This should not be needed any more after https://crrev.com/c/2944808,
which made job execution deterministic in predictable mode.
R=thibaudm@chromium.org
Bug: v8:11848, v8:10936
Change-Id: I7f71af063d366ca2ba9223afeb6c2caa77b02a99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3090334
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76258}
These are no longer enabled, so remove the code mitigation logic from
the codebase.
BUG=chromium:1003890
Change-Id: I536bb1732e8463281c21da446bbba8f47ede8ebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3045704
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76256}
d8 throws on unhandled rejected Promises since
https://crrev.com/c/2238569 so no special handling beyond throwing in
the async hooks themselves is needed.
Drive-by-fix: Use v8::Isolate* as local variable.
Bug: chromium:1238467
Change-Id: I271720cd9cfd1d30b58b5407c700b0f730910968
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3090333
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76255}
Move from recusion to loop to avoid stack overflow
Bug: v8:12059
Change-Id: I44981f4271495adf00d7697114663f966b8f9f11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087937
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76252}
OSR and concurrent_inlining are not strictly related, thus remove the
!is_osr condition when setting the concurrent_inlining flag.
OSR jobs simply execute on the main thread, whether CI is enabled or
not.
Drive-by: Exhaustive CodeKind switch cases.
Bug: v8:7790,v8:11981
Change-Id: Ia50e083f1c39d1d9845b1ef4e16ae8fd10798fb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086480
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76250}
The baseline compiler wasn't saving the accumulator when generating code
for StaDataPropertyInLiteral. This could lead to issues in cases where
the bytecode compiler optimized away loads of a register into the
accumulator.
Fixed: chromium:1236978
Change-Id: I8603a4c7446664f82b35db61f81cacefce2e4f3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3090326
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76249}
Make "emit_s128_set_if_nan" take LiftoffRegisters rather than Registers.
The decoding of the FP register code is architecture dependent, and in
particular we expect an FP pair on arm.
R=clemensb@chromium.org
Bug: v8:11856
Change-Id: I44a364c3ef3a0c41000ea1f6cead4916ee04145d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089165
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76246}
All the flags are in place and we can disable the slow histogram to
fix the expected regression we see on the perf bots.
Bug: v8:11946, chromium:1238515
Change-Id: I063582b4dede32bf90b5d5d94ba3a9dfd9f56718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089155
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76245}
Move I32x4SConvertF32x4 into shared implementation, and takes care of
both AVX and no-AVX implementation. Instruction selector still requires
dst == src to save a move in codegen.
Bug: v8:11589
Change-Id: Ie982682b3002192ab27700bf73f8c1e66aeba492
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086732
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76243}
MovFloatToInt and MovIntToFloat have been optimized
on Power8 and above to use VSX instructions instead if
using the memory.
Change-Id: I77af9aa20aa477f8f9e3ec9545445ef777aa0c72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087726
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76241}
This adds dedicated histograms for measuring the memory consumption and
compilation time for compiling "huge functions". Those are functions
with a body of more than 100kB. They are a *very* small fraction of all
functions (<0.01% according to current data), but their compile time is
often unproportionally large. Since they would just disappear in the
overall histograms, this CL adds dedicated histograms to make the
compile time and memory consumption of those functions more visible.
R=ecmziegler@chromium.org
Bug: chromium:1238828
Change-Id: I30bd07792ef4d9d67ff60c49c9edd0892c5c6e6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089166
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76239}
TurboFan currently calls into runtime for these two instructions, but
there is a better 4-instruction lowering that Liftoff already uses. Move
this into macro-assembler so we can share this across both compilers. We
name this PopcntHelper because there isn't a Cnt on ARM64 that works on
Word32/Word64.
Bug: v8:12071
Change-Id: I182bf466b76cbad985d8c5b8ddae0f4352f71cd2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087812
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76236}
This is a reland of 1c0cca0f56. It is
modified now to use V8_HAS_PTHREAD_JIT_WRITE_PROTECT and is rebased on
https://crrev.com/c/3085271 which fixes the definition of that macro.
Original change's description:
> Reland: [wasm] Check correctness of thread-local write protection
>
> The fix landed as a separate CL: https://crrev.com/c/3081522
> This is an unmodified reland.
>
> Original description:
> We make an undocumented assumption in {CodeSpaceWriteScope} that a
> single thread will only work on one module at a time. If this is
> violated, the thread-local {code_space_write_nesting_level_} would
> prevent the second module from being switched to writable.
>
> This CL adds a second thread local (in debug only) to check that if
> there is already a {CodeSpaceWriteScope} open that it contains the same
> {NativeModule} as any nested scope.
>
> R=jkummerow@chromium.org
>
> Bug: v8:11974
> Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg_ng
> Cq-Include-Trybots: luci.v8.try:v8_mac64_gc_stress_dbg_ng
> Change-Id: Id827b6ca472f695e4500584349aba159aa07eed1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3080578
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#76177}
Bug: v8:11974
Change-Id: Iffc510e85c8c56f26bfa88115ed3a8bdd33ef422
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg_ng
Cq-Include-Trybots: luci.v8.try:v8_mac64_gc_stress_dbg_ng
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085269
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76235}
When this is enabled, v8 reserves a large region of virtual address
space during initialization, at the start of which it will place its 4GB
pointer compression cage. The remainder of the cage is used to store
ArrayBuffer backing stores and WASM memory buffers. This will later
allow referencing these buffers from inside V8 through offsets from the
cage base rather than through raw pointers.
Bug: chromium:1218005
Change-Id: I300094b07f64985217104b14c320cc019f8438af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3010195
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#76234}
The combination of --wasm-write-protect-code-memory and MAP_JIT was not
handled correctly. We were trying to unnecessarily switch permissions,
and a DCHECK was failing because the writers count was not increased
previously (because the {CodeSpaceWriteScope} uses a separate
implementation if MAP_JIT is available).
This CL fixes the issues by explicitly setting
{WasmCodeAllocator::protect_code_memory_} to false if MAP_JIT is being
used.
R=jkummerow@chromium.org
Bug: v8:12070
Change-Id: Ifb05ba01f8e2e7781d7c29fe80d1144a3d65543b
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_mac_arm64_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089159
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76233}
We add a map from condition nodes to respective BranchConditions in
ControlPathConditions for faster lookup.
Bug: v8:11510
Change-Id: I571514beb699b76f2a1a0245c4785f518b9d8b1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3041676
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76232}
We now have %FinalizeOptimization() to block until all concurrent
compile jobs are done.
Bug: v8:7790,v8:12004
Change-Id: Ibb9955be06957b3f395b680e9be570c7c3ec0dcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086478
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76231}
nullptr objects are considered alive to allow weakness to be used from
stack while running into a conservative GC. Treating nullptr as dead
would mean that e.g. custom collectins could not be strongified on
stack.
Bug: chromium:1231286
Change-Id: Ibeddef18fcbae366c3f54304bf36b75c47bd74ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085280
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76229}
Got the data we need for now, reverting to enable --concurrent-inlining
clean data on --future.
BUG=v8:9684
Change-Id: I80b5bac1e852cb9f0915434a75115f6a59be8943
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3089154
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76228}
CallPrinter cannot determine the actual reason when the error is
triggered by CallRuntime. In the case, throw iterator error by
default instead of non-callable error to present more intuitive
error messages.
Bug: v8:12039
Change-Id: I240f9a729878b2dd606f4cc71236c8427bba316e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086902
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76226}
Bug: v8:8888
Change-Id: I3ecbf73df482865d838a0b98b6acd45de7e186f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085270
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76225}
.. to attempt to update deprecated maps. Used in
JSHeapBroker::ReadFeedbackForPropertyAccess.
Drive-by: Move Map::TryUpdate to MapUpdater to address
an old TODO.
Bug: v8:7790
Change-Id: Iaa791e204dd133f067014c0abdb23ef3b807a315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085274
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76224}
This makes flako usable on Windows using standard test names.
A workaround to bisecting to failures before this CL is to replace the
test_name by something like "mjsunit/regress\regress-1138075", i.e.
using this on the command line to trigger flako:
-p 'test_name="mjsunit/regress\\regress-1138075"'
R=liviurau@chromium.org
Bug: v8:9218
Change-Id: I37596efcaeca780eeacb27c2841fe8302ddb1e49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081610
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76222}
When running d8 with --trace-deopt, any deopt will contain the id of
the node that caused this deopt. These ids also show up in the
deoptimization data table of when using --print-opt-code.
Change-Id: I412ca7a4ff20427100fa63101d78ee3846569a8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3024144
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76220}
Avoid stray sweeper tasks still accessing heap after teardown has been
initiated. This reverts https://crrev.com/c/2297466 and restores the
invariant that no GC is running during teardown.
Bug: v8:12025
Change-Id: I9974a63ef385783a9c3ec09725dce118f754b25f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3081615
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76219}
One of the subtests relies on that.
R=jgruber@chromium.org
Bug: v8:12069
Change-Id: I648a766baf4d977f4df607754f666bd9e9102168
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086473
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76218}
... which didn't properly handle negative Smi indices with
JSTypedArray receivers.
The logic was broken by the spec violation fix
https://chromium-review.googlesource.com/c/v8/v8/+/2972727
Bug: chromium:1227476, chromium:1209405
Change-Id: I9bfa57d56bebccad00ed29666489f2003694e0a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086472
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76217}
MapRef::AsElementsKind can now concurrently walk transitions to find a
map of the requested elements kind.
Note this implementation is still less powerful than what we had before
crrev.com/c/3021175, since we never allocate new maps. When the
transition walk fails to find an appropriate map, we bail out.
I don't expect this to be a problem - when optimizing, the code has
already run multiple times and transitioned maps should exist.
Bug: v8:7790, v8:11988
Change-Id: Ic767b40c29bb86f7c4167097c76c5417985420fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086471
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76216}
Re-enable the creation of elements transition groups in
JSHeapBroker::ProcessFeedbackMapsForElementAccess. This turned out to be
quite important for performance.
Bug: v8:7790,v8:12031
Change-Id: I4d24837a668a5f7e78a5078212a7dc34b767d703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3085262
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76215}
Rolling v8/build: 8e6db3e..bbf7f0e
Rolling v8/buildtools/third_party/libunwind/trunk: b79b97c..b825591
Rolling v8/third_party/aemu-linux-x64: zSIltuD7SHwbJrbeTyt6t1P_n6bQJXzs-YHXShrGDI8C..qWiGSH8A_xdaUVO-GsDJsJ5HCkIRwZqb-HDyxsLiuWwC
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b35ee49..abc7ba7
Rolling v8/third_party/depot_tools: 8550570..49a703f
Rolling v8/third_party/googletest/src: aefb454..47f819c
Rolling v8/tools/luci-go: git_revision:e7749d37e8e52fd6eb9c79266a17d7fcb6f6ec04..git_revision:1120f810b7ab7eb71bd618c4c57fe82a60d4f2fe
Rolling v8/tools/luci-go: git_revision:e7749d37e8e52fd6eb9c79266a17d7fcb6f6ec04..git_revision:1120f810b7ab7eb71bd618c4c57fe82a60d4f2fe
Rolling v8/tools/luci-go: git_revision:e7749d37e8e52fd6eb9c79266a17d7fcb6f6ec04..git_revision:1120f810b7ab7eb71bd618c4c57fe82a60d4f2fe
TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
Change-Id: I188502d554c13aa599cb45a8a067c260dc61ec49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3087565
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#76214}
This Cl optimizes 64bit FP min/max using scalar VSX instructions.
FP values are always stored in DP format in a FP register which
means 32bit FP min/max ops will also benefit from this change.
Change-Id: I181e61b2d28ddf6920b548d33cb4d926da856be8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3086023
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#76212}
All marked as FAIL at this stage.
Bug: v8:11544
Change-Id: I6e4346a57aa3df054d2ef5bd353544fba7fd855b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3044350
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76211}
This patch significantly speeds up parsing of small BigInts. Its
primary idea is to move the loop that's iterating over the string
into the FromStringAccumulator API. That enables using function-
local variables instead of member fields.
A second optimization is to use a stack-allocated digit_t[] array
for small sizes, before falling back to a (comparatively slow)
std::vector.
As a particularly fast path, when this stack-allocated storage is
guaranteed to be enough, we can perform inlined multiply-and-add
steps directly on that data.
Finally, this patch changes the conversion of characters to their
numeric values from computations to a lookup table, which is a bit
faster for radixes <= 10 (where, in the old code, only one range
needed to be checked), and a lot faster for radixes > 10.
Bug: v8:11515
Change-Id: Ifd8ec4799ac34447ba6d4350b7788b559307784c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3064603
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76210}
Use logical shifts to emulate arithmetic shift, by first adding a bias
to make all signed values unsigned, then subtracting the shifted bias.
Details are in code comments for SharedTurboAssembler::I64x2ShrS.
Also refactor ia32 (which was already using this algorithm) to use the
shared macro-assembler function. And convert Liftoff's implementation as
well.
Bug: v8:12058
Change-Id: Ia1fd5fe5a9a0b7a7f31c426d4112256c8bf7021b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3083291
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76209}
