Commit Graph

31506 Commits

Author SHA1 Message Date
Seth Brenith
6eeb994d35 Fix a failing DCHECK
The destructor for BackgroundMergeTask checks that the task doesn't have
pending foreground work. However, there are valid cases where the task
can be abandoned without completing its foreground work, either because
another copy of the same script showed up in the Isolate compilation
cache or because the serialized code data had an incorrect source hash
and was rejected. This change removes the problematic DCHECK and adds a
new one in code-serializer.cc at a point where we can actually be sure
there isn't pending foreground work.

Bug: chromium:1400781
Change-Id: Idb3538229d25f297adf5b2696c4b4b50d85557b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4105926
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84869}
2022-12-15 14:06:59 +00:00
Matthias Liedtke
89f05508b1 [wasm-gc] Add new br_on_cast_fail null variant taking a heap type immediate
Adds new `br_on_cast_fail null <branch depth> <heap type>` instruction
with opcode 0xfb4b.
The heap type may be any concreate heap type index or an abstract
type like `(ref null eq)`.

Bug: v8:7748
Change-Id: Ieb7322a31fd2b5f64a669193003a365149bef34e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085008
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84868}
2022-12-15 12:45:51 +00:00
Benedikt Meurer
57b1dc9acf [inspector] Improve description for Proxy objects.
This includes the class name of the target object as part of the
description for Proxy objects, i.e. `Proxy(HTMLElement)` for proxies
whose targets are `HTMLElement`s. This greatly improves the debugging
experience with proxies, which are becoming more common these days (for
example with Vue using proxies for their components).

Before: https://imgur.com/SbR4s6H.png
After: https://imgur.com/NWQJFj8.png
Fixed: chromium:1400253
Change-Id: I3bd2b0f91a3aeaa531d5e5dd2ca3e777e4663ba1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4109729
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84864}
2022-12-15 10:53:39 +00:00
Maya Lekova
3764898a23 [turboshaft] Fix incorrect assumption when inlining a block
The current version of CloneAndInlineBlock assumes that the inlined
block is a direct predecessor of the currently reduced block. With
recent Return reductions implemented in branch elimination that's no
longer the case, as we're looking one edge past the current block.

Bug: chromium:1399626
Change-Id: I2ce23672c0e33b2857a4663d8e7ad5ed1df3c20e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4097125
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84862}
2022-12-15 10:43:46 +00:00
Frank Tang
6bf3344f5d [Intl] Impl LocaleInfo PR 63
https://github.com/tc39/proposal-intl-locale-info/pull/63

Sort collation code alphabetically before return.

Bug: v8:13542
Change-Id: I1c7df69af483a96a1fc7625b11c2b850edc59283
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094503
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84857}
2022-12-15 01:21:58 +00:00
Frank Tang
f0dfa877b2 [test262] Roll test262
ec752ebaab..e6c6460a5b

Bug: v8:7834
Change-Id: I886a7aaba57564076c30493b07d30757cefedbfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4099704
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84856}
2022-12-15 00:34:07 +00:00
Frank Tang
96bc59aec0 [intl] Sync to durationFormat PR130
https://github.com/tc39/proposal-intl-duration-format/pull/130

Bug: v8:11660
Change-Id: Ib749a5f8264fdef21cb8622df766ebf7710595e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4104320
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84854}
2022-12-14 21:33:36 +00:00
Nikolaos Papaspyrou
f81430caa9 [heap] Enable conservative stack scanning on tests
Since its introduction (behind a compile-time flag), conservative stack
scanning was disabled by default on tests. This CL inverts this logic,
enabling CSS by default for all tests that do not define an explicit
scope to disable it.

Bug: v8:13257
Change-Id: I5ea4249d02f69b0b1e195415c2562daf5d8c0ea9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100912
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84848}
2022-12-14 16:14:12 +00:00
Anton Bikineev
f8bd5feb68 unified-young-gen: Fix Oilpan-to-V8 remembered set
The CL applies multiple changes:
1) Reverts back to using std::vector<> for young nodes. Distinguishing
   between young and remembered nodes is still needed to allow fast
   filtering.
2) Adds the has-old-host flag to TracedNode, which is used to remember a
   node.
3) Adds bailouts for old objects into UnifiedHeapMarkinState and
   ConservativeTracedHandlesMarkingVisitor.

Bug: v8:13475
Change-Id: Ib296ece9df6f783bb3d47ffa0794be16e6c1aea8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4080386
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84839}
2022-12-14 14:01:35 +00:00
Leszek Swirski
6a52ff1d84 Revert "Fix a few more places where we don't check for termination"
This reverts commit 8b283d0c7e.

Reason for revert: This test fails in stress mode: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20verify%20csa/31485/overview

Original change's description:
> Fix a few more places where we don't check for termination
>
> Bug: chromium:1376663, chromium:1393272
> Change-Id: Ie6ee25fb87f9959166b1696e36f07218d2959098
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4105981
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84835}

Bug: chromium:1376663, chromium:1393272
Change-Id: Iaa9b1370a9e581dd8cb06b83855acaa9a22652c9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4106370
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#84836}
2022-12-14 13:08:13 +00:00
Camillo Bruni
8b283d0c7e Fix a few more places where we don't check for termination
Bug: chromium:1376663, chromium:1393272
Change-Id: Ie6ee25fb87f9959166b1696e36f07218d2959098
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4105981
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84835}
2022-12-14 12:01:47 +00:00
Qifan Pan
b152c67e03 [turbofan] Support BigIntEqual
This CL adds support for BigIntEqual in turbofan and collects type
feedback for small BigInt equal and strict equal in ignition.

Bug: v8:9407
Change-Id: I29cbc4d3bdfe9fcde8c1717afe83654a84c25c36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096557
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84832}
2022-12-14 10:37:47 +00:00
Dominik Inführ
3915384f58 Reland "[heap] Also promote strings in large objects into shared heap"
This is a reland of commit 303facf5e1

This CL fixes DCHECK failures by using BasicMemoryChunk in
RecordOldToSharedSlot.

Original change's description:
> [heap] Also promote strings in large objects into shared heap
>
> With --shared-string-table all in-place internalizable strings are
> directly promoted from new space into the shared heap. However, this
> wasn't the case with large objects. This CL fixes this and adds test
> to guide fuzzers.
>
> Bug: v8:13267, chromium:1400048
> Change-Id: I6f850d480956c63bfbe1a7060140df850e284933
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096818
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84805}

Bug: v8:13267, chromium:1400048, v8:13588
Change-Id: I221592ec723d2b5e92094ff2598a99576d72a677
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4098831
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84830}
2022-12-14 10:06:27 +00:00
Jaroslav Sevcik
4c3266841c [inspector] Handle instrumentation break with multiple sessions
Currently, any session can resume instrumentation breaks by sending
Debugger.resume command. That can lead to unreliable breakpoint
placement because sessions can resume too early.

The early resumption can happen in two ways:

- When we have two instrumented sessions, the first one to resume
  can prevent the other one from setting its breakpoints
  before executing the code.

- With one instrumented session and one without instrumentation
  breakpoints, the uninstrumented session's Debugger.resume
  command can resume the instrumentation pause before the
  instrumented session can set its breakpoints.

This patch fixes both of these issues by changing the instrumentation
pause resumption logic to take note of the sessions that were notified
about the instrumentation breakpoints. The debugger will only resume
once all those sessions resume (or disconnect).

Bug: chromium:1354043
Change-Id: I84cf16b57187dbb40645b2f7ec2e08f0078539dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100466
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84827}
2022-12-14 06:01:22 +00:00
Shu-yu Guo
4757205b3c [rab/gsab,api] Add resizable BackingStore creation
This CL adds v8::ArrayBuffer::NewResizableBackingStore.

This API is needed to support Mojo cross-process serialization of
resizable buffers. See https://chromium-review.googlesource.com/c/chromium/src/+/4086949

Bug: chromium:1396361, v8:11111
Change-Id: I1d3ad367f28015184fd80fd2f05a37a3659d3a66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4093555
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84826}
2022-12-14 01:54:00 +00:00
Clemens Backes
770e66c483 [wasm] Do not validate asm.js code
Asm.js code (translated to Wasm) is valid by design, do not try to
validate it.
This is achieved by fully populating the {validated_functions} bitset
for asm.js modules. To make this safe(r) we do not allow to change the
origin or a WasmModule after initialization, which requires some
refactoring mostly in tests.

R=ahaas@chromium.org

Bug: v8:13447, v8:13565
Change-Id: I174c01f13185ff4117b02882b953c6ba29a3644d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100686
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84824}
2022-12-13 17:46:59 +00:00
Adam Klein
a40734b3cc Revert "[maglev] Enable --maglev with --future"
This reverts commit 4cc24b6a1c.

Reason for revert: sqlite-change-heap mjsunit test starts failing:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/12381/overview

Original change's description:
> [maglev] Enable --maglev with --future
>
> This also removes --nowrite-protect-code-memory from --future.
>
> Bug: v8:7700
> Change-Id: Ibf17f541906d5f586d380b00ce471b5e1f20f7e3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100754
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Auto-Submit: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84817}

Bug: v8:7700
Change-Id: Ia9c4e5515cf24c8b96f7b05dc3c823bdfa285643
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4102360
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84818}
2022-12-13 17:25:07 +00:00
Toon Verwaest
4cc24b6a1c [maglev] Enable --maglev with --future
This also removes --nowrite-protect-code-memory from --future.

Bug: v8:7700
Change-Id: Ibf17f541906d5f586d380b00ce471b5e1f20f7e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100754
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84817}
2022-12-13 16:32:16 +00:00
Dominik Inführ
8f911e423e Revert "[heap] Also promote strings in large objects into shared heap"
This reverts commit 303facf5e1.

Reason for revert: Causes failures with fuzzers.

Original change's description:
> [heap] Also promote strings in large objects into shared heap
>
> With --shared-string-table all in-place internalizable strings are
> directly promoted from new space into the shared heap. However, this
> wasn't the case with large objects. This CL fixes this and adds test
> to guide fuzzers.
>
> Bug: v8:13267, chromium:1400048
> Change-Id: I6f850d480956c63bfbe1a7060140df850e284933
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096818
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84805}

Bug: v8:13267, chromium:1400048
Change-Id: If20528bbf804b73ce8ad10f8addc9a1f11b50d96
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4101261
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84813}
2022-12-13 14:38:39 +00:00
Marja Hölttä
d873ac4b15 [rab/gsab] Fix ValueSerializer RAB / GSAB support
The "is there enough data" check has to be done *after* reading
maxByteLength.

Bug: v8:11111, chromium:1400431
Change-Id: I7c2eddaeb998f3cd3919e118c093a5d036fca408
Fixed: chromium:1400431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100468
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84809}
2022-12-13 13:27:35 +00:00
Toon Verwaest
e1e08901c2 [parser] Reset the calls_eval flag after arrow head
Otherwise it's propagated to the parent

Bug: chromium:1394973
Change-Id: I178f9d5d863aec501525a783846d1df6d3031bb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100687
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84808}
2022-12-13 13:15:51 +00:00
Dominik Inführ
303facf5e1 [heap] Also promote strings in large objects into shared heap
With --shared-string-table all in-place internalizable strings are
directly promoted from new space into the shared heap. However, this
wasn't the case with large objects. This CL fixes this and adds test
to guide fuzzers.

Bug: v8:13267, chromium:1400048
Change-Id: I6f850d480956c63bfbe1a7060140df850e284933
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096818
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84805}
2022-12-13 12:25:14 +00:00
Leszek Swirski
f051f773f4 [heap] Remove optimized code list
Code objects are linked in a custom per-native-context weak list of
optimized code (previously there was also a list of deoptimized code,
but this was recently removed).

There used to be reasons for this list, but at this point it is only
used by the debugger to mark code for deoptimization. The debugger can
do this with a heap walk instead, so we can remove this list and indeed
the next_code_links from Code objects themselves.

Change-Id: Iebbed4adacd31b8ddc442ae6355ea45c691cc856
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4061515
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84804}
2022-12-13 11:58:32 +00:00
Nico Hartmann
0efdcf6f38 [turboshaft] Fix type refinement on branches with implicit truncation
Bug: v8:12783, chromium:1400056
Change-Id: Ie522a308f49b92c8438ae102559a763f8912c1d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094420
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84801}
2022-12-13 09:35:50 +00:00
Jaroslav Sevcik
00c8f93df1 [debug] Fix removing instrumentation breakpoint on pause
Bug: chromium:1354043
Change-Id: Ib30aaa6e799eb3cda611e1ec63cd8e049befc75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100485
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84799}
2022-12-13 08:18:44 +00:00
Jaroslav Sevcik
d46662c084 [test] Move inspector stopping to session
This patch moves the stop method from context group to session to enable
stopping each session independently. This is useful for testing that
stopping does not interact badly with other sessions.

Bug: chromium:1354043
Change-Id: I885cf49f2d4cf006fa5228edf2954099e45cfc6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4100484
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84797}
2022-12-13 06:59:09 +00:00
Qifan Pan
c27adbd631 [turbofan] Fix bugs of ToBigIntConvertNumber
This CL fixes two bugs:

- The monotonicity violation in the typers of ToBigIntConvertNumber and
  Integral32OrMinusZeroToBigInt.
- The missing handling of conversion from Tagged output with the type
  DoubleRepresentableInt64OrMinusZero to Word64.

Bug: v8:9407, v8:13580, chromium:1399951, chromium:1400053
Change-Id: I669820b52e5b82bddc9853cfd97a2361c344a2cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096990
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84793}
2022-12-12 17:01:54 +00:00
Clemens Backes
67377c13c0 [wasm] Use WasmEngine's allocator for validation
We already exclusively use the WasmEngine's AccountingAllocator for all
decoded Wasm modules. Except for tests, the same allocator will also be
used for validation. Thus do not pass it down explicitly, but get it
from the WasmEngine when needed.

R=ahaas@chromium.org

Bug: v8:13447
Change-Id: Idaa9d6c3e0ab0051bf85bb2667accac89e8b5607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092738
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84792}
2022-12-12 16:59:04 +00:00
Olivier Flückiger
f834ce3ae4 [static-roots] Skip a slow serializer test on windows debug build
A new test added in https://crrev.com/c/4092575 times out on ASan
windows builds and is slow.

Superseeds https://crrev.com/c/4096677.

No-Tree-Checks: true
No-Try: true
Bug: v8:13466
Change-Id: I40d61459437434cf739fbff8c223871012a23010
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096817
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84784}
2022-12-12 14:22:02 +00:00
Matthias Liedtke
4760f9292c [test] Skip flaky unittest TyperTest.Monotonicity_Operation_Integral32OrMinusZeroToBigInt
Bug: v8:13580
Change-Id: I96680f9e12515fa1f2885edc6fbdf754fed6b40b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096986
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84783}
2022-12-12 14:19:28 +00:00
Maya Lekova
10ae2e4a59 [turboshaft] Fix a crash in branch elimination
The current reduction of blocks that are branch targets with a known
condition assumes that this is the first time we're seeing the given
condition with the given value. That's no longer the case, so updating
the expectation accordingly.

Bug: chromium:1399627
Change-Id: Id84d80a38801cf6178b476e62160d616b948d8d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096984
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84780}
2022-12-12 14:16:20 +00:00
Shu-yu Guo
d1d100d4ef [shared-struct] Disallow Symbol field names
Bug: chromium:1394408, v8:12547
Change-Id: If98e6f0e7048a7d218010eb2859bb986a20917ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094374
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84779}
2022-12-12 12:45:34 +00:00
Matthias Liedtke
1bf670ef20 [wasm-gc] ref.cast null: Always produces a null type independent of input type
This is required to be spec-compliant.
The previously implemented behavior was more relaxed allowing one to use
`ref.cast null` on non-nullable inputs and still getting a non-nullable
result on cast success.

Bug: v8:7748
Change-Id: I1297314389b0445a7c8d5a74f37d07a723d7a133
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091549
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84776}
2022-12-12 11:30:33 +00:00
Olivier Flückiger
bd7458cb7f Reland "[static-roots] Allow creating isolates from exist. r/o snapshot"
This is a reland of commit 331c577e1d

Fix DCHECK for single generation builds.

Original change's description:
> [static-roots] Allow creating isolates from existing r/o snapshot
>
> This adds the ability to create an isolate from scratch, except the
> read only roots, which are initialized from a read_only_data snapshot.
> To do this we split the heap setup in a read/only part and the rest.
> The goal of these changes is to later support writing serializer tests,
> even if the read only roots are static and have to be loaded from a
> fixed snapshot.
>
> Bug: v8:13466
> Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Olivier Flückiger <olivf@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84750}

Bug: v8:13466
Change-Id: Ic680b7620fc3176260c5d550e474412afef5f598
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092575
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84773}
2022-12-12 10:44:23 +00:00
Marja Hölttä
bf998bdf47 [rab/gsab] Fix TA.p.slice even more
The previous fix was using the wrong getter for accessing the length.

It also threw an error when the created TA was length-tracking but in
bounds.

Bug: v8:11111,chromium:1399799
Change-Id: I5a94b1b49b2e30cf33999be7ff0ee8e4f5323849
Fixed: chromium:1399799
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4090984
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84771}
2022-12-12 08:37:34 +00:00
Leszek Swirski
c5dc2fc9c1 [mjsunit] Make Array deepEquals respect holes
Don't let holes compare equal to undefined, to avoid tests accidentally
succeeding when operating on the wrong holeyness.

Change-Id: I5fe1eea8b3e718389b46d542be45cca578a1080c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4091024
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84769}
2022-12-10 13:19:33 +00:00
Shu-yu Guo
08e95d81d5 [rab/gsab,api] Add v8::BackingStore::MaxByteLength
I originally thought MaxByteLength would only be needed for
v8::ArrayBuffer and v8::SharedArrayBuffer, but it is also needed on
v8::BackingStore.

In particular, blink uses Mojo to serialize ArrayBuffers' contents via
v8::BackingStore when doing cross-process postMessage.

Bug: chromium:1396361, v8:11111
Change-Id: I86d44829175ad760fb43294d386483a16044fc3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4090708
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84767}
2022-12-09 22:45:18 +00:00
Choongwoo Han
2dcb0a1a1e Fix Array.toReversed to create properties for holes
Array.toReversed always creates properties even for holes, but the
optimization paths for HOLEY_* arrays did not respect the spec. This CL
fixes the fast paths to set `undefined` value instead of the hole.

Bug: chromium:1395672
Change-Id: I51584829caf312a1864f93928315782bb120ee14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4081689
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Choongwoo Han <choongwoo.han@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#84766}
2022-12-09 18:00:55 +00:00
Qifan Pan
753584c74b [turbofan] Inline BigInt Constructor for Integral32 input
This CL introduces two JS operators JSToBigInt and
JSToBigIntConvertNumber and one simplified operator
Integral32OrMinusZeroToBigInt.

- BigInt constructors are lowered to JSToBigIntConvertNumber in the
  inlining phase.
- JSToBigIntConvertNumber is replaced with
  Integral32OrMinusZeroToBigInt if the input is typed as Integral32
  in typed lowering.
- In simplified lowering, Integral32OrMinusZeroToBigInt is lowered
  to conversion to word64 accordingly.
- If the input is not Integral32 or BigInt, JSToBigIntConvertNumber
  is lowered to a builtin call in generic lowering.

Bug: v8:9407
Change-Id: I8539d742e82cce515bd9350797f5f9b0876ee6f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055670
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Qifan Pan <panq@google.com>
Cr-Commit-Position: refs/heads/main@{#84761}
2022-12-09 15:08:34 +00:00
Dominik Inführ
458cda96fe Revert "[heap] Iterate promoted pages during sweeping"
This reverts commit 1e3dd39d09.

Reason for revert: Causes failures with --shared-string-table

https://bugs.chromium.org/p/chromium/issues/detail?id=1399489
https://bugs.chromium.org/p/chromium/issues/detail?id=1399491
https://bugs.chromium.org/p/chromium/issues/detail?id=1399488
https://bugs.chromium.org/p/v8/issues/detail?id=13574

Original change's description:
> [heap] Iterate promoted pages during sweeping
>
> Promoted pages are iterated to record slots containing old to new and
> old to shared references. This takes a significant amount of time during
> the atomic pause.
> Instead we offload this task to the concurrent sweepers, record slots to
> a local cache, and merge it when finalizing sweeping.
>
> Array buffer sweeping depends on iteration of promoted pages, so it is
> frozen until iteration is done.
>
> See design doc at https://docs.google.com/document/d/1JzXZHguAnNAZUfS7kLeaPVXFfCYbf5bGCtyKgyiMDH4/edit?usp=sharing
>
> Bug: v8:12612
> Change-Id: Icdc79a7a70c53352e3a1b3961cfe369e8563b65b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4062041
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Auto-Submit: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84706}

Bug: v8:12612
Change-Id: I4ed4a6ad954cb294b569c94b4d8ea25a0956a223
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092734
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84760}
2022-12-09 14:53:05 +00:00
Simon Zünd
fb02c04d48 [debug] Only pause once when we throw in an async generator
Similar to the `AsyncFunctionReject` builtin, the
`AsyncGeneratorReject` should also mark the promise rejection as a
non-debuggable event.

That is because the initial throw that causes the generator rejection
downstream alreay triggered the debuggable event.

We can re-use one of the existing tests as a regression test here:
If we wait for the Runtime.evaluate promise to resolve after the first
pause, we ensure that we already paused once. The test in its current
form swallowed the second pause implicitly by disabling the debugger.

R=bmeurer@chromium.org

Bug: chromium:1270780
Change-Id: I97ab08934804fefd097e9bd01081469da5379154
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4084925
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84756}
2022-12-09 12:49:29 +00:00
Clemens Backes
068536f109 [wasm] Remove thread timings (CPU time)
On Mac, we spend around 30% of lazy compile time in {ThreadTicks::Now}.
On Linux it's less severe, but still around 10%.
That's too much overhead for measurements that only show up in UKM, so
remove that.

The unused fields will be removed from the UKM events after the plumbing
on the chromium side has been removed.

R=ahaas@chromium.org, mlippautz@chromium.org
CC=​ecmziegler@chromium.org

Bug: v8:13565
Change-Id: I2dad88d899482801888940499d2d1761ff075578
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4078966
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84754}
2022-12-09 12:11:22 +00:00
Jaroslav Sevcik
f4fb8fc1f7 [inspector] Introduce debugger session stop API
We introduce V8InspectorSession::stop API to enable safe
detach from the session. In particular, after calling 'stop',
the session will leave any instrumentation pause it might
be in and disarm all its instrumentation breakpoints.

This is useful when the session disconnect request is registered
on V8 interrupt (so it is unsafe to disconnect at that point),
and the execution should first get to the message loop
where the disconnect can be handled safely.

Bug: chromium:1354043
Change-Id: I3caab12a21b123229835e8374efadc1f4c9954c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085143
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84753}
2022-12-09 12:08:58 +00:00
Toon Verwaest
f3c20276ed [compiler] Use CheckIf instead of DeoptimizeIf to fix the framestate
Bug: chromium:1399695
Change-Id: Id2aae902d1ce483b4d0a1e4953074a7539cf7058
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092264
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84752}
2022-12-09 12:07:48 +00:00
Nico Hartmann
1d733b97a2 Revert "[static-roots] Allow creating isolates from existing r/o snapshot"
This reverts commit 331c577e1d.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20debug%20-%20single%20generation%20-%20builder/9912/overview

Original change's description:
> [static-roots] Allow creating isolates from existing r/o snapshot
>
> This adds the ability to create an isolate from scratch, except the
> read only roots, which are initialized from a read_only_data snapshot.
> To do this we split the heap setup in a read/only part and the rest.
> The goal of these changes is to later support writing serializer tests,
> even if the read only roots are static and have to be loaded from a
> fixed snapshot.
>
> Bug: v8:13466
> Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Olivier Flückiger <olivf@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84750}

Bug: v8:13466
Change-Id: I91512140abb98993578d27e65e6080e1d3f317e6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4089967
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84751}
2022-12-09 12:06:43 +00:00
Olivier Flückiger
331c577e1d [static-roots] Allow creating isolates from existing r/o snapshot
This adds the ability to create an isolate from scratch, except the
read only roots, which are initialized from a read_only_data snapshot.
To do this we split the heap setup in a read/only part and the rest.
The goal of these changes is to later support writing serializer tests,
even if the read only roots are static and have to be loaded from a
fixed snapshot.

Bug: v8:13466
Change-Id: I078695b95710e5281da013ca0c08af0e153b4725
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037271
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84750}
2022-12-09 11:43:52 +00:00
Nikolaos Papaspyrou
710f2a4da2 Revert "[heap] Fix conservative stack scanning for client isolates"
This reverts commit 36bac1bcae.

Reason for revert: This possibly caused clusterfuzz issues and test flakiness.

Original change's description:
> [heap] Fix conservative stack scanning for client isolates
>
> With this CL, the context of stacks corresponding to all client isolates
> are saved, so that conservative stack scanning can be used correctly
> during a shared garbage collection. This happens:
>
> 1) in Heap::PerformSharedGarbageCollection, for the stacks of the shared
>    isolate and the initiator;
> 2) when an isolate's main thread is waiting in a safepoint; and
> 3) when an isolate's main thread is parked.
>
> Bug: v8:13257
> Change-Id: I9ff060f2c0c1ec12977c70d67d65d9c543e2d165
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4027210
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84712}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:13257
Change-Id: I7eb50b24243084d45b3f1bcc37a559b9f92e0318
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092363
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84749}
2022-12-09 10:50:35 +00:00
Al Muthanna Athamina
fe89c47a68 [test] Mark slow tests as slow on debug mode
Bug: v8:13572
Change-Id: Ib23cfc4c3b69ffc7c89d0dde47323a03980452f0
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4092223
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84748}
2022-12-09 10:24:47 +00:00
Deepti Gandluri
f5fc2d7fe2 [wasm-relaxed-simd] Implement Dot add instructions on x64/ia32
Bug: v8:12284
Change-Id: Ieb92206cb9b2df296bd9ba1ef88d1183752c4bc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3866610
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84744}
2022-12-09 01:26:26 +00:00
Shu-yu Guo
1f306a9666 [rab/gsab] Do not optimize objects in shared space as prototypes
Bug: chromium:1393515, v8:12547
Change-Id: I6d0a7c32cf367976524eec56b824600eecc911ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4086127
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84741}
2022-12-08 21:36:31 +00:00