Implement conversion of an i8x16 node to a f32x4 node.
Bug: v8:10507
Change-Id: Ifefffb779dbf25b57eae278afe41c11b41c949ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2185472
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67659}
Move them all into wasm-macro-gen.h, other opcodes have their macros
there as well. This will make reusing these macros easier when we have
other test files for SIMD. (An upcoming one is for scalar lowering
tests.)
Change-Id: I6c21100ce490abbc26f80a0d204815687fd62f00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2185471
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67658}
When the memory reducer decides whether to do the next GC or not, it
takes into account the number of detached contexts. This may lead to
redundant GCs if the detached contexts are leaking and stay reachable.
With the unified heap all unreachable detached contexts are freed in
one GC, so this heuristic is no longer necessary.
Bug: chromium:1072746
Change-Id: I869fd6ca2008135dfea39e7ceeb01fdc9ead22be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187493
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67653}
In upcoming work these flags will be used to configure the
experimental native context independent code feature.
Build-time flags:
v8_enable_nci_code
Defines:
V8_ENABLE_NCI_CODE
Runtime flags:
--turbo-nci
--turbo-nci-as-highest_tier
--print-nci-code
--trace-turbo-nci
Drive-by: Remove unused embedded builtins and jitless defines.
Bug: v8:8888
Change-Id: I4466b440634a787bd84b052fe2466b22540216a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184295
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67650}
The snapshot's Checksum function internally uses adler32, which
appears to be significantly faster than base::hash_range and almost as
fast as doing nothing at all.
Test times, measured with
$ time tools/run-tests.py --outdir out/release-with-dchecks/
--exit-after-n-failures=1 --quickcheck
base::hash_range: 1m35s
adler32: 1m15s
nop: 1m13s
Bug: chromium:1047818
Change-Id: I8def62f6276a3d06d06911abf5368f59331245ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187492
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67649}
When the garbage collector needs to get a struct's type information,
it must be prepared to deal with forwarding pointers, as those will
only get cleaned up at the end of the GC cycle.
Bug: v8:7748
Change-Id: Ifdfdffcef27d1dbe07c86a3abd17711f46c1b900
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187732
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67648}
The code generated by TurboFan was incorrect when comparing to
non-oddball undetectables using abstract equality. In particular,
%GetUndetectable() == %GetUndetectable() did not return false.
Bug: chromium:1051008
Change-Id: Ib62adc72a20aa6cca9ef6499d5fe7429f04623cf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187498
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67647}
This CL cleans up CompareOperationFeedback by replacing it with a
composable set of flags. The interpreter is changed to collect
more specific feedback for abstract equality, especially if oddballs
are involved.
TurboFan is changed to construct SpeculativeNumberEqual operator
instead of the generic JSEqual in many more cases. This change has
shown a local speedup of a factor of 3-10, because the specific
operator is way faster than calling into the generic builtin, but
it also enables additional optimizations, further improving
runtime performance.
Bug: v8:5660
Change-Id: I856752caa707e9a4f742c6e7a9c75552fb431d28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162854
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67645}
This CL introduces:
- Worklist
- MarkingHandler to manage gc marking phase
- Integration into CollectGarbage for atomic pause GC
- MarkingVisitor for main thread marking
Still missing from this CL:
- Proper handling for stack scanning
- Handling of previously not fully constructed objects
Bug: chromium:1056170
Change-Id: I70ac8534dfb898777cf3a06e3119cac8072174fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2170526
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67642}
We know the array CodeGenerator::deoptimization_literals_ is corrupted
somehow. Additional checks in place to validate.
Bug: chromium:1027130
Change-Id: Ie0146003f096d24e67aeb382372bca8472548c2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182636
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67641}
Currently WebAssembly breakpoint information survive disabling and
re-enabling the debugger. This is different from JavaScript, where
they are all removed. The frontend is expected to re-set the
breakpoint then.
Thus this CL remembers all wasm scripts where breakpoints have been set
in the Debug object, and clears them all when the debugger gets
disabled.
R=bmeurer@chromium.org
Bug: v8:10403
Change-Id: I5f8a8f3123727c954921920897ee7bf3b73f0ae8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184969
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67639}
After sorting the work array but before writing the values back into
the actual receiver, we have an accessor check. This accessor check
needs to be stricter, in order to catch Array prototype protector
cell invalidations.
R=jgruber@chromium.org
Bug: chromium:1077508
Change-Id: I3c3bd4711f9019f9d4423701724319eee9d800a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2187171
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67638}
There's no need for them to be in NativeContext.
This CL moves the minimal subset of SFIs related to async iterators.
Bug: v8:10482
Change-Id: I80a34a886387398e6565afe77ab99f389d2ccabd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184233
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67636}
Returned LABs can be of size less than sizeof(FreeListEntry).
Bug: chromium:1056170
Change-Id: Ib4094701472ce7cb5ee20b9fe632651570832dc9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183051
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67635}
Destructors are allowed to allocate without triggering recursive
garbage collections.
This changes NoGCScope to provide a soft-bailout for garbage
collections to avoid introducing yet another scope.
Bug: chromium:1056170
Change-Id: I0fe51a21977ae954221b6b64b2f6e938ff6d3264
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2185131
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67632}
Adds a public method that embedders can use to trigger garbage
collections. Such garbage collections are always required to have a
source and reason specifying which components calls it why.
Change-Id: I6ae983f99227febc1b7f0dd15c191d5b1eaaf3f3
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181332
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67631}
RunSingleMicrotask calls Runtime::ReportMessage, but the implementation
of ReportMessage would unconditionally discard these exceptions. This
CL removes all of the intermediate logic and directly calls
MessageHandler::ReportMessage, restoring the ability of
RunSingleMicrotask to report exceptions that occur in microtasks.
Bug: v8:8326
Change-Id: I493de74383b2ab191d786611fb9eba9d27e7a243
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162121
Commit-Queue: Gus Caplan <me@gus.host>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67630}
This CL introduces VOR and VSRO opcodes which get used
for implementing F64x2Splat, I64x2Splat and F32x4Splat.
Change-Id: I64b4cd340fbe9ecf6a789a91e3219b6ad83ce3f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184830
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67627}
The location of the immediates depend on the opcode length if a
s128.load/store was encoded using multiple bytes.
Bug: v8:10258
Change-Id: I09de8a37d442c0711de96ba4bb1746ae6732d83e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182960
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67623}
- Rewrites the following builtins in Torque:
WasmThrow
WasmRethrow
WasmStackGuard
WasmStackOverflow
WasmTraceMemory
WasmAllocateJSArray
ThrowWasmTrap* builtins
- Changes return type of LoadContext* functions to NativeContext,
so we can more easily construct JS objects.
Change-Id: Id034358f9f15e0acc58fd1f493b15d1cfd177a23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2174830
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67621}
This is a reland of 8c8e6b4117
Timeouts seem unrelated.
Original change's description:
> [offthread] Serialize new-space objects into old space
>
> If an object made it into serialization, it probably deserves to be in
> old space when it is deserialized. This will also make off-thread
> deserialization simpler, as there is no off-thread new space.
>
> Bug: chromium:1075999
> Change-Id: Icabf2f0ae0a3e0205a1094dd0ffe675e69bd1d8e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184291
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67606}
TBR=jgruber@chromium.org,ulan@chromium.org
Bug: chromium:1075999
Change-Id: Iac4e4eebeca1c343250269cdaad17e23645e9e2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184970
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67620}
This prevents bug flooding based on differences from calling
%GetOptimizationStatus in correctness tests. It is supposed to
be suppressed with --allow-natives-for-differential-fuzzing.
This ensures early bail-out in case the flag is forgotten at
some point. The v8_sanity_checks.js file is executed before
each correctness test case for this purpose.
NOTRY=true
Bug: chromium:1044942
Change-Id: I74a836a82562604b35e94e5e123a2a8bff939423
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184294
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67618}
and avoid runtime calls for struct allocation. We can load the
map from the instance and do the allocation in a CSA builtin.
Bug: v8:7748
Change-Id: I76dfcb6c28800d69046b3d7381d3b8ba774fbf09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169099
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67617}
On the PredictablePlatform, worker tasks were executed immediately
instead of posting them in a task queue first. This approach caused
problems because the execution of the worker task blocked progress of
the posting task, and the worker task was always executed in the
context of the posting task, e.g. with an already open HandleScope.
With this CL, worker tasks get posted into the foreground task queue
of the nullptr isolate instead of executing them immediately.
The tasks of the nullptr isolate are then executed after a task of
some other task queue is executed. As the worker tasks are thereby
executed on the same thread as foreground tasks, the behavior is
deterministic.
A consequence of this approach is that each pumping the message loop
of an Isolate may also execute other Isolate's background tasks.
This approach is needed because we don't have a BackgroundTaskRunner but
merely a CallOnWorkerThread method that doesn't know which Isolate the
task corresponds to.
R=clemensb@chromium.org, mlippautz@chromium.org
Bug: v8:9670
Change-Id: I6847ae042146431bc2376d27280be8829f529b95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182453
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67616}
This reverts commit 8c8e6b4117.
Reason for revert: Makes Mac64 debug quite flaky: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20-%20debug/28766
Original change's description:
> [offthread] Serialize new-space objects into old space
>
> If an object made it into serialization, it probably deserves to be in
> old space when it is deserialized. This will also make off-thread
> deserialization simpler, as there is no off-thread new space.
>
> Bug: chromium:1075999
> Change-Id: Icabf2f0ae0a3e0205a1094dd0ffe675e69bd1d8e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184291
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67606}
TBR=ulan@chromium.org,jgruber@chromium.org,leszeks@chromium.org
Change-Id: I0baca3c3b7985fcda6b9055f93111ec99c207d29
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1075999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183925
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67615}
Motivation:
There were three versions of type decoding for wasm in the codebase.
Not all of them decoded gc types with immediates (reference types)
correctly.
Changes:
- Refactor the wasm binary decoder for unify type decoding.
- Update BranchTypeImmediate and SelectTypeImmediate to handle
reference types.
Reference: https://github.com/WebAssembly/gcR=jkummerow@chromium.org
Bug: v8:7748
Change-Id: I33b38c911d366570ca6ef2723ded5205698e1979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179003
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67614}
This is a reland of afd9493a34
LSAN_IGNORE_OBJECTs for FreeListCategories are now removed.
Original change's description:
> [heap] Remove FreeList when sealing RO_SPACE
>
> This releases the FreeListCategories for each MemoryChunk when sealing
> the ReadOnlySpace and deletes the FreeList.
>
> Additionally this also calls
> ReleaseAllocatedMemoryNeededForWritableChunk for each MemoryChunk when
> sealing when pointer compression is enabled even if no memory is to be
> shared.
>
> Bug: v8:10454
> Change-Id: I45aec59f6d4fddedeb713e13095f58974cda279e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184292
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67598}
Bug: v8:10454
Change-Id: I08fcd122437c65c01af526fa8316d5c9e3ebeb3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184297
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67613}
These will be used by ic-collecting builtins called from both bytecode
handlers and js-generic-lowering.
For now only x64 is implemented.
Bug: v8:8888
Change-Id: I12a21b40061b7cb6c9b3cbad6134e7457a6cfa44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184237
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67611}
When the input to a speculative BigInt operation was an undefined
constant, no necessary type check was inserted by the
RepresentationChanger. This CL fixes this.
Bug: chromium:1077804
Change-Id: I3d4e15b1e018803d56e46c7b23b9d4b03832ba8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182455
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67610}
