shift when
> the multiplication is by a power of two.
>
> This provides 0.15% for Speedometer2 on a Neoverse-N1 machine,
> with React being improved by 0.45%.
>
> Change-Id: Ic8db42ecc7cb14cf1ac7bbbeab0e9d8359104351
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829472
> Commit-Queue: George Wort <george.wort@arm.com>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82499}

Change-Id: Ib8f387bd41d283df551299f7ee98e72d39e2a3bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865484
Commit-Queue: George Wort <george.wort@arm.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82909}
2022-09-01 11:40:02 +00:00
Matthias Liedtke
ad52bf8a4e [wasm-gc] Cleanup: Rename remaining '_static' op codes
Bug: v8:7748
Change-Id: Ie94e8f7f5afdaea7b4406bf8c57b294bf8f5733c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865959
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82851}
2022-08-31 08:35:38 +00:00
Jakob Kummerow
6168782925 [wasm-gc] call_ref: consume a type immediate
Per https://github.com/WebAssembly/function-references/pull/76,
call_ref and return_call_ref should consume type immediates specifying
the signature of the funcref. This is a breaking change.

To ease the migration, this patch introduces a temporary alternative
binary encoding for call_ref:
- 0x14 continues to *not* take a type immediate for now.
- 0x17 (formerly "let") is the new call_ref *with* type immediate. Module
  producers are encouraged to emit this encoding ASAP.
- After a few weeks of transitionary period, we'll update 0x14 to
  take a type immediate as well. At this point, module producers will be
  encouraged to switch back to 0x14.
- After a few more weeks of transitionary period, we'll drop 0x17 again.

We're not doing the same dance for return_call_ref because it currently
has no uses that we know of.

Bug: v8:7748,v8:9495
Change-Id: Id8d468be3949f84571efff713c937ffd1addff70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3863280
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82839}
2022-08-30 17:51:49 +00:00
Feng Yu
fd9c2391fd [test] Migrate cctest/test-parsing to unittests/
- move cctest/test-parsing -> unittests/parser/parsing-unittest
- move common/{scope-test-helper, unicode-helper} to unittests/parser
  directory because these are only be used by tests in unittests/parser


Bug: v8:12781
Change-Id: Ie0fb043d5df6178bbe088d140a76f606454bbf29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3855313
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Feng Yu <f3n67u@gmail.com>
Cr-Commit-Position: refs/heads/main@{#82837}
2022-08-30 17:37:47 +00:00
Matthias Liedtke
75391be247 [wasm-gc] array.len: Add new opcode without type immediate
Bug: v8:7748
Change-Id: Ib5df6996583435275e9f9c8929763cb19d467d09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3865157
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82824}
2022-08-30 14:23:51 +00:00
Clemens Backes
c497701814 [wasm] Use v8_flags for accessing flag values
Avoid the deprecated FLAG_* syntax, access flag values via the
{v8_flags} struct instead.

R=jkummerow@chromium.org

Bug: v8:12887
Change-Id: Ieccf35730f69bcefa3740227f15e05686080d122
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3843517
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82774}
2022-08-29 12:43:46 +00:00
Samuel Groß
5c152a0f7b [sandbox] Remove a number of native allocations from WasmInstanceObject
Those are not safe in combination with the sandbox as they are stored as
raw pointers. Instead of turning them into ExternalPointers (which use
the ExternalPointerTable indirection), this CL simply turns them into
on-heap ByteArrays which is cheaper and should be unproblematic
security-wise as their contents can be corrupted without causing memory
corruption outside the sandbox address space (just incorrect behaviour
and/or further memory corruption *inside* the sandbox, which is fine).

Bug: chromium:1335046
Change-Id: Id2b901a58b7d6c91dd7596fca553d7c76cbc61ec
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3845636
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82765}
2022-08-29 09:53:35 +00:00
Matthias Liedtke
b592c968e0 [wasm-gc] Internalize JS init value in Table::grow(number, init_value)
This change follows up on 3cc931543f on which Table::grow() was missed.

Bug: v8:7748
Change-Id: I83dc4e4894354ad8c97e577da03d67a36f6d9443
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3858227
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82752}
2022-08-26 14:46:37 +00:00
Matthias Liedtke
8600d58092 [wasm-gc] Rename array.new_fixed_static -> array.new_fixed
This is a left-over of the removal of the dynamic (rtt-based)
variants.

Bug: v8:7748
Change-Id: I93bb74a72543a5697f1102d283c7d65c6be99466
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3856577
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82746}
2022-08-26 13:11:38 +00:00
Feng Yu
0cbfcede6d [test] Migrate cctest/test-sloppy-equality to unittests/
Bug: v8:12781
Change-Id: I1b0be6803d6a9f4ab7071bc3ae5abeb8f29ce9c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829753
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82680}
2022-08-24 08:46:10 +00:00
Feng Yu
75beca729e [test] Migrate cctest/parsing/test-preparser to unittests/
Bug: v8:12781
Change-Id: I5b605db296c2a2813a44f05c74500cc1a0049f57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3832175
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82668}
2022-08-23 15:54:39 +00:00
Matthias Liedtke
3cc931543f [wasm-gc] Add Table<any|eq|data|array>
This change adds support for new table element types besides the
existing support for func and extern.
The newly supported types are the generic types of the 'any' subtype
hierarchy: any, eq, data and array.
All these table types are also usable and accessible via JavaScript,
causing implicit internalization and externalization of the elements
on Table::get() and Table::set().

Bug: v8:7748
Change-Id: Ie85d8f5e1d70471360dd2fb8a39cd38efaac2c22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3838729
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82643}
2022-08-23 07:38:49 +00:00
Feng Yu
4392e0a4ad [test] Migrate cctest/compiler/test-codegen to unittests/
This changeset include:
1. [prepare for migrate] move `cctest/compiler/value-helper.h`,
`cctest/compiler/c-signature.h`, and `cctest/compiler/call-tester.h` to
`test/common` directory because both `test-codegen` and a lot of cctest file
include it.
2. [prepare for migrate] separate the tester helper part of `test-codegen`
into a new `codegen-tester` file.
3. finally, migrate test-codegen.cc to `codegen-unittest.cc`

Bug: v8:12781
Change-Id: Ia2f52c1d3b6b62501066dc1c4308a2c09d699e92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3831146
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82630}
2022-08-22 17:28:27 +00:00
Matthias Liedtke
772f6c8bcd Reland "[wasm-gc] Add extern.externalize"
This is a reland of commit ee89a26977

Original change's description:
> [wasm-gc] Add extern.externalize
>
> This adds `extern.externalize(ref null any): ref null extern` to wasm
> which packs wasm objects into JS objects if the js-interop flag is not set.
> This is the counterpart to extern.internalize introduced in
> 50ec8a11f2.
>
> Bug: v8:7748
> Change-Id: I67b8fe6d70b9f526ff6c43b0a4d7861c7ff5dad0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3825879
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82492}

Bug: v8:7748
Change-Id: Ie13cfd6464006dcadc2a53f2dbf77f76ab185504
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829940
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82551}
2022-08-18 07:41:29 +00:00
Nico Hartmann
e8b62d509b Revert "[wasm-gc] Add extern.externalize"
This reverts commit ee89a26977.

Reason for revert: Speculative revert https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/24078/overview

Original change's description:
> [wasm-gc] Add extern.externalize
>
> This adds `extern.externalize(ref null any): ref null extern` to wasm
> which packs wasm objects into JS objects if the js-interop flag is not set.
> This is the counterpart to extern.internalize introduced in
> 50ec8a11f2.
>
> Bug: v8:7748
> Change-Id: I67b8fe6d70b9f526ff6c43b0a4d7861c7ff5dad0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3825879
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#82492}

Bug: v8:7748
Change-Id: I22c84d69a1dc957208f60ae3125e80278ae739a5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3832389
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#82495}
2022-08-16 16:18:23 +00:00
Matthias Liedtke
ee89a26977 [wasm-gc] Add extern.externalize
This adds `extern.externalize(ref null any): ref null extern` to wasm
which packs wasm objects into JS objects if the js-interop flag is not set.
This is the counterpart to extern.internalize introduced in
50ec8a11f2.

Bug: v8:7748
Change-Id: I67b8fe6d70b9f526ff6c43b0a4d7861c7ff5dad0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3825879
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82492}
2022-08-16 14:43:03 +00:00
Matthias Liedtke
50ec8a11f2 [wasm-gc] Add extern.internalize
This adds `extern.internalize(ref null extern): ref null any` to wasm
which unpacks the wrapped wasm object if the js-interop flag is not set.
I31 values are still wrapped in object wrappers and don't use SMIs.

Bug: v8:7748
Change-Id: Ie4a4507961d0ad41caf430054a3d341f474b8e66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3819645
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82426}
2022-08-12 08:18:48 +00:00
Matthias Liedtke
7961bd20df [wasm-gc] Remove br_on_func & br_on_non_func op
Preparation step to remove the subtype relationship between funcref and anyref.

Bug: v8:7748
Change-Id: Ie4b29bfc4b874aaca668082018f5359d1b6e3a2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3803226
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82125}
2022-08-02 07:41:23 +00:00
Matthias Liedtke
fb9504f31e [wasm-gc] Remove ref.is_func & ref.as_func op
Preparation step to remove the subtype relationship between funcref and anyref.

Bug: v8:7748
Change-Id: Ic2d3467addff16dc0df466234cb7ce6e573ba666
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3797829
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82111}
2022-08-01 15:26:22 +00:00
Manos Koukoutos
4f0ef8c31d [wasm] Use isorecursive canonical types for call_indirect
Currently, we canonicalize types for call_indirect by looking in the
current module for a signature of the same shape. This is not enough
as of wasm-gc. Instead, the canonical identifier representing a type
has to be computed via isorecursive canonicalization.
This change is implemented behind a flag for now.
Future work: Also integrate export wrappers with isorecursive
canonical types. We need to store wrappers in instance-independent
storage.

Drive-by:
- Always emit type check for call_indirect. We did not emit a check
  only when typed-function-references was enabled, but not gc. This
  is not something that will be possible long-term.
- Fix some wasm cctests.

Bug: v8:7748
Change-Id: I7cced187009ac148c833dff5e720a8bb9a717e68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3784600
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82064}
2022-07-29 08:55:49 +00:00
Matthias Liedtke
9c73f61ada [wasm-gc] Split any and extern type
Bug: v8:7748
Change-Id: Ifd4caec2015894f736dd94356298f6ee35ac852b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3779911
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#82035}
2022-07-28 13:09:55 +00:00
Matthias Liedtke
86da4f8f60 [test][wasm-gc] remove remaining rtt canon tests
Bug: v8:7748
Change-Id: I067e9d6a56dd58dbd0f45607f62b5ef36c69ff6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3776690
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Cr-Commit-Position: refs/heads/main@{#81888}
2022-07-22 11:39:21 +00:00
Matthias Liedtke
b9768c0d53 [test][wasm-gc] replace remaining new and cast instructions using rtt
Bug: v8:7748
Change-Id: I09e9d919751945e99e0178168358a3f269fa34a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3776679
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81850}
2022-07-20 12:21:15 +00:00
Matthias Liedtke
81bd4a559b [test][wasm-gc] Replace ref.(cast|test) usages with static variant
Bug: v8:7748
Change-Id: Iec95162ec86a0d96fdd64764864604fc3e26cc39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3771902
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Cr-Commit-Position: refs/heads/main@{#81821}
2022-07-19 16:18:41 +00:00
Matthias Liedtke
e43a5f0ee2 [test][wasm-gc] Replace (array|struct).new_[default_]with_rtt
Bug: v8:7748
Change-Id: Ib8fadc272178fb0d49f7d5fab7d1953e2328a1ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3770107
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81787}
2022-07-18 16:35:53 +00:00
Manos Koukoutos
2d1c3ed604 [test] Remove some unused includes
Mostly test/cctest/.

Bug: v8:13006
Change-Id: I8853d38feb79bed6234a4354ab25a13255a1871b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755149
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81777}
2022-07-18 12:59:03 +00:00
Manos Koukoutos
0ed101e015 Remove some unused includes (4)
Mostly src/codegen, src/compiler, src/interpreter, src/libplatform.

Drive-by: Remove some unreachable code.

Bug: v8:13006
Change-Id: I1a9467f7e42531c545f660d35416c388e8ef9d3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749193
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81613}
2022-07-08 15:26:40 +00:00
Matthias Liedtke
562e21866c [wasm][test] Replace struct.new_with_rtt with struct.new
in unit tests:
- function-body-decoder-unittest.cc
- module-decoder-unittest.cc

    Bug: v8:7748

Change-Id: I1f782bb7292ecd1206a921daccde23b1d314d325
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3751198
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Cr-Commit-Position: refs/heads/main@{#81601}
2022-07-08 09:24:40 +00:00
Manos Koukoutos
32e6b48fca Reland "Remove some unused includes"
This is a reland of commit 2d74bfa4a0

Difference compared to original: Restore one needed include.

Original change's description:
> Remove some unused includes
>
> Mostly src/api, src/asmjs. src/ast, src/base, src/wasm.
>
> Bug: v8:13006
> Change-Id: If4e85afe003fda9f8a681077827c3502e939fe57
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3742702
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81523}

Bug: v8:13006
Change-Id: I88c45059572fa25af4e0999f479ba5c28572db7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3746077
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81539}
2022-07-05 16:44:13 +00:00
Manos Koukoutos
69c77a4ea0 Revert "Remove some unused includes"
This reverts commit 2d74bfa4a0.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20debug%20builder/7403/overview

Original change's description:
> Remove some unused includes
>
> Mostly src/api, src/asmjs. src/ast, src/base, src/wasm.
>
> Bug: v8:13006
> Change-Id: If4e85afe003fda9f8a681077827c3502e939fe57
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3742702
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#81523}

Bug: v8:13006
Change-Id: I7579dc3805ed4cbcd56488c31450c7941b430b1a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3746076
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81526}
2022-07-05 11:57:40 +00:00
Manos Koukoutos
2d74bfa4a0 Remove some unused includes
Mostly src/api, src/asmjs. src/ast, src/base, src/wasm.

Bug: v8:13006
Change-Id: If4e85afe003fda9f8a681077827c3502e939fe57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3742702
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81523}
2022-07-05 11:39:01 +00:00
Manos Koukoutos
ccc74bc64e [wasm-gc] Remove 'let' opcode
This opcode is being removed in favor of pre-declared non-defaultable
locals (details are still TBD).

Bug: v8:9495
Change-Id: I96ac053a1b5a852310c5dc0bbaeab0cbf5384663
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3738743
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81496}
2022-07-01 14:35:09 +00:00
Manos Koukoutos
bcd8bf90ff [wasm-gc] Introduce separate constructors for ref and (ref null)
Most often, the {ValueType::Ref} constructor was called with a
constant nullability. To make things more convenient, this CL renames
{Ref} to {RefMaybeNull}, and introduces {Ref} and {RefNull}
constructors with fixed nullability.

Bug: v8:7748
Change-Id: I664ff184ca936cc752e152c3c67546d79aa24390
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3732936
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81494}
2022-07-01 13:43:58 +00:00