When kDontAdaptArgumentsSentinel is 0 (the receiver is included in the
argument count), we don't need a dedicated check against the sentinel
before comparing the formal parameter count to the actual argument count
when calling a JS function.
Bug: v8:11112
Change-Id: I8c9f64a538984cb3de9e35f16bc6adbd3c92d24f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173671
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76993}
We should cancel tasks before we destroy objects like the string table
from the isolate. So far our concurrent tasks didn't interact with
the isolate much, but we now have tasks that can e.g. access the heap
concurrently. While this is not strictly necessary at the moment, I want
to see whether there might be problems with that approach. In the future
this order will be required e.g. for baseline batch compilation tasks.
Bug: v8:11708
Change-Id: I80d8a9447bb51e9ae84ed9b6c0da6183290dc70b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3164338
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76989}
Liftoff is fully supported on all officially supported platforms, thus
remove a TODO to implement it on more platforms.
R=thibaudm@chromium.org
Bug: v8:11879
Change-Id: I00a559286d67e7e377a36b68803ee30e8fa2f34e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168341
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76987}
Add support for heap sandbox on arm64 when building with v8_enable_heap_sandbox=true
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Bug: v8:10391
Change-Id: I3080f5970d2a604ca67827c732cd77761f7611a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165057
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76986}
As the comment notes, we want to ensure that code space is *not*
writable by the current thread.
R=jkummerow@chromium.orgCC=mpdenton@chromium.org
Bug: v8:11974
Change-Id: I5c3cad32b8edc56013f298405c8e20d8bc9da05f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173675
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76985}
On Mac we handle SIGBUS, not SIGSEGV, so the test should access a valid
but inaccessible pointer to trigger the right signal.
R=jkummerow@chromium.org
Bug: v8:11955, v8:12249
Change-Id: I25b93ce40bccc24ef5e84694a7c03c465eb4c51e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168344
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76984}
Rolling v8/build: 1037128..66bad00
Rolling v8/third_party/aemu-linux-x64: bOp0PE8R9VUQxsHclvuA10P4iOaWjRRpsK8ZQKtAZCAC..UnrNXrNKJtnUOqrH_BbjXgZ_Ns1v0PZ9WNtFgoHrQZwC
Rolling v8/third_party/android_sdk/public: yODElY4RdHopNEfpOnqjRcrpa6JMzbhYYqGD53-DjJwC..AuYa11pULKT8AI14_owabJrkZoRGuovL-nvwmiONlYEC
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8ec776f..25814bb
Rolling v8/third_party/depot_tools: c1fd44b..eff810e
Rolling v8/tools/clang: 7ea32d7..948efd2TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
Change-Id: I9bc3a48c310c9364a3cd2e24e1fdc6fcd5e6d934
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172719
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76979}
DISALLOW_COPY_AND_ASSIGN is no longer in our codebase, and the compilers
mentioned in the comments are (probably) no longer supported.
Bug: v8:12244
Change-Id: I432bd56ca3ddd870be140032f11d94ddb60ce1a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171974
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76977}
Add another "#if V8_ENABLE_WEBASSEMBLY" block to fix compilation if wasm
is disabled.
TBR=jkummerow@chromium.org
Bug: v8:11974
Change-Id: If889814e16dfb51d5b78122e6957bb2c41cefe5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172758
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76975}
Drive-by edit to use ASM_CODE_COMMENT for better code comments for
all the more complicated macro-assembler functions.
Also undef macros (AVX_OP et al) since they are not longer used outside
of shared-macro-assembler.
Bug: v8:11589
Change-Id: I424f27b5b742a8efb26ccef87dbffb01eae60335
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3173892
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76973}
Previously it generates a mvoq+pinsrq, now it generates a single
punpcklqdq.
punpcklqdq is smaller in code size, and also faster on most arch (latency
1, rthroughput of 1, 1 uop, uses 1 port) than pinsrq (latency 2, 2 uop,
uses 2 port) (from https://uops.info/table.html)
punpcklqdq is mean to work on int domain, and although we can't be
certain what v128.const will be used for, the movq is considered
an integer domain instruction, so we can avoid unnecessary transitions
by using punpcklqdq (instead of movddup, which is similar in perf
and code size).
Bug: v8:11033
Change-Id: Iab81168ffad84488b90ff307d440bed15c9f90a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3169322
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76972}
We move some instructions from the test that just disassembles them, to
the test that checks for expected output.
Bug: v8:12207
Change-Id: Ide8954e36c6ad016150bfe45abc1717bed55eb19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171972
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76970}
This CL exposes the size of the virtual memory cage to the embedder
through V8::GetVirtualMemoryCageSizeInBytes(). This will for example be
useful to collect metrics about the cage reservation, such as how
frequently it fails, in the future. While collecting these metrics
directly in V8 would also be possible, it would require access to an
Isolate, which is not yet available when the cage is initialized. As
such, it is easier to enable the embedder to collect these metrics.
Bug: chromium:1218005
Change-Id: Ie9c9ca7d1cd158ec024be6ab2418f50083b06d6e
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172762
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76969}
Port 06af754cea
Original Message:
.. for more efficient access to builtins from generated code.
Root-relative accesses tend to be faster and produce more compact
code when the root-relative offset is small. IsolateData contains
a few large tables (roots, external references, builtins), resulting
in very large offsets in general.
This CL starts by splitting the builtin table into tiers: tier 0
is a minimal set of perf-critical builtins that should be cheap to
access. The offset to tier 0 builtins is guaranteed to be small.
The full builtin table also remains in IsolateData for occasions in
which we need to lookup builtins by index.
In future work, we can also split external references and roots into
tiers.
On x64, this reduces deopt exit sizes from 7 to 4 bytes and from 12
to 9 bytes (dynamic map checks / EagerWithResume deopts).
Change-Id: I021d60b20b783da170987ffcf0327b93206f7e5d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172917
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76967}
The shipping version was incorrect in the original CL.
R=ecmziegler@chromium.org
Bug: v8:7581
Change-Id: Ib382cdacb8f6aa80718e6917b535c026b83d88cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172766
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76966}
The function index encoded into the serialized module is already offset
by num_imported_functions. For lazy compilation, however, we added the
number of imported functions another time, which was incorrect.
R=clemensb@chromium.org
Change-Id: I56380e21e74b4d1935ebdbab6ef8cc388de49f2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172761
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76965}
Conditions are usually used in binary comparisons, and are named for
that purpose. When used in a unary comparison, {kEqual} means "equal to
zero" and {kUnequal} means "not equal to zero". This is noted in several
comments in {LiftoffCompiler}.
This CL introduces the alternative names {kEqualZero} and
{kNotEqualZero} to avoid the repeated comments and increase readability.
R=thibaudm@chromium.org
Bug: v8:12244
Change-Id: I720a3d91ea95a26a38a48c68161f1b0552937cd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172763
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76964}
Most call signatures are small enough to keep them on the stack. This CL
adds a little optimization to avoid two Zone allocations for such small
signatures (and one in the general case).
R=thibaudm@chromium.org
Change-Id: I20ea7b77bfe8f1c86f8aa66450baa3561d564de1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168279
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76958}
The fix is released now, so we can add the tests to the public repo.
R=ahaas@chromium.org
Bug: chromium:1239116
Change-Id: Ie1489f6bcd934f84222b4631921475c389f778dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3172752
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76957}
Use <iosfwd> where possible, in particular in public headers
(include/v8-*.h).
R=cbruni@chromium.org
Bug: v8:11879
Change-Id: I9d6095e6385229763d667f5064a794d67952b2b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160517
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76956}
This CL sets the prototype for the other WebAssembly API objects,
Module, Instance, Table, and Memory.
For Instance, the WebAssemblyInstanceImpl function got inlined, as
there was only one caller, and it made setting the prototype
complicated.
R=jkummerow@chromium.org
Bug: v8:12227
Change-Id: I93b459d69b917b099b27f957fb0e04b7e021bd59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168282
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76954}
This adds a few DCHECKs to ensure that the process-wide memory
protection key is not writable (per thread) in a few strategic places:
- Before switching it to writable (which implicitly checks the initial
state),
- when entering compiled code, and
- in the explicit unit test.
R=jkummerow@chromium.orgCC=mpdenton@chromium.org
Bug: v8:11974
Change-Id: I6037f599afe9009d5e48794eb382eb1979f3ce9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3165060
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76953}
It didn't take the recently added
--stress-concurrent-inlining-attach-code feature into account.
Bug: chromium:1250547
Change-Id: I657b030308158353b72b9b38db7909a1e4190b6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171153
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76952}
Rolling v8/build: ae8cb5d..1037128
Rolling v8/third_party/abseil-cpp: 6569bfc..48418f3
Rolling v8/third_party/android_sdk/public: ZT3JmI6GMG4YVcZ1OtECRVMOLLJAWAdPbi-OclubJLMC..yODElY4RdHopNEfpOnqjRcrpa6JMzbhYYqGD53-DjJwC
Rolling v8/third_party/android_sdk/public: qi_k82nm6j9nz4dQosOoqXew4_TFAy8rcGOHDLptx1sC..g7n_-r6yJd_SGRklujGB1wEt8iyr77FZTUJVS9w6O34C
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fa2350f..fb69904
Rolling v8/third_party/depot_tools: cf9d643..6550ec9
Rolling v8/tools/clang: 6f44cf5..7ea32d7TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com
Change-Id: Id62cd6c728dcc4bfc422632afdf47cef3db2bee1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171717
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76949}
At least for the initial rollout, we will gracefully handle cage
reservation failures by shrinking the size of the cage until the
reservation succeeds or the size drops below the mimimum cage size. This
will allow collecting statistics on how often cage reservation failures
occur in practice for different cage sizes, which will in turn influence
the decision on how to handle them in the future.
Bug: chromium:1218005
Change-Id: Ica58951ba51ac01bc2c387b34dfc8d9051ed4d75
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168347
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76948}
.. for more efficient access to builtins from generated code.
Root-relative accesses tend to be faster and produce more compact
code when the root-relative offset is small. IsolateData contains
a few large tables (roots, external references, builtins), resulting
in very large offsets in general.
This CL starts by splitting the builtin table into tiers: tier 0
is a minimal set of perf-critical builtins that should be cheap to
access. The offset to tier 0 builtins is guaranteed to be small.
The full builtin table also remains in IsolateData for occasions in
which we need to lookup builtins by index.
In future work, we can also split external references and roots into
tiers.
On x64, this reduces deopt exit sizes from 7 to 4 bytes and from 12
to 9 bytes (dynamic map checks / EagerWithResume deopts).
Bug: v8:12203,v8:8661
Change-Id: I5a9ed22b0e00682aca1abcf15892ae1458dbdd70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162142
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76947}
This is a reland of 5dde281c87,
after also fixing the ic-migrated-... test, in which an object died
too early.
Original change's description:
> [compiler] Fix a few test flakes and reenable the tests
>
> Bug: v8:12173
> Change-Id: I2983be9133f8ff4d1740e8eba05a3c29d603dfc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168270
> Auto-Submit: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76939}
Bug: v8:12173
Change-Id: If385e5c826b8470ef67f12705c5171f330f6cd57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171353
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76946}
When dst != lhs, we moved lhs to dst, but dst can be == rhs, so we would
overwrite rhs, and end up comparing lhs with itself, always returning
false. We handle the different aliasing cases in the macro-assembler
function I64x2GtS, to simplify the checks in Liftoff a little bit.
TurboFan does not need to change as it will require dst == lhs when AVX
is not supported.
Bug: v8:12237
Change-Id: Icefa6eb79083c003e93dbbd11ccc419aae4b15d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3169312
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76945}
