Commit Graph

60722 Commits

Author SHA1 Message Date
Sam Maier
858e3c7ef7 Compressing SnapshotData with zlib
This CL introduces, and turns on by default, compression for snapshots.
The compression is handled in SnapshotCompression, which is a new static
helper class for producing/consuming compressed SnapshotData.

To turn off snapshot compression (accomplished by removing calls of
Compress/Decompress) set the GN arg:
v8_disable_snapshot_compression = true


Bug: chromium:833361
Change-Id: If8abc3662e8473fbd0c94e443946fbea804a305e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1846066
Commit-Queue: Sam Maier <smaier@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66230}
2020-02-12 02:10:14 +00:00
Georg Neis
6239ec101a [modules] Fix bug in instantiation failure handling
It's not sufficient to reset only the modules on the current DFS path.

Bug: chromium:1050164
Change-Id: I00e5e12144ad70ac6371eea5e11590b72feaeecc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049853
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66229}
2020-02-12 01:27:33 +00:00
Georg Neis
447e2a7c49 [modules] Fix handle bug
SourceTextModule::AddAsyncParentModule can allocate so it must be a
static function.

Bug: chromium:1050433
Change-Id: I86e58569d16e626ce3f85cc46ea5f376c2d06f3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050383
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66228}
2020-02-12 00:53:53 +00:00
Johannes Henkel
1166f87a1c [DevTools] Roll inspector_protocol (v8)
"Remove ErrorSupport_.{h,cpp}.template as promised."
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/2045151
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/2047663

New Rev: 1f2492b6768e8620ece36a784c8ecd7ae7091610

Change-Id: I4acc65f0aafa94e20921a3e9ff7843303034bb60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2044951
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66227}
2020-02-11 18:45:53 +00:00
Jakob Gruber
099de337fe [gasm] Fix deopt frame state in Array.p.reduce and reduceRight
This fixes a bug in lazy deopts caused by calls to the callback function
in Array.prototype.reduce and reduceRight.

The deopt continuation expects the *next* iteration's index value but
we actually passed the current iteration's value.

The user-visible effect of this bug was that sometimes, an unexpected
additional call to the callback function would occur.

It was introduced by https://crrev.com/c/1934329.

Bug: v8:9972,chromium:1049982
Change-Id: Icfd2ef076209e20602f54d4662220e1d4c5d07ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049850
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66226}
2020-02-11 16:38:33 +00:00
Nico Hartmann
89b248b6f8 [torque] Reduce generated CSA variables and labels
This CL significantly reduces the size of CSA files generated from
torque by introducing only those Phis at block entry that are
required and otherwise uses defined values directly.

To do so it does:
- Define a DefinitionLocation that represents where a value is
  defined.
- For each block compute all the definitions that reach that
  block and introduce a phi iff the reaching definitions for a value
  are not the same for all predecessor blocks.
- In CSAGenerator map all DefinitionLocations to variables, such that
  if the same value is used in multiple blocks, it is mapped to the
  same variable without the need to pass it along the jump. This
  reduces both the arguments passed to Goto, Branch, ... and the
  variables that need to be passed to Bind when the block's label is
  bound. This reduces the number of temporary variables
  significantly. Temporaries are declared outside of blocks now
  in order to be accessible from other blocks.

Drive-by changes:
- Sequences of SetSourcePosition calls are merged if no output is
  generated between them.
- Dead blocks are no longer generated in release builds.

Bug: v8:9861
Change-Id: I5c30e5376e93c424c3ebfc5144a08592d77ae61f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2037444
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66225}
2020-02-11 15:07:23 +00:00
Leszek Swirski
5c7b4d2a01 [owners] Add leszeks@ as per-file factory owner
Change-Id: I2fed918353fea7c4fe42d6aef6e064e143111057
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050392
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66224}
2020-02-11 14:30:53 +00:00
Maya Lekova
dc360c6718 [test] Handlify a few Objects to prevent UAF
The Object::SetElement and JSObject::GetElement were
the GC suspects.

Fixed: v8:9995
Change-Id: Ia1f794188f08f0e2543a88eb4dc7a8b06dcb3deb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050391
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66223}
2020-02-11 14:09:53 +00:00
Jakob Gruber
61bba92bcf Revert "Revert [gasm] Implement ReduceArrayPrototypeReduce using the graph assembler"
This reverts commit c0fbfcd81c.

Reason for revert: Fix found.

Original change's description:
> Revert [gasm] Implement ReduceArrayPrototypeReduce using the graph assembler
> 
> Reverting due to a nondeterministic correctness issue bisected to this
> change. The intent is to reland once we fully understand and have
> fixed the problem.
> 
> The original CL landed in https://crrev.com/c/1934329.
> The revert on master is https://crrev.com/c/2049763.
> The revert on 8.0 is https://crrev.com/c/2049764.
> 
> Bug: v8:9972,chromium:1049982
> Change-Id: I171624bdeb18831e70869ae806c73529c240be4a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049763
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66215}

TBR=neis@chromium.org,jgruber@chromium.org

Change-Id: Id12a01dc72558639b26af58ff56cd0b11916eec2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9972, chromium:1049982
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050395
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66222}
2020-02-11 14:05:03 +00:00
Dominik Inführ
48e93e209a [heap] Update array buffer byte counters sooner
Before this CL array buffer counters were only decremented at the next
GC. This CL makes freed_bytes_ an atomic variable which is incremented
by the concurrent sweeping task. The main thread now also inspects this
value when adding new JSArrayBuffers to update counters sooner.

Bug: v8:10064
Change-Id: Ibcb245b541e806b95a3c2c42d3cc3affe7739e4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047043
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66221}
2020-02-11 14:00:13 +00:00
Dan Elphick
2afe890d24 [heap] Add DCHECK to AllocateRawWithImmortalMap
Adds DCHECK to Factory::AllocateRawWithImmortalMap to assert that the
Map passed in is read_only_space, since it's passed in as a raw object.

Bug: chromium:1049866
Change-Id: Ia7c6d5c99a4bc790ebcfb06e5ed55340964a5612
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049846
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66220}
2020-02-11 12:34:23 +00:00
Dan Elphick
1a4bbc8a9e Revert "[compiler] Make StateValuesAccess methods inlinable"
This reverts commit 14d1b9e944.

Reason for revert: Increases RuntimeStats/Group-JavaScript/duration

Original change's description:
> [compiler] Make StateValuesAccess methods inlinable
> 
> This moves several simple StateValuesAccess methods as well as
> SparseInputMask::InputIterator::IsReal into their header files so they
> can be more easily inlined. This gives about a 7% improvement to the
> BackgroundSelectInstructions runtime call stat.
> 
> Also marks some methods called by the new methods as V8_PRIVATE_EXPORT
> so component build test can build.
> 
> Bug: v8:10051
> Change-Id: I3e34977a4fa660d3f4f55fd4f2c0b2370d5d2bc2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2023559
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66078}

TBR=neis@chromium.org,delphick@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10051
Change-Id: I9168b524bc06562906a12a6ec0e948d6f90d4a7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050387
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66219}
2020-02-11 12:07:53 +00:00
Jakob Kummerow
cdd0a392ad Fix GC unsafety in ToPropertyDescriptorFastPath
Reading an object property can allocate a HeapNumber (even with
unboxed double fields turned off: we still use MutableHeapNumbers
to store properties).

Bug: chromium:1049859
Change-Id: I82228ccb98403b3db82671743f51b2e23f6636d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2050385
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66218}
2020-02-11 11:42:33 +00:00
Michael Achenbach
51cdea5def [foozzie] Make comparison before crash sensitive to single characters
The assumtion that V8 has no output differences within a single line
before a stack overflow, didn't hold. The prefix of e.g. console.info
can lead to a difference in a recursive call.

This change makes foozzie's output capping before a crash work on the
level of characters instead of lines to fix this.

No-Try: true
Bug: chromium:1050942
Change-Id: I13f747caf4f5848d40c31bd4232811285bab3c17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049844
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66217}
2020-02-11 11:13:33 +00:00
Toon Verwaest
f9b81189d5 [ast] Remove unused DoExpression
Change-Id: Iebdf095600186988abd7b1f13a1a2d9f566e5d7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049845
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66216}
2020-02-11 11:09:53 +00:00
Jakob Gruber
c0fbfcd81c Revert [gasm] Implement ReduceArrayPrototypeReduce using the graph assembler
Reverting due to a nondeterministic correctness issue bisected to this
change. The intent is to reland once we fully understand and have
fixed the problem.

The original CL landed in https://crrev.com/c/1934329.
The revert on master is https://crrev.com/c/2049763.
The revert on 8.0 is https://crrev.com/c/2049764.

Bug: v8:9972,chromium:1049982
Change-Id: I171624bdeb18831e70869ae806c73529c240be4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049763
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66215}
2020-02-11 10:54:23 +00:00
Steve Blackburn
9c6c8d9960 Fix TPH heap code
1. Fix typo introduced in prior commit.
2. Guard code so TPH does not attempt to use OffThreadSpace.

Bug: v8:9533
Change-Id: I37eeff6a9c6ec4a7c479161a01345aa82c884e54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047046
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Steve Blackburn <steveblackburn@google.com>
Cr-Commit-Position: refs/heads/master@{#66214}
2020-02-11 09:49:23 +00:00
Leszek Swirski
5a5976fc51 [offthread] Add off-thread support to Script
Adds support for off-thread allocation to Script allocation and
line-end calculation.

This includes adding support for keeping/merging a script list on
the OffThreadIsolate, and adding syntactical support for logging
(in the future this could do actual logging).

Bug: chromium:1011762
Change-Id: Id90f2ad7458e90e06f6926f1fce7ef7a1ef50b3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2046884
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66213}
2020-02-11 09:45:33 +00:00
Steve Blackburn
3645656b05 [heap] TPH cannot assume chunks
Bug: v8:9533
Change-Id: Ia47af94bd24b3f9a8a3d39f79a8ed61f4f2d53ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047048
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Steve Blackburn <steveblackburn@google.com>
Cr-Commit-Position: refs/heads/master@{#66212}
2020-02-11 09:22:03 +00:00
v8-ci-autoroll-builder
e6e42ec108 Update V8 DEPS.
Rolling v8/build: 8ada491..9e32f61

Rolling v8/third_party/depot_tools: 3b8094a..64c5af3

Rolling v8/tools/clang: 7d1284a..10a302f

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ia023508780e6341f22d94e9879fbae24e1fff960
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049523
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66211}
2020-02-11 03:53:44 +00:00
Milad Farazmand
9987977efe PPC/s390: [interpreter] Make FunctionEntry StackCheck bytecodes implicit
Port 9d3dc6f219

Original Commit Message:

  FunctionEntry StackChecks is one of the two cases where we generate a
  StackCheck bytecode. In these cases, we do stack check against the js
  limit (not to be confused with the real js limit). Their purpose is to
  be able to interrupt the running code.

  We can omit the FunctionEntry StackCheck by embedding its code into
  the InterpreterEntryTrampoline builtin. We save one bytecode per
  interpreted function.

  This change has rippling effects for optimized code, as well as the
  deoptimizer.

R=solanes@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: If797a8acba7581c9c388ac09b5554c774c5993a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2048124
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66210}
2020-02-10 22:14:14 +00:00
Dominik Inführ
ffdece642c [heap] Ensure that ArrayBufferSweeper is not active
Add CHECKs to make sure that ArrayBufferSweeper is only active when
v8_enable_array_buffer_extension is set to true.

Bug: v8:10064
Change-Id: I609d5e1230dca52fd8555d4401c3f60faf4c266c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047047
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66209}
2020-02-10 21:59:24 +00:00
Shu-yu Guo
55a01ec751 Reland "[weakrefs] Schedule FinalizationGroup cleanup tasks from within V8"
Deprecate the following explicit FinalizationGroup APIs in favor of
automatic handling of FinalizationGroup cleanup callbacks:
  - v8::Isolate::SetHostCleanupFinalizationGroupCallback
  - v8::FinaliationGroup::Cleanup

If no HostCleanupFinalizationGroupCallback is set, then
FinalizationGroup cleanup callbacks are automatically scheduled by V8
itself as non-nestable foreground tasks.

When a Context being disposed, all FinalizationGroups that are
associated with it are removed from the dirty list, cancelling
scheduled cleanup.

This is a reland of 31d8ff7ac5

Bug: v8:8179, v8:10190
Change-Id: I704ecf48aeebac1dc2c05ea1c052f6a2560ae332
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2045723
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66208}
2020-02-10 21:56:34 +00:00
Milad Farazmand
841fd7077b PPC: [codegen][cleanup] Unify assembler's support for DebugBreak().
Port 86d4b9f6ca

Original Commit Message:

    Each assembler has it's own way to place breakpoints:

      - stop() for arm, mips*, ppc* and s390.
      - debug() for arm64.
      - int3() for ia32 and x64.

    We can mandate a macro-assembler `DebugBreak()` method that all should
    implement so one can place a breakpoint in a portable way using a
    macro-assembler. This way also assemblers are in line with TurboFan, CSA, Torque
    and Liftoff which all have a DebugBreak() facility.

R=pierre.langlois@arm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: If2fb5ed99b4477142579e29fc5288d0768fd48c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047463
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66207}
2020-02-10 18:37:23 +00:00
Santiago Aboy Solanes
9d3dc6f219 [interpreter] Make FunctionEntry StackCheck bytecodes implicit
FunctionEntry StackChecks is one of the two cases where we generate a
StackCheck bytecode. In these cases, we do stack check against the js
limit (not to be confused with the real js limit). Their purpose is to
be able to interrupt the running code.

We can omit the FunctionEntry StackCheck by embedding its code into
the InterpreterEntryTrampoline builtin. We save one bytecode per
interpreted function.

This change has rippling effects for optimized code, as well as the
deoptimizer.

Bug: v8:10149, v8:9977, v8:9960
Change-Id: I6156de48b3bc0b519dd21190a8e6214fbe96c78d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914218
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66206}
2020-02-10 17:05:23 +00:00
Michael Achenbach
0920f17628 [test] Update whitelisted runtime-functions for fuzzing
We should not allow runtime functions that perform extra checks in
differential fuzzing, as there we ignore crashes and dchecks entirely.

Furthermore, this change whitelists some runtime functions for getting
more coverage.

Bug: chromium:1044942
Change-Id: Ie5d90bb53bc2d2bacc6635b1dcbe466605b33e12
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2041444
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66205}
2020-02-10 15:41:43 +00:00
Dominik Inführ
4fa45c6de2 [heap] Keep array buffer bytes stable during sweeping
Introduce separate counters for young and old array buffer bytes. They
are used to keep the counter stable during sweeping when the array
buffer lists are moved to the concurrent thread for sweeping.

Bug: v8:10064
Change-Id: I0f11a634341873b4d21759c284c55beb26fe30a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2045511
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66204}
2020-02-10 14:38:43 +00:00
Ulan Degenbaev
c50dcf68c7 [d8] Make myself an owner of d8
Change-Id: If22a3121f3fdaf0e67ecee267ea275b1bc79d617
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2039052
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66203}
2020-02-10 14:21:13 +00:00
Michael Achenbach
cf05e4ca79 Make using natives for fuzzing more permissive
This makes creating whitelisted runtime functions more permissive on
fuzzers (when --allow-natives-for-fuzzing is passed).

- Runtime functions with too few arguments are replaced with undefined.
- Superfluous arguments are ignored.

This reduces syntax-error rate on fuzzers. Also prevents
dcheck errors when fuzzing debug builds and fuzzers use too many
arguments for runtime functions.

Bug: chromium:1044942
Change-Id: I23b45398421c50bc82d1e8bfdf019f565253db96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2039352
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66202}
2020-02-10 14:18:08 +00:00
Ulan Degenbaev
f925176e19 [base] Clean up atomicops.h
This groups atomicops by type, removes an unused atomicop, and fixes
comments.

Change-Id: I9621ac4512d019ae9d0ce4f7e38c81011d46aa37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2047044
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66201}
2020-02-10 14:06:53 +00:00
Leszek Swirski
ec554ec053 [offthread] Make NextScriptId thread-safe
Make the NextScriptId value incrementing method thread-safe, using
CompareAndSwap primitives. This will allow it to be used in the
future for off-thread compilation.

Bug: chromium:1011762
Change-Id: I5b449e75c7dc63d24fa045ae880b0680b54c2f3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2046883
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66200}
2020-02-10 14:05:23 +00:00
Leszek Swirski
f6d988f910 [offthread] Clean-up HandleOrOffThreadHandle uses
Take advantage of the HandleOrOffThreadHandle implicit conversions where
applicable.

Bug: chromium:1011762
Change-Id: Iaf49d9098368b402e1cd3d991629d3f5e718f28e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2046885
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66199}
2020-02-10 13:46:23 +00:00
Pierre Langlois
86d4b9f6ca [codegen][cleanup] Unify assembler's support for DebugBreak().
Each assembler has it's own way to place breakpoints:

  - stop() for arm, mips*, ppc* and s390.
  - debug() for arm64.
  - int3() for ia32 and x64.

We can mandate a macro-assembler `DebugBreak()` method that all should
implement so one can place a breakpoint in a portable way using a
macro-assembler. This way also assemblers are in line with TurboFan, CSA, Torque
and Liftoff which all have a DebugBreak() facility.

Change-Id: Ic4332bd19ca4db53e01441d54af6632c2c1189f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2020954
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#66198}
2020-02-10 13:39:33 +00:00
Leszek Swirski
5f6384622f [offthread] Add off-thread scope allocation
Make Scope allocation and ScopeInfo creation Isolate-templated. This
includes making SourceTextModuleInfo allocation templated -- modules
aren't currently streamed off-thread, but will hopefully be in the
future, so this future-proofs them against that.

Bug: chromium:1011762
Change-Id: I8954e08e8e81489eb821b5f62ec35a5be31fce09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043790
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66197}
2020-02-10 12:58:03 +00:00
Michael Lippautz
7a410e739b heap: Be more conservative when delaying finalization
When delaying finalization we considered the maximum of the current time
to task and the recorded average. In case there's no recorded average
the GC would consider the current time to task as estimate which is too
aggresive as V8 may never get a task executed.

Be fully conservative about recorded task times and bail out in such
cases.

Bug: chromium:1049957
Change-Id: Ibaac242f72459341a170af80e63fb2266f91b0eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043809
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66196}
2020-02-10 12:17:13 +00:00
Dominik Inführ
83dfd0583b [heap] Improve accounting with ArrayBufferExtensions
Update external memory counters when using ArrayBufferExtensions. In
case the array buffers are swept concurrently, the counters are updated
at the beginning of the next minor/full GC. A subsequent GC is going
to update counters faster.

ArrayBufferExtension now stores the accounting_length such that
the sweeper always knows how much memory to deduct from the external
memory on destruction.

ArrayBufferList now also tracks the size of all ArrayBuffers in it.

Bug: v8:10064
Change-Id: I50a8b1180aa837b6932f834df1610255bd2bd9fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2041441
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66195}
2020-02-10 11:16:03 +00:00
Leszek Swirski
98129efc92 [offthread] Add InOffThreadSpace checks for Isolate access
Make sure we can't get the Isolate for writable off-thread space
objects, to avoid leaking the Isolate into off-thread compilation.

Bug: chromium:1011762
Change-Id: I5c4316e751736b8c8235fdcc8949d52b78313f38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043791
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66194}
2020-02-10 10:14:52 +00:00
Joakim Bengtsson
4b1447e4bb Improve V8 GC logic for external memory
The logic for V8 GC normally only takes the external memory growth
since last mark-compact into account. Unfortunately, the amount of
external memory recorded at the end of MC is often too high. The
reason is that it might take a while for the external memory
associated with the GCed objects to be released (e.g. V8 itself post a
task to release external memory for ArrayBuffer backing stores). In a
worst case scenario GC is driven only by external memory and none of
the external memory is released by the end of the MC. Then each MC
will record the external memory at its highest point and the GC logic
will allow the external memory to grow a bit higher each time which
can lead to excessive memory use.

This patch improves the situation a bit by calculating the growth from
the lowest external memory seen since the last MC. That way the growth
calculation will be offset from a level presumably closer to the
intended one (to what it would have been if the external memory
associated with the GCed objects was released during the MC). Now,
this fix is not perfect because it can be thrown off by external
memory growth occurring before the lingering memory is
released. However, it seems to work rather well in practice (e.g. when
playing MSE video on YT).

Bug: v8:10185
Change-Id: Ifcdd87eb45f3ae4a99d2aeec667c3ae4ca9a52b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2042711
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66193}
2020-02-10 09:33:33 +00:00
Peter Marshall
e16bd85b8e [tooling] Reland "Keep track of idle state even when we aren't profiling"
> It isn't expensive to set this enum on the isolate and we only call
> this in chrome when the ThreadDebugger is enabled anyway.
>
> This means we have a correct idle state to use with the upcoming
> CDP event which emits the thread state.

This time, move the dcheck below the stack pointer check. It turns out
we call into this with current state == JS, but only when js is on the
stack, so we can just move the check lower.

Bug: chromium:1025490
Change-Id: Ic9b2eff1ae1880535d0c6da5487ebea4f7e5e62b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2039050
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66192}
2020-02-10 09:15:22 +00:00
v8-ci-autoroll-builder
9e548ec77a Update V8 DEPS.
Rolling v8/tools/clang: 4f24c2a..7d1284a

Rolling v8/tools/luci-go: git_revision:bbda6f0d563b25ce0a25b147dec46e5815da5601..git_revision:02ba678a47594da180904851f3e6f809da7e0fc5

Rolling v8/tools/luci-go: git_revision:bbda6f0d563b25ce0a25b147dec46e5815da5601..git_revision:02ba678a47594da180904851f3e6f809da7e0fc5

Rolling v8/tools/luci-go: git_revision:bbda6f0d563b25ce0a25b147dec46e5815da5601..git_revision:02ba678a47594da180904851f3e6f809da7e0fc5

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Iff417ef02e3e79fa094fad500fec3975c915c399
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2044840
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66191}
2020-02-10 03:55:52 +00:00
Michael Achenbach
72fc962b4d Revert "[weakrefs] Schedule FinalizationGroup cleanup tasks from within V8"
This reverts commit 31d8ff7ac5.

Reason for revert: https://crbug.com/v8/10190

Original change's description:
> [weakrefs] Schedule FinalizationGroup cleanup tasks from within V8
> 
> Deprecate the following explicit FinalizationGroup APIs in favor of
> automatic handling of FinalizationGroup cleanup callbacks:
>   - v8::Isolate::SetHostCleanupFinalizationGroupCallback
>   - v8::FinaliationGroup::Cleanup
> 
> If no HostCleanupFinalizationGroupCallback is set, then
> FinalizationGroup cleanup callbacks are automatically scheduled by V8
> itself as non-nestable foreground tasks.
> 
> When a Context being disposed, all FinalizationGroups that are
> associated with it are removed from the dirty list, cancelling
> scheduled cleanup.
> 
> Bug: v8:8179
> Change-Id: Ic09313a11dd00af36d1f698250b3d735155f45e8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1986392
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66184}

TBR=ulan@chromium.org,rmcilroy@chromium.org,syg@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8179
Change-Id: If7869e9a5841803c10e748691f019a7d28f3b62e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043807
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66190}
2020-02-09 16:24:52 +00:00
Johannes Henkel
40e2bd1a9c [DevTools] Roll inspector_protocol (V8)
Upstream PR:
"Drop && from Serializable::TakeSerialized() &&."
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/2029933

New Rev: 75c465e8d425f2e0b5297245c7eb058411af493a

Change-Id: I11dafc589c8f0c5a7e158b9cc5ad5202ba8237e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2029335
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66189}
2020-02-09 12:24:31 +00:00
Z Nguyen-Huu
ddc7e69125 [wasm] Skip test in multiple isolates
If both isolates run this test, they are kind of racing on the
{tier_down_} flag, hence you get unexpected results.

Bug: v8:10189, v8:10099
Change-Id: I8657c32c024898442d5c916cf15077c846276b1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2044544
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66188}
2020-02-09 07:50:01 +00:00
v8-ci-autoroll-builder
a781302612 Update V8 DEPS.
Rolling v8/build: d34dbf0..8ada491

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I1a5aaa521f42bf2779605345568ab851d7126e4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2044836
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66187}
2020-02-09 04:01:41 +00:00
v8-ci-autoroll-builder
574b099985 Update V8 DEPS.
Rolling v8/build: 68bdecf..d34dbf0

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8052d29..ea794b8

Rolling v8/third_party/depot_tools: 73c7670..3b8094a

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I55eddf107dd1001dbcadef4c2222a5bd2b630117
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2044833
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66186}
2020-02-08 03:49:30 +00:00
Milad Farazmand
f2579c7331 s390: [wasm-simd] Add to simd conversion operations
Change-Id: Id3d6566dc7b8a4cc10574abe79246ebf1398f016
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2043024
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66185}
2020-02-08 02:19:10 +00:00
Shu-yu Guo
31d8ff7ac5 [weakrefs] Schedule FinalizationGroup cleanup tasks from within V8
Deprecate the following explicit FinalizationGroup APIs in favor of
automatic handling of FinalizationGroup cleanup callbacks:
  - v8::Isolate::SetHostCleanupFinalizationGroupCallback
  - v8::FinaliationGroup::Cleanup

If no HostCleanupFinalizationGroupCallback is set, then
FinalizationGroup cleanup callbacks are automatically scheduled by V8
itself as non-nestable foreground tasks.

When a Context being disposed, all FinalizationGroups that are
associated with it are removed from the dirty list, cancelling
scheduled cleanup.

Bug: v8:8179
Change-Id: Ic09313a11dd00af36d1f698250b3d735155f45e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1986392
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66184}
2020-02-08 00:20:10 +00:00
Ng Zhi An
51a7668976 [wasm-simd] Scalar lowering for load splat (s8x16, s16x8, s32x4)
We lower each op into num_lanes loads, and connecting up the effects in
a chain.

s64x2 is not implemented since we lowering for 64x2 generally doesn't
work anyway.

Load extends are a bit more complicated, so we'll do that in a separate
change.

Bug: v8:9886
Change-Id: I80096827bf8e8e0db1ef0ad1b76759ed1797ca5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2031893
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66183}
2020-02-07 19:59:09 +00:00
Seth Brenith
e5e4ea962e [torque] Support bitfield structs stored within Smis
This change moves the definition of the bits stored in DebugInfo::flags
to Torque, and updates the only Torque usage of that field to use more
natural syntax. This is intended as an example of common patterns found
in various other classes. Several supporting changes are required:

1. Add a new type representing a bitfield struct stored within a Smi. It
   is currently called SmiTagged, but I'm open to suggestions.
2. Add an enum-style output for Torque bitfield structs whose bitfields
   occupy only one bit each.
3. Add a new case to MachineOperatorReducer that makes the generated
   code for IncBlockCounter match with what was generated before this
   change.
4. Add support for reporting these bitfields in the postmortem debugging
   API. The format matches existing bitfields but with an offset value
   that includes the SMI shift size.

Bug: v8:7793
Change-Id: Icaecbe4a162da55d2d9a3a35a8ea85b285b2f1b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2028832
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66182}
2020-02-07 18:43:06 +00:00
Ng Zhi An
9991e4066c [cleanup] Add undefs for macros
Bug: v8:10115
Change-Id: If2ef0cd4bef9805dce3c9486d91385d0d40189fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2044650
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66181}
2020-02-07 18:27:40 +00:00