This is a reland of 9b1e174f85c42d6efd5481e9153dbf593e2b3f1e\
Reverted for a test failure that was unrelated to this CL. It was fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/1845223.
Original change's description:
> [ptr-compr] Storing a Tagged value stores the lower 32 bits
>
> This CL changes the Tagged stores when pointer compression is enabled.
> It shouldn't affect anything for the time being since if we have pointer
> compression enabled, we are going to be storing Compressed values. Later,
> we will eliminate the Compressed representation and that it's where it
> will come into effect.
>
> The Arm64 side of the CL looks bigger since we eliminated the opcode in
> https://chromium-review.googlesource.com/c/v8/v8/+/1803345.
>
> Bug: v8:7703
> Change-Id: Ic4afbff9646b5d058adb9619b20ccccb3f5aed45
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1822044
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64133}
Bug: v8:7703
Change-Id: I7775e90c36f180adb0484b22eaf3918d9c012b77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1845219
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64156}
Left-shifting a variable of signed type containing a negative value is
undefined behavior.
Bug: chromium:1010465,v8:9330
Change-Id: Ide524f87a7d76f906f6034de4c6605df150c66a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1847151
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64154}
The test creates 10000 modules, which runs in less then one second in
release builds, but can take much longer with stress flags and on
special bots.
It timed out on the tsan isolates bot in a variant passing
--stress-wasm-code-gc.
Since the test should only verify that we support more than 1000
modules in a single isolate, we do not need to run it in that variant.
Thus just skip it.
R=fgm@chromium.org
Bug: v8:9814
Change-Id: Ie3a4f62a053b1f7cff2c2206f39ddd71a533ae3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1845229
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64153}
TracedGlobalTrait was unable to override v8::TracedGlobal<v8::Object> for
avoiding the destructor because it is needed on the API surface itself and C++
ODR which prohibits specialization after template instantiation.
Avoid this problem by providing a separate type TracedReference
that, similar to TracedGlobal, is purely traced but avoids the destructor
completely. This only works for embedders that have their memory management
tied to V8 as it is prone to accessing already reclaimed objects otherwise.
Bug: chromium:995684
Change-Id: Iab4332ed417b26c58638a8f9389174cc355a305b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1840972
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64150}
Remove test expectations whose behavior is not specified or contradicts
the Stage 3 PR https://github.com/tc39/ecma402/pull/349 which we plan
to land soon.
The Chinese calendar (and other calendars) now need to choose
different patterns for non-default calendars to support the correct
behavior.
Bug: v8:9320
Change-Id: Ia84e0eb1f7244b0d2d252071cf985d97f2acec58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1838437
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64149}
For this, all Torque stub-linkage builtins use TFC instead of TFS,
with a custom descriptor added to interface-descriptors.h
To avoid having complex logic in the generated code, the new class
TorqueInterfaceDescriptor contains the logic to create a
CallInterfaceDescriptor from a signature consisting of TNode types.
As an example and test, this CL ports StringCharAt to Torque.
Bug: v8:7793
Change-Id: I8339d2ad6e4f908ebdc3b8d30244e4bcbd974f21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1798427
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64148}
With the smi-corrupting decompression approach we don't have to sign
extend Smis anymore and therefore we can switch to zero extending
approach by moving the isolate root to the beginning of the reserved
4Gb region.
Bug: v8:9706
Change-Id: Icd6008fa87d0924519b574fdec445976f742e306
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835548
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64144}
Just mechanical conversion to remove boilerplate code. When .tq and .h
files didn't agree on what a field is named, I used the name from the .h
file. In a couple of cases the generated accessor became slightly more
specific (HeapObject instead of Object), and I had to update the code
that uses those accessors accordingly.
Change-Id: Ie3af1590e3889887b167c9d045b07860b01f7d15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776479
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#64142}
Disable because it's not yet supported on BE
Bug: v8:9330
Change-Id: Ia850801d410d3eeaccf9933dd2669f6077e2919c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1834904
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64141}
TypedSlotSet is only recorded for code pages. Code pages are not swept
concurrently to the application, so pre-freeing is not needed for typed
slot sets anymore.
Also replaces the manually allocated buffer with a regular std::vector.
Bug: v8:9454
Change-Id: I901851ad8b525c1653c9818e6599308319aeade2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1844773
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64140}
This reverts commit 9b1e174f85.
Reason for revert: Breaks arm64 sim debug build - https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/17609
Original change's description:
> [ptr-compr] Storing a Tagged value stores the lower 32 bits
>
> This CL changes the Tagged stores when pointer compression is enabled.
> It shouldn't affect anything for the time being since if we have pointer
> compression enabled, we are going to be storing Compressed values. Later,
> we will eliminate the Compressed representation and that it's where it
> will come into effect.
>
> The Arm64 side of the CL looks bigger since we eliminated the opcode in
> https://chromium-review.googlesource.com/c/v8/v8/+/1803345.
>
> Bug: v8:7703
> Change-Id: Ic4afbff9646b5d058adb9619b20ccccb3f5aed45
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1822044
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64133}
TBR=neis@chromium.org,jgruber@chromium.org,solanes@chromium.org
Change-Id: I901f0802b40144492594f293657f7f2b58dc32cf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1845217
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64139}
It was disabled because it didn't use to work, but it does now, see bugs.
Bug: chromium:803591, v8:9736
Change-Id: I53a04199f001b436bd5a247b51cd7c25e3a6e990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1844776
Commit-Queue: Hans Wennborg <hans@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Hans Wennborg <hans@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64138}
Some of the methods in {WasmCodeAllocator} can be called either without
holding the lock, or while already holding it. In order to support both
situations, we used a {RecursiveMutex} so far.
This CL refactors this to be a simple {Mutex} again, and passes a
{WasmCodeAllocator::OptionalLock} object which stores whether the lock
is already held or not.
Note that getting the lock twice fails immediately in debug builds,
while forgetting to get the lock might only fail on TSan.
The alternative would be to duplicate all methods, having one variant
that expects that the lock is held and one that assume that it's
unlocked. It would be multiple methods though to duplicate across both
{NativeModule} and {WasmCodeAllocator}, hence I went for the
{OptionalLock} instead.
Bug: v8:9477
R=mstarzinger@chromium.org
Change-Id: I4e32286cdb93385ac655d408191b330efdd7ad66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1825338
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64137}
Found while testing with asan.
Change-Id: I82529422770653535aae148a4acc6089c5a4fee7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1844786
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#64136}
This CL changes the Tagged stores when pointer compression is enabled.
It shouldn't affect anything for the time being since if we have pointer
compression enabled, we are going to be storing Compressed values. Later,
we will eliminate the Compressed representation and that it's where it
will come into effect.
The Arm64 side of the CL looks bigger since we eliminated the opcode in
https://chromium-review.googlesource.com/c/v8/v8/+/1803345.
Bug: v8:7703
Change-Id: Ic4afbff9646b5d058adb9619b20ccccb3f5aed45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1822044
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64133}
... and make sure that the arm64 ptr-compr bots proceed testing V8 without
pointer compression in order to keep testing the other config.
Bug: v8:7703
Change-Id: I0017345273d5328d95a338064dd80b44974c1c53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1844780
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64132}
This CL fixes the overlap check by using {<=} instead of {<}. This
allows us to always use {std::copy_n}, which should fall back to
{memcpy} internally (instead of the potentially slower {memmove} we
were using before).
This might also fix the regressions seen mostly on atom CPUs.
R=leszeks@chromium.org
Bug: chromium:1006157
Change-Id: Ib61048d65e99a9e7edac5ed894ceaf9e26ad4409
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1844781
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64131}
Removes CodeStubAssembler::GotoIfDebugExecutionModeChecksSideEffects and
associated test as well as the PerformSideEffectCheckForObject runtime
function.
Bug: v8:9396
Change-Id: Id7748be8fbf1d633f759fef8751ddca13a21748c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1824937
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64130}
The {GetNearRuntimeStubEntry} and {GetNearCallTargetForFunction}
functions need to find the code space that contains the current
function. This lookup requires a lock and is non-trivial. The repeated
lookup caused severe regressions.
This CL introduces a {JumpTablesRef} struct which holds information
about the jump tables to use. It can be looked up once and then used
for a whole function or even several functions within the same code
space (in {NativeModule::AddCompiledCode} which adds a whole vector of
compilation results).
This fixes the regressions.
R=ahaas@chromium.org
Bug: chromium:1004262, v8:9477
Change-Id: I50bd8327a131e3bee79d86b6d7e867a506959312
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1840153
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64129}
Placing these tests in anonymous namespaces, is the suggested fix
according to the GCC documentation.
The GCC documentation states: "If a type A depends on a type B with no or
internal linkage, defining it in multiple translation units would be an
ODR violation because the meaning of B is different in each translation unit.
If A only appears in a single translation unit, the best way to silence the
warning is to give it internal linkage by putting it in an anonymous namespace as well."
Change-Id: I69a1e9b5f1789e9a7a62c762cd499809a72e0ea5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1836255
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64128}
Because of a GCC bug we needed to use a functor instead of a constexpr
function. Since we do not support gcc before version 5 any more, this
can be cleaned up now.
R=jkummerow@chromium.org
Bug: v8:9396
Change-Id: I848c5a25e1d5fa44a1497b06826f9a59b93ed695
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835543
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64127}
This CL removes the StoreBuffer and inserts slots into the
RememberedSet directly from within the RecordWrite builtin. Only calls
into C code when either the SlotSet-array or the bucket is not
allocated. This avoids filling the store buffer up with duplicates or
due to a write-heavy workload and then blocking the main thread on
store buffer processing.
The first CL (https://crrev.com/c/1815241) got reverted, because
mksnapshot was using a different size for SlotSet than the final
binary on ARM. This is fixed now, SlotSet has a standard layout.
Bug: v8:9454
Change-Id: I881641f4ee08a8b42c36fdca8733138b908096bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1842452
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64126}
This adds a fake toolchain for pointer compression, used for
correctness fuzzing. The toolchain enables us to have an extra build
with inverse pointer-compression defaults side-by-side.
The extra build is used similarly to existing x64/x86 comparisons,
except that we now compare builds with different compile-time flags.
Change-Id: I75491371262204b86eaa006ca8d04848f49121ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1829275
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64123}
The entries test262_variants and test262 are now equal after previous changes.
This switches all to test262 to prepare removing the former.
Bug: v8:9791
Change-Id: I677ea36798556e1aeed8bc11c3272804141e1eb8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835539
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64122}
We reuse PACKED_OP_LIST to generate *pd instructions. Introduce a new pd
base method, similar to ps and vps.
Bug: v8:9396
Change-Id: Id9d81c22c9110935484fd929ef7bf5cc20e9ae7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1834767
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64117}
... in order to improve performance of decompression code on C++ side
(because computation of isolate root from isolate pointer becomes a trivial
reinterpret cast) and measure the impact separately from other ptr-compr
changes.
Bug: v8:9353
Change-Id: I36906cef2968355411ee944d97625ecd2652646b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835550
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64115}
Now that sweeping uses its own RememberedSet, pre-freeing of empty
buckets is not necessary anymore. Mutator inserts into a different
remembered set, than the sweeper removes slots from.
Bug: v8:9454
Change-Id: I65d046926aa82aeb9eca7694e6a7eff1331d7e01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835547
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64114}
It was on JSGlobalProxyRef but in reality the property cells exist in
the global object, not in the global proxy.
Bug: v8:7790
Change-Id: Ia7bd5731c730db09602a1aec61b64b1355abf6a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1841352
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64112}
This is a reland of b271ea3c94
The failing arm64 disasm poison test was fixed.
Original change's description:
> [ptr-compr] Disable double fields unboxing
>
> Double field unboxing optimization is incompatible with pointer compression so
> we land this CL before enabling pointer compression in order to separate memory
> and performance regressions caused by disabled double field unboxing from
> pointer compression change.
>
> Bug: v8:9799
> Change-Id: Ic8118356496a3f351344215b409f9722de6c9355
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835546
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64089}
Tbr: verwaest@chromium.org
Cq-Include-Trybots: luci.v8.try:v8_linux_arm64_dbg
Bug: v8:9799
Change-Id: Ib7c126d70859537c3d0bce54a49f23909c14a6ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1840411
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64111}
Reorders the Smi check and the empty OptimizationMarker check as the
latter implies the first and means there is now just a single comparison
on the fast path.
Bug: v8:9771
Change-Id: Ibba1f322944b17186842983e227684b301ed5f31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1833683
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64110}
A slow dcheck can verify that hints are equal for the same
SharedFunctionInfo+FeedbackVector combo.
Bug: v8:7790
Change-Id: I43dcacf19c857770b609d13c310835a873c814fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835952
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64109}
Recursively serialize arguments to higher-order functions if
appropriate. This should recover all or most of the Deltablue
regression with --concurrent-inlining. It is also a prerequisite to
allowing speculation in the call reducer for these situations.
Bug: v8:7790, v8:9702
Change-Id: I1ac8ac8b8e4dc0f2e19c89aacfb45d18f2df190f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835541
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64108}
... as the smi-corrupting decompression seems to be stable enough.
Bug: v8:9706
Change-Id: I404924ec4a12b37d8bc3e521c5563aa7e6357dc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1835544
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64107}
