Commit Graph

65585 Commits

Author SHA1 Message Date
Camillo Bruni
6c69379497 [tools] Add V8CustomElement.update method
Drive-by-fix:
- Remove duplicated LazyTable
- Introduce more pseudo private _* fields
- Remove MapPanel.mapDetails getter
- Rename MapDetails.setSelectedMap to .map

Bug: v8:10644
Change-Id: I0f976ab86f24de2677e024e386e7d4169c9abbb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523192
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71093}
2020-11-10 16:25:10 +00:00
Junliang Yan
7555761b9b PPC/s390: initialize argc register before calling interpreter
Change-Id: I5cc99ac457d6d9e6317b5a910ad11c0543130e45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2528900
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71092}
2020-11-10 15:36:28 +00:00
Manos Koukoutos
f792114b04 [wasm-gc] Don't only consider 7 bits of i33 values
When comparing a decoded i33 value (v) to an expected value (ex) given
as a 7-bit unsigned byte, we first truncated (v) to 7 bits. This
resulted in values which coincide with (ex) only in the last 7 digits to
erroneously be accepted.

Bug: v8:7748
Change-Id: Iaf40d5be7bbfa80535cec9109c7dd19a9d96edaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526387
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71091}
2020-11-10 15:15:57 +00:00
Victor Gomes
8a5cb3dc17 [arm64] Remove arguments adaptor frame
- It also fixes padding issues in the deoptimizer

Change-Id: Icac62892657830d067b7c21ff45b43ba58e350d9
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498694
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71090}
2020-11-10 14:56:07 +00:00
Clemens Backes
fbb3353c29 [wasm] Fix data race on current_compile_job_
A new compile job can be scheduled from any thread, and
{current_compile_job_} is documented to be protected by {mutex_}. Hence
take the mutex before writing that field.

R=thibaudm@chromium.org, ahaas@chromium.org

Bug: v8:11089
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Change-Id: I2d3b2c51a7d24c7e827bb7ddc9c76b718c2ccb4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529140
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71089}
2020-11-10 14:37:07 +00:00
Michael Achenbach
79cf44cf69 Revert "Reland "Temporary compilation failure to test tree closing""
This reverts commit df156ffcba.

Reason for revert: experiment over

Original change's description:
> Reland "Temporary compilation failure to test tree closing"
>
> This is a reland of e3ec228c0a
>
> Original change's description:
> > Temporary compilation failure to test tree closing
> >
> > This will be reverted after testing the new tree closer.
> >
> > No-Try: true
> > Bug: v8:10661
> > Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
> > Reviewed-by: Maya Lekova <mslekova@chromium.org>
> > Reviewed-by: Liviu Rau <liviurau@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#71081}
>
> No-Try: true
> Bug: v8:10661
> Change-Id: Ia628c5eb7609b57c9ad7ebe042e63d056e0ff85f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529144
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71085}

TBR=machenbach@chromium.org,clemensb@chromium.org,mslekova@chromium.org,liviurau@chromium.org

Change-Id: I11d7c3de64ef26c7d53210463d5477d15fa925b7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10661
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529146
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71088}
2020-11-10 14:07:01 +00:00
Marja Hölttä
04f5085dfe [super] Disable --deopt-every-n-times in super property optimization tests
The tests assert that funcs are optimized / deoptimized a certain way.

Bug: v8:9237, v8:11138
Change-Id: Ia4879e722e442be52de0bf93919eb03fecb88147
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529136
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71087}
2020-11-10 13:50:07 +00:00
Ross McIlroy
d54b3afcb0 [csa][cleanup] TNodify interpreter-intrinsics.
Also moves CallStubN to be a private member of code-assembler.

BUG=v8:6949,v8:11074

Change-Id: I88a36819aead919cc4f4deff201925562fc9f74f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527061
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71086}
2020-11-10 13:45:47 +00:00
Michael Achenbach
df156ffcba Reland "Temporary compilation failure to test tree closing"
This is a reland of e3ec228c0a

Original change's description:
> Temporary compilation failure to test tree closing
>
> This will be reverted after testing the new tree closer.
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71081}

No-Try: true
Bug: v8:10661
Change-Id: Ia628c5eb7609b57c9ad7ebe042e63d056e0ff85f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529144
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71085}
2020-11-10 13:41:57 +00:00
Jakob Gruber
09ef5458c0 [factory] Refactor JSFunction construction
Construction of JSFunction objects is complex, mostly due to the
existence of multiple functions kinds (JS, wasm, builtin, test, ...)
that are all created slightly differently. For example, JS functions
may come with an existing FeedbackCell (and FeedbackVector), while
builtins and wasm functions always use the many_closures_cell (without
a vector).

Prior to this CL, construction logic was scattered over a family of
7 functions, without a clearly defined chokepoint for header
initialization. This was hard to understand, hard to modify, and
needlessly inefficient (by setting some fields twice).

This CL fixes all that by introducing JSFunctionBuilder. The BuildRaw
method is the chokepoint for allocation and initialization, and Build
performs common pre- and post-work.

Future work:
- Remove now-deprecated functions.
- Untangle SFI/Map/JSFunction construction and remove
  Factory::NewFunction and NewFunctionArgs.

Bug: v8:8888
Change-Id: I709a2a44ee02e10593a4c9afe43d4d2c6d6351c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527098
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71084}
2020-11-10 13:01:56 +00:00
Michael Achenbach
6b5d6d105f Revert "Temporary failure for tree-closer test"
This reverts commit a9252d7085.

Reason for revert: experiment done

Original change's description:
> Temporary failure for tree-closer test
>
> CL to test tree-closure. This CL will be reverted afterwards.
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I07cdedc530dd3718a9537bca51fbb40b83a3e8b9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527100
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71075}

TBR=machenbach@chromium.org,mslekova@chromium.org,liviurau@chromium.org

Change-Id: I830daa57a10f284d96e8532b6117d627817f1da8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10661
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529138
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71083}
2020-11-10 12:57:51 +00:00
Michael Achenbach
62b59b7f7a Revert "Temporary compilation failure to test tree closing"
This reverts commit e3ec228c0a.

Reason for revert: experiment done

Original change's description:
> Temporary compilation failure to test tree closing
>
> This will be reverted after testing the new tree closer.
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71081}

TBR=machenbach@chromium.org,clemensb@chromium.org,mslekova@chromium.org,liviurau@chromium.org

Change-Id: I16b03d0e86b23cbf55fcd3e7f40976897e138229
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10661
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529137
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71082}
2020-11-10 12:56:48 +00:00
Michael Achenbach
e3ec228c0a Temporary compilation failure to test tree closing
This will be reverted after testing the new tree closer.

No-Try: true
Bug: v8:10661
Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71081}
2020-11-10 12:35:04 +00:00
Camillo Bruni
400b6e7f9d [tools] Modernize tools .mjs files
This is mostly an auto-conversion done by several tools.

- use let / const
- use arrow functions
- use template strings

There are some additional manual rewrite required to modernize the
code further.

Change-Id: I63a7a43b05b14b33ad9941350d3d5f26aab10ba0
Bug: v8:10667
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2519564
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71080}
2020-11-10 12:32:26 +00:00
Tobias Tebbi
4beadfde31 [torque] fully port Oddball and add @customMap annotation
Bug: v8:7793
TBR=hpayer@chromium.org

Change-Id: I88644c9476b74f57d3cf7a3056a9b70f1467b96d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489689
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71079}
2020-11-10 12:20:34 +00:00
Clemens Backes
ef2363db0b Revert "[wasm]: Use CancelAndDetach and barrier on BackgroundCompileJob."
This reverts commit a74f9eb689.

Reason for revert: Data race: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34121

Original change's description:
> [wasm]: Use CancelAndDetach and barrier on BackgroundCompileJob.
>
> To avoid keeping around a list of job handles, CancelAndDetach() is
> used in CancelCompilation. Dependency on WasmEngine is handled by a
> barrier that waits on all jobs to finish.
>
>
> Change-Id: I685a1737354b2fb3d1f4b98580926a93da38be5b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498659
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71074}

TBR=ulan@chromium.org,jkummerow@chromium.org,clemensb@chromium.org,etiennep@chromium.org

Change-Id: I9288abd03b572059ac5278d2e5b84bd418b4d69d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529132
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71078}
2020-11-10 11:59:36 +00:00
Marja Hölttä
0be88a57e5 [super] Optimize super property access in JSNativeContextSpecialization
This is the second reland of
https://chromium-review.googlesource.com/c/v8/v8/+/2487122 , this time
without RuntimeCallStats in the tests.

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I782df6e032ff8191082b425e68d68b69cef0a560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527092
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71077}
2020-11-10 11:24:44 +00:00
Sathya Gunasekaran
981bb48d63 [tools] Format JS files in system-analyzer/ if they're unformatted
Instead of just warning, let's try to format the files as well

Bug: v8:10670
Change-Id: I0dfbdc0ed4a96af7f2a2a472f1d0d3d332d39c90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523193
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71076}
2020-11-10 11:02:32 +00:00
Michael Achenbach
a9252d7085 Temporary failure for tree-closer test
CL to test tree-closure. This CL will be reverted afterwards.

No-Try: true
Bug: v8:10661
Change-Id: I07cdedc530dd3718a9537bca51fbb40b83a3e8b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527100
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71075}
2020-11-10 10:44:16 +00:00
Etienne Pierre-doray
a74f9eb689 [wasm]: Use CancelAndDetach and barrier on BackgroundCompileJob.
To avoid keeping around a list of job handles, CancelAndDetach() is
used in CancelCompilation. Dependency on WasmEngine is handled by a
barrier that waits on all jobs to finish.


Change-Id: I685a1737354b2fb3d1f4b98580926a93da38be5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498659
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71074}
2020-11-10 10:14:16 +00:00
Georg Neis
b1d9bbce51 [compiler] Turn a DCHECK into a CHECK in ValueMatcher::ResolvedValue
Bug: chromium:1147206
Change-Id: I53bc7fc6326c6656c154f1bdebf0ddebc178e146
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527093
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71073}
2020-11-10 09:44:24 +00:00
Georg Neis
a2d2ab46e6 Reland "[cleanup] Replace more uses of Min/Max by std::min/max"
This is a reland of 3b6f7802e5.
The compilation failures due to call-by-reference have been fixed.

Original change's description:
> [cleanup] Replace more uses of Min/Max by std::min/max
>
> Bug: v8:11074
> Change-Id: I94d53ea0aac123459ae60fc61748fedf0faac2f4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2521147
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Auto-Submit: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71022}

Bug: v8:11074
Change-Id: Ia01bfd014e481d3a13b306974f6837a65391b19c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527064
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71072}
2020-11-10 08:57:54 +00:00
Michael Achenbach
394eedcdd4 Revert "Add regression tests for 4 calendar bugs"
This reverts commit 915f729afb.

Reason for revert: Failing on Android:
https://ci.chromium.org/p/v8/builders/ci/V8%20Android%20Arm64%20-%20N5X/11321

Original change's description:
> Add regression tests for 4 calendar bugs
>
> These bugs was fixed by ICU68
>
> Bug: v8:10526, v8:10527, v8:10528, v8:10529
> Change-Id: I8d0dcb52d849f742e0a29314ac8a148370f60a1a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527086
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71062}

TBR=jkummerow@chromium.org,ftang@chromium.org,syg@chromium.org

Change-Id: I3173d1e7e991de63a8a6fa73be9b931faf6d9ef6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10526
Bug: v8:10527
Bug: v8:10528
Bug: v8:10529
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527091
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71071}
2020-11-10 08:18:45 +00:00
v8-ci-autoroll-builder
8eabf72217 Update V8 DEPS.
Rolling v8/build: 6dd14a4..2101eff

Rolling v8/third_party/aemu-linux-x64: a1yTNBS-h5GEUTwaKTzyZcC4sisB88wYX7_tvAkzSP0C..xP4TXh9wWGTG0qr4y6eFcUO_0HOBmt3vorgtVmpwBJsC

Rolling v8/third_party/depot_tools: b674f8a..982b2a7

Rolling v8/tools/clang: 192a0ed..a37c085

Rolling v8/tools/luci-go: git_revision:576741d3eed0fa33971fb34cd823650e6f5b47fb..git_revision:1a022d3a4c50be4207ee93451255d71896416596

Rolling v8/tools/luci-go: git_revision:576741d3eed0fa33971fb34cd823650e6f5b47fb..git_revision:1a022d3a4c50be4207ee93451255d71896416596

Rolling v8/tools/luci-go: git_revision:576741d3eed0fa33971fb34cd823650e6f5b47fb..git_revision:1a022d3a4c50be4207ee93451255d71896416596

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I91f9a8e5079721ca76c34bbd8e309e7567fbcace
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2528755
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#71070}
2020-11-10 03:54:04 +00:00
Zhi An Ng
1c7bcc8b22 [scalar-lowering] Implement lowering for load zero
Bug: v8:11038
Change-Id: Ia8b8c1c438d67ccfe5f27c452852c0f096062f56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2503877
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71069}
2020-11-10 02:39:44 +00:00
Zhi An Ng
062ba7e78f [wasm-simd][arm64] Prototype extended pairwise additions
Prototype i32x4.extadd_pairwise_i16x8_{s,u} and
i16x8.extadd_pairwise_i8x16{s,u} (names not confirmed) on ARM64 and
interpreter. With a simple test case.

Bug: v8:11086
Change-Id: If1ffc04e179e86ca5cc209bf9ef9d337298e3cc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2513872
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71068}
2020-11-10 02:19:04 +00:00
Zhi An Ng
2fed939052 [arm][simulator] Introduce helpers for implementing NEON operations
Introduce some helper functions to implement NEON operations that were
performing unary operations or binary operations lane-wise.

Not everything uses these helpers yet, in particular pairwise
operations, or zip/transpose.

Bug: v8:11074
Change-Id: Ia7e5b13ae79cd166c47535139d92adb7f7a7c1ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516301
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71067}
2020-11-10 02:02:14 +00:00
Daniel Clark
ea0ccc7ee3 Plumb import assertions through SourceTextModuleDescriptor's ModuleRequestMap
This change plumbs import assertions from SourceTextModuleDescriptor's
ModuleRequestMap into SourceTextModuleInfo via a new ModuleRequest
type, where previously there had been only the specifier.

SourceTextModuleDescriptor::module_map now deduplicates module requests
using the specifier and the import assertions.  Continuing to use the
specifier alone would cause a loss of information in the event that
a module imports from the same specifier multiple times using different
sets of assertions.  Failing to deduplicate at all would result in
multiple requests for statements like `import {a,b,c} from "foo.js"`,
which would be a potential performance issue.  See design doc at
https://docs.google.com/document/d/1yuXgNHSbTAPubT1Mg0JXp5uTrfirkvO1g5cHHCe-LmY
for more detail on this decision.

v8::internal::ModuleRequest holds the assertions as an array of the form
[key1, value1, position1, key2, value2, assertion2, ...].  However the
parser still needs to use a map, since duplicate assertion keys need to
be detected at parse time.  A follow-up  change will ensure that
assertions are sorted using a proper lexicographic sort.

Bug: v8:10958
Change-Id: Iff13fb9a37d58fc1622cd3cce78925ad2b7a14bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493060
Commit-Queue: Dan Clark <daniec@microsoft.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71066}
2020-11-10 01:27:34 +00:00
Zhi An Ng
e42e855462 [cleanup] Remove DISALLOW_COPY_AND_ASSIGN in test/{cctest,fuzzer,inspector}
Bug: v8:11074
Change-Id: I4e53abf1c4d5dcf8342eff98a699afeac7719d36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2522731
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71065}
2020-11-10 01:24:43 +00:00
Zhi An Ng
2565c9dd9a [cleanup] Remove DISALLOW_COPY_AND_ASSIGN in interpreter/
Bug: v8:11074
Change-Id: I181af917c141fb327213ae6303057f1bb87f4ac4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2524418
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71064}
2020-11-10 01:02:14 +00:00
Frank Tang
a547b61da1 [intl] skip tz test on android
Bug: v8:11131
Change-Id: I7007a11e3cfc5ea4ebab6bedc8b6ba4c7cafa456
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527787
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71063}
2020-11-10 00:25:04 +00:00
Frank Tang
915f729afb Add regression tests for 4 calendar bugs
These bugs was fixed by ICU68

Bug: v8:10526, v8:10527, v8:10528, v8:10529
Change-Id: I8d0dcb52d849f742e0a29314ac8a148370f60a1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527086
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71062}
2020-11-09 23:50:24 +00:00
Milad Fa
ffaac6bbe2 PPC: set DoubleToInt64 overflow to zero
fctidz saturates the output in case of overflow. This cl
makes the behaviour similar to s390 and sets the output to zero.

Change-Id: Ic043625c46147eb02a65dfdbbcd883a067ba6981
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527783
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#71061}
2020-11-09 21:39:13 +00:00
Clemens Backes
89ca48c907 [wasm][liftoff] Fix register usage for i64_addi
The arm implementation made the assumption that the {lhs} and {dst}
registers are either the same, or there is no overlap. This assumption
does not hold.
ia32 on the other hand has a lot of complicated logic (and unnecessary
code generation) for different cases of overlap.

This CL fixes the arm issue *and* simplifies the ia32 logic by making
the arm assumption hold, and using it to eliminate special handling on
ia32.

R=thibaudm@chromium.org

Bug: chromium:1146861
Change-Id: I8753c2ed70349e735c03293130c899c0c8a3a671
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526388
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71060}
2020-11-09 18:30:39 +00:00
Clemens Backes
4cf5d200ab [inspector][fuzzer] Don't exit on uncaught exceptions
For the fuzzer it's unwise to exit on uncaught exceptions, as this
terminates the whole fuzzing process. Just ignore those exceptions
instead.

Drive-by: Fix a typo.

R=szuend@chromium.org

Bug: chromium:1142437
Change-Id: Ided1c0f35840c158f157acd8c0bb1c12ecf8a37f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526386
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71059}
2020-11-09 18:02:47 +00:00
Shu-yu Guo
d9a0b7b11e Revert "[super] Optimize super property access in JSNativeContextSpecialization"
This reverts commit 30ca51ec48.

Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34104

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71052}

TBR=marja@chromium.org,neis@chromium.org

Change-Id: I2b10963a9a99f7b482f1014472a6a281fcf9b8c1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527184
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71058}
2020-11-09 17:42:41 +00:00
Ulan Degenbaev
f7e484ee29 [heap] Fix a data race in a DCHECK in FreeLinearAllocationArea
The function was using an non-atomic marking state to check the color
of the object. This is incorrect because concurrent marking may be
running while the linear allocation area is freed.

Bug: chromium:1139165
Change-Id: I20ef22908dfd8dcd75858707e884e87658dcb1cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526391
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71057}
2020-11-09 16:53:58 +00:00
Clemens Backes
4d97ff5900 [inspector][test][cleanup] Introduce enums for bools
Instead of passing two bools to the {TaskRunner} constructor, pass to
enums. This makes the semantics more clear in the caller.

In the fuzzer, we actually *do not* want to catch exceptions. This
semantic fix will be done in a follow-up CL, such that this CL is a pure
refactoring.

R=szuend@chromium.org

Bug: v8:11074
Change-Id: I7f6df3a3f344524deb08db10b9317a6734b7ea42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526385
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71056}
2020-11-09 16:34:49 +00:00
Ulan Degenbaev
4e0da20df2 [heap] Fix DCHECK in FixStaleLeftTrimmedHandlesVisitor
This adds a guard for a forwarding address in the debug mode checks
of FixStaleLeftTrimmedHandlesVisitor::FixHandle.

Bug: chromium:1146601
Change-Id: I6681352a91177c1d138a409d17e5d170bd43f11b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526389
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71055}
2020-11-09 16:28:19 +00:00
Clemens Backes
4510401df4 [inspector][fuzzer] Fix termination
Joining the thread from the watchdog is problematic, since e.g.
{pthread_join} (the implementation of {Thread::Join} on POSIX systems)
has undefined behaviour if multiple threads try to join at the same
time. In practice, this leads to deadlocks.

Thus implement termination by just calling {TaskRunner::Terminate}, but
not {TaskRunner::Join}. This fixes the deadlocks in the inspector
fuzzer.
The inspector test binary is fixed simarly, even though there it seems
to not cause problems so far.

In both files, the {Terminate} function is inlined into callers because
it's only a single line now, with one to two users.

Also, replace the single fuzzer test (which is invalid javascript) by
two tests: One called "invalid" explicitly, still with invalid
javascript, and one empty file, which is valid input. That one
reproduced the deadlock.

R=szuend@chromium.org

Bug: chromium:1142437
Change-Id: I8fb98b0cdbf3ceff6af6849397e5da5a4e9acd3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526384
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71054}
2020-11-09 16:02:19 +00:00
Sara Tang
c9e883e803 (Step 1 of 2): Prepping Wasm events in the Recorder interface
As part of an effort to prepare the Recorder interface for general use,
we had to make some changes to the way the existing Wasm Events are
being used. In particular,
  - it is more fitting to use a ElapsedTimer than a TimedScope to
    measure the durations in src/wasm/module-[decoder|instantiate].cc
  - we want to rename the wall_clock_time_in_us field to duration_in_us
    for clarity.

Because these Wasm events are already being instantiated in chromium,
renaming the field requires a two-step change. This is the first of
those changes.

Change-Id: If1b2990f7645616a59fc21d07ac10bf00701c0e5
Bug: v8:11109
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2518619
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71053}
2020-11-09 15:29:14 +00:00
Marja Hölttä
30ca51ec48 [super] Optimize super property access in JSNativeContextSpecialization
This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71052}
2020-11-09 15:28:09 +00:00
Santiago Aboy Solanes
3669ecd6e4 [csa][cleanup] Remove Sloppy-ness for even more classes
Remove for:
 * Word32T
 * String
 * SharedFunctionInfo
 * MaybeObject

Bug: v8:6949, v8:11074
Change-Id: I6facf1692697a4776a88ceae8a817f57af40c351
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523322
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71051}
2020-11-09 15:19:19 +00:00
Camillo Bruni
66cb4dccde [keys] Speed up Array serialization
Using KeyAccumulator::GetKeys directly enables fast-paths by checking
if the enum-cache is set.

Drive-by-fix:
- Reduce public interface of KeyAccumulator to prevent these
  performance issues in the future.
- Fix value-serializer.cc includes

Change-Id: I2cc7b3bf9d1e42e699829427163ecbdee92c9007
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520898
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71050}
2020-11-09 15:16:10 +00:00
Manos Koukoutos
9914f62c4d [wasm] Simplify function name decoding in module-decoder.cc
Change-Id: I66043e0e251ad3214a0d695434c2850caac96c69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2521145
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71049}
2020-11-09 14:03:19 +00:00
Tobias Tebbi
bd75b0ba3e Reland "[torque] allow exported classes with custom C++ class"
This is a reland of 26f10ecd95

Change compared to original CL:
The deserializer changes StrongDescriptorArray to DescriptorArray.
Since this CL uses separate BodyDescriptors for the two kinds of
descriptor arrays, this caused a DCHECK failure when the deserializer
changes the map while the object is visited from the concurrent marking
thread. Fix this by disabling the corresponding checks.


Original change's description:
> [torque] allow exported classes with custom C++ class
>
> Introduce a new annotation @customCppClass that can be used for
> non-extern @export classes, that is, generate everything, remove
> boilerplate from all the internal lists and switches, but allow
> a custom C++ class, which in turn also allows overwriting the generated
> print and verify functions.
>
> Port DescriptorArray and StrongDescriptorArray as an example.
>
> Bug: v8:7793
> Change-Id: I744e52fb4102ac49c0097f1c95bb17d301975bf0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489687
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Seth Brenith <seth.brenith@microsoft.com>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70989}

Bug: v8:7793
Change-Id: I7505fb111896991d16d7d113704c8c3676669f34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526383
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71048}
2020-11-09 13:56:09 +00:00
Mythri A
a7857d44f4 [turboprop] Fix an incorrect DCHECK
When setting optimized code on feedback vector we had a DCHECK that
ensured the optimization tier is kNone or it is kMidTier and we are
installing TurboFan code. While this holds usually, this fails in
few corner cases like:

1. Trigger a TF concurrent compilation
2. Create a new closure with --always-opt, which triggers a TF
concurrent compilation and installs optimized code. We set
OptimizationTier to kTopTier
3. Optimized code gets deoptimized / GC clears the optimized code, but
we haven't healed the optimized code slot / optimization tier yet.
4. Concurrent compilation finishes and tries to install optimized code
but the optimization tier is still set to kTopTier.

This cl fixes the DCHECK by actually checking we are not overwriting
valid optimized code except for tiering up.

Drive by fixes: Also print optimization tier with feedback vector and
print when marking a function for optimization with --always-opt.

Bug: v8:11101, v8:9684
Change-Id: Icad673ea01bb225f8b05e727a56f890af7e86514
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520900
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71047}
2020-11-09 13:46:19 +00:00
Clemens Backes
233f5ac164 [wasm] Add event for serialization
This is a major contributor to compilation (call path is
ExecuteCompilationUnits -> TopTierFinished -> SerializeNativeModule).
On Earth, it's ~200ms on my machine. Hence make this pause visible in
traces.

R=ahaas@chromium.org

Change-Id: I26ff97d531647fa7038f14325e8ab8ae3dff24e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520909
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71046}
2020-11-09 13:26:29 +00:00
Clemens Backes
eeaf7c868d [inspector][fuzzer] Fix alloc-dealloc-mismatch
Asan complains about the alloc-dealloc-mismatch because the startup data
is allocated via "new[]" in snapshot.cc and deallocated via "delete" in
inspector-test.cc.
A more failure-proof fix would be to have {StartupData} manage the
lifetime of the contained char*, but since this is in an API object, the
refactoring might be more involved. Since other users also just dealloc
explicitly via "delete[]", this CL just fixes the issue in
inspector-test.cc.

R=szuend@chromium.org

Bug: chromium:1142437, v8:11107
Change-Id: I84438b2f12ce8eb6b653d4861e899a2f003e1227
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523200
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71045}
2020-11-09 13:23:59 +00:00
Nico Hartmann
d94afe6644 Remove redundant set_builtin_id
Bug: v8:11074
Change-Id: I6fd2334b3a427f4423bbe8b2b380bc575ad128b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2519563
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71044}
2020-11-09 13:15:49 +00:00