Commit Graph

61038 Commits

Author SHA1 Message Date
v8-ci-autoroll-builder
9dacf73a4f Update V8 DEPS.
Rolling v8/build: b03644a..c6ac51f

Rolling v8/third_party/depot_tools: 9ca9c52..4576851

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I93e5506a0a4f9f8830ccdd11623d6bac88584556
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083667
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66546}
2020-03-03 03:55:41 +00:00
Ng Zhi An
237a0982b4 [wasm-simd][x64] Add AVX codegen for some s128 ops
Bug: v8:9561
Change-Id: I733df8856ad8266a637794a9401118937e6bf006
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2069401
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66545}
2020-03-03 03:33:51 +00:00
Andreas Haas
24110ef046 [wasm][liftoff] Implement atomic.fence
R=clemensb@chromium.org

Bug: v8:10108
Change-Id: I3bdb4c2abe0b1db1babec370921463dbdfcd0a32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2074403
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66544}
2020-03-02 22:28:31 +00:00
Shu-yu Guo
8c8bd658c6 Make ToInteger always truncate -0
The spec was changed in February TC39 to make ToInteger always normalize
-0 to +0. This only observably affects Atomics.store.

Bug: v8:10271
Change-Id: I0e8f6c35cef982eae242cf6619f6f24fa75b1759
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2076509
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66543}
2020-03-02 20:40:01 +00:00
Deepti Gandluri
f57943788e [wasm-simd] Add flag for post-MVP SIMD, gate opcodes with it
Some opcodes are introduced in V8 for prototyping, and performance
measurements that are not officially a part of the current SIMD proposal
but may be included in future, gate these by a separate flag.

Change-Id: Icc6a9e89c6196c8ff144d2e0193d707e1f60c38b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079539
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66542}
2020-03-02 20:38:51 +00:00
Andreas Haas
c9a2703891 [wasm][liftoff] Implement AtomicNotify
R=clemensb@chromium.org

Bug: v8:10108
Change-Id: I72294ae6fa62209e078b3d00151207524b32e67e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2074401
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66541}
2020-03-02 17:37:05 +00:00
Milad Farazmand
b701dfc1b4 s390: [simulator] Avoid negating if reg value overflows
Negating 1 << 31 as a signed integer overflows and
causes undefined behaviour hence SetS390OverflowCode
may never get set.

Change-Id: I91379a53752de322cee4541cf44fb65338a614e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081335
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66540}
2020-03-02 17:19:45 +00:00
Milad Farazmand
40406eb649 s390: [wasm-simd] Implement F64x2 simd operations
Also adding to and modifying some of the F32x4 operations.

Change-Id: Ia57dcd70a3bad2f1ec4ccc64ff2cb02b9c83aa22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081832
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66539}
2020-03-02 17:12:35 +00:00
Leszek Swirski
ae340e19fe [cleanup] Remove right trimming from class boilerplate allocation
During class boilerplate allocation, we were overestimating the number
of computed properties before allocating the computed property array,
and the array after. But, we can reasonably easily get an exact size
for the computed properties array, and avoid the right trimming
entirely.

This will simplify off-thread class boilerplate allocation, where the
off-thread heap doesn't currently implement right trimming.

Bug: chromium:1011762
Change-Id: Icf450340aa4e215c2063f4dd964ca7b80ef033c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083029
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66538}
2020-03-02 15:59:10 +00:00
Andreas Haas
cdec094f27 [wasm][liftoff] Implement AtomicWait on 64-bit platforms
Implements AtomicWait on 64-bit platforms. Note that this implementation
does not use {PrepareCall}, as planned originally. This will be done in
a separate CL, to prepare the implementation for 32-bit platforms. This
CL for now unblocks the implementation on x64.

R=clemensb@chromium.org

Bug: v8:10108
Change-Id: I52eb752364b231043975f62913c2ef9579321038
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2074400
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66537}
2020-03-02 15:58:06 +00:00
Toon Verwaest
98fe71533e Revert "[cleanup] Remove three unused proxy runtime functions"
This reverts commit 90b39673c3.

Reason for revert: These functions are in use by d8-js.cc

Original change's description:
> [cleanup] Remove three unused proxy runtime functions
>
> R=​jgruber@chromium.org
>
> Bug: v8:9183
> Change-Id: I789295e5bbea682b2e46ccf5a55c69dc74f0ed72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617669
> Auto-Submit: Simon Zünd <szuend@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61632}

TBR=jgruber@chromium.org,szuend@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9183, v8:10289
Change-Id: Ibd8566151f036efe73c869dcfd2cfee2a559489b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083299
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66536}
2020-03-02 15:47:55 +00:00
Seth Brenith
5cf5767552 Reland "[runtime] Improve handling of enumeration index on global dictionary"
This is a reland of 25d16574f8

Changes from original: replaced slow test with fast test

Original change's description:
> [runtime] Improve handling of enumeration index on global dictionary
>
> Bug: chromium:1056054
> Change-Id: Ie1f2da98bc54a2ad5189cbe2ee1686fe1ef7019a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079035
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#66504}

Bug: chromium:1056054
Change-Id: I45b9a096b1e37bf1dc5e792f106cdfadd47fabf9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080855
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#66535}
2020-03-02 15:41:15 +00:00
Milad Farazmand
ab033d0489 PPC/s390: [regexp] Always pass the isolate to CaseInsensitiveCompareUC16
Port d303f4fba9

Original Commit Message:

    In the past we've used the isolate argument to signal whether we were
    in unicode mode (nullptr) or not (the real isolate). This is no longer
    needed, and in fact breaks no-i18n mode which always expects to have a
    real isolate.

R=jgruber@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2b8ede3c89738a6cec59f8e32657a3c8c815fe6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081888
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66534}
2020-03-02 14:59:25 +00:00
Andreas Haas
7ad6b04edb Reland "[wasm] Refactor AtomicWait implementation"
Stack parameters in the StubCallDescriptor were set to the wrong type. I
changed it now so that for stack parameters that are specified in the
CallInterfaceDescriptor, type specified type is used. All other
parameters are assumed to be tagged, as it has been until now.

Original change's description:
> [wasm] Refactor AtomicWait implementation
>
> The existing implementation included aspects that are not
> straight-forward to implement in Liftoff and seemed inefficient:
> * Convert the timeout in WebAssembly code from I64 to F64, just to
>   convert it back in the runtime.
>   * On 32-bit platforms this conversion needs an additional C-call.
> * Split the I64 expected value from I64 into two I32 values in the
>   wasm-compiler.
>   * Ideally the int64-lowering takes care of 32-bit specific handling.
>
> With this CL the timeout and the expected value are passed as I64 to
> the runtime (a builtin moves the I64 into a bigint for that). The
> int64-lowering takes care of 32-bit platforms. There are special
> builtins for 32-bit platforms, but they are written such that ideally
> also the int64-lowering could create them.

Bug: v8:10108
Change-Id: Ib87b543666708457c0d686208a86e46cdca3f9a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080362
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66533}
2020-03-02 14:49:55 +00:00
Georg Neis
97d905909a [turbofan] Remove two obsolete operators
Change-Id: Ibba52fe0c94dbb95ec66bc88d0a1e9a254094013
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080364
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66532}
2020-03-02 14:41:55 +00:00
Clemens Backes
14a9968f6a [wasm] Add a separate frame type for debug break frames
The frame created by the WasmDebugBreak builtin now has a separate frame
type, which will (later) allow to inspect the spilled registers.

Once Liftoff supports reference types, this frame will also need special
GC support for spilled heap references.

R=jkummerow@chromium.org

Bug: v8:10222
Change-Id: I110e51d1e6d09b0f44dcdd1cdcaafa2eaa64fddd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083013
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66531}
2020-03-02 14:40:25 +00:00
Liviu Rau
64ae870e0a Update llvm-project repo location
Bug: chromium:1055078
Change-Id: Ifa421501cd19f445c2e0c0c87ab33563cef205cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077677
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66530}
2020-03-02 14:32:35 +00:00
Michael Achenbach
4dde764696 [foozzie] Add another abort on regexp stack overflow
Bug: chromium:1055060
Change-Id: I9fd06642ba47d1452b33b0e97715dd2e64943c6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083027
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66529}
2020-03-02 14:12:45 +00:00
Leszek Swirski
e91ccc43bd [cleanup] Unify HashTable specialisation instantiation
Use macros to unify how HashTable (and subclasses) are marked as
externally specialised, and how those specialisations are initialised.

This cleanup will make it easier in the future to also add
specialisations of HashTable methods for Isolate/OffThreadIsolate.

Bug: chromium:1011762
Change-Id: Ibb62cf30d3ba40170e1d35ab72ada0f74963a5c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083023
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66528}
2020-03-02 13:03:36 +00:00
Igor Sheludko
bc714409c4 [ptr-compr] Enable 32-bit smis on non-ptr-compr builds
This will help detecting TaggedIndex-related issues earlier.

Bug: v8:10047
Change-Id: Ibd150e8ff77ec807977e0ee1b54c880620840bac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071261
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66527}
2020-03-02 12:33:05 +00:00
Georg Neis
e440eda4ad [turbofan] Validate computed induction variable phi type
Bug: chromium:1051017
Change-Id: I1729c059f4bc4fc75615fa0aa8dacf44dc56dad4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2066968
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66526}
2020-03-02 12:24:00 +00:00
Clemens Backes
826df16aba Revert "Update unicode-regexp-ignore-case-noi18n expectations"
This reverts commit c6c9d4bf1b.

Reason for revert: Fails on noi18n bot: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/30737

Original change's description:
> Update unicode-regexp-ignore-case-noi18n expectations
> 
> There appear to be one or several bugs in noi18n mode such that
> expectations in this test are no longer met. This CL updates
> expectations to the current behavior and re-enables the test so we at
> least preserve coverage in the other cases.
> 
> The behavior in question should be investigated in the future
> (low priority).
> 
> Bug: v8:10120
> Change-Id: Ib7c9a18133a386e6e39ee54d68ce4106d9b28c84
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081815
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66524}

TBR=jkummerow@chromium.org,jgruber@chromium.org

Change-Id: I960b90fe3679ef4c04782ca9ac9b91454e636dbb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10120
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083024
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66525}
2020-03-02 12:22:55 +00:00
Jakob Gruber
c6c9d4bf1b Update unicode-regexp-ignore-case-noi18n expectations
There appear to be one or several bugs in noi18n mode such that
expectations in this test are no longer met. This CL updates
expectations to the current behavior and re-enables the test so we at
least preserve coverage in the other cases.

The behavior in question should be investigated in the future
(low priority).

Bug: v8:10120
Change-Id: Ib7c9a18133a386e6e39ee54d68ce4106d9b28c84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081815
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66524}
2020-03-02 11:48:26 +00:00
Victor Gomes
5f27695a77 [runtime] Update frame/frame-constant to support V8_REVERSE_JSARGS
Bug: v8:10201
Change-Id: I7c91e912feab227378810c91afe3de61e0e2fda8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081817
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66523}
2020-03-02 11:11:35 +00:00
Georg Neis
7d144a6729 [turbofan] Restructure typer's operator dispatch
Remove some duplication and make it easier to type a specific operation
with given input types.

Change-Id: I70d0424a1d1bd6330aa381568728d8313d5ad25d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078541
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66522}
2020-03-02 11:05:00 +00:00
Dominik Inführ
317ab46a6a [heap] Enable usage of ArrayBufferExtensions
Enable ArrayBufferExtensions by default. The
last CL (https://crrev.com/c/2078585) that tried to enable this was
reverted because of a TSAN failure. This was fixed in
https://crrev.com/c/2078586.

Bug: v8:10064
Change-Id: I2c3e0f2614323ea1521f2085b3c2bda5b69418ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2083012
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66521}
2020-03-02 10:54:05 +00:00
Jakob Gruber
d303f4fba9 [regexp] Always pass the isolate to CaseInsensitiveCompareUC16
In the past we've used the isolate argument to signal whether we were
in unicode mode (nullptr) or not (the real isolate). This is no longer
needed, and in fact breaks no-i18n mode which always expects to have a
real isolate.

Bug: v8:10120
Change-Id: I2f848c4ff8c2ff0e9b84278cbcdf3c3670e44e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081816
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66520}
2020-03-02 10:46:15 +00:00
Igor Sheludko
36b80bea19 [ptr-compr] Fix 32-bit smis on non-ptr-compr builds (rev 2)
Bug: v8:10047, v8:10257
Change-Id: Idf7f5e0faf6b8d41795bb362b2473392cdb6e73d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077682
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66519}
2020-03-02 10:45:05 +00:00
Victor Gomes
7750311321 [asm] Add StackArgumentsAccessor to ia32
This add StackArgumentsAccessor class to ia32, which slighty increases
abstraction when accessing arguments in the stack.

Bug: v8:10201
Change-Id: I4ee0323022d9334cb0b2af63a9c1f437eed9a079
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2073762
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66518}
2020-03-02 10:26:45 +00:00
Seth Brenith
5f5bcace28 [tools] include missing dep for v8_debug_helper
This fixes a build break in certain configurations. v8_debug_helper
depends on generate_bytecode_builtins_list via the following headers:

In file included from gen/v8/tools/debug_helper/heap-constants-gen.cc:5:
In file included from ../../v8\src/common/ptr-compr-inl.h:10:
In file included from ../../v8\src/execution/isolate.h:19:
In file included from ../../v8\src/builtins/builtins.h:9:

Change-Id: I38e5d851afc6ce52716d3e5e64ae9219df396bd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078768
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66517}
2020-03-02 10:22:15 +00:00
Leszek Swirski
84279bfcca [off-thread] Get rid of OffThreadHandle
Remove OffThreadHandle, HandleOrOffThreadHandle, and HandleFor, and
make the OffThreadIsolate allocate "real" Handles. Rather than using
the main-thread Isolate's handle scopes, these off-thread Handles are
backed by a Zone, which is tied to the lifetime of the nearest
OffThreadHandleScope. Eventually, we'll likely want to merge the
implementation of OffThreadHandleScope and HandleScope, but currently
the latter is too tightly coupled to the main thread to do so.

Bug: chromium:1011762
Change-Id: I2a6361931fe3f90a7bef4cc28ee42155fa8d062f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071865
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66516}
2020-03-02 09:42:15 +00:00
Dominik Inführ
ecc1508bc3 [objects] Update JSArrayBuffer::extension-field in two steps
The JSArrayBuffer::extension-field might not be aligned with pointer
compression enabled. However on AArch64 pointers need to be aligned if
you perform atomic operations on them. Therefore split extension into
two 32-bit words that each get updated atomically. There is no ABA
problem here since the extension field only transitions from
NULL --> value --> NULL. After Detach(), Attach() isn't invoked anymore.

Bug: v8:10064
Change-Id: I20c1a37ac35d1749a94bfd277a4f91d531015bc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078586
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66515}
2020-03-02 07:54:44 +00:00
v8-ci-autoroll-builder
af3d9ee9b4 Update V8 DEPS.
Rolling v8/build: 8c2d4f7..b03644a

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I5f62d5448e47c9b05c9f6cb9e8dd8973d5ea77f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2082005
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66514}
2020-03-02 03:57:13 +00:00
v8-ci-autoroll-builder
22a073ce6b Update V8 DEPS.
Rolling v8/third_party/depot_tools: 55ab41d..9ca9c52

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I133a199f46974bd3a283140d46b3475310eb17ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081992
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66513}
2020-03-01 04:01:52 +00:00
Mike Stanton
a4c14089b0 [Turbofan] Allow CallIC to be polymorphic for same SharedFunctionInfos
We can make better inlining decisions in TurboFan if the CallIC will
provide the feedback that it's seen multiple closures that share the
same SharedFunctionInfo. This is not difficult to do, and it fixes
some frustrating performance cliffs.

Thanks to Bmeurer@chromium.org for the prototype CL, rebased from his
project a year ago.

Bug: v8:2206, v8:10100
Change-Id: I4248145ea67216f9a23efa175bbe90e7a9ee0ec4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2054100
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66512}
2020-02-29 09:09:42 +00:00
v8-ci-autoroll-builder
fdbdb6a69d Update V8 DEPS.
Rolling v8/build: 0a67df9..8c2d4f7

Rolling v8/buildtools: ef2f1b3..fa6ae42

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/21c99c4..03a5e99

Rolling v8/third_party/depot_tools: 780e6bf..55ab41d

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ida3c1cada6c21ef0cd0fb12d7018947de675fb29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081454
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#66511}
2020-02-29 03:55:42 +00:00
Francis McCabe
7558e1821f Revert "Use context of then function for PromiseResolveThenableJob"
This reverts commit 9325397812.

Reason for revert: Causing blink layout failures. See 

https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux%20Future/2684

Original change's description:
> Use context of then function for PromiseResolveThenableJob
> 
> When a microtask is executed, we need to use an appropriate,
> non-detached Context for its execution. Currently with
> PromiseResolveThenableJobs [1], the Context used is always drawn from
> the realm of the Promise constructor being used. This may cause
> non-intuitive behavior, such as in the following case:
> 
>   const DeadPromise = iframe.contentWindow.Promise;
>   const p = DeadPromise.resolve({
>     then() {
>       return { success: true };
>     }
>   });
>   p.then(result => { console.log(result); });
> 
>   // Some time later, but synchronously...
>   iframe.src = "http://example.com"; // navigate away.
>   // DeadPromise's Context is detached state now.
>   // p never gets resolved, and its reaction handler never gets called.
> 
> To fix this behavior, when PromiseResolveThenableJob is being queued up,
> the `then` method of the thenable should be used to determine the
> context of the resultant microtask. Doing so aligns with Firefox, and
> also with the latest HTML spec [2][3].
> 
> This change is analogous to CL 1465902, which uses the realm of the
> reaction handlers to determine the Context PromiseReactionJobs run in.
> 
> [1]: https://tc39.es/ecma262/#sec-promiseresolvethenablejob
> [2]: https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
> [3]: https://github.com/whatwg/html/pull/5212
> 
> Bug: v8:10200
> Change-Id: I2312788eeea0f9e870c13cf3cb5730a87d15609e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071624
> Commit-Queue: Timothy Gu <timothygu@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66507}

TBR=verwaest@chromium.org,timothygu@chromium.org,syg@chromium.org

Change-Id: I81737750f8b369567ba586c5a2cfb489836b7e74
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10200
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2081091
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66510}
2020-02-29 00:45:12 +00:00
Johannes Henkel
2b4dd77925 [DevTools] Roll inspector_protocol (V8)
"Tweaks for emitting JSON"
https://chromium-review.googlesource.com/c/deps/inspector_protocol/+/2071518

Change-Id: Ie05ff1390a5340e15c21788c58e8171cb442da10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2073205
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66509}
2020-02-29 00:36:02 +00:00
Deepti Gandluri
c6f611be26 [wasm] Cleanup wasm opcode text
Change-Id: Iaf8e02b201c547fb8b74a7e7f2defd4bfbc098d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079049
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66508}
2020-02-28 22:55:22 +00:00
Timothy Gu
9325397812 Use context of then function for PromiseResolveThenableJob
When a microtask is executed, we need to use an appropriate,
non-detached Context for its execution. Currently with
PromiseResolveThenableJobs [1], the Context used is always drawn from
the realm of the Promise constructor being used. This may cause
non-intuitive behavior, such as in the following case:

  const DeadPromise = iframe.contentWindow.Promise;
  const p = DeadPromise.resolve({
    then() {
      return { success: true };
    }
  });
  p.then(result => { console.log(result); });

  // Some time later, but synchronously...
  iframe.src = "http://example.com"; // navigate away.
  // DeadPromise's Context is detached state now.
  // p never gets resolved, and its reaction handler never gets called.

To fix this behavior, when PromiseResolveThenableJob is being queued up,
the `then` method of the thenable should be used to determine the
context of the resultant microtask. Doing so aligns with Firefox, and
also with the latest HTML spec [2][3].

This change is analogous to CL 1465902, which uses the realm of the
reaction handlers to determine the Context PromiseReactionJobs run in.

[1]: https://tc39.es/ecma262/#sec-promiseresolvethenablejob
[2]: https://html.spec.whatwg.org/C/#enqueuejob(queuename,-job,-arguments)
[3]: https://github.com/whatwg/html/pull/5212

Bug: v8:10200
Change-Id: I2312788eeea0f9e870c13cf3cb5730a87d15609e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071624
Commit-Queue: Timothy Gu <timothygu@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66507}
2020-02-28 20:54:32 +00:00
Frank Tang
d5b444bc5a Add UsageCounters for misc Intl features
We need to track misc features launched in 2019 to understand the impact.
Also we need to measure the v8BreakIterator usage of 'word' and 'line'
to lobby the need for 'line' in the replacement standard Intl.Segmenter
which an Apple engineer opposed to include.

Bug: v8:10251
Change-Id: I5d4cbe6ccf458c9ec4adfebad235f9c6dcd2ac37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2067512
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66506}
2020-02-28 19:48:52 +00:00
Francis McCabe
b66e24f0b3 Revert "[runtime] Improve handling of enumeration index on global dictionary"
This reverts commit 25d16574f8.

Reason for revert: breaks tree with new flakes. See, for example:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/31169
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim/21895
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20isolates/8490


Original change's description:
> [runtime] Improve handling of enumeration index on global dictionary
> 
> Bug: chromium:1056054
> Change-Id: Ie1f2da98bc54a2ad5189cbe2ee1686fe1ef7019a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079035
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#66504}

TBR=jkummerow@chromium.org,verwaest@chromium.org,seth.brenith@microsoft.com,victorgomes@chromium.org

Change-Id: I2baa48f6ed2b0b3e23b0d705b6a805d76ee4bb8f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1056054
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080653
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66505}
2020-02-28 19:29:03 +00:00
Seth Brenith
25d16574f8 [runtime] Improve handling of enumeration index on global dictionary
Bug: chromium:1056054
Change-Id: Ie1f2da98bc54a2ad5189cbe2ee1686fe1ef7019a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079035
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#66504}
2020-02-28 17:43:02 +00:00
Seth Brenith
da900ffe5f Complete Torque definition of JSArrayBuffer
Previously, our Torque definition of JSArrayBuffer included only the
first two fields. This allowed access to those two fields, but was
somewhat confusing and obviously didn't let Torque code access the
other fields. This change:

- Completes the JSArrayBuffer layout definition;
- Moves the associated bitfield struct definition to Torque;
- Moves a couple of JSArrayBuffer macros to Torque;
- Adds a reducer case so that the code generated using these new macros
  is not worse than what was generated previously.

Change-Id: Ib19c3ba789a33801fa9d0d064cd21d62a1e03e30
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2053769
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66503}
2020-02-28 17:27:12 +00:00
Milad Farazmand
fb792f31ab PPC: [wasm] Update WasmCapiFunction offset
More instructions are being emitted with 242d58e
hence the offset needs to be updated.

Change-Id: I892920837ca7d785eb423503921ee39134be1c0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2079156
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#66502}
2020-02-28 15:54:25 +00:00
Ambroise Vincent
291b95f2a7 [turbofan] remove ArchLookupSwitch
The ArchLookupSwitch implementation has been completely replaced by
ArchBinarySearchSwitch, leaving dead code behind.

Change-Id: I7fd6306cb0f5562c10e32293f5ea13bbd3bf7067
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2077684
Commit-Queue: Rodolph Perfetta <rodolph.perfetta@arm.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66501}
2020-02-28 14:23:45 +00:00
Emanuel Ziegler
3caff4a0d6 [regexp] Fix crash due to unsetting NoRootArrayScope after free
This fixes a crash related to access after free on platforms that
store the MacroAssembler as a pointer. The intended behavior is
restored by explicitly setting the flag in the macro assembler
instead of using NoRootArrayScope.

Landing as TBR as it's blocking fuzzers and fix seems simple enough.

TBR=jgruber@chromium.org
R=jyan@ca.ibm.com
R=miladfar@ca.ibm.com

Bug: chromium:1057018
Change-Id: Ib6de82b47bb1abb74da58b3d476b359669372bb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080242
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66500}
2020-02-28 13:49:37 +00:00
Maya Lekova
cca9dd1012 [turbofan] Add bounds checks to fast API calls
The interface for ArgumentInfo was allowing out-of-bounds
read from the returned array. Improved that by passing the
index explicitly as a parameter and checking against the
expected bounds.

Bug: v8:10267
Change-Id: Ic1022def3e338598cd9bd9e6582d67a62836d0db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2078578
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66499}
2020-02-28 13:37:17 +00:00
Sathya Gunasekaran
9945e90829 Revert "[wasm] Refactor AtomicWait implementation"
This reverts commit 77d4e23047.

Reason for revert: verify csa build bot broken
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20verify%20csa/16218?

Original change's description:
> [wasm] Refactor AtomicWait implementation
> 
> The existing implementation included aspects that are not
> straight-forward to implement in Liftoff and seemed inefficient:
> * Convert the timeout in WebAssembly code from I64 to F64, just to
>   convert it back in the runtime.
>   * On 32-bit platforms this conversion needs an additional C-call.
> * Split the I64 expected value from I64 into two I32 values in the
>   wasm-compiler.
>   * Ideally the int64-lowering takes care of 32-bit specific handling.
> 
> With this CL the timeout and the expected value are passed as I64 to
> the runtime (a builtin moves the I64 into a bigint for that). The
> int64-lowering takes care of 32-bit platforms. There are special
> builtins for 32-bit platforms, but they are written such that ideally
> also the int64-lowering could create them.
> 
> R=​jkummerow@chromium.org, binji@chromium.org
> 
> Bug: v8:10108
> Change-Id: I2dbba5839779961b1c5bde4c23fc3f38f1895a52
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071867
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Ben Smith <binji@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#66497}

TBR=binji@chromium.org,jkummerow@chromium.org,ahaas@chromium.org,clemensb@chromium.org

Change-Id: If284aa07eedddd2fbea4df8c53c7d371cac1d42e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10108
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2080250
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66498}
2020-02-28 12:32:37 +00:00
Andreas Haas
77d4e23047 [wasm] Refactor AtomicWait implementation
The existing implementation included aspects that are not
straight-forward to implement in Liftoff and seemed inefficient:
* Convert the timeout in WebAssembly code from I64 to F64, just to
  convert it back in the runtime.
  * On 32-bit platforms this conversion needs an additional C-call.
* Split the I64 expected value from I64 into two I32 values in the
  wasm-compiler.
  * Ideally the int64-lowering takes care of 32-bit specific handling.

With this CL the timeout and the expected value are passed as I64 to
the runtime (a builtin moves the I64 into a bigint for that). The
int64-lowering takes care of 32-bit platforms. There are special
builtins for 32-bit platforms, but they are written such that ideally
also the int64-lowering could create them.

R=jkummerow@chromium.org, binji@chromium.org

Bug: v8:10108
Change-Id: I2dbba5839779961b1c5bde4c23fc3f38f1895a52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2071867
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#66497}
2020-02-28 12:25:47 +00:00