Commit Graph

28731 Commits

Author SHA1 Message Date
Ng Zhi An
7d1c50d1cd [x64] Verify disassembly of SSE4_1 instructions
R=gdeepti@chromium.org

Bug: v8:12207
Change-Id: Ic0d408b3c7ecf69e45a794c6c96159df2bee80e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3180376
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77273}
2021-10-06 21:47:09 +00:00
Frank Tang
bb500e63ff [test262] Roll test262
50dd431..61339fd2

Bug: v8:7834, v8:12288, v8:11544, v8:11989
Change-Id: Ie7c799f1c757554bd66619fe65433921d4419d52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3206773
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77270}
2021-10-06 19:57:58 +00:00
Vasili Skurydzin
a03ed9d61b aix: Fix stack overflow error in debug mode on regress-1067270.js
Change-Id: I49a4e2f05028279cd69d3909a9ca80f4c0acb1c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3208649
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/main@{#77266}
2021-10-06 16:17:34 +00:00
Milad Fa
5f9dd79855 PPC: skip unsupported liftoff tests
Liftoff is temporarily disabled on PPC.
After https://crrev.com/c/3202593 the newly skipped tests
are failing with this error:
```
Check failed: tester.native_module()->GetCode(0)->is_liftoff()
```

Change-Id: I681a27930909fd6ac4e5087c2d03608b891a6066
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3208070
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77265}
2021-10-06 15:23:04 +00:00
Manos Koukoutos
1ac45dd90a [wasm-gc] Optionally skip null checks
Bug: v8:7748
Change-Id: Ia277cf58a0eea431c4f19198914c1539fd03bc06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3207898
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77264}
2021-10-06 15:12:44 +00:00
Manos Koukoutos
5889deb100 [wasm-gc] Optionally skip ref.cast type check
Bug: v8:7748
Change-Id: I5b0200560c5d77c1218142ca686c4e71c5106600
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3208027
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77263}
2021-10-06 13:50:04 +00:00
George Wort
4ddc53d807 Reland "[arm64][wasm-simd] Use Cm(0) for integer comparison with 0"
This is a reland of 16df1dfa13

No changes have been made to this reland as previous commit was reverted
due to a new test revealing an existing bug. This bug has now been fixed.

Original change's description:
> [arm64][wasm-simd] Use Cm(0) for integer comparison with 0
>
> Use an immediate zero operand for integer comparison when possible. This
> gives ~1% runtime performance improvement in some benchmarks on Neoverse
> N1.
>
> Change-Id: I727a8104f8e6ca3d122d6b5b8b3d38d7bdd76c47
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158327
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
> Cr-Commit-Position: refs/heads/main@{#76847}

Change-Id: I77d6923d79407a83becbd39970c6a3f62d3a304d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178482
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Rodolph Perfetta <rodolph.perfetta@arm.com>
Cr-Commit-Position: refs/heads/main@{#77260}
2021-10-06 12:59:27 +00:00
Andreas Haas
5578195db3 [wasm] Load --wasm_dynamic_tiering from the context
WebAssembly dynamic tiering should be tested with an origin trial. For
the origin trial the feature flag value has to be loaded from blink.
This CL stores the value of the --wasm-dynamic-tiering flag in the
compilation state, from where it gets passed forward to all uses of the
flag. The flag value gets loaded from blink when a new NativeModule is
created.

R=clemensb@chromium.org

Bug: v8:12281
Change-Id: Ia26355a665b7dfcdb47144863c1bec296774abb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3204963
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77256}
2021-10-06 12:12:54 +00:00
Jakob Gruber
2dd23f7575 [regexp] Ensure regress-1255368 runs only with irregexp
The expected assertion is specific to irregexp codegen.

Bug: chromium:1255368
Change-Id: I14d033285014727de2e63582ed798fc82570497d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3207892
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77254}
2021-10-06 11:36:34 +00:00
Andreas Haas
af1b9a9333 [wasm] Introduce a caching threshold
With dynamic tiering, typically not all functions of a WebAssembly
module get compiled with TurboFan, and therefore the code caching would
never get triggered. With this CL code caching is triggered whenever
{FLAG_wasm_caching_threshold} bytes of TurboFan code are generated.

This new caching event is only triggered when --wasm-dynamic-tiering is
enabled.

R=clemensb@chromium.org

Bug: v8:12281
Change-Id: I939325aea7e4310aa76c936636799661c05d4079
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3202593
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77251}
2021-10-06 10:30:13 +00:00
Clemens Backes
bab8254c32 [regexp][arm] Fix regexp assembler abortion
When aborting code generation, we need to call {AbortedCodeGeneration}
on the {MacroAssembler} contained in the {RegExpMacroAssemblerARM}.

R=jgruber@chromium.org

Bug: chromium:1255368
Change-Id: If37351e8f5715e23affd21ad2de8a8eaad3ea094
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3204965
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77250}
2021-10-06 10:02:13 +00:00
Hao Xu
b1b5cddab9 [sparkplug][x64] Enable short builtin calls in x64 when pointer compression is disabled
Allocate code range close to binary (<2GB) when pointer compression is
disabled. And enable short builtin calls if it succeeds.

Bug: v8:12045, v8:11527
Change-Id: I1a9d635b243337980fd75883d9802bc0cee75e43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3069457
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77248}
2021-10-06 09:04:43 +00:00
Frank Tang
34f278b8e4 Revert "[intl] Fix consistency in Intl API"
This reverts commit a1e6efd80c.

Reason for revert: Break Arm64

Original change's description:
> [intl] Fix consistency in Intl API
>
> Fix several edge cases consistency issues with ICU discovered by test262 test by
> using Intl Enumeration API
> 1. Work around ICU short coming of always fallback in currency display
>  name so when the fallback is "none" in DisplayNames, the force fallback
> code will produce the correct undefined from the of(currency_code) method.
> 2. Always check numbering system is not algorithm based numbering system
> to fix DateTimeFormat/RelativeTimeFormat/NumberFormat
> resolvedOptions().numberingSystem when the reqested numberingSystem is one
> of the numbering systems that we filter out the resources and not supported.
> 3. Generalize the iso8601 bit solution in DateTimeFormat and rename it to
> alt_calendar bit to also fix DateTimeFormat resolvedOptions report
> calendar as "islamic" while requesting "islamic-rgsa".
> 4. Work around reporting inconsistency of currency code and display name
> in ICU.
>
> Bug: v8:12209
> Change-Id: Ibd349ee55426fad7d6f20a5e93fb35ff7438e111
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3153576
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77242}

Bug: v8:12209
Change-Id: I6b8ac7dc89eda158e29c9d653825cb20a89341aa
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3207379
Reviewed-by: Frank Tang <ftang@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77246}
2021-10-06 08:51:02 +00:00
Camillo Bruni
d78d8b7d1c [api] Rename v8::Locker::IsActive to v8::Locker::WasEverUsed
IsActive is misleading as the current implementation forces to use
v8::Locker for all Isolate access once any Locker has been used in
the same process.

Bug: chromium:1240851
Change-Id: Ieb2cfa352313b6f2cbec1bafdbc94a3fc718f3d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190093
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77243}
2021-10-06 07:54:37 +00:00
Frank Tang
a1e6efd80c [intl] Fix consistency in Intl API
Fix several edge cases consistency issues with ICU discovered by test262 test by
using Intl Enumeration API
1. Work around ICU short coming of always fallback in currency display
 name so when the fallback is "none" in DisplayNames, the force fallback
code will produce the correct undefined from the of(currency_code) method.
2. Always check numbering system is not algorithm based numbering system
to fix DateTimeFormat/RelativeTimeFormat/NumberFormat
resolvedOptions().numberingSystem when the reqested numberingSystem is one
of the numbering systems that we filter out the resources and not supported.
3. Generalize the iso8601 bit solution in DateTimeFormat and rename it to
alt_calendar bit to also fix DateTimeFormat resolvedOptions report
calendar as "islamic" while requesting "islamic-rgsa".
4. Work around reporting inconsistency of currency code and display name
in ICU.

Bug: v8:12209
Change-Id: Ibd349ee55426fad7d6f20a5e93fb35ff7438e111
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3153576
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77242}
2021-10-06 06:33:46 +00:00
Ng Zhi An
1dfb8cd74a [x64][diasasm] Add more padding to disassembly
A mov can be up to 10 bytes, 6 for displacement, 4 for instr. Other
instructions (like pshufb) with a complex addressing mode can take 10
bytes too. So adjust the padding for disassembly of hex accordingly.
This requires fixing up all the test cases too.

Bug: v8:12207
Change-Id: I372d67a818a5dbfe6f49f67047493d7f67b59bcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3180375
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77241}
2021-10-06 00:08:45 +00:00
Clemens Backes
34d9cd040b [wasm] Fix code kind of imported math intrinsics
The error showed when printing the resulting code object, because the
tier was neither TurboFan nor Liftoff, even though the code was
registered as a standard wasm function (instead of an import wrapper).

R=jkummerow@chromium.org

Bug: chromium:1254674
Change-Id: I26482fd88d72403393428979abf08e9f60cd8c4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3202001
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77238}
2021-10-05 17:34:07 +00:00
Marja Hölttä
99abc4db85 [rab/gsab] TA.prototype.{every,some}: Support RAB / GSAB
Bug: v8:11111
Change-Id: I784a9d347fa4a21fd38f04b4d4e3a8a4398292c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3186438
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77234}
2021-10-05 14:10:56 +00:00
Milad Fa
634596521a PPC [liftoff]: skip liftoff related tests
Change-Id: Id4336aae4e8ef8974657a28cb5e8ea66a968c60c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3202474
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77233}
2021-10-05 12:33:28 +00:00
Ng Zhi An
f80eed4729 [x64] Verify disassembly of SSE3 and SSSE3 instructions
Bug: v8:12207
Change-Id: I6d8a62bb69c6011e6e7f6da2663f9db297b76f7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3180374
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77226}
2021-10-04 17:38:52 +00:00
Ng Zhi An
eb5656ef23 [x64] Verify disassembly of cmov instructions
Bug: v8:12207
Change-Id: Ic59dbbce330221c917f20c7d20ac7ddb421932ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3180373
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77222}
2021-10-04 16:27:52 +00:00
Clemens Backes
9021235d3b [wasm] Reenable shared memory test
This reenables a test which is passing, independent of missing
accounting for shared memory. This is because we repeatedly trigger a GC
explicitly in all workers.

R=dinfuehr@chromium.org

Bug: v8:12278
Change-Id: I73d1513d809787284af0be4956018806719acd50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3201995
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77219}
2021-10-04 15:12:14 +00:00
Maria Tîmbur
bbf476e729 [fuzzer] Add array.get and struct.get to GenerateOptRef
Add the array.get and struct.get functions to GenerateOptRef.

Bug: v8:11954
Change-Id: I39b03f909abfd19d89d7d6a76cdef5f0d5219b8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197689
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Cr-Commit-Position: refs/heads/main@{#77217}
2021-10-04 13:41:51 +00:00
Manos Koukoutos
efd42d689f [turbofan] Do not optimize Trap with siblings inside If
Trying to optimize in such case breaks down the optimization, as we
end up with potentially non-eliminatable nodes that depend on the dead
IfTrue/IfFalse node.
Drive-by: Clean up dead nodes with {Kill()}.

Bug: v8:11510, chromium:1255354

Change-Id: Ia89fe6c243974c3c2abac6ad80bd4677a935f637
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3200073
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77211}
2021-10-04 09:31:32 +00:00
Omer Katz
75c130a862 cppgc: Allow writes to dead slots in member assignment checks.
The checks for assignemnts to member during prefinalizers assumed the
slot has to live. It was assumed that if a slot is dead then we would
not be updating it.
Prefinalizers are allowed to touch dead objects and thus are techincally
allowed to write to dead slots. Such writes are usually redundant (the
object will be swept soon anyway) but are not always easy to get rid of.

Bug: chromium:1255152, v8:11749
Change-Id: I57e143abd53d434c3198616909c506eb70d8944b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3199800
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77208}
2021-10-04 08:37:21 +00:00
Patrick Thier
55374d16ba [regexp] Fix ScanForCaptures when invoked inside a character class.
When scanning for capture groups, we have to consider the case that the
current state is inside a character class. In that case skip everything
until the end of the current character class. Otherwise we would wrongly
count open brackets inside the character class as start of a capture
group.

Bug: chromium:1254704
Change-Id: I91d2177c464f7e507413d96216fe570253f17676
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3199871
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77204}
2021-10-04 06:41:42 +00:00
Yolanda Chen
ed7e3de95a [x64] Implement 256-bit assembly for vhaddps
Bug: v8:12228
Change-Id: Ie1f569c450f84a862c754b844e36349b1533872d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3194633
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Cr-Commit-Position: refs/heads/main@{#77202}
2021-10-02 04:24:22 +00:00
Ng Zhi An
a5692811bd [wasm] Check SIMD support when validating function sig params
Bug: chromium:1254675
Change-Id: I8c24d3956752a367a4fa60827ee47a589c48e699
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197700
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77201}
2021-10-01 17:57:57 +00:00
Omer Katz
e677a6f6b2 cppgc: Fix ephemeron iterations
If processing the marking worklists found new ephemeron pairs, but
processing the existing ephemeron pairs didn't mark new objects, marking
would stop and the newly discovered ephemeron pairs would not be
processed. This can lead to a marked key with an unmarked value.

Bug: chromium:1252878
Change-Id: I0f158f6f64490f1f06961520b4ba57fa204bd867
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3199872
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77197}
2021-10-01 14:00:27 +00:00
Maria Tîmbur
749e41d468 [fuzzer] ref.func should look up functions by signature
When we generate identical signatures in the fuzzer,
we generate one function for each of the copies.
However, when these functions are added to WasmModulBuilder,
all will be assigned the same signature index.
Therefore, when ref.func tries to find a function corresponding
to a signature index, it will fail, despite a matching signature
existing in the module.
This CL fixes this issue by looking up functions by signature
over signature index.

Bug: v8:11954, chromium:1254387
Change-Id: Iac8d5444d4914d993da63d0630ca4d95e671630c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197711
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Maria Tîmbur <mtimbur@google.com>
Cr-Commit-Position: refs/heads/main@{#77187}
2021-10-01 10:30:04 +00:00
Benedikt Meurer
6d25f20f35 [debug] Set breakpoints correctly right after function literals.
The logic to locate the correct function to set a breakpoint in based
on script position was treating SharedFunctionInfo::EndPosition() as
inclusive rather than exclusive. There are various assumptions all over
the Debugger that seem to demand this treatment for the toplevel script.
But it's definitely wrong for function literals.

Fixed: chromium:1253277
Change-Id: I3421703673f4d78aee28e923e03e2fca24bc06ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197715
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77186}
2021-10-01 10:11:45 +00:00
Benedikt Meurer
0195a5eb49 [inspector] Consistently treat promise rejections as side-effecting.
Previously we'd treat %_AsyncFunctionReject (and %AsyncFunctionReject)
as side-effect free (in async functions), but that's not correct, since
promise rejections have side-effects (at the very least triggering the
unhandled promise rejection machinery in the browser).

This required a minor refactoring as previously we'd classify functions
as side-effecting or not depending on whether they contain any calls to
side-effecting intrinsics, no matter whether this call is actually
executed or not. That would break REPL mode however if we'd generally
treat all async functions with %_AsyncFunctionReject intrinsic calls as
side-effecting, so instead of performing the intrinsic checks ahead of
time, we now perform the test at execution time.

Before: https://imgur.com/5BvJP9d.png
After: https://imgur.com/10FanNr.png
Fixed: chromium:1249275
Change-Id: Ib06f945ba21f1e06ee9b13a1363fad342464fd9a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197712
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77183}
2021-10-01 07:10:34 +00:00
Benedikt Meurer
0ea62c94f0 [inspector] Mark Intl builtins as side-effect free.
Fixed: chromium:1073804
Change-Id: Idb8b4b5558bb243eb1cbe70b2de1c22d8dd07f9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3198152
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77182}
2021-10-01 05:31:16 +00:00
Manos Koukoutos
29afe1e585 [turbofan] Optimize traps after Merge/IfTrue/IfFalse
We implement two optimizations for trap conditionals for patterns that
come up in wasm-gc.
In case of a Merge followed by a trap, where the path conditions of all
branches of the Merge contain the trap condition, we lift the trap into
the branches of the Merge.
In case of a Branch whose IfTrue branch is followed by a TrapIf with the
same condition, we replace it with the trap followed by the IfFalse
branch. Symmetrically for IfFalse and TrapUnless.

Bug: v8:7748
Change-Id: I43040aebe60eab7b2230fc3130e3b8250e8b2f45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190109
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77181}
2021-10-01 05:05:15 +00:00
Seth Brenith
25f0e32915 [torque] Make return types required
Currently, it is possible to declare macros, builtins, etc., without
specifying a return type, in which case the return type is treated as
void. This is confusing; the code is more clear if we require the return
type to be specified.

Aside from src/torque, this change is almost entirely just adding
`: void` until the compiler is happy. However, two intrinsics in
src/builtins/torque-internal.tq have been corrected to declare an
appropriate return type. Those two intrinsics were only used in code
generated within the compiler after the type-checking phase, so we never
noticed that their return types were declared incorrectly.

Bug: v8:7793
Change-Id: Ib7df88678c25393a9e3eba389a6a1c4d9233dcbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3176502
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77178}
2021-09-30 15:54:17 +00:00
Nico Hartmann
c9f69db900 [turbofan] No speculative BigInt operations on 32 bit architectures
Bug: chromium:1254191, v8:9407
Change-Id: Ieb22063dad1ea8dfde359662d0330e689b6b2e05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193547
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77177}
2021-09-30 15:49:17 +00:00
Manos Koukoutos
c1e26cc722 [wasm] Do not emit loop exits in inlined functions
Loop exits are only used during loop unrolling and are then removed, as
they cannot be handled by later optimization stages. Since unrolling
comes before inlining in the compilation pipeline, we should not emit
loop exits in inlined functions.

Bug: v8:12166
Change-Id: I28b3ebaf67c9e15b127eeb1a63906c4ecfd77480
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3195871
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77175}
2021-09-30 15:16:20 +00:00
Maya Lekova
ea64150b8a Revert "[inspector] Mark Intl builtins as side-effect free."
This reverts commit f40998322f.

Reason for revert: The new test is failing on noi18n, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/39705/blamelist

Original change's description:
> [inspector] Mark `Intl` builtins as side-effect free.
>
> Fixed: chromium:1073804
> Change-Id: Ia8cd29323e2b1c4faa0f115b5f60bc216b7813f1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3196175
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77171}

Change-Id: Ibb11ba2e835992e8b2fdd374bb38e245d32a1047
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3197192
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77173}
2021-09-30 14:54:19 +00:00
Benedikt Meurer
f40998322f [inspector] Mark Intl builtins as side-effect free.
Fixed: chromium:1073804
Change-Id: Ia8cd29323e2b1c4faa0f115b5f60bc216b7813f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3196175
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77171}
2021-09-30 14:25:31 +00:00
Manos Koukoutos
2ae6cda1ee [wasm-gc] Skip array.copy if length == 0
Bug: v8:7748
Change-Id: Id6adc39af6818f5a37307f26cfe40de11a0ce3c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3195872
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77169}
2021-09-30 13:23:11 +00:00
Clemens Backes
68ab78e24d [wasm] Fix error message for missing stack arguments
We currently could produce the error message 'not enough arguments on
the stack for block, expected 0 more'. This CL fixes this by printing
the available number of arguments and the needed number, and adds
DCHECKs to catch similar miscomputations in the future.

It also adds a new test that produced the broken error before, and
includes the expected failure message in a few more tests for
robustness.

R=manoskouk@chromium.org

Change-Id: Ia08863889ae36ae0a05d96d36e92295b7159a01e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3194264
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77167}
2021-09-30 12:29:01 +00:00
Clemens Backes
0cb6323bf1 [wasm] Skip slow test
The test allocates a lot of wasm memories. This got a low slower after
https://crrev.com/c/3190476, because we can now allocate more than 102
memories, and do not explicitly trigger a GC any more to get rid of
unused memories.
We should figure out how to tell the GC about the external memory such
that the memories get collected earlier.

R=ahaas@chromium.org

Bug: v8:12076, v8:12278
Change-Id: I9b8795a9999a806380d86f22e751de2727942648
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3196131
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77164}
2021-09-30 11:06:52 +00:00
Clemens Backes
2cbcf6e089 [wasm] Remove process-wide address space limit
The address space limit puts an arbitrary cap on the total reservation
size, thus limiting the total number of Wasm memories to around 100 on
64-bit systems.
Since the usable address space on 64 bit is much larger than the
1TB+4GB limit, this makes us reject code that we could otherwise just
execute.

This CL thus removes that limit completely.

See the linked issue for more discussion, including security
considerations.

R=jkummerow@chromium.org, rsesek@chromium.org

Bug: v8:12076
Change-Id: I1f61511d68efdab1f8cef4e09c0a39fc1d6fed60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190476
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77161}
2021-09-30 09:07:59 +00:00
Marja Hölttä
db50b49128 [csa, torque, cleanup] Rename CSA_ASSERT to CSA_DCHECK
It's confusing that we have CSA_CHECK and CSA_ASSERT and it's not
clear from the names that the former works in release mode and the
latter only in debug mode.

Renaming CSA_ASSERT to CSA_DCHECK makes it clear what it does. So now
we have CSA_CHECK and CSA_DCHECK and they're not confusing.

This also renames assert() in Torque to dcheck().

Bug: v8:12244
Change-Id: I6f25d431ebc6eec7ebe326b6b8ad3a0ac5e9a108
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190104
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77160}
2021-09-30 08:41:23 +00:00
Benedikt Meurer
d6c01059a5 [inspector] Align async task frame reporting for await.
The V8 Inspector was sending an additional frame as part of async stack
traces for async functions, which pointed to the first executed `await`
in the async function. This is leaking an implementation detail of how
(and more precisely when) the inspector decides to collect this stack
trace. From the users perspective the async part of the stack trace is
supposed to capture what happened _prior to the task_ - meaning in case
of async functions: What lead to the execution of the async function.
This is reflected by the fact that the DevTools front-end (and the V8
Inspector itself) performs post-processing on these async call stacks,
removing the misleading top frame from it. But this post-processing is
not applied consistently to all async stack traces (i.e. the Console
message stack traces don't get this), and potentially also not applied
consistently across consumers of the Chromium debugger backend.

Instead the V8 Inspector now removes the top frame itself and thus
reports `await` consistently with how other async tasks are reported to
debugger front-ends.

Note: This preserves backwards compatibility with old versions of
devtools-frontend, which do post-processing (for the Call Stack) only on
async stack traces marked with "async function", while we now mark these
async stack traces with "await" instead (aligned with what the front-end
is using as user visibile string anyways in the Call Stack section, and
this matching will be updated in a separate follow up CL to look for
"await" instead of "async function").

Before: https://imgur.com/kIrWcIc.png
After: https://imgur.com/HvZGqiP
Fixed: chromium:1254259
Bug: chromium:1229662
Change-Id: I57ce051a28892177b6b96221f083ae957f967e52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193535
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77157}
2021-09-30 07:56:15 +00:00
Zhao Jiazhong
129ef0a16b [mips64][loong64][codegen] Sign-extend uint32 values to 64-bit
Due to MIPS64 ISA feature, 32-bit values should be sign-extended
in 64-bit registers, no matter it's signed or unsigned.

Besides, LoongArch64 also has this feature, and a similar change
has been made before loong64 port's land in V8. This CL also make
a small fix for loong64.

Change-Id: Ib284662931082365f727925af61781e3653debc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193595
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Liu yu <liuyu@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#77154}
2021-09-30 07:53:06 +00:00
Clemens Backes
4b6ee11532 [asm] Fix importing monkey-patched objects
This fixes a long-standing TODO to disallow importing receivers that
have "toString" or "valueOf" patched. Calling those methods could have
observable side effects, so allowing that would require bigger
refactorings to ensure that we only call each such function exactly once
per import, and in the right order.
Since this use case is rare, we just forbid importing such receivers.

R=jkummerow@chromium.org

Bug: chromium:1248677
Change-Id: I99bbd7db950ec3c7ac9cc1f59e8c476688e7d7b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3190475
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77149}
2021-09-29 18:19:30 +00:00
Omer Katz
f001bfd787 Reland "Reland "Reland "cppgc: Enable checks for assignments in prefinalizers"""
This is a reland of 2db5067031

crrev.com/c/3182223 resolves all known issues (and should prevent
additional issues in the future).

Original change's description:
> Reland "Reland "cppgc: Enable checks for assignments in prefinalizers""
>
> This is a reland of adb6276f4a
>
> Causes for previous revert was addressed by crbug.com/3140387 and
> crbug.com/3163579.
>
> Original change's description:
> > Reland "cppgc: Enable checks for assignments in prefinalizers"
> >
> > This is a reland of edcc8ff5b5
> >
> > Cause for previous revert was addressed by crbug.com/1241773.
> >
> > Original change's description:
> > > cppgc: Enable checks for assignments in prefinalizers
> > >
> > > Bug: v8:11749
> > > Change-Id: Ic027f732030fb6a2befeffeca9db2eacfd0830a5
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3099953
> > > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > > Cr-Commit-Position: refs/heads/main@{#76370}
> >
> > Bug: v8:11749
> > Change-Id: I57fc138ace002d41e54f7f70250e4d19bc9262b0
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3122153
> > Auto-Submit: Omer Katz <omerkatz@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#76553}
>
> Bug: v8:11749
> Change-Id: I138ca374314108f0f23e234a8fd90d15d912120d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168280
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76971}

Bug: v8:11749
Change-Id: I8bf48cecde910e74f40cf0cd6aa8a5ed19de1584
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3182224
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77143}
2021-09-29 16:02:17 +00:00
Jakob Gruber
77906a700c [regexp] Hide the generic JSRegExp::DataAt/SetDataAt accessors
.. and refactor js-regexp.h.

- Hide the generic DataAt/SetDataAt accessors and replace them by
  dedicated accessors. Use the common lower_case naming scheme for
  these.
- Shuffle around definitions in js-regexp.h s.t. they are in a
  meaningful order.
- Dedupe the source/flags accessors - these fields are stored both
  on the instance and on the data array. We keep only accessors for
  the instance. Previously, these were disambiguated through naming
  oddities (e.g. Pattern() returned data->source).

Change-Id: I3d53c8b095f0d59621ff779608438f7fa5e8c92a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193534
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77138}
2021-09-29 11:37:41 +00:00
Jakob Gruber
8965d90362 Reland "[regexp] Reorganize and deduplicate in the regexp parser"
This is a reland of 7d849870ff

Original change's description:
> [regexp] Reorganize and deduplicate in the regexp parser
>
> The parser is organized in a somewhat tricky way s.t. it can be
> hard to map the implementation back to the specified grammar.
>
> In particular, the logic for CharacterClassEscape, ClassEscape,
> and CharacterEscape was implemented twice - once inside a character
> class, once outside.
>
> This CL refactors related logic to have only a single implementation.
>
> As a drive-by, fix one related inconsistency related to \k inside
> a character class.
>
> Fixed: v8:10602
> Change-Id: I5858840159694fa6f8d1aa857027db80754e3dfd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3178966
> Reviewed-by: Mathias Bynens <mathias@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77114}

Fixed: v8:10602,chromium:1253976
Change-Id: I9e7cc6a34d3be06e1a68895775aa50b0eee78c57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3193531
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77135}
2021-09-29 07:33:12 +00:00