Commit Graph

28858 Commits

Author SHA1 Message Date
Michael Lippautz
34c0f0fced Disable UnifiedHeapTest.TracedReferenceRetainsFromStack on Fuchsia
Test still fails after the previous fix.

No-try: true
Bug: v8:11933
Change-Id: I55100631e6f168728075234bddc6f9fd558c1e89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3251169
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77605}
2021-10-29 07:38:29 +00:00
jiepan
ab03285599 [x64] Implement 256-bit assembler for SSSE3/SSE4/SSE42_AVX instructions
Bug: v8:12228
Change-Id: I32efb46cd71d494de4d40301224724b41ad035a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250410
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#77602}
2021-10-29 00:14:50 +00:00
Michael Lippautz
6f66a832c9 heap: Add safe stack support for stack containment checks
Stack containment checks for slots should consider safe stacks when
they are enabled.

Bug: v8:11933, v8:12165
Change-Id: I2e2c8539c3c0a2dd795f87781ecb2942e059accc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250642
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77601}
2021-10-28 20:37:20 +00:00
Michael Lippautz
88823c8c6c heap: Fix msvc compile due to unused return value
Bug: v8:12165
Change-Id: I54c7b429708a2d6a3c4db89911b9b69fa4a5a41a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250640
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77600}
2021-10-28 18:15:00 +00:00
Leszek Swirski
eaaaed9735 [cleanup] Remove compiler.h from js-function-inl.h
Change-Id: I17104eba48919c4608d6ab7e91cb09601a2f71d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250636
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77599}
2021-10-28 17:20:30 +00:00
Ng Zhi An
d81888bc94 [relaxed-simd][wasm] Prototype relaxed int-float trunc
4 instructions, int32x4.trunc_f32x4_{s,u},
int32x4.trunc_f64x2_{s,u}_zero.

Drive-by cleanup to wasm-interpreter to use saturated_cast.

The machine ops are named <int>Trunc<float>, dropping the "sat" since
these don't do any saturation anymore.

Bug: v8:12284
Change-Id: I2d4d6a61b819b287fee69e3eea03dd3151cfa10d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3223166
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77598}
2021-10-28 17:03:30 +00:00
Tobias Tebbi
392078fb83 Reland "[turbofan] extend type asserts to cover all JS types"
This is a reland of 45227ffdb4
Differences:
- Handle one more flags conflict in variants.py.
- Disallow %VerifyType without --concurrent-recompilation.

Original change's description:
> [turbofan] extend type asserts to cover all JS types
>
> Extend type assertions to all types covering JavaScript values.
> This is achieved by allocating type representations on the heap using
> newly defined HeapObject subclasses. To allocate these in the compiler,
> we disable concurrent compilation for the --assert-types flag for now.
>
> Fix two type errors that came up with the existing tests:
> 1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
>    OtherObject.
> 2. OperationTyper::NumberToString(Type) can type the result as the
>    HeapConstant Factory::zero_string(). However, NumberToString does
>    not always produce this string. To avoid regressions, the CL keeps
>    the HeapConstant type and changes the runtime and builtin code to
>    always produce the canonical "0" string.
>
> A few tests were failing because they check for truncations to work
> and prevent deoptimization. However, AssertType nodes destroy all
> truncations (which is by design), so these tests are incompatible
> and now disabled for the assert_types variant.
>
> Drive-by fix: a few minor Torque issues that came up.
>
> Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77565}

Change-Id: I5b3c6745c6ad349ff8c2b199d9afdf0a9b5a7392
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247035
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77596}
2021-10-28 14:10:30 +00:00
Yujie Wang
4240985a1e [riscv64] Add tests for RVV VI VF instructions
Implement `LiftoffAssembler::emit_i16x8_sconvert_i32x4` for riscv.
Add tests for rvv integer and floating-point instructions.
Add simulator support for rvv instructions, e.g. `vfmadd`, `vnclip`.
Fixed order of operands for `vfdiv.vv`.

Bug: v8:11976
Change-Id: I0691ac66771468533c5994be1fc8a86b09d3c738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3225319
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77595}
2021-10-28 13:57:31 +00:00
Thibaud Michaud
bddb7b02d3 [wasm] Temporarily disable stack-switching test
The stack-switching test is not expected to pass yet if a GC happens
in the runtime call or in the wasm call.

R=ahaas@chromium.org

Bug: v8:12191, v8:12344
Change-Id: Iba66be58c1abd2ffbb22bbd7d34f8df0246a2a92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3250900
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77594}
2021-10-28 12:23:51 +00:00
Michael Lippautz
e5a509049e api: Provide write barrier in TracedReferenceBase
TracedReferenceBase use (traced) global handles to implement the
referencs. Provide a write barrier in the corresponding handle
methods. Doing so
- avoids bugs by having embedders taking care of write barrier
  management.
- speeds up the barrier as it is better integrated in the handle
  methods.

Drive-by: We don't need write barriers on initializating stores.

Bug: v8:12165
Change-Id: Ie49cc3783aeed576fd46c957c473c61362fefbf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247039
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77593}
2021-10-28 12:00:32 +00:00
Ray Wang
cced52a97e [date] Skip leading zeros when parsing date string
1. Skip leading zeros when parsing date string
2. Add necessary unittests

Bug: v8:12256
Change-Id: Ibc1f320382a2e33175f7f57542c8fe48afd05fa8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3223239
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77592}
2021-10-28 11:49:10 +00:00
Shu-yu Guo
e8c823763a [ic,baseline] Add KeyedDefineOwnIC_Slow and use StoreOwnICBaseline in baseline
A "store own" slow runtime was missing, and the slow handler on the
StoreOwnIC was using the non-own slow runtime function, incorrectly
causing setters to be called.

For baseline, [1] invalidates the invariant that StoreOwnIC is only used
for storing properties already in the literal boilerplate, since it's
also used when the new literal is cloned from an object spread.

[1] https://chromium-review.googlesource.com/c/v8/v8/+/3224666

Bug: chromium:1263389, v8:11429
Change-Id: I0284396f306f937d1b8ff96adda6cc133c19726a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244308
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77591}
2021-10-28 11:34:23 +00:00
Tim van der Lippe
52b4aae2d9 Improve error message when using await in DebugEvaluate
When evaluating a top-level expression while paused on a breakpoint, we
don't support an await expression as top-level statement. In these
cases, the error was not informative and could be improved.

To do so, we now propagate the information from DebugEvaluate to
ParseInfo and use the parse_info in parser-base to throw a more
informative error while parsing.

R=jarin@chromium.org

Fixed: chromium:1132245
Change-Id: I200c5af7391258256d1d86a09cbcae326327a0d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247037
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tim van der Lippe <tvanderlippe@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77587}
2021-10-28 09:56:40 +00:00
jiepan
411bb69c2a [x64] Implement 256-bit assembler for SSE2_AVX instructions.
Not all the SSE2 instructions can be extended to
256-bit wide AVX instructions, AVX only supports 128-bit
wide packed integer operands, while AVX2 supports both
128-bit and 256-bit wide packed integer operands. Moreover,
the 256-bit shift instructions use XMM register/m128 to store
the shift count, while all the operands of others are YMM
registers/m256 operands,so we have to divide the
SSE2_INSTRUCTION_LIST into 3 lists, packed double, packed
integer and packed integer shift.

Bug: v8:12228
Change-Id: Ieb240673ec51eec4315871e873e145a59bf16d5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246760
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#77583}
2021-10-28 00:52:59 +00:00
Shu-yu Guo
aa0b4a2139 [test] Don't flush code for another flaky optimization test
Bug: v8:12329
Change-Id: I51c38d70537889b7534fb7e6b4066e6ab440234a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3248163
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77582}
2021-10-27 19:00:19 +00:00
legendecas
419ca34349 [objects] Fix module namespace object element accesses
As of the normative change [1] of spec, the export name can be
arbitrary strings. Element accesses on module namespace objects
will be interpreted as indexed properties, so those element key
exports should be setup as elements.

[1]: https://github.com/tc39/ecma262/pull/2154

Bug: v8:11690
Change-Id: I3b724d11b9306739268fc5348bae87911a8da18c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3219945
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: legendecas <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#77581}
2021-10-27 18:10:09 +00:00
Frank Tang
3f27ca4f47 [test262] Roll test262
1ad9bb762..ba82d462

Bug: v8:7834
Change-Id: Iee35bbd770344eb6bd697e4d297888ee100e8e24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3246763
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77579}
2021-10-27 16:41:39 +00:00
Leszek Swirski
538522d0c8 Revert "unittests: Provide Context in TestWithHeapInternals"
This reverts commit f300a01a63.

Reason for revert: Makes TSAN unhappy: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/5299/overview

Original change's description:
> unittests: Provide Context in TestWithHeapInternals
>
> Change-Id: I54e658325dfbfb425c41cab2fd7b32253b380e37
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247038
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77577}

Change-Id: I3806a40847d327cc86e2816e00a74c80ba7b512e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247633
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77578}
2021-10-27 15:05:10 +00:00
Michael Lippautz
f300a01a63 unittests: Provide Context in TestWithHeapInternals
Change-Id: I54e658325dfbfb425c41cab2fd7b32253b380e37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247038
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77577}
2021-10-27 13:48:59 +00:00
Igor Sheludko
d9068f6c5d [cleanup] Move builtins related APIs from Heap class
... to Builtins class.

Bug: v8:12244, v8:11880
Change-Id: Ia96e476b904618b5fc45d2e401cedc2f67e36e7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245346
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77571}
2021-10-27 11:17:01 +00:00
Maya Lekova
54f90462ec Revert "[turbofan] extend type asserts to cover all JS types"
This reverts commit 45227ffdb4.

Reason for revert: Breaks on gc_stress mode, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/35988/overview

Original change's description:
> [turbofan] extend type asserts to cover all JS types
>
> Extend type assertions to all types covering JavaScript values.
> This is achieved by allocating type representations on the heap using
> newly defined HeapObject subclasses. To allocate these in the compiler,
> we disable concurrent compilation for the --assert-types flag for now.
>
> Fix two type errors that came up with the existing tests:
> 1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
>    OtherObject.
> 2. OperationTyper::NumberToString(Type) can type the result as the
>    HeapConstant Factory::zero_string(). However, NumberToString does
>    not always produce this string. To avoid regressions, the CL keeps
>    the HeapConstant type and changes the runtime and builtin code to
>    always produce the canonical "0" string.
>
> A few tests were failing because they check for truncations to work
> and prevent deoptimization. However, AssertType nodes destroy all
> truncations (which is by design), so these tests are incompatible
> and now disabled for the assert_types variant.
>
> Drive-by fix: a few minor Torque issues that came up.
>
> Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77565}

Change-Id: Ia779a11fc811846194c7a8d1e40b372b265e7ea4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3247034
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Owners-Override: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77566}
2021-10-27 09:38:32 +00:00
Tobias Tebbi
45227ffdb4 [turbofan] extend type asserts to cover all JS types
Extend type assertions to all types covering JavaScript values.
This is achieved by allocating type representations on the heap using
newly defined HeapObject subclasses. To allocate these in the compiler,
we disable concurrent compilation for the --assert-types flag for now.

Fix two type errors that came up with the existing tests:
1. JSCreateKeyValueArray has type Array (i.e., a JSArray) instead of
   OtherObject.
2. OperationTyper::NumberToString(Type) can type the result as the
   HeapConstant Factory::zero_string(). However, NumberToString does
   not always produce this string. To avoid regressions, the CL keeps
   the HeapConstant type and changes the runtime and builtin code to
   always produce the canonical "0" string.

A few tests were failing because they check for truncations to work
and prevent deoptimization. However, AssertType nodes destroy all
truncations (which is by design), so these tests are incompatible
and now disabled for the assert_types variant.

Drive-by fix: a few minor Torque issues that came up.

Change-Id: If03b7851f7e6803a2f69edead4fa91231998f764
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234717
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77565}
2021-10-27 08:37:31 +00:00
Camillo Bruni
78387ca75d [api] Deprecate v8::ScriptCompiler::CompileFunctionInContext
- Introduce v8::ScriptCompiler::CompileFunction
- Deprecate v8::ScriptCompiler::CompileFunctionInContext
- Add v8::Function::GetUnboundScript
- Add v8::Script::GetResourceName

The ScriptOrModule out-parameter is only used by NodeJS since we don't
allow arbitrary objects has host-defined options and they need a way to
keep the options alive.

This CL deprecates the out-parameter and adds helper methods to
address the most common use-cases.

The final fix still requires more fundamental changes on how host-defined
options are handled.

Bug: chromium:1244145
Change-Id: Id29de53521ad626c41391b8300146ee37a1b8a51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245117
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77564}
2021-10-27 07:19:51 +00:00
Camillo Bruni
91475f958a [api] Add v8::Object::GetCreationContextChecked
Using v8::Object::GetCreationContext().ToLocalChecked() causes needless
binary size regression on android due to the additional call after
migrating to the non-deprecated GetCreationContext API.

Bug: chromium:1166077, v8:11451, v8:11165
Change-Id: Ic5e2aada4d47392c5d61b419c19b5bcdbf869f0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244411
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77563}
2021-10-27 07:18:13 +00:00
Ng Zhi An
881a486ef6 [x64] Verify disassembly of more AVX instructions
This covers all the AVX instructions.

Bug: v8:12207
Change-Id: Idee66a55e1da5a2e88797002d25c6affb2d0c564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3238149
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77559}
2021-10-27 00:05:51 +00:00
Victor Gomes
6661dcc190 [test] Upstream Google3 mjsunit variants
Change-Id: Ie419fe63a0d63574a155b48a040beb0b633989e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245930
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77558}
2021-10-26 17:05:10 +00:00
Thibaud Michaud
a4252db322 [wasm][liftoff] Fix spill offsets in merge regions
Recompute the spill offsets for values in the merge region, instead of
reusing the offsets of the source. This ensures that spill slots stay
contiguous (modulo alignment).
This also solves a correctness issue where the spill offsets in the
merge region could move up, thereby overwriting the source of another
move.
With this change, the spill offsets always move down (to fill the gap)
or stay the same, such that processing them from bottom to top
can only overwrite sources of already-processed moves.

Since we do not reuse the current state's offsets, this might generate
extra stack moves and regress generated code performance a bit.

Drive-by: print spill offsets in the Liftoff trace

R=clemensb@chromium.org

Bug: v8:12270
Change-Id: I8d20df8fc1e80dd36b6f651de457686e9935a628
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245115
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77556}
2021-10-26 16:07:00 +00:00
Clemens Backes
4ea3051629 [asm] Disallow duplicate parameter names
According to the spec, the three parameters (stdlib, foreign, and heap)
must be mutually distinct. We did not check this yet, which led to
observable differences between asm validation and standard JavaScript
semantics.

R=thibaudm@chromium.org

Bug: chromium:1068355
Change-Id: I451f63d10ea50474aeb6e8a547918b5af769343b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3244408
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77554}
2021-10-26 15:21:06 +00:00
Jakob Gruber
a6a113c6d5 [csa] Fix an old spec violation in Array.length writes
We used to apply an invalid optimization which skips `length` writes
if the JSArray is 'fast' and the old value equals the new value. This
optimization is not valid if e.g. `length` is non-writable.

Fixed: chromium:1262478
Change-Id: I49ef50de293dae5c3a62c64b303ec34b9c0f6cbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236720
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77552}
2021-10-26 13:30:04 +00:00
Kim-Anh Tran
8678fc629d [heap-snapshot] Declaring progress counter as uint32_t (instead of int)
A test was overflowing on the progress counter when using int as type.
This CL is fixing the progress counter to use uint32_t, and re-enables
the test.

Why uint32_t instead of size_t?
In the referenced bug, the progress_counter_ (but not the
progress_total_) triggered an overflow; and since these two counters
should be relatively similar (the total count is an estimate, and can
be less than the actual progress count), we do not expect the
count to increase much more than we can already encode with int.


Bug: chromium:1246860
Change-Id: I9769884ef60d352b3787c2223e528ddf33b0b23e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245116
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77551}
2021-10-26 13:26:21 +00:00
Victor Gomes
2c791ece5f [cctest] Deflake CPU profiler tests
Reduce sampling interval to increase test accuracy.
Flakes happen specially when compiling with Sparkplug.

Bug: v8:12054
Change-Id: Ic58bc97d0ad9861259fc8df4b121425b375669e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245336
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77547}
2021-10-26 12:05:33 +00:00
Clemens Backes
26eeacb7ca [compiler] Compute dominator tree for tests
The dominator tree is usually computed as part of scheduling (in
{Scheduler::ComputeSchedule}). For tests it was missing, leading to
DCHECK errors in the mid-tier register allocator, which uses the
dominator tree.

R=mslekova@chromium.org

Bug: v8:12330
Change-Id: I02bc8dee3aecb6a1613fa1d07d3aae85cd28de17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245114
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77543}
2021-10-26 11:11:31 +00:00
Thibaud Michaud
2404758e8c [wasm] Add initial returnPromiseOnSuspend builtin
R=ahaas@chromium.org
CC=fgm@chromium.org

Bug: v8:12191
Change-Id: Ied9ab5fa5009e5ab268d1c9893729d8210ae62ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3220344
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77542}
2021-10-26 11:07:00 +00:00
Maria Tîmbur
c8976f6434 [fuzzer] Add support for immutable arrays
Add support for immutable arrays.

Bug: v8:11954
Change-Id: Ia343247d5fbc960e0e5b1f9b7cb75e734a747d0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240827
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Cr-Commit-Position: refs/heads/main@{#77541}
2021-10-26 10:25:30 +00:00
Jakob Gruber
c1e32791a3 [regexp] Allow empty ranges in GetQuickCheckDetails
A follow-up to crrev.com/c/3240782.

Drive-by: extend JSRegExp printing.

Fixed: chromium:1263327
Bug: v8:11069
Change-Id: Iff64ded27ca93641f0f572df2ce0a9f846948f7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3245110
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77536}
2021-10-26 08:14:40 +00:00
Michael Lippautz
59fe961804 cppgc: Move interesting checks behind DEBUG
v8_enable_v8_checks has very little coverage outside of V8 itself.
Move pointer verification checks behind DEBUG so that they fire in
regular debug or dcheck_always_on builds.

Change-Id: Ib2803240dd996f4223e403d20e927aff2955afbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3242006
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77534}
2021-10-26 07:37:11 +00:00
Camillo Bruni
447c3f3c2a [tests] Increase stack-size limit to make tests pass in debug mode
This fixes webkit/run-json-stringify broken by
https://crrev.com/c/3222765

Failure: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8832393633085738145/+/u/Bisect_23af060d/Retry_-_default/run-json-stringify


Bug: chromium:1244145
Change-Id: I1235f6db8ab10356476cd1028b20300f86510119
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3242005
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77533}
2021-10-26 07:05:19 +00:00
Vasili Skurydzin
dcbcb52c9c aix: Skip test in debug mode to avoid increasing stack-size
Bug: v8:12297
Change-Id: Ifbf6ac61e6b61e419b361d1fc14009d6d745193c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231484
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/main@{#77528}
2021-10-25 14:14:19 +00:00
Camillo Bruni
23af060d6c [runtime] Introduce explicit Execute::CallScript
For the upcoming host_defined_options fixes we will have to explicitly
pass the host-defined options to Invoke so we will be able to install
it in the script context in the future.

Bug: chromium:1244145
Change-Id: I690cc774d6a17278db4381aba8c3408e979606c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3222765
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77524}
2021-10-25 13:17:39 +00:00
Maya Lekova
e1f5e68ebb [fastcall] Fix MachineType for FP TypedArray arguments
This CL fixes an issue in EffectControlLinearizer, where the primitive
type of the argument of a fast C call was used to compute its
MachineType even when the argument was actually a TypedArray, which
should always be treated as a Tagged type. This resulted in Float32/64
typed arrays being passed in FP registers, leading to a crash in the
register allocator.

Drive-by fix: Fixed output from --trace-turbo-alloc so that all of its
sub-parts are printed with PrintF, avoiding interleaved log lines.

Bug: chromium:1260954
Change-Id: I249c8629daae3af437fb52f53f45211f3a214222
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231341
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77521}
2021-10-25 12:32:31 +00:00
Michael Lippautz
4b437beee9 cppgc: Add support for young generation only marking verification
Marking verification should only process young generation objects when
verifying the marking state of a young generation garbage collection.

Bug: v8:12324
Change-Id: I01db261437ec5c42ddb6c79c44e31b5fe0e536d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3231343
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77518}
2021-10-25 11:16:28 +00:00
Jakob Gruber
5b5a200274 Add missing status annotation for regress-1262423
No-Try: true
Bug: chromium:1262423
Change-Id: I9d56e347d046944f01e33aa6fb8752c889e2d38d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240784
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77517}
2021-10-25 11:15:26 +00:00
Jakob Gruber
b7dc9915ff [regexp] Only emit valid ranges in MakeRangeArray
Character class handling in the irregexp pipeline is quite complex;
codepoints outside the BMP (basic multilingual plane) are only
translated into surrogate pairs when needed, e.g. when the subject
string is two-byte. If not needed, the codepoints simply stay part of
the list of CharacterRanges.

In EmitCharClass, we determine the valid subset of ranges through
ranges_length; until this CL, we forgot to pass that information on to
MakeRangeArray. Do that now by truncating the list of CharacterRanges.

Fixed: chromium:1262423
Change-Id: I5bb5b839e9935890ca2d10908ad66d72c3217178
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3240782
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77514}
2021-10-25 09:32:49 +00:00
Frank Tang
63344e8d0b Roll ICU and correct timezone test
Bug: v8:12301
Change-Id: Ia87943478c1b67c077a18785668c485c404cd5dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3235814
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77505}
2021-10-21 18:39:31 +00:00
Ng Zhi An
76efd418e4 [x64] Verify disassembly of some AVX instructions
Extract instructions, and pextrq.

Bug: v8:12207
Change-Id: I919ce53a6bb1357cb70d78b3c7f12fc3d2128deb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3223969
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77504}
2021-10-21 18:32:21 +00:00
Frank Tang
eaa1ac794e [test262] Roll test262
8d420cef4..1ad9bb7626

Bug: v8:7834
Change-Id: Icc082f9834aabd39f0d21f85d6ff9ed8ad1d0137
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3235813
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77503}
2021-10-21 16:41:33 +00:00
Joyee Cheung
63a8a3bb18 Trace optimization in store-data-property-in-literal-private.js
To get more details about the failure when it flakes.

Bug: v8:12332
Change-Id: I1bf5188efe13a75e34dd9832e6275fd985ee8dbd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3233974
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77498}
2021-10-21 13:30:47 +00:00
Clemens Backes
d757cd5c63 [compiler] Fix mid-tier register allocator issue
If an output operand has "same as input" policy, we cannot assume that
it's input 0. Instead we should look at the {input_index}.

The bug manifests on Wasm select instructions, where the input index is
actually 2 and not 0.

In order to test this better, we introduce the a new
--turbo-force-mid-tier-regalloc flag, which always uses the mid-tier
register allocator. Otherwise the bug would only manifest on huge
functions.

R=mslekova@chromium.org
CC=​thibaudm@chromium.org

Bug: v8:12330
Change-Id: I6a005a48bbd2aba354dc99fed587bffce24c8839
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3234722
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77495}
2021-10-21 12:20:26 +00:00
Patrick Thier
88c0f72927 [turbofan] Fix calling class constructors with spread
Calling class constructors without new is a spec violation and should
raise an exception.
In [1] calling class constructors with spread (without new) was handled
by reducing the node to a call to runtime to raise the exception.
However, arguments of the call have to be evaluated first ([2]).
This CL changes the reduction of JSCallWithSpread/JSCallWithArrayLike to
a no-op in JSCallReducer if the target is a class constructor, delaying
raising of the exception to the call builtin.

[1] https://crrev.com/c/3229369
[2] https://tc39.es/ecma262/#sec-evaluatecall

Bug: chromium:1262007
Change-Id: I2ef504d4ce6e51d582b5951beb6debb983cefba6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3236348
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77492}
2021-10-21 10:14:12 +00:00
Ng Zhi An
c3f346b7ac [wasm-relaxed-simd][x64] Prototype relaxed min and max
Relaxed f32x4 and f64x2 min and max.

These instructions only guarantee results when the inputs are non nans,
and when the inputs are not 0s of opposite signs.

Reuse existing float binop testing harnesses and add special checks for
such constants when relaxed operations are being tested.

Drive-by rename of x64 instruction codes to be Minps/Maxps/Minpd/Maxpd
since they map down exactly to a single instruction.

Bug: v8:12284
Change-Id: I1449dbfa87935a96d7d260db22667ab7b9e86601
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3218196
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77484}
2021-10-21 00:58:24 +00:00