When injecting locations for block-end gap moves into Phis, make sure to
maintain register frame state too, so that the subsequent
MergeRegisterValues call sees the result of these moves.
Bug: v8:7700
Change-Id: I4f68e386c5a6cc578d26904306cb9b0c2f7a90d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3676861
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80879}
Add a method which optionally merges dead fallthrough paths, in case the
iteration in EmitUnconditionalDeopt reaches a merge point that is live
from another jump but dead on the fallthrough.
Bug: v8:7700
Change-Id: Ie505cd5356fcf70208f2f6d3e52b805956485f74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3663086
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80878}
Rolling v8/build: b2f1ec8..fb6ee35
Rolling v8/buildtools: a5fa465..8b16338
Rolling v8/buildtools/linux64: git_revision:c547ca1497e3ff0dcbc0b2cb036b3d40380cbeeb..git_revision:37baefb026b199605affa7bcb24810d1724ce373
Rolling v8/buildtools/third_party/libc++/trunk: 79a2e92..b126981
Rolling v8/buildtools/third_party/libc++abi/trunk: 4ad92ec..c30c515
Rolling v8/buildtools/third_party/libunwind/trunk: d03f56b..5e737be
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a1cf7a2..fba169d
Rolling v8/third_party/depot_tools: 4e6aa25..e1197f0
Rolling v8/third_party/fuchsia-sdk/sdk: version:8.20220522.3.1..version:8.20220531.3.1
Rolling v8/third_party/zlib: 80b28c9..64bbf98
Rolling v8/tools/clang: 6df1876..393c871
Rolling v8/tools/luci-go: git_revision:0ef9351a5b73943d547fb27d463d5f4a1572727f..git_revision:de014227dd270df7c61bfab740eb4ae4b52ac2a7
Rolling v8/tools/luci-go: git_revision:0ef9351a5b73943d547fb27d463d5f4a1572727f..git_revision:de014227dd270df7c61bfab740eb4ae4b52ac2a7
R=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
Change-Id: I350575968cfc4adfe6d6785146735d83debfa0a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3682481
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80876}
This is a reland of commit ea9a1f1cbe
Changes since revert:
- Make the state field uintptr-aligned since arm64 faults on
atomic accesses to non-naturally aligned addresses.
Original change's description:
> [shared-struct] Add Atomics.Mutex
>
> This CL adds a moving GC-safe, JS-exposed mutex behind the
> --harmony-struct flag. It uses a ParkingLot-inspired algorithm and
> each mutex manages its own waiter queue.
>
> For more details, please see the design doc: https://docs.google.com/document/d/1QHkmiTF770GKxtoP-VQ1eKF42MpedLUeqiQPfCqus0Y/edit?usp=sharing
>
> Bug: v8:12547
> Change-Id: Ic58f8750d2e14ecd573173d17d5235a136bedef9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595460
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80789}
Bug: v8:12547
Change-Id: I776cbf6ea860dcc6cb0ac51694a9b584b53d255c
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3673354
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80875}
When async compilation finishes for WebAssembly, the promise returned by
`WebAssembly.compile()` gets resolved. Resolving the promise creates a
microtask that should get executed automatically when the call stack
empties up when MicrotasksPolicy::kAuto is used. However, this policy
requires a CallDepthScope to work, but there is no CallDepthScope when
WebAssembly compilation finishes. This CL adds this CallDepthScope.
R=jkummerow@chromium.org
Bug: chromium:1297672
Change-Id: I1bd607dec9daf08b3dbb1294393a8af255d222ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3679579
Auto-Submit: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80872}
Modification is needed since after this CL:
https://crrev.com/c/3676642
Bug: v8:12781
Change-Id: Icb2644c9cd6f20e37c4b0ba0c4b861417c84b7f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3679980
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80871}
This CL introduces the following changes to the experimental
implementation of the object start bitmap, that is evaluated as
a mechanism for resolving inner pointers (behind the flag
v8_enable_conservative_stack_scanning):
- Manually iterate through page objects, instead of using the
PagedSpaceObjectIterator, for performance (avoid calling
MakeHeapIterable all the time) and to simplify the handling
of filler objects.
- Clear bits when reusing evacuated pages of the new space.
- Use the cage base to iterate correctly through code objects.
- Introduce a method for verifying the validity of the object
start bitmap.
- Minor fixes, additional checks and cleanup.
Bug: v8:12851
Change-Id: I245937ffe6f4b53c4c2dcf5126e8836aec4dc79e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3675099
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80869}
Remove code size and compilation time sampling for the "top tier
finished" event. With dynamic tiering, this event will never be reached.
R=ahaas@chromium.org
Bug: v8:12899
Change-Id: I1b0d053e31fe8cd1f8ba3b23bfff4c5879569b45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3647691
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80867}
The macro list makes it difficult to impossible to deprecate individual
methods (like the one receiving a {WasmModuleTieredUp} struct).
Hence avoid the macro list and instead call the macro explicitly for
each definition.
R=cbruni@chromium.org
Bug: v8:12899
Change-Id: I4139de7721c4a1450920c5be312e91e7478e6fa7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3667076
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80865}
This will be useful for implementing crbug.com/1328448.
Bug: v8:12916
Change-Id: Id22ae96f6c1f9b72ab09508dd1f6dc2d70f8b5d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3677654
Commit-Queue: Clark DuVall <cduvall@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80863}
Add a new late escape analysis pass to JS late optimizations.
The new pass simply removes allocations that are not used (besides
initializing stores to the object).
Bug: v8:12200
Change-Id: I01fc6233cca2f369c77ff2116ed7c4da1a232d95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3677298
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80862}
After AssertNoTypedSlotsInFreeMemory being a CHECK for some time now to
get more test coverage, turn this into a DCHECK again.
This CL also renames the methods used by the sweeper to clear typed
slots in free memory. It was previously called "invalid slots" but
IMHO that could be a bit misleading, since this isn't about object slot
invalidation (where we also filter slots) but only really about slots in
free memory.
Bug: v8:12760
Change-Id: I8f414be06207460531fa54189b9ef1be85f4ecb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3679578
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80860}
The method is already misleading, as with dynamic tiering the "top tier"
is defined to be the same as the "baseline tier" (i.e. Liftoff). Hence
the method does not do what you would expect it to do.
Fixing it to wait for all functions to be compiled with TurboFan would
result in a deadlock, if we do not also trigger tier-up of all
functions.
Hence remove the method.
R=ahaas@chromium.org
Bug: v8:12899
Change-Id: I4ba76febd796f6a9ad1252e6d73a72e569fd648c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3657436
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80859}
This CL adds the serialization and deserialization
for properties in function. And we only support fast
properties in property array now.
Bug: v8:11525
Change-Id: If0bb3fee400ca957009d046ed74b92d8192c2514
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3650675
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80858}
Add support for LoadHandlers with the kConstantFromPrototype kind. With
some dependency checks, this becomes a map check and constant load.
Bug: v8:7700
Change-Id: I865eee7be4df9bd0ba56943814f601e3e950ed80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3675101
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80855}
This CL fixes all spots where wasm Turbofan code did not satisfy the
invariant that all nodes with effect outputs are connected to another
node. Also, it enables the related verification for wasm code.
Drive-by:
- Simplify how stack checks are removed during loop unrolling.
- Fix a test declaration in test-gc.cc.
Change-Id: Id32af8584ba0ec281f4bf7757bd2915e6d8bf443
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3676862
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80854}
This makes the following use cases produce a visible error:
- deserializing invalid data w/ d8 [previously broken]
- error in the script embedded in the web snapshot
- d8 can't read web snapshot files
Bug: v8:11525,v8:12820
Change-Id: I40a993194f9992a40c877261ebf9882e018b669b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3672415
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80852}
Some tests disabled dynamic tiering in order to actually serialize
TurboFan code. This makes the tests a bit simpler, but does not reflect
real-world usage.
This CL enables dynamic tiering in those tests and when needed executes
the code until tier-up was observed.
R=ahaas@chromium.org
Bug: v8:12899
Change-Id: I34cb8cedbc5908d9e6ca09d56c51609d0c8b2d6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3660262
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80849}
This is a reland of a7d6bf9662
Added perfetto to unittests include_rules.
Bug: v8:12781
Change-Id: Iabf0e62abb1de879de21ba06fbd38f5432ee4f76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3652295
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80847}
The abstractions in this CL include:
1) Using EvacuatePrologue to handle age mark updating in
SemiSpaceNewSpace.
2) Using IsPromotionCandidate to check if a page contains
the current age mark.
3) EnsureCurrentCapacity instead of Rebalance.
4) Delegate page promotions in mark-compact.cc to the
NewSpace implementation.
Bug: v8:12612
Change-Id: Ied83261d661a8e61a11bf33b1d7a2103ac99a853
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3644966
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80846}
This reverts commit ff84cd0433.
Reason for revert: This CL had a commit from another branch
which was supposed to land as a part of that CL
( https://chromium-review.googlesource.com/c/v8/v8/+/3672415/1 ),
not this one.
Going to reland a cleaned up version.
Original change's description:
> [rab/gsab] Fix ObjectSerializer
>
> Without this fix, the byte length for GSABs is probably serialized
> wrong. A failing test is omitted since it would be pretty involved
> (currently this code path is only hit with --stress-snapshot).
>
> Bug: v8:11111
> Change-Id: If7df98263cec9f82766c2fa6ba095b98b53a6fde
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3657431
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80780}
Bug: v8:11111
Change-Id: I5fc3384484f6a8d2d6e40a404da0bf04167abc1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3678838
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80845}
To eliminate unnecessary move instructions from register to fixed register. We check the fixed register hint for operands in move gaps
when building LiveRanges. If a to_operand has a hint_operand (with fixed register), then set the hint_operand for from_operand too. This can avoid the register allocator ignore hint information about fixed register.
Bug: v8:12909
Change-Id: I17f9afa484ee08de8ac1ab42945caba2c362fc9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3669019
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Jialu Zhang <jialu.zhang@intel.com>
Cr-Commit-Position: refs/heads/main@{#80844}
The fuzzer runs the same wire bytes through the streaming decoder and
through synchronous compilation, and compares the result. In particular,
if one fails, then also the other should fail.
More checks for the result of both pipelines can be added later.
R=ahaas@chromium.org
Bug: v8:12922
Change-Id: I905adf740e581c4b7d0f4ab7c0d5d0e48d96fc4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3675100
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80842}
WorkerThreads access the queue to get new tasks, that's why all of
them need to stop before we can destroy the queue.
This hopefully fixes the linked race/crash since I can't reproduce
this locally.
Bug: v8:12914
Change-Id: Icbfd462f106a4a1f0bbd525f0b7f342e9857a539
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3672421
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80841}
Replace all usages of UPDATE_WEAK_WRITE_BARRIER with
UPDATE_WRITE_BARRIER. The barrier wasn't hot, so the additional branch
for the marking barrier shouldn't be a problem.
Performing the marking barrier could in theory cause more floating
garbage. However in this case the write barrier is only run once
directly after e.g. allocating a Code or NativeContext object. Since
UPDATE_WEAK_WRITE_BARRIER only skips the marking barrier, we should only
observe different behavior when marking is on. But since we already
have black allocation for objects in old space, we will not cause
additional floating garbage.
In case of performance regression, we should also be able to replace
those usages with SKIP_WRITE_BARRIER, since NativeContext and Code
objects are never allocated in the young generation, so running the
generational barrier shouldn't be necessary. It's just hard to DCHECK
that SKIP_WRITE_BARRIER is valid here.
Bug: v8:11708
Change-Id: I25d760a46d1d7ec973cc589f51ddf80ca3b5419d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3663080
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80839}
