Commit Graph

358 Commits

Author SHA1 Message Date
Nikolaos Papaspyrou
472429e623 [heap] Fix saving the callee-saved registers on stack
This CL reinstates the trampoline for pushing the values of
callee-saved registers on the stack, which is used for stack scanning.
It reintroduces the set of architecture-specific functions
PushAllRegistersAndIterateStack, removed in crrev.com/c/3989143.
The reason for this change is that the simpler architecture-specific
functions SaveCalleeSavedRegisters failed to correctly save the
values of the registers, in the presence of C++ compiler optimizations.

It also removes the stack context, introduced in crrev.com/c/4017512,
and uses again the trampoline for iterating through the stack.

Bug: v8:13257
Change-Id: I9e656a9b3ba6616168602300f2180b4f340593f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4171639
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85394}
2023-01-19 12:29:05 +00:00
Michael Lippautz
ba401bb42b [heap] Remove LocalEmbedderHeapTracer
Bug: v8:13207
Change-Id: I54c6f501337a502407f8c137ec59f55a6f8d3416
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4174081
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85358}
2023-01-18 09:36:32 +00:00
Victor Gomes
d7d5049cfa [maglev] Create DataViewGetVariableLength builtin
kDataViewGetVariableLength has JS linkage, and so it has a strong
requirement to what should be in the stack and in the registers
(including having a JSFunction for kDataViewGetVariableLength).

These were missing before, which would crash when checking the frame.

Fixed: chromium:1406727
Bug: v8:7700
Change-Id: Iad878cbc06d46403e21162dfdfd3bcd1a2a063d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4162926
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85284}
2023-01-13 14:59:03 +00:00
Manos Koukoutos
90c972bb52 [wasm-gc][turbofan] Introduce wasm load elimination
We introduce high-level typed load elimination for wasm. It is based
on CSALoadElimination. It operates on wasm struct.set/get and
array.length operators (with array operations pending). Wasm types are
used to refine the may-alias analysis ran for stores.

Drive-by:
- Type more nodes in wasm-compiler and wasm-gc-operator-reducer.
- Remove an unsafe-cast test which now hits an Unreachable Turbofan
  node.

Bug: v8:7748
Change-Id: I309e4af4d9f9c584e27ff79804a776666b5dc3c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4146430
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85255}
2023-01-12 14:45:45 +00:00
Michael Lippautz
24ca73004e cppgc: Implement slim write barrier
Introduces a slim write barrier for Oilpan behind
`cppgc_enable_slim_write_barrier` that is enabled by default. The slim
write barrier only performs a single approximate global check for
whether the write barrier is needed and delegates all other checks to
a slow path call. This is beneficial in configurations that do not need
many checks for the barrier overall, i.e., configurations without
young generation. Young generation is off by default which is why this
approach is beneficial.

On Speedometer the write barrier is hit 75M times with a fast bailout
of 99.3%. Progression on Speedometer2 is somewhere around 0.2-0.5%.

The resulting code embedded in another function is only 34 bytes
compared to 128 bytes before. See attached bug for detailed assembly
snippet.

Change-Id: I6869513186e7a26104c46f1f2ac2cfa855689f64
Bug: chromium:1406464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152488
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85232}
2023-01-11 18:54:57 +00:00
Jakob Linke
539b50f5ae [turbofan] Add the v8_enable_turbofan build option
When disabled, Turbofan is fully excluded from the compilation result.
This is expected to reduce V8's contribution to chromium's binary size
by roughly 20%.

If Turbofan is disabled, Maglev and Webassembly must also be disabled
(since both depend on TF).

Note this new configuration (v8_enable_turbofan=false) is not yet
used anywhere - we'll probably enable it for lite_mode bots in an
upcoming CL for test coverage.

Changes in detail:
- Split out all src/compiler files from the main source sets. This
  was mostly done already, here we only clean up the few files that
  were left.
- Define a new main TF entry point in turbofan.h. `NewCompilationJob`
  replaces `Pipeline::NewCompilationJob`.
- When TF is enabled, turbofan-enabled.cc implements the above.
- When disabled, turbofan-disabled stubs out the above with a runtime
  FATAL message.
- The build process is modified s.t. mksnapshot always has TF
  available since it's needed to generate builtins. When disabled,
  TF is removed from other components, in particular it is no longer
  included in v8_compiler and transitively in v8_base.
- When disabled, v8_for_testing no longer has v8_initializers
  available. These were only needed for test-serialize.cc, which
  is now excluded from this build mode.
- When disabled, remove all related cctest/ und unittest/ files from
  the build.

Bug: v8:13629
Change-Id: I63ab7632f03d0ee4a787cfc01574b5fdb08fd80b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4128529
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85210}
2023-01-11 10:57:54 +00:00
Nico Hartmann
d25d23f54d [turboshaft] Type-based reduction verification
Bug: v8:12783
Change-Id: Icb0ff1ff228acf84c8fd4e5a0896ef6558f57248
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4120260
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85179}
2023-01-10 13:26:47 +00:00
Nico Hartmann
88eac4b870 [turboshaft] Basic TypedOptimization and new DeadCodeElimination
This CL introduces typed optimizations for Turboshaft, which replaces all operations that produce a constant output (and don't have side effects) by the corresponding constant.

In addition, a new pass for eliminating dead code is introduced that cannot only remove dead operations, but also rewrite branches that are not required into GotoOps.

Drive-by: Introduce -0 as a "special value" for Float32Type and Float64Type to fix a few issues where 0 and -0 have been treated as identical.

Bug: v8:12783
Change-Id: Ia1450ad7a9abb5d58c7d753596ed08a33a73184f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4110993
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85143}
2023-01-09 13:23:56 +00:00
Jaroslav Sevcik
ff2b5a6729 [inspector] Avoid sliding breakpoints for same scripts
We change the breakpoint hint logic to check if the script has not
locally changed (with a hash of the source text between the requested
breakpoint location and the actual breakpoint location). If the
text did not change, we set the breakpoint at the same
location as before.

Bug: chromium:1404643
Change-Id: I6ceecf9924e699aaf37518680d1cb79d3eb00959
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4138260
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85131}
2023-01-09 07:29:47 +00:00
Clemens Backes
aa5f2e5c43 Revert "[x64] Add support for "cold calls" in hot paths"
This reverts commit 31ccfed461.

Reason for revert: Fails compilation on: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20cfi%20-%20builder/6527/overview

Original change's description:
> [x64] Add support for "cold calls" in hot paths
>
> This makes (specially annotated) calls to "cold functions" in hot paths
> more efficient by hiding the fact that we are actually calling a
> function here. Clang would otherwise unconditionally spill and reload
> registers that might be clobbered by the call. This would slow down the
> fast path.
>
> This CL allows to reverse priorities here: The fast path can stay fast
> (no spills and loads), but the slow path gets even slower. The inline
> assembly that implements the cold call spills and reloads *all*
> registers, because we do not know which registers are in use in the
> scope where the cold call is being emitted.
>
> I.e. this behaves like a custom calling convention with no caller-saved
> registers.
>
> The `preserve_all` attribute (experimental in clang, and incomplete for
> C++) would also solve this, but it is not production-ready yet (leads to
> crashes of clang and crashes of the generated code).
>
> R=​leszeks@chromium.org
> CC=​​dlehmann@chromium.org
>
> Bug: v8:13565, v8:13570
> Change-Id: I2b54a480da1c689113a67c601c29d73239b0ff2b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4116584
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85127}

Bug: v8:13565, v8:13570
Change-Id: I2f5b3343eb372fea13d2c4ab6354f2bc52e2c338
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4145819
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#85128}
2023-01-08 21:03:06 +00:00
Clemens Backes
31ccfed461 [x64] Add support for "cold calls" in hot paths
This makes (specially annotated) calls to "cold functions" in hot paths
more efficient by hiding the fact that we are actually calling a
function here. Clang would otherwise unconditionally spill and reload
registers that might be clobbered by the call. This would slow down the
fast path.

This CL allows to reverse priorities here: The fast path can stay fast
(no spills and loads), but the slow path gets even slower. The inline
assembly that implements the cold call spills and reloads *all*
registers, because we do not know which registers are in use in the
scope where the cold call is being emitted.

I.e. this behaves like a custom calling convention with no caller-saved
registers.

The `preserve_all` attribute (experimental in clang, and incomplete for
C++) would also solve this, but it is not production-ready yet (leads to
crashes of clang and crashes of the generated code).

R=leszeks@chromium.org
CC=​dlehmann@chromium.org

Bug: v8:13565, v8:13570
Change-Id: I2b54a480da1c689113a67c601c29d73239b0ff2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4116584
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85127}
2023-01-08 18:44:18 +00:00
Michael Lippautz
6eb0a668c2 [heap] Move wrappable extraction logic out of LocalEmbedderHeapTracer
Bug: v8:13207
Change-Id: I5d96454c7335e698ff79572706cf0c16640fdd53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4136711
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85100}
2023-01-04 17:04:15 +00:00
Shu-yu Guo
5c7fca4a61 [string-iswellformed] Implement String#{is,to}WellFormed
Bug: v8:13557
Change-Id: I6fa772c70d8307eca047fd839058279ce244f0e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4118066
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85002}
2022-12-22 18:04:40 +00:00
Nico Hartmann
41628b52fc [turboshaft] Implement %CheckTurboshaftTypeOf intrinsic to test typer
This CL implements a new %CheckTurboshaftTypeOf(e, type_string)
intrinsic allowing tests to express that the expression e is supposed
to have the turboshaft type expressed by type_string eventually during
lowering.

Test that use this intrinsic are verifying implementation details and
are thus somewhat brittle and potentially platform depedent. This
intrinsic is not supposed to be used broadly, but rather to write
some tests that check the precision of turboshaft's new type system.

This intrinsic may be removed once the type system is shipped and gets
coverage in other ways.

Bug: v8:12783
Change-Id: I4cc2582273f3d668601a3203c400a8461b470cac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4061889
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84894}
2022-12-16 10:10:58 +00:00
Jakob Kummerow
2427a3bad1 [wasm] Move i64<->BigInt CallDescriptors to WasmEngine
This stores the CallDescriptors used for i64 <-> BigInt conversion
builtins as process-globals on the WasmEngine, instead of creating
them as temporaries whenever they're needed.
The primary purpose of this change is to simplify the interface to
the Int64Lowering by eliminating its "special case" parameter, in
preparation for moving that lowering to a different point in the
compilation pipeline.
A minor secondary benefit is that this will save a little bit of
(repeated) Zone memory usage.
Bonus change: drop the Int64Lowering from 64-bit builds, where it
isn't used, but was compiled in up to now. This saves ~17 KiB on
Android-arm64 builds.

Change-Id: Ib35d2e0f772110652eb05abd4c42d848108164b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4110898
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84884}
2022-12-15 19:40:17 +00:00
Olivier Flückiger
f6eab3830d [static-roots] Build infrastructure for static roots
Add gen-static-roots.py to conveniently re-generate the static roots
table when it needs changing.

Additionally, ensure the first read-only page is allocated as first page
during mksnapshot, to move static roots closer to start.

Bug: v8:13466
Change-Id: Ie72b64d0ad0dd3e5fccd3b41e8ed00a4a55a0033
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4096481
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84844}
2022-12-14 15:19:39 +00:00
Olivier Flückiger
afc49f4725 [static-roots] Support serializing read-only heap as a memory dump
Build mode for serializing the read only heap as a memory dump in the
startup snapshot. This makes compressed pointers of root objects
statically known at mksnapshot time.

This CL also adds a feature to mksnapshot to dump the static addresses
to a C++ header file. This will allow us to use these addresses in the
future.

The mode is disabled for now since we need some build infrastructure
first to conveniently re-generate the table when the layout changes.

Bug: v8:13466
Change-Id: I975b15bd89fedf713fb7d12b4929935ece78139d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4056181
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84815}
2022-12-13 15:21:25 +00:00
Nico Hartmann
b3ffda44f2 [turboshaft] Introduce new Turboshaft type system
Bug: v8:12783
Change-Id: Id5d3ce17f0dc8cec1b2b257585290bed72dd9fd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4057111
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84765}
2022-12-09 17:41:29 +00:00
Darius M
7795179da6 Reland "[turboshaft] Port LateEscapeAnalysis"
This reverts commit 0bd121f8e6.

MemoryAnalyzer wasn't calling LateEscapeAnalysisReducer's
ShouldSkipOperation method, but instead was calling the BaseReducer's
method (because it was using a generic Operation) for the call, which
resulted in some memory corruptions, because MemoryAnalyzer was
planning some folding which was never actually happening.

Original change's description:
> [turboshaft] Port LateEscapeAnalysis
>
> Bug: v8:12783
> Change-Id: Id5fa026d103dc67e05322b725f34186124bc5936
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4054621
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84603}

Bug: v8:12783
Change-Id: I103eb2f518943c0c57bc3e10471d1c47f5262599
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4075724
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84660}
2022-12-05 16:13:36 +00:00
Darius Mercadier
0bd121f8e6 Revert "[turboshaft] Port LateEscapeAnalysis"
This reverts commit fbcffa62b8.

Reason for revert: breaks a few fuzzers

Original change's description:
> [turboshaft] Port LateEscapeAnalysis
>
> Bug: v8:12783
> Change-Id: Id5fa026d103dc67e05322b725f34186124bc5936
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4054621
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84603}

Change-Id: I33dfaaa0f12eef634dec578fb4e3532a0cbb4b2b
Fixed: v8:13561, v8:13562, chromium:1395181, chromium:1395183, chromium:1395243,  chromium:1395244
Bug: v8:12783
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4075524
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84608}
2022-12-02 08:59:10 +00:00
Darius M
fbcffa62b8 [turboshaft] Port LateEscapeAnalysis
Bug: v8:12783
Change-Id: Id5fa026d103dc67e05322b725f34186124bc5936
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4054621
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84603}
2022-12-01 16:40:03 +00:00
Caitlin Potter
c618a17984 [runtime] Refactor GetOwnPropertyDescriptor to use dispatching stub
This is split out from
https://chromium-review.googlesource.com/c/v8/v8/+/3963708, and
implements only the change to using a dispatcher code stub for different
object types in GetOwnPropertyDescriptor, which returns a
PropertyDescriptor struct, and converts the descriptor into a JSObject
in the final step of Reflect.getOwnPropertyDescriptor or
Object.getOwnPropertyDescriptor.

This does not include the path in the dispatcher for Proxy objects, and
thus Proxy objects are still handled in the runtime.

Change-Id: I3960615aa0941d02d32717ccea291f6b63ae180e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4024866
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84602}
2022-12-01 16:38:43 +00:00
Tobias Tebbi
1d415100ed [turboshaft] port memory optimization
Bug: v8:12783
Change-Id: I923982285dc7bff40cc6f9b7db2772d344e19e97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3913085
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84547}
2022-11-29 16:04:12 +00:00
Michael Achenbach
1211605a39 [build] Remove dead ENABLE_DEBUGGER_SUPPORT define
Bug: v8:9287
Change-Id: Ia031aa653b78bae1817e05c75ea508a7e2df8a83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4055628
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84479}
2022-11-25 09:54:03 +00:00
Igor Sheludko
00c7e383a8 [ptr-compr] Store cage bases in globals when cage sharing is enabled
... instead of computing them on the fly. This approach seems to
perform slightly better because it requires less code.

Bug: v8:7703, v8:11460
Change-Id: If31a06fbc748251c491c011e9e3f118665e20159
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4020456
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84413}
2022-11-22 08:00:16 +00:00
Victor Gomes
7096e7a689 [bazel] Use copts -Wno-implicit-fallthrough
Upstream cl/489478120

Change-Id: Ia23ce5f7093bf0cdfff0b6a9c19828008e9bf040
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4041511
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84401}
2022-11-21 15:54:27 +00:00
Darius M
dd79882e54 Reland^2 "[turboshaft] Port BranchElimination to turboshaft"
Original change's description:
> Reland "[turboshaft] Port BranchElimination to turboshaft"
>
> Original change's description:
> > [turboshaft] Port BranchElimination to turboshaft
> >
> > Bug: v8:12783
> > Change-Id: Ib1e7d3cb3ec18bfad57577ae6c830994e6139601
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899298
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#84258}
>
> Bug: v8:12783
> Change-Id: I48214de33d05b7aa61a488b86bd5539fdb92e1f7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4030576
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84331}

Bug: v8:12783
Change-Id: I7d217426f9ad96f586a8917d05492640f9c96af4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4037762
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84370}
2022-11-18 16:38:04 +00:00
Anton Bikineev
cd731db4b3 unified-young-gen: Implement V8->Oilpan remembered set
The CL implements an old-V8-to-young-Oilpan remembered set together with
a generational barrier.

Bug: v8:13475
Change-Id: I5f09f7c6db397f2a49cb0c47fd758a1604af4e83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4030433
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84365}
2022-11-18 15:03:44 +00:00
Darius Mercadier
dbbb59d0e6 Revert "Reland "[turboshaft] Port BranchElimination to turboshaft""
This reverts commit 1f26a28f0e.

Reason for revert: a fuzzer found a bug, and some infra stability bots broke.

Original change's description:
> Reland "[turboshaft] Port BranchElimination to turboshaft"
>
> Original change's description:
> > [turboshaft] Port BranchElimination to turboshaft
> >
> > Bug: v8:12783
> > Change-Id: Ib1e7d3cb3ec18bfad57577ae6c830994e6139601
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899298
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#84258}
>
> Bug: v8:12783
> Change-Id: I48214de33d05b7aa61a488b86bd5539fdb92e1f7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4030576
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84331}

Bug: v8:12783, chromium:1385995
Change-Id: I1abee79e7292cf3afae8bd9456c46022a3123ed3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4035207
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84348}
2022-11-18 08:37:40 +00:00
Darius M
1f26a28f0e Reland "[turboshaft] Port BranchElimination to turboshaft"
Original change's description:
> [turboshaft] Port BranchElimination to turboshaft
>
> Bug: v8:12783
> Change-Id: Ib1e7d3cb3ec18bfad57577ae6c830994e6139601
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899298
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84258}

Bug: v8:12783
Change-Id: I48214de33d05b7aa61a488b86bd5539fdb92e1f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4030576
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84331}
2022-11-17 15:11:10 +00:00
Darius Mercadier
a8d0f63a9d Revert "[turboshaft] Port BranchElimination to turboshaft"
This reverts commit f3917347b2.

Reason for revert: breaks numfuzz (https://crbug.com/v8/13492).

Original change's description:
> [turboshaft] Port BranchElimination to turboshaft
>
> Bug: v8:12783
> Change-Id: Ib1e7d3cb3ec18bfad57577ae6c830994e6139601
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899298
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84258}

Change-Id: I0020ef3952b7273555d98c50366261a945f51058
Fixed: v8:13492
Bug: v8:12783
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4028938
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84282}
2022-11-16 08:54:19 +00:00
Michael Lippautz
841969dbdc [handles] Left over refactorings from TracedHandles
- GlobalHandleMarkingVisitor -> ConservativeTracedHandlesMarkingVisitor
- Encapsulate the acquire load into TracedHandles::Mark

Bug: v8:13372
Change-Id: I00277be4e87aff75419837d40b46bc376ea9a881
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4028107
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84273}
2022-11-15 15:35:09 +00:00
Darius M
f3917347b2 [turboshaft] Port BranchElimination to turboshaft
Bug: v8:12783
Change-Id: Ib1e7d3cb3ec18bfad57577ae6c830994e6139601
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3899298
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84258}
2022-11-15 10:05:19 +00:00
Andrey Kosyakov
aa684004d0 DevTools: use a barrier to sync runIfWaitingForDebugger from multiple sessions
This introduces a barrier that ensures that
`V8InspectorClient::runIfWaitingForDebugger()` is only invoked once all
sessions that requested a paused have invoked runIfWaitingForDebugger.

Downstream change: https://chromium-review.googlesource.com/c/chromium/src/+/3977348

Bug: chromium:1352175
Change-Id: I9049c2de6da8e690ad4312cd6cb799619125bb62
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3976353
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84191}
2022-11-10 20:23:01 +00:00
Nikolaos Papaspyrou
dcaf26930f [heap] Refactor saving the callee-saved registers on stack
This CL refactors the trampoline that pushes the values of callee-saved
registers on the stack, which used before stack scanning.

At the low level, it defines simpler architecture-specific functions
that save the values of these registers in a caller-supplied buffer of
the appropriate size.

The trampoline is now implemented using this mechanism. However, the
low-level functions will be used in subsequent CLs for storing the
registers without using a callback, when setting a stack marker for
conservative stack scanning.

Bug: v8:13257
Change-Id: I86dae66e8613b839c694dc004747e04d1dfad7c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3989143
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#84160}
2022-11-09 19:39:54 +00:00
Tobias Tebbi
bfda81d1a1 [turboshaft] introduce SnapshotTable
Bug: v8:12783

Change-Id: Ie8e578105065ed5ad833fbf2a525b149e39d3424
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971368
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83966}
2022-10-28 06:36:55 +00:00
Darius M
b35d549082 [turboshaft] Change Reducer stack architecture
Bug: v8:12783
Change-Id: If30dea88ce237c04261dc942ee9f1547a1c45252
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3982114
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83961}
2022-10-27 16:08:45 +00:00
Juan José Arboleda
69ad9552b2 [profiler] add Serialize to v8::CpuProfile
Support JSON serialization in `v8::CpuProfile`

Bug: v8:13291
Change-Id: I638cf2c1f7acba9c5b8a2932d84c9882d968c90d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3905128
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83901}
2022-10-25 10:49:04 +00:00
Michael Lippautz
c23bc72c83 [handles] Split off traced handles from regular global handles
v8::TracedReference and their underlying traced handles are not
actually phantom references but have been historically represented as
such. This patch splits off their backing implementaton into
`TracedHandles`.

As a drive-by, re-organize the free list to rely on indices instead of
pointers, saving a full word for each node. In additon, the setup also
allows for freeing fully empty node blocks after GCs.

Allocation/free of nodes is also organized in a way that avoids
jumping between handles/blocks/nodes for accounting purposes.

Removing CRTP in GlobalHandle internals is left for a follow up.

Bug: v8:13372
Change-Id: Ib55aa9ba71202d5918b486c161fe6f747d31c719
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966952
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83872}
2022-10-24 10:04:08 +00:00
Nikolaos Papaspyrou
8c7c087812 [heap] Make stack thread-local and introduce stack markers
This CL makes the object keeping stack information thread-local, moving
it from Heap to ThreadLocalTop. In this way, stack scanning will work
correctly when switching between threads, e.g., using v8::Locker.

It also introduces a mechanism for setting a stack marker, to be used
for scanning only the part of stack between its start and the marker
(instead of the current stack top).

Bug: v8:13257
Change-Id: I01091f5f49d9a8143d50aeef53789a98bdb29048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3960991
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83848}
2022-10-21 13:02:07 +00:00
Hao Xu
024e5fb4fa [CSA][codegen] Add BitcastElision Phase
Turbofan generates bitcast nodes like BitcastWordToTaggedSigned to
ensure the value types of definitions and uses are matched. These
nodes can be elided after MachineGraphVerifier verifying the graph.
This can avoid generating redundant instructions:

Before:
  xorl r15,r15
  cmpl [rdx+0xb],r15

After:
  cmpl [rdx+0xb],0x0

Change-Id: I84bc1b05d77ed9487001e34a93dfe14e45a7a678
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3837161
Commit-Queue: Hao A Xu <hao.a.xu@intel.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83811}
2022-10-20 02:29:57 +00:00
Darius M
73b070b74f [turboshaft] Port SelectLowering to turboshaft
Drive-by fix: reorder members of RandomAccessStackDominatorNode to
save 8 bytes on the total size of Block.

Bug: v8:12783
Change-Id: I4923490b0d2f4de22ea001eeba44c950c6451633
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3893853
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83679}
2022-10-13 12:48:58 +00:00
Nico Hartmann
aa388de13d [turbofan] Move UseInfo to its own file
Change-Id: Idbd61bf934b08c4e9afdfc7e939787f842952f65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3948786
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83660}
2022-10-12 16:19:10 +00:00
Samuel Groß
e9775165b6 [sandbox] Introduce BoundedSize
A BoundedSize is just a regular size_t when the sandbox is disabled.
However, when the sandbox is enabled, a BoundedLength is guaranteed to
be in the range [0, kMaxSafeBufferSizeForSandbox]. This is (currently)
achieved by storing the length shifted to the left, then right-shifting
it when loading it. This guarantees that the top bits are zero.

BoundedSizes are used to ensure safe access to variable-sized buffers,
in particular ArrayBuffers and their views, located inside the sandbox.
If a full size_t is used to represent their size, it may allow an
attacker to "reach out of" the sandbox address space by setting the
length to a very large value. A BoundedSize prevents this.

Bug: chromium:1360375
Change-Id: I0579693db528af96c41eeaa64bd3ed71266aacd9
Cq-Include-Trybots: luci.v8.try.triggered:v8_linux64_no_sandbox_dbg_ng_triggered
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3876823
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83631}
2022-10-11 13:43:43 +00:00
Tobias Tebbi
52b85cbfde Reland "[turboshaft] port MachineOperatorReducer"
This is a reland of commit ea67ec63d2

Original change's description:
> [turboshaft] port MachineOperatorReducer
>
> Bug: v8:12783
> Change-Id: I9b3db78d8a70aead38836e6ccd4b2a76d6f1eb94
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3872269
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83602}

Bug: v8:12783
Change-Id: I9d7110dbd26a8f617e191a6d662ea73b322f71bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3942386
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83624}
2022-10-11 09:05:23 +00:00
Leszek Swirski
af6840b153 Revert "[turboshaft] port MachineOperatorReducer"
This reverts commit ea67ec63d2.

Reason for revert: UBSan failures https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/23526/overview

Original change's description:
> [turboshaft] port MachineOperatorReducer
>
> Bug: v8:12783
> Change-Id: I9b3db78d8a70aead38836e6ccd4b2a76d6f1eb94
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3872269
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83602}

Bug: v8:12783
Change-Id: I3ac6d13feaea72ee47871ee880bc488cc4a36f88
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3942089
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83607}
2022-10-10 15:29:17 +00:00
Tobias Tebbi
ea67ec63d2 [turboshaft] port MachineOperatorReducer
Bug: v8:12783
Change-Id: I9b3db78d8a70aead38836e6ccd4b2a76d6f1eb94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3872269
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83602}
2022-10-10 13:26:16 +00:00
Marja Hölttä
283791d250 [inspector] Remove Type Profiler
See https://docs.google.com/document/d/1dJHFRXKE4NUchvYweuyzsolXDEWACr-jJZEPyC6f9EQ/edit?usp=sharing

Change-Id: Ie5b30db30d55ba701a336d8a59dbff7771276e96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3936281
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83593}
2022-10-10 11:50:16 +00:00
jameslahm
e2f9097647 [json-parse-with-source] Implement the JSON.parse source text
... access proposal.

Bug: v8:12955
Change-Id: I339c4ee1849c67f85d7b975105a53a17d2b2360c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3911270
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83586}
2022-10-10 07:33:07 +00:00
Omer Katz
096fefc03a [heap] Move Sweeper from collectors to heap
This is needed to simplify concurrent sweeping for MinorMC.

Also: move evacuation verifiers to a separate file so that they can be
used from heap.cc as well.

Bug: v8:12612
Change-Id: I2a738a31e83a357f4fdded8a30ccb2ff6ba70553
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3932720
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83557}
2022-10-06 13:30:33 +00:00