Commit Graph

71933 Commits

Author SHA1 Message Date
Lei Zhang
5333d90ecd Fix MSVC C4065 warning in HasMemoryAccessMode().
Avoid generating switch statements with only a default case. Instead,
when there are no instructions that can trap, simply have
HasMemoryAccessMode() return false. This avoids a MSVC warning when
doing a 32-bit build.

To do this, remove empty TARGET_ARCH_OPCODE_WITH_MEMORY_ACCESS_MODE_LIST
definitions from instruction-codes-$arch.h files.

Change-Id: Ifed76eb9cbca169f30c188c1999e1e9be0b2c6aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3224807
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77441}
2021-10-18 16:02:50 +00:00
Michael Achenbach
5bcd2037a3 Revert "[infra] Split Linux arm sim lite CI builders"
This reverts commit ee50ba881c.

Reason for revert: builders purple

Original change's description:
> [infra] Split Linux arm sim lite CI builders
>
> Bug: v8:12253
> Change-Id: I9cb67901a5711f251baa411ff57d84fa2049562a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3208029
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77439}

Bug: v8:12253
Change-Id: Ifa77aead25746ce368b6207d9e1861b0006664bf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229566
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77440}
2021-10-18 15:55:12 +00:00
Al Muthanna Athamina
ee50ba881c [infra] Split Linux arm sim lite CI builders
Bug: v8:12253
Change-Id: I9cb67901a5711f251baa411ff57d84fa2049562a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3208029
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77439}
2021-10-18 15:17:50 +00:00
Maria Tîmbur
838249bf52 [fuzzer] Change the logic of GenerateOneOf
Change the logic behind GenerateOneOf so that not only
ref_null would appear almost everytime. Increase the probability
of other alternatives to appear as well.
Change the name of GenerateOptRef to GenerateRef.

Bug: v8:11954
Change-Id: I8bff1661c3d3a91105bca1ffa68e1e9b0b662240
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229367
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77438}
2021-10-18 15:09:40 +00:00
Victor Gomes
3fc4de00a2 Reland "[baseline] Concurrent Sparkplug n-thread with synchronised queue"
This is a reland of 0c459ff52b

Original change's description:
> [baseline] Concurrent Sparkplug n-thread with synchronised queue
>
> Installation in the main thread.
> Design doc: https://docs.google.com/document/d/1GmEiEt2VDmhY_Ag0PiIcGWKtvQupKgNcMZUvgpfQksk/edit?resourcekey=0-seYa-QJsx1ZbjelluPG1iQ
>
> Change-Id: Ifc6eccd44efdf377320c64cf9957c6060334e543
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186831
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77431}

Change-Id: I4ea8f3c026a0a448afcb16f57517ee75cedaf83f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229379
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77437}
2021-10-18 15:03:00 +00:00
Leszek Swirski
5e9afd645c [tools] Fix gdb frame skip over dummy frames
The gdb DCHECK frame skipping automatically skips over all the abort
etc. frames to get you to that DCHECK callsite you're actually looking
for.

However, this is annoying if you tried to call a function with a
breakpoint from the gdb prompt; the frame skipping wold skip over your
breakpoint back up to the failing DCHECK.

Now, we abort the frame walk on dummy frames inserted by gdb execution.

Change-Id: I2cf89ea9219374ad7c562c6eb13afe471038b033
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229376
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77436}
2021-10-18 14:49:13 +00:00
Igor Sheludko
c0cf4f838d [ext-code-space] Support external code space in serializers
... by updating the checks for not_mapped_symbol root and using proper
cage base values depending on the host object type.

Bug: v8:11880
Change-Id: I28908cbb5b1023addaee248028661d480734e29c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222760
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77435}
2021-10-18 14:48:10 +00:00
Leszek Swirski
761f892898 Revert "[snapshot] Fix two stress_snapshot failures"
This reverts commit dca83ff7e7.

Reason for revert: Speculative revert for https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/38914/overview

Original change's description:
> [snapshot] Fix two stress_snapshot failures
>
> 1. Stress snapshot discards code on SFIs, which breaks flushing
>    invariants. Add --stress-snapshot to those invariants.
> 2. Another test failing on IsScript, added it to the disabled list.
>
> Change-Id: Ic415923a9cc96d34b74f7450b29be99c1b53d077
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229375
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Auto-Submit: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77430}

Change-Id: Ied1bd9e10389f361cd6e39a1c985ee134f098629
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229561
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77434}
2021-10-18 14:01:13 +00:00
Leszek Swirski
8844cfd925 Revert "[baseline] Concurrent Sparkplug n-thread with synchronised queue"
This reverts commit 0c459ff52b.

Reason for revert: breaks build on M1 (where W^X flag is RO) https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release%20builder/6999/overview

Original change's description:
> [baseline] Concurrent Sparkplug n-thread with synchronised queue
>
> Installation in the main thread.
> Design doc: https://docs.google.com/document/d/1GmEiEt2VDmhY_Ag0PiIcGWKtvQupKgNcMZUvgpfQksk/edit?resourcekey=0-seYa-QJsx1ZbjelluPG1iQ
>
> Change-Id: Ifc6eccd44efdf377320c64cf9957c6060334e543
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186831
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77431}

Change-Id: I45a952aacf0ad29ebb703a742fdc6da7b0b7c826
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229378
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77433}
2021-10-18 13:45:44 +00:00
Michael Lippautz
e8c97924d0 cppgc: Adjust assert ensuring Oilpan generally satisfies alignof(std::max_align_t)
GCC on x86 wants alignof(std::max_align_t) == 16 which is not
supported by Oilpan. Stricter checks in
MakeGarbageCollectedTraitBase::Allocate() cover problems per type.

Bug: v8:12295
Change-Id: Icdd6517a2828280ed19279ca45004e26c99505a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229372
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77432}
2021-10-18 13:21:04 +00:00
Victor Gomes
0c459ff52b [baseline] Concurrent Sparkplug n-thread with synchronised queue
Installation in the main thread.
Design doc: https://docs.google.com/document/d/1GmEiEt2VDmhY_Ag0PiIcGWKtvQupKgNcMZUvgpfQksk/edit?resourcekey=0-seYa-QJsx1ZbjelluPG1iQ

Change-Id: Ifc6eccd44efdf377320c64cf9957c6060334e543
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186831
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77431}
2021-10-18 13:20:01 +00:00
Leszek Swirski
dca83ff7e7 [snapshot] Fix two stress_snapshot failures
1. Stress snapshot discards code on SFIs, which breaks flushing
   invariants. Add --stress-snapshot to those invariants.
2. Another test failing on IsScript, added it to the disabled list.

Change-Id: Ic415923a9cc96d34b74f7450b29be99c1b53d077
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3229375
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77430}
2021-10-18 13:18:59 +00:00
Joyee Cheung
50031da2bc [class] Use Runtime::DefineClassField() in KeyedStoreIC
It was missing on the slow path before.

Bug: chromium:1259902, chromium:1260746, v8:10793
Change-Id: I9ae5f9efd552754a725f624307dd7caaeacd496f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226541
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#77429}
2021-10-18 12:03:38 +00:00
Manos Koukoutos
bce4410837 [wasm][turbofan] Improve inlining heuristics
This CL improves wasm inlining heuristics in Turbofan, for an average
8,5% performance improvement in selected benchmarks.

Changes:
- In WasmInliner::Reduce(), only collect inlining candidates into a
  priority queue, according to WasmInliner::LexicographicOrdering.
  Move actual inlining to Finalize().
- Remove the InlineFirstFew heuristic. Add two limits to inlining:
  Maximum relative size increase (reversely proportional to the function
  size), and absolute size increase.
- Pass information about call frequency from liftoff-collected feedback
  to the WasmInliner though the wasm module.
- Run wasm inlining along other optimizations in the pipeline.
- Split inlining and speculative inlining tests.

Bug: v8:7748, v8:12166
Change-Id: Iccee22093db765981889a24451fb458dfce1f1a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222764
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77428}
2021-10-18 10:54:28 +00:00
Marja Hölttä
e4dba97006 [super ic] Fix receiver vs lookup start object confusion related to module exports
Bug: chromium:1260577
Change-Id: I8944f2f1dda22ab9a24e389a686c707deb5f18c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3225936
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77427}
2021-10-18 10:13:19 +00:00
Michael Lippautz
63dc736d6b unittests: Move conditional include out of wasm section
Change-Id: I2150c83eeb8939801aeed7e7bb0aec92f8f91733
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3227756
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77426}
2021-10-18 09:39:18 +00:00
Nico Hartmann
e784bf6180 Revert "[heap] Attach to shared isolate after setting up main thread"
This reverts commit 929b83fb7b.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/18725/overview

Original change's description:
> [heap] Attach to shared isolate after setting up main thread
>
> Attach to the shared isolate after the main thread was set up. Otherwise
> it could happen that a shared GC initiated from another isolate might
> see no threads are running and performs the safepoint operation in the
> middle of isolate deserialization.
>
> We use DisallowSafepoints to check that the isolate doesn't join a
> global safepoint before deserialization is complete. DisallowSafepoints
> used to prevent only invocations of Safepoint() but was updated to
> also prevent Park() and Unpark() invocations. Each state change could
> cause the thread to reach a safepoint, which would allow a shared GC
> to run.
>
> We now also DCHECK that every isolate has at least one local heap and
> that shared collections aren't started before deserialization is
> complete.
>
> Bug: v8:11708
> Change-Id: Iba3fb59dd951d5ee4fc9934158062287302fc279
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3221157
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77424}

Bug: v8:11708
Change-Id: I0633150b6b40b297a335a39bf1a087ca93592e04
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3225937
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77425}
2021-10-18 08:48:59 +00:00
Dominik Inführ
929b83fb7b [heap] Attach to shared isolate after setting up main thread
Attach to the shared isolate after the main thread was set up. Otherwise
it could happen that a shared GC initiated from another isolate might
see no threads are running and performs the safepoint operation in the
middle of isolate deserialization.

We use DisallowSafepoints to check that the isolate doesn't join a
global safepoint before deserialization is complete. DisallowSafepoints
used to prevent only invocations of Safepoint() but was updated to
also prevent Park() and Unpark() invocations. Each state change could
cause the thread to reach a safepoint, which would allow a shared GC
to run.

We now also DCHECK that every isolate has at least one local heap and
that shared collections aren't started before deserialization is
complete.

Bug: v8:11708
Change-Id: Iba3fb59dd951d5ee4fc9934158062287302fc279
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3221157
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77424}
2021-10-18 07:57:30 +00:00
Benedikt Meurer
42d3ff64c2 Add jarin@ to inspector and debug OWNERS.
Bug: none
Change-Id: If62875a1f907ac33b6c6e6a894099a83bba71783
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3225935
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77423}
2021-10-18 07:27:48 +00:00
Marja Hölttä
dbf3ab5f20 [rab/gsab] Add RAB / GSAB support to various TA.prototype functions
Functions affected:
filter
find
findIndex
findLast
findLastIndex
forEach
reduce
reduceRight

Bug: v8:11111
Change-Id: Ifb40143e5b6ed4a3eb30cb25332e2387009e3274
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3205421
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77422}
2021-10-18 07:15:41 +00:00
v8-ci-autoroll-builder
5c1adef743 Update google_benchmark
Rolling v8/third_party/google_benchmark/src: 0baacde..59bbc7f

cmake: eliminate redundant `target_include_directories` (#1242) (Sergiu Deitsch)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/59bbc7f

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Ibab54099357ee194a92c0c076b3053868ea5e4cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3228788
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77421}
2021-10-18 05:49:49 +00:00
Ng Zhi An
55c1d2c52a [trap-handler] Fix -Wshadow warnings
Bug: v8:12244,v8:12245
Change-Id: I6a449ec60a75d55715f04b9a57988c8a7caf038c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3227267
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77420}
2021-10-15 23:09:46 +00:00
Milad Fa
5ee194a1a3 Use V8_VIRTUAL_MEMORY_CAGE_IS_AVAILABLE under vm-cage
Bug: chromium:1218005
Change-Id: I1c9aae03e460155002dfa2483c37cec4f50ec566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226782
Reviewed-by: Samuel Groß <saelo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77419}
2021-10-15 16:09:58 +00:00
Patrick Thier
a1427aad7c Assert that we never copy properties from an object itself
When copying properties, it should never happen that source == target.
Add a CHECK to assert this assumption.

Bug: chromium:1260129
Change-Id: Ia5248e4363d85e13052db726fb7143897cea9c87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226779
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77418}
2021-10-15 15:47:21 +00:00
Manos Koukoutos
14dc357259 [wasm-gc] Add option to skip array bounds checks
Bug: v8:7748
Change-Id: Id09544a9f55843d2474b6114da9d42e1ec994cff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226322
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77417}
2021-10-15 15:10:58 +00:00
Camillo Bruni
2f0447be7e [ic] Use the Map for hashing in the secondary stub cache
Avoid repeated collisions when the name doesn't hold much entropy.
This is typically the case with minified sources where 1 or 2 letter
names are used very frequently.

Bug: v8:12316
Change-Id: I20df3a6b0c5daf7975668d25404eca94a1230fe0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222759
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77416}
2021-10-15 14:54:28 +00:00
Leszek Swirski
6025b260fa Revert "[torque] Don't generate k(?:Start|End)Of\w+FieldsOffset constants"
This reverts commit 7366f6e204.

Reason for revert: Speculative revert for cctest/test-debug-helper/GetObjectProperties failures
https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8833300564873660401/+/u/Check/GetObjectProperties

Original change's description:
> [torque] Don't generate k(?:Start|End)Of\w+FieldsOffset constants
>
> Torque currently generates constants like kStartOfWeakFieldsOffset and
> kEndOfStrongFieldsOffset, which can be used when writing custom
> BodyDescriptors. However, these offsets have some potentially confusing
> behaviors:
>
> * They don't take inheritance into account and describe only the fields
>   defined by the current class itself, so there might be (for example)
>   strong fields before kStartOfStrongFieldsOffset if they were defined
>   by a superclass.
> * kStartOfWeakFieldsOffset points to the first field defined in Torque
>   using the keyword `weak`, which indicates fields with *custom*
>   weakness semantics (those that should be visited with
>   IterateCustomWeakPointers), not those that may contain standard weak
>   pointers (visited with IterateMaybeWeakPointers). (As a follow-up, I'd
>   like to also rename `weak` to `@customWeak`.)
>
> Given that these constants have very low usage and somewhat bizarre
> semantics, I propose that we remove them. This change does so, and
> updates the existing usages to either define the required constants
> directly in C++ or not use them. I know that defining these constants in
> C++ is more brittle, but I think that brittle and clear is better than
> automatic and incomprehensible.
>
> Bug: v8:7793
> Change-Id: I87f8c85ccae4027f61ac73d4e7e4e2820e92003b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3199731
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/main@{#77411}

Bug: v8:7793
Change-Id: Ia12b5d773db35739283ca8871d3dd6922413cc82
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226783
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77415}
2021-10-15 14:26:17 +00:00
Manos Koukoutos
5f6c9fc57b [wasm-gc][liftoff] GetUnusedRegister before fetching stack slots
GetUnusedRegister may spill registers and thus modify stack slots.
Therefore, we have to call it before fetching stack slots.
This is another instance of
https://chromium-review.googlesource.com/c/v8/v8/+/3217199.

Bug: v8:7748
Change-Id: I9ff28b26f2dce93ef7b71c1100d9bf88f7c2f7c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226327
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77414}
2021-10-15 14:09:50 +00:00
Milad Fa
e8c3a329f3 S390: modify the TB opcode name
https://crrev.com/c/3222763 has added a new global value `TB`
which is the same as our `test block` opcode. Cl is adding an
underscore to resolve the naming issue.

Change-Id: I4744f14dd594d4a58ed14d7651a6b7a0cad62ba8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226801
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77413}
2021-10-15 13:59:58 +00:00
Clemens Backes
91111a402f [wasm] Add trace events for wrapper compilation
This adds a few more trace events, also tracing the number of wrappers.
This can help to understand instantiation time better.

R=ahaas@chromium.org

Bug: v8:12287
Change-Id: Ic1a03b2e278af64908f0dc45cd5db60ecf7c79f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226323
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77412}
2021-10-15 13:40:38 +00:00
Seth Brenith
7366f6e204 [torque] Don't generate k(?:Start|End)Of\w+FieldsOffset constants
Torque currently generates constants like kStartOfWeakFieldsOffset and
kEndOfStrongFieldsOffset, which can be used when writing custom
BodyDescriptors. However, these offsets have some potentially confusing
behaviors:

* They don't take inheritance into account and describe only the fields
  defined by the current class itself, so there might be (for example)
  strong fields before kStartOfStrongFieldsOffset if they were defined
  by a superclass.
* kStartOfWeakFieldsOffset points to the first field defined in Torque
  using the keyword `weak`, which indicates fields with *custom*
  weakness semantics (those that should be visited with
  IterateCustomWeakPointers), not those that may contain standard weak
  pointers (visited with IterateMaybeWeakPointers). (As a follow-up, I'd
  like to also rename `weak` to `@customWeak`.)

Given that these constants have very low usage and somewhat bizarre
semantics, I propose that we remove them. This change does so, and
updates the existing usages to either define the required constants
directly in C++ or not use them. I know that defining these constants in
C++ is more brittle, but I think that brittle and clear is better than
automatic and incomprehensible.

Bug: v8:7793
Change-Id: I87f8c85ccae4027f61ac73d4e7e4e2820e92003b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3199731
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#77411}
2021-10-15 13:15:48 +00:00
Clemens Backes
320084656e [wasm] Trace NativeModuleCache accesses and hits
This makes it easier to see if a module is taken from the cache.

R=thibaudm@chromium.org

Bug: v8:12287
Change-Id: I6b7acf15f1aa20f6531d746d37890608462606de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226326
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77410}
2021-10-15 12:37:38 +00:00
Benedikt Meurer
cb08942d2d [inspector] Properly catch side effecting iterators.
Array spread syntax `[...obj]` is compiled to a special bytecode that
tries to take fast-paths for values special kinds of `obj`s, including
Set, Map, and Array iterator instances. But these fast-paths skip the
side-effect checks of `Runtime.evaluate` and friends, and thus lead to
surprises for developers.

This CL alters the behavior to always call the `next()` builtins when
the debugger is active to make sure we catch the side effects correctly.

Fixed: chromium:1255896
Change-Id: If3fc48a119cfa791c4fde7b5c586acc22dd973e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3226329
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77409}
2021-10-15 12:29:09 +00:00
Michael Lippautz
1a47c1e9be cppgc: Cleanup around FreeList:Add
Bug: v8:12295
Change-Id: Ibf18c936215e892edd5009dc59560988453e1203
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3218063
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77408}
2021-10-15 08:11:03 +00:00
Lu Yahan
5ff309ded4 [riscv64] Argument Count Consistency
Port 255aaed95b
Port 6bd44dfe57

Change-Id: I9d57cf7782c267bda4532d0408e69b671e6001f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220271
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77407}
2021-10-15 01:56:13 +00:00
Frank Tang
40d6e7de85 [test262] Roll test262
61339fd2..8d420cef4

Bug: v8:7834
Change-Id: I03213a87597bf9dcd810bcc55f7bc9f352342b3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222879
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77406}
2021-10-14 22:31:33 +00:00
Shu-yu Guo
ebddaedee6 Skip non-compilation functions in %OptimizeOsr
Bug: chromium:1258603
Change-Id: Ife2284de6151c7e70592b55871875061b93bbcca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3218193
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77405}
2021-10-14 22:15:23 +00:00
Bruce Dawson
62bd6a628a Test that heap-inl.h doesn't include windows.h
In order to avoid namespace pollution and compilation overhead it is
desirable to avoid include windows.h, and this enforces that.

Bug: chromium:796644
Change-Id: I7fdcd3c182a77cee03672bc4324b9e21566896d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3223960
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Bruce Dawson <brucedawson@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77404}
2021-10-14 21:18:51 +00:00
Samuel Groß
1d661ec3ed Mark the Virtual Memory Cage as compatible with LSAN
There is no need to wrap the cage's page allocator into a
LsanPageAllocator as that page allocator ultimately relies on the
platform page allocator to obtain pages. As the platform page allocator
will be a LsanPageAllocator when LSAN is enabled, it will already take
care of marking the pages as root regions with LSAN.

luci.v8.try:v8_linux64_heap_sandbox_dbg_ng

Bug: chromium:1218005
Change-Id: I62b5da9cb320e5012a657951c0d4c85a1bb2b3fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222761
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77403}
2021-10-14 17:53:28 +00:00
Samuel Groß
72cd8c1aba Add special handling for Windows in DetermineAddressSpaceLimit
On Windows pre 8.1, userspace is limited to 8TB of virtual address
space. Take that into account when determining the size and/or placement
of the virtual memory cage.

Bug: chromium:1218005
Change-Id: Idda94534cad67dc2db77e9ba459e3a4b239dac2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222763
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77402}
2021-10-14 17:48:38 +00:00
Ng Zhi An
ee3b4eadab [wasm-relaxed-simd][x64] Prototype relaxed lane selects
4 instructions, i8x16, i16x8, i32x4, i64x2 relaxed lane select. These
instructions only guarantee results when the entire lane is set or
unset, so vpblendvb will give correct results for all of them.

Bug: v8:12284
Change-Id: I76959a23f2d97de8ecc3bef43d138184484e3c4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3207006
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77401}
2021-10-14 17:22:58 +00:00
Thibaud Michaud
33634d76ec [wasm] Add initial stack switching data structures
Add initial stack memory, jump buffer and continuation objects.

R=ahaas@chromium.org
CC=fgm@chromium.org

Bug: v8:12191
Change-Id: I0c6bde4e5f15e9c539e5e8af1a3b84e5cb5bc9a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220342
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77400}
2021-10-14 15:26:47 +00:00
Jakob Kummerow
c0a8a36c6c [wasm] New flags for tracing compilation times
--trace-wasm-compilation-times: print one line per compiled function
      with basic performance information. Useful for narrowing down
      functions of interest before investigating them in more depth.
--wasm-tier-up-filter=N: only tier up function #N. Useful for focusing
      features like --turbo-stats-wasm on a particular function.

Change-Id: Iaddb29bf815f4de8381a08e29187e96cc9945779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086341
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77399}
2021-10-14 13:47:28 +00:00
Samuel Groß
6e707c95a5 Respect page allocator hints on Fuchsia
The virtual memory cage supports a fallback mode that attempts to obtain
memory pages within a specific virtual address range by using
PageAllocator hints. However, Prior to this CL, the default
PageAllocator on Fuchsia would ignore hints alltogether, preventing
these mechanisms from working there.

Ultimately, on Fuchsia it would probably be better to manage the virtual
memory cage purely through VMARs instead of actually creating pseudo
mappings just to reserve virtual address space as is currently done
through the PageAllocator. This will require broader changes though, so
in the meantime, sticking to the current PageAllocator API is probably
the best option.

Bug: chromium:1218005
Change-Id: I821cfbb815d81479c3b3310296302addbb9cd8f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220340
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77398}
2021-10-14 13:40:47 +00:00
Jakob Kummerow
6e36e3ec85 [wasm-gc] Support immutable arrays
Since we introduced `array.init` as a way to create fully initialized
arrays, immutable arrays are no longer useless, and they enable certain
static optimizations, so this patch allows them.

Bug: v8:7748
Change-Id: I404aab60099826f4bd83cf54e5e1acbc38a3ca9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3221151
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77397}
2021-10-14 12:48:27 +00:00
Samuel Groß
7efcab88db Make PageAllocator::DecommitPages mandatory
Besides the virtual memory cage, the DecommitPages API is also now
required for Cppgc with crrev/c/3211583.

A working implementation of this API is availabe in src/base/platform
for all supported platforms and is used by the DefaultPlatform.

Bug: chromium:1218005
Change-Id: I29765993ed54bb52de71998ae8c6295637ee4072
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3211584
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77396}
2021-10-14 12:30:59 +00:00
Lu Yahan
783e1fde50 [riscv64] Create Instance Type for Class Constructors
Port: 1cd7a58223

Original Commit Message:

Class Constructors are special, because they are callable but [[Call]]
raises an exception. Instead of checking if a JS function is a class
constructor for every JS function call, this CL adds a new instance
type for class constructors.
This way we can use a fast instance type range check for the common
case, and only check for class constructors in the uncommon case were
a class constructor is called and when we need to raise an exception.

Change-Id: I8f11416124a1eefc4ba63423747686bc0b519bb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3218711
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77395}
2021-10-14 12:16:46 +00:00
Igor Sheludko
3239227951 [ext-code-space] Split UNIQUE_INSTANCE_TYPE_MAP_LIST_GENERATOR macro
... into UNIQUE_LEAF_INSTANCE_TYPE_MAP_LIST_GENERATOR and the rest
where the former list contains only those maps which have 1:1 relation
to instance type values.

Bug: v8:11880
Change-Id: Ibe20ec7a7c432680dcf23a5c0102ae89c0689d47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3218065
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77394}
2021-10-14 10:07:48 +00:00
Samuel Groß
571eca5ced Implement DetermineAddressSpaceLimit() on x64
This function tries to determine the number of virtual address bits
available on the current CPU and with that the maximum size of the
userspace address space. On x64, it can be implemented through CPUID.

The result of this function is now used in two ways: first, it limits
the maximum size of the virtual memory cage, currently to a quarter of
the address space. Second, it influences the placement of fake cages,
which are attempted to be placed into the lower half of the address
space so that they are followed by large amounts of (hopefully) unused
but addressable virtual memory in which pages can be allocated.

Bug: chromium:1218005
Change-Id: I0edc5d241d899f16dbc47492fa1534b6aaa4aa13
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220348
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77393}
2021-10-14 10:01:57 +00:00
Samuel Groß
af1d043c21 Add V8::IsUsingSecureVirtualMemoryCage API
V8 can fall back to creating a virtual memory cage that does not have
the desired security properties but at least allows V8 to run when
caging is enabled. This API allows the embedder to determine which kind
of cage is being used, for example for metrics collection.

Bug: chromium:1218005
Change-Id: I6988d0a4fce8aeb1361b30fce8c9c2f68f3b92f9
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220343
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77392}
2021-10-14 09:47:49 +00:00