Commit Graph

79949 Commits

Author SHA1 Message Date
Jakob Linke
177b6be920 [codet] Remove the CodeT=Code implementation
There is no reason to keep the CodeT dispatch (which switches
between `CodeT = CodeDataContainer` and `CodeT = Code`) around. Using
CodeDataContainer doesn't actually depend on anything from v8_enable_external_code_space, so let's use it unconditionally and
simplify our codebase.

In this first step, update the
`v8_enable_external_code_space = false` configuration to use
`CodeT = CodeDataContainer` as well and remove all support for
`CodeT = Code`.

Upcoming CLs will remove the CodeT alias type, and rename
the Code/CodeDataContainer pair to something more intuitive.

Bug: v8:13654
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_no_pointer_compression_dbg,v8_linux64_no_pointer_compression_rel,v8_linux64_arm64_no_pointer_compression_rel;luci.node-ci.try:node_ci_linux64_rel
Change-Id: I58e4d510924f685ef0f2403220a2c33651c3c864
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4138254
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85257}
2023-01-12 15:23:13 +00:00
Victor Gomes
1a109d28a5 [maglev][arm64] Fix cloberred register in ReduceInterruptBudget
Bug: v8:7700
Change-Id: I883de6edfd218cfff23a4b4a512c516cb825734c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4161766
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85256}
2023-01-12 15:04:58 +00:00
Manos Koukoutos
90c972bb52 [wasm-gc][turbofan] Introduce wasm load elimination
We introduce high-level typed load elimination for wasm. It is based
on CSALoadElimination. It operates on wasm struct.set/get and
array.length operators (with array operations pending). Wasm types are
used to refine the may-alias analysis ran for stores.

Drive-by:
- Type more nodes in wasm-compiler and wasm-gc-operator-reducer.
- Remove an unsafe-cast test which now hits an Unreachable Turbofan
  node.

Bug: v8:7748
Change-Id: I309e4af4d9f9c584e27ff79804a776666b5dc3c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4146430
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85255}
2023-01-12 14:45:45 +00:00
Michael Lippautz
c020a31092 cppgc: Change calling convention for slow write barrier bailout
Change the calling convention for the slow write barrier call to allow
callers to avoid saving caller-saved registers.

Bug: chromium:1406464
Change-Id: I314bdacb235727e0e78a192ed7cbff09e9bc6b4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156476
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85254}
2023-01-12 14:23:01 +00:00
Alexander Schulze
25f779623d [builtins][pgo] Add helper script to interact with PGO profile bucket
We start to host PGO profiles for builtins on a GCP bucket. This script supports various workflows to download profiles for tagged git versions.

In a first step, we provide profiles for tagged git versions only. The script identifies this version from the current checkout and downloads (or validates the existence of) the profiles to a directory where they'll be used during build time.

We introduce `checkout_v8_builtins_pgo_profiles` to the DEPS file (defaults to False). If set, we call the new helper script to download the profiles within the gclient sync step.

The profile download is added to the Chromium project in crrev.com/c/4131525.

Bug: chromium:1382471
Change-Id: I74ba4f3c102a85e230be7ef17b9c87621a1eab14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4111528
Commit-Queue: Alexander Schulze <alexschulze@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85253}
2023-01-12 14:16:16 +00:00
Leszek Swirski
d8cd42360d [maglev] Ensure CheckedObjectToIndex zero extends
Use SmiToInt32 instead of SmiUntag to get a zero extended value in
CheckedObjectToIndex.

Bug: v8:7700
Change-Id: I034039781d8db106713e54ebaf72672c261b8fc1
Fixed: chromium:1406573
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4161759
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85252}
2023-01-12 14:06:48 +00:00
pthier
2501a75575 [maglev][arm64] Use one less scratch register in PushAllHelper
Instead of pushing 2 arguments at the same time, we push 1 argument
together with padreg (to ensure alignment) and overwrite padreg
afterwards.
That way we can re-use scratch registers used for the first argument
to materialise the second one.

Bug: v8:7700
Change-Id: I6d32b61f6e75ec488b4cf4128ced966bcf0ed1bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4161758
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85251}
2023-01-12 12:55:19 +00:00
Omer Katz
177eb46e5f Reland "[heap] Iterate promoted pages during sweeping"
This is a reland of commit 1e3dd39d09
and commit e5dbd05dcf

The fix is in https://chromium-review.googlesource.com/c/v8/v8/+/4094755/3..6

Original change's description:
> [heap] Iterate promoted pages during sweeping
>
> Promoted pages are iterated to record slots containing old to new and
> old to shared references. This takes a significant amount of time during
> the atomic pause.
> Instead we offload this task to the concurrent sweepers, record slots to
> a local cache, and merge it when finalizing sweeping.
>
> Array buffer sweeping depends on iteration of promoted pages, so it is
> frozen until iteration is done.
>
> See design doc at https://docs.google.com/document/d/1JzXZHguAnNAZUfS7kLeaPVXFfCYbf5bGCtyKgyiMDH4/edit?usp=sharing
>
> Bug: v8:12612
> Change-Id: Icdc79a7a70c53352e3a1b3961cfe369e8563b65b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4062041
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Auto-Submit: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#84706}

Bug: v8:12612
Change-Id: I67bbf4753e9fa8b9194367996797aa103e58c16f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4094755
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85250}
2023-01-12 12:35:19 +00:00
Paolo Severini
1ef43e7ba9 [sandbox] Increase max size of ExternalPointerTable
Bug: v8:13640
Change-Id: I017a067d775c71977054b772ead8853e4df0cd51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4159852
Reviewed-by: Samuel Groß <saelo@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85249}
2023-01-12 12:31:10 +00:00
Matthias Liedtke
89677cfaa8 [wasm-gc] Fix call feedback vector issues after memory out of bounds accesses
Turbofan uses the feedback vectors created by liftoff during
compilation. It is assumed that for any given function liftoff and
turbofan use same-sized feedback vectors.

Calls in unreachable code don't allocate entries in the feedback vector.
Therefore it is required that turbofan and liftoff have the same
understanding of which parts of the code are treated as unreachable.
This is achieved by moving the unreachable handling from liftoff
into the decoder that is also used for the turbofan compilation.

Bug: chromium:1403398
Change-Id: I113726c1a0d773ea9483c80d8e3c3084be423ca2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152477
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85248}
2023-01-12 12:00:06 +00:00
Clemens Backes
25005c142c [wasm] Allow TurboFan compilation of arbitrarily sized functions
We added a stop-gap workaround for excessive TurboFan compilation times,
by just not compiling functions bigger than 500k by TurboFan.
This code is only used when WasmGC is enabled and lazy compilation is
disabled.
Since lazy compilation is the default now, this code is not needed any
more. We remove it to simplify the code by avoiding late updates of the
compilation progress.

R=jkummerow@chromium.org

Change-Id: I32c63b24417e6f44e8ec4496caba20b10bfd78b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4161754
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85247}
2023-01-12 11:25:01 +00:00
Olivier Flückiger
77de44e1c4 [ptr-compr] Improve ptr compression/decompresion in C++
Optimizations introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/1776079
are currently defeated since Address is not a pointer type.
Clang does not seem to carry over alignment information as range
information when casting to ints.

Using __builtin_assume we can restore the same effect. Additionally
we can help the compiler remember that when compressing the removed
bits are actually the cage base. This helps e.g. with
 `decompress(compress(..))`.

See https://godbolt.org/z/5r68G5qa6 for details.

Bug: v8:9353
Change-Id: Ief016fce0788f2bef6b684a18b104ada6e6d3856
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156060
Commit-Queue: Olivier Flückiger <olivf@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85246}
2023-01-12 10:44:27 +00:00
Victor Gomes
e82b88192e [maglev][arm64] Fix some typed array arch issues
- When doing a 64 bit add, we should not pass a W register
- We should use MemOperand to load from memory

Bug: v8:7700
Change-Id: I2dfca1f558c58a12f836942155cafb60cc72915a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4161753
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85245}
2023-01-12 10:30:38 +00:00
Clemens Backes
c48cc5bab5 [wasm] Avoid re-validation after deserialization
As we do not ship lazy validation, we can expect that most modules are
fully validated when they are serialized. We should use that information
and not re-validate functions after deserialization.

We do so by writing out a single boolean value that encodes whether all
functions have been validated. This value is expected to be true in all
relevant cases. On deserialization we then mark all functions as
validated if the value is set.

R=ahaas@chromium.org

Bug: v8:13565
Change-Id: I18bdd6b04b607ba4521d36d3ca2fd35b4a6df7dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152489
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85244}
2023-01-12 10:06:08 +00:00
Victor Gomes
8a646573d9 [maglev][arm64] Port crrev.com/c/4127157
Drive-by fix:
- On x64: load byte zero extended.
- On arm64: set flag when subtracting the interrupt budget

Bug: v8:7700
Change-Id: Ieeaa461a037b2968617ff1df4c75ecc1b509e2d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4161751
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85243}
2023-01-12 09:57:55 +00:00
Jakob Linke
d4bf44d820 Disable TF in lite mode
When v8_enable_lite_mode is enabled at build-time, we can set
v8_enable_turbofan to false and thus completely omit TF from the
binary.

.. and we also piggy-back on top of existing lite-mode bots for
basic bot coverage.

Bug: v8:13629
Cq-Include-Trybots: luci.v8.try:v8_linux_arm_lite_compile_dbg,v8_linux_arm_lite_compile_rel,v8_linux_arm_lite_rel
Change-Id: I8104ccd918531714db80631c61c5134e856fafa6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4135887
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85242}
2023-01-12 09:54:54 +00:00
Andreas Haas
7b3b682818 [wasm] Improve result check in {DefaultWasmAsyncResolvePromiseTask}
In the implementation we assumed that the Maybe<bool> returned by
`Promise::Resolver::Resolve()` always has a value. However, if the
isolate is already in the process of termination, this assumption is
wrong.

With this CL we first check if a value was returned, and only check
the value if it exists.

Bug: chromium:1404317
Change-Id: I0b63860b7063f055ee5ef739f877583a29f2acdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4136724
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85241}
2023-01-12 09:42:46 +00:00
Leszek Swirski
ed47b8cd0c [ic] Allow resetting interrupt budget on IC change
Add an alternative to any_ic_changed_, where instead of a global flag
that is updated on ICs changed (which prevents small function
optimisation), the interrupt budget of the particular function whose IC
was updated is reset to a default value.

This should have a similar effect, allowing small functions to tier up
quickly but still only once they have been stable enough for some time,
but should prevent cross-contamination of different functions'
stabilities due to the global nature of the flag.

It does, however, require a back pointer from the feedback vector to its
parent feedback cell (which holds the interrupt budget).

Drive-by, use any_ic_changed_ for Maglev tierup, to match small
function behaviour.

Change-Id: I7109cf3aff536af7ab36d3564ec8005ee7aa44f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156472
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85240}
2023-01-12 09:35:41 +00:00
Dominik Inführ
7777e0321d [api] Deprecate memory savings mode
This mode was used for an experiment and isn't used anymore.
IsolateInBackgroundNotification() can be used to achieve the same
memory savings mode.

Bug: v8:13653
Change-Id: I4bc0b0bd7ceac43f22e16b234b9482af9fe03152
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156054
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85239}
2023-01-12 09:14:01 +00:00
v8-ci-autoroll-builder
a3b7c6706a Update V8 DEPS (trusted)
Rolling v8/build: fc82049..d57dd8d

Rolling v8/buildtools: f017c8f..6409ca9

Rolling v8/buildtools/third_party/libc++/trunk: 7c5e4b4..ccb0d32

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/c470a55..8f4c5d6

Rolling v8/third_party/depot_tools: dcb79c7..4f3b322

Rolling v8/third_party/fuchsia-sdk/sdk: version:11.20230109.2.2..version:11.20230110.3.1

Rolling v8/third_party/zlib: fa5dc47..2d88319

Rolling v8/tools/clang: 341ed9b..9f2d780

Rolling v8/tools/luci-go: git_revision:bac571b5399502fa16ac48a1d3820e1117505085..git_revision:81e5cdad29bb4c7aaad98c843637513db3155b0d

Rolling v8/tools/luci-go: git_revision:bac571b5399502fa16ac48a1d3820e1117505085..git_revision:81e5cdad29bb4c7aaad98c843637513db3155b0d

Change-Id: Iafd14878d4159be8aedd82800eebb93f97996ed1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4159773
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#85238}
2023-01-12 04:39:23 +00:00
Michael Lippautz
9ae82b0486 Revert "Reland "[heap] Move methods from LocalEmbedderHeapTracer to CppHeap""
This reverts commit 38a4042c05.

Reason for revert: Still broken: https://ci.chromium.org/ui/p/chromium/builders/try/fuchsia-arm64-rel/b8792238654530542257/test-results?q=ExactID%3Aninja%3A%2F%2Fcomponents%3Acomponents_browsertests%2FFormAutofillUtilsTest.GetAriaLabelledByInvalid+VHash%3A6f6e8444a444fd2a&clean=&sortby=&groupby=

Original change's description:
> Reland "[heap] Move methods from LocalEmbedderHeapTracer to CppHeap"
>
> This is a reland of commit 40b002ffbc
>
> Original change's description:
> > [heap] Move methods from LocalEmbedderHeapTracer to CppHeap
> >
> > Move methods around tracing to CppHeap and simplifies overall tracing
> > logic.
> >
> > Bug: v8:13207
> > Change-Id: I539fba924ba3f8f329405e084b999b18a7adfe7e
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147610
> > Reviewed-by: Omer Katz <omerkatz@chromium.org>
> > Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#85152}
>
> Bug: v8:13207
> Change-Id: I42834edd7a0a84d01df60e8dfdfe7a1c0cac5533
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4155912
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85228}

Bug: v8:13207
Change-Id: If34811c4ac4d664b61727ea2b855f3a23e4179f1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4158271
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85237}
2023-01-11 20:21:07 +00:00
Andreas Haas
b77287525d [wasm] Update spec tests
R=thibaudm@chromium.org

Change-Id: Ic0d953530118cec8933bd64ab2e40607975bc039
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156057
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85236}
2023-01-11 19:59:14 +00:00
Shu-yu Guo
8267c7e12c [flags] Remove --harmony-array-find-last
The Array and TypedArray findLast and findLastIndex proposal has shipped
since M97.

Bug: v8:11990
Change-Id: Iece995c020c2b5535abc4dd2a47516265e445fc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4144631
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85235}
2023-01-11 19:52:46 +00:00
Shu-yu Guo
a216b3de4b [shared-struct] Mark shared constructors has_non_instance_prototype
Bug: v8:12547
Change-Id: I63cbb45565ec978a38726d993753f14bd6e7fbea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4144662
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85234}
2023-01-11 19:31:54 +00:00
Shu-yu Guo
f1adbe2e44 [shared-struct] Fix shared value barrier in TF
This CL fixes a bug where TurboFan was incorrectly compiling away the
shared value barrier for shared arrays.

TurboFan should not be compiling accesses to objects in the shared heap
until it natively has support for the shared value barrier, because it
is an invariant that shared objects do not point to non-shared objects.

Bug: chromium:1404052, v8:12547
Change-Id: I5bd44ce5c44ad81a97421598e6d5b24fb5e210cd
Fixed: chromium:1404052
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4136980
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85233}
2023-01-11 19:28:45 +00:00
Michael Lippautz
24ca73004e cppgc: Implement slim write barrier
Introduces a slim write barrier for Oilpan behind
`cppgc_enable_slim_write_barrier` that is enabled by default. The slim
write barrier only performs a single approximate global check for
whether the write barrier is needed and delegates all other checks to
a slow path call. This is beneficial in configurations that do not need
many checks for the barrier overall, i.e., configurations without
young generation. Young generation is off by default which is why this
approach is beneficial.

On Speedometer the write barrier is hit 75M times with a fast bailout
of 99.3%. Progression on Speedometer2 is somewhere around 0.2-0.5%.

The resulting code embedded in another function is only 34 bytes
compared to 128 bytes before. See attached bug for detailed assembly
snippet.

Change-Id: I6869513186e7a26104c46f1f2ac2cfa855689f64
Bug: chromium:1406464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152488
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85232}
2023-01-11 18:54:57 +00:00
Clemens Backes
080e281820 Reland "[x64] Make {Assembler::GrowBuffer} preserve most registers"
This is a reland of commit 8fe57bf641.
We restrict the use of "preserve_most" to x64 and arm64 in
non-component builds for now.

Original change's description:
> [x64] Make {Assembler::GrowBuffer} preserve most registers
>
> This makes many callers of {GrowBuffer} a lot slimmer, by avoiding the
> need to push and pop all values in otherwise caller-saved registers.
> E.g. {emit_mov(Register, Operand)} was measured to be ~2x faster (from
> 2.3% of Liftoff compilation time to 1.2%).
>
> R=bikineev@chromium.org
> CC=dlehmann@chromium.org
>
> Bug: v8:13565
> Change-Id: I681747a491548adf1374187cd9f37520c153ef1a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4127230
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85147}

Bug: v8:13565
Change-Id: I273e222b423786fdc0338c7dfab3d95c8af6ff13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147788
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85231}
2023-01-11 17:53:05 +00:00
Anton Bikineev
78717ce93d cppgc: Return empty pages right away when sweeping on allocation
This should save about 0.23% cycles on the JQuery Speedometer story.

Bug: chromium:1406296
Change-Id: Ib2b76325c6441eb5da8051c3701291abf347c56d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152952
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85230}
2023-01-11 16:57:55 +00:00
Leszek Swirski
c617c553a6 Revert "[turbofan] Properly perform range check for array access"
This reverts commit ec4f19d530.

Reason for revert: Speculative revert for speculative-lowering failures in the roll (e.g. https://ci.chromium.org/ui/p/chromium/builders/try/linux_optional_gpu_tests_rel/b8792253516032578097/test-results?q=ExactID%3Aninja%3A%2F%2Fchrome%2Ftest%3Atelemetry_gpu_integration_test%2Fgpu_tests.webgl2_conformance_integration_test.WebGL2ConformanceIntegrationTest.deqp%2Ffunctional%2Fgles3%2Ffbocolorbuffer%2Fblend.html+VHash%3Aa55ece39ab587dea&clean=&sortby=&groupby=)

Original change's description:
> [turbofan] Properly perform range check for array access
>
> Turbofan optimized array access returned incorrect values in some cases
> when a negative index was provided. This CL fixes this by changing the
> way those bounds checks are performed in JSNativeContextSpecialization.
>
> Bug: chromium:1320641
> Change-Id: Id1f06680ccf7964994d179f7fb44199a0b1245b1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147622
> Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85207}

Bug: chromium:1320641
Change-Id: I4e7899eb89ec8ef5541a57f7a0fb8fe6a452371a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156871
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#85229}
2023-01-11 16:20:06 +00:00
Michael Lippautz
38a4042c05 Reland "[heap] Move methods from LocalEmbedderHeapTracer to CppHeap"
This is a reland of commit 40b002ffbc

Original change's description:
> [heap] Move methods from LocalEmbedderHeapTracer to CppHeap
>
> Move methods around tracing to CppHeap and simplifies overall tracing
> logic.
>
> Bug: v8:13207
> Change-Id: I539fba924ba3f8f329405e084b999b18a7adfe7e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147610
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85152}

Bug: v8:13207
Change-Id: I42834edd7a0a84d01df60e8dfdfe7a1c0cac5533
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4155912
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85228}
2023-01-11 15:51:30 +00:00
Victor Gomes
169bdfe408 [maglev] Fix CheckJSDataViewBounds clobbered argument
If the register allocator assigns kJavaScriptCallArgCountRegister
to {object}, we were clobbering the object, before pushing it to
the stack.

Additionally, we use PushReverse instead of Push to indicate
that kDataViewPrototypeGetByteLength has a JS call convention
(arguments are reversed). This is a no-op for x64, but it guarantees
the correct order of the padding in arm64.

Fixed: chromium:1406456
Bug: v8:7700, v8:13645
Change-Id: Ia9126ff5315ab4ab08ae733f138a1e0cb2d021a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156053
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85227}
2023-01-11 14:42:46 +00:00
Darius M
8dd716db16 [maglev] Re-enable in-heap Typed Arrays
Bug: v8:7700
Change-Id: Iaccce419f5269ab7a6bd257bf952e3226143c32d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154422
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85226}
2023-01-11 14:16:25 +00:00
Matthias Liedtke
177bfd1502 [wasm-gc] Remove deprecated array.len
Rmove the deprecated array.len 0xfb17 variant which takes a type
immediate.
This has been superseded by 0xfb19 which does not need the type.

Bug: v8:7748
Change-Id: I7d4620423c786462444512abe40ee006aab99cf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4110831
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85225}
2023-01-11 14:11:23 +00:00
Hannes Payer
32f82d0f48 Disable page permission flipping of code pages
Code protection based on page permission flipping is inherently unsafe since it does not prevent concurrent modification of unprotected pages. It also comes with a significant performance cost. Going forward we will rely on per-thread page permission mechanisms (e.g. PKEYS) to protect code memory.

Change-Id: I28e15899cd6316fbe146f3725b9e0c81a668e1dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4156051
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85224}
2023-01-11 14:10:20 +00:00
Matthias Liedtke
b77e704a74 [wasm-gc] Remove deprecated callref variant
This removes the deprecated callref variant 0x17 which has been
superseded by 0x14.

Bug: v8:7748
Change-Id: I8e3704f5b302428eb175df2d59896a1b6c6a1323
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4118868
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85223}
2023-01-11 14:05:19 +00:00
Milad Fa
880f8208ef PPC/s390: [static-roots] Use static roots in CSA
Port 643b458b07

Original Commit Message:

    Like in https://chromium-review.googlesource.com/c/v8/v8/+/4130075
    we add the same optimizations to non-C++ builtins.

R=olivf@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I46ea828bc6c2cea395a20e1d7748e96a87bcaee2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4150961
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/main@{#85222}
2023-01-11 13:43:31 +00:00
Omer Katz
2a5e1878a5 Reland "Reland "[heap] Adjust pretenuring heuristic for MinorMC""
This is a reland of commit 47405154da

Original change's description:
> Reland "[heap] Adjust pretenuring heuristic for MinorMC"
>
> This is a reland of commit a614ccb8f7
>
> This CL will cause a performance regression when running with MinorMC on
> the bots. However this regression is expected (due to delaying pretenuring
> decisions) and we anyway result from relanding crrev.com/c/4092734.
>
> Original change's description:
> > [heap] Adjust pretenuring heuristic for MinorMC
> >
> > MinorMC needed to process pretenuring feedback both after sweeping and
> > at the end of the atomic pause, despite having no new feedback at the
> > end of the atomic pause, because the heuristics didn't hold after
> > sweeping. This CL adjusts the heuristics for MinorMC so that processing
> > twice is no longer needed.
> >
> > Bug: v8:12612
> > Change-Id: I4d3ebaeaa6e7868bcdcae6fbdb3bcecb0ebcb8bf
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4085983
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Commit-Queue: Omer Katz <omerkatz@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#84730}
>
> Bug: v8:12612
> Change-Id: I3101f8c8b4c1d34ff95802fbc8c8d1fff81e8ddd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4147607
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#85161}

Bug: v8:12612
Change-Id: I9de00799fb79403289d6ec3d47f1696b0410cf28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4155013
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85221}
2023-01-11 13:36:31 +00:00
Mikhail Khokhlov
c3c8c86850 Fix v8_snapshot build in Chromium with v8_use_perfetto=true
We're migrating Chrome tracing to Perfetto SDK, and the first step is
to make everything build with perfetto library.

Example build errors:
https://ci.chromium.org/ui/p/chromium/builders/ci/linux-headless-shell-rel/52404

Bug: chromium:1006766
Change-Id: I5da38f421b742be41a9cf1993a3cf463ec3cb801
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152474
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Mikhail Khokhlov <khokhlov@google.com>
Cr-Commit-Position: refs/heads/main@{#85220}
2023-01-11 13:14:37 +00:00
Victor Gomes
f73f3b3b51 [maglev] Remove MaglevGraphHasUnimplementedNode
Bug: v8:7700
Change-Id: Ic7bd3cef4b4fd29d7b03b8a3896b8ed6675c518a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154424
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85219}
2023-01-11 13:06:39 +00:00
Darius M
7e169e2052 [maglev] Fix liveness hole bug in register allocator
Bug: v8:7700, v8:13639, chromium:1403893
Change-Id: Ie49b4bce1a5fe406a2bec31e307968cc29929430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152479
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85218}
2023-01-11 12:51:56 +00:00
Victor Gomes
e17d443bfb [maglev][arm64] Fix initialization of stack slots loop
Bug: v8:7700
Change-Id: I923f45f7e3821062bd0af5086bcf086de988f604
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154423
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85217}
2023-01-11 12:49:54 +00:00
Victor Gomes
20aad404d0 [maglev] Share JumpLoopProgolue IR
Bug: v8:7700
Change-Id: I738523b02e2700438a179e00f252d3fce53a0066
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4131403
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85216}
2023-01-11 12:44:14 +00:00
pthier
9685f44f51 [static-roots][arm64] Avoid using a scratch register in LoadRoot
The immediate value for a read-only root can be larger than 12-bit and
therefore can't be encoded directly on arm64. To avoid using an
additional scratch register, we can use the destination for the prepared
immediate operand.

Bug: v8:13466
Change-Id: I7904770c4a155a876793c029e3ad321825517a8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154420
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85215}
2023-01-11 12:38:08 +00:00
Simon Zünd
c16405e82e [cleanup] Remove experimental flag for [[Scopes]] removal
After we received feedback about some legitmate use-cases of the
internal [[Scopes]] property, we decided to not go ahead with its
removal.

This CL removes the corresponding experimental flag.

R=kimanh@chromium.org

Bug: chromium:1365858
Change-Id: I6744889b4e2e960695838648e2f4902cbdb75890
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154416
Auto-Submit: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85214}
2023-01-11 11:51:48 +00:00
Simon Zünd
705c8406a5 [cleanup] Remove the '--experimental-reuse-locals-blocklists' flag
The feature shipped with M109 so we'll remove the flag with M111.

R=jarin@chromium.org

Bug: chromium:1363561
Change-Id: Ia9b276f6c56fb3f57c57f5da1abe02dda8dc36e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154418
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85213}
2023-01-11 11:50:44 +00:00
Michael Achenbach
424e51c106 [foozzie] Add more contradiction configs after readonly-flags introduction
No-Try: true
Bug: v8:10577, chromium:1406056
Change-Id: If4204cadc2647931c55ec81e83080e7eb3b5a2b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154419
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85212}
2023-01-11 11:13:48 +00:00
Matthias Liedtke
a54fc340b1 [wasm-gc] Remove structref as dataref compatibility fallback
Currently structref is interpreted as dataref by default for backwards
compatibility reasons.
This behavior is now being removed with this change.

Bug: v8:7748
Change-Id: I610fd04187b1bda53c83a82345eae09f23d99731
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4111171
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85211}
2023-01-11 11:11:31 +00:00
Jakob Linke
539b50f5ae [turbofan] Add the v8_enable_turbofan build option
When disabled, Turbofan is fully excluded from the compilation result.
This is expected to reduce V8's contribution to chromium's binary size
by roughly 20%.

If Turbofan is disabled, Maglev and Webassembly must also be disabled
(since both depend on TF).

Note this new configuration (v8_enable_turbofan=false) is not yet
used anywhere - we'll probably enable it for lite_mode bots in an
upcoming CL for test coverage.

Changes in detail:
- Split out all src/compiler files from the main source sets. This
  was mostly done already, here we only clean up the few files that
  were left.
- Define a new main TF entry point in turbofan.h. `NewCompilationJob`
  replaces `Pipeline::NewCompilationJob`.
- When TF is enabled, turbofan-enabled.cc implements the above.
- When disabled, turbofan-disabled stubs out the above with a runtime
  FATAL message.
- The build process is modified s.t. mksnapshot always has TF
  available since it's needed to generate builtins. When disabled,
  TF is removed from other components, in particular it is no longer
  included in v8_compiler and transitively in v8_base.
- When disabled, v8_for_testing no longer has v8_initializers
  available. These were only needed for test-serialize.cc, which
  is now excluded from this build mode.
- When disabled, remove all related cctest/ und unittest/ files from
  the build.

Bug: v8:13629
Change-Id: I63ab7632f03d0ee4a787cfc01574b5fdb08fd80b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4128529
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85210}
2023-01-11 10:57:54 +00:00
Leszek Swirski
93165a6721 [maglev] Add maglev config to foozzie
Bug: v8:7700
Change-Id: I2e20d457e303bf4cd4338ff45bb47c8f863885c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4152473
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85209}
2023-01-11 10:56:28 +00:00
Andreas Haas
5482480488 [perf] Add file to js-perf-test resources list
The file `at.js` was missing in the resources list, and did therefore
not get uploaded to the perf bot. This caused an error on the perf bot.

R=machenbach@chromium.org
CC=dmercadier@chromium.org

Bug: v8:12926
Change-Id: I199591444da651854633a37e7164756981b9353f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/4154414
Auto-Submit: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#85208}
2023-01-11 10:50:45 +00:00