Commit Graph

26395 Commits

Author SHA1 Message Date
Marja Hölttä
0147db5a4a [super] Optimize super property access in JSNativeContextSpecialization
Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70988}
2020-11-05 13:58:11 +00:00
Clemens Backes
ff2993bb45 [inspector][test] Exit properly on internal errors
Calling {Exit} does not stop execution in the current thread (or
process), it just tells the two task runners to stop. Hence following
code would still be executed.
This CL replaces the calls to {Exit} to {FATAL} for internal errors
where we want to stop immediately.

R=szuend@chromium.org

Bug: chromium:1142437
Change-Id: I70c1c39da28a3cd040214d46eddf61f05a12bce7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2519568
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70984}
2020-11-05 10:34:11 +00:00
Jakob Gruber
2dc1799585 Revert "[nci] Enable --turbo-nci behind --future to gather perf data"
This reverts commit c3b2b64be4.

Reason for revert: Scheduled revert.

The flag flip is in 88.0.4315.0. Group report links:

https://chromeperf.appspot.com/group_report?rev=70949
https://chromeperf.appspot.com/group_report?rev=823663

Original change's description:
> [nci] Enable --turbo-nci behind --future to gather perf data
>
> .. to be reverted in a day or two.
>
> Bug: v8:8888
> Change-Id: Iee156da614b50c351ca9a07cc497177c92de865d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512907
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70949}

TBR=machenbach@chromium.org,jgruber@chromium.org,vahl@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8888,v8:11087
Change-Id: I57411474d885dd69613a85f5fa3a801a573fcd08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2517690
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70982}
2020-11-05 09:26:56 +00:00
Zhi An Ng
7d7b25d95c [wasm-simd][x64] Optimize integer splats of constant 0
Integer splats (especially for sizes < 32-bits) does not directly
translate to a single instruction on x64. We can do better for special
values, like 0, which can be lowered to `xor dst dst`. We do this check
in the instruction selector, and emit a special opcode kX64S128Zero.

Also change the xor operation for kX64S128Zero from xorps to pxor. This
can help reduce any potential data bypass delay (search for this on
agner's microarchitecture manual for more details.). Since integer
splats are likely to be followed by integer ops, we should remain in the
integer domain, thus use pxor.

For i64x2.splat the codegen goes from:

  xorl rdi,rdi
  vmovq xmm0,rdi
  vmovddup xmm0,xmm0

to:

  vpxor xmm0,xmm0,xmm0

Also add a unittest to verify this optimization, and necessary
raw-assembler methods for the test.

Bug: v8:11093
Change-Id: I26b092032b6e672f1d5d26e35d79578ebe591cfe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516299
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70977}
2020-11-05 01:56:30 +00:00
Devlin Cronin
2ccd4dc564 Introduce Function::FunctionProtoToString()
Add a new function on the public API to allow serializing a function to
a string using the built-in toString() implementation, allowing
serialization without worrying about untrusted author script overriding
the toString() implementation. This is similar in nature to
Object::ObjectProtoToString() (but that only returns "[object Function]"
for any passed function).

Add tests for the same.

Bug: chromium:1144841
Change-Id: Ie4c29b870034c0817c23bf91f9424f956098823d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2514768
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Devlin <rdevlin.cronin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70976}
2020-11-05 00:38:40 +00:00
Victor Gomes
f383a92396 Reland "[x64][ia32] Add stack overflow check in InvokePrologue"
This is a reland of adceb45979
Redesign test to not be OS dependent.

Original change's description:
> [x64][ia32] Add stack overflow check in InvokePrologue
>
> In case of no arguments adaptor frame, we massage the arguments in InvokePrologue pushing undefined objects if the actual argument count is below the parameter count. This CL adds a stack overflow check before pushing these undefined objects to the stack.
>
> Change-Id: I2a88bf6fdfd17958f6f6884143a67d50ea842fd2
> Bug: v8:10201
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491039
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70927}

Bug: v8:10201
Change-Id: Ifab3413b748cdf3bb998a5080cd1fcb3b67a737b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2517921
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70973}
2020-11-04 19:26:09 +00:00
Frank Tang
b0a7f56911 Update to ICU68-1
ICU68-1 change the output skeleton format. So we need to change
resolvedOptions code for 68 migration.

Chromium roll
https://chromium-review.googlesource.com/c/chromium/src/+/2474093

Bug: v8:10945
Change-Id: I3b2c7fbe8abb22df8fa51287c498ca3245b8c55b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2477431
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70972}
2020-11-04 19:14:59 +00:00
Victor Gomes
18d79f90cf [deoptimizer] Fix define typo and inlined frame base
Change-Id: I81ace5b6abf883c80bea1fada94a66888b16745a
Bug: chromium:1144672, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512923
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70971}
2020-11-04 18:39:04 +00:00
Daniel Vogelheim
543e5633af [api] TC39 Dynamic Code Brand checks - rename for consistency.
Rename-only CL: Rename "code kind" to "code like".

The reason is CL feedback when using this feature, and a desire for
consistency across V8 + Blink. An additional benefit would be to
disambiguate from the v8::internal::CodeKind type, which is unrelated to
any of this.

Original CL: crrev.com/c/v8/v8/+/2339618
CL whose review prompted this change: crrev.com/c/2340905

Bug: chromium:1096017
Change-Id: Id59016fc2906ab6cd1414e598338b3963811b92f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509598
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70970}
2020-11-04 16:35:21 +00:00
Camillo Bruni
a8eea87933 [tools] Port more tools to ES6 classes
Convert Profile, CodeMap and their helpers to ES6 classes.
Code cleanup will happen in a separate step.

Bug: v8:10667
Change-Id: Icfb28f6d9ef7f00efba93b347fdf210a9af36a49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509591
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70969}
2020-11-04 14:45:41 +00:00
Camillo Bruni
5ce10a0b5e [api] Add updated ScriptCompiler::StartStreaming API
The new api removes the unused CompileOptions argument.

Change-Id: Ie3c48cda5247da9ce87d70a90b7ab9c43d5e8e37
Bug: chromium:1061857
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498698
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70965}
2020-11-04 12:38:46 +00:00
Jakob Gruber
0593cb7218 [regexp] Don't recognize the 'l' flag unless enabled
.. by the runtime flag --enable-experimental-regexp-engine.

Introduced in https://chromium-review.googlesource.com/c/v8/v8/+/2461244

Tbr: neis@chromium.org
Bug: v8:10765
Change-Id: Ic32464ced7e5ddb4c31fe165eddb6b9d19260efc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516920
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70963}
2020-11-04 12:36:36 +00:00
Mike Stanton
1ef2936adf [TurboFan] Concurrency test needs to accept that worker thread exits
Timeouts occurred in test-concurrent-feedback-vector/CheckLoadICStates
because the main thread could enter "handshaking" mode precisely at
the moment when the worker thread successfully saw all states.
The main thread would miss this, and end up waiting forever on
a signal from the worker thread.

Bug: v8:11082
Change-Id: I0441785d908c5e27562a3620bb2195483727f118
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2519553
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70962}
2020-11-04 12:35:31 +00:00
Shu-yu Guo
e1fd3f6916 [flags] Remove --harmony-promise-all-settled
It's shipped since M76.

Bug: v8:9060
Change-Id: Ifb107f3ef77ab803d5c0ce34f0a31ac33088c41a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2510610
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70956}
2020-11-03 19:34:42 +00:00
Shu-yu Guo
5a03fbeba4 [flags] Remove --harmony-namespace-exports
It's shipped since M72.

Bug: v8:8101
Change-Id: I80856b9e1acfb6e434f20b6174e864f8c4e2896a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509945
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70955}
2020-11-03 18:51:32 +00:00
Shu-yu Guo
a5e33a57d7 [flags] Remove --harmony-import-meta
It's shipped since M64.

Bug: v8:6693
Change-Id: Ifc547c0036dd7e5f7bab9bcb169abee0157f73b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509943
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70954}
2020-11-03 18:05:52 +00:00
Shu-yu Guo
49dc0e311a [flags] Remove --harmony-dynamic-import
It's shipped since M63.

Bug: v8:5785
Change-Id: Iaa591890edc560bc58b7a6b18ad5787d747f1ba4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509942
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70953}
2020-11-03 17:11:52 +00:00
Etienne Pierre-doray
b6d1fc1669 [test] Fix platform lifetime in test-streaming-compilation
Currently MockPlatform has shorter lifetime than the isolate that uses
it. Creating isolate before MockPlatform leads to races in concurrent
tasks that were scheduled before the MockPlatform replaced the default
TestPlatform. This caused issues after landing
https://chromium-review.googlesource.com/c/v8/v8/+/2502808

This CL ensures that MockPlatform is valid throughout the whole
lifetime of the isolate

Change-Id: Ia888fba93819ea98b935a1d36307d98dd358fcad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507379
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70950}
2020-11-03 15:06:26 +00:00
Jakob Gruber
c3b2b64be4 [nci] Enable --turbo-nci behind --future to gather perf data
.. to be reverted in a day or two.

Bug: v8:8888
Change-Id: Iee156da614b50c351ca9a07cc497177c92de865d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512907
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Lutz Vahl <vahl@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70949}
2020-11-03 14:52:07 +00:00
Andreas Haas
4c2fd721d6 [wasm][interpreter] Check for shared memory in atomic.wait
For atomic.wait we have to check in generated code if the memory is
shared. If not, the code has to trap. In compiled code, this is done in
the runtime function. In the interpreter, however, this check was
missing. This CL adds the check to the interpreter.

R=thibaudm@chromium.org

Bug: chromium:1144603
Change-Id: If897e3f10b404ff677341ee14ad9eda7f5e64d16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512922
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70948}
2020-11-03 13:21:26 +00:00
Dominik Inführ
70a1de97c6 [heap] Fix flaky test failure in concurrent allocation
Concurrent allocation test was failing flakily. Do not fix this simply
by increasing heap size since this would reduce frequency of GCs.
Instead allow allocations to fail. Even in this case the allocation
code path is still executed which we want to test.

Bug: v8:11084, v8:10315
Change-Id: I0daa9ad9177aab8b02b7decf2ccfd50e0d8ab9b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2516471
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70946}
2020-11-03 12:48:16 +00:00
Jakob Gruber
19463165f7 [feedback] Minor name and type changes
Minor refactors to improve readability and consistency between
FeedbackVectorSpec and FeedbackMetadata:

- Rename FeedbackVectorSpec::slots to slot_count.
- Rename FeedbackVectorSpec::closure_feedback_cells to
  create_closure_slot_count, likewise all related fields.
- Store FeedbackVectorSpec::slot_kinds_ as an array of
  FeedbackSlotKind.

Bug: v8:8888
Change-Id: I3a45177163d1484b1625de8dfba5c6c05cfc426d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512908
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70943}
2020-11-03 11:50:29 +00:00
Sathya Gunasekaran
df7a86c3bf Revert "GetCurrentStackPosition() -> base::Stack::GetCurrentStackPosition()"
This reverts commit 8156dd85fc.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20ASAN/15800/overview

Original change's description:
> GetCurrentStackPosition() -> base::Stack::GetCurrentStackPosition()
>
> Remove the duplicate utility function and use the base::Stack
> equivalent instead which provides more stack utilitiy functionality.
>
> Change-Id: Ia7a79f2530b64ceb6e2ce33445c876980b4b2a3d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509595
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70930}

TBR=mlippautz@chromium.org,clemensb@chromium.org,verwaest@chromium.org

Change-Id: Id18949a3c82171e74370e729cd303607d46c8805
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2515431
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70940}
2020-11-03 09:42:42 +00:00
Zhi An Ng
71733d2891 [wasm-simd] Clean up test-run-wasm-simd
IWYU some headers, remove/inline helpers that were only used once.

Bug: v8:11074
Change-Id: I3e3d7e22b56e77076f1a2faac07ca727fb6e4f46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2513871
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70931}
2020-11-03 00:18:28 +00:00
Michael Lippautz
8156dd85fc GetCurrentStackPosition() -> base::Stack::GetCurrentStackPosition()
Remove the duplicate utility function and use the base::Stack
equivalent instead which provides more stack utilitiy functionality.

Change-Id: Ia7a79f2530b64ceb6e2ce33445c876980b4b2a3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509595
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70930}
2020-11-02 20:27:38 +00:00
Victor Gomes
5d122bdc59 Revert "[x64][ia32] Add stack overflow check in InvokePrologue"
This reverts commit adceb45979.

Reason for revert:
- ConcurrentAllocationInLargeSpace fails in verify CSA bot: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20verify%20csa/20547
- New test fail on Windows bot: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/29622

Original change's description:
> [x64][ia32] Add stack overflow check in InvokePrologue
>
> In case of no arguments adaptor frame, we massage the arguments in InvokePrologue pushing undefined objects if the actual argument count is below the parameter count. This CL adds a stack overflow check before pushing these undefined objects to the stack.
>
> Change-Id: I2a88bf6fdfd17958f6f6884143a67d50ea842fd2
> Bug: v8:10201
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491039
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70927}

TBR=neis@chromium.org,ishell@chromium.org,victorgomes@chromium.org

Change-Id: I7371e1603659ce512a39c0c0a8bb01baf7b916e0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2514505
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70928}
2020-11-02 18:10:50 +00:00
Victor Gomes
adceb45979 [x64][ia32] Add stack overflow check in InvokePrologue
In case of no arguments adaptor frame, we massage the arguments in InvokePrologue pushing undefined objects if the actual argument count is below the parameter count. This CL adds a stack overflow check before pushing these undefined objects to the stack.

Change-Id: I2a88bf6fdfd17958f6f6884143a67d50ea842fd2
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491039
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70927}
2020-11-02 17:18:28 +00:00
Vasili Skurydzin
f9bbde868e Adding myself to relevant OWNERS files.
Change-Id: I14941fcc34773791a86c6fb250237279641fd690
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2510070
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Michael Dawson <midawson@redhat.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70924}
2020-11-02 16:37:28 +00:00
Clemens Backes
cf3a842edb [inspector][fuzzer] Add inspector fuzzer
This adds a first simple version of the inspector fuzzer, which is a
stripped-down version of the inspector-test executable. The fuzzer
generates inputs which are compatible with inspector-test.

There are still memory leaks, and the fuzzer will probably run into
timeouts most of the time. Both of this will be addressed in follow-ups.

R=szuend@chromium.org, machenbach@chromium.org

Bug: chromium:1142437
Change-Id: I4d13da460f571d791a3642b0705a1f07b442c11b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505722
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70922}
2020-11-02 14:29:08 +00:00
Clemens Backes
a52cd8a541 [inspector][fuzzer] Extract more functionality for reuse
This also extracts the {FrontendChannelImpl}, the {SetTimeoutTask}, and
the {SetTimeoutExtension} for reuse by the inspector fuzzer.

R=szuend@chromium.org

Bug: chromium:1142437
Change-Id: I75e49d6fbb4b801ace1ffc9cac963d6b83c52f36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505717
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70909}
2020-11-02 09:07:00 +00:00
Zhi An Ng
19a3c291eb [arm] Add missing disasm and test for vld1r
Bug: v8:11038
Change-Id: Ifb50d8667b03afa045a957ffc8f3df799252e561
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2500939
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70907}
2020-11-02 02:03:09 +00:00
Etienne Pierre-doray
4fb053d847 [Jobs API] Rename !IsCompleted -> IsActive
IsCompleted is backwards. For a more consistent api, the function is
renamed IsActive and logic is flipped.
Following up on https://chromium-review.googlesource.com/c/v8/v8/+/2461840
The intend is to make the distinction between IsActive and IsValid obvious.

Change-Id: Iaf00b9f6ffa8f1efe93ae29f09899737ef20f04d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2510969
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70901}
2020-10-30 19:57:38 +00:00
Michael Lippautz
cfba2e5d4e platform, cppgc: Fix stack handling routines
- Provide GetRealStackAddressForSlot that deals with ASAN fake stacks
  properly, also accounting for the fact that ASAN gets its real stack
  address in a nested call.
- Fix cppgc on-stack getter.
- Reuse platform routines in global handles.

Bug: chromium:1139914, chromium:1056170
Change-Id: If11a40d543b33edcea220bb70f170ac018e15053
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2509594
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70899}
2020-10-30 15:07:26 +00:00
Michael Lippautz
aad7b7ff33 global-handles: Fix ASAN fake stack handling
We previously assumed that a fake stack should be mapped back to a
real stack based on fake-stack offsets. This is not correct: Fake and
real stack are disjoint and both contain the corresponding slot
values.

For global handles this means that on-stack handles must be registered
using their real stack frame base to be able to purge them
occasionally based on the current stack address.

When dealing with a slot though, the GC can just dereference the slot
for a value, indeppendent of whether the slot is in a fake or real
frame.

Drive-by: Fix tests that do not want stack handles by creating
handles on heap.

Change-Id: I2c86c8e047bd0d48c24c2642b2b4dba284a93909
Bug: chromium:1139914
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507720
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70897}
2020-10-30 13:56:36 +00:00
Benedikt Meurer
1d7579b525 [wasm] Remove "function tables" from the scope chains.
Building these objects takes a lot of time and memory for realistic
applications and exposing them via the Scope view in DevTools isn't
practical either. We have a replacement in the Console now, and if
this needs more exposure we can think about other, more scalable
ways with better UX.

Fixed: v8:10986
Bug: chromium:1141781
Change-Id: I6177d63a987749889a9880cf0738031191eb5705
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507696
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70894}
2020-10-30 11:32:12 +00:00
Martin Bidlingmaier
5720d2056c [regexp] Add 'l' flag to force experimental engine
This commit adds the 'l' (linear) RegExp flag (as in e.g. /asdf|123/l)
that forces execution in linear time.  These regexps are handled by the
experimental engine.  If the experimental engine cannot handle the
pattern, an exception is thrown on creation of the regexp.

The commit also adds a new global V8 flag and changes an existing one:
* --enable-experimental-engine, which turns on recognition of the RegExp
  'l' flag.  Previously this flag also caused all supported regexps to
  be executed by the experimental engine; this is not the case anymore.
* --default-to-experimental-regexp-engine takes over the previous
  semantics of --enable-experimental-regexp-engine:  We execute all
  supported regexps with the experimental engine.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: I5622a89b19404105e8be280d454e9fdd63c003b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2461244
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Cr-Commit-Position: refs/heads/master@{#70892}
2020-10-30 08:33:06 +00:00
Leszek Swirski
8e3ae62d29 [map] Try to in-place transition during map update
When searching for a target map during map update, attempt to
update field representations in-place to the more general
representation, where possible.

Bug: chromium:1143772
Change-Id: I6a43c94910a1d2d8f8b0ad89048f94b51461f76c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507715
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70887}
2020-10-29 21:26:16 +00:00
Ulan Degenbaev
d7bc6e800e [heap] Delay OOM during GC until NearHeapLimitCallback is invoked
This allows GC to go slightly over the max heap limit in order to give
NearHeapLimitCallback a chance to run and increase the limit.

Based on the suggestion by Kenton Varda.

Change-Id: I9c084b5a4c8fb7b9ce331b565958391c1be56add
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505724
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70884}
2020-10-29 20:00:56 +00:00
Shu-yu Guo
def7dc3d4b [class] Fix super call evaluation order
Fix super calls so that arguments are evaluated before the
super constructor is checked to be in fact a constructor.

A new bytecode is introduced to split the IsConstructor check
out from the current GetSuperConstructor bytecode.

Bug: v8:10111
Change-Id: I3af99e32a34d99493806bb01b547d6f671cdc9de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493077
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70881}
2020-10-29 16:08:34 +00:00
Frank Emrich
eeb74f09c1 [dict-proto] make small ordered hash tables use InternalIndex, too
This CL changes the "small" versions of ordered hash tables, like
SmallOrderedNameDictionary and the corresponding handlers, like
OrderedNameDictionaryHandler, to use InternalIndex rather than int
as the type used for indices.

This is part of an effort to make the interfaces of the
ordered and unordered name dictionaries more similar.

Bug: v8:7569
Change-Id: I3b6fe79dfd3c6743f58a04cfe82798fe2ef09e19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505720
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70876}
2020-10-29 13:00:53 +00:00
Jakob Gruber
4044038082 [nci] Unskip a test
For-in now collect feedback as well, the test passes.

Tbr: neis@chromium.org
Bug: v8:8888
Change-Id: I4e2ae41b60aa43132a24f001dc4de460a270a1a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505766
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70874}
2020-10-29 12:21:53 +00:00
Frank Emrich
b4fe3473e4 [dict-proto] make ordered hash tables use InternalIndex for indices
This changes the ordered hash data structures in ordered-hash-table.h to
use InternalIndex as the type used for indices, rather than int.

This makes the interface more similar to the (unordered) hash tables in
dictionary.h and hash-table.h

Bug: v8:7569

Change-Id: I2389b0c7d103eb7c33c5ed620b16eb198109b54c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2503949
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70873}
2020-10-29 11:21:21 +00:00
Santiago Aboy Solanes
8eaf1cde4a Reland x2 "[compiler] Replace Symbol with direct reads""
Inside of LoopPeeler::PeelInnerLoopsOfTree we call the typer, which
inspects heap objects, so we need to unpark the local heap.

Reverted in https://chromium-review.googlesource.com/c/v8/v8/+/2502333

Original change's description:
> [compiler] Replace Symbol with direct reads
>
> Bug: v8:7790
> Change-Id: I49120a6349777fd992a97d697940e79b2e71dbd1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400988
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69812}

Bug: v8:7790, chromium:1137594
Change-Id: I8539175002e19b04b84009eb6b2cc5ced4ee53c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502339
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70872}
2020-10-29 10:25:41 +00:00
Zhi An Ng
aafa16d641 [mjsunit] Check array length in array-concat
The speedup in https://crrev.com/c/2504853 left out checking the array
lengths, this adds that check.

Bug: v8:7783
Change-Id: I8de01fa2dff3e051246ee3a268cdce2128ad16ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505252
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70869}
2020-10-29 09:33:56 +00:00
Zhi An Ng
0545f1164e [mjsunit][wasm] Unmark some tests as slow
These were sped up in
https://bugs.chromium.org/p/v8/issues/detail?id=7783 comments 65 to 68.


Bug: v8:7783
Change-Id: If1bb3db10a418625d13ae3417c009274c39df67d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505249
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70868}
2020-10-29 09:32:51 +00:00
Michael Lippautz
b86e224b40 Reland "cppgc-js: heap snapshot: Add logic for querying detachedness"
This is a reland of e68285e21d

Failing wasm tests seemed to recover on their own.

Original change's description:
> cppgc-js: heap snapshot: Add logic for querying detachedness
>
> Adds infrastructure to allow embedders specifying a detachedness state
> that is queried when encountering an object with a TraceReference that
> has a non-zero wrapper class id set.
>
> Change-Id: Ie7f2f253544ee25a25565eb08d82e9df5f0a74d2
> Bug: chromium:1056170
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502345
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70841}

Bug: chromium:1056170
Change-Id: I293a9d38f841b4d0faa4af7408bb57544f11d566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505713
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70867}
2020-10-29 09:18:21 +00:00
Mathias Bynens
b4d35d0241 Revert "Update RegExp sequence property support"
This reverts commit 1eecdf3450.

Reason for revert: unacceptable binary size increase (+65.5 KiB)
We’ll reland once we implement a more efficient way to store the
sequences.

Original change's description:
> Update RegExp sequence property support
>
> This patch aligns --harmony-regexp-sequence with the latest version of
> the corresponding TC39 and Unicode proposals.
>
> The list of supported properties has been changed:
>
> - https://github.com/tc39/proposal-regexp-unicode-sequence-properties#proposed-solution
> - https://unicode.org/reports/tr18/#Full_Properties
>
> Furthermore, the Unicode data now uses Unicode v13.0.0 instead of v12.0.0.
>
> Bug: v8:7467
> Change-Id: I1ac386d87af68d68e84e919cb5ffc1313443844a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497163
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Mathias Bynens <mathias@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70752}

TBR=yangguo@chromium.org,jgruber@chromium.org,mathias@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7467
Change-Id: I6721f4862827dc686d96d79498a1e8fdae4481d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505758
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70866}
2020-10-29 07:46:01 +00:00
Zhi An Ng
f4ff68af61 [wasm-simd] Enable skipped regression test
Test was skipped because the generated test contains multi-byte opcode,
and wasn't correct. Fix up the test with the correct encoding. The
fuzzer now generates multi-byte opcodes correctly, and so shouldn't be
an issue.

Bug: v8:10486
Change-Id: I1f5ad7d456320a30da6c553f65fdca0fc86a291a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2505238
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70864}
2020-10-29 05:12:27 +00:00
Leszek Swirski
2c555da9e5 [test] Fix mjsunit/regress/regress-542823 on PPC
PPC has a larger page size than other platforms, so increase the page
size in the test to account for this.

Change-Id: I392064e9ef3f87c5bddb7763b35661aee5b4669d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502330
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70857}
2020-10-28 18:19:41 +00:00
Mythri A
71220b3b69 Reland "[turboprop] Pass required parameters as value inputs to TierUpCheck node"
This is a reland of 44f46defcf with a
fix for failures with --turbonci_as_mid_tier

Original change's description:
> [turboprop] Pass required parameters as value inputs to TierUpCheck node
>
> TierUpCheck node tail calls interpreter entry trampoline when additional
> processing is needed for tiering up. Calling IET requires target,
> new_target, input count and context as parameters. Earlier these were
> created as parameter nodes in effect-control-linearizer. This causes
> problems with Turboprop since TurboProp doesn't use the second scheduler
> and cannot reschedule these nodes to the start block. We should instead
> create these parameter nodes in bytecode-graph-builder and pass them
> as value inputs to TierUpCheck node.
>
> Bug: v8:9684
> Change-Id: Icfe5a33b4e628d5a3ba9a3121b2b0746be6aed5c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2498695
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70790}

Bug: v8:9684
Change-Id: Ic1a7d39aab0a599d0dd421f237e7bc640fcd6eb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2504258
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70856}
2020-10-28 18:18:36 +00:00