Commit Graph

11647 Commits

Author SHA1 Message Date
Marja Hölttä
042e3e025b [builtins] Fix ArrayPrototypeSlice
The bug was introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/3147910 : We only
want the fast path when "start" is either missing or the number 0, not
when it's something which converts to 0.

Bug: chromium:1248704
Change-Id: I72bb8fa8a9b90a13aae216c6a8e16e7be54285fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3157948
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76789}
2021-09-13 10:19:16 +00:00
Manos Koukoutos
e8708fe355 [wasm][turbofan] Enable tail calls in inlined functions
Bug: v8:12166
Change-Id: If77ecea8102e4ba5d98d3e1e6700e9c1efaa319a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144913
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76787}
2021-09-13 10:11:23 +00:00
Andreas Haas
2255e418b8 Revert "[wasm] Ship Reference Types"
This reverts commit 91b72485a3.

Reason for revert: Some spec tests are failing, see WPT tests.

Original change's description:
> [wasm] Ship Reference Types
>
> R=​ecmziegler@chromium.org
>
> Bug: v8:7581
> Change-Id: I9acd99f3cf6832ee393d839cde7444a475a8f808
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123409
> Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76565}

Bug: v8:7581
Change-Id: I18ed821ffda51cdc9869e0e36666c816d0bf00df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141576
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76786}
2021-09-13 08:31:19 +00:00
Marja Hölttä
fc3fce0122 [rab/gsab] TypedArray.prototype.at: Support RAB / GSAB
Bug: v8:11111
Change-Id: I0e7db9ca74b9d61f2e86581b0cd2f424ad006db9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3151958
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76785}
2021-09-13 07:32:27 +00:00
Milad Fa
aec2c09547 [liftoff] skip test on unsupported platforms
StackCheck needs to be implemented on liftoff.

Change-Id: I29624d65b82cbba3ef640ab7ea0cc78c2d5f2c4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3152745
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76766}
2021-09-10 14:20:28 +00:00
Clemens Backes
f235120c5e [liftoff] Fix i64.sub special case
In the case that {dst}, {lhs} and {rhs} all point to the same register,
we would emit wrong code (negating the register and adding it to
itself). This CL fixes this by checking if {lhs == rhs}, and just
clearing the {dst} register in that case.

R=thibaudm@chromium.org

Bug: chromium:1247659
Change-Id: I7913617850adb34a5ad812369f16a7422358454d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3151955
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76765}
2021-09-10 11:03:58 +00:00
Clemens Backes
b177b4e3e8 [liftoff] Fix --trace-wasm-memory
With statically in-bounds memory accesses (implemented in
https://crrev.com/c/2919827) we would only have an offset but no index
register for {TraceMemoryOperation}. This CL fixes that situation.

R=thibaudm@chromium.org

Bug: chromium:1248024
Change-Id: I856b263a560cb71791c61e446e78dd99c9664190
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3149464
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76763}
2021-09-10 10:47:20 +00:00
Marja Hölttä
0d42c9d0b1 [builtins] Unify ArrayPrototypeSlice & ReduceArrayPrototypeSlice
They need to agree about when to delegate to CloneFastJSArray, since it
produces arrays which are potentially COW. If they don't agree, TF
generates code which produces a COW array and then expects it to be
non-COW -> immediate deopt.

This CL gets rid of the discrepancy in the case when there's exactly
one argument and it's the number 0.

Some corner cases remain, e.g., 1st argument not a number but ToInteger
returns 0. These should be extremely rare in the real world.

Bug: v8:12194
Change-Id: I10230245c97f8997da4d79702f29ebff11297229
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3147910
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76745}
2021-09-09 08:48:03 +00:00
Michael Achenbach
65f8948a08 [test] Neuter stack-size for more tests incompatible with stack-size fuzzing
Also bump the minimum size determined by manually testing with:
mjsunit/harmony/modules-import-13

Bug: v8:12197
Change-Id: Ic21d42547ba14cd927d158388ad4bc6f1891f45c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3147453
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76723}
2021-09-08 11:21:14 +00:00
Manos Koukoutos
59e4cf11c5 [wasm][turbofan] Remove stack checks/tracing from inlinee, add tests
We add an option to BuildTFGraph to not emit stack checks and call
tracing and use it in inlined functions.
Also, we add tests for zero/multiple return values, as well as infinite
loops in the inlined function.

Bug: v8:12166
Change-Id: I5f34c57d9870592085804853ff23ba94897cc8d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141589
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76718}
2021-09-08 09:05:33 +00:00
Jakob Kummerow
059d2f799c [wasm-gc] Drop --experimental-wasm-gc-experiments flag
Simply putting all features behind --experimental-wasm-gc.
The intent is to simplify command lines.

Bug: v8:7748
Change-Id: Ibfaa4dc720087a490b177a2b95841620a4d25d89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141583
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76703}
2021-09-07 19:22:19 +00:00
Deepti Gandluri
0ef2ccec58 [test] Skip SIMD regression test when SIMD is unsupported
Change-Id: Ie614bf368d6cf955cb1a7537ef81aafd6925ccbb
No-Tree-Checks: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144149
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76702}
2021-09-07 18:32:18 +00:00
Clemens Backes
10dc8ef0bc [arm64][x64][liftoff] Fix trap handling on load lane
This is a reland of 1786f8d770. It turned
out that also x64 is broken, and only for TurboFan. Both is fixed now.

Original change's description:
> [arm64][liftoff] Fix trap handling on load lane
>
> This fixes the registered {protected_load_pc} to (always) point to the
> actual load instruction. If {dst != src} we would emit a register move
> before the load, and the trap handler would then not recognize the PC
> where the signal occurs, leading to a segfault.
>
> R=thibaudm@chromium.org
>
> Bug: chromium:1242300, v8:12018
> Change-Id: I3ed2a8307e353fd85a7ddedf6ecb73e90a112d32
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136454
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76642}

Bug: chromium:1242300, v8:12018
Change-Id: I79284ab9815f5363f759569d98c8c4b52d48e738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140609
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76698}
2021-09-07 15:14:00 +00:00
Thibaud Michaud
906459f142 Reland "[wasm][eh] Ship exception handling"
This is a reland of 4936628ed6

Original change's description:
> [wasm][eh] Ship exception handling
>
> R=ahaas@chromium.org
> CC=ecmziegler@chromium.org
>
> Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
> Bug: chromium:1173515
> Change-Id: Id487ec32de7ec10ba1f61f77414565949b8d3dc7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138203
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76672}

Bug: chromium:1173515, v8:12173
Change-Id: I61a216207e4aadfd00a716e3296af2f7c3e8df88
Cq-Include-Trybots: luci.v8.try:v8_linux_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141609
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76691}
2021-09-07 11:21:32 +00:00
Manos Koukoutos
ab4cf929f3 [wasm][turbofan] Set up basic inlining infrastructure
We introduce basic wasm inlining infrastructure behind a flag. The
implementation is currently incomplete. Additionally, we always inline
the function at index 0; proper inlining heuristics will be added later.

Changes:
- Rename WasmInliningPhase -> JSWasmInliningPhase
- Introduce WasmInliningPhase and WasmInliner.
- Pass additional parameters as needed to GenerateCodeForWasmFunction.
- Remove EnsureEnd in WasmGraphAssembler. Create end node at the start
  of compilation.
- Add a simple test.

Bug: v8:12166
Change-Id: Ifd7006ba378e9f74cd248b71e16869fbbb8a82be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141575
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76689}
2021-09-07 10:57:30 +00:00
Thibaud Michaud
7c67bc1928 [wasm][eh] Update delegate behavior
Update the behavior of 'delegate' according to:
https://github.com/WebAssembly/exception-handling/issues/176

Summary: delegate can target any block, which just rethrows to the next
outer try/catch.

R=clemensb@chromium.org

Bug: v8:8091
Change-Id: I967db9ab1cbb1a15b2c5e0a1a20f64fa19a3f769
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140603
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76677}
2021-09-06 13:46:38 +00:00
Manos Koukoutos
f7efe45b55 [wasm-gc] Improve performance of array.copy in TF
We use BuildCCall over CallBuiltin. This improves the performance of
array.copy by up to 2x for small arrays.

Bug: v8:7748
Change-Id: Ibbd6a69267edb229beda1f6de4ff1c48eb38b729
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3135580
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76661}
2021-09-03 16:45:59 +00:00
Andreas Haas
b9f282a97e [wasm][externref] Support default value for the table constructor
The WebAssembly.Table constructor supports a second parameter that was
not supported by V8 so far.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: Id74c53a6b1bde7f49a4edea8397d1cab253e1a0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141571
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76660}
2021-09-03 15:43:59 +00:00
Michael Achenbach
19254de6d4 [test] Run no-concurrent-inlining variant
After concurrent inlining is true by default we keep testing the
negated version on the main linux bots and drop testing the
variant on FYI, which is a no-op now.

Bug: v8:7790
Change-Id: I604838a45f3de242db82b42b93afdb56804152b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140599
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76655}
2021-09-03 12:16:59 +00:00
Marja Hölttä
6de4e21068 [parser] Fix class variable redeclaration
ParserBase::ParseClassLiteral and BaseConsumedPreparseData::RestoreDataForScope
both declare the class variable, but the logic is so complex
that they sometimes ended up both declaring it.

This is further complicated by some of the variable values (esp.
inner_scope_calls_eval_) potentially changing in between, so we can't
just redo the same logic any more.

Forcefully make it work by making RestoreDataForScope declare the variable
iff ParseClassLiteral didn't.

Bug: chromium:1245870
Change-Id: I777fd9d78145240448fc25709d2b118977d91056
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3140596
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76654}
2021-09-03 11:15:03 +00:00
Luis Fernando Pardo Sixtos
b8feade615 Fix ContainsArgument on class fields shorthands
Fixed issue were using the `arguments` object as a shorthand for a class
field initializer was not producing an early error.

Bug: chromium:1216261
Change-Id: I7d8f5a85c6881f7ca12a0e8450954de15bdd6033
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3095017
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#76646}
2021-09-02 15:56:36 +00:00
Nico Hartmann
ecefa2a40a Revert "[arm64][liftoff] Fix trap handling on load lane"
This reverts commit 1786f8d770.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64/44442/overview

Original change's description:
> [arm64][liftoff] Fix trap handling on load lane
>
> This fixes the registered {protected_load_pc} to (always) point to the
> actual load instruction. If {dst != src} we would emit a register move
> before the load, and the trap handler would then not recognize the PC
> where the signal occurs, leading to a segfault.
>
> R=​thibaudm@chromium.org
>
> Bug: chromium:1242300, v8:12018
> Change-Id: I3ed2a8307e353fd85a7ddedf6ecb73e90a112d32
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136454
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76642}

Bug: chromium:1242300, v8:12018
Change-Id: I7bc9d00a4fba3101e7ee68695961d1b543268c4e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138202
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76644}
2021-09-02 12:50:58 +00:00
Clemens Backes
1786f8d770 [arm64][liftoff] Fix trap handling on load lane
This fixes the registered {protected_load_pc} to (always) point to the
actual load instruction. If {dst != src} we would emit a register move
before the load, and the trap handler would then not recognize the PC
where the signal occurs, leading to a segfault.

R=thibaudm@chromium.org

Bug: chromium:1242300, v8:12018
Change-Id: I3ed2a8307e353fd85a7ddedf6ecb73e90a112d32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136454
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76642}
2021-09-02 12:23:22 +00:00
Georg Neis
dc81345f7e [compiler] Fix a bug in SimplifiedLowering
Bug: chromium:1245949
Change-Id: Ib0a9b3b9307c925d6c3bb0b9c294eea5545b3819
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138200
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76641}
2021-09-02 11:37:45 +00:00
Marja Hölttä
76adfd1c86 [super ic] Add tests for an already fixed security bug
Bug: chromium:1203122
Change-Id: Ief88320b620dbf2f347bf6f6fc1ebd459e60af3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3138194
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76639}
2021-09-02 10:13:06 +00:00
legendecas
4dc425c5f9 [builtins] TypedArray.prototype.set with number
Removes outdated type-error throwing on TypedArray.prototype.set
when the first argument is a number.

Bug: v8:11294
Change-Id: Ida3a46dec154b645620e2b064ded7a18de238649
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136773
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76631}
2021-09-02 00:06:23 +00:00
Al Muthanna Athamina
ca5a119497 Skip compiler/inlined-call-polymorphic on numfuzzer
Bug: v8:12013
Change-Id: I382f505914633598865586bc6a1d5dac7c875994
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3135581
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76621}
2021-09-01 13:11:33 +00:00
Jakob Kummerow
11cd2317ac [bigint] Truncate huge error messages
When an attempt to parse a huge string to a BigInt fails, then
including the entire string in it makes the exception's message
unwieldy, so this patch puts only the first 1000 characters of
such invalid strings into the exception message.

Bug: chromium:1245239
Change-Id: I2c62f0d34256653ba67da9666e8c5a1a4bbe0599
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3133142
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76619}
2021-09-01 10:09:52 +00:00
Al Muthanna Athamina
eb7e8fb5af Skip compiler/concurrent-inlining-1 on deopt_fuzzer
Bug: v8:12013
Change-Id: I7cee883f22b96b291ac9679fbe05ca2742993dc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3135574
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76618}
2021-09-01 09:48:03 +00:00
Camillo Bruni
6f80c9a619 [mjsunit] Prevent module test from accidentally loading common files
- Disable automatic module file extensions for the test
- Use uncommon name suffix to prevent accidental loading of an
  existing file

Change-Id: I26c1092a1e559cbbebce442a8d5ff3fb6dd5aa84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3122145
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76616}
2021-09-01 07:35:59 +00:00
legendecas
3926d6cde4 [builtins] typed array detaching in builtin iterations
%TypedArray.prototype% methods that receive a user callback
fn should not break in the mid-way of the iteration when the
backing array buffer was been detached. Instead, the iteration
should continue with the value set to undefined.

Notably, %TypedArray.prototype%.filter was throwing when the
backing buffer was detached during iteration. This should not
throw now.

Refs: https://github.com/tc39/ecma262/pull/2164
Bug: v8:4895
Change-Id: Ia7fab63264c8148a11f8f123b43c7b3ee0893300
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3066941
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76611}
2021-08-31 21:32:17 +00:00
Jakob Gruber
7b38608601 [compiler] Remove unused JSFunctionData::function_data_
Bug: v8:7790,v8:12149
Change-Id: I0c23b2c1126b2a950efe848973618407f64afeb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3132268
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76601}
2021-08-31 13:44:01 +00:00
Jakob Gruber
3ac13ef5b0 Add regression test for crrev.com/c/2928509
Bug: chromium:1209444
Change-Id: I4ec16a718061063dc01ec0d7c4a397c220e684c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3127718
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76585}
2021-08-30 16:44:15 +00:00
Jakob Gruber
7a3cc81d24 Skip mjsunit/interrupt-budget-override
Flaky due to concurrent inlining. Unskip once fixed.

Bug: v8:12149,v8:7790
Change-Id: I97345a37e68d7dcb671afe0fbb1332ad0be0de8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3129422
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76574}
2021-08-30 13:17:34 +00:00
Leszek Swirski
8bb3de6ebd [test] Disallow BG compile stress in log test
The log test checks for log positions, which may change when background
serialization / background compilation are enabled.

Fixed: v8:12117
Change-Id: I193c9c23e016fad1e3f06a9f377bb53db84a6988
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3129421
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76573}
2021-08-30 13:00:03 +00:00
Jakob Gruber
6627638a9d [parser] Integrate regexp parser into stack overflow handling
If a stack overflow occurs inside the regexp parser, propagate that
information to the parser.

Bug: v8:896,chromium:1243989
Change-Id: I5ced27ff968ad97764e156643e1980b3a722af1a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3127717
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76568}
2021-08-30 11:16:22 +00:00
Andreas Haas
91b72485a3 [wasm] Ship Reference Types
R=ecmziegler@chromium.org

Bug: v8:7581
Change-Id: I9acd99f3cf6832ee393d839cde7444a475a8f808
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123409
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76565}
2021-08-30 10:24:01 +00:00
Frank Tang
d61809bb41 [Temporal] Add some tests for PlainDate
Land some of the tests for Temporal.PlainDate
All marked as FAIL at this stage.

Bug: v8:11544
Change-Id: I004b7cb34effe1de1735b61c7ac749ae3c8e9bf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085624
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76551}
2021-08-28 05:40:50 +00:00
Frank Tang
7d729e85b6 [Temporal] Add some tests for Instant
Land some of the tests for Temporal.Instant
All marked as FAIL at this stage.

Bug: v8:11544
Change-Id: I79d14df47248c708e5d73a0e00e3f7973c521d16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086903
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76550}
2021-08-28 05:26:50 +00:00
Milad Fa
aed61ff438 PPC/s390: [sparkplug] skip test on unsupported platforms
Port 732f394c5d

Original Commit Message:

    StaGlobal didn't write the accumulator, but the baseline implementation
    assumed that it could preserve the accumulator by taking the return
    value of the StoreGlobalIC. This almost always worked, except for
    setters on the global object.

    Fix this by marking StaGlobal as clobbering the accumulator, same as
    StaNamedProperty (StaNamedProperty needs to do this anyway to avoid
    inlined setters from needing to create accumulator-preserving frames;
    StaGlobal would have needed the same thing if we'd ever inlined setters
    for it).

    Also, add a new debug scope, EnsureAccumulatorPreservedScope, to the
    baseline compiler, which checks if the accumulator value is preserved
    across non-accumulator-writing bytecodes. This found a (benign) bug with
    ForInPrepare, so fix that too.

R=leszeks@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Id8ada05abeb1a9c7e8a16936c35be9d652c4e8b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3124529
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76537}
2021-08-27 15:03:39 +00:00
Mythri A
471a22c3d0 [baseline] Add --no-stress-concurrent-inlining for code flushing tests
--stress-concurrent-inlining disables lazy feedback allocation. These
tests require lazy feedback allocation to compile baseline code.
Listing them in INCOMPATIBLE_FLAGS_PER_VARIANT isn't sufficient for
NumFuzzer.

Bug: v8:12088
Change-Id: I4fe091d27e104f4d9acda447fcf43f9a52bf60dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123420
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76529}
2021-08-27 10:32:21 +00:00
Mythri A
12e0978d2d Skip code flushing tests failing on NumFuzz bots
Bug: v8:12088
Change-Id: Ibc4db95125d44eca110829f1c043e769de5bd349
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123416
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76527}
2021-08-27 09:31:41 +00:00
Leszek Swirski
92a12c9e4d [test] Disallow optimisation for baseline flushing tests
Optimisation affects both reachability and tier-up, so disable it for
the flushing tests.

This should de-flake the Numfuzz bots.

Change-Id: I87c479f216eae2d801e7a0dc665e7325bd1b6bd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3123415
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76526}
2021-08-27 09:19:03 +00:00
Leszek Swirski
732f394c5d [sparkplug] Clobber accumulator in StaGlobal
StaGlobal didn't write the accumulator, but the baseline implementation
assumed that it could preserve the accumulator by taking the return
value of the StoreGlobalIC. This almost always worked, except for
setters on the global object.

Fix this by marking StaGlobal as clobbering the accumulator, same as
StaNamedProperty (StaNamedProperty needs to do this anyway to avoid
inlined setters from needing to create accumulator-preserving frames;
StaGlobal would have needed the same thing if we'd ever inlined setters
for it).

Also, add a new debug scope, EnsureAccumulatorPreservedScope, to the
baseline compiler, which checks if the accumulator value is preserved
across non-accumulator-writing bytecodes. This found a (benign) bug with
ForInPrepare, so fix that too.

Fixed: chromium:1242306
Change-Id: I220b5b1c41010c16ac9f944cbd55d2705c299434
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3122325
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76525}
2021-08-27 09:06:13 +00:00
Frank Tang
a91a6e1a23 [Temporal] Add some tests for Duration
Land some of the tests for Temporal.Duration
All marked as FAIL at this stage.

Bug: v8:11544
Change-Id: I4696edee7a2345133ed13c25aa720febe1f8fc69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087363
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76524}
2021-08-27 06:45:13 +00:00
Maya Lekova
be1fcdc9d2 [test] Introduce a d8-only flag for fast calls
This CL introduces a d8-only flag --expose-fast-api which enables the
test FastCAPI object if the --turbo-fast-api-calls flag is enabled. It
also disables --stress-snapshot, which is incompatible with fast calls.

Bug: v8:12137
Change-Id: I01e8321726b78be660fd6554225999bfc94006c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3117485
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76505}
2021-08-26 13:07:52 +00:00
Jakob Gruber
a56874d3eb [regexp] Early errors 🤯
This CL implements early SyntaxErrors for regular expressions. Early
errors are thrown when a malformed pattern is parsed, rather than when
the code first runs.

We do this by having the JS parser call into the regexp parser when
a regexp pattern is found. Regexps are expected to be relatively
rare, small, and cheap to parse - that's why we currently accept that
the regexp parser does unnecessary work (e.g. creating the AST
structures).

If needed, we can optimize in the future. Ideas:

- Split up the regexp parser to avoid useless work for syntax validation.
- Preserve parser results to avoid reparsing later.

Bug: v8:896
Change-Id: I3d1ec18c980ba94439576ac3764138552418b85d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3106647
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76502}
2021-08-26 11:33:39 +00:00
Samuel Groß
e84ac8bc3b [sandbox] Disallow ArrayBuffers outside the VM Cage
In a follow-up CL, the backing stores will, when the sandbox is enabled,
be referenced from V8 objects through offsets rather than raw pointers.
For that to work, all backing stores must be located inside the virtual
memory cage. This CL prepares for that.

Bug: chromium:1218005
Change-Id: Ibb989626ed7094bd4f02ca15464539f4e2bda90f
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3114136
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76486}
2021-08-25 09:52:38 +00:00
Mythri A
9ec7089687 lazy-feedback-allocation conflicts with stress-concurrent-inlining
stress-concurrent-inlining has a negative implication for
lazy-feedback-allocation. So add lazy-feedback-allocation as
incompatible flag with stress-concurrent-inlining.

Bug: v8:12088, v8:11947
Change-Id: Ia8ff66c595f6c6288b44f7a066729ace0d7ad9d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3113630
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76483}
2021-08-25 08:58:55 +00:00
Ng Zhi An
56090f1b59 [wasm-simd][x64][ia32] Fix I64x2ShrS
We were overwriting the shift Register, instead, we should be using the
tmp_shift register.

Bug: chromium:1242689
Change-Id: I732c9c1f8a43401ce003b22893db9e39dfac3817
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3116115
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76466}
2021-08-24 19:04:43 +00:00