This adds support for handling reference types when loading/storing
globals. Support for imported mutable globals is still missing and will
be done in a follow-up change.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-global-interpreter
BUG=v8:8091,v8:7581
Change-Id: I0d14919b1ce7f49c4a0541e3d6a99ee203cfb311
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1558086
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60695}
In mksnapshot, we only need to ensure we generate counter code in
(embedded) builtins, if needed. The counter function does not need to do
anything useful as long as it returns unique pointers for each counter,
and we don't need to dump counters.
Tbr: petermarshall@chromium.org
Change-Id: I94a53ef5193b89365948d0395e1908e6d3c6e396
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1549159
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60694}
Just set the flag --use-osr to false by default.
If it's set to true on the command line, then it'll be on.
I'd like to get some performance metrics on various tests spread
throughout our performance bot infrastructure.
Change-Id: I1ebc33264505af080901e531dca625452880f81b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1558089
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60693}
In RecordVirtualBytecodeArrayDetails() check whether the BytecodeArray
has a source position table before accessing it, otherwise it will just
crash with --enable-lazy-source-positions.
Bug: v8:8510
Change-Id: I1250e89faf836a8d5976ca98c14b6b7314bacb98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559730
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60692}
See the changes in BUILD.gn for an explanation of why a new flag is necessary.
It's likely that current usages of V8_TARGET_OS_* and V8_TARGET_ARCH_* also need
to change, but this is good enough for now to ensure both Win/cross/x86 and
Win/cross/x64 build.
BUG=chromium:945659
R=machenbach,thakis
TBR=jgruber
Change-Id: Ie2765db91a1c0d8c72ccf42c9d7fece792d9b252
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1542500
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60687}
This changes the existing cctest/test-field-type-tracking tests to
use actual Code objects and proper code dependencies to test that the
runtime actually does the right thing (aka deoptimizes the Code objects
correctly). Before it was using the CompilationDependencies, which as
of now no longer check whether the runtime actually deoptimized or not.
This is a prerequisite for changing the way we handle field representation
changes, specifically going from Smi or HeapObject to Tagged.
Bug: v8:8749, v8:8865
Change-Id: I260294217550cee2b42f7ba7e9c92bf0d1db0b8c
Doc: http://bit.ly/v8-in-place-field-representation-changes
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557149
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60686}
This adds preliminary support for references types as argument or return
values to functions that are redirected to the interpreter. The current
interpreter entry stub remains unchanged, using one buffer area that is
hidden from the GC. The corresponding {Runtime_WasmRunInterpreter} now
correctly boxes/un-boxes reference types into handles. This switch to a
handlified representation happens before any method that potentially
triggers a GC is called.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-anyref-interpreter
BUG=v8:8091,v8:7581
Change-Id: I41c766ed5ac877042d5964e72f3fd7df390c4e98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557147
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60684}
This CL contains a bunch of different improvements to the existing
object stats, namely:
- Introduce DEPRECATED_DESCRIPTOR_ARRAY_TYPE virtual instance type to
also estimate the memory overhead of DescriptorArrays for deprecated
Maps.
- Do proper over-allocation computating for inobject fields in JSObjects.
- Introduce OBJECT_PROPERTY_ARRAY_TYPE virtual instance type and properly
compute over-allocation for PropertyArrays
- Compute over-allocation for JSObject/JSArray elements properly.
- Correctly report JSFunction and JSCollection like the other
JSObjects, specifically report over-allocation properly for the
instances itself and for the elements/properties backing stores.
- Implement correct over-allocation computation for hash tables in
ObjectStatsCollectorImpl::RecordHashTableVirtualObjectStats().
Bug: v8:7266
Change-Id: I9cadd703266dc90911a8e7420c3b00dcee82b06d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557139
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60683}
Flag syntax is explained in a comment in flags.h, but we can make d8
easier to learn for new people if we also expose that explanation in the
--help text.
Change-Id: I7fd9ad0e545c2d9110119c0283bb14d665bcf19e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1555061
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60682}
For CheckNonEmptyString we not only need to rule out that the input is
not the empty string, but also make sure that the input is actually a
string, hence we need to do a proper instance type check in the general
case.
Bug: chromium:949996, chromium:947949, v8:8834, v8:8931, v8:8939, v8:8951
Change-Id: Icc260d735d19337bba4bb71570a6c6385e47c310
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557146
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60681}
The JSInliningHeuristic is now completely heap-access free. JSInliner
still includes Allow* guards and will be brokerized as a follow-up CL.
R=neis@chromium.org
Bug: v8:7790
Change-Id: I6df5d8515bb8bd8d512e8442e4f4dba9ebe9dd2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1528437
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60680}
This ensures that ApiObjects in V8 are not dropped if they are
currently used as WeakCollection keys. As proxy to determine key
status we use the presence of the identity hash on the object.
R=ulan@chromium.org
Bug: v8:8557, chromium:949244
Change-Id: Ifa0e24be44431a0200fd6a1d9898cd366b940bd5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557143
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60675}
We would only increment write barrier counters from the the MacroAssembler's
RecordWrite method which is only used in limited cases. Instead, we should
increment it inside the RecordWrite stub, this way we catch all uses, including
WASM.
Also, we had a static counter aimed at telling us how many barriers exist in
generated code, as opposed to how many are executed. This counter was not
functional since the compiler isn't aware of counters at the moment. Let's just
remove it to avoid confusion.
Change-Id: I6b173ab858c8984ef03ede225afdc999ba82b5c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1524483
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#60673}
Remove unused includes and add includes that were indirect.
Remove UnboundQueue which was not used anywhere.
Change-Id: If47faac45fc9c16a27453ecabed927ea00df3045
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557136
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60672}
The test is so slow that it might have caused the test driver to hang after the
normal hard timeout.
TBR=sergiyb@chromium.org
NOTRY=true
Bug: v8:9098
Change-Id: I28ad1551f66fab989494d7a3b015d661c5ab6efb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1557142
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60671}
The --trace-gc-verbose flag was mistakenly reporting the generic LO space size
in place of the *code* LO space size.
Change-Id: Iddb83b540b0e0a201aa358649d91ef606721e0be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554693
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60665}
This is a reland of 63608968b6
The previous CL failed on Windows, but it was a general bug. The
dropped_elem_segments was not being set on the instance properly in
cctests, so`table.init` instructions would fail by reading uninitialized
data.
I took this opportunity to also add an implementation of
`elem.drop` in the interpreter, and ported the JS tests for those too.
Original change's description:
> [wasm] Implement table.init for interpreter
>
> This also fixes CheckCallViaJS when a trap occurs. In that case, the
> trap callback is called instead of an exception being thrown, so if it
> isn't handled, a bogus result will be returned instead.
>
> Bug: v8:8965
> Change-Id: I560e89f353756df23c062fb8c9484d9971c19253
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1539078
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Ben Smith <binji@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60473}
Bug: v8:8965
Change-Id: Ia547d9530b7ca67fde5bd94539f49153b796e82d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1547142
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60664}
As part of one of the stack trace refactorings, this field moved from
StackFrameInfo to the StackTraceFrame class, but was not properly
removed.
R=petermarshall@chromium.org
Bug: v8:8742
Change-Id: I18b9bd7650eed0f5bdb0823da9fdefb6afa3491e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1550800
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60659}
This makes sure that the implicit operand stack slot used for passing an
exception from the throw-site to the catch-site is counted against the
maximum stack height.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-rethrow-interpreter
BUG=v8:8091
Change-Id: I7e8f47ba4662eb273792e7508207f67588264a2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554683
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60658}
For standard test failures, the variant name is enough to deduce the
full command line of the test. This is used to create the flako
command line on the infra side.
Test failures from numfuzz have additional variant_flags, calculated
by the fuzzer, which don't match a variant name. Exposing those in
the test results will enable printing a proper flako command line
on infra side for numfuzz cases.
Bug: v8:8971
Change-Id: Ie47d42a0b34037da458b474f2a9ab38f1a5d238a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554689
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60656}
This introduces a new PROTOTYPE_DESCRIPTOR_ARRAY_TYPE, which is used to
be able to distinguish DescriptorArrays for prototypes from regular
ones. This is primarily useful for the live objects, since for dead
DescriptorArrays we will likely not be able to figure out whether they
belong to a prototype Map, unless they die together.
Bug: v8:7266
Change-Id: I4b8e0008cc8bae607778151b7c18d30f4efba88d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554687
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60654}
This is a reland of d746be9ceb
Original change's description:
> [wasm] Use work-stealing queues for background compilation
>
> This reduces contention on the mutex protecting the {CompilationState}
> by splitting the compilation unit queues into several queues (one per
> background task). Each task executes its own queue first, and steals
> from other queues once it runs out of work.
> The implementation of the set of work-stealing queues is encapsulated
> in the new {CompilationUnitQueues} class in module-compiler.cc.
>
> R=titzer@chromium.org
>
> Bug: v8:8916
> Change-Id: I5a40314917e7d4a35d7ff9e8ec124ec212beacab
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543350
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60572}
Bug: v8:8916
Change-Id: Ic0cbad0ddc31be24715c5490b9ec71a39186fd3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1549172
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60653}
Typed arrays with elements cannot be frozen, but this function
previously would have falsely reported that they are after
an `Object.freeze()` call. Since the latter bails out when
the object is already frozen, the effect was that when calling
`Object.freeze()` on a typed array more than once, the first call
would throw and subsequent ones would not.
Change-Id: I75e59f51ebb94797cdf39bac4ec4c25c547e70a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552781
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60652}
This introduces new virtual instance types to further diagnose what's
going on in MapSpace, namely:
- MAP_ABANDONED_PROTOTYPE_TYPE includes all the abandoned (fast-mode)
prototype maps.
- MAP_DEPRECATED_TYPE includes all the deprecated (fast-mode) maps.
- MAP_DICTIONARY_TYPE includes all the dictionary-mode maps.
- MAP_PROTOTYPE_DICTIONARY_TYPE includes all the prototype maps in
dictionary-mode.
- MAP_PROTOTYPE_TYPE includes all the prototype maps in fast-mode.
- MAP_STABLE_TYPE includes all the (fast-mode) stable (leaf) maps.
Those maps who don't fall into any of the buckets above are categorized
as MAP_TYPE (as before).
The naming was chosen like this to make it possible to filter for the
relevant maps in the object stats via 'MAP_.*_TYPE'.
Bug: v8:7266
Change-Id: I233734e96a390ddb391bfff8a34a8fec842d1f7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554685
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60651}
This ensures the lifetime of reference values on the simulated operand
stack of the interpreter is coupled to a lifetime of the {ThreadImpl}.
We no longer directly store reference values on the stack, but maintain
a separate "reference stack" on the GC'ed heap. This will ensure the GC
traces such references properly.
The new {StackValue} safety wrapper makes sure all use-sites that access
the operand stack properly convert to/from handles when dealing with
reference values.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions-interpreter
BUG=v8:8091,v8:7581
Change-Id: I8c05f2d945a6def943b89be0cfca538a73df8855
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552791
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60650}
This expose v8::Context::DetachGlobal() as Realm.detachGlobal() in d8,
so that we can test API behaviors on Blink's detached iframes.
Change-Id: I4de1dd1a20d5862aba709e36d1d6afa9b221df6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1554322
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60649}
This is the first step towards full huge typed array support in V8.
Before this change, the JSTypedArray::length and the elements backing
store length (FixedTypedArrayBase::length) were used more or less
interchangeably to determine the number of elements in a JSTypedArray.
With this change we disentangle these two lengths, and instead make
JSTypedArray::length authoritative. For on-heap typed arrays, the
FixedTypedArrayBase::length will remain the number of elements in the
backing store, but for the off-heap typed arrays, this length will be
set to 0 (matching the fact that the FixedTypedArrayBase instance does
not contain any elements itself).
This also unifies the JSTypedArray::set_/length() and length_value()
methods to only have JSTypedArray::set_/length() which returns/takes
size_t values. Currently this still requires the values to be in Smi
range, but later we will extend this to allow arbitrary size_t values
(in the safe integer range).
Bug: v8:4153, v8:7881
Change-Id: Iff9089130bb31fa9e08e0cf913e7ab52c3dbf107
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543729
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60648}
Locks for compilation state callbacks and for the native module are
again taken one after the other. As a consequence, publishing compiled
Wasm code again happens in parallel. Compile times are now comparable to
before lazy hints were enabled.
Bug: chromium:949050
Change-Id: I45c52254d046de080938bd131fd3ed8116660bef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552787
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60646}
