Commit Graph

62296 Commits

Author SHA1 Message Date
Thibaud Michaud
78774f07d5 [wasm][fuzzer] Remove unused function
R=ahaas@chromium.org

Change-Id: I757abd5d0e8e63745482e9bec66abf39a174f0ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201759
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67804}
2020-05-14 15:18:44 +00:00
Omer Katz
930598427c Reland "cppgc: Stack scanning using ObjectStartBitmap"
This reverts commit 580917d252.

Reason for revert: fix in patchset 2

Original change's description:
> Revert "cppgc: Stack scanning using ObjectStartBitmap"
> 
> This reverts commit d3a72e3c2a.
> 
> Reason for revert: MSAN failures (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/32360)
> 
> Original change's description:
> > cppgc: Stack scanning using ObjectStartBitmap
> > 
> > This CL implements stack scanning for cppgc.
> > Given a value on the stack, the MarkingVisitor uses
> > PageBackend::Lookup to checks whether that address is on
> > the heap. If it is, BasePage::TryObjectHeaderFromInnerAddress
> > (introduced in this CL) is used to get the relevant object
> > header. Note that random addresses on the heap might point to
> > free memory, object-start-bitmap, etc.
> > 
> > If a valid object header is found:
> > * If the object is not in construction, the GCInfoIndex is used
> > the get the relevant Trace method and the object is traced.
> > * Otherwise, the object is conservatively scanned - i.e. the
> > payload of the object is iterated word by word and each word is
> > treated as a possible pointer.
> > 
> > Only addresses pointing to the payload on non-free objects are
> > traced.
> > 
> > BasePage::TryObjectHeaderFromInnerAddress assumes on LAB on the
> > relevant space, thus all LABs are reset before scanning the stack.
> > 
> > Bug: chromium:1056170
> > Change-Id: I172850f6f1bbb6f0efca8e44ad8fdfe222977b9f
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190426
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#67795}
> 
> TBR=ulan@chromium.org,mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org
> 
> Change-Id: I3caef6f9f55911fd1a86e895c3495d1b98b1eac2
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:1056170
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201136
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67796}

TBR=ulan@chromium.org,mlippautz@chromium.org,leszeks@chromium.org,bikineev@chromium.org,omerkatz@chromium.org

# Not skipping CQ checks because this is a reland.

Bug: chromium:1056170
Change-Id: If7ea4fe5cb794c07544d5545f5d6548e3375d3ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201137
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67803}
2020-05-14 15:07:23 +00:00
Leszek Swirski
acb8fefa02 [compiler] Hold Handles for finalization data
Avoid the SFI lookup in the script's weak SFI list, which could fail if
the function was somehow GCed between allocation and finalization, and
instead hold a Handle to each finalizing SFI in the finalization data
structure.

For similar reasons, also check that the compiled function to have its
compilation finalized is still compiled by that point, because it could
have been bytecode flushed.

Bug: chromium:1081691
Change-Id: I4e1f681263473a966e782b23291636d10a9209c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199349
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67802}
2020-05-14 14:51:53 +00:00
Omer Katz
cc6dfd5d67 Fix CountPopulation non-builtin implementation
The existing non-builtin implementation is returning wrong results.
For example, given the value 63 as a uint8_t it returns 38 (should be 6).

The new implementation follows the naive algorithm presented in figure 5-1
in Hacker's Delight section 5-1.
Note that the algorithm in the book is designed for 32 bit numbers, so we
extended it to support 64 bit as well.

Bug: chromium:1056170
Change-Id: I8fed9c449f80b01b8cc93d339529c0e1e0863fc0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199345
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67801}
2020-05-14 14:24:13 +00:00
Mythri A
4753a0a4e3 [TurboFan] Fix a bug with holder equality checks in ReduceCallApiFunc
When reducing api calls, TurboFan infers the maps of the receiver
and tries to drop the compatibile receiver checks if we can verify that
it is safe to do so. One of these checks involves checking that the holder
is same across all of the receiver maps. However, when receiver itself
is the holder the existing checks prevent TurboFan from optimizing the
api calls.

Change-Id: I6aad39a1a9bb351550e04dd883fa49d7d53ca691
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201076
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67800}
2020-05-14 14:12:33 +00:00
Leszek Swirski
595609fb85 [offthread] Add off thread deserialization
Add a new OffThreadObjectDeserializer, which can deserialize a snapshot
into an OffThreadIsolate.

This involves templating the Deserializer base class on Isolate, and
amending OffThreadHeap to be able to create Reservations same as the
main-thread Heap can. Various off-thread incompatible methods are
stubbed out as UNREACHABLE in OffThreadIsolate overloads.

There is currently no API entry into the off-thread deserialization, but
under --stress-background-compile it now runs the CodeDeserializer (i.e.
code cache deserialization) in a background thread.

Bug: chromium:1075999

Change-Id: I2453f51ae31df4d4b6aa94b0804a9d6d3a03781e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172741
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67799}
2020-05-14 13:50:24 +00:00
Leszek Swirski
4dabba12bc [cleanup] Make SFI::function_data a SYNCHRONIZED_ACCESSOR
We can use existing macros to define this getter/setter rather than hand
writing it -- as a side effect this ends up defining an Isolate overload
of the getter which was otherwise missing.

Bug: v8:10506
Change-Id: I0bc5a3082b5ed0416c8099a94e7d2e32a2bd363f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199350
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67798}
2020-05-14 12:58:52 +00:00
Ulan Degenbaev
555324dadb [heap] Disable --scavenge-separate-stack-scanning flag by default
It was enabled accidentally.

Bug: chromium:1082426
Change-Id: I08019aeb3ddc34fea8ce9e08c6ace3a95335c171
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199354
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67797}
2020-05-14 11:26:04 +00:00
Leszek Swirski
580917d252 Revert "cppgc: Stack scanning using ObjectStartBitmap"
This reverts commit d3a72e3c2a.

Reason for revert: MSAN failures (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/32360)

Original change's description:
> cppgc: Stack scanning using ObjectStartBitmap
> 
> This CL implements stack scanning for cppgc.
> Given a value on the stack, the MarkingVisitor uses
> PageBackend::Lookup to checks whether that address is on
> the heap. If it is, BasePage::TryObjectHeaderFromInnerAddress
> (introduced in this CL) is used to get the relevant object
> header. Note that random addresses on the heap might point to
> free memory, object-start-bitmap, etc.
> 
> If a valid object header is found:
> * If the object is not in construction, the GCInfoIndex is used
> the get the relevant Trace method and the object is traced.
> * Otherwise, the object is conservatively scanned - i.e. the
> payload of the object is iterated word by word and each word is
> treated as a possible pointer.
> 
> Only addresses pointing to the payload on non-free objects are
> traced.
> 
> BasePage::TryObjectHeaderFromInnerAddress assumes on LAB on the
> relevant space, thus all LABs are reset before scanning the stack.
> 
> Bug: chromium:1056170
> Change-Id: I172850f6f1bbb6f0efca8e44ad8fdfe222977b9f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190426
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67795}

TBR=ulan@chromium.org,mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org

Change-Id: I3caef6f9f55911fd1a86e895c3495d1b98b1eac2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2201136
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67796}
2020-05-14 11:09:25 +00:00
Omer Katz
d3a72e3c2a cppgc: Stack scanning using ObjectStartBitmap
This CL implements stack scanning for cppgc.
Given a value on the stack, the MarkingVisitor uses
PageBackend::Lookup to checks whether that address is on
the heap. If it is, BasePage::TryObjectHeaderFromInnerAddress
(introduced in this CL) is used to get the relevant object
header. Note that random addresses on the heap might point to
free memory, object-start-bitmap, etc.

If a valid object header is found:
* If the object is not in construction, the GCInfoIndex is used
the get the relevant Trace method and the object is traced.
* Otherwise, the object is conservatively scanned - i.e. the
payload of the object is iterated word by word and each word is
treated as a possible pointer.

Only addresses pointing to the payload on non-free objects are
traced.

BasePage::TryObjectHeaderFromInnerAddress assumes on LAB on the
relevant space, thus all LABs are reset before scanning the stack.

Bug: chromium:1056170
Change-Id: I172850f6f1bbb6f0efca8e44ad8fdfe222977b9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190426
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67795}
2020-05-14 10:56:28 +00:00
Santiago Aboy Solanes
2b7201500b [turbolizer] Update Readme regarding typescript migration
Basically, remove 'Turbolizer is currently migrating to TypeScript.'

Bug: v8:7327
Change-Id: I83df1b4cf568e17c2e9393865702e5bb722a8b95
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199353
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67794}
2020-05-14 10:55:23 +00:00
cjihrig
9868b2aefa Fix SmartOS compilation errors
This commit resolves compilation errors on SmartOS that
were found while upgrading Node.js.

See: https://github.com/nodejs/node/pull/32831
Change-Id: Ia2a2e028ba4f5bfd69c050cab4fb4e13af5eefd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2191054
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67793}
2020-05-14 10:31:43 +00:00
Dan Elphick
cde84e8428 [heap] move MemoryChunk functions to memory-chunk.cc
Also adds missing header includes.

Bug: v8:10473
Change-Id: Ib5bf599dae5bc954edcb6e6fcbd83004bd48c1eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199347
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67792}
2020-05-14 09:54:44 +00:00
Manos Koukoutos
bb964252cc [wasm-gc][bug] Remove UNIMPLEMENTED to supress fuzzer errors
Bug: chromium:1082309, chromium:1082083
Change-Id: I616da287adce5db7952eadf11364a7593e405fdb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199346
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67791}
2020-05-14 09:39:33 +00:00
Thibaud Michaud
63c84da67c [wasm][fuzzer] Fuzz multi-return functions
R=ahaas@chromium.org

Bug: v8:10408
Change-Id: Ic5cb2b915584c64656bfc5baf8c9524a7d5bf48c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196346
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67790}
2020-05-14 09:20:33 +00:00
Varun Varada
a25dce8a05 Fix console time format error
There should be a space between the quantity and the unit symbol
as per the SI, so this commit fixes this issue.

Change-Id: I3356942391d96906f3e3840c7bb802e10f29eb4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190230
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67789}
2020-05-14 07:36:54 +00:00
Omer Katz
288b545ad0 cppgc: Add TraceCallback to GCInfo
This is needed to trace objects found durinbg stack scanning.

Bug: chromium:1056170
Change-Id: I1280d98f2fe69281c514b3a7d4a57f909a2eed96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190425
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67788}
2020-05-13 23:53:43 +00:00
Ng Zhi An
795246c444 [wasm-simd][arm64] Implement f32x4 f64x2 pmin pmax
Bug: v8:10501
Change-Id: I6dad0f4da4d7c50d0793d39a5a119defb6b53844
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2191392
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67787}
2020-05-13 23:40:23 +00:00
Ng Zhi An
6a6ec7a10c [wasm-simd][ia32] Fix f32x4.min AVX implementation
The AVX implementation does not have dst == input(0), so the vminps call
was wrong. The intention is to compare the 2 input operands.

Bug: chromium:1081030
Change-Id: Id54074327a6aca4b75988fc9d85beccfeabfc791
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2194471
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67786}
2020-05-13 22:54:53 +00:00
Bill Budge
bd4f1a6100 [wasm] Torqueify more builtins.
- Rewrites the following builtins using Torque:
  WasmAtomicNotify
  WasmI32AtomicWait64
  WasmI64AtomicWait64
  WasmAllocateStruct
- Adds some helper builtins to reduce the size of the Atomics builtins.
  These do multiple conversions and CSA inlines all of this code. As
  these are runtime calls, the call overhead should be negligible.
  WasmInt32ToNumber
  WasmUint32ToNumber

Change-Id: Ie15e15a965dc383c54ae50164d83bce211178888
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2176895
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67785}
2020-05-13 22:17:53 +00:00
Michael Lippautz
81290c4851 cppgc: Use static_assert to force semi colon after macro
Bug: chromium:1056170
Change-Id: I1b6787ecea6ad58173a0bcc8e8d0862a5b19d299
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2199342
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67784}
2020-05-13 21:47:48 +00:00
Igor Sheludko
bf251848b5 [ic] Properly handle store mode generalization in KeyedStoreIC
... when one of the receivers is a JSArray that may have a read-only
length.

Bug: chromium:1069530
Change-Id: Idbaf1a9030bb5a0f9c25e30925f18f603a99832f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196353
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67783}
2020-05-13 15:14:21 +00:00
Zhao Jiazhong
265405ca58 [mips][wasm-simd][liftoff] Implement shl
Port 91cbf3e310
https://crrev.com/c/2171475

Change-Id: I09e24f7da0449fa891633794bc3a8ef639352eeb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198862
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67782}
2020-05-13 14:38:40 +00:00
Zhao Jiazhong
4b4567f781 [mips][liftoff][mv] Support multi-value returns
Port b931af5dd8
https://crrev.com/c/2190423

Change-Id: I9d5eeae078604e1bd5241afea14f169f45711ce3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198056
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67781}
2020-05-13 14:35:40 +00:00
Milad Farazmand
111619b414 PPC/s390: [wasm-simd][liftoff] Implement shl on x64 and ia32
Port 91cbf3e310

R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ie69563747b10a2a783289d21b39ea3c48e99e2c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198361
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#67780}
2020-05-13 13:53:20 +00:00
Andreas Haas
b4eb441837 [wasm][liftoff] Push stack parameters of builtins in reversed order
This CL fixes a bug in Liftoff where stack parameters for builtins were
pushed in the reversed order.

CC=bbudge@chromium.org
R=clemensb@chromium.org

Bug: v8:10281
Change-Id: I51ab4f19b0dc3835140ca3c05c98cc82dfe9cac4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196341
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67779}
2020-05-13 13:47:30 +00:00
Marja Hölttä
335a141b85 [Promise.any] Implement async stack traces for Promise.any
We can't attach a meaningful stack trace to the AggregateError
Promise.any rejects with, but we can augment the individual errors'
stack traces with Promise.any and the index of the corresponding
Promise in the input.

Bug: v8:9808
Change-Id: I7ba754c9b043594decaac8b3a23be74f05c3dffd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198983
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67778}
2020-05-13 13:33:10 +00:00
Clemens Backes
10e8664b3b [wasm][debug] Skip scopes on uninspectable frames
Frames that have not been compiled by Liftoff for debugging are
uninspectable. Instead of reporting an empty local scope and stack scope
in this case, just don't report these two scopes at all.

This also fixes a case missed in https://crrev.com/c/2196349, where we
would still try to generate the stack scope for non-debugging code.

Drive-by: Use {WasmFrame} instead of {StandardFrame} in the
{DebugWasmScopeIterator}, and use the {FrameInspectionScope}
consistently.

R=thibaudm@chromium.org, bmeurer@chromium.org
CC=kimanh@chromium.org

Bug: v8:10359, chromium:1071757, chromium:1079328, chromium:1072839
Change-Id: I3a3731a0bd9f582f94458500252922b4146e394f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198982
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67777}
2020-05-13 13:27:10 +00:00
Leszek Swirski
9c8a7f84ce [heap] Make Heap::Contains const
Add const Page iterators to Spaces, and add whichever const methods are
necessary for this to work. This and a couple more const methods allows
us to make Heap::Contains const.

Change-Id: I1b63a10575ccdb8a3979aef4fa63a97b288ff836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198975
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67776}
2020-05-13 13:19:22 +00:00
Dominik Inführ
0062d7594c [heap] Introduce barrier when merging LocalSpace
Ensure that page header flags are properly initialized before concurrent markers can discover objects.

Bug: v8:10315
Change-Id: Ib9ce813dfd3fda75e4ee209a846828366222b110
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198990
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67775}
2020-05-13 13:14:20 +00:00
Dan Elphick
3fab452f4d [heap] Move slot_set_ out of BasicMemoryChunk
BasicMemoryChunk will become the base class for ReadOnlySpace pages
which won't be MemoryChunks. Since ReadOnlySpace pages don't participate
in GC they don't need slot_set_.

Also some references to BasicMemoryChunk fields that were still prefixed
with MemoryChunk::

Bug: v8:10454
Change-Id: If8ce40c7ee72d1617d2a1161ad9d4b7929f8a8e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198988
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67774}
2020-05-13 12:31:50 +00:00
Jakob Gruber
35f88bf3cc Fix node->Print() in gdb
With the default arg, node->Print() complains about a missing parameter
in gdb. This CL adds a wrapper method instead of the default arg.

Change-Id: Idd6e5bb8e0022255449d5f54420d930b55ca1134
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198991
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67773}
2020-05-13 12:02:50 +00:00
Michael Lippautz
61b1d020ad Reland "cppgc: Port ObjectStartBitmap"
This is a reland of 3df36990b3

Original change's description:
> cppgc: Port ObjectStartBitmap
> 
> This ports ObjectStartBitmap from Blink.
> 
> Bug: chromium:1056170
> Change-Id: Ib959d9ac1c5e1e34ffa6418f77956e993c570ffc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181331
> Commit-Queue: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67735}

Bug: chromium:1056170
Change-Id: I6e2fd99e96bebe3060f4feb8503ab04c0d452d51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198986
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67772}
2020-05-13 11:34:20 +00:00
Igor Sheludko
f67131e500 [sandbox][api] Introduce Internals::GetIsolateForHeapSandbox()
... for the cases when the Isolate is necessary only for external
pointers decoding. This will avoid unnecessary calls to non-inlined
IsolateFromNeverReadOnlySpaceObject().

Bug: v8:10391
Change-Id: I0a299c8a44d5845f26cf704ce53555bf07c93f8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198978
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67771}
2020-05-13 09:42:00 +00:00
Ambroise Vincent
20945ef75d [turbofan] Add SIMD multiply-add/sub on arm64
Fold distinct MUL and ADD (or SUB) instructions into a single MLA (or
MLS) instruction, mirroring what is being done for general purpose
registers.

SIMD wasm only uses the vectorized ADD and MUL instructions on quad
vectors (NEON Q), so only those cases are handled.

SIMD wasm only uses MUL by vectors, not by elements so there is no need
to check for an addition and shift reduction.

Change-Id: If07191dde9fb1dc37a5de27187800c15cc4325ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184239
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#67770}
2020-05-13 09:40:00 +00:00
Frank Tang
69b46896ff Roll test262
f1b0a1e27..d2f7d428

Bug: v8:7834, v8:10510
Change-Id: Iad860f82cb1b30639d07b3541540f244ab8c61a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2197618
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67769}
2020-05-13 09:14:21 +00:00
Camillo Bruni
b509448a7d [runtime] Don't query the number_string_cache on the fallback path
This CL locally improves Number.toString by 5% for the slow case where
the number is not found in the cache.

- Introduce NumberCacheMode to avoid needless querying of the cache
- Allow for some more inlining

Bug: v8:10477
Change-Id: I4163e85db587ab3a6e89c126f81f6095fdb02b2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172793
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67768}
2020-05-13 08:38:20 +00:00
Jakob Gruber
a17a172467 [infra] Add nci variant and enable it on fyi bots
The native context independent (NCI) code variant will be used to test
various aspects as the NCI implementation progresses. Examples:

- Test js-generic-lowering with feedback collection.
- Test NCI codegen without caching or tier-up.
- Test NCI codegen and tier-up without caching.
- Test full NCI (codegen, caching, tier-up).

At some point a build-time flag may be required, we'll see when we get
there.

This variant should be removed once work on NCI is complete.

Bug: v8:8888
Change-Id: I8b12c9a5d69bf167e39e002af385f8f523585550
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2198776
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67767}
2020-05-13 07:32:40 +00:00
Marja Hölttä
07dcc47a27 Move helper SFIs from NativeContext to Isolate, part 5
There's no need for them to be in NativeContext.

This CL moves the only remaining Proxy-related SFI.

Bug: v8:10482
Change-Id: I2f5e2d250c30f552787915d306c1be23b9d033bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196184
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67766}
2020-05-13 07:18:25 +00:00
Yolanda Chen
ec839eb968 [regalloc] Do not spill uses that are constrained to move to register in backwards spilling heuristics
For uses that are moved to registers, they are not beneficial for backwards spilling as it will introduce memory loads from stack to register.

Bug: chromium:1066869, chromium:1063831
Change-Id: I562d22336b6607a8f7286fc65dbf5b95a941a130
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172052
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Cr-Commit-Position: refs/heads/master@{#67765}
2020-05-13 06:53:31 +00:00
Tobias Tebbi
d04ab19768 [torque] allow conditionals with enum constants
Bug: v8:7793, v8:10475
Change-Id: I3c528d07e8d3192d7110ebc81e9e89f79a7c735d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196132
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67764}
2020-05-13 06:49:51 +00:00
Zhou, Zhiguo
91cbf3e310 [wasm-simd][liftoff] Implement shl on x64 and ia32
Bug: v8:9909
Change-Id: I1bd17d6a1a6f32e9076d80c91be2743868ecad2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2171475
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhiguo Zhou <zhiguo.zhou@intel.com>
Cr-Commit-Position: refs/heads/master@{#67763}
2020-05-13 03:00:40 +00:00
Ng Zhi An
364987a9b6 [wasm-simd][fuzzer] Add load splat and load extend
Bug: v8:10180
Change-Id: I4c1d18c71d1514a561c37fb9ae821617de949d87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2194175
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67762}
2020-05-12 22:27:50 +00:00
Shu-yu Guo
89577b6f78 Revert "Reland "[heap] Remove sweeping state in incremental marking""
This reverts commit c25352f388.

Reason for revert: Causing raytrace timeouts on TSAN:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/13089
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/13090
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/13091

Original change's description:
> Reland "[heap] Remove sweeping state in incremental marking"
> 
> This is a reland of 7f29c48ef6
> 
> After fixing TSAN failures in https://crrev.com/c/2192661 and https://crrev.com/c/2193712, this CL and be relanded without changes.
> 
> Original change's description:
> > [heap] Remove sweeping state in incremental marking
> >
> > Remove the SWEEPING state from incremental marking. Sweeping is now
> > always completed when starting incremental marking. Before this change
> > there needed to be a safepoint each for starting marking and completing
> > sweeping. Now both happens within a single safepoint.
> >
> > Bug: v8:10315
> > Change-Id: Iad2835554865f2de24376372affe9a98992d1fa0
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2190419
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#67678}
> 
> Bug: v8:10315
> Change-Id: Ic949d125e72c4d17fd427d08d4b6f9056721eee9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196182
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67741}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: Ie529fd3bef13a28301f22876758d731e466d3939
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2197457
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67761}
2020-05-12 21:21:47 +00:00
Frank Tang
758212a82e [Intl] Fix hour cycle in formatRange
Bug: v8:9934
Change-Id: I8e4c0bb647913b703c01fd0d11329fba254e5350
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2195491
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67760}
2020-05-12 20:38:45 +00:00
Thibaud Michaud
2b2f3a4290 [liftoff][mv] Remove bailout for call_indirect
The recent changes to support multi-value calls should also apply to
indirect calls, so this bailout can be removed.

R=ahaas@chromium.org

Bug: v8:10408
Change-Id: Ia1b2e49caa6f308a4d2f30712a132c7e072df9f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196350
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67759}
2020-05-12 18:23:45 +00:00
Shu-yu Guo
81534e76cd Revert "Whitespace change to trigger bots"
This reverts commit e473d23215.

Reason for revert: Checking if build infra is fixed

Original change's description:
> Whitespace change to trigger bots
> 
> Some bots turned red. Might be an infra failure. Let's see if this CL
> makes it disappear.
> 
> Tbr: machenbach@chromium.org
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Change-Id: I269257184cfca5423fb2c52ae8cfc1ad696002e9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196352
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67757}

TBR=clemensb@chromium.org

Change-Id: Ibe1d2725cc2bd621a3243b8930b43f8ec732420b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2197254
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67758}
2020-05-12 17:11:07 +00:00
Clemens Backes
e473d23215 Whitespace change to trigger bots
Some bots turned red. Might be an infra failure. Let's see if this CL
makes it disappear.

Tbr: machenbach@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I269257184cfca5423fb2c52ae8cfc1ad696002e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196352
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67757}
2020-05-12 16:37:37 +00:00
Clemens Backes
cfe1b64bfc [wasm][debug] Only inspect code generated for debugging
Liftoff code generated for debugging has an extended function prologue
which checks the "hook on function entry" flag on the isolate. Because
of this, code positions between standard Liftoff code and Liftoff code
for debugging do not match up. When (lazily) generating debug side
tables, we always generate them for debugging-flavored Liftoff code.

The issue that this CL fixes happened when we tried to inspect non-debug
Liftoff code, and lazily generated the debug side table for that code.
As noted above, source positions would not match up in that case, and we
get DCHECK failures (or crashes in release builds) when inspecting the
code.

This issue was uncovered as part of the multi-threaded debugging effort,
but because of the similarity in the stack trace, it might also fix the
other issues linked below. We will get test coverage as soon as we add
multi-threaded debugging tests (which are in development, but are still
hitting other issues).

R=thibaudm@chromium.org

Bug: v8:10359, chromium:1071757, chromium:1079328, chromium:1072839
Change-Id: Ic0c14e635dc2a0b84ac86ceb6650288202dafedc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196349
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67756}
2020-05-12 16:05:25 +00:00
Manos Koukoutos
39932a0467 [wasm-gc][bug] Fix Fuzzer crashes on unimplemented experimental code.
Changes:
- Don't use UNIMPLEMENTED where it can be run.
- Implement OpcodeLength for gc types.
- Remove unreachable code.
- Request the correct feature 'gc' for the respective opcodes and types.

Bug: 1079337, 1079450, 1081529, 1081011, 1080444

Change-Id: Ib081139ca805c6f5471a372f862638a3606254b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2196302
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67755}
2020-05-12 15:50:05 +00:00