Commit Graph

57995 Commits

Author SHA1 Message Date
Bill Budge
f6e08f43fc Revert "[ic] Inline constant fields in IC"
This reverts commit 8ee507f1ca.

Reason for revert: Speculative, to unblock the V8 roller

https://ci.chromium.org/p/chromium/builders/try/linux-rel/173637

Original change's description:
> [ic] Inline constant fields in IC
> 
> Previously, the handler would load the constant field from the holder
> everytime by using the descriptor index. Instead, this patch inlines
> the constant field directly into the handler.
> 
> Change-Id: Ia731811b135897033f4c5dc973031a30f25a64ed
> Bug: v8:9616
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688829
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63332}

TBR=gsathya@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: I36c5648c56f1d78447b7a45504cdebf593c020a1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1766148
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63353}
2019-08-22 18:43:15 +00:00
Seth Brenith
1a815e44b5 [tools][torque]Improve postmortem API behavior on strings
This change adds the indexed field for the characters in the definition
of sequential string types, and introduces support for recognizing the
various specific string types in v8_debug_helper. In an attempt to
avoid duplicating info about string instance types, it also refactors
String::Get so that StringShape (a simple class usable by postmortem
tools) can dispatch using a class that defines behaviors for each
concrete type.

Bug: v8:9376
Change-Id: Id0653040f6decddc004c73f8fe93d2187828c2c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735795
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63352}
2019-08-22 18:40:05 +00:00
v8-ci-autoroll-builder
a9ab791298 Update V8 DEPS.
Rolling v8/build: abb522f..f4bb5e7

Rolling v8/third_party/depot_tools: bfcde3c..4c55b35

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Iaf903551f6942cd4b2d30fb80601eae7d04b91b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1765461
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63351}
2019-08-22 17:50:05 +00:00
Bill Budge
98b5c49fb8 Revert "[compiler] Track the maximal unoptimized frame size"
This reverts commit 1e472c423b.

Reason for revert: Speculative revert, to attempt to fix crashes that block the V8 roll. Example failure run:

https://ci.chromium.org/p/chromium/builders/try/linux-rel/173465

Original change's description:
> [compiler] Track the maximal unoptimized frame size
> 
> This is another step towards considering the unoptimized frame size in
> stack checks within optimized code.
> 
> With the changes in this CL, we now keep track of the maximal
> unoptimized frame size of the function that is currently being
> compiled. An optimized function may inline multiple unoptimized
> functions, so a single optimized frame can deopt to multiple
> frames. The real frame size thus differs in different parts of the
> optimized function.
> 
> We only care about the maximal frame size, which we calculate
> conservatively as an over-approximation, and track in
> InstructionSelector::max_unoptimized_frame_height_ for now. In future
> work, this value will be passed on to codegen, where it will be
> applied as an offset to the stack pointer during the stack check.
> 
> (The motivation behind this is to avoid stack overflows through deopts,
> caused by size differences between optimized and unoptimized frames.)
> 
> Note that this offset only ensure that the topmost optimized frame can
> deopt without overflowing the stack limit. That's fine, because we only
> deopt optimized frames one at a time. Other (non-topmost) frames are
> only deoptimized once they are returned to.
> 
> Drive-by: Print variable and total frame height in --trace-deopt.
> 
> Bug: v8:9534
> Change-Id: I821684a9da93bff59c20c8ab226105e7e12d93eb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762024
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63330}

TBR=neis@chromium.org,sigurds@chromium.org,jgruber@chromium.org

Change-Id: I7b225c30bfc4e1d958276583f512a1ec5fa2b458
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9534
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1764626
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63350}
2019-08-22 16:50:05 +00:00
Jakob Kummerow
64c88d8698 [api] Fix overflow in AdjustAmountOfExternalAllocatedMemory
ClusterFuzz found another case where "weird" embedder calls can cause
signed integer overflow. This patch fixes the last addition in that
function to use unsigned types.

Bug: chromium:991676
Change-Id: Ia77a12020908de8f0a3bd1be7d3722ba5c5c919b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743971
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63349}
2019-08-22 16:35:44 +00:00
Darius Mercadier
90fef305c8 [heap] switch default FreeList strategy to FreeListManyCachedOrigin
This CL enables the FreeList strategy introduced by CL 1762292.

Bug: v8:9329
Change-Id: I73c1399aa9ae9a602f29f208c5543927a1405403
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1765533
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Cr-Commit-Position: refs/heads/master@{#63348}
2019-08-22 15:40:56 +00:00
Sathya Gunasekaran
3bd0dc18f3 Revert "[ic] Fix KeyedLoadIC for ArrayIndex access"
This reverts commit 5c59ba4fbc.

Reason for revert: requires more thinking 

Original change's description:
> [ic] Fix KeyedLoadIC for ArrayIndex access
> 
> Previously, without support for converting strings to numbers we'd
> switch to megamorphic state and go to the runtime always to do the
> conversion causing a performance cliff.
> 
> This patch improves the following js-perf-test scores:
> Object-Lookup-String-Constant-BytecodeHandler: 4.25%
> Object-Lookup-Index-String-BytecodeHandler: 5.41%
> 
> Bug: v8:9449
> Change-Id: I63787fa84373fc946f1304b0141e48a52a1b4bcb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690953
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63293}

TBR=mythria@chromium.org,jyan@ca.ibm.com,gsathya@chromium.org,leszeks@chromium.org,ishell@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9449
Change-Id: I6b6ad5901175c2e6bbd7516b13e91471adb5776d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1765532
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63347}
2019-08-22 15:19:17 +00:00
Michael Starzinger
e16775163a [wasm] Preserve identity on {WasmJSFunction} re-export.
This preserves the object identity of a {WebAssembly.Function} instance
that is being re-exported by a module. Such functions are considered to
have an internal [[FunctionAddress]] slot and hence require their object
identity to be preserved (similar to {WasmExportedFunction} already).

R=jkummerow@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I88ba75fcd91ce04440008467f3b218a1ac3047db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763545
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63346}
2019-08-22 15:00:22 +00:00
Darius Mercadier
18a2268fcf [heap] Add new freelist: FreeListManyCachedOrigin
This new FreeList should be a reasonable replacement for our old
FreeListLegacy: it is slightly less efficient (~1%), but uses much
less memory (often 5% less old_space size).

It is based on FreeListMany, with the following additions:

  - A cache to waste less time iterating empty categories

  - A fast path for allocations done in the runtime and generated code

  - A slow path (the same as FreeListMany actually) for allocations
    done in the GC.

Bug: v8:9329
Change-Id: Ifc10b88df7861266a721afd2c6e6d8357255ec4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762292
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63345}
2019-08-22 14:32:17 +00:00
Andreas Haas
73010d22dd [wasm][bigint] Fix calls to imports with I64 in their signature
For import wrappers, we add a special "callable" parameter as the last
parameter. This parameter is not set in the TurboFan graph but in the
code generator. Therefore this parameter has to be allocated in a
special register and cannot be lowered generically. With this CL we
detect in the CallDescriptor lowering if the last parameter is this
special "callable" parameter. If so, we preserve it in the lowered
CallDescriptor in the same register.

R=jkummerow@chromium.org

Bug: v8:7741
Change-Id: I884baa41813011c811612ec84f4e3cfe86a0e83a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762014
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63344}
2019-08-22 14:22:06 +00:00
Sigurd Schneider
6d9b7988f7 [testing] Prevent heuristics from triggering optimization in tests
This CL adds a mechanism that prevents the RuntimeProfiler from
triggering optimization of a function after
%PrepareFunctionForOptimization has been called. This is useful to
prevent flakiness in tests, as sometimes a function that already
got deoptimized would receive a new code object from a concurrent
compile that was triggered by a heuristic just in the right moment
for the assertUnoptimized test to fail. For example, the following
was happening:

PrepareFunctionForOptimization
[marking `testAdd` for optimized recompilation, reason: small function]
[concurrently compiling method `testAdd` using TurboFan]
[manually marking `testAdd` for non-concurrent optimization]
[synchonously compiling method `testAdd` using TurboFan]
[synchonously optimizing `testAdd` produced code object 0xAAAA - took 1.638 ms]
Runtime_GetOptimizationStatus OPTIMIZED `testAdd` (code object 0xAAAA)
DeoptimizeFunction `testAdd` with Code Object 0xAAAA
[concurrently optimizing `testAdd` produced code object 0xBBBB - took 3.377 ms]
Runtime_GetOptimizationStatus OPTIMIZED `testAdd` (code object 0xBBBB)

Bug: v8:9563
Change-Id: Ia4c846aba95281589317d43b82383e70fe0a35f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763546
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63343}
2019-08-22 13:51:36 +00:00
Dominik Inführ
6fa5de0b8e Revert "[heap] Remove slots when shrinking objects"
This reverts commit aba185a713.

Reason for revert: We want to keep this API.

Original change's description:
> [heap] Remove slots when shrinking objects
>
> Immediately remove recorded old-to-new slots when shrinking objects.
> This operation needs to drain the store buffer, however the store buffer
> is supposed to be removed anyway.
>
> Also do not remove slots when left-trimming since this isn't needed for
> correctness.
>
> Bug: v8:9454
> Change-Id: I751baf2dcd03c87aee9cb1ebd168e05bf373a738
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762012
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63271}

TBR=ulan@chromium.org,dinfuehr@chromium.org


Bug: v8:9454
Change-Id: I9524a7448cc49948915fdccc5a6b1aa22e4de4a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762524
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63342}
2019-08-22 13:45:46 +00:00
Maya Lekova
0bd19ddbba Revert "[debug] only break on entry when immediately called from JS"
This reverts commit e66cee7e9e.

Reason for revert: Speculative revert for https://ci.chromium.org/p/chromium/builders/try/linux-rel/173349

Original change's description:
> [debug] only break on entry when immediately called from JS
> 
> When we break on function entry, check whether the target function is being
> called from JS after entering V8 through V8's API. We implement this by
> keeping track of the stack height when we enter V8 through the API, and compare
> the caller JS frame's stack height with that.
> 
> R=​szuend@chromium.org
> 
> Bug: chromium:991217, chromium:992406
> Change-Id: I258ad9cef11fe0ef48de6fd5055790792fd0ec0c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762298
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63331}

TBR=yangguo@chromium.org,szuend@chromium.org

Change-Id: I4bfb42f7ce1484807696048a09609f14113d10f4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:991217, chromium:992406
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762525
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63341}
2019-08-22 13:29:59 +00:00
Andreas Haas
614171c232 [wasm] Introduce a wasm-staging flag
R=mstarzinger@chromium.org

Change-Id: Ic7a3538bbdf3ec2e68c83c397818ab0ca838ddbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738855
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63340}
2019-08-22 12:36:16 +00:00
Mathias Bynens
0ab6d4a56e Roll Test262
Bug: v8:7834, v8:4709, v8:9646, v8:9647
Change-Id: Ie3648aec127504b9d6eb5b8ed491ba056fb68a8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763544
Auto-Submit: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63339}
2019-08-22 12:22:16 +00:00
Dominik Inführ
aac132f008 Revert "[heap] Remove ClearRecordedSlots"
This reverts commit 74e68e6a8a.

Reason for revert: We want to keep this API.

Original change's description:
> [heap] Remove ClearRecordedSlots
> 
> Do not pass it as argument to CreateObjectFillerAt and remove the enum.
> 
> Bug: v8:9454
> Change-Id: Iafa37acbfea73d3cabb1732dbec0944db859fac2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762017
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63282}

TBR=ulan@chromium.org,petermarshall@chromium.org,dinfuehr@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9454
Change-Id: I9a0a249294957740f831b28f5fefef132123d0e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762523
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63338}
2019-08-22 12:06:36 +00:00
Joey Gouly
e0a2d93e47 [arm64] Allow immediate operands to be swapped in compares
This was deleted in 5b2ab2f6f7, it seems only
the first part of the condition should have been deleted.

This changes (from the embedded builtins):

    movz x9, #0x2
    cmp x9, x8

Back to:

    cmp x8, #0x2

This saves 0.29% in the embedded builtins size for a pointer-compression enabled arm64 build.

Also a minor cleanup by removing the commutative boolean parameter and always commuting the
FlagsContinuation. For a commutative operation the FlagsContinuation will stay the same.

Change-Id: I5bba84a07bb32284b4756bc6293560ee106745f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762522
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#63337}
2019-08-22 10:51:26 +00:00
Georg Neis
eeef619956 [turbofan] Move serialization of ObjectCreate map into serializer
Also: add hint for "prototype" property. This makes us not miss
the ObjectCreate map in any of our tests.

Bug: v8:7790
Change-Id: Icc9f91ebaf466a1cdfba27526335b930c744b9c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762519
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63336}
2019-08-22 10:47:06 +00:00
Leszek Swirski
c4db8bf536 [cleanup] TNodify nodes which are set by a TNode function
Automated cleanup which finds patterns of `Node* a = foo` where `foo` is
a TNode expression, and replaces Node* with the appropriate TNode.

Bug: v8:9396
Change-Id: I8b0cd9baf10e74d6e2e336eae62eca6cfe6a9c11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762515
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63335}
2019-08-22 10:30:16 +00:00
Simon Zünd
4f0ee93bd1 Introduce "-m32" compilation mode for Torque
Forge (Google3) can only run 64-bit executables. As Torque runs as part
of the build process, we need a 32-bit "cross-compile" mode when
we target 32-bit architectures. Note that this flag won't be needed
in Chromium/V8 land, since we build V8 with the same bit width as
the target architecture.

This CL adds a new runtime flag to torque "-m32". When enabled, the
flag forces 32-bit word sizes for various pointer/word sizes. By
default, the host system sizes from {src/commons/globals.h}
are used.

R=tebbi@chromium.org

Bug: v8:9641
Change-Id: I8701eec45e3fb59dc65049b0a679d34589c4127f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763540
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63334}
2019-08-22 10:08:26 +00:00
Maya Lekova
0a726b75aa [turbofan] Fix a flipped condition in JSGenericLowering
This fixes a serious performance regression in Octane2 future variant.

Bug: v8:7790
Change-Id: Ie72d7b8ecf8af12e06a0ecae216cfb456908fe5d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763542
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63333}
2019-08-22 10:06:06 +00:00
Sathya Gunasekaran
8ee507f1ca [ic] Inline constant fields in IC
Previously, the handler would load the constant field from the holder
everytime by using the descriptor index. Instead, this patch inlines
the constant field directly into the handler.

Change-Id: Ia731811b135897033f4c5dc973031a30f25a64ed
Bug: v8:9616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688829
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63332}
2019-08-22 09:52:26 +00:00
Yang Guo
e66cee7e9e [debug] only break on entry when immediately called from JS
When we break on function entry, check whether the target function is being
called from JS after entering V8 through V8's API. We implement this by
keeping track of the stack height when we enter V8 through the API, and compare
the caller JS frame's stack height with that.

R=szuend@chromium.org

Bug: chromium:991217, chromium:992406
Change-Id: I258ad9cef11fe0ef48de6fd5055790792fd0ec0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762298
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63331}
2019-08-22 09:01:56 +00:00
Jakob Gruber
1e472c423b [compiler] Track the maximal unoptimized frame size
This is another step towards considering the unoptimized frame size in
stack checks within optimized code.

With the changes in this CL, we now keep track of the maximal
unoptimized frame size of the function that is currently being
compiled. An optimized function may inline multiple unoptimized
functions, so a single optimized frame can deopt to multiple
frames. The real frame size thus differs in different parts of the
optimized function.

We only care about the maximal frame size, which we calculate
conservatively as an over-approximation, and track in
InstructionSelector::max_unoptimized_frame_height_ for now. In future
work, this value will be passed on to codegen, where it will be
applied as an offset to the stack pointer during the stack check.

(The motivation behind this is to avoid stack overflows through deopts,
caused by size differences between optimized and unoptimized frames.)

Note that this offset only ensure that the topmost optimized frame can
deopt without overflowing the stack limit. That's fine, because we only
deopt optimized frames one at a time. Other (non-topmost) frames are
only deoptimized once they are returned to.

Drive-by: Print variable and total frame height in --trace-deopt.

Bug: v8:9534
Change-Id: I821684a9da93bff59c20c8ab226105e7e12d93eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762024
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63330}
2019-08-22 08:22:36 +00:00
Peter Marshall
4a2e91b8e0 [cleanup] Remove unused TickSample class from the public API
We have internal::TickSample which inherits from this, but we never
use the public version in the API despite defining it there.

Change-Id: I6f0ce7ee663ef821be57cfbad540c1660484a525
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1745472
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63329}
2019-08-22 07:27:35 +00:00
Johannes Henkel
d0e718a7cf [DevTools] Roll inspector_protocol
New revision: d114a62e144cdfdae697fe0af6581ce39a31af37

Change-Id: I865edf40848d5593ae80a5ee0ed65c0c472a5a89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1713234
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63328}
2019-08-22 07:01:05 +00:00
Joshua Litt
bb2e707119 [regexp] Fix clusterfuzz syntax errors for regexp-builtins
Bug: chromium:996232
Change-Id: I1df23835c18f5491a95e2faff17594ee7419cf75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763157
Auto-Submit: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63327}
2019-08-22 05:50:35 +00:00
v8-ci-autoroll-builder
bc01032c88 Update V8 DEPS.
Rolling v8/build: 5f675b2..abb522f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/04a66c3..679dc37

Rolling v8/third_party/depot_tools: 5329779..bfcde3c

Rolling v8/third_party/fuchsia-sdk: d677ea6..1785f0a

Rolling v8/third_party/googletest/src: c9ccac7..fb49e6c

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I29b600c24c77f268011669ac821dfcac0509885c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1764594
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63326}
2019-08-22 03:39:44 +00:00
Michael Lippautz
8c1de9ce37 api: Fixed TracedGlobal<T> move operators
Implement move ctor and assignment for both, the version that matches T
and the version where T and S are related in the type hierarchy.

Bug: chromium:995684
Change-Id: I21a747d706b224117c398e6feff42cc4ffc4cae8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762296
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63325}
2019-08-21 19:53:35 +00:00
Ng Zhi An
5c4c5aa207 [wasm-simd] Implement SSE4.1 fallback for I64x2MinS
Bug: v8:9510
Change-Id: Icf2500240ee36c271992897a222da2f089acc035
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1756855
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63324}
2019-08-21 18:46:21 +00:00
Z Nguyen-Huu
aa41caa576 [builtins] Port RegExp SourceGetter to Torque
Bug: v8:8976
Change-Id: I5eb7871a5d5daa15faff73666d400bb87627bbe0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762711
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63323}
2019-08-21 18:17:20 +00:00
Georg Neis
141138f84a [turbofan] Exclude more serialization from JSHeapCopyReducer
Bug: v8:7790
Change-Id: I02de7cb5b89a20a4eb10407cb1ff56ed3ece098f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762520
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63322}
2019-08-21 17:42:39 +00:00
Andreas Haas
12c009dee7 [wasm] 32-bit support WebAssembly's i64<>JavaScript's BigInt conversions
This CL was reviewed originally in https://crrev.com/c/1518181.

Bug: v8:7741
Change-Id: Iddb139a24c4b9aee6694e20cb5d04e9f9887160c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752859
Auto-Submit: Sven Sauleau <sven@cloudflare.com>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63321}
2019-08-21 17:03:51 +00:00
Maya Lekova
90cdb05324 [turbofan] Brokerize JSGenericLowering
Bug: v8:7790
Change-Id: I42ef762bdc9340d4cb8f03186c1961eddf35e46b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762516
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63320}
2019-08-21 16:06:49 +00:00
Andreas Haas
37d2c9408e [turbofan][cleanup] Fix LinkageLocation equality
The LinkageLocation currently consists of two fields, a bit_field and a
machine_type. The existing equality check only checked the equality of
the bit_field, which meant that a FP register location and a GP register
location could alias. I added a static {IsSameLocation} function which
checks that not just the bit_field but also if one of the two locations
at least has a subtype of the other. Note that we do not check for
type-equality because {CanTailCall} checks, which are the main user of
the LinkageLocation equality check, should pass even if the result types
are in a sub-typing relationship.

R=mstarzinger@chromium.org

Bug: v8:9396
Change-Id: Iaa2d11311d0c18e8ffc1dd934e369106ab2456a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763533
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63319}
2019-08-21 16:05:10 +00:00
Jakob Kummerow
2d17bf79d5 [wasm-c-api] Roll 3094fe2: Implement Global::get/set for refs
Change-Id: Ibab34553f1499bd5dee7cf7477284783cc0660fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763534
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63318}
2019-08-21 15:54:59 +00:00
Joshua Litt
3ec1036526 [nullish] Add support for nullish operator
This CL implements the nullish operator in bytecode as defined by:
https://github.com/tc39/proposal-nullish-coalescing. It can be
enabled by passing '--harmony-nullish'.

Nullish is similar to logical operators, but instead of truthy/falsey
values, it short circuits when it evaluates a null or undefined value.


Bug: v8:9547
Change-Id: Ia0f55877fc2714482b5547942baef9733537d1b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1738568
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63317}
2019-08-21 15:48:34 +00:00
Georg Neis
882f8c6b89 [turbofan] Remove a heap access from JSIntrinsicLowering
Bug: v8:7790
Change-Id: I9a770fd6861c216121aef88f0119698edc0e224e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763537
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63316}
2019-08-21 15:31:44 +00:00
Georg Neis
74257189e9 [turbofan] Move serialization of module cells into serializer
Bug: v8:7790
Change-Id: I6705e5399ad37201b89d5d6d5174138b22401ca1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762518
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63315}
2019-08-21 15:17:04 +00:00
Georg Schmid
26e39d12a8 [torque] Add user-defined Slice struct
This CL consists of several preparatory steps for slices in Torque. Above all, it introduces a user-defined struct, torque_internal::Slice<T>, that performs bounds checking and returns references to elements in arrays. To enable this, several smaller changes were also made:

- Constructors of internal classes such as torque_internal::Reference<T> now require a special 'Unsafe' argument, making it clear that there be dragons.
- Struct methods are now declared during finalization. This allows instances of generic structs to have methods referring to the same struct. Previously, methods would be declared before the instance had been fully registered, leading to errors during type resolution. Furthermore, such methods were declared in a temporary namespace, that would then erroneously escape and lead to use-after-free issues.
- Instances of TypeArgumentInference were not running in the correct (Torque) scopes, leading to type resolution errors.
- The chain of ContextualVariable::Scope for any given ContextualVariable (such as CurrentScope) can now be walked, simplifying debugging.

R=jgruber@chromium.org, tebbi@chromium.org

Bug: v8:7793
Change-Id: I36f808f63cc3ce441062dfc56f511f24f1e3121e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758322
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63314}
2019-08-21 14:52:35 +00:00
Andreas Haas
1eda962e59 [turbofan][cleanup] Remove Node-use in linkage.cc
The linkage should not have any knowledge about the existance of nodes.

R=mstarzinger@chromium.org

Bug: v8:9396
Change-Id: If10bf113c6ec19c434573a8d9bb7b736caef5dee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763532
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63313}
2019-08-21 14:49:06 +00:00
Michael Starzinger
fd8fe87387 [wasm] Add WebAssembly.Module type reflection of memories.
This adds type reflection support to the {WebAssembly.Module.exports} as
well as {WebAssembly.Module.imports} method. It also refactors existing
reflective code to use the internal instead of the public embedder API,
which is slightly more efficient anyways.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I88a6c7e9236a549808707c72e40a63302b7747a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763527
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63312}
2019-08-21 14:45:14 +00:00
Michael Starzinger
df76f1e55a [wasm] Add test case for {WebAssembly.Function} re-export.
This just adds a test case checking against the current behavior, but
expectations might change once the proposal is clarified. For details
see: https://github.com/WebAssembly/js-types/issues/11

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I2fc502460c0a8094a414d138703b75497b2d1c6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762517
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63311}
2019-08-21 14:43:03 +00:00
Dan Elphick
6d20778e4a [tests] Add --stress-lazy-source-positions to stress variant
Bug: v8:8510
Change-Id: Ie2b1cbbc136fecf3a81716b129e51857bd8db157
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762294
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63310}
2019-08-21 12:42:05 +00:00
Igor Sheludko
861f09d6b7 [ptr-compr][csa] Define optimal parameter mode as Smi
This generates slightly better code and gives some performance.

Bug: v8:8948
Change-Id: I958fed109c85d2b1a413c82b37e56a39766dd172
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762295
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63309}
2019-08-21 11:56:44 +00:00
Simon Zünd
c4e0dd7422 [cleanup] Re-enable clang-format for BuildAsciiCharFlags
With the added parenthesis from a previous CL, clang-format does a
decent job of formatting the nested ternary operator statement.

R=leszeks@chromium.org

Change-Id: If2f5db766b6234a44f771c167f9831adda5dbd43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762301
Auto-Submit: Simon Zünd <szuend@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63308}
2019-08-21 11:33:40 +00:00
Sigurd Schneider
ea42cf707c [debugger] Report function proxies as proxies, not as functions
This CL fixes a bug where function proxies were reported as functions
instead as proxies to devtools, which caused dev-tools to call methods
on the function, possibly triggering side-effects.

Change-Id: I1d5d234b784601bd4b7ec91107e4b0cf0d877d07
Bug: chromium:995753
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762303
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63307}
2019-08-21 11:03:30 +00:00
Santiago Aboy Solanes
18cdc2f0e8 [CSA] TNodify ArrayPrototype(Pop|Push)
Bug: v8:6949, v8:9396
Change-Id: Ibb0979979e7092521cacf0931a98b4d5aa39a695
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758306
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63306}
2019-08-21 10:45:48 +00:00
Maya Lekova
688b702eb6 [turbofan] Cleanup PropertyAccessInfos serialization
Bug: v8:7790
Change-Id: I5659dd0fd9cc9eb6c129dbdafbc678d6c62289c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763528
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63305}
2019-08-21 10:18:19 +00:00
Santiago Aboy Solanes
3c948f1cd5 [CSA][cleanup] TNodified Smi related methods, loads and stores
Methods TNodified:
* CodeStubAssembler::LoadWeakFixedArrayLength
* InterpreterAssembler::LoadAndUntagConstantPoolEntryAtOperandIndex
* InterpreterAssembler::LoadWeakFixedArrayLength

Bug: v8:6949, v8:9396
Change-Id: I30edf1799c35175799ebcca9d9e5d7a815997358
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755845
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63304}
2019-08-21 09:59:48 +00:00