Commit Graph

62113 Commits

Author SHA1 Message Date
Leszek Swirski
908f08e43f [ast] Remove literal allocation from CallPrinter
Access literal data directly in CallPrinter, rather than allocating
their values. This allows us to remove the isolate member from
CallPrinter entirely.

Change-Id: Ib4203009c86b6778ee843e8956fc7cee2214841e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122019
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67471}
2020-04-29 11:18:51 +00:00
Yang Guo
d4cb48c1a8 [debugger] clarify purpose of test case
The original motivation of the test case is long outdated, and it
has been repurposed. Making some cosmetic changes to clarify.

R=szuend@chromium.org

Fixed: v8:10455
Change-Id: I02c2e6f83d3475478efd37dbe834fca5d415b829
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172419
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67470}
2020-04-29 10:42:21 +00:00
Zhao Jiazhong
a01e821a3a [mips][wasm-simd][liftoff] Implement gt
Port 22242cb18b
https://crrev.com/c/2169026

Change-Id: I76f8639d4d939924db13e69eb366ac064eef447c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172364
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67469}
2020-04-29 10:03:05 +00:00
Mythri A
2aa6751ef2 [turboprop] Use feedback only for calls to builtins
To reduce the number of deoptimizations in TurboProp use call feedback
only when we know the call target is a builtin. Given that we don't
inline in TurboProp, call feedback isn't really useful and using Generic
lowering doesn't impact performance much. TurboProp still inlines
builtins, so it is important to use this feedback for generating better
optimized code.

BUG: v8:10431
Change-Id: I24d51e43728f9aea3099767deb7800119fea40e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2116033
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67468}
2020-04-29 09:27:31 +00:00
Marja Hölttä
218fc55708 [torque] Remove unnecessary arguments length checks
arguments[i] already returns undefined if arguments is not large
enough.

BUG=v8:10468

Change-Id: I0755014d0f1b61d5e3e2069ef4d14a9b51f2ebee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170092
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67467}
2020-04-29 08:49:41 +00:00
Georg Neis
a596efccd1 [turbofan] Refine a DCHECK
Hole checks are done using a lower level comparison.

Change-Id: I61c5b787f12564ad3553d395a36938a00f5dd554
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172418
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67466}
2020-04-29 08:38:01 +00:00
Zhao Jiazhong
7a1d712763 [mips][wasm-simd][liftoff] Implement some simd ops in liftoff on mips64
We don't have mips32 CPU or 32-bits OS, so we are not going to implement
these functions on mips32.

Change-Id: Ie37e5cea360526a82bbbc52ec3933d74c32fea6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167741
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67465}
2020-04-29 08:04:11 +00:00
Tobias Tebbi
9e9cd5dfa0 Reland "Reland "[turbofan][csa] optimize Smi untagging better""
This is a reland of 43b885a842
This fixes another signed overflow in the unit test.

Original change's description:
> Reland "[turbofan][csa] optimize Smi untagging better"
>
> This is a reland of ff22ae80e2
>
> Original change's description:
> > [turbofan][csa] optimize Smi untagging better
> >
> > - Introduce new operator variants for signed right-shifts with the
> >   additional information that they always shift out zeros.
> > - Use these new operators for Smi untagging.
> > - Merge left-shifts with a preceding Smi-untagging shift.
> > - Optimize comparisons of Smi-untagging shifts to operate on the
> >   unshifted word.
> > - Optimize 64bit comparisons of values expanded from 32bit to use
> >   a 32bit comparison instead.
> > - Change CodeStubAssembler::UntagSmi to first sign-extend and then
> >   right-shift to enable better address computations for Smi indices.
> >
> > Bug: v8:9962
> > Change-Id: If91300f365e8f01457aebf0bd43bdf88b305c460
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135734
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#67378}
>
> Bug: v8:9962
> Change-Id: Ieab0755806c95fb50022eb17596fb0c95f36004c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170001
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67430}

Bug: v8:9962
TBR: neis@chromium.org
Change-Id: I79883db546bf37873b3727b8023ef688507091d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169103
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67464}
2020-04-29 07:30:11 +00:00
Dan Elphick
9e1df3daac Add third_party/jsoncpp/source to .gitignore
Follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/1947688,
which unhid the third_party/jsoncpp directory, but the source subdir is
still synced via gclient so needs hiding.

Change-Id: Ica6f7e63e92dd9fa5a460e844a7d273f2ebe109c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169102
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67463}
2020-04-29 07:20:41 +00:00
Jakob Gruber
10842cad3c Reland "[regexp] Limit the size of inlined choice nodes"
This is a reland of 6a0e7224f3

Original change's description:
> [regexp] Limit the size of inlined choice nodes
>
> Codegen for unicode property escapes (e.g.: /\p{L}/u) can produce huge
> code objects. This effect can be further magnified through inlining,
> leading to exponential code growth in the size of the pattern.
>
> This CL is a (fairly hacky) way to avoid exponential growth. We
> recognize choice nodes with 'many' choices and disable inlining for
> them. In the future we should fix this properly, either by using the
> code size budget correctly, or by improving codegen for property
> escapes.
>
> Bug: v8:10441
> Change-Id: I817f145251ec8b1b9906cc735c9e9bdb004c98ed
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170229
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67433}

Tbr: yangguo@chromium.org
Bug: v8:10441
Change-Id: I9a16cc9e8248cb46d3d16a4e2d250968cc1b7b39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172679
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67462}
2020-04-29 07:18:11 +00:00
jing.bao
22242cb18b [wasm-simd][liftoff] Implement gt on x64 and ia32
Bug: v8:9909
Change-Id: Ic75c75fa3693a59bf059cf852172900ad95a1941
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169026
Commit-Queue: Jing Bao <jing.bao@intel.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67461}
2020-04-29 06:02:51 +00:00
Zhou, Zhiguo
e19d4b5393 [wasm-simd][liftoff] Implement le of i8x16, i16x8 and i32x4 on x64 and ia32
Bug: v8:9909
Change-Id: Id16bc151fd76febabb05987eebf2f2e1ae357b2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169025
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com>
Cr-Commit-Position: refs/heads/master@{#67460}
2020-04-29 01:19:30 +00:00
Omer Katz
a856444ca9 cppgc: Duplicate worklist
The worklist in this CL is a merge of the worklists of Oilpan and V8. This implementation supports both use cases and should serve as the shared worklist once we start merging the codebase.

Bug: chromium:1056170
Change-Id: I4ecdb475f3900c33eced9249efa112a69c1b2707
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170828
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67459}
2020-04-29 00:28:00 +00:00
Anton Bikineev
f2ece54b3e cppgc: Introduce HeapVisitor
HeapVisitor is a simple visitor implementing both visitation and accept
interfaces. HeapVisitor is aimed to replace functions that traverse the
heap in Blink: PrepareForSweep, Sweep, FinalizeSweep, MakeConsistentForGC,
ObjectPayloadSize, VerifyObjectStartBitmap, CollectStatistics, etc.

This CL also introduces a Heap::ObjectPayloadSize function.

Bug: chromium:1056170
Change-Id: I85a2b8b572486bea29704fc436b002d8f7405201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2165733
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67458}
2020-04-29 00:07:20 +00:00
Ng Zhi An
ec5149ef1e [wasm-simd][fuzzer] Add f64x2 and f32x4 comparison to fuzzer
Bug: v8:10180
Change-Id: I58df9f445a67c35b352f5a3058fd8e40d04a3eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168548
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67457}
2020-04-28 23:39:30 +00:00
Dan Elphick
d398af189f [heap] Split out LargeObject* from spaces.h
Creates a new large-spaces.h and large-spaces.cc to contain
LargeObjectSpace and subclasses.

Bug: v8:10473
Change-Id: Ifdb4eac9df5c8213f992d549e04b612b62f6df0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170826
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67456}
2020-04-28 21:19:45 +00:00
Junliang Yan
a3fbabc726 PPC: rename kPointerSize to kSystemPointerSize etc
Prepare for pointer compression changes

Change-Id: I8ec56ac65194f1f89f2803af155d5bec520a569f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2171036
Auto-Submit: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67455}
2020-04-28 18:17:36 +00:00
Shu-yu Guo
abfdb819ce [builtins] Fix optional arguments for %TypedArray%.from
Since ES6, optional arguments are treated the same as undefined. This
was recently cleaned up in https://github.com/tc39/ecma262/pull/1411.
The current Torque implementation of %TypedArray%.from incorrectly
interpreted the old (and confusing) language of a parameter being "not
present" as testing using arguments.length instead of testing directly
for undefined.

Bug: v8:10458
Change-Id: I055f1fa3be570a31a4f7369ba5b51b7d6b022f0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168674
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67454}
2020-04-28 16:32:25 +00:00
Leszek Swirski
910d2d792c [heap] Verify filler slots don't need clearing
When creating a filler, we pass through whether we need to clear slots
in the old to new remembered set.

This patch adds a verification check that, when we claim we don't need
to clear slots, checks that no slots are set in the remembered set for
the range of the filler. Effectively, this is a range counterpart to
VerifyClearedSlot.

Change-Id: Id994c56d941988cc282463304bc7307a51943e99
Bug: chromium:1075999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139572
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67453}
2020-04-28 16:24:45 +00:00
Ng Zhi An
4f6ac04d1f [wasm-simd][liftoff] Implement i32x4 i16x8 i8x16 ge
Bug: v8:9909
Change-Id: I7f32769ad85d05e91a39782816f1c2da042454a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169017
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67452}
2020-04-28 16:22:55 +00:00
Nico Hartmann
84cff42c59 [turbofan] Fixes incorrect DataView setters
Having no value argument in DataView setters (e.g. setFloat64) caused
wrong behavior in compiled code.

Bug: chromium:1071190
Change-Id: I37ddba8555dafad321f8d4c1352da8a501a98453
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170091
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67451}
2020-04-28 15:47:55 +00:00
Yang Guo
ed559eae5e [debugger] fix function in suspended generator
R=szuend@chromium.org

Fixed: chromium:1075763
Change-Id: I7f67cfb9c643d8f30bec808ccb2a9e1326ad1921
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170030
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67450}
2020-04-28 15:42:43 +00:00
Clemens Backes
9d1b87efd6 [wasm][debug] Remove interpreter redirection information
We don't redirect to the interpreter for debugging any more, hence we
can remove methods and data structures for storing and accessing
information about functions redirected to the interpreter.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: I31ce1ef09748eb65d62910269548bc66eb02e01c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2164795
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67449}
2020-04-28 15:31:12 +00:00
Dan Elphick
9827c7168b [heap] Move base::List to heap::List
base::List is only used inside of heap and has some pretty strange
semantics that don't lend themselves to it being a general purpose data
structure so this moves it to heap where it can be safe isolated.

Bug: v8:10454
Change-Id: I7921c22286276432956005c72143b22b0364fc93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170029
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67448}
2020-04-28 15:21:02 +00:00
Clemens Backes
b98b462163 [wasm][debug] Remove WasmNumInterpretedCalls runtime function
Redirection to the interpreter is removed from mjsunit tests. Hence the
runtime function will always return 0.
This CL removes the runtime function and the respective method from the
interpreter.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: Ia17bebf3992f42a17a9c1b385ecdc2f2e3061b65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2164794
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67447}
2020-04-28 15:16:42 +00:00
Milad Farazmand
053d732988 PPC/s390: [wasm-simd][liftoff] Implement ge of i8x16, i16x8 and i32x4 on x64 and ia32
Port 97a4b795be
Port f8be9948d3

R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Id72fd94459b13713d25aefbf96fd00c88e352c85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169841
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67446}
2020-04-28 15:12:12 +00:00
Andreas Haas
980037cefe [wasm][liftoff][arm] Avoid double allocation of register is AtomicOp64
In AtomicOp64 ClearRegister is called twice to clear the registers r8
and r9. Thereby new registers may get allocated. We forgot to add the
newly allocated registers to pinned after the first call to
ClearRegister, which caused the same registers to be allocated again in
the second ClearRegister, and thereby caused the bug.

R=clemensb@chromium.org

Change-Id: I0d069aea4c9438fe30c30c22406b4075ddf3e95c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170088
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67445}
2020-04-28 15:08:42 +00:00
Victor Gomes
af09a9b026 [builtins][arm] Reverse JS arguments for arm
Change-Id: Idbb678e3fd8491c3568ddf7084f969368ac527cc
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2139582
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67444}
2020-04-28 15:05:02 +00:00
Victor Gomes
1bcac785de [builtins][ia32] Reverse JS arguments for ia32
Change-Id: Ic5f703f29525ce7680249666454cf146c1f088dd
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2116198
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67443}
2020-04-28 14:56:42 +00:00
Victor Gomes
79855db409 [builtins][x64] Using AllocateStackSpace instead of subtracting RSP
Subtracting RSP to allocate stack space is not safe on Windows, where we could subtract several pages away and the value could not be committed yet in memory yielding a segfault. We use the macro assembler AllocateStackSpace instead.

Change-Id: I69ac9d96c57af57276b480a33c7cefa81fc018a7
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2166169
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67442}
2020-04-28 14:48:22 +00:00
Iain Ireland
6bb3f0c046 [regexp] Handlify RegExpCompileData::code
RegExpMacroAssembler::GetCode returns a Handle<Object>. However, that
Handle is almost immediately dereferenced, and is stored as a bare
Object in both RegExpCompiler::CompilationResult and RegExpCompileData.

This makes SpiderMonkey's rooting hazard analysis somewhat
antsy. While RegExpCompileData is alive on the stack, the hazard
analysis will not allow any calls that might GC, because it isn't
smart enough to prove that the code field can't be clobbered by a GC.

As far as I can tell, there is no real hazard here, but storing a
Handle in RegExpCompileData instead of a bare Object will simplify SM
and prevent a future patch from accidentally breaking something.

Bug: v8:10406
Change-Id: I9642dd05c591bfd23b340a89df2f2bf5c9fcac2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161578
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67441}
2020-04-28 14:23:52 +00:00
Dan Elphick
93cfa4587b [heap] Add SharedReadOnlySpace for shared RO_SPACE
When RO_SPACE is to be shared, this constructs SharedReadOnlySpace
object (via ReadOnlySpace::DetachPagesAndAddToArtifacts) that contains
the shared artifacts and the original ReadOnlySpace is destroyed. This
is mostly a conceptual change and SharedReadOnlySpace behaves
identically to ReadOnlySpace (and subclasses it).

Also adds ReadOnlyArtifacts that contains the shared artifacts and which
is stored as a std::weak_ptr in a global so it can be destroyed when all
std::shared_ptrs to it are destroyed. Since this allows the ReadOnlyHeap
to be reconstructed when all Isolates are destroyed,
ReadOnlyHeap::ClearSharedHeapForTest is removed along with all uses
since that is now done automatically.

The ReadOnlyArtifacts class now owns all the shared artifacts and is
responsible for deleting them on exit (mostly via unique_ptr).

Bug: v8:10454
Change-Id: I2fe7110a4ab9cf8719dd198bafc1d083bee641b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154204
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67440}
2020-04-28 14:18:32 +00:00
Leszek Swirski
32726006f4 [offthread] Set LO space flags on merge
Make sure to set the right page flags on pages merged from off-thread
LO space have the right flags set -- in particular, the marking bit.

Bug: chromium:1011762
Change-Id: I595a3afb5e40d92b8d4c26c7671a43ea8e9e94d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169096
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67439}
2020-04-28 14:03:26 +00:00
Victor Gomes
39f72279a5 [builtins][x64] Simplify Function.prototype.call builtin for x64 when V8_REVERSE_JSARGS.
Change-Id: I4d6ea687d78516d2bac2abc82230e0fe8379d4b9
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2113378
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67438}
2020-04-28 13:45:08 +00:00
Georg Neis
0188a33c78 [turbofan] Fix bug in typed array iteration
... by making sure we deopt when the buffer is detached.

Bug: chromium:1074736
Change-Id: I86e4e63014767766d7c079c3a3e38d947c76ef10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168874
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67437}
2020-04-28 13:36:26 +00:00
Clemens Backes
f8b23009bf Revert "[regexp] Limit the size of inlined choice nodes"
This reverts commit 6a0e7224f3.

Reason for revert: Fails noi18n: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/31513

Original change's description:
> [regexp] Limit the size of inlined choice nodes
> 
> Codegen for unicode property escapes (e.g.: /\p{L}/u) can produce huge
> code objects. This effect can be further magnified through inlining,
> leading to exponential code growth in the size of the pattern.
> 
> This CL is a (fairly hacky) way to avoid exponential growth. We
> recognize choice nodes with 'many' choices and disable inlining for
> them. In the future we should fix this properly, either by using the
> code size budget correctly, or by improving codegen for property
> escapes.
> 
> Bug: v8:10441
> Change-Id: I817f145251ec8b1b9906cc735c9e9bdb004c98ed
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170229
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67433}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I503b8b2be539468d86e4ec1ac13074cd1c06a5cb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10441
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169101
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67436}
2020-04-28 13:35:20 +00:00
Tobias Tebbi
b5ab5c7b75 [torque] allow builtins without context parameter
Bug: v8:10404, v8:7793
Change-Id: I7ed5fc790bd97af0dd3671669779e416101731ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162877
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67435}
2020-04-28 13:20:56 +00:00
Zhao Jiazhong
2ce3a8e973 [mips][wasm-simd][liftoff] Implement ge of i8x16, i16x8 and i32x4 and bitselect
Port 97a4b795be
https://crrev.com/c/2162366

Port f8be9948d3
https://crrev.com/c/2166959

Change-Id: Id0cebfe0761ff75fb95c9ceacf95e53fee12eb73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168978
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67434}
2020-04-28 13:19:46 +00:00
Jakob Gruber
6a0e7224f3 [regexp] Limit the size of inlined choice nodes
Codegen for unicode property escapes (e.g.: /\p{L}/u) can produce huge
code objects. This effect can be further magnified through inlining,
leading to exponential code growth in the size of the pattern.

This CL is a (fairly hacky) way to avoid exponential growth. We
recognize choice nodes with 'many' choices and disable inlining for
them. In the future we should fix this properly, either by using the
code size budget correctly, or by improving codegen for property
escapes.

Bug: v8:10441
Change-Id: I817f145251ec8b1b9906cc735c9e9bdb004c98ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170229
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67433}
2020-04-28 12:55:48 +00:00
Camillo Bruni
817d5c4368 [tools] Support loading raw runtime call stats output in callstat.html
This enables comparing single runs from the direct command line ouptut
generated by --runtime-call-stats

No-Try: true
No-Presubmit: true
Change-Id: Ieac06bbd95c2a73f8064af161fe35f6fb083648f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170093
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67432}
2020-04-28 12:53:49 +00:00
Clemens Backes
bef5b85d31 Revert "Reland "[turbofan][csa] optimize Smi untagging better""
This reverts commit 43b885a842.

Reason for revert: Still fails on UBSan: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/10873

Original change's description:
> Reland "[turbofan][csa] optimize Smi untagging better"
> 
> This is a reland of ff22ae80e2
> 
> Original change's description:
> > [turbofan][csa] optimize Smi untagging better
> > 
> > - Introduce new operator variants for signed right-shifts with the
> >   additional information that they always shift out zeros.
> > - Use these new operators for Smi untagging.
> > - Merge left-shifts with a preceding Smi-untagging shift.
> > - Optimize comparisons of Smi-untagging shifts to operate on the
> >   unshifted word.
> > - Optimize 64bit comparisons of values expanded from 32bit to use
> >   a 32bit comparison instead.
> > - Change CodeStubAssembler::UntagSmi to first sign-extend and then
> >   right-shift to enable better address computations for Smi indices.
> > 
> > Bug: v8:9962
> > Change-Id: If91300f365e8f01457aebf0bd43bdf88b305c460
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135734
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#67378}
> 
> Bug: v8:9962
> Change-Id: Ieab0755806c95fb50022eb17596fb0c95f36004c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170001
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67430}

TBR=neis@chromium.org,tebbi@chromium.org

Change-Id: I49e19811ebcecb846f61291bc0c4a0d8b0bc4cff
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168876
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67431}
2020-04-28 12:48:18 +00:00
Tobias Tebbi
43b885a842 Reland "[turbofan][csa] optimize Smi untagging better"
This is a reland of ff22ae80e2

Original change's description:
> [turbofan][csa] optimize Smi untagging better
> 
> - Introduce new operator variants for signed right-shifts with the
>   additional information that they always shift out zeros.
> - Use these new operators for Smi untagging.
> - Merge left-shifts with a preceding Smi-untagging shift.
> - Optimize comparisons of Smi-untagging shifts to operate on the
>   unshifted word.
> - Optimize 64bit comparisons of values expanded from 32bit to use
>   a 32bit comparison instead.
> - Change CodeStubAssembler::UntagSmi to first sign-extend and then
>   right-shift to enable better address computations for Smi indices.
> 
> Bug: v8:9962
> Change-Id: If91300f365e8f01457aebf0bd43bdf88b305c460
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2135734
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67378}

Bug: v8:9962
Change-Id: Ieab0755806c95fb50022eb17596fb0c95f36004c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170001
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67430}
2020-04-28 12:00:41 +00:00
Jakob Gruber
f8615f67be [runtime] More permissive %NeverOptimizeFunction for fuzzing
SFI::DisableOptimization can only be called on certain function kinds.
Update %NeverOptimizeFunction to crash/do nothing if these conditions
are not fulfilled in normal/fuzzing configurations.

Bug: chromium:1074689
Change-Id: I371dd539e27447ede48c69d0480a3d224071b304
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169926
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67429}
2020-04-28 11:23:21 +00:00
Dominik Inführ
f6960c0a6b [heap] Move semantics for LocalAllocationBuffer
Implement move semantics for the LocalAllocationBuffer as noted in
the comments. Also moved Close() invocation out of the assignment
operator and renamed it to CloseWithFiller().

Bug: v8:10315
Change-Id: Idc36fb7923e1f8857c05ec5d5110fa16087b07e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170087
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67428}
2020-04-28 11:19:51 +00:00
Clemens Backes
1fb1db1792 [wasm][debug] Remove redirection to interpreter
This removes the {RedirectToWasmInterpreter} runtime function and the
respective method from {WasmDebugInfo}.
Some tests test specifically the interaction between compiled code and
the interpreter. They are irrelevant now and are deleted.

R=thibaudm@chromium.org

Bug: v8:10389
Change-Id: I38330fcb523f7c65968fdf03abc60af3392bdcc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2164793
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67427}
2020-04-28 10:50:21 +00:00
Jakob Gruber
bce121c7c5 Reland "[snapshot] Expose the serializer through %SerializeDeserializeNow"
This is a reland of ad5b005e38

Original change's description:
> [snapshot] Expose the serializer through %SerializeDeserializeNow
>
> ... in order to exercise the snapshot/ component from mjsunit tests
> and fuzzers.
>
> * Since the serializer and deserializer can now be called at any time
> instead of only in a tightly controlled environment, several
> assumptions (such as an empty execution stack, no microtasks, no
> handles) no longer hold and had to be made configurable through
> SerializerFlags.
>
> * Root iteration now skips more root categories which were previously
> guaranteed to be empty (e.g. the stack, microtask queue, handles).
>
> * The %SerializeDeserializeNow runtime function triggers
> serialization, deserialization, and heap verification on the current
> isolate and native context.
>
> Support is not yet complete and will be extended in future work. Once
> all mjsunit tests successfully run, we can add a new test mode to
> stress serialization.
>
> Bug: v8:10416
> Change-Id: Ie7ff441a761257dd7f256d0a33e73227850074ac
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159495
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67423}

Tbr: delphick@chromium.org,ulan@chromium.org
Bug: v8:10416
Change-Id: Ibed04c0f0b72fabcf811d8b18a1479391a11568b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170090
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67426}
2020-04-28 10:41:41 +00:00
Anton Bikineev
22f80fc176 cppgc: Introduce heap object structure classes
This adds the following:
1) Heap object structure classes: RawHeap, BaseArena and BasePage.
   - freelist
   - linear allocation block
2) ObjectAllocator, a class responsible for object (and page) allocation.

The design doc with UML design: https://bit.ly/2VVTcqc

User defined arenas are followup.

Bug: chromium:1056170
Change-Id: I69a82974bd08e3cf3da90041b1628297cc890891
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167392
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67425}
2020-04-28 10:21:11 +00:00
Nico Hartmann
451854faa3 Revert "[snapshot] Expose the serializer through %SerializeDeserializeNow"
This reverts commit ad5b005e38.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20shared/36070?

Original change's description:
> [snapshot] Expose the serializer through %SerializeDeserializeNow
> 
> ... in order to exercise the snapshot/ component from mjsunit tests
> and fuzzers.
> 
> * Since the serializer and deserializer can now be called at any time
> instead of only in a tightly controlled environment, several
> assumptions (such as an empty execution stack, no microtasks, no
> handles) no longer hold and had to be made configurable through
> SerializerFlags.
> 
> * Root iteration now skips more root categories which were previously
> guaranteed to be empty (e.g. the stack, microtask queue, handles).
> 
> * The %SerializeDeserializeNow runtime function triggers
> serialization, deserialization, and heap verification on the current
> isolate and native context.
> 
> Support is not yet complete and will be extended in future work. Once
> all mjsunit tests successfully run, we can add a new test mode to
> stress serialization.
> 
> Bug: v8:10416
> Change-Id: Ie7ff441a761257dd7f256d0a33e73227850074ac
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159495
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67423}

TBR=ulan@chromium.org,jgruber@chromium.org,delphick@chromium.org

Change-Id: Ie30b94c9ec6e4463bed6cc87dd6525f469fdf84a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10416
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170089
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67424}
2020-04-28 09:45:55 +00:00
Jakob Gruber
ad5b005e38 [snapshot] Expose the serializer through %SerializeDeserializeNow
... in order to exercise the snapshot/ component from mjsunit tests
and fuzzers.

* Since the serializer and deserializer can now be called at any time
instead of only in a tightly controlled environment, several
assumptions (such as an empty execution stack, no microtasks, no
handles) no longer hold and had to be made configurable through
SerializerFlags.

* Root iteration now skips more root categories which were previously
guaranteed to be empty (e.g. the stack, microtask queue, handles).

* The %SerializeDeserializeNow runtime function triggers
serialization, deserialization, and heap verification on the current
isolate and native context.

Support is not yet complete and will be extended in future work. Once
all mjsunit tests successfully run, we can add a new test mode to
stress serialization.

Bug: v8:10416
Change-Id: Ie7ff441a761257dd7f256d0a33e73227850074ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159495
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67423}
2020-04-28 09:36:23 +00:00
Ulan Degenbaev
3a50c708b9 [heap] Do not schedule follow-up GCs on memory pressure signal
Upon receiving a memory pressure signal V8 performs one GC and also
schedules three follow-up GCs. This may be problematic for performance
if the memory pressure signals are generated periodically.

This patch makes V8's memory pressure handler more lightweight by doing
only one GC.

Bug: chromium:1072746
Change-Id: I242534bd2c27a68188bb5e3a6b4092118c1b486c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169930
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67422}
2020-04-28 09:19:03 +00:00