This change adds an addition 2GiB of guard region in front of guarded
WebAssembly memories. This provides defense in depth against code
generation errors, such as accidental sign extension of a 32-bit value.
As we consider supporting 4GiB WebAssembly memories, this is an
important line of defense.
Change-Id: Ica643c01ef28b5d2a01fbbd46273442545d8448e
Reviewed-on: https://chromium-review.googlesource.com/1108503
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53949}
This CL adds a builtin which receives an int32 argument and returns the
int32 result. Internally, it checks whether the argument is in the
valid smi range, then calls the runtime function with the smi argument
and converts the return value back from smi to int32.
This saves a lot of code in the wasm TF builder and in Liftoff.
R=mstarzinger@chromium.org
Bug: v8:6600
Change-Id: Icddcb020eae74c767a75090feb4939275432c007
Reviewed-on: https://chromium-review.googlesource.com/1107711
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53946}
Pass Isolate directly into CallHandlerInfo methods so that calls to
GetHeap can be removed.
Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: If28fbbd65530b01b69786c3e743754cff3b1ba3a
Reviewed-on: https://chromium-review.googlesource.com/1107926
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53945}
This removes error messages about missing _True labels, and instead tries
find overloads for the branch protocol and a normal function call at the
same time. The branch protocol is only considered if there are _True and
_False in the context and the overload returns never.
In addition, it prints all macro names of operator overloads if none
was matching.
Bug: v8:7793
Change-Id: Id81712f5b7f2af6765e23bb1f37438f141a79316
Reviewed-on: https://chromium-review.googlesource.com/1109839
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53943}
Also add a DCHECK to a branch that can only be taken for the null
prototype.
R=sigurds@chromium.org
Change-Id: Ib94fe8f25ecfd1a4baa576915e6edfa60bcd771b
Reviewed-on: https://chromium-review.googlesource.com/1109961
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53939}
After this CL all liveedit tests call the same LiveEdit::PatchScript
method. This method will be updated later.
As well some new liveedit cctests added, unfortunately part of them
do not work with current implementation.
R=dgozman@chromium.org,yangguo@chromium.org
Bug: v8:7862
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I3521af12b0f95b39d13aaafb1d1cf60f3f642a97
Reviewed-on: https://chromium-review.googlesource.com/1108382
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53936}
Pipe through Isolate into several elements.cc functions, to avoid using
HeapObject::GetIsolate. In some cases, uses ReadOnlyObject::GetIsolate
which is allowed.
(Autogenerated using Leszek's clang-bubble-getisolate)
Bug: v8:7786
Change-Id: Idcbfaadf95c3c2b96d03b606da5594774bac2f7e
Reviewed-on: https://chromium-review.googlesource.com/1107706
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53932}
Each local ABT is logically for one page. We passed the space in to the
constructor, but this is wrong because the space a page is in can
change, e.g. for compaction pages.
Instead, pass the page to the local ABT constructor and always get the
space from this. To do this we need to push the AllocateLocalTracker()
helper and friends down to Page, rather than its superclass MemoryChunk.
Unfortunately, we need to keep ReleaseLocalTracker() on MemoryChunk even
though only Pages can have local trackers, because we can't do virtual
dispatch on MemoryChunk::ReleaseAllocatedMemory() which would allow us
to clean up the tracker memory nicely for pages only.
We also have to make sure we update external bytes accounting properly
when swapping spaces, as in SemiSpace::Swap().
Change-Id: Iff02e41dd12a6b04a57fcc32f9e2b4f049fcbc24
Reviewed-on: https://chromium-review.googlesource.com/1107635
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53930}
The name {CallerOwnedBuffer} does not make sense in all situations,
especially if such an object is returned instead of being passed as
argument.
I am working on moving the wasm wire bytes off the JS heap, and hence
will return unowned references via the API. To prepare this change, I
deprecate the existing {CallerOwnedBuffer} and introduce a new
{BufferReference} struct with proper field names.
R=titzer@chromium.org, adamk@chromium.org
Bug: v8:7868
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic8953951447038a831b15a336a52a199bfbeafd5
Reviewed-on: https://chromium-review.googlesource.com/1108207
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53929}
Other fuzzers already have this ability. This CL adds it to the fuzzer.
The input has to be valid bytes, otherwise we cannot generate the text
representation.
R=titzer@chromium.orgCC=gdeepti@chromium.org
Change-Id: If1ba8accc707bee3b042e93f4201949f0233c90e
Reviewed-on: https://chromium-review.googlesource.com/1109794
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53926}
This completes the transition to Assembler::Options, which reduces
the assemblers's dependency on isolates, and there is now only one
way to create an Assembler, which is to use the options.
Note that some operations on assemblers still need an isolate, such
as GetCode(), and in these cases, the isolate is an additional
argument to the method.
R=jgruber@chromium.orgCC=mstarzinger@chromium.org
Change-Id: I413209d816c63a7c3640f1c226764693dcad1e7f
Reviewed-on: https://chromium-review.googlesource.com/1106169
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53925}
For bounds accesses, we definitely want to see these dchecks fire in
all configurations.
Change-Id: I54516794e32aaf0b00a2b1d88ffaf449f5a20b7b
Reviewed-on: https://chromium-review.googlesource.com/1109835
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53923}
For consistency with the existing Validate/Complete methodology.
Drive-by: Use it in {PrintRawWasmCode}.
R=titzer@chromium.org
Bug: v8:7754
Change-Id: I6f08ad7456ded2bdb9b06bb9f288e2609d4010e7
Reviewed-on: https://chromium-review.googlesource.com/1109793
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53922}
This is a reland of c2f1090db8, fixing jumbo builds.
Original change's description:
> [wasm] Move serialization tests to own file
>
> Move out all serialization related tests to
> {test-wasm-serialization.cc}, to reduce the size of
> {test-run-wasm-module.cc}.
>
> R=titzer@chromium.org
>
> Bug: v8:7754
> Change-Id: I0b2133baf69e2557df27d1733cc267d1d4cf7452
> Reviewed-on: https://chromium-review.googlesource.com/1107980
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53909}
TBR=titzer@chromium.org
Bug: v8:7754
Change-Id: Ic0bb02b1b782676c6100daa2d588adce8b54c388
Reviewed-on: https://chromium-review.googlesource.com/1109838
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53919}
All other sorting benchmarks use arrays of roughly the same length.
This CL adds a set of benchmarks that sort arrays of various lengths.
Two data configurations are used for each length: Completely random
and already sorted.
R=jgruber@chromium.org
Bug: v8:7382
Change-Id: Ib80a3421a68029c8e4f823605bab7b2d7fe1ae34
Reviewed-on: https://chromium-review.googlesource.com/1109509
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53917}
The {parameter_count} is always equal to {kParameterCount}, so just use
{kParameterCount} directly.
R=ishell@chromium.org
Bug: v8:7754
Change-Id: I136387b5f2da3af10bb36215f947ff0e0d872928
Reviewed-on: https://chromium-review.googlesource.com/1109820
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53916}
Currently we have to access the unreachable ArrayBuffer object to get
the backing store pointer when we want to free it. This means we need
the original ArrayBuffer object to stay alive until we collect all of
the pointers to free (currently done sequentially after marking).
We want to move this step to a background task that does not block GC
finishing - to do that we need the backing store pointers so that the
original page (where the ArrayBuffers live) can be freed.
Change-Id: Ifaf070d777939cb23c46da637a25d75f9c863bd8
Reviewed-on: https://chromium-review.googlesource.com/1102434
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53915}
This CL adds sorting of a randomized array to the PreSorted benchmark
to act as a baseline/reference point.
R=jgruber@chromium.org
Bug: v8:7382
Change-Id: I45b77a6584d5d9a4f14a807f3796af7197673eaa
Reviewed-on: https://chromium-review.googlesource.com/1109508
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53913}
This CL reverts commit 38bec2eadc and
implements the same functionality via Assembler::RecordRelocInfo.
Bug: v8:6666
Change-Id: I2e6b60697f68e956257f4c0877342da1bffca361
Reviewed-on: https://chromium-review.googlesource.com/1107710
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53911}
Move out all serialization related tests to
{test-wasm-serialization.cc}, to reduce the size of
{test-run-wasm-module.cc}.
R=titzer@chromium.org
Bug: v8:7754
Change-Id: I0b2133baf69e2557df27d1733cc267d1d4cf7452
Reviewed-on: https://chromium-review.googlesource.com/1107980
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53909}
Byteswap operations are used a lot in WASM on big endian
architecture. This CL removed unused 1-byte swapping,
rewrite tests so they have better coverage and cleans up
some other minor things.
TEST=cctest/test-run-wasm/RunWasmTurbofan_I32DivSOnDifferentRegisters
Change-Id: I60466bbd5fe3f64e8e55684265dc43e92fcabc2c
Reviewed-on: https://chromium-review.googlesource.com/1106379
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53908}
This is a reland of 2c1e4aa990
Original change's description:
> [test] Initialize slow-dcheck runtime flag with compile time value
>
> This makes sure slow dchecks are part of the snapshot when the compile
> time flag is set. It'll also obviate the need to set the runtime flag
> in general, making configurations simpler.
>
> It's still possible to opt out at runtime for the non-snapshot dchecks
> using the negated runtime flag.
>
> Bug: v8:7853
> Change-Id: Iadfc46ed691d32e9d39717e2ea0383e784660d1d
> Reviewed-on: https://chromium-review.googlesource.com/1105050
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53819}
TBR=jgruber@chromium.org
Bug: v8:7853
Change-Id: I21d82ea907c0beead4ad2bc90fecc4dc9036dc1b
Reviewed-on: https://chromium-review.googlesource.com/1109418
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53906}
The assertion is invalid if dst aliases src, which is the case in
InterpreterOnStackReplacement:
__ SmiUntag(x1,
FieldMemOperand(x1, FixedArray::OffsetOfElementAt(
DeoptimizationData::kOsrPcOffsetIndex)));
This didn't fail so far because slow asserts in snapshotted code are
never executed.
Bug: v8:7853
Change-Id: I5b2dad780da94b5821aa9a624a3fcb9d083b3aa3
Reviewed-on: https://chromium-review.googlesource.com/1109503
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53905}
It doesn't depend on anything from PropertyAccessBuilder other than
CompilationDependencies. Move it there instead.
R=jarin@chromium.org
Bug: v8:7790
Change-Id: I0545a990829f4591ebf5089b6a9e8c1a96899b93
Reviewed-on: https://chromium-review.googlesource.com/1107797
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53903}
