Commit Graph

14312 Commits

Author SHA1 Message Date
Samuel Groß
f3737bbb12 [sandbox] Initialize sandbox during V8::Initialize
As sandboxed pointers are now default-enabled when the sandbox is
enabled, it is no longer possible to deactivate the sandbox at runtime.
This CL therefore removes all the logic that was required to support a
sandbox that could be disabled at runtime, moves the initialization of
the sandbox into V8::Initialize, and deprecates V8::InitializeSandbox.

This change also makes the sandbox initialization deterministic if
FLAG_random_seed is supplied.

Bug: v8:10391
Change-Id: Ibd49f7c251b7c58c642f18a551ecc2c391740970
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3762583
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81746}
2022-07-15 09:29:32 +00:00
Marja Hölttä
00704f5a03 [api] Add more efficient API for accesssing ArrayBuffer raw data
Raw data access is already possible via GetBackingStore()->GetData().
This API exposes a more efficient way for accessing
JSArrayBuffer::backing_store (which, despite the confusing name, is no
the BackingStore but its raw data pointer).

Bug: v8:10343
Change-Id: I695cea91e2c3de75ce6c86bac6e413ce6617958b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3764341
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81745}
2022-07-15 09:03:11 +00:00
Matthias Liedtke
2935b22fe2 [wasm-gc] Add 'none' type for nullref
This adds a new type 'none' as part of the WASM GC MVP.
The type can only be used in combination with a nullable reference, e.g.
'ref.null none'.
A 'nullref' is implicitly convertible to any nullable reference type.

Bug: v8:7748
Change-Id: Ic5ab6cc27094b3c9103ce3584452daa34633612f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3755136
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81670}
2022-07-12 17:54:58 +00:00
Joyee Cheung
f3cad8cec6 [serializer] allow SnapshotCreator to destruct without a blob
Previously SnapshotCreator demanded a blob to be created before
it can be destructed in debug build, this patch removes the
DCHECK so that the embedder can choose not to create the blob
when e.g. the snapshot building isn't successful due to errors.

Change-Id: I72939be1e0d79b257b9761f48a72e45325a1f6d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3716682
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#81644}
2022-07-11 16:14:33 +00:00
Thibaud Michaud
ff44012623 [wasm] Move Suspender functions to WebAssembly
Suspender.{returnPromiseOnSuspend,suspendOnReturnedPromise}
are not tied to a specific suspender anymore, so move them to
WebAssembly.{returnPRomiseOnSuspend,suspendOnReturnedPromise}.

With this change, the suspender property is not needed anymore on the
function data. Convert it to a boolean flag that just indicates whether
a function uses the JS Promise Integration API.

R=ahaas@chromium.org

Bug: v8:12191
Change-Id: I1b6d8e3190ebf5049dbc7eedee448999cf077509
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3748660
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81639}
2022-07-11 14:52:43 +00:00
Manos Koukoutos
0ed101e015 Remove some unused includes (4)
Mostly src/codegen, src/compiler, src/interpreter, src/libplatform.

Drive-by: Remove some unreachable code.

Bug: v8:13006
Change-Id: I1a9467f7e42531c545f660d35416c388e8ef9d3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749193
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81613}
2022-07-08 15:26:40 +00:00
Samuel Groß
818a36bb9d [sandbox] Sandboxify WasmInstanceObject::globals_start
This field points to the start of an ArrayBuffer backing store, which
is guaranteed to be located inside the sandbox if it is enabled. As
such, this simply turns the field into a sandboxed pointer field.

Bug: chromium:1342548
Change-Id: I5a76e23cfc83b2a04cd461def1cd04337ccf5cf7
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3749190
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81579}
2022-07-07 10:57:29 +00:00
Matthias Liedtke
a4fdd9f5de [wasm][test] test-gc.cc: Replace struct.new_with_rtt
with struct.new

Bug: v8:7748
Change-Id: Icc4868910832556f4c31081fb4af336f492db28e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3747868
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@google.com>
Commit-Queue: Matthias Liedtke <mliedtke@google.com>
Cr-Commit-Position: refs/heads/main@{#81565}
2022-07-06 17:40:07 +00:00
Clemens Backes
e4f07c0997 [wasm][streaming] Check section order of code section
The streaming decoder did not properly check the ordering of sections
relative to the code section.
This CL fixes that for both empty and non-empty code sections.
The special path for empty code sections is not actually needed, so
remove it to simplify code paths.

Drive-by:
1. Refactor the existing code for checking section ordering to make it
   more structured and readable.
2. Ensure that we either call {DecodeCodeSection} or {StartCodeSection},
   but not both.
3. Remove {set_code_section}, merge it into {StartCodeSection}.
4. Simplify calls to {CalculateGlobalOffsets} (make them unconditional
   and remove one redundant one).

R=ahaas@chromium.org

Bug: chromium:1336380
Change-Id: Ia2c5c115d43d2b5315e3b3c9e4a21175a36aa326
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3747860
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81554}
2022-07-06 13:43:17 +00:00
snek
d89d185fad [fastcall] expose wasm memory to cfunction
Load current Memory start/size off of the wasm instance when entering
fast calls, so they can use that info for whatever they need to do.
Fast calls from JS set the memory to null, and the memory does not
need to be piped from wasm to slow callbacks as wasm always calls
the fast function.

Change-Id: Ibfa33cdd7dba85300f95cbdacc9a56b3f7181663
Bug: chromium:1052746
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3719005
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: snek <snek@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81538}
2022-07-05 16:24:01 +00:00
jameslahm
ce16c04dc3 [test] Move cctest/test-intl to unittests/
... objects/intl-unittest.

Bug: v8:12781
Change-Id: I225054f5d0071f28d5b4d1efe8698ce5d0276c0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3725448
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#81534}
2022-07-05 14:51:00 +00:00
jameslahm
4c3f710833 [test] Move cctest/test-identity-map to unittests/
... utils/identity-map-unittest.

Bug: v8:12781
Change-Id: I875de2b1e589ec72d724a6d0745a5d615344b510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724792
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#81531}
2022-07-05 14:41:01 +00:00
Ilya Rezvov
fb8cd26f27 [wasm-atomics] Use traps for rest of atomic operations OOB handling
Bug: v8:12946
Change-Id: I2c17c3258123417d616e7fc8a1521e006b758e08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3731149
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Ilya Rezvov <irezvov@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81500}
2022-07-01 19:51:50 +00:00
Manos Koukoutos
ccc74bc64e [wasm-gc] Remove 'let' opcode
This opcode is being removed in favor of pre-declared non-defaultable
locals (details are still TBD).

Bug: v8:9495
Change-Id: I96ac053a1b5a852310c5dc0bbaeab0cbf5384663
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3738743
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81496}
2022-07-01 14:35:09 +00:00
Manos Koukoutos
bcd8bf90ff [wasm-gc] Introduce separate constructors for ref and (ref null)
Most often, the {ValueType::Ref} constructor was called with a
constant nullability. To make things more convenient, this CL renames
{Ref} to {RefMaybeNull}, and introduces {Ref} and {RefNull}
constructors with fixed nullability.

Bug: v8:7748
Change-Id: I664ff184ca936cc752e152c3c67546d79aa24390
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3732936
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81494}
2022-07-01 13:43:58 +00:00
Manos Koukoutos
a0a786656f [wasm-gc][refactor] Rename optRef -> refNull
This makes the internal V8 name consistent with the text-format name.

Bug: v8:7748
Change-Id: I44f7ac1eb5e634b4f829e596bf1f14caeb748d54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726291
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81491}
2022-07-01 12:33:23 +00:00
Ilya Rezvov
40daf5b14b [wasm-atomics] Prevent atomic load operation to be optimized out
Bug: chromium:1339276
Change-Id: Ice60167660fa52e84c78bb0bd9d2a2c85e0c377a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3733027
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Ilya Rezvov <irezvov@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81478}
2022-07-01 03:21:45 +00:00
Seth Brenith
1f97a2dfcb Reuse existing Scripts during synchronous parsing
This is a partial reland of https://crrev.com/c/3597106

With this change, an existing Script from the compilation cache can be
reused after its top-level SharedFunctionInfo was discarded, but only if
the new script is parsed on the main thread (not deserialized from code
cache data, and not parsed on a background thread).

Bug: v8:12808
Change-Id: I1edaee2095306a89e2c3b91f2fd01ac053f3c770
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3689348
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#81472}
2022-06-30 15:41:07 +00:00
Omer Katz
7626202118 [heap] Merge marking states
MinorMC maintained a separate marking state to support interleaved GCs.
Since MinorMC now assumes that interleaving is not possible, MinorMC can
use the same marking state as the full GC.

Bug: v8:12612
Change-Id: Ibeb7df2eb24e448f811b497c9d16b3b132f87ec2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3735163
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81468}
2022-06-30 14:16:48 +00:00
Toon Verwaest
e5dd7a400e [code-cache] Add a flag to control bytecode aging limits
Change-Id: Ia09e8c4528e59116be39be12d688f5b99a34c8e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3732938
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81437}
2022-06-29 13:00:17 +00:00
Leszek Swirski
50d2276347 [msvc] Fix build by guarding gcc pragmas
Bug: chromium:1307180
Change-Id: I45e01e172c04f5c0aac40cd84605ce52cb335cdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3732934
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81432}
2022-06-29 09:56:07 +00:00
Leszek Swirski
c68c724810 [gcc] Suppress array bounds warning
Suppress a gcc array bounds warning in ComputeStackLimit, where we are
very intentionally accessing a location out of bounds.

Bug: chromium:1307180
Change-Id: If4b7ce182472a761f9f619824676e5e660b0277a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3732109
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81416}
2022-06-28 14:59:36 +00:00
jameslahm
9f783f229b [test] Move cctest/test-dictionary to unittests/
... objects/dictionary-unittest.

Bug: v8:12781
Change-Id: I7faeb9fedf7857b25a85bf32f14323ba3da207c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706968
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#81395}
2022-06-27 12:06:50 +00:00
jameslahm
471e739b93 [test] Move cctest/test-atomicops to unittests/
... base/atomicops-unittest.

Bug: v8:12781
Change-Id: Iac23576cca9c50c2281a2d7e781dde4750e54c03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3711344
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#81394}
2022-06-27 12:03:15 +00:00
Manos Koukoutos
114a03ac82 [wasm-gc] Rename array opcodes
Rename:
- array.init(_static) -> array.new_fixed(_static)
- array.init_from_data(_static) -> array.new_data(_static)
- array.init_from_elem_static -> array.new_elem_static
- (Wasm)ArrayInitFromSegment -> (Wasm)ArrayNewSegment

Bug: v8:7748
Change-Id: I5ea314d653dd0e9f7f1f556469794d880934e01b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3726207
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81393}
2022-06-27 11:32:39 +00:00
jameslahm
5c0a114a4f [test] Move cctest/test-access-check to unittests/
... api/access-check-unittest.

Bug: v8:12781
Change-Id: I25025af204cdeaba1ba2b690cbaf5ba93e59441f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3725447
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81392}
2022-06-27 11:31:37 +00:00
jameslahm
7a2686016d [test] Move cctest/test-persistent-handles to
... unittests/heap/persistent-handles-unittest.

Bug: v8:12781
Change-Id: I8d7abff3a34e11c920053c71a1a2c4b9c84235d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724791
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81391}
2022-06-27 11:30:34 +00:00
jameslahm
8dbeee0d79 [test] Move cctest/test-global-object to unittests/
... objects/global-object-unittest.

Bug: v8:12781
Change-Id: I40a8d00301531e7d1a6dce90e1226c4568c8d72c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3713521
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81390}
2022-06-27 11:29:32 +00:00
jameslahm
fda71f4cf7 [test] Move cctest/test-pointer-auth-arm64 to unittests
... /codegen/pointer-auth-arm64-unittest.

Bug: v8:12781
Change-Id: Ibce77b62650c7a5f84b62282861297b9d4b2e591
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3724790
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Cr-Commit-Position: refs/heads/main@{#81389}
2022-06-27 11:28:30 +00:00
Michael Achenbach
accf013cb4 [test] Skip very slow test
No-Try: true
Bug: v8:12999
Change-Id: I82b1d8d3dc9ab62341f581440665964652603b92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3720718
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81383}
2022-06-27 09:24:08 +00:00
Camillo
14af9c22db [heap][deserializer] Better HeapObject alignment checks
Unaglined allocations are not fully supported in V8.

- Set USE_ALLOCATION_ALIGNMENT_BOOL to false for documentation
- Verify HeapObject address alignment requirements with --verify-heap
- Move address alignment to right after allocation in the deserializer
- Use object_size in the CheckAlignment helper to get a chance to
  figure out which allocation path we took

Bug: chromium:1330861, v8:8875
Change-Id: Iffd02d869923ccec133618250dfefb0480b02741
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717995
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81358}
2022-06-24 16:19:49 +00:00
Manos Koukoutos
49e6633eb5 [wasm-gc] Fix bugs and improve tests for br_on_cast(_fail)
There were multiple bugs and no test coverage for br_on_cast and br_on_cast_fail, specifically for the paths in the decoder where those
checks get optimized away.

Bug: v8:7748
Change-Id: I6e5d6449152df0456b43938174f57055a4c63fdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3723503
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81349}
2022-06-24 11:39:59 +00:00
Ilya Rezvov
118dff9dcd [wasm-atomics] Use traps for atomic Load and Store OOB handling
Bug: v8:12946
Change-Id: I3d9037a6dd940fe25f737efca49835b098d55081
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3691129
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Ilya Rezvov <irezvov@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81336}
2022-06-23 18:43:56 +00:00
Shu-yu Guo
54c69fc584 [heap] Verify the shared heap before tearing down a client heap
In the case of bugs creating shared->local edges, this lets us catch
dangling pointers via CHECKs before they happen.

Also removed some redundant checks in the shared struct verifier.
Existing heap verification already checks that all of a Heap's pointers
are contained within it.

Bug: v8:12547
Change-Id: Ic7a007b3b6559e3dfd0286fbf869586023c6f801
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3704911
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81335}
2022-06-23 14:56:23 +00:00
legendecas
22698d2676 [module] Fix aborts in terminated async module evaluation
SourceTextModule::ExecuteAsyncModule asserts the execution of
the module's async function to succeed without exception. However,
the problem is that TerminateExecution initiated by embedders is
breaking that assumption. The execution can be terminated with an
exception and the exception is not catchable by JavaScript.

The uncatchable exceptions during the async module evaluation need
to be raised to the embedder and not crash the process if possible.

Refs: https://github.com/nodejs/node/issues/43182

Change-Id: Ifc152428b95945b6b49a2f70ba35018cfc0ce40b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3696493
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#81307}
2022-06-22 16:20:28 +00:00
Patrick Thier
b4bb6cbce4 [string] Add checks for correct hash values in heap verification
- Check that internalized strings always have a computed hash value.
- Check that ThinStrings never have a forwarding index.
- Add a simple test of various property access with
  --always-use-string-forwarding-table to make the CF aware of the flag.

Change-Id: Ie047c9f635d5e0ed999208ec3379ef09c395b3f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717988
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81303}
2022-06-22 13:39:48 +00:00
Nikolaos Papaspyrou
852baabc17 heap: Add flag v8_enable_inner_pointer_resolution_osb
This CL introduces a compile flag v8_enable_inner_pointer_resolution_osb
behind which lies the experimental implementation of the object start
bitmap. It disassociates the object start bitmap from the compile flag
v8_enable_conservative_stack_scanning. At the moment the former flag is
a prerequisite for the latter, as conservative stack scanning requires
some mechanism for inner pointer resolution and the object start bitmap
provides one such mechanism.

Bug: v8:12851
Change-Id: I24c6b389453fbaefc79ae50c34c5ec7a1bf23347
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3717322
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81295}
2022-06-22 10:12:38 +00:00
Jakob Kummerow
d39d75b5e9 [wasm][cleanup] Merge opcode names into main macros
This merges the separate opcode name definitions from wasm-opcodes-inl.h
into the main opcode-defining macros in wasm-opcodes.h. This is simpler
(avoids a bunch of fairly complex macros) and easier to update when we
add new opcodes in the future.
The tests become obsolete because they would simply repeat the implementation.

Change-Id: Ib6421da5670079e7725659c1f4008251f8ff7aed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3714244
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81280}
2022-06-21 14:47:30 +00:00
Igor Sheludko
8487e66d75 [runtime] Inline Foreign fields into AccessorInfo
... to avoid additional indirection on every access.

Drive-by: given that AccessorInfo class now has a custom body visitor
it's no longer necessary to encode flags field as Smi.

Bug: v8:12949
Change-Id: I30eabee3cbc5ded2bf3f050dfe22208713a764bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3701590
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81237}
2022-06-20 09:25:03 +00:00
Michael Lippautz
a50caffd33 [heap] Remove incremental marking finalization step
Remove finalization step of incremental marking. The step was
historically used to process embedder/weak work on the main thread
before invoking the atomic pause. Remove the infrastructure as the
step is not needed anymore and actually required a safepoint.

Change-Id: I208767bbac3d9a06a0b3c67aa9779f8a5fa07328
Bug: v8:12775
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3702801
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81234}
2022-06-20 07:58:03 +00:00
Lu Yahan
a986dcff73 [riscv64] Avoid using callee saved register in call func
f8(fs0) is callee saved so that we should not use it to hold return value in the float_min_max test case.


Change-Id: I7039918cc434462dd956339d4263811543e23a94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3711284
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#81230}
2022-06-19 12:30:52 +00:00
Shu-yu Guo
8b8e044fd2 [heap] Add Parking* variants of blocking primitives
Due to shared GCs it's easy to accidentally deadlock V8 by forgetting to
park a thread before blocking.

This CL does the following:

- Adds ParkingConditionVariable and ParkingSemaphore, which hide
the Wait[For] methods in favor of ParkedWait[For], which parks the
thread before blocking the thread.
- Migrate to the Parking* variants in JS shared memory tests.

Bug: v8:11708
Change-Id: I6d1b2b26a05e7df0a69a1614c03308f538a8782f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3708017
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81225}
2022-06-17 17:42:40 +00:00
Igor Sheludko
62c6c6c772 [tests] Fix cctest/test-spaces/OldLargeObjectSpace
... which doesn't expect GCs caused by concurrent allocations.

Bug: v8:12779
Change-Id: I4ab13711ed4d98e7a46d759f0020b5983dec4ee0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3707278
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81219}
2022-06-17 13:09:24 +00:00
Seth Brenith
c5efd19b0e Return both toplevel SFI and Script from compilation cache
This is a partial reland of https://crrev.com/c/3597106 , except for the
changes in compiler.cc, which are just the minimal possible changes to
make the code compile.

With this change, it is possible that a call to
CompilationCache::LookupScript returns any of:
1. A Script and a toplevel SharedFunctionInfo (cache hit)
2. A Script but no toplevel SharedFunctionInfo (partial cache hit)
3. Nothing (cache miss)

Bug: v8:12808
Change-Id: Id33a4cd0cb28562d6b862fbb113ea9d03f255b2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3687425
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#81193}
2022-06-15 16:15:12 +00:00
jameslahm
dc5972784b [test] Move cctest/test-deoptimization to unittests/
... deoptimizer/deoptimization-unittest.

Bug: v8:12781
Change-Id: I453d02f6ead59ee274af600197dedc01cb144a4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3705237
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81181}
2022-06-15 12:37:25 +00:00
Clemens Backes
46e95920e4 [flags] Disable flags freezing in tests, fuzzers, and others
This CL explicitly disables the --freeze-flags-after-init flag for cases
where we modify flags after initialization. This is only tests, fuzzers,
and special options to d8, thus not security relevant.

These should be the last blockers for enabling the flag globally.

R=cbruni@chromium.org

Bug: v8:12887
Change-Id: I1d8a03dcc20e524d30c967f6fe15f6401de77612
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3706619
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81179}
2022-06-15 11:52:46 +00:00
Frank Tang
fe53fc04d2 [intl] Implement NumberFormat v8 string input handling
Design Document:
https://docs.google.com/document/d/14zxGub6Os6nARzH6XstOZX05w2537sZo_ZSSlGjGpBM/edit#


Bug: v8:10776
Change-Id: I506eadcf70f6855a79601a7cb1ce47849cfc066a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3594118
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81168}
2022-06-15 04:23:14 +00:00
Etienne Pierre-doray
1e0d18dc0b [task] Expose CreateJob in v8::Platform
CreateJob() is similar to PostJob() but doesn't schedule anything
until Join() or Notify*() is called.
This allows
- CreateJob().Join() without too many worker.
- Early 'empty' CreateJob() for initialization
  without causing spurious calls to GetMaxConcurrency()

Bug: chromium:1287665
Change-Id: I8fd8b139392ad30218f0cf8f580b2d76f1078777
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3668842
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81166}
2022-06-15 00:13:31 +00:00
Camillo
ed6be49813 [logging] Use short "JS:" prefix for function log events
"Function:" and "LazyCompile:" are confusing by now and use up too
much space.# Enter a description of the change.

This also changes the function names visible when using linux-perf

Change-Id: Ib2d4b7df39068c27b5b06db578fc550d2973ebb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3693705
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81161}
2022-06-14 16:11:21 +00:00
Michael Lippautz
c26dd2e32b [heap] Simplify incremental marking
In preparation for removing the finalization step, simplify
incremental marking logic.

Change-Id: I929034e389edb0c9da78cd39fd497d5783aff7c4
Bug: v8:12775
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3704509
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#81155}
2022-06-14 14:51:21 +00:00