Commit Graph

722 Commits

Author SHA1 Message Date
Jakob Kummerow
ae8f83fe08 [ubsan] Rename ObjectPtr to Object
The two names refer to the same thing by now, so this patch is
entirely mechanical.

Bug: v8:3770
Change-Id: Ia360c06c89af6b3da27fd21bbcaeb2bdaa28ce22
Reviewed-on: https://chromium-review.googlesource.com/c/1397705
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58615}
2019-01-08 09:08:59 +00:00
peterwmwong
263dce9b57 [js] Remove CORE JS Natives (prologue.js), port extra utils to C++/Torque
- Removes the last `CORE` JS native script: `prologue.js`.
- Removes build step and bootstrapping associated with building/loading `CORE` JS natives.
- Removes `natives_utils_object` from context.
- Deprecates `--expose-natives-as` flag.
- Ports extra utils functions to C++ (`uncurryThis`) or Torque
  (`createPrivateSymbol`, `markPromiseAsHandled`, and `promiseState`).
- Move extra utils constants initialization into bootstrapper
  (`kPROMISE_PENDING`, `kPROMISE_FULFILLED`, `kPROMISE_REJECTED`).
- Removes unused extra utils functions `log` and `logStackTrace`.

Drive-by: Added test coverage for Array#includes being an unscopeable.

Bug: v8:7624
Change-Id: I5d983f8d11b76cb4dd3c2c67592ce1dc88364cd9
Reviewed-on: https://chromium-review.googlesource.com/c/1381672
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#58577}
2019-01-07 11:57:46 +00:00
Jakob Kummerow
056f927861 [ubsan] Port Object to the new design
Tbr: ahaas@chromium.org,leszeks@chromium.org,verwaest@chromium.org
Bug: v8:3770
Change-Id: Ia6530fbb70dac05e9972283781c3550d8b50e1eb
Reviewed-on: https://chromium-review.googlesource.com/c/1390116
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58470}
2018-12-26 20:54:07 +00:00
Jakob Kummerow
444741ac11 Revert "[error] extend error stack w/ function parameters"
This reverts commit 97628eeeb9.

Reason for revert: breaks compilation in Lite mode, which does not allow overriding of certain flags. See https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8926078411629093216/+/steps/build/0/steps/compile/0/stdout.

Original change's description:
> [error] extend error stack w/ function parameters
> 
> Extend FrameArray to hold weak references to parameters for functions in
> the call stack. The goal here is to provide more metadata for postmortem
> tools (such as llnode), especially in cases of rethrowing (this will be
> particularly useful when using postmortem with promises on Node.js).
> 
> Besides postmortem, these changes allow us to print a more detailed
> stack trace for errors with parameters types (or even values), which can
> be useful since JavaScript functions can receive any number of
> parameters of any type, and having a function behave differently
> according to the number of parameters received as well as their types is
> a common pattern on JS libraries and frameworks.
> 
> R=​bmeurer@google.com, yangguo@google.com
> 
> Change-Id: Idf0984d0dbac16041f11d738d4b1c095a8eecd61
> Reviewed-on: https://chromium-review.googlesource.com/c/1289489
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58468}

TBR=yangguo@chromium.org,bmeurer@google.com,bmeurer@chromium.org,mat@mmarchini.me

Change-Id: Ide0a434c1521ab2bbeca6821397ff63ba7d40fe5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1390128
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58469}
2018-12-26 19:03:45 +00:00
Matheus Marchini
97628eeeb9 [error] extend error stack w/ function parameters
Extend FrameArray to hold weak references to parameters for functions in
the call stack. The goal here is to provide more metadata for postmortem
tools (such as llnode), especially in cases of rethrowing (this will be
particularly useful when using postmortem with promises on Node.js).

Besides postmortem, these changes allow us to print a more detailed
stack trace for errors with parameters types (or even values), which can
be useful since JavaScript functions can receive any number of
parameters of any type, and having a function behave differently
according to the number of parameters received as well as their types is
a common pattern on JS libraries and frameworks.

R=bmeurer@google.com, yangguo@google.com

Change-Id: Idf0984d0dbac16041f11d738d4b1c095a8eecd61
Reviewed-on: https://chromium-review.googlesource.com/c/1289489
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58468}
2018-12-26 11:54:17 +00:00
Ulan Degenbaev
6c740734c4 [heap] Add a regression test for v8:8617
This also adjusts debug printing of descriptor arrays and adds a check
to the code serializer.

Bug: v8:8617
Tbr: mlippautz@chromium.org
Change-Id: Ic04f01abf9f7ed5a310b9e51a22c04fda108f563
Reviewed-on: https://chromium-review.googlesource.com/c/1387501
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58438}
2018-12-21 14:38:36 +00:00
Jakob Kummerow
9302db480e [ubsan] Port HeapObject to the new design
Merging the temporary HeapObjectPtr back into HeapObject.

Bug: v8:3770
Change-Id: I5bcd23ca2f5ba862cf5b52955dca143e531c637b
Reviewed-on: https://chromium-review.googlesource.com/c/1386492
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58410}
2018-12-20 16:43:49 +00:00
Igor Sheludko
4ba29d0503 [cleanup][heap] Fix kPointerSize usages in src/heap/
Bug: v8:8477, v8:8562
Change-Id: Iaa995c8fbb9f309dadac4e308d727f628fdb8b3c
Reviewed-on: https://chromium-review.googlesource.com/c/1384314
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58379}
2018-12-19 19:58:20 +00:00
Ulan Degenbaev
0400fc2049 [heap] Optimize marking of descriptor arrays.
Now a descriptor array tracks the number of descriptors that were
already marked. The marking visitor of a map only marks the subset
of the descriptors that it needs and that are not already marked.

If a descriptor array is shared between M maps and has N descriptos,
then the number of marking operations is reduced from O(M*N) to O(N).

This patch also adds a marking barrier for descriptors.

The marked descriptor counter in a descriptor array is not cleared
after mark-compact GC. Instead, it embeds two bits from the global
mark-compact epoch counter and is considered 0 if the bits do not match
the current value of the global epoch counter.

Bug: v8:8486
Change-Id: I2a7822a6833f3143e1d351e5e4819c2ef2c07fb0
Reviewed-on: https://chromium-review.googlesource.com/c/1382746
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58372}
2018-12-19 16:49:06 +00:00
Mythri
1ca0de67d2 [reland] Don't allocate feedback vectors and feedback metadata in lite mode
Don't allocate feedback vectors and feedback metadata in lite mode.
Also updates to skip tests that require feedback vectors.

This is a reland of
https://chromium-review.googlesource.com/c/v8/v8/+/1384087 after skipping
the failing tests.

Bug: v8:8394
Change-Id: I7766533b85a144e62996ceed8d542cdc534feeb5
Reviewed-on: https://chromium-review.googlesource.com/c/1384307
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58363}
2018-12-19 14:29:30 +00:00
Clemens Hammacher
9efa28bf00 Revert "Do not allocate feedback vectors and feedback metadata in lite mode"
This reverts commit 62e86b88e5.

Reason for revert: Fails on arm sim lite debug: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite%20-%20debug/1075

Original change's description:
> Do not allocate feedback vectors and feedback metadata in lite mode
> 
> Don't allocate feedback vectors and feedback metadata in lite mode.
> Also updates to skip tests that require feedback vectors.
> 
> Bug: v8:8394
> Change-Id: I22c64a32c44bb8f25fb09003d6e9fc5a04e84f8a
> Reviewed-on: https://chromium-review.googlesource.com/c/1378173
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58351}

TBR=rmcilroy@chromium.org,yangguo@chromium.org,mlippautz@chromium.org,mythria@chromium.org

Change-Id: I88fd37ea4e21aa2cc81eceb87ddb35c23224beae
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8394
Reviewed-on: https://chromium-review.googlesource.com/c/1384087
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58355}
2018-12-19 11:31:32 +00:00
Mythri
62e86b88e5 Do not allocate feedback vectors and feedback metadata in lite mode
Don't allocate feedback vectors and feedback metadata in lite mode.
Also updates to skip tests that require feedback vectors.

Bug: v8:8394
Change-Id: I22c64a32c44bb8f25fb09003d6e9fc5a04e84f8a
Reviewed-on: https://chromium-review.googlesource.com/c/1378173
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58351}
2018-12-19 10:30:48 +00:00
Jakob Kummerow
766ef168fb [objects.h splitting] Move HeapNumber to heap-number.h
Along with HeapNumberBase and MutableHeapNumber, of course.

Bug: v8:5402
Change-Id: I14a7f8052de3839cad36bb7e4ebb6da38b2ac096
Reviewed-on: https://chromium-review.googlesource.com/c/1379884
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58293}
2018-12-17 17:58:09 +00:00
Jakob Kummerow
b5a2839b92 [objects.h splitting] Move FreeSpace to free-space.h
Bug: v8:5402
Change-Id: I07f276dc6a06a2850aaae0a5ee4cbbfd27d8aa81
Reviewed-on: https://chromium-review.googlesource.com/c/1379875
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58289}
2018-12-17 15:56:39 +00:00
Jakob Kummerow
824596aa28 [ubsan] Replace a few more Object** with alternatives
Either Address* or Handle<Object> or ObjectSlot, depending on
circumstances.

Bug: v8:3770
Change-Id: Id00dfede6eb92ec30b658c0090b5310548ba5162
Reviewed-on: https://chromium-review.googlesource.com/c/1379228
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58282}
2018-12-17 14:17:22 +00:00
Jakob Kummerow
8dc9e26eda [ubsan] Port Struct subclasses, part 8: Script
Bug: v8:3770
Change-Id: Id7a05e5687d36c9347f35f6f3276af2a4b6115fd
Reviewed-on: https://chromium-review.googlesource.com/c/1377770
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58279}
2018-12-17 13:36:35 +00:00
Jakob Kummerow
c31f33b212 [ubsan] Port Struct subclasses, part 2
AllocationMemento, AllocationSite, ArrayBoilerplateDescription

Bug: v8:3770
Change-Id: I0081d222c73d9d66ba35ae28e73b6388e4e58ac0
Reviewed-on: https://chromium-review.googlesource.com/c/1377455
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58255}
2018-12-14 20:43:54 +00:00
peterwmwong
640d3adf5f [builtins] Remove InternalArray and reduce InternalPackedArray constructors.
InternalPackedArray now only has one constructor variant that expects no
arguments (Chrome's only usage of InternalPackedArray). As such, these TFC
builtins are no longer used and were removed:
- InternalArrayNoArgumentConstructor_Holey
- InternalArraySingleArgumentConstructor_Packed
- InternalArraySingleArgumentConstructor_Holey

On x64.release, this reduces builtins size by ~1.2KB.

Bug: v8:7624
Change-Id: I7316608dc02b1e09e9e414ee1aeb1fb08410c6f6
Reviewed-on: https://chromium-review.googlesource.com/c/1372772
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58193}
2018-12-12 16:13:41 +00:00
Ross McIlroy
a55803a15d [SFI] Add support for flushing old Bytecode from SharedFunctionInfos.
This change makes the SFI to bytecode link pseudo-weak. The marking visitors
check whether the bytecode is old, and if so, don't mark it and instead
push the SFI onto a bytecode_flushing_candidates worklist. Once marking
is complete, this list is walked, and for any of the candidates who's bytecode
has not been marked (i.e., is only referenced by the shared function info),
the bytecode is flushed and the SFI has the function data replaced with
an UncompiledData (which overwrites the flushed bytecode array).

Since we don't track JSFunctions, these can still think the underlying
function is compiled, and so calling them will invoke
InterpreterEntryTrampoline. As such, logic is added to
InterpreterEntryTrampoline to detect flushed functions, and enter
CompileLazy instead.

BUG=v8:8395

Change-Id: I4afba79f814ca9a92dec45d59485935845a6669d
Reviewed-on: https://chromium-review.googlesource.com/c/1348433
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58158}
2018-12-11 14:50:07 +00:00
Jakob Kummerow
cfb5bb726f [ubsan] Port JSReceiver and subclasses to the new design
Bug: v8:3770
Change-Id: I1d74ffe9e5478b4b8bc0acbf088d20919d458d50
Reviewed-on: https://chromium-review.googlesource.com/c/1363822
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58112}
2018-12-08 04:05:50 +00:00
Jakob Gruber
24e766168b Reland "[nojit] Remove code stubs"
This is a reland of f849396c3a

Original change's description:
> [nojit] Remove code stubs
>
> All stubs have been migrated to builtins. This CL removes most related
> code.
>
> Bug: v8:7777, v8:5784
> Change-Id: I4470cfef34788e6c8e0fd5fd09e40e250d088dad
> Reviewed-on: https://chromium-review.googlesource.com/c/1365284
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58093}

Tbr: mstarzinger@chromium.org,yangguo@chromium.org,jkummerow@chromium.org,bmeurer@chromium.org
Bug: v8:7777, v8:5784
Change-Id: I005ee2a820d49a75a90481d262a310e4ccfd1391
Reviewed-on: https://chromium-review.googlesource.com/c/1367746
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58101}
2018-12-07 15:46:17 +00:00
Jakob Gruber
05100848ba Revert "[nojit] Remove code stubs"
This reverts commit f849396c3a.

Reason for revert: arm64: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/24229

Original change's description:
> [nojit] Remove code stubs
> 
> All stubs have been migrated to builtins. This CL removes most related
> code.
> 
> Bug: v8:7777, v8:5784
> Change-Id: I4470cfef34788e6c8e0fd5fd09e40e250d088dad
> Reviewed-on: https://chromium-review.googlesource.com/c/1365284
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58093}

TBR=jkummerow@chromium.org,yangguo@chromium.org,mstarzinger@chromium.org,jarin@chromium.org,jgruber@chromium.org,bmeurer@chromium.org

Change-Id: I52c3abd3f4e5872fe26ed7e527a58b118e02b387
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7777, v8:5784
Reviewed-on: https://chromium-review.googlesource.com/c/1367804
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58095}
2018-12-07 13:54:22 +00:00
Jakob Gruber
f849396c3a [nojit] Remove code stubs
All stubs have been migrated to builtins. This CL removes most related
code.

Bug: v8:7777, v8:5784
Change-Id: I4470cfef34788e6c8e0fd5fd09e40e250d088dad
Reviewed-on: https://chromium-review.googlesource.com/c/1365284
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58093}
2018-12-07 13:41:21 +00:00
Igor Sheludko
8799f78080 [ptr-compr] Use FullObjectSlot for off-heap slots
(mostly for roots, handles and stack locations).
Thi CL also changes RootVisitor interface to use FullObjectSlots instead of
ObjectSlots.

Bug: v8:8518
Change-Id: I217c7ae176387a8c64f4754e62339727bdb36018
Reviewed-on: https://chromium-review.googlesource.com/c/1366035
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58091}
2018-12-07 12:35:27 +00:00
Igor Sheludko
014eb84f1f [ptr-compr] Introduce MemsetTagged() for initializing on-heap kTaggedSize-sized slots
Bug: v8:8518
Change-Id: I39db0adbd84627491bcb653b90de724eb988d383
Reviewed-on: https://chromium-review.googlesource.com/c/1363145
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58057}
2018-12-05 22:58:54 +00:00
Jakob Kummerow
371ba71f82 [ubsan] Port WeakArrayList to the new design
and also its pure-static subclass PrototypeUsers, whose porting
is a no-op.

Bug: v8:3770
Change-Id: I075806f784a0631058692149e71c45e455e90f73
Reviewed-on: https://chromium-review.googlesource.com/c/1355631
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58003}
2018-12-03 23:35:12 +00:00
Jakob Kummerow
f53d4d70a9 [ubsan] Port FeedbackVector and FeedbackMetadata
to the new design.

Bug: v8:3770
Change-Id: I63291cc8eccfa1da20e84c6d3e9f48f253409396
Reviewed-on: https://chromium-review.googlesource.com/c/1355627
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57981}
2018-11-30 20:00:20 +00:00
Hannes Payer
9ec92be9c8 [heap] Fix cctest expectations for large object allocations.
Bug: chromium:852420
Change-Id: Ie1f656cafe78c517ff53676d8cb7200d0bf1d7cc
Reviewed-on: https://chromium-review.googlesource.com/c/1356518
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57972}
2018-11-30 14:47:54 +00:00
Ulan Degenbaev
799dfad502 Prepare bottleneck for setting instance descriptors.
This refactors Map operations to update the instance descriptors and
the number of own descriptors via the SetInstanceDescriptors bottleneck.
This will allow us to add a special marking barrier for these updates.

Bug: v8:8486
Change-Id: Ie9c746d4bcdd6166d38402622734693fa59faf21
Reviewed-on: https://chromium-review.googlesource.com/c/1354883
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57934}
2018-11-29 12:50:53 +00:00
Jakob Kummerow
862266a2aa [ubsan] Port WeakFixedArray and subclasses
TransitionArray, NormalizedMapCache, DependentCode to the new design.

Bug: v8:3770
Change-Id: I8bd56f231fb62b146e0fb05989418aedb62a628b
Reviewed-on: https://chromium-review.googlesource.com/c/1350287
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57921}
2018-11-29 02:03:20 +00:00
Jakob Kummerow
81620900e9 [ubsan] Port SharedFunctionInfo to the new design
Bug: v8:3770
Change-Id: If405611d359d29ae1958beebd9202e068434a621
Reviewed-on: https://chromium-review.googlesource.com/c/1350286
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57918}
2018-11-28 21:23:50 +00:00
Hannes Payer
9266bc2453 Reland: [heap] Release dead young generation large objects in the Scavenger.
This reverts commit 33713b5b61.

Bug: chromium:852420
Change-Id: I45f447b690af8534aeec8630a717abe92f4099f8
Reviewed-on: https://chromium-review.googlesource.com/c/1350997
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57850}
2018-11-26 19:47:20 +00:00
Hannes Payer
1abc28e328 [heap] Remove large object tenure limit for now.
Bug: chromium:852420
Change-Id: Ie0a6eeb42b57db2309403acd23e986f73cb33afe
Reviewed-on: https://chromium-review.googlesource.com/c/1350123
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57824}
2018-11-26 13:59:49 +00:00
Jakob Kummerow
8bb236d7c9 [ubsan] Port FixedArray{,Base} to the new design
Removing the temporarily duplicated classes FixedArrayPtr and
FixedArrayBasePtr.

Bug: v8:3770
Change-Id: I056ad74ff69593e9f134ef5c976766812c4d9275
Reviewed-on: https://chromium-review.googlesource.com/c/1345913
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57807}
2018-11-25 03:08:14 +00:00
Jakob Kummerow
4ff869ed3c [ubsan] Port ByteArray and subclasses to the new design
Bug: v8:3770
Change-Id: I49d4fdc1cac6c4bde81fbe0bf76341be12711109
Reviewed-on: https://chromium-review.googlesource.com/c/1345911
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57803}
2018-11-24 09:29:14 +00:00
Yang Guo
33713b5b61 Revert "[heap] Release dead young generation large objects in the Scavenger."
This reverts commit 40b448eadd.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64/27711

Original change's description:
> [heap] Release dead young generation large objects in the Scavenger.
> 
> Bug: chromium:852420
> Change-Id: Ieefbee7bfd625d62e9104950bdfa8e46d5f4270a
> Reviewed-on: https://chromium-review.googlesource.com/c/1348081
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57761}

TBR=ulan@chromium.org,hpayer@chromium.org

Change-Id: I6b57dd8ed92d85b5ce012da754611278ceaefe20
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:852420
Reviewed-on: https://chromium-review.googlesource.com/c/1349270
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57763}
2018-11-23 09:15:33 +00:00
Hannes Payer
40b448eadd [heap] Release dead young generation large objects in the Scavenger.
Bug: chromium:852420
Change-Id: Ieefbee7bfd625d62e9104950bdfa8e46d5f4270a
Reviewed-on: https://chromium-review.googlesource.com/c/1348081
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57761}
2018-11-23 08:04:49 +00:00
Hannes Payer
be77c3ef75 [heap] Handle young generation large objects by MC.
Bug: chromium:852420
Change-Id: Ice7548bf9993bc5dd57b301c410c019eb956daa5
Reviewed-on: https://chromium-review.googlesource.com/c/1348077
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57755}
2018-11-22 17:48:43 +00:00
Hannes Payer
ac9908a090 [heap] Introduce a large object space for code objects.
Change-Id: Ie2d740b6b584c5104849e46c1286550c80f1f5c9
Reviewed-on: https://chromium-review.googlesource.com/c/1340252
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57713}
2018-11-22 08:23:09 +00:00
Hannes Payer
42c41a1fbb Don't run young generation large object tests for nosnap configurations.
Bug: chromium:852420
Change-Id: I01d0bed33a573adbe1d9365868d63ea9c3cb0552
Reviewed-on: https://chromium-review.googlesource.com/c/1346499
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57697}
2018-11-21 18:52:44 +00:00
Ulan Degenbaev
6b55356d3a [heap] Decouple code deoptimization from clearing weak objects.
This patch allows the deoptimizer to keep embedded pointers intact.
Previously, the deoptimizer had to clear embedded pointers because
the mark-compactor relied on the Code::marked_for_deoptimization flag
to indicate whether the embedder pointers were cleared or not.

This patch adds a new flag called Code::embedded_objects_cleared()
and thus can correctly clear dead weak objects in deoptimized code.

Bug: v8:8459
Change-Id: I6eb6ff3aa2182bc41730e0a249965f8d8c0525ce
Reviewed-on: https://chromium-review.googlesource.com/c/1335943
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57584}
2018-11-16 18:31:06 +00:00
Jakob Kummerow
0dbda17de5 [ubsan] Port Map to the new design
Bug: v8:3770
Change-Id: I52660eeda1bd299953793af9af1395f47e89072e
Reviewed-on: https://chromium-review.googlesource.com/c/1331155
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57454}
2018-11-13 06:59:12 +00:00
Jakob Kummerow
fe61cd6487 [ubsan] Port Code to the new design
Bug: v8:3770
Change-Id: I413ce57f7fa91cef2445995ca22650477f92b0df
Reviewed-on: https://chromium-review.googlesource.com/c/1321892
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57445}
2018-11-12 18:47:04 +00:00
Igor Sheludko
4001f86afa [ptr-compr] Make cleared weak reference value pointer compression friendly
because otherwise cleared weak references require special treatment during
decompression.

Bug: v8:7703
Change-Id: I38761d656c606e7ba7fc3075dffbd855a9f72302
Reviewed-on: https://chromium-review.googlesource.com/c/1322909
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57315}
2018-11-07 13:28:43 +00:00
Jakob Kummerow
6d706ae3a0 [ubsan] Port Smi to the new design
and split Smi out of objects.h into smi.h.

Bug: v8:3770, v8:5402
Change-Id: I5ff7461495d29c785a76c79aca2616816a29ab1e
Reviewed-on: https://chromium-review.googlesource.com/c/1313035
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57252}
2018-11-05 20:52:51 +00:00
Ross McIlroy
21784e3d94 [Lite] Disable ICs in lite mode
BUG=v8:8293

Change-Id: I1d0e75f8671d3ec1c899c65bb9a865f2358173de
Reviewed-on: https://chromium-review.googlesource.com/c/1280527
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57042}
2018-10-26 16:07:20 +00:00
Jakob Kummerow
e7b8699910 [ubsan] Port MaybeObject to new design
This CL applies the equivalent of the Object -> ObjectPtr
transformation to MaybeObject and HeapObjectReference. We
need no renaming in this case because we can just migrate
them both in one go.

Bug: v8:3770
Change-Id: Ie1259c3e8c556eff00f8bcf534d7270ca9fe00e1
Reviewed-on: https://chromium-review.googlesource.com/c/1298386
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57010}
2018-10-26 01:08:30 +00:00
Hannes Payer
7103cd8b10 Reland "[heap] Clean-up MemoryChunk allocation area constants."
This is a reland of 1d83709303

Original change's description:
> [heap] Clean-up MemoryChunk allocation area constants.
> 
> Change-Id: I8ba59546ab93c7af98bc5ece2f0160628844dd92
> Reviewed-on: https://chromium-review.googlesource.com/c/1280584
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56908}

Change-Id: I110b70ee5cb5609e54e24e17f183b8c6d6086b8a
Reviewed-on: https://chromium-review.googlesource.com/c/1297318
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56941}
2018-10-24 13:27:41 +00:00
Jakob Kummerow
266c0b967b [ubsan,heap] Replace Object** with ObjectSlot
as part of the continuing quest to get rid of Object*/Object**.
This is a fairly mechanical replacement of Object**/MaybeObject** with
wrapper objects carrying the same data. No change in behavior is intended.
Overloaded operators are provided to minimize code churn.

Bug: v8:3770
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I76cee82b8bf2dd80a1b66f09dd2bb2b65038eeb7
Reviewed-on: https://chromium-review.googlesource.com/c/1287889
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56920}
2018-10-24 00:14:20 +00:00
Yang Guo
0d75b76c64 Revert "[heap] Clean-up MemoryChunk allocation area constants."
This reverts commit 1d83709303.

Reason for revert: Speculative revert for https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Arm%20-%20debug/8158

Original change's description:
> [heap] Clean-up MemoryChunk allocation area constants.
> 
> Change-Id: I8ba59546ab93c7af98bc5ece2f0160628844dd92
> Reviewed-on: https://chromium-review.googlesource.com/c/1280584
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56908}

TBR=ulan@chromium.org,yangguo@chromium.org,hpayer@chromium.org

Change-Id: I0ce51513864d3f7e4337391dc510fb828c083d48
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1296488
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56914}
2018-10-23 18:20:07 +00:00