Commit Graph

26050 Commits

Author SHA1 Message Date
Leszek Swirski
74f3665c64 Revert "[serializer] Allocate during deserialization"
This reverts commit 5d7a29c90e.

Reason for revert: UBSan -- https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/13100

Original change's description:
> [serializer] Allocate during deserialization
>
> This patch removes the concept of reservations and a specialized
> deserializer allocator, and instead makes the deserializer allocate
> directly with the Heap's Allocate method.
>
> The major consequence of this is that the GC can now run during
> deserialization, which means that:
>
>   a) Deserialized objects are visible to the GC, and
>   b) Objects that the deserializer/deserialized objects point to can
>      move.
>
> Point a) is mostly not a problem due to previous work in making
> deserialized objects "GC valid", i.e. making sure that they have a valid
> size before any subsequent allocation/safepoint. We now additionally
> have to initialize the allocated space with a valid tagged value -- this
> is a magic Smi value to keep "uninitialized" checks simple.
>
> Point b) is solved by Handlifying the deserializer. This involves
> changing any vectors of objects into vectors of Handles, and any object
> keyed map into an IdentityMap (we can't use Handles as keys because
> the object's address is no longer a stable hash).
>
> Back-references can no longer be direct chunk offsets, so instead the
> deserializer stores a Handle to each deserialized object, and the
> backreference is an index into this handle array. This encoding could
> be optimized in the future with e.g. a second pass over the serialized
> array which emits a different bytecode for objects that are and aren't
> back-referenced.
>
> Additionally, the slot-walk over objects to initialize them can no
> longer use absolute slot offsets, as again an object may move and its
> slot address would become invalid. Now, slots are walked as relative
> offsets to a Handle to the object, or as absolute slots for the case of
> root pointers. A concept of "slot accessor" is introduced to share the
> code between these two modes, and writing the slot (including write
> barriers) is abstracted into this accessor.
>
> Finally, the Code body walk is modified to deserialize all objects
> referred to by RelocInfos before doing the RelocInfo walk itself. This
> is because RelocInfoIterator uses raw pointers, so we cannot allocate
> during a RelocInfo walk.
>
> As a drive-by, the VariableRawData bytecode is tweaked to use tagged
> size rather than byte size -- the size is expected to be tagged-aligned
> anyway, so now we get an extra few bits in the size encoding.
>
> Bug: chromium:1075999
> Change-Id: I672c42f553f2669888cc5e35d692c1b8ece1845e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404451
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70229}

TBR=ulan@chromium.org,jgruber@chromium.org,leszeks@chromium.org

Change-Id: I2bd792a24861e8f54897e51522769b50f8f814e2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1075999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440827
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70231}
2020-09-30 14:24:01 +00:00
Leszek Swirski
5d7a29c90e [serializer] Allocate during deserialization
This patch removes the concept of reservations and a specialized
deserializer allocator, and instead makes the deserializer allocate
directly with the Heap's Allocate method.

The major consequence of this is that the GC can now run during
deserialization, which means that:

  a) Deserialized objects are visible to the GC, and
  b) Objects that the deserializer/deserialized objects point to can
     move.

Point a) is mostly not a problem due to previous work in making
deserialized objects "GC valid", i.e. making sure that they have a valid
size before any subsequent allocation/safepoint. We now additionally
have to initialize the allocated space with a valid tagged value -- this
is a magic Smi value to keep "uninitialized" checks simple.

Point b) is solved by Handlifying the deserializer. This involves
changing any vectors of objects into vectors of Handles, and any object
keyed map into an IdentityMap (we can't use Handles as keys because
the object's address is no longer a stable hash).

Back-references can no longer be direct chunk offsets, so instead the
deserializer stores a Handle to each deserialized object, and the
backreference is an index into this handle array. This encoding could
be optimized in the future with e.g. a second pass over the serialized
array which emits a different bytecode for objects that are and aren't
back-referenced.

Additionally, the slot-walk over objects to initialize them can no
longer use absolute slot offsets, as again an object may move and its
slot address would become invalid. Now, slots are walked as relative
offsets to a Handle to the object, or as absolute slots for the case of
root pointers. A concept of "slot accessor" is introduced to share the
code between these two modes, and writing the slot (including write
barriers) is abstracted into this accessor.

Finally, the Code body walk is modified to deserialize all objects
referred to by RelocInfos before doing the RelocInfo walk itself. This
is because RelocInfoIterator uses raw pointers, so we cannot allocate
during a RelocInfo walk.

As a drive-by, the VariableRawData bytecode is tweaked to use tagged
size rather than byte size -- the size is expected to be tagged-aligned
anyway, so now we get an extra few bits in the size encoding.

Bug: chromium:1075999
Change-Id: I672c42f553f2669888cc5e35d692c1b8ece1845e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404451
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70229}
2020-09-30 14:04:03 +00:00
Samuel Groß
919d1dd770 Fix unhandled promise rejections in REPRL mode
Previously, unhandled promise rejections weren't reset between REPRL
executions, leading to incorrect exit statuses being reported. This CL
fixes the issue and adds further tests to verify the correct behaviour.

Change-Id: Ied47d9359b0fbc05ebb211667687a0a4041ef767
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431205
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#70227}
2020-09-30 13:34:23 +00:00
Milad Fa
44355d750a PPC: Mark console-messages-limits as slow
Bug: v8:10965
Change-Id: Iba23cfcfaed44b52fe38851713e2ffedd118430f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2437172
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70225}
2020-09-30 13:23:53 +00:00
Clemens Backes
2a71b32062 [wasm] Rename {ValidateFlag} constants
As a preparation to add a "boolean validation" mode, rename the existing
flags. This removes many unrelated changes from the follow-up change and
makes it easier to review.

R=thibaudm@chromium.org

Bug: v8:10969
Change-Id: I5f71405b525a7caa91be46c035e31d4d960e4e4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440036
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70224}
2020-09-30 13:19:03 +00:00
Thibaud Michaud
e60d8600b5 [wasm] Add GenericJSToWasmWrapper to the list of executable builtins
Ensure that a valid off-heap trampoline is created for the
GenericJSToWasmWrapper builtin by adding it to the list of executable
builtins.

R=ahaas@chromium.org
CC=​evih@chromium.org

Bug: v8:10701
Change-Id: I49b8144237aca20f5f663c7b32810a16f715ad5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438415
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70218}
2020-09-30 10:45:47 +00:00
Zhao Jiazhong
2abb9de6f5 [mips] Skip inspector/debugger/wasm-scope-info* tests
Since the inspector/debugger/wasm-scope-info* tests need simd128,
but not all mips cpus support it, we skip the tests on mips
platforms without simd support.

Change-Id: Iebefa5d6b33d80d707ad0077be7d4f25e3e52b4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2439769
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70216}
2020-09-30 10:15:05 +00:00
Manos Koukoutos
2e9cb16c14 [wasm][bug] Compare signatures correctly in ResolveWasmImportCall
Changes:
- Implement WasmExportedFunction::MatchesSignature.
- Use it over comparison with == in ResolveWasmImportCall.
- Add a test which exposes the existing bug.
- Add a few reminder TODOs.

Bug: v8:9495
Change-Id: Ibbe31dbf550be212dbf2170ab8cdab9b4b6de734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438060
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70215}
2020-09-30 09:56:27 +00:00
Ng Zhi An
d8a36591ed [wasm-simd][scalar-lowering] Fix sign extend/masks of lanes
For replacing lanes (i8x16 and i16x8) the replacement value is stored in
a word32. Simply storing it will cause us to have the wrong value, we
need to mask (for overflow) and extend appropriately.

Same for extracting, the values are stored in sign-extended form,
unsigned extracts should zero the top bits.

Bug: v8:10507
Change-Id: If5ed79f5b6bdb64f900a54b9e148b2d96a74f312
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436612
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70210}
2020-09-30 00:16:24 +00:00
Andrey Kosyakov
582de025d8 Do not pause on breaks while installing additional command line API
A break may cause the session disconnect (and therefore agents destruction)
on a nested message loop. The runtime agent code is generally prepared to
handle this during evaluate, but the code outside of it may be not. Besides,
having a break before the console API installed is generally not what
user wants or expects, so just disable all breaks while installing the API.

Bug: chromium:1122487
Change-Id: I1d40f5007f2e1e4ec07a50ef57988513d0309b7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2437383
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70209}
2020-09-30 00:12:24 +00:00
Ng Zhi An
ed7204bbde [wasm-simd] Add saturating conversion opcodes to wasm-module-builder.js
Bug: v8:10933
Change-Id: I6709dac3598f9dea96fe6f5efec452c1bbdcbc2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436611
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70208}
2020-09-29 20:18:13 +00:00
Ng Zhi An
98e2796555 [wasm-simd] Protected load transforms are not eliminatable
LoadTransform operators contain a LoadKind, which can be unaligned,
protected, poisoned, normal.

If it is protected, we cannot eliminiate that load,
since we rely on the segv signal handling. So, we use partial template
specialization on LoadKind::kProtected, and don't set the operator to
not be eliminatable.

Bug: chromium:1132461
Change-Id: If45fc6562348ffd4dbaa27058e6c5d4242f79abb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436081
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70205}
2020-09-29 17:24:53 +00:00
Samuel Groß
32e2584405 [sandbox][x64] Access external pointer through a table
This change moves external pointers into a separate table and turns
external pointers in heap objects into indices into that table.

This CL implements one of two possible ownership models for the table
entries. With this one, every heap object owns its table entries, and
they are allocated when the owning object is allocated. As such, setting
external pointer fields does not require allocation of table entries. On
the other hand, table indices cannot be shared between multiple objects.

This CL does not yet implement freeing of external pointer table
entires. This will later happen by a table garbage collector.

Bug: v8:10391
Change-Id: I4d37785295c25a7d1dcbc9871dd5887b9d788a4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235700
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#70204}
2020-09-29 17:13:43 +00:00
Milad Fa
0b635d7f67 PPC: Skip inspector/runtime/console-messages-limits on sim
Bug: v8:10965
Change-Id: Ie98d77c681cfdc468ae8c1fef51e8b6ec2aa185a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438230
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70201}
2020-09-29 15:07:23 +00:00
Philip Pfaffe
4a20fe3869 Enable evaluateOnCallFrame for wasm frames
This is the first step to support debug evaluate on wasm call frames.
This CL enables calling evaluateOnCallFrame when a wasm frame is
selected, which before always returned undefined. The CL mirrors global
evaluation, and actually enabling inspecting the wasm frame will be part
of a second change.

Bug: chromium:1127914
Change-Id: If0ad0be7c402d85ab2a8e95376398f4f4ef94948
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436338
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70198}
2020-09-29 13:43:21 +00:00
Camillo Bruni
8d389204a6 [log][test] Skip log_two_byte.js test in predictable mode
Allocating the log string causes allocation differences.
Skipping test for now.

Drive-by-fix: remove two more console.log from test

Bug: v8:10966, v8:10668
Change-Id: Ifb93393fb82a983e779246ea728b1f6caf650426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436457
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70197}
2020-09-29 13:18:51 +00:00
Georg Neis
44f23d617a Revert "[compiler] Check for stack overflow in recursive ReduceJSCall"
This reverts commit d734bb4c5d.

Reason for revert: Flawed.

Original change's description:
> [compiler] Check for stack overflow in recursive ReduceJSCall
>
> Gracefully handle hugely nested JSBoundFunctions.
>
> Bug: chromium:1125145
> Change-Id: I08f136fa9d35cf16ea8da5132d4d483a75d0ba94
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418091
> Auto-Submit: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70164}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I2d4ed79e2470981dab7ccba8e0c7e1004fe91369
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1125145
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436342
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70195}
2020-09-29 11:33:52 +00:00
Dominik Inführ
81ceccd598 [test] Fix timeout in AddTraceEventMultiThreaded
Initializing running_ to true in Run() could happen after Stop().

Bug: v8:10315
Change-Id: Ibde2ff8cb8a5db862f970df261481cb55f8b6c96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436459
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70191}
2020-09-29 09:15:51 +00:00
Manos Koukoutos
21d954154c [wasm][cleanup] Rename kLocal<type> constants -> k<type>Code
Change-Id: I7bca3ed949a5dd036c3255cc5853819312387cce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436330
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70190}
2020-09-29 08:48:21 +00:00
Ng Zhi An
c84b85cc30 [wasm-simd][scalar-lowering] Fix signature with lowered Simd
Functions with Simd128 in their signature will be lowered to 4 Word32.
Later for Int64 lowering, it needs to use the lowered signature.
Otherwise we will have weird parameter and signature mismatch, since it
expects Parameter[1] to be == signature()->GetParam(0).

Bug: v8:10507
Change-Id: Ia9417ecd46c1768344ed1fb3ebfe4e8dd9c3e397
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432626
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70185}
2020-09-29 00:15:05 +00:00
Ng Zhi An
78391a4450 [wasm-simd] Fix typo in constructing SIMD Global
The value should be v128 according to
https://github.com/WebAssembly/simd/blob/master/proposals/simd/SIMD.md#global-constructor.

Change-Id: I9d29905daaaf19cdcaf686991f4887c3e709d2d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436638
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70184}
2020-09-28 23:29:44 +00:00
Frank Tang
07e0c55538 [date] Fix crash by invalid TimeZone "US/x0" names.
Bug: chromium:1132641
Change-Id: Ifa005f9c901ccc865159b618e5145b6d83293b2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436078
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70182}
2020-09-28 21:34:34 +00:00
Manos Koukoutos
df92d806b8 [wasm-gc] Initializer expressions can reference locally def. globals
Changes:
- Add current global index argument to consume_init_expr.
- Inline DecodeGlobalInModule. Move the check for undefined global
  indexes into into consume_init_expr. Note: This fixes a bug where the
  index wasn't checked for nested global.get.
- Under --experimental-wasm-gc, allow global initializers to reference
  already defined globals in the same module.
- Rename ModuleDecoderImpl::DecodeInitExpr -> DecodeInitExprForTesting.
  Remove redundant "start" argument.
- Add tests for global initializers. Remove a redundant test.

Bug: v8:7748
Change-Id: Ieb4a768f8cfdd423e5f439bb3467700068f240b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2428596
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70181}
2020-09-28 19:15:23 +00:00
Michael Achenbach
ef2e6dc5ee [test] Run more variants on no-CM builder
This additionally combines --future with all other standard testing
variants.

This also enables using concurrent_marking in status files to skip
tests in this variant.

This also marks a slow test that times out in the new config.

Bug: v8:10875
Change-Id: Id904f6a2c51b814eecfccb523a897de2f5d96f56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423719
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70180}
2020-09-28 19:04:19 +00:00
Adam Klein
ac395813f1 [compiler] Remove apparent no-op compiler test
This test likely did something in 2013 when we still had legacy const,
but now it seems like it's mostly a poor unittest of when
optimization/deoptimization happens.

Bug: v8:10933
Change-Id: Ib816e0eddf9224a4ad37096591da9032740d5e7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432313
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70178}
2020-09-28 18:14:49 +00:00
Camillo Bruni
7d60fe99cb [d8] Improve error message for invalid module file
Change-Id: Ia55be7d7eda930e6ebf2a0e46c466873006e9d68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2429264
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70176}
2020-09-28 17:31:04 +00:00
Camillo Bruni
12cd035911 [test][tools] Add test for timline.mjs
Bug: v8:10668
Change-Id: I51f81a66408a4b262f9ac7e6421609c5e485f779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435107
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70174}
2020-09-28 16:47:44 +00:00
Maya Lekova
677920320c [turbofan] Add float unit tests for c-linkage/x64
Bug: chromium:1052746
Change-Id: Iafe5104952d8086e2cabdff8aa031e964ff0626a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423704
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70173}
2020-09-28 16:46:40 +00:00
Thibaud Michaud
9b385eb72c [regalloc] Remove live range splintering
Control-flow aware allocation has been enabled by default for a long
time now. This removes the unused code paths related to splintering.

R=neis@chromium.org

Bug: v8:10933
Change-Id: I19d9eb448c3912b24a1ad16030e7dd556b13accc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434328
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70172}
2020-09-28 16:45:35 +00:00
Victor Gomes
f11cf0af46 [compiler] Change AssembleReturn to use ret instead of jmp
- Improves return address prediction
- Fix PopAndReturn CSA tests

Change-Id: I5ed76e32bb997f47dcce725511a8653e34a4c398
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435369
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70169}
2020-09-28 15:37:57 +00:00
Maya Lekova
ce38a0679b [turbofan] Add double support in c-linkage for x64
This CL also adds some unit tests, locally tested under x64.

The double support is based on this original CL by Gus Caplan
(snek@chromium.org):
https://chromium-review.googlesource.com/c/v8/v8/+/2264612

Bug: chromium:1052746
Change-Id: Ibdf631689b01ab619a72005226bfc015b4737dde
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416028
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70168}
2020-09-28 15:36:53 +00:00
Camillo Bruni
e0d04697d6 [log][test] Fix log_two_byte test
Remove debug code that fails with predictable tests.

Bug: chromium:1130673
Change-Id: Ie0009a3b18979057b08c25d22c58c7542dd1db6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435678
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70167}
2020-09-28 15:35:47 +00:00
Georg Neis
d734bb4c5d [compiler] Check for stack overflow in recursive ReduceJSCall
Gracefully handle hugely nested JSBoundFunctions.

Bug: chromium:1125145
Change-Id: I08f136fa9d35cf16ea8da5132d4d483a75d0ba94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418091
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70164}
2020-09-28 14:47:18 +00:00
Camillo Bruni
94bce1dcac [tools] Convert JS-tools to ES6 modules
This changes all tools to use ES6 modules and proper imports.

Step 1: Add converted .mjs files (*this CL*)
Step 2: Update node-ci build to use new .mjs files
Step 3: Remove outdated .js files

Bug: v8:10667, v8:10933
Change-Id: I3e92e66f896d8a9cacaf6d421f8d2c86fb3bc444
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431045
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70163}
2020-09-28 14:40:18 +00:00
Simon Zünd
e281dc303e Don't use the isolate compilation cache for REPL mode scripts
The compilation cache doesn't know about REPL mode. This means that
non-REPL mode compiled scripts are successfully found for their
REPL mode equivalent and vice versa.

This CL disables the compilation cache for REPL mode scripts.
Performance is not really a concern as DevTools console inputs
are usually very small.

R=leszeks@chromium.org

Bug: chromium:1108021
Change-Id: If396c7aa004188730762e4f6bd01dae2fc141181
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434333
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70160}
2020-09-28 13:25:56 +00:00
Camillo Bruni
1e80ad69b3 [tools] Remove tools/profviz
The tool has been outdated for a while and replaced by profview for
most use-cases.

The last version is still hosted under
https://v8.github.io/tools/v8.4/profviz/profviz.html

Bug: v8:9260, v8:10667
Change-Id: I54888640a627ee8e4d8ad2ab63bd91e04e6fb98f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434335
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70159}
2020-09-28 13:22:46 +00:00
Dan Elphick
c55c00d488 [CSA] Fix CSA::PopAndReturn tests
These tests were incorrectly declaring the number of parameters the
generated function would take by omitting the receiver and
PopAndReturnVariable was accessing the wrong parameter.

Also updated a passed in parameter to not match the constant that was
being returned in case that led to the test passing accidentally.

Bug: v8:10933
Change-Id: Ia354e4e30b464a333039ab6bc54198acd16a4789
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434334
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70157}
2020-09-28 12:25:06 +00:00
evih
4924d01f8b Use js-to-wasm generic wrapper for f32 and f64 params
Currently, the generic wrapper is used for i32, i64, f32 and f64 params
and 0 or 1 i32, i64, f32, f64 return value.

Bug: v8:10701
Change-Id: I3776de617aa4a384fdff5154ddad8ff405001a33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2429266
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70156}
2020-09-28 11:13:36 +00:00
Dan Elphick
df0ea9732e [torque] Fix TestBitFieldStore reading wrong parameter
Fixes test-torque/TestBitFieldStore to read the Smi parameter passed in
rather than the receiver which was always the global object.

Change-Id: Ie6b343ad7ef9393c211b0e7c8e1b7c1427e0aeb4
Bug: v8:10933
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434327
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70154}
2020-09-28 10:55:06 +00:00
Omer Katz
be45cd8e00 cppgc: Add concurrent marking tests
Bug: chromium:1056170
Change-Id: I2f62c74c3e435e05fd9e313af2f15925583872ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423716
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70153}
2020-09-28 09:43:36 +00:00
Alex Kodat
9329f558bb [debug] Restore StepNext on correct frame for RestoreDebug
When an Isolate in a multi-threaded environment is being debugged
and a thread does a Step Over (StepNext internally) one-shot
breaks are created in the code at the stack frame where the
StepNext occurred. However, if the stepped-over statement had
a function call and the called function (or some function that
it called) unlocked the Isolate (via a C++ function call) and
another thread then locked the Isolate, an ArchiveDebug would
be done which would save the fact that a StepNext is active and
the call frame depth of the StepNext. The one-shot breaks would
then be cleared to avoid stopping the now running thread.

When the original thread that did the StepNext relocks the Isolate,
a RestoreDebug is done which, seeing that a StepNext was active
calls PrepareDebug which assumes that the StepNext must be for
the current JS frame which is usually correct, but not in this
case. This results in the StepNext break actually occurring in the
function that called the C++ function not in the function where
the StepNext was originally done. In addition, the function where
the break now happens must necessarily be deoptimized if
optimized, and debug code and a source map table created if one
doesn't already exists though this is largely invisible to the
user.

Occasionally, a crash/core dump also occurs because the stack
guard is restored after the debugging environment is restored in
the RestoreThread code which can prevent the compiler from being
called to generate the source map table (for the incorrect
function) since the stack guard is another thread's stack guard,
and so might appear that the stack guard has been gone past so
the compiler is not called, resulting in there being no source
map table. But PrepareStep ends up calling the BreakIterator
(via the DebugInfo constructor) which assumes there is a source
map table so we get a crash.

The fix is to have PrepareStep to skip to the frame where the
StepNext was done before doing its thing. Since the only
PrepareStepcaller that requires a frame other than the current
frame, is RestoreDebug, a target frame parameter was added to
PrepareStep that's set by RestoreDebug and defaults to -1
indicating to use the current frame for all other callers.

While this made the order of the debug environment and stack
guard no longer cause an obvious problem, it still felt wrong
to defer restoration of the stack guard until after something
as potentially complex as PrepareStep might be called, so the
order of RestoreDebug and RestoreStackGuard calls were reversed.

Bug: v8:10902
Change-Id: I174e254e72414c827e113aec142f1d329ebe73d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2405932
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70152}
2020-09-28 09:23:25 +00:00
Omer Katz
905318c724 Reland "cppgc: Provide jobs support through DefaultPlatform and TestPlatform"
This reverts commit 2221f0909b.

Reason for revert: fix in patchset 2

Original change's description:
> Revert "cppgc: Provide jobs support through DefaultPlatform and TestPlatform"
>
> This reverts commit 22c0fc8f2e.
>
> Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20gcc/8712?
>
> Original change's description:
> > cppgc: Provide jobs support through DefaultPlatform and TestPlatform
> >
> > This CL extends cppgc::DefaultPlatform and TestPlatform to emulate
> > jobs using std::thread and v8::base::Thread respectively.
> > Jobs using these platform do not yield unless the job as been
> > cancelled. Additionally, the job priority is ignored.
> >
> > Bug: chromium:1056170
> > Change-Id: I72db1eef410d2be3d3e5ea7d4ece9e5584a451f2
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416378
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#70139}
>
> TBR=mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org
>
> Change-Id: Ic29235e3ab78a1b515a5b14b808e116a1ccffc0f
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:1056170
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432087
> Reviewed-by: Francis McCabe <fgm@chromium.org>
> Commit-Queue: Francis McCabe <fgm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70142}

# Not skipping CQ checks because this is a reland.

Bug: chromium:1056170
Change-Id: Iaa8312da759ab97f646a9fb6144462a115393b5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431666
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70150}
2020-09-28 09:07:25 +00:00
Ng Zhi An
8ca2a7c833 [wasm-simd][scalar-lowering] Fix 64x2 load splat
64x2 nodes were already supported, we just didn't add the case for
64x2 load splat. Add that in and we pass simd_load_splat.js.

Bug: v8:10507
Change-Id: If9145e1b3a4595f4707ca0fc3dcee466773c054f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432074
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70149}
2020-09-25 22:10:22 +00:00
Bill Budge
f50d8c7840 [cleanup] Remove 'RT' suffix on Runtime ToString function
Bug: v8:10933
Change-Id: I4db540cf47ce5cfa25757d776a2bf988ce3ed554
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432072
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70147}
2020-09-25 21:18:32 +00:00
Ng Zhi An
1987480671 [wasm-simd][scalar-lowering] Fix splats for i8 and i16
i8 and i16 nodes are stored in word32 nodes, when splat-ing them, we
need to make sure to handle overflow values and also sign extend them
correctly.

This fix allows us to pass simd-splat.js. It still fails on ARM
(non-simulator) due to a use of f32x4.min in the test.

Bug: v8:10507
Change-Id: I1507637a7edb33a530c84c85ee8d4acb481293e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2430170
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70146}
2020-09-25 20:49:52 +00:00
Almothana Athamneh
42c2fb3cf5 [test] Ensure tests relying on no-inlining keep working
Add opt and noturbo inlining to these tests to ensure that
they keep working.

Bug: v8:10924
Change-Id: Icdb5ddffad11ea3c2eea723e339d450d8405b6b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426604
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70145}
2020-09-25 19:09:22 +00:00
Gus Caplan
83f778aff1 Add iterator done check in spread destructuring
This fixes the logic in the desugaring of destructuring assignments. In
particular, a spread element would not check if previous `next` results
had already been done, and would always call `next()` again.

Change-Id: I1bd384678722e6cf51c5777fc3b0dd965360291a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2430488
Commit-Queue: Gus Caplan <snek@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70144}
2020-09-25 19:08:17 +00:00
Adam Klein
74794fb937 [wasm-simd] Rename shuffle & swizzle instructions to match spec
These instructions were changed from "s8x16" to "i8x16" prefixes in
https://github.com/WebAssembly/simd/pull/321.

This CL updates all V8 code, including arch-specific code, to match.

Bug: v8:10946, v8:10933
Change-Id: I26ef9ad77571f94501d42c1d65f57380fd507f3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432068
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70143}
2020-09-25 19:07:12 +00:00
Francis McCabe
2221f0909b Revert "cppgc: Provide jobs support through DefaultPlatform and TestPlatform"
This reverts commit 22c0fc8f2e.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20gcc/8712?

Original change's description:
> cppgc: Provide jobs support through DefaultPlatform and TestPlatform
>
> This CL extends cppgc::DefaultPlatform and TestPlatform to emulate
> jobs using std::thread and v8::base::Thread respectively.
> Jobs using these platform do not yield unless the job as been
> cancelled. Additionally, the job priority is ignored.
>
> Bug: chromium:1056170
> Change-Id: I72db1eef410d2be3d3e5ea7d4ece9e5584a451f2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416378
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70139}

TBR=mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org

Change-Id: Ic29235e3ab78a1b515a5b14b808e116a1ccffc0f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432087
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70142}
2020-09-25 17:51:10 +00:00
Omer Katz
22c0fc8f2e cppgc: Provide jobs support through DefaultPlatform and TestPlatform
This CL extends cppgc::DefaultPlatform and TestPlatform to emulate
jobs using std::thread and v8::base::Thread respectively.
Jobs using these platform do not yield unless the job as been
cancelled. Additionally, the job priority is ignored.

Bug: chromium:1056170
Change-Id: I72db1eef410d2be3d3e5ea7d4ece9e5584a451f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416378
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70139}
2020-09-25 17:47:08 +00:00