Commit Graph

11003 Commits

Author SHA1 Message Date
Ng Zhi An
35d230164b [wasm-simd] Rename add saturate and sub saturate instructions
Rename AddSaturate and SubSaturate to the shorter version, AddSat and
SubSat, following the spec.

Bug: v8:10946,v8:10933
Change-Id: Idf74b3a1eb2e2f6d4e37d2b8e5fa6d96ea090db4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436615
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70549}
2020-10-15 20:36:43 +00:00
Maya Lekova
d84109963d Revert "[wasm-gc] Implement call_ref on WasmJSFunction"
This reverts commit 6227c95e5f.

Reason for revert: Breaks Mac64 GC stress - https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8866365194967638384/+/steps/Check_-_d8/0/logs/call-ref/0

Original change's description:
> [wasm-gc] Implement call_ref on WasmJSFunction
>
> Changes:
> - Introduce turbofan builtin WasmAllocatePair.
> - Implement call_ref for WasmJSFunction in wasm-compiler.cc.
> - Remove WasmJSFunction trap.
> - Improve and extend call-ref.js test.
>
> Bug: v8:9495
> Change-Id: I8b4d1ab70cbbe9ae37887a6241d409eec638fd28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463226
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70535}

TBR=clemensb@chromium.org,manoskouk@chromium.org

Change-Id: Ifad2cd8185df5e8d6766cefbcd3f28234a157dfb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9495
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2475735
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70539}
2020-10-15 15:22:18 +00:00
Ross McIlroy
13436edce2 [TurboProp] Handle allocation of phis which are never used
In certain situations a phi might not be used by later code, and so
is neither spilled nor has a register allocated to it. Handle this
by removing the incorrect DCHECK.

BUG=chromium:1137979,v8:9684

Change-Id: I702dc05dba22e23dac5c1a366a770f18bac45c52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2471998
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70536}
2020-10-15 14:52:33 +00:00
Manos Koukoutos
6227c95e5f [wasm-gc] Implement call_ref on WasmJSFunction
Changes:
- Introduce turbofan builtin WasmAllocatePair.
- Implement call_ref for WasmJSFunction in wasm-compiler.cc.
- Remove WasmJSFunction trap.
- Improve and extend call-ref.js test.

Bug: v8:9495
Change-Id: I8b4d1ab70cbbe9ae37887a6241d409eec638fd28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463226
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70535}
2020-10-15 14:30:23 +00:00
Z Nguyen-Huu
b22f5ac6e7 [turbofan] Avoid relaxing node that has other effect use
It is related to Reduce consecutive overflow addition with constants.
Turned out that we needs to consider also effect use before relaxing it.

This fixed the issue that fuzzer found in e93a369f7a.

Bug: chromium:1137586
Change-Id: I32fee5ecc7a6ce40d6f739f9c6e2440a647a2222
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469597
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70514}
2020-10-14 19:16:02 +00:00
Martin Bidlingmaier
d4febb6b46 [regexp] Use experimental engine if backtrack limit exceeded
We fall back from irregexp to the experimental engine if a backtrack
limit is exceeded and the experimental engine can handle the regexp.
The feature can be turned on with a boolean flag, and an uint-valued
flag controls the default backtrack limit.  For regexps that are
constructed with an explicit backtrack limit (API,
%NewRegExpWithBacktrackLimit), we choose the lower of the explicit and
default backtrack limits.
The default backtrack limit does not apply to regexps that can't be
handled by the experimental engine, and for such regexps an explicitly
specified backtrack limit is handled as before by returning null if we
exceed it.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: I580df79bd847520985b6c2c2159bc427315c89d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436341
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70500}
2020-10-14 11:18:37 +00:00
Clemens Backes
9d7be16cae [wasm] Add missing checks for growing the stack
Whenever more then one value is pushed to the stack, we need to execute
a check for growing the stack first (since https://crrev.com/c/2431525).
This CL adds two missing checks.

R=thibaudm@chromium.org

Bug: chromium:1137582
Change-Id: I9755502dfdb77c03d1dde3e83fb7d33b9b99e499
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467796
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70480}
2020-10-13 12:35:14 +00:00
Andreas Haas
bc4a94d308 [wasm] Rename flag to --experimental-liftoff-extern-ref
Rename the flag --liftoff-extern-ref to
--experimental-liftoff-extern-ref to keep the fuzzer from using it.
The implementation is not complete yet, and the next steps may take a
bit.

R=clemensb@chromium.org

Bug: chromium:1137601
Change-Id: I74f1ed8faba44e42f63790d87f4a538dd59ac852
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465838
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70476}
2020-10-13 11:17:24 +00:00
Camillo Bruni
509802fd08 [log] Add predictable logging
Use monotonic times for logging with --predictable.

Bug: v8:10937, v8:10966, v8:10668
Change-Id: I3d4f0d48375f6f5d9fa375cf5393ff3afee7c0b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465829
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70474}
2020-10-13 10:13:54 +00:00
Mythri A
1dac9f3b10 [turboprop] Don't use function context specialization with Turboprop
For turboprop, it's a better tradeoff to reuse the code than
specialising the code for a particular closure especially given we
optimize quite early when compared to Turbofan.

Bug: v8:9684
Change-Id: Icf5d8548bbdcac9e202dcf44c68e06cc4c732ba7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2461242
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70451}
2020-10-12 16:30:45 +00:00
Manos Koukoutos
da3c731894 [wasm-gc] Cleanup/preparation to enable call_ref with WasmJSFunction
Changes:
- Add wasm-to-js wrapper field to WasmJSFunction. A WasmJSFunction might
  be called with call_ref without being imported to a module, and this
  provides a call target for this scenario. The wrapper is only compiled
  if --experimental-wasm-typed-funcref is set.
- Add CompileWasmToJSWrapper in wasm-compiler.
- Rename  BuildLoadFunctionDataFromExportedFunction ->
  BuildLoadFunctionDataFromJSFunction to reflect its wider usage.
- Rename BuildWasmImportCallWrapper -> BuildWasmToJsWrapper to reflect
  this function is now also used by CompileWasmToJSWrapper (unrelated to
  imports).
- (Drive-by) Remove dead arguments from wasm-module-builder.js.

Bug: v8:9495
Change-Id: I23468b69d42310cb8e96da5286ce68c701188876
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2459371
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70421}
2020-10-09 11:24:22 +00:00
Camillo Bruni
3935dc4909 [d8] Fix Realm.owner on detached global proxy
Return undefined instead of hard-crashing.

Bug: chromium:1130213
Change-Id: I7e573f46607fc0e7b91db62d881b4209b919028e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2456087
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70420}
2020-10-09 09:55:32 +00:00
Camillo Bruni
28c2e433d0 [runtime] Fix global_dictionary case in SetOrCopyDataProperties
Bug: chromium:1133210
Change-Id: Ic60e88ab3c50602a71387f7c3a1253d70a7c69fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2450061
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70341}
2020-10-06 12:27:15 +00:00
Manos Koukoutos
cdb3da7f5f [wasm-gc][bug] call_indirect should check for null table entries
This was not happening when there was no need to typecheck the entry.

Additional changes:
- Add tests with null table entries for typed and untyped function
  tables.
- Allow AddIndirectFunctionTable in wasm-run-utils to specify table
  type.
- Add possibility to define tables in test-gc.cc.
- Merge trapTableOutOfBounds with trapInvalidFunc.
- Use trapTableOutOfBounds in call_indirect as appropriate.
- Fix emission of table types in wasm-module-builder.cc.

Bug: v8:9495
Change-Id: I4a857ff4378e5a87dc0646d94b4c75635a43c55b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2442622
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70311}
2020-10-05 13:08:20 +00:00
Sathya Gunasekaran
2cf6ee0be8 [turboprop] Inline monomorphic map check
Instead of loading the map from the feedback vector for monomorphic
access, this CL directly inlines the expected map constant as a static
check.

In case this static check fails, we call out to a builtin which performs
additional dynamic map checks.

There are several dynamic map checks performed by the builtin for various
cases such as:
(a) IC is monomorphic with a map that's different from the initial
static map that we checked, in which case we perform another dynamic
map check.
(b) IC is monomorphic but incoming map is a deprecated map in which case
we call out the runtime to migrate this incoming object to a new map and
then try to handle it.
(c) IC has now transitioned to polymorphic in which we use the old
dynamic polymorphic checks to validate the map and handler.

Bug: v8:10582, v8:9684
Change-Id: Id87265ed513e4aef87b8e66c826afbf10f50a1d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2429034
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70304}
2020-10-05 10:13:08 +00:00
Jakob Kummerow
896627dbef [cleanup] Drop Runtime_IsValidSmi
It only had one callsite, and that callsite was useless:
%IsValidSmi(two_31) has never returned {true} on any
configuration we have ever shipped.

Bug: v8:10933
Change-Id: I09cdfd7bbd7960d1ec460ad4bd9f0d21e47f7393
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434746
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70285}
2020-10-02 14:22:48 +00:00
Leszek Swirski
a769ea7a44 [parser] Fix AST func reindexing for function fields
AST reindexing has to skip visiting fields that are already in the
member initializer, as they will have already been visited when
visiting said initializer. This is the case for private fields and
fields with computed names.

However, the reindexer was incorrectly assuming that all properties
with a FunctionLiteral value are methods (and thus not fields, and
can safely be visited). This is not the case for fields with
function expression values.

Now, we correctly use the class property's "kind" when making this
visitation decision.

Fixed: chromium:1132111
Change-Id: Ia53d1fe713453e361b818dfb0b5f88a90cecdf21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440519
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70247}
2020-10-01 07:53:01 +00:00
Jakob Kummerow
9c55b1d69d Fix Array.p.pop() for read-only length 0
Array.prototype.pop() must throw a TypeError whenever the array's
length is readonly; there is no exception to that when the length
is 0. This patch moves the length==0 special case after the read-
only length check in both fast paths (CSA and C++).

Fixed: v8:10908
Change-Id: I4a77439478cffeaf11022ff8beb78b0a907290d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440576
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70233}
2020-09-30 15:34:48 +00:00
Jakob Kummerow
6c07d6e3d8 [typedarray] Throw rather than crash when too large to sort
Sorting a TypedArray with a custom compare function requires us to
copy the array's contents to a FixedArray. When the TypedArray is
larger than FixedArray::kMaxLength, we should throw a RangeError
rather than crashing with an OOM message.

Fixed: v8:10931
Change-Id: I8a27cc0ac80a9172bc5e8e154fdf4ccce5974317
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440575
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70232}
2020-09-30 15:20:33 +00:00
Thibaud Michaud
e60d8600b5 [wasm] Add GenericJSToWasmWrapper to the list of executable builtins
Ensure that a valid off-heap trampoline is created for the
GenericJSToWasmWrapper builtin by adding it to the list of executable
builtins.

R=ahaas@chromium.org
CC=​evih@chromium.org

Bug: v8:10701
Change-Id: I49b8144237aca20f5f663c7b32810a16f715ad5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438415
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70218}
2020-09-30 10:45:47 +00:00
Manos Koukoutos
2e9cb16c14 [wasm][bug] Compare signatures correctly in ResolveWasmImportCall
Changes:
- Implement WasmExportedFunction::MatchesSignature.
- Use it over comparison with == in ResolveWasmImportCall.
- Add a test which exposes the existing bug.
- Add a few reminder TODOs.

Bug: v8:9495
Change-Id: Ibbe31dbf550be212dbf2170ab8cdab9b4b6de734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438060
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70215}
2020-09-30 09:56:27 +00:00
Ng Zhi An
ed7204bbde [wasm-simd] Add saturating conversion opcodes to wasm-module-builder.js
Bug: v8:10933
Change-Id: I6709dac3598f9dea96fe6f5efec452c1bbdcbc2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436611
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70208}
2020-09-29 20:18:13 +00:00
Ng Zhi An
98e2796555 [wasm-simd] Protected load transforms are not eliminatable
LoadTransform operators contain a LoadKind, which can be unaligned,
protected, poisoned, normal.

If it is protected, we cannot eliminiate that load,
since we rely on the segv signal handling. So, we use partial template
specialization on LoadKind::kProtected, and don't set the operator to
not be eliminatable.

Bug: chromium:1132461
Change-Id: If45fc6562348ffd4dbaa27058e6c5d4242f79abb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436081
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70205}
2020-09-29 17:24:53 +00:00
Camillo Bruni
8d389204a6 [log][test] Skip log_two_byte.js test in predictable mode
Allocating the log string causes allocation differences.
Skipping test for now.

Drive-by-fix: remove two more console.log from test

Bug: v8:10966, v8:10668
Change-Id: Ifb93393fb82a983e779246ea728b1f6caf650426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436457
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70197}
2020-09-29 13:18:51 +00:00
Georg Neis
44f23d617a Revert "[compiler] Check for stack overflow in recursive ReduceJSCall"
This reverts commit d734bb4c5d.

Reason for revert: Flawed.

Original change's description:
> [compiler] Check for stack overflow in recursive ReduceJSCall
>
> Gracefully handle hugely nested JSBoundFunctions.
>
> Bug: chromium:1125145
> Change-Id: I08f136fa9d35cf16ea8da5132d4d483a75d0ba94
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418091
> Auto-Submit: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70164}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I2d4ed79e2470981dab7ccba8e0c7e1004fe91369
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1125145
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436342
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70195}
2020-09-29 11:33:52 +00:00
Ng Zhi An
78391a4450 [wasm-simd] Fix typo in constructing SIMD Global
The value should be v128 according to
https://github.com/WebAssembly/simd/blob/master/proposals/simd/SIMD.md#global-constructor.

Change-Id: I9d29905daaaf19cdcaf686991f4887c3e709d2d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436638
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70184}
2020-09-28 23:29:44 +00:00
Michael Achenbach
ef2e6dc5ee [test] Run more variants on no-CM builder
This additionally combines --future with all other standard testing
variants.

This also enables using concurrent_marking in status files to skip
tests in this variant.

This also marks a slow test that times out in the new config.

Bug: v8:10875
Change-Id: Id904f6a2c51b814eecfccb523a897de2f5d96f56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423719
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70180}
2020-09-28 19:04:19 +00:00
Adam Klein
ac395813f1 [compiler] Remove apparent no-op compiler test
This test likely did something in 2013 when we still had legacy const,
but now it seems like it's mostly a poor unittest of when
optimization/deoptimization happens.

Bug: v8:10933
Change-Id: Ib816e0eddf9224a4ad37096591da9032740d5e7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432313
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70178}
2020-09-28 18:14:49 +00:00
Camillo Bruni
7d60fe99cb [d8] Improve error message for invalid module file
Change-Id: Ia55be7d7eda930e6ebf2a0e46c466873006e9d68
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2429264
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70176}
2020-09-28 17:31:04 +00:00
Camillo Bruni
12cd035911 [test][tools] Add test for timline.mjs
Bug: v8:10668
Change-Id: I51f81a66408a4b262f9ac7e6421609c5e485f779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435107
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70174}
2020-09-28 16:47:44 +00:00
Camillo Bruni
e0d04697d6 [log][test] Fix log_two_byte test
Remove debug code that fails with predictable tests.

Bug: chromium:1130673
Change-Id: Ie0009a3b18979057b08c25d22c58c7542dd1db6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435678
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70167}
2020-09-28 15:35:47 +00:00
Georg Neis
d734bb4c5d [compiler] Check for stack overflow in recursive ReduceJSCall
Gracefully handle hugely nested JSBoundFunctions.

Bug: chromium:1125145
Change-Id: I08f136fa9d35cf16ea8da5132d4d483a75d0ba94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418091
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70164}
2020-09-28 14:47:18 +00:00
Camillo Bruni
94bce1dcac [tools] Convert JS-tools to ES6 modules
This changes all tools to use ES6 modules and proper imports.

Step 1: Add converted .mjs files (*this CL*)
Step 2: Update node-ci build to use new .mjs files
Step 3: Remove outdated .js files

Bug: v8:10667, v8:10933
Change-Id: I3e92e66f896d8a9cacaf6d421f8d2c86fb3bc444
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431045
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70163}
2020-09-28 14:40:18 +00:00
Camillo Bruni
1e80ad69b3 [tools] Remove tools/profviz
The tool has been outdated for a while and replaced by profview for
most use-cases.

The last version is still hosted under
https://v8.github.io/tools/v8.4/profviz/profviz.html

Bug: v8:9260, v8:10667
Change-Id: I54888640a627ee8e4d8ad2ab63bd91e04e6fb98f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2434335
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70159}
2020-09-28 13:22:46 +00:00
evih
4924d01f8b Use js-to-wasm generic wrapper for f32 and f64 params
Currently, the generic wrapper is used for i32, i64, f32 and f64 params
and 0 or 1 i32, i64, f32, f64 return value.

Bug: v8:10701
Change-Id: I3776de617aa4a384fdff5154ddad8ff405001a33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2429266
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70156}
2020-09-28 11:13:36 +00:00
Bill Budge
f50d8c7840 [cleanup] Remove 'RT' suffix on Runtime ToString function
Bug: v8:10933
Change-Id: I4db540cf47ce5cfa25757d776a2bf988ce3ed554
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432072
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70147}
2020-09-25 21:18:32 +00:00
Almothana Athamneh
42c2fb3cf5 [test] Ensure tests relying on no-inlining keep working
Add opt and noturbo inlining to these tests to ensure that
they keep working.

Bug: v8:10924
Change-Id: Icdb5ddffad11ea3c2eea723e339d450d8405b6b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426604
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70145}
2020-09-25 19:09:22 +00:00
Gus Caplan
83f778aff1 Add iterator done check in spread destructuring
This fixes the logic in the desugaring of destructuring assignments. In
particular, a spread element would not check if previous `next` results
had already been done, and would always call `next()` again.

Change-Id: I1bd384678722e6cf51c5777fc3b0dd965360291a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2430488
Commit-Queue: Gus Caplan <snek@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70144}
2020-09-25 19:08:17 +00:00
Adam Klein
74794fb937 [wasm-simd] Rename shuffle & swizzle instructions to match spec
These instructions were changed from "s8x16" to "i8x16" prefixes in
https://github.com/WebAssembly/simd/pull/321.

This CL updates all V8 code, including arch-specific code, to match.

Bug: v8:10946, v8:10933
Change-Id: I26ef9ad77571f94501d42c1d65f57380fd507f3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432068
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70143}
2020-09-25 19:07:12 +00:00
Tobias Tebbi
e9bcaa91ea [flags] introduce --allow-overwriting-for-next-flag
Bug: v8:10942
Change-Id: Icbb1d8e054ee924a77f1fbeb9e48cde604ef69b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422001
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70130}
2020-09-25 11:03:18 +00:00
Andreas Haas
4af3a33327 [wasm] Don't overwrite register in atomic.notify if it is still used
In atomic.notify we overwrote the register which stored the index,
without checking if it was still in use or not.

R=clemensb@chromium.org

Bug: v8:10898
Change-Id: I59ed7a2c1f1342ff4252e3c4d33822111caee82c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426616
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70125}
2020-09-24 18:59:07 +00:00
evih
b728ad817e [wasm] Use proper load in the generic js-to-wasm wrapper
When loading from the exported function data without pointer
compression, wrong load was used before.

Bug: v8:10701, chromium:1130385
Change-Id: If66913bcd5284eeb6fb7b795357f1512682a062f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426383
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70124}
2020-09-24 18:46:08 +00:00
Camillo Bruni
78c42a1f8e [log] Support logging two-byte characters
Bug: chromium:1130673
Change-Id: I78ae388daa1c4c2b594981bdadd201c2dfb39eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426618
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70116}
2020-09-24 12:34:07 +00:00
Marja Hölttä
24fbcf8847 Try 2: [super ic] Fix more receiver vs lookup start object vs holder confusion
The actual fix is in LoadIC::ComputeHandler (checking
lookup_start_object == holder instead of receiver == holder) + the
LookupIterator changes for preserving lookup_start_object.

The rest is renaming / refactoring.

Reland: not relying on the prototype validity cell after all

Previous version: https://chromium-review.googlesource.com/c/v8/v8/+/2414039

Bug: v8:9237, chromium:1127653
Change-Id: I1949442f8ddcecb776f0c5d2cf737cb75f80e313
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2428588
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70112}
2020-09-24 11:45:18 +00:00
Marja Hölttä
8443390f71 Revert "[super ic] Fix more receiver vs lookup start object vs holder confusion"
This reverts commit ab7e6df074.

Reason for revert: Several fuzz bugs: chromium:1131469, chromium:1131525, chromium:1131779

Original change's description:
> [super ic] Fix more receiver vs lookup start object vs holder confusion
>
> The actual fix is in LoadIC::ComputeHandler (checking
> lookup_start_object == holder instead of receiver == holder) + the
> LookupIterator changes for preserving lookup_start_object.
>
> The rest is renaming / refactoring.
>
> Bug: v8:9237, chromium:1127653
> Change-Id: Ieef46fb46ababa79623951c48639429c5b552d2d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414039
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70045}

TBR=marja@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9237
Bug: chromium:1127653, chromium:1131469, chromium:1131525, chromium:1131779
Change-Id: I1bad5ba1dcfe9a0de8ce775feac2d3bfd7264c8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426620
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70107}
2020-09-24 09:07:25 +00:00
Jakob Gruber
5b42e3f334 [regexp] Assign proper flags to TextNode
This fixes a case in which we forgot to assign flags to TextNodes
created through

AddBmpCharacters
AddNonBmpSurrogatePairs
AddLoneLeadSurrogates
AddLoneTrailSurrogates

functions. If these initially had a flag (e.g. case-insensitive 'i')
set, that information was lost. This bug resulted in missing case
folding in no_i18n builds (perhaps other things as well that just
aren't covered by our test suite).

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Bug: v8:10131,v8:10120
Change-Id: Icef4f0dbd47971a538e07bab2f1067c383fd59c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423718
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70106}
2020-09-24 08:51:15 +00:00
Marja Hölttä
5d5b728b8a [logical assignment] Disallow foo() &&= 1 etc
Having the web compatibility hack (allowing foo() = 1) enabled for
logical assignment was unintentional.

Browser compatibility data:
https://docs.google.com/document/d/1cGorRZ73KvQqu57tT4ahCjSLncibFMUwlkaL-XIstzI/edit?usp=sharing

Bug: v8:10372, v8:10950
Change-Id: I87f6348b75ce72ee5bd5db143f789ceeee596070
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423721
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70105}
2020-09-24 08:17:17 +00:00
Jakob Gruber
2c354c3634 Skip failing stress_sampling tests
Bug: v8:10915
Change-Id: I96fb546cea47d382b2ca160bbbf1fb270468e51b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426617
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70104}
2020-09-24 08:10:17 +00:00
Camillo Bruni
61d0c2bbb3 [mjsunit] Simplify log test to avoid timer issues
Avoid --log-all which activates profiling timers that have issues on
certain bots. --log-code is good enough to test whether logging works.

Bug: v8:10937
Change-Id: I3284801f7b423480756abb0f3c33980a9776575d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424349
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70093}
2020-09-23 13:56:31 +00:00
evih
607414e91c [wasm] Use js-to-wasm generic wrapper for f32 and f64 return
Currently, the generic wrapper is used for i32 and i64 params and 0 or 1
i32, i64, f32, f64 return value.

Bug: v8:10701
Change-Id: I610172995457354879afd3c9c2c6c2d55c2b700f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414219
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#70090}
2020-09-23 12:38:01 +00:00
Michael Achenbach
98db2c842f [test] Mark slow test
No-Try: true
Bug: v8:10952
Change-Id: Iee858419b160a354a4df61f51b18782fcbc4a521
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424155
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70089}
2020-09-23 12:10:40 +00:00
Camillo Bruni
a09632b9e2 [test] Skip flaky test
Bug: chromium:1129854, v8:10937
Change-Id: I0a9fd3e16a6ae8ea47a7a3f0a9325542d9e46014
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424133
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70083}
2020-09-23 11:03:20 +00:00
Martin Bidlingmaier
e6e9cbac37 [regexp] Support the msy flags in experimental engine
The m (multiline) and s (dotall) flags just needed to be marked as
allowed; the required logic was already in the regexp parser.

A regexp /<x>/ without the y (sticky) flag is equivalent to the sticky
regexp /.*?<x>/y.  The interpreter now assumes that every regexp is
sticky, and the compiler appends a preamble corresponding to /.*?/
before non-sticky regexps.  To reuse existing code for compiling this
preamble, the logic for each kind of quantifier is now in a separate
function and called from VisitQuantifier and for the preamble.

The commit also includes some improvements/fixes for character ranges:
- Empty character ranges/disjunctions should never match, but before
  this commit they would *always* match.
- The check of the range bounds in CanBeHandledVisitor was unncessary;
  without the unicode flag this can't be a range that can't be specified
  in 2-byte codepoints, and once we support unicode we simply support
  all codepoints.
- The capacity of the list containing the complementary intervals of a
  character range is now calculated more accurately.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: I71a0e07279b4e1140c0ed1651b3714200c801de9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404766
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70082}
2020-09-23 09:43:39 +00:00
Ng Zhi An
f1530eddf9 [wasm-simd] Rename load splat and load extend
Rename opcodes based on the renaming in the proposal,
https://github.com/WebAssembly/simd/pull/322.

Bug: v8:10946
Change-Id: If267d6f8fb1b9deeff64cd9abcd7e4cd64a540a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422357
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70077}
2020-09-22 22:19:33 +00:00
Camillo Bruni
1724c77c40 Reland "[log][d8] Only use d8.log.getAndStop on temporary log file"
This is a reland of 21bb43cc6a

The build failures seems to be an infra flake.

Original change's description:
> [log][d8] Only use d8.log.getAndStop on temporary log file
>
> We run tests in parallel which can cause multiple tests to write to
> the shared v8.log file. This obviously breaks the simple assertions in
> mjsunit/tools/log.js.
>
> - Use temporary files for log testing with --logfile='+'
>
> - Change the symbol from '&' to '+' for using temporary files for
>   logging with --logfile
>
> - Enable skipped log tests again.
>
> Bug: v8:10937, chromium:1129854, chromium:1130196
> Change-Id: I607dc9a9ecc352e58525cdd21c1c93efebf0f09f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421826
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70071}

Bug: v8:10937
Bug: chromium:1129854
Bug: chromium:1130196
Change-Id: I2ccf7528f35057ef668aa211142e0f1073fc1fc3
Tbr: verwaest@chromium.org, victorgomes@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424257
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70076}
2020-09-22 22:18:28 +00:00
Francis McCabe
ec570b8a80 Revert "[log][d8] Only use d8.log.getAndStop on temporary log file"
This reverts commit 21bb43cc6a.

Reason for revert: See broken build: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20builder/49882

Original change's description:
> [log][d8] Only use d8.log.getAndStop on temporary log file
> 
> We run tests in parallel which can cause multiple tests to write to
> the shared v8.log file. This obviously breaks the simple assertions in
> mjsunit/tools/log.js.
> 
> - Use temporary files for log testing with --logfile='+'
> 
> - Change the symbol from '&' to '+' for using temporary files for
>   logging with --logfile
> 
> - Enable skipped log tests again.
> 
> Bug: v8:10937, chromium:1129854, chromium:1130196
> Change-Id: I607dc9a9ecc352e58525cdd21c1c93efebf0f09f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421826
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70071}

TBR=cbruni@chromium.org,verwaest@chromium.org,victorgomes@chromium.org

Change-Id: I5de61792c283139b2a898334e28e1f7b2d7c08f8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10937
Bug: chromium:1129854
Bug: chromium:1130196
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424625
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70072}
2020-09-22 18:57:59 +00:00
Camillo Bruni
21bb43cc6a [log][d8] Only use d8.log.getAndStop on temporary log file
We run tests in parallel which can cause multiple tests to write to
the shared v8.log file. This obviously breaks the simple assertions in
mjsunit/tools/log.js.

- Use temporary files for log testing with --logfile='+'

- Change the symbol from '&' to '+' for using temporary files for
  logging with --logfile

- Enable skipped log tests again.

Bug: v8:10937, chromium:1129854, chromium:1130196
Change-Id: I607dc9a9ecc352e58525cdd21c1c93efebf0f09f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2421826
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70071}
2020-09-22 18:45:58 +00:00
Z Nguyen-Huu
e93a369f7a [turbofan] Reduce consecutive overflow addition with constants
Using associative property of addition: (x + A) + B => x + (A + B).
Note: A and B need to have the same sign and we need to check that
(x + A) isn't used anywhere else.

20% perf improvement of the following function.

function f(n) {
  var c = 0;
  for (var i = 0; i < n; i++) {
    c = c + 2 + 3;
  }
  return c;
}
for n = 10_000_000.

Before: 7.31s.
After: 6.05s.

Bug: v8:10305
Change-Id: If45d1cad6128a9a25cb9f43a4828ae28d594a84b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2365221
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70064}
2020-09-22 16:17:53 +00:00
Shu-yu Guo
91f1d130b1 [elements] Remove detach CHECK from the generic TypedArray#set
The detach CHECK is currently crashing on a non-TypedArray and non-Array
input source to TypedArray#set that detaches the destination TypedArray
in its length getter.

Bug: v8:10885
Change-Id: I80bcb4ffb4e4122afbff5c412623c008dc9509df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419655
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70062}
2020-09-22 16:10:38 +00:00
Andreas Haas
6b68692f07 [wasm] Disable flaky tests
The tests are flaky because of missing safepoint information for stack
checks. Adding the safepoint information there is not trivial though,
so I disable these tests for now to keep at least the bots green.
An alternative would be to revert the CLs that add safepoints in the
first place. However, I would prefer to avoid the overhead that would
be caused by it. The implementation is completely hidden behind a flag,
so it does not have impact on production code.

R=clemensb@chromium.org

Bug: v8:10929
Change-Id: I38c0e3c3806de2cc39ba26bc3b47c2ea8d1cf81a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423705
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70056}
2020-09-22 14:08:28 +00:00
Marja Hölttä
4f5ea814ca [Atomics.waitAsync] Mock Atomics.waitAsync in correctness fuzzing
It's inherently timing-dependent, leading to false positives.

Bug: chromium:1127612, v8:10239

Change-Id: Ibf6f3cb07f520a404daf8e860a0c2e5f2319529e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423707
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70046}
2020-09-22 11:04:58 +00:00
Marja Hölttä
ab7e6df074 [super ic] Fix more receiver vs lookup start object vs holder confusion
The actual fix is in LoadIC::ComputeHandler (checking
lookup_start_object == holder instead of receiver == holder) + the
LookupIterator changes for preserving lookup_start_object.

The rest is renaming / refactoring.

Bug: v8:9237, chromium:1127653
Change-Id: Ieef46fb46ababa79623951c48639429c5b552d2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414039
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70045}
2020-09-22 11:03:50 +00:00
Dominik Inführ
e9fb6f9ce9 [heap] Add slow test with --stress-concurrent-allocation
Test doesn't finish in 60s with --stress-concurrent-allocation, similar
to --stress-gc.

Bug: v8:10315
Change-Id: Id46231616387605ee49bfb54512828c0c8e84745
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2422000
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70035}
2020-09-21 16:38:27 +00:00
Manos Koukoutos
69ca751bc8 [wasm-gc] Implement typed function tables
Changes:
- When checking if a table is a function table, check for subtyping to
  funcref instead of equality.
- Add WasmModuleObject argument to GetFunctionTableEntry.
- Implement WasmTableObject::Get/Set for all legal table types.
- Factor out SetFunctionTableEntry from WasmTableObject::Set.
- Write unittests and JS tests.

Bug: v8:9495
Change-Id: I4f0c7a7013f17c561afb3039c5e0811634a4d313
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416387
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70032}
2020-09-21 15:20:32 +00:00
Martin Bidlingmaier
e83511c260 [regexp] Support assertions in experimental engine
Assertions are implemented with the new ASSERTION instruction.  The nfa
interpreter evaluates the assertion based on the current context in the
subject string every time a thread executes ASSERTION.  This is
analogous to what re2 and rust/regex do.

Alternatives to this approach:
- The interpreter could calculate eagerly for all assertion types
  whether they are satisfied whenever the current input position is
  advanced.  This would make evaluating the ASSERTION instruction itself
  cheaper, but at the cost of making every advance in the input string
  more expensive.  I suspect this would be slower on average because
  assertions are not that common that we typically evaluate >= 2
  assertions at every input position.
- Assertions in a regexp could be desugared into CONSUME_RANGE
  instructions, so that no new instruction would be necessary.  For
  example, the word boundary assertion \b is satisfied at a given
  position/state if we have just consumed a word character and will
  consume a non-word character next, or vice-versa.  The tricky part
  about this is that the assertion itself should not consume input, so
  we'd have to split (automaton) states according to whether we've
  arrived at them via a word character or not.  The current compiler is
  not really equipped for this kind of transformation.  For {start,end}
  of {line,file} assertions, we'd need to introduce dummy characters
  indicating start/end of input (say, 0x10000 and 0x10001) which we feed
  to the interpreter before respectively after the actual input.
  I suspect that this approach wouldn't make much of a difference for
  NFA execution. It would likely speed up (lazy) DFA execution though
  because assertions would be dealt with in the fast path.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: Ic2012c943e0ce54eb8662789fb3d4c1b6cd8d606
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398644
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70026}
2020-09-21 13:30:14 +00:00
Michael Achenbach
3cb8b399fe [test] Skip flaky tests
No-Try: true
Bug: v8:10942
Change-Id: I1c99c30ece27c67215629a0f5dbaa8d0aef9863a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2419014
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70020}
2020-09-21 09:09:04 +00:00
Michael Achenbach
ace13772eb [test] Skip flaky test
No-Try: true
Bug: chromium:1129854, v8:10937
Change-Id: I5e8f1afe582a10fe3d1bad989b197df01a557f90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2418721
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70019}
2020-09-21 08:55:24 +00:00
Manos Koukoutos
a5f68abef6 [wasm-gc] Preparation for typed function tables
Changes:
- Rename IsSignatureEqual -> MatchesSignature for consistency
- Add WasmInstanceObject field to WasmTableObject.
- Improve some error messages related to tables in
  function-body-decoder-impl.h.
- Introduce WasmTable::IsValidTableType. Use it wherever appropriate.
- Overload equality operators in HeapType to work with
  HeapType::Representation.
- Rename DynamicTypeCheckRef -> TypecheckJSObject.
- Handle WasmCapiFunctions in TypecheckJSObject.
- Use TypecheckJSObject in WasmTableObject::IsValidElement.
- A few more minor improvements.

Bug: v8:9495
Change-Id: I2867dd3486d7c31717ac26b87a50e15cf2b898be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416491
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70001}
2020-09-18 16:03:04 +00:00
Tobias Tebbi
0832a1093d Reland^5 "[flags] warn about contradictory flags"
This is a reland of 2000aea58a
Changes compared to last reland:
- Add rule in variants.py for --enable_experimental_regexp_engine.
- Make sure --abort-on-contradictory-flags works as well as --fuzzing
  to disable the checking for fuzzers, including for d8 flags.

Original change's description:
> Reland^4 "[flags] warn about contradictory flags"
>
> This is a reland of 0ba115e6a9
> Changes compared to last reland:
> - Fix Python code trying to write to expected_outcomes, which is now a
>   computed property.
> - Fix remaining place in d8.cc that ignored the --fuzzing flag.
> - Expect flag contradictions for --cache in code_serializer variant.
>
> Original change's description:
> > Reland^3 "[flags] warn about contradictory flags"
> >
> > Changes:
> > - Also allow second parameter influenced by --cache to be reassigned.
> > - Fix --stress-opt to only --always-opt in the last iteration as before.
> >
> > Original change's description:
> > > Reland^2 "[flags] warn about contradictory flags"
> > >
> > > This is a reland of d8f8a7e210
> > > Change compared to last reland:
> > > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > > - Allow identical re-declaration of --cache=*
> > >
> > > Original change's description:
> > > > Reland "[flags] warn about contradictory flags"
> > > >
> > > > This is a reland of b8f9166664
> > > > Difference to previous CL: Additional functionality to specify
> > > > incompatible flags based on GN variables and extra-flags, used
> > > > to fix the issues that came up on the waterfall.
> > > >
> > > > This also changes the rules regarding repeated flags: While
> > > > explicitly repeated flags are allowed for boolean values as long
> > > > as they are identical, repeated flags or explicit flags in the
> > > > presence of an active implication are disallowed for non-boolean
> > > > flags. The latter simplifies specifying conflict rules in
> > > > variants.py. Otherwise a rule like
> > > >
> > > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > > >   "--gc-interval=*": ["--gc-interval=*"],
> > > > }
> > > >
> > > > wouldn't work because specifying the same GC interval twice
> > > > wouldn't actually count as a conflict. This was an issue with
> > > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > > >
> > > > Also, this now expands contradictory flags checking to d8 flags
> > > > for consistency.
> > > >
> > > > Original change's description:
> > > > > [flags] warn about contradictory flags
> > > > >
> > > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > > >
> > > > > Bug: v8:10577
> > > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68989}
> > >
> > > Bug: v8:10577
> > > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#69339}
> >
> > Bug: v8:10577
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> > Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69433}
>
> Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69954}

Bug: v8:10577
TBR: clemensb@chromium.org, tmrts@chromium.org
Change-Id: Iab2d32cdcc2648934fc52255ccf3ae3ec9ca4d9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2416386
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70000}
2020-09-18 15:45:00 +00:00
Camillo Bruni
262fbcbeb8 [test][d8] Add d8.log.getAndStop helper
The new helper function allows us to write tests for log parsing
without the need of first generating a log file.
This makes it easier guard against errors when the log format changes.

- add d8.log.getAndStop helper
- add basic log test
- fix test that regresses due to changed gc timing

Bug: v8:10668
Change-Id: Ie57171fa98fe90428b89c26289d55fcbf2a70615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403245
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69987}
2020-09-18 09:49:39 +00:00
Manos Koukoutos
2b60b8d497 [wasm-gc] Extend js-compatible signatures to include typed functions
Changes:
- Extend IsJSCompatibleSignature to include typed functions.
- Generalize WasmIsValidFuncRefValue to WasmIsValidRefValue, utilize
  DynamicTypeCheckRef. Use it in FromJS.
- Extend DynamicTypeCheckRef to eqRef type and WasmJSFunction
  references.
- Update call-ref.js test.

Change-Id: I71166ab8c1e716c21e79776c561e77b443add1da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412527
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69981}
2020-09-18 07:10:38 +00:00
Bill Budge
a0e38f3186 Revert "Reland^4 "[flags] warn about contradictory flags""
This reverts commit 2000aea58a.

Reason for revert: Breaks NumFuzz.

Original change's description:
> Reland^4 "[flags] warn about contradictory flags"
> 
> This is a reland of 0ba115e6a9
> Changes compared to last reland:
> - Fix Python code trying to write to expected_outcomes, which is now a
>   computed property.
> - Fix remaining place in d8.cc that ignored the --fuzzing flag.
> - Expect flag contradictions for --cache in code_serializer variant.
> 
> Original change's description:
> > Reland^3 "[flags] warn about contradictory flags"
> >
> > Changes:
> > - Also allow second parameter influenced by --cache to be reassigned.
> > - Fix --stress-opt to only --always-opt in the last iteration as before.
> >
> > Original change's description:
> > > Reland^2 "[flags] warn about contradictory flags"
> > >
> > > This is a reland of d8f8a7e210
> > > Change compared to last reland:
> > > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > > - Allow identical re-declaration of --cache=*
> > >
> > > Original change's description:
> > > > Reland "[flags] warn about contradictory flags"
> > > >
> > > > This is a reland of b8f9166664
> > > > Difference to previous CL: Additional functionality to specify
> > > > incompatible flags based on GN variables and extra-flags, used
> > > > to fix the issues that came up on the waterfall.
> > > >
> > > > This also changes the rules regarding repeated flags: While
> > > > explicitly repeated flags are allowed for boolean values as long
> > > > as they are identical, repeated flags or explicit flags in the
> > > > presence of an active implication are disallowed for non-boolean
> > > > flags. The latter simplifies specifying conflict rules in
> > > > variants.py. Otherwise a rule like
> > > >
> > > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > > >   "--gc-interval=*": ["--gc-interval=*"],
> > > > }
> > > >
> > > > wouldn't work because specifying the same GC interval twice
> > > > wouldn't actually count as a conflict. This was an issue with
> > > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > > >
> > > > Also, this now expands contradictory flags checking to d8 flags
> > > > for consistency.
> > > >
> > > > Original change's description:
> > > > > [flags] warn about contradictory flags
> > > > >
> > > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > > >
> > > > > Bug: v8:10577
> > > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68989}
> > >
> > > Bug: v8:10577
> > > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#69339}
> >
> > Bug: v8:10577
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> > Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> > Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69433}
> 
> Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69954}

TBR=clemensb@chromium.org,tebbi@chromium.org,tmrts@chromium.org

Change-Id: I2dc80bcad9f74c29298902e01939e7e7f3336cf6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2415133
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69959}
2020-09-16 20:45:31 +00:00
Tobias Tebbi
2000aea58a Reland^4 "[flags] warn about contradictory flags"
This is a reland of 0ba115e6a9
Changes compared to last reland:
- Fix Python code trying to write to expected_outcomes, which is now a
  computed property.
- Fix remaining place in d8.cc that ignored the --fuzzing flag.
- Expect flag contradictions for --cache in code_serializer variant.

Original change's description:
> Reland^3 "[flags] warn about contradictory flags"
>
> Changes:
> - Also allow second parameter influenced by --cache to be reassigned.
> - Fix --stress-opt to only --always-opt in the last iteration as before.
>
> Original change's description:
> > Reland^2 "[flags] warn about contradictory flags"
> >
> > This is a reland of d8f8a7e210
> > Change compared to last reland:
> > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > - Allow identical re-declaration of --cache=*
> >
> > Original change's description:
> > > Reland "[flags] warn about contradictory flags"
> > >
> > > This is a reland of b8f9166664
> > > Difference to previous CL: Additional functionality to specify
> > > incompatible flags based on GN variables and extra-flags, used
> > > to fix the issues that came up on the waterfall.
> > >
> > > This also changes the rules regarding repeated flags: While
> > > explicitly repeated flags are allowed for boolean values as long
> > > as they are identical, repeated flags or explicit flags in the
> > > presence of an active implication are disallowed for non-boolean
> > > flags. The latter simplifies specifying conflict rules in
> > > variants.py. Otherwise a rule like
> > >
> > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > >   "--gc-interval=*": ["--gc-interval=*"],
> > > }
> > >
> > > wouldn't work because specifying the same GC interval twice
> > > wouldn't actually count as a conflict. This was an issue with
> > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > >
> > > Also, this now expands contradictory flags checking to d8 flags
> > > for consistency.
> > >
> > > Original change's description:
> > > > [flags] warn about contradictory flags
> > > >
> > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > >
> > > Bug: v8:10577
> > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#68989}
> >
> > Bug: v8:10577
> > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69339}
>
> Bug: v8:10577
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69433}

Change-Id: Ib6d2aeb495210f581ac671221c265df58e8e5e70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398640
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69954}
2020-09-16 16:39:49 +00:00
Frank Tang
46e06ad8fd Fix locale of Intl.Collator..resolvedOptions
Bug: v8:7481, v8:9084, v8:8664
Change-Id: Iccbf78bf11a4e8ca5d105772fa5f654fbe6542cd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410791
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69951}
2020-09-16 15:53:09 +00:00
Michael Achenbach
23a37871ac [test] Mark slow tests
No-Try: true
Bug: v8:10923
Change-Id: I254a6190aa7aad69a7e11c58e78429a45eec9962
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414208
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69946}
2020-09-16 13:07:09 +00:00
Martin Bidlingmaier
98b8ca89a2 [regexp] Support capture groups in experimental engine
This commit adds support for capture groups (as in e.g. /x(123|abc)y/)
in the experimental regexp engine.  Now every InterpreterThread owns a
register array containing (sub)match boundaries. There is a new
instruction to record the current input index in some register.

Submatches in quantifier bodies should be reported only if they occur
during the last repetition.  Thus we reset those registers before
attempting to match the body of a quantifier.  This is implemented with
another new instruction.

Because of concerns for the growing sizeof the NfaInterpreter object
(which is allocated on the stack), this commit replaces the
`SmallVector` members of the NfaInterpreter with zone-allocated arrays.
Register arrays, which for a fixed regexp are all the same size, are
allocated with a RecyclingZoneAllocator for cheap memory reclamation via
a linked list of equally-sized free blocks.

Possible optimizations for management of register array memory:
1. If there are few register per thread, then it is likely faster to
   store them inline in the InterpreterThread struct.
2. re2 implements copy-on-write:  InterpreterThreads can share the same
   register array. If a thread attempts to write to shared register
   array, the register array is cloned first.
3. The register at index 1 contains the end of the match; this is only
   written to right before an ACCEPT statement.  We could make ACCEPT
   equivalent to what's currently CAPTURE 1 followed by ACCEPT.  We
   could then save the memory for register 1 for threads that haven't
   finished yet.  This is particularly interesting if now optimization 1
   kicks in.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: I2c0503206ce331e13ac9912945bb66736d740197
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390770
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69929}
2020-09-16 08:16:08 +00:00
evih
e950f0407e [wasm] Use js-to-wasm generic wrapper for i64 return
Currently, the generic wrapper is used for i32 and i64 params and 0 or 1
i32 and i64 return value.

Bug: v8:10701
Change-Id: I4b592d7e0e4ebcb3455520c094c92bf4177c5a5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2412179
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69920}
2020-09-15 16:59:32 +00:00
Ng Zhi An
440bb7524b [wasm-simd] Check v128 imported global object
Check that a v128 imported global in a Wasm module is initialized with a
WebAssembly.Global object.

This is technically impossible, because creating WebAssembly.Global of
type v128 is an error, and creating one of any other type is a type
mismatch. However, we still need this check to avoid hitting an
unreachable case when setting the value of the global later on.

Also, this is not a validation error, since the v128 restriction is only
a Web/JS limitation. Other embedders can choose to do something
different with this module with an imported v128 global.

Bug: chromium:1127740
Change-Id: I6d444578c082b6b1c353cfa2fd82bb42eb14fc3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410659
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69919}
2020-09-15 16:58:02 +00:00
Andreas Haas
3bd1efd5e6 Reland "[wasm][liftoff] Support for most externref globals" on ia32
Global.set requires a write barrier. This write barrier was missing in
the original CL. The reland only adds the write barrier for ia32, and
bails out on the other platforms.

Original message:

With this CL we add support for all externref globals except for
imported mutable globals.

R=thibaudm@chromium.org, ulan@chromium.org

Bug: v8:7581
Change-Id: I86328a17200d1edc505f4c4357bdf795d95cf0c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404777
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69912}
2020-09-15 13:46:42 +00:00
Georg Neis
241c8fa48f [compiler] Unpark local heap in more places
Bug: chromium:1127405, v8:7790
Change-Id: Ibba029725b46c691b7848b0a092f0159259651c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2410381
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69887}
2020-09-14 16:09:26 +00:00
Daniel Clifford
c84ca9c480 Port some SloppyArgumentsElements CSA code to Torque
Specifically, all the EmitKeyedSloppyArgumentsXXX methods.

Change-Id: I5d98c0f031b858e1e5342020f5ad68526c57c42a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235694
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69886}
2020-09-14 15:44:16 +00:00
Georg Neis
e371325bcb [compiler] Fix bug in SimplifiedLowering's overflow computation
It's unsound to ignore -0 inputs:
-0 - INT32_MIN is outside of INT32 range.

Bug: chromium:1126249
Change-Id: I3b92f16c1201705780acb0359975329aa2ca34d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404452
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69877}
2020-09-14 12:33:27 +00:00
Georg Neis
219b28bfe2 [turbofan] Fix bug in inlining
JSInliningHeuristic::Finalize did not take into account that by the
time it gets called some of the candidate nodes may have changed to
non-call operators.

Bug: chromium:1127319
Change-Id: I180ed36de98455be6b55790ba7bdb4391ff5fd5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2409273
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69874}
2020-09-14 12:01:55 +00:00
Manos Koukoutos
50813c34da [wasm-gc] Typecheck function-typed imported globals
Changes:
- Add optional WasmModuleObject field to WasmGlobalObject
- Introduce DynamicTypeCheckRef. Use it to typecheck imported global
  objects.
- Correctly typecheck imported WasmGlobalObjects.
- Add some testing infrastructure and one test file

Bug: v8:7748
Change-Id: Icc62d378d17696c5808d580f1ec84186c9556ec1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403248
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69872}
2020-09-14 11:25:05 +00:00
Camillo Bruni
dbe98c8090 [turbofan] Fix some tests
Stress configurations cause maps to be GC'ed too early.
We now keep them alive by storing the object in a global variable.

Bug: v8:10892
Change-Id: If03c42612d9907b3b6d0df8bb2de879857a89e0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404774
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69862}
2020-09-14 07:52:22 +00:00
evih
e9d3d232b7 [wasm] Use js-to-wasm generic wrapper for i32 and i64 params.
Currently, the generic wrapper is used for i32 and i64 params and 0 or 1
i32 return value.

Bug: v8:10701
Change-Id: I8c47e78fa9beeda01bdb647e1fcf9ebe6baf1ee4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403243
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69849}
2020-09-11 16:12:53 +00:00
Mythri A
798ca7fed4 [turboprop] Store minimorphic access info indexed on FeedbackSource
We used to store MinimorphicPropertyAccessInfo indexed on the feedback
slot id. This works fine when there is no inlining but returns the
wrong access information when functions are inlined. Index it
based on FeedbackSource to avoid these problems.

Bug: v8:10582,chromium:1125871
Change-Id: Id01010f3153f7e21495d73899a8604a64417ae95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2401426
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69845}
2020-09-11 11:38:11 +00:00
Georg Neis
17d4868c06 [turbofan] Fix some tests
- serializer-*:
In some stress configuration, the new map of x was GC'd at the beginning
of optimization, thus generating a soft-deopt for the store to x (thus
in turn skipping inlining of f).

- native-context-*:
In some stress configuration, f had its feedback flushed.

Bug: v8:10892
Change-Id: Icd9f9c0ba6feb938ae8c3b0031b02b766f2e3f91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404764
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69837}
2020-09-11 09:01:15 +00:00
Camillo Bruni
9a48abc519 [runtime][ic] Add CopyMutableHeapNumbersInObject helper
Factor out common loop for copying MutableHeapNumbers in newly copied
objects.

Bug: v8:10763
Change-Id: I6cf2fc52c9ac72253dceaba518deacfde9905a9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402035
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69825}
2020-09-10 18:32:40 +00:00
Shu-yu Guo
ed50458e6f Revert "Reland "[d8] Add d8 global variable""
This reverts commit 120eb38883.

Reason for revert: Maybe perturbed GC and caused optimization test to fail: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/33042?

Original change's description:
> Reland "[d8] Add d8 global variable"
> 
> This is a reland of 6798619a69
> 
> Original change's description:
> > [d8] Add d8 global variable
> >
> > - Add a a "d8" global variable where d8 can provide helpers.
> >   This in in preparation of adding d8.log for testing our log parsers
> >   written in JavaScript.
> >
> > - Separate d8 helper creation into individual functions.
> >
> > Bug: v8:1064
> > Change-Id: I84e434452463afb93ae403f890d8841b20b00703
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400990
> > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69801}
> 
> TBR=verwaest@chromium.org
> 
> Bug: v8:1064
> Change-Id: I656d550b5ec87dc52dbe6cbbdddf7151ce25031f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403247
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69819}

TBR=cbruni@chromium.org,mythria@chromium.org,verwaest@chromium.org

Change-Id: If6df69e30b097c78eb0ff2676f5e5c219edfae5b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:1064
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404323
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69823}
2020-09-10 18:30:29 +00:00
Camillo Bruni
120eb38883 Reland "[d8] Add d8 global variable"
This is a reland of 6798619a69

Original change's description:
> [d8] Add d8 global variable
>
> - Add a a "d8" global variable where d8 can provide helpers.
>   This in in preparation of adding d8.log for testing our log parsers
>   written in JavaScript.
>
> - Separate d8 helper creation into individual functions.
>
> Bug: v8:1064
> Change-Id: I84e434452463afb93ae403f890d8841b20b00703
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400990
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69801}

TBR=verwaest@chromium.org

Bug: v8:1064
Change-Id: I656d550b5ec87dc52dbe6cbbdddf7151ce25031f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403247
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69819}
2020-09-10 16:11:20 +00:00
Manos Koukoutos
79a1468831 [wasm][wasm-gc][test] Improve and extend Javascript testing API
Changes:
- Add possibility to define and emit all reference types.
- Simplify function locals definition.
- Change 'type' to 'type_index' where appropiate.

Bug: v8:7748
Change-Id: Ie35a6204369e678298ee2ff2ec7c7793c5315c3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390144
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69814}
2020-09-10 14:32:00 +00:00
Sathya Gunasekaran
d5cd5d2304 [turboprop] Mark test as slow
TBR: machenbach@chromium.org
Bug: v8:10894
Change-Id: Ie36e7cb3fe8e52478d96d24aab3517fbed29a817
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2403250
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69810}
2020-09-10 13:54:55 +00:00
Georg Neis
c8303fe67d [compiler] Fix bug in ContextRef::previous
My last CL introduced a null-pointer bug there.

Bug: chromium:1126771, v8:7790
Change-Id: Ib16317dea14c9fbad7951cb28ce7bb8bb9ce41c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2402037
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69799}
2020-09-10 09:22:05 +00:00
Andreas Haas
7c4b930242 Reland "[wasm][liftoff] Emit safepoints for externref values on the stack"
The emitted safepoint entries had the wrong size, because it did not
contain StandardFrameConstants::kFixedFrameSizeAboveFp. The code still
worked because the indices of encoded in the entries where too low by
StandardFrameConstants::kFixedFrameSizeAboveFp and thereby corrected
the invalid size. It worked as follows:

First the stack_slots_size gets calculated from the safepoint entry.
Then the position of a stack slot was
"frame_header_base + stack_slots_size - index * pointer_size", where
"index" is what is encoded in the safepoint map. Because of the incorrect
encoding, both stack_slot_size and index were too low by
StandardFrameConstants::kFixedFrameSizeAboveFp. Therefore the errors in
both values eliminated each other, making the end result correct.

With --print-code, the safepoint entry size was also read, and it
crashed because the encoded value was too low.

The reland fixes the indices.

Original message:

With this CL we emit safepoint maps for externref values on the Liftoff
value stack. With that there is support for externref parameters and
locals in Liftoff, as well as for intermediate values of type
externref.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I88444e57745d7b9fe8f1630e904d49736fa9d720
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398531
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69786}
2020-09-09 15:38:32 +00:00
Sathya Gunasekaran
92236da279 Revert "Reland "[test][d8] Add d8.log.getAndStop helper""
This reverts commit 23531d823c.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/33007?

Original change's description:
> Reland "[test][d8] Add d8.log.getAndStop helper"
> 
> This is a reland of 95aa697b2f
> 
> Original change's description:
> > [test][d8] Add d8.log.getAndStop helper
> >
> > The new helper function allows us to write tests for log parsing
> > without the need to first generating a log file. This makes it easier
> > to spot errors when the log format changes.
> >
> > - Add d8 global variable
> > - Add file_name accessor to Logger and Log classes
> > - Change OS::LogFileOpenMode to w+ / wb+
> > - Use separate Log::WriteLogHeader method
> > - Remove unused logger_ instance variable from Log
> >
> > Bug: v8:10644
> > Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> > Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> > Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69715}
> 
> Bug: v8:10644
> 
> TBR=verwaest@chromium.org
> 
> Change-Id: I54741344834d88a376b74e2e3a2047e880a94624
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396081
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69769}

TBR=mlippautz@chromium.org,cbruni@chromium.org,gsathya@chromium.org,verwaest@chromium.org

Change-Id: I493315e0d6498f0fa9bed3409725bb52d554b53a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2400982
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69770}
2020-09-09 11:46:16 +00:00
Camillo Bruni
23531d823c Reland "[test][d8] Add d8.log.getAndStop helper"
This is a reland of 95aa697b2f

Original change's description:
> [test][d8] Add d8.log.getAndStop helper
>
> The new helper function allows us to write tests for log parsing
> without the need to first generating a log file. This makes it easier
> to spot errors when the log format changes.
>
> - Add d8 global variable
> - Add file_name accessor to Logger and Log classes
> - Change OS::LogFileOpenMode to w+ / wb+
> - Use separate Log::WriteLogHeader method
> - Remove unused logger_ instance variable from Log
>
> Bug: v8:10644
> Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69715}

Bug: v8:10644

TBR=verwaest@chromium.org

Change-Id: I54741344834d88a376b74e2e3a2047e880a94624
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396081
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69769}
2020-09-09 11:20:34 +00:00
Martin Bidlingmaier
f2a832cadd [regexp] Support more quantifiers in experimental engine
Previously to this commit only quantifiers of the form /<x>*/, i.e.
arbitrarily often greedy repetition, were implemented.  Now a much
larger class is supported, e.g. + and ? and their non-greedy variants.
Because it came up repeatedly during the implementation, the commit also
adds the Label and DeferredLabel classes to patch JMP and FORK target
addresses more easily.

Still not supported are the following quantifiers:
- Possessive quantifiers, where I'm not entirely sure whether they could
  be implemented in principle. Re2 doesn't support them.
- Quantifiers with large but finite numbers for min and max numbers of
  repetitions, as in e.g. /<x>{9000, 90000}/. These are currently
  limited to some small value. This is because the body of such
  repetitions is unrolled explicitly, so the size of the bytecode is
  linear in the number of repetitions.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: Id04d893252588abb0f80c3cb33cfc707f6601ea0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387575
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69759}
2020-09-09 06:17:31 +00:00
Andreas Haas
1554c7eed8 Revert "[wasm][liftoff] Emit safepoints for externref values on the stack"
This reverts commit 10348e8eb6.

Reason for revert: https://crbug.com/1125951

Original change's description:
> [wasm][liftoff] Emit safepoints for externref values on the stack
> 
> With this CL we emit safepoint maps for externref values on the Liftoff
> value stack. With that there is support for externref parameters and
> locals in Liftoff, as well as for intermediate values of type
> externref.
> 
> R=​thibaudm@chromium.org
> 
> Bug: v8:7581
> Change-Id: I2df0a8d00b2da33fe06ff474b039cca4c7be726d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387571
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69725}

TBR=ahaas@chromium.org,thibaudm@chromium.org

Change-Id: I4cdf7fedfc91cd99302d5cb05e242dbb032c5803
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7581
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398529
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69754}
2020-09-08 18:48:17 +00:00
Sathya Gunasekaran
b45693010f Revert "[wasm][liftoff] Support for most externref globals"
This reverts commit e43ec59b4e.

Reason for revert: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8869719317069732832/+/steps/Check_-_d8/0/logs/externref-globals-liftoff/0

Original change's description:
> [wasm][liftoff] Support for most externref globals
> 
> With this CL we add support for all externref globals except for
> imported mutable globals.
> 
> R=​thibaudm@chromium.org
> 
> Bug: v8:7581
> Change-Id: I63cb26f8ad6f4b8fc1c276e223c5d45745122ebf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396086
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69741}

TBR=ahaas@chromium.org,thibaudm@chromium.org

Change-Id: I19d191862aa91a116ea84a4a59a3a0a8036fcb49
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7581
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2398643
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69744}
2020-09-08 14:18:05 +00:00
Andreas Haas
e43ec59b4e [wasm][liftoff] Support for most externref globals
With this CL we add support for all externref globals except for
imported mutable globals.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I63cb26f8ad6f4b8fc1c276e223c5d45745122ebf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396086
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69741}
2020-09-08 13:55:22 +00:00
evih
64b5926497 [wasm] Reverse the evaluation of params in js-to-wasm generic wrapper
The parameters should be processed and evaluated in an increasing order
(starting with the 1st param).
Before we started with the last (n-th) parameter which was not correct.

Bug: v8:10701, chromium:1124940
Change-Id: I8e0d8b1f0c53832c8f2d09551879c1a4413e1598
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396085
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69739}
2020-09-08 13:36:15 +00:00
Marja Hölttä
3d40ec8d99 [super property speed] Add an IC for super property loads
Bug: v8:9237
Change-Id: I06d7e74ba0360334e6fa65c19f24548e220e4c69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349297
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69735}
2020-09-08 12:28:05 +00:00
Mythri A
58164026fe [turboprop] Fix type info to also expect Smi for double data-field loads
An earlier cl:
https://chromium-review.googlesource.com/c/v8/v8/+/2354810 fixed loading
double fields with dynamic map checks. The fix however didn't update the
expected type information to also expect Smi fields. So, in the later
optimization phases the CheckHeapObject operation was reduced to a NoP
since the expected type was a HeapObject. This cl fixes the bug by
updating the type to Type::Any.

Bug: chromium:1124696, v8:10582
Change-Id: Ic96dd74c97caf8eaf5289d8e8939f6feb1686a57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396088
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69730}
2020-09-08 09:41:34 +00:00
Andreas Haas
10348e8eb6 [wasm][liftoff] Emit safepoints for externref values on the stack
With this CL we emit safepoint maps for externref values on the Liftoff
value stack. With that there is support for externref parameters and
locals in Liftoff, as well as for intermediate values of type
externref.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I2df0a8d00b2da33fe06ff474b039cca4c7be726d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387571
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69725}
2020-09-07 20:26:23 +00:00
Camillo Bruni
8bf237dd49 Revert "[test][d8] Add d8.log.getAndStop helper"
This reverts commit 95aa697b2f.

Reason for revert: breaks under tsan

Original change's description:
> [test][d8] Add d8.log.getAndStop helper
> 
> The new helper function allows us to write tests for log parsing
> without the need to first generating a log file. This makes it easier
> to spot errors when the log format changes.
> 
> - Add d8 global variable
> - Add file_name accessor to Logger and Log classes
> - Change OS::LogFileOpenMode to w+ / wb+
> - Use separate Log::WriteLogHeader method
> - Remove unused logger_ instance variable from Log
> 
> Bug: v8:10644
> Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69715}

TBR=mlippautz@chromium.org,cbruni@chromium.org,gsathya@chromium.org,verwaest@chromium.org

Change-Id: Iad47d2f1e3391cae3c2f8c9e6c904c43925e1671
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2396080
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69717}
2020-09-07 14:12:48 +00:00
Camillo Bruni
95aa697b2f [test][d8] Add d8.log.getAndStop helper
The new helper function allows us to write tests for log parsing
without the need to first generating a log file. This makes it easier
to spot errors when the log format changes.

- Add d8 global variable
- Add file_name accessor to Logger and Log classes
- Change OS::LogFileOpenMode to w+ / wb+
- Use separate Log::WriteLogHeader method
- Remove unused logger_ instance variable from Log

Bug: v8:10644
Change-Id: Ifc7e35aa4e91b3f01f0847843263946e085944c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387563
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69715}
2020-09-07 12:29:03 +00:00
evih
17cda1e6f1 [wasm] Use generic js-to-wasm wrapper for 0 or 1 int32 return case
The generic wrapper can be used for Wasm functions with int32 parameters
and 0 or 1 int32 return values.

Added tests for cases when the return value can & cannot be converted to
a Smi.

Bug: v8:10701
Change-Id: I470954ed0aced0e4ec6e65a9f38caac19c576549
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2390141
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69700}
2020-09-03 14:47:00 +00:00
Santiago Aboy Solanes
634c2a63e0 [csa][cleanup] Remove non-Tnodified IntPtrT version of LoadObjectField
There is an int version that will be TNodified in a follow-up CL.

Bug: v8:9708, v8:6949
Change-Id: I3a47cb352396dfe9dea426b6396216c06e0e3254
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387963
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69695}
2020-09-03 11:53:20 +00:00
Ng Zhi An
b72bd14f13 Force test to not run on unsupported SIMD platforms
Due to the way SSE flags work, we need to enable all versions prior to
SSE 4.1 as well.

Bug: v8:10863
Change-Id: I50ddd3f486641e7bf22c651fc2c9a8a4ccbc2b46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391325
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69687}
2020-09-02 23:07:49 +00:00
Ng Zhi An
78b2a154d8 Revert the change to skip test using nosse41 check
With https://crrev.com/c/2389982 we are now forcing the sse flag in this
test, so we no longer need the flag check. Keep it around for the other
archs.

The nosse41 condition will be removed from the test runner in the next
patch.

Bug: v8:10863
Change-Id: I7eacb21803e6cc810384d3e4881d2a965dc1ad69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2391320
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69684}
2020-09-02 21:04:19 +00:00
Martin Bidlingmaier
943f78a4ec [regexp] Fix usage of {Is,Mark}PcProcessed in NfaInterpreter
Previously we checked whether a thread's pc IsPcProcessed before pushing
to the stack of (postponed) active_threads_.  This commit moves the
IsPcProcessed check and corresponding MarkPcProcessed call to when the
thread is actually processed, i.e. when it is popped from the
active_threads_ stack again.

This fixes two issues:
- Consider what used to happen in the following scenario:
1. An active thread t is postponed (e.g. because it is a fork) and
 pushed on active_threads_.  IsPcProcessed(t.pc) is false, so t is
 not discarded and does actually end up on active_threads_.
2. Some other thread s is executed, and at some point s.pc == t.pc,
 i.e. t.pc is marked as processed.
3. t is popped from active_threads_ for processing.

In 3 we don't want to continue execution of t: After all, its pc is
already marked as processed.  But because previously we only checked
for IsPcProcessed in step 1 before pushing to active_threads_, we used
to continue execution in 3.  I don't think this is a correctness
issue, but possibly a performance problem.  In any case, this commit
moves the IsPcProcessed check from 1 to 3 and so fixes this.
- After flushing blocked_threads_, we push them to active_threads_
again.  While doing so, we used to mark these thread's pcs as processed.
This meant that sometimes a (fork of a) high priority thread was
cancelled by the IsPcProcessed check even though its pc was only
marked as processed by a thread with lower priority during flushing.
We need it to be the other way round:  The low priority thread should
be cancelled after its pc is processed by a thread with higher
priority.
With this commit we don't MarkPcProcessed during flushing, it's
postponed to when we're actually processing.  This was a correctness
issue, and there's a new corresponding test case.


Bug: v8:10765
Change-Id: Ie12682cf3f8a04222d907edd8a3ad25baa69465a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2388112
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69668}
2020-09-02 11:32:35 +00:00
Michael Achenbach
b22aa7865a [test] Make test compatible with numfuzz
The test is incompatible with --noenable-sse4-1, which is randomly
added by numfuzz (and possibly other fuzzers).

The "Flags" from the test files are always passed last and are often
used to neuter incompatible flags.

Bug: v8:10863
Change-Id: I8fd11b4d38586f25f5af63ab8ef83873dc250557
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2389982
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69665}
2020-09-02 10:28:20 +00:00
Arno Renevier
d022b74c4e [builtins] Use fast path for JSArray source in TypedArray.from()
For TypedArray, a fast path is used when using the builtin iterator, and
next method has not been overriden. If we use that fast path for JSArray
too, the method will be about 200x times faster on a large array.

This patch also fixes a bug when a typed array is modified during the
mapper execution. In that case, the modification should not be taken
into account.

Bug: v8:10802

Change-Id: I74e2cbcd6a654def318585b4e08745037584669a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2358749
Commit-Queue: Arnaud Renevier <arenevier@fb.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69655}
2020-09-01 20:53:19 +00:00
Andreas Haas
10e2311f8a [test] Enable --wasm-tier-up when test does serialization
With a recent change, we require WebAssembly code to be tiered up to
serialize it, see https://crrev.com/c/2349290. In that CL tests were
adjusted to set the --wasm-tier-up flag when serialization was involved.
However, the test adjusted in this CL was missing, because this test
used the kExprRefNull instruction, which caused a bailout to TurboFan
anyways. With recent changes, Liftoff can compile kExprRefNull now,
and therefore causes problems.

R=thibaudm@chromium.org

Bug: v8:10852
Change-Id: I9b89f37c22f17cbf046110f3ee1c98bfea73e009
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2387574
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69648}
2020-09-01 15:35:09 +00:00
evih
42fcb2c25f [wasm] Use generic js-to-wasm wrapper for n int32 param case
The generic wrapper can be used for Wasm functions with int32 parameters
and no return values.

Changed the GC scanning for the generic wrapper.

Added tests for cases when all the parameters of the Wasm function fit
into registers and when some of the parameters are on the top of the
stack.

Change-Id: I511fd04d2a4a2bdc4a6f72d72e2867a03b256f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2381459
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69645}
2020-09-01 12:31:09 +00:00
Milad Farazmand
db837d580f PPC/s390: [wasm-simd][mips] Skip test on arch without SIMD
Port 524fa743da

Original Commit Message:

    This regression test does not work on MIPS without SIMD since the scalar
    lowering is not complete yet. Skip it for now.

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I0338593de3160dc0864c066e607b6030956e3efa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2386141
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69629}
2020-08-31 20:28:15 +00:00
Ng Zhi An
524fa743da [wasm-simd][mips] Skip test on MIPS without SIMD
This regression test does not work on MIPS without SIMD since the scalar
lowering is not complete yet. Skip it for now.

Bug: v8:10831
Change-Id: Icc407488a96d4c965c1cf956f7a74abde078d421
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2385855
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69626}
2020-08-31 18:14:45 +00:00
Martin Bidlingmaier
136670652c [regexp] Support some non-trivial EXPERIMENTAL patterns
This CL adds support for disjunctions and some quantification in
EXPERIMENTAL regexp patterns. It is implemented using a new bytecode
format and an NFA-based breadth-first interpreter.

R=jgruber@chromium.org

Bug: v8:10765
Change-Id: Idd49a3bbc9a9fcc2be80d822c9d84a638e53e777
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2370634
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69621}
2020-08-31 11:09:43 +00:00
Jakob Gruber
f8061c6c66 [compiler] Revisit graph end after a gasm reduction in call reducer
The graph assembler calls MergeControlToEnd as part of Unreachable
node creation; this causes issues when used inside the GraphReducer
framework, since the reducer is not notified by gasm that the end node
should be revisited.

The (hacky) fix in this CL is to always mark the end node for
revisitation after a gasm reduction has taken place.

Bug: v8:8888,chromium:1123379
Change-Id: I350bb7144add04a0c3fd7f3d88c07fcfe1cd42e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2384772
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69619}
2020-08-31 10:40:03 +00:00
Jakob Kummerow
b5a33ebafe [test] Make a few tests robust to GC stress
A recent unrelated change caused these tests to get unlucky in
GC stress mode. Their "assertOptimized" expectations rely on
certain type feedback data not getting flushed at the wrong time.

Bug: v8:10846
Change-Id: I86d0b0c049539e4a69aa764cc6ec92465ca12beb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2381458
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69617}
2020-08-31 08:37:16 +00:00
Ng Zhi An
ab23ff3c0e [ia32][wasm-simd] Fix aligned moves in codegen
For SIMD instructions that use aligned moves (like movaps or movapd), we
don't have correct memory alignment for SIMD moves yet. Switch to to
movupd.

Bug: v8:9198
Bug: v8:10831
Change-Id: Ic60fba5d08dda9676f6091ce505ac7be54957d00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2380240
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69613}
2020-08-28 22:59:56 +00:00
Clemens Backes
1512f89328 [asm] Fix globals initialized by '-0'
Those globals must have type float instead of int to preserve the sign
bit.

R=ahaas@chromium.org

Bug: chromium:1069173
Change-Id: I9769f47f087aaba94a6172118be44f70adeded0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2379861
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69609}
2020-08-28 15:19:16 +00:00
Victor Gomes
a695cb403c [test] Add short copyright to regress-1120905.js
Change-Id: I49dbd52b9019b1da94dfa91c73116e827ce74ca4
Bug: chromium:1120905, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2377689
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69592}
2020-08-27 20:58:05 +00:00
Arnaud Robin
6ad8193be2 [wasm] Add priorities for function compilation
In order to improve our tiering strategy, it is a good idea to start
by tiering up functions that will be used the most, as this is done in
most JavaScript engines.

To decide which function requires tiering, we use as a basic strategy
to define its compilation priority to 'func_size * number_of_calls',
this roughly approximates the time we spend in the function.

To handle prioritization, it seemed that using  a concurrent
priority queue similar to BigUnits was causing concurrencies issues.
I then decided to use different priority queues for each worker thread.

R=clemensb@chromium.org
CC=thibaudm@chromium.org

Bug: v8:10728
Change-Id: I6f314468549000b2a9b51d3d470f04a0cb997879
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2367859
Commit-Queue: Arnaud Robin <arobin@google.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69585}
2020-08-27 13:42:55 +00:00
Victor Gomes
d721dc8f14 [deoptimizer] Reverse arguments in DoComputeArgumentsAdaptorFrame
Change-Id: I31e205b696627913584016bb9197e1e719ca0237
Bug: chromium:1120905, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375191
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69565}
2020-08-26 07:43:58 +00:00
Andreas Haas
289c15eb6d [wasm][liftoff] Allow reftype results, and implement ref.null
This CL is the start to implement reference types support in Liftoff.
As a first step this CL implements the ref.null instruction, and allows
reference types as return values. This allows register allocation to be
extended to support reference types, and also adds an easy way to get a
reference type value for tests. Additionally with ref.null we don't have
to worry about garbage collection because 'null' is an immovable object
and therefore does not have to be scanned by the GC.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I5785dcf522c0d9881e1386f2d8b5d8560a16225c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352784
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69556}
2020-08-25 14:15:53 +00:00
Jakob Gruber
b9b25d1289 [nci] Skip regress-1112155 in nci test modes
NCI code deopts differently than TF code.

Tbr: mythria@chromium.org
Bug: v8:8888
Change-Id: Ica1352ed5aba648c95a8a26fd6c2dd703b0f335c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375186
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69555}
2020-08-25 14:09:33 +00:00
Mythri A
3551cac6da [turboprop] For double data fields check loaded value is HeapNumber
With in-place representation changes we can transition from a double
field to a Tagged field without changing the map. So it is not always
safe to assume the loaded value would be a HeapNumber. TurboFan takes a
dependency on the field representation to ensure the code is deoptimized
on any changes. With dynamic map checks, it is not possible to take such
a dependency. Hence check the loaded value is a HeapNumber and
deoptimize otherwise.

Bug: chromium:1112155,v8:10582
Change-Id: I910ac1c0781ac8842fdbf272f9173b55b02923ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2354810
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69521}
2020-08-21 17:00:47 +00:00
Jakob Gruber
faed29869f [nci] Change testing mode to --turbo-nci-as-midtier
To properly test tier-up in the V8 test suite, change the test variant
previously called --turbo-nci-as-highest-tier to
--turbo-nci-as-midtier.  As a midtier (between ignition and turbofan),
all major parts of the NCI pipeline (codegen, caching inside the same
native context, tier-up) are exercised by test suite.

Bug: v8:8888
Change-Id: Ic8ee2f3e3d72768c3869f5e0b25800dd0a5f25b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2361462
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69501}
2020-08-20 12:54:40 +00:00
Clemens Backes
10a434f37e Revert "[test] Disable asm-wasm regression test"
This reverts commit f0bade979d.

Reason for revert: Culprit CL reverted: https://crrev.com/c/2364504

Original change's description:
> [test] Disable asm-wasm regression test
> 
> Bug: v8:10813
> Change-Id: Ib7b3949147706552a6d569ad5fcd22f2f63d7977
> No-Try: True
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2364496
> Auto-Submit: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69479}

TBR=clemensb@chromium.org,mslekova@chromium.org

Change-Id: I8047db66eba1e2221654d7018c661551950f2194
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10813
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2366712
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69494}
2020-08-20 06:27:42 +00:00
Ng Zhi An
a85b5a63f6 [wasm-simd] Fix bounds check for load extends
Load extends always load 8 bytes, so the access size does not depend on
MachineType of the load. The MachineType is used for classifying the
lane shape of the 8-byte load.

Also add cctest to load splats and load extends to test OOB. (Note that
load splats access size depends on MachineType).

Add regression test from clusterfuzz, minimized by ahaas@. Remove the
`--no-wasm-trap-handler` flag since we have a no_wasm_traps variant that
should test this flag.

Bug: chromium:1116019
Change-Id: I27ba051d0536ca0f6fd75dd641ca9b78132dafed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2363291
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69489}
2020-08-19 18:26:17 +00:00
Maya Lekova
f0bade979d [test] Disable asm-wasm regression test
Bug: v8:10813
Change-Id: Ib7b3949147706552a6d569ad5fcd22f2f63d7977
No-Try: True
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2364496
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69479}
2020-08-19 13:49:11 +00:00
Andreas Haas
74b907aeff [wasm] Add some simd opcodes to the wasm-module-builder
The V8 wasm fuzzer can create regression tests for failing fuzzer cases.
These regression tests use the wasm-module-builder.js. With the addition
of simd to the wasm-compile-fuzzer, the fuzzer can now create test cases
that use simd instructions, but the wasm-module-builder.js did not know
yet about the new instructions. This CL adds some instructions to
wasm-module-builder.js.

R=zhin@chromium.org

Bug: chromium:1116019
Change-Id: I198e4f11c2225a65d6b438f95e351fc14ee66218
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362694
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69467}
2020-08-18 21:02:43 +00:00
Shu-yu Guo
985a9ddaa1 Fix "name" property of %ThrowTypeError% to be spec-conformant
This is a normative PR that reached consensus at the June 2019 TC39:
https://github.com/tc39/test262/pull/2299

Bug: v8:9646
Change-Id: Idbeea703fe264da43825729e7b37a08a1bb10001
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2360907
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69466}
2020-08-18 19:36:53 +00:00
Shu-yu Guo
048761aa0f Install "name" property on anonymous classes
This is a normative PR that reached consensus at the June 2019 TC39:
https://github.com/tc39/test262/pull/2299

Bug: v8:9646
Change-Id: I8cb927b9e9231dfb71ebf47171205a096350e38b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2360905
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69460}
2020-08-18 16:41:23 +00:00
Thibaud Michaud
65d28a7fe4 [wasm][mv] Enable wasm multi-value
R=ahaas@chromium.org

Bug: chromium:1097717
Change-Id: I6c5a0a32191c9a06fd894c8fe7d9367e9403de8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2362956
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69459}
2020-08-18 16:21:43 +00:00
evih
ddc3672d91 [wasm] Add GC support to generic js-to-wasm wrapper
GC support works for the current 0 and 1 param version
of the wrapper.

Bug: v8:10701
Change-Id: I9e3822b1481223c44050d23ddee7293936f1e6d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2351673
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69447}
2020-08-18 09:28:34 +00:00
Ng Zhi An
360c9294a8 [wasm-simd] Support returning Simd128 on caller's stack
In Liftoff, we were missing kS128 cases to load to/from stack.

For the x64 and ARM64 instruction selector, the calculation of
reverse_slot is incorrect for 128-bit values:

- reverse_slot += 2 (size of 128-bit values, 2 pointers)
- this copies from slot -2 into register
- but the value starts at slot -1, it occupies slots -1 and -2
- we end up copying slot -2 (most significant half) of the register, and
also slot -3, which is where rsi was store (Wasm instance addr)
- the test ends up with a different result every time

The calculation of reverse_slot is changed to follow how ia32 and ARM
does it, which is to start with

- reverse_slot = 0
- in the code-generator, add 1 to the slot
- then after emitting Peek operation, reverse_slot += 2

The fixes for x64 and ARM64 are in both instruction-selector and
code-generator.

ia32 and ARM didn't support writing kSimd128 values yet, it was only a
missing check in code-generator, so add that in.

For ARM, the codegen is more involved, vld1 does not support addressing
with an offset, so we have to do the addition into a scratch register.

Also adding a test for returning multiple v128. V128 is not exposed to
JavaScript, so we use a Wasm function call, and then an involved chain
of extract lanes, returning 6 i32 which we verify the values of. It
extracts the first and last lane of the i32x4 value in order to catch
bugs where we write or read to a wrong stack slot (off by 1).

The simd-scalar-lowering for kCall was only handling single s128 return,
we adopt the way i64-lowering handles kCall, so that is can now handle
any kinds of calls with s128 in the descriptor.

Bug: v8:10794
Bug: chromium:1115230
Change-Id: I2ccdd55f6292bc5794be78053b27e14da8cce70e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2355189
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69439}
2020-08-17 20:59:54 +00:00
Francis McCabe
a575608555 Revert "Reland^3 "[flags] warn about contradictory flags""
This reverts commit dc18b82221.

Reason for revert: still causing failures: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/31566

Original change's description:
> Reland^3 "[flags] warn about contradictory flags"
> 
> This is a reland of 0ba115e6a9
> Changes:
> - Also allow second parameter influenced by --cache to be reassigned.
> - Fix --stress-opt to only --always-opt in the last iteration as before.
> 
> Original change's description:
> > Reland^2 "[flags] warn about contradictory flags"
> >
> > This is a reland of d8f8a7e210
> > Change compared to last reland:
> > - Do not check for d8 flag contradictions in the presence of --fuzzing
> > - Allow identical re-declaration of --cache=*
> >
> > Original change's description:
> > > Reland "[flags] warn about contradictory flags"
> > >
> > > This is a reland of b8f9166664
> > > Difference to previous CL: Additional functionality to specify
> > > incompatible flags based on GN variables and extra-flags, used
> > > to fix the issues that came up on the waterfall.
> > >
> > > This also changes the rules regarding repeated flags: While
> > > explicitly repeated flags are allowed for boolean values as long
> > > as they are identical, repeated flags or explicit flags in the
> > > presence of an active implication are disallowed for non-boolean
> > > flags. The latter simplifies specifying conflict rules in
> > > variants.py. Otherwise a rule like
> > >
> > > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> > >   "--gc-interval=*": ["--gc-interval=*"],
> > > }
> > >
> > > wouldn't work because specifying the same GC interval twice
> > > wouldn't actually count as a conflict. This was an issue with
> > > test/mjsunit/wasm/gc-buffer.js, which specifies
> > > --gc-interval=500 exactly like the extra flag by the stress bot.
> > >
> > > Also, this now expands contradictory flags checking to d8 flags
> > > for consistency.
> > >
> > > Original change's description:
> > > > [flags] warn about contradictory flags
> > > >
> > > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > > >
> > > > Bug: v8:10577
> > > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#68168}
> > >
> > > Bug: v8:10577
> > > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#68989}
> >
> > Bug: v8:10577
> > Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69339}
> 
> Bug: v8:10577
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
> Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
> Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69433}

TBR=machenbach@chromium.org,neis@chromium.org,clemensb@chromium.org,tebbi@chromium.org,tmrts@chromium.org

Change-Id: I4ccdd7b931d0ddccbcec1d6cfae8d4874ee49cfc
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10577
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2360414
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69438}
2020-08-17 19:34:18 +00:00
Tobias Tebbi
dc18b82221 Reland^3 "[flags] warn about contradictory flags"
This is a reland of 0ba115e6a9
Changes:
- Also allow second parameter influenced by --cache to be reassigned.
- Fix --stress-opt to only --always-opt in the last iteration as before.

Original change's description:
> Reland^2 "[flags] warn about contradictory flags"
>
> This is a reland of d8f8a7e210
> Change compared to last reland:
> - Do not check for d8 flag contradictions in the presence of --fuzzing
> - Allow identical re-declaration of --cache=*
>
> Original change's description:
> > Reland "[flags] warn about contradictory flags"
> >
> > This is a reland of b8f9166664
> > Difference to previous CL: Additional functionality to specify
> > incompatible flags based on GN variables and extra-flags, used
> > to fix the issues that came up on the waterfall.
> >
> > This also changes the rules regarding repeated flags: While
> > explicitly repeated flags are allowed for boolean values as long
> > as they are identical, repeated flags or explicit flags in the
> > presence of an active implication are disallowed for non-boolean
> > flags. The latter simplifies specifying conflict rules in
> > variants.py. Otherwise a rule like
> >
> > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> >   "--gc-interval=*": ["--gc-interval=*"],
> > }
> >
> > wouldn't work because specifying the same GC interval twice
> > wouldn't actually count as a conflict. This was an issue with
> > test/mjsunit/wasm/gc-buffer.js, which specifies
> > --gc-interval=500 exactly like the extra flag by the stress bot.
> >
> > Also, this now expands contradictory flags checking to d8 flags
> > for consistency.
> >
> > Original change's description:
> > > [flags] warn about contradictory flags
> > >
> > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > >
> > > Bug: v8:10577
> > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#68168}
> >
> > Bug: v8:10577
> > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68989}
>
> Bug: v8:10577
> Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69339}

Bug: v8:10577
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Change-Id: I4a69dc57a102782cb453144323e3752ac8278624
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352770
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69433}
2020-08-17 15:59:43 +00:00
Marja Hölttä
97846e0357 [Atomics.waitAsync] Add regression test
Bug: v8:10239, chromium:1115354
Change-Id: I64b028b383dcff1e4224c945ee1f982d1979eb9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2354813
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69430}
2020-08-17 15:36:53 +00:00
Thibaud Michaud
20728eeb09 [wasm] Disable multi-value
Temporarily disable multi-value until the launch is approved.

R=ahaas@chromium.org

Bug: chromium:1097717
Change-Id: Ifb2370d87ec5e531257852bc5fc5259386a022d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2358675
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69419}
2020-08-17 10:33:42 +00:00
Manos Koukoutos
dd152527d6 [wasm-gc] Implement call_ref, return_call_ref, add some basic tests
Drive-by: Add flag implications for wasm experimental features:
  gc -> typed_funcref, typed_funcref -> reftypes.

Bug: v8:9495
Change-Id: Ia6054886935d68e79b8f463289aa9e1e9d6484f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352777
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69403}
2020-08-14 17:58:27 +00:00
Shu-yu Guo
6962221295 [atomics] Relax Atomics methods to work on ArrayBuffers
This reached consensus in the March 2020 TC39.
https://github.com/tc39/ecma262/pull/1908

This aligns JS with wasm, which allows atomics operations on non-shared
linear memory.

Bug: v8:10687, v8:9921
Change-Id: I7b60473b271cee6bccb342e97a4fd3781aedddb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2330802
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69392}
2020-08-13 22:10:07 +00:00
Clemens Backes
df32131b3e [wasm] Speed up multiple-code-spaces test
TurboFan generates significantly less code than Liftoff for this test,
and depending on timing it can happen that we need to generate thousands
of functions, which takes some time and occasionally runs into timeouts.
Thus disable tier-up for this test, such that we stick with the much
longer Liftoff code, and reach the four separate code spaces quicker.

R=ahaas@chromium.org

Change-Id: I8e9a0cb466c1bdfef29aceeb5dd31aa96d05b70b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2352490
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69369}
2020-08-13 08:51:03 +00:00
Ng Zhi An
9b9c6b0ed9 Reland "[wasm-simd][arm] Use vmov to move all ones to register"
This is a reland of 57242a051e

no-sse4.1 builds were failing due to missing simd-scalar-lowering
for s128.const, this reland adds that implementation.

Original change's description:
> [wasm-simd][arm] Use vmov to move all ones to register
>
> vceq(dst, dst, dst) does not seem to always set the register to all
> ones. The right way should be be to use vmov (immediate) anyway. This
> was not supported in the assembler yet, so we need changes to the
> assembler, diassembler, and simulator.
>
> There is an unfortunate fork in logic in the simulator, due to the way
> the switches are set up, vmov (imm) logic is duplicated across two
> different cases, because the switch looks at the top bit of the
> immediate. Refactoring this will be a bigger change that is irrelevant
> for this bug, so I'm putting that off for now. Instead we extract the
> core of vmov (imm) into helpers and call it in the two cases.
>
> Bug: chromium:1112124
> Change-Id: I283dbcd86cb0572e5ee720835f897b51fae96701
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2337503
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69315}

Bug: chromium:1112124
Change-Id: Id450e5cea41f7a569e49be8386a7788ca8f00658
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346937
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69346}
2020-08-11 19:47:06 +00:00
Bill Budge
7e9322335e Revert "Reland^2 "[flags] warn about contradictory flags""
This reverts commit 0ba115e6a9.

Reason for revert: Breaks test on TSAN - block-conflicts
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/14230

Original change's description:
> Reland^2 "[flags] warn about contradictory flags"
> 
> This is a reland of d8f8a7e210
> Change compared to last reland:
> - Do not check for d8 flag contradictions in the presence of --fuzzing
> - Allow identical re-declaration of --cache=*
> 
> Original change's description:
> > Reland "[flags] warn about contradictory flags"
> >
> > This is a reland of b8f9166664
> > Difference to previous CL: Additional functionality to specify
> > incompatible flags based on GN variables and extra-flags, used
> > to fix the issues that came up on the waterfall.
> >
> > This also changes the rules regarding repeated flags: While
> > explicitly repeated flags are allowed for boolean values as long
> > as they are identical, repeated flags or explicit flags in the
> > presence of an active implication are disallowed for non-boolean
> > flags. The latter simplifies specifying conflict rules in
> > variants.py. Otherwise a rule like
> >
> > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> >   "--gc-interval=*": ["--gc-interval=*"],
> > }
> >
> > wouldn't work because specifying the same GC interval twice
> > wouldn't actually count as a conflict. This was an issue with
> > test/mjsunit/wasm/gc-buffer.js, which specifies
> > --gc-interval=500 exactly like the extra flag by the stress bot.
> >
> > Also, this now expands contradictory flags checking to d8 flags
> > for consistency.
> >
> > Original change's description:
> > > [flags] warn about contradictory flags
> > >
> > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > >
> > > Bug: v8:10577
> > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#68168}
> >
> > Bug: v8:10577
> > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68989}
> 
> Bug: v8:10577
> Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69339}

TBR=machenbach@chromium.org,neis@chromium.org,clemensb@chromium.org,tebbi@chromium.org,tmrts@chromium.org

Change-Id: I1454a05e357ddd704db7fb79e51be65d45a9a16e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2348365
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69341}
2020-08-11 17:12:07 +00:00
Tobias Tebbi
0ba115e6a9 Reland^2 "[flags] warn about contradictory flags"
This is a reland of d8f8a7e210
Change compared to last reland:
- Do not check for d8 flag contradictions in the presence of --fuzzing
- Allow identical re-declaration of --cache=*

Original change's description:
> Reland "[flags] warn about contradictory flags"
>
> This is a reland of b8f9166664
> Difference to previous CL: Additional functionality to specify
> incompatible flags based on GN variables and extra-flags, used
> to fix the issues that came up on the waterfall.
>
> This also changes the rules regarding repeated flags: While
> explicitly repeated flags are allowed for boolean values as long
> as they are identical, repeated flags or explicit flags in the
> presence of an active implication are disallowed for non-boolean
> flags. The latter simplifies specifying conflict rules in
> variants.py. Otherwise a rule like
>
> INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
>   "--gc-interval=*": ["--gc-interval=*"],
> }
>
> wouldn't work because specifying the same GC interval twice
> wouldn't actually count as a conflict. This was an issue with
> test/mjsunit/wasm/gc-buffer.js, which specifies
> --gc-interval=500 exactly like the extra flag by the stress bot.
>
> Also, this now expands contradictory flags checking to d8 flags
> for consistency.
>
> Original change's description:
> > [flags] warn about contradictory flags
> >
> > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> >
> > Bug: v8:10577
> > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68168}
>
> Bug: v8:10577
> Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68989}

Bug: v8:10577
Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69339}
2020-08-11 15:58:44 +00:00
Clemens Backes
cdd984ef48 Reland "[wasm] Ensure that only TurboFan code is serialized"
This is a reland of 60ee70bb40.
The wasm c-api flakes were fixed in https://crrev.com/c/2349293.

Original change's description:
> [wasm] Ensure that only TurboFan code is serialized
>
> We have the implicit assumption that Liftoff code will never be
> serialized, and we start relying on that when implementing new features
> (debugging, dynamic tiering).
>
> This CL makes the serializer fail if the module contains any Liftoff
> code. Existing tests are changed to ensure that we fully tiered up
> before serializing a module (similar to the logic in Chromium).
> The "wasm-clone-module" test needs to serialize the module before
> enabling the debugger.
>
> Note that chrome currently only serializes a module after it fully
> tiered up, so that should be fine. If other embedders need the ability
> to serialize a module in an arbitrary state, we will have to fix this
> later. With this CL we will be on the safe side though and (gracefully)
> fail serialization instead of accidentally serializing Liftoff code.
>
> R=ahaas@chromium.org
>
> Bug: v8:10777
> Change-Id: I1245e5f7fda3447a544c1e3525e1239cde759174
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336799
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69276}

Bug: v8:10777
Change-Id: I2a7c1429812ca46d88a2902b8e0a7b7e3d638b56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349290
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69335}
2020-08-11 14:43:58 +00:00
Shu-yu Guo
a36f40cb3f [atomics] Remove the deprecated Atomics.wake
The Intent to Deprecate and Remove was sent in March 2019:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/_zPuM7ETNSE

Current use of Atomics.wake is at <0.0002% of page loads:
https://chromestatus.com/metrics/feature/timeline/popularity/2556

Bug: v8:7883
Change-Id: I4534df6cb88e0afbeae655254d6ce48ad7b462e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333349
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69317}
2020-08-10 23:02:17 +00:00
Bill Budge
ff503fd433 Revert "[wasm-simd][arm] Use vmov to move all ones to register"
This reverts commit 57242a051e.

Reason for revert: regression tests fails:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/31477

Original change's description:
> [wasm-simd][arm] Use vmov to move all ones to register
> 
> vceq(dst, dst, dst) does not seem to always set the register to all
> ones. The right way should be be to use vmov (immediate) anyway. This
> was not supported in the assembler yet, so we need changes to the
> assembler, diassembler, and simulator.
> 
> There is an unfortunate fork in logic in the simulator, due to the way
> the switches are set up, vmov (imm) logic is duplicated across two
> different cases, because the switch looks at the top bit of the
> immediate. Refactoring this will be a bigger change that is irrelevant
> for this bug, so I'm putting that off for now. Instead we extract the
> core of vmov (imm) into helpers and call it in the two cases.
> 
> Bug: chromium:1112124
> Change-Id: I283dbcd86cb0572e5ee720835f897b51fae96701
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2337503
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69315}

TBR=bbudge@chromium.org,jkummerow@chromium.org,v8-arm-ports@googlegroups.com,zhin@chromium.org

Change-Id: I5d9d1dcb81771f71001d959ec5a03a43a11c4233
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1112124
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2347211
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69316}
2020-08-10 21:10:08 +00:00
Ng Zhi An
57242a051e [wasm-simd][arm] Use vmov to move all ones to register
vceq(dst, dst, dst) does not seem to always set the register to all
ones. The right way should be be to use vmov (immediate) anyway. This
was not supported in the assembler yet, so we need changes to the
assembler, diassembler, and simulator.

There is an unfortunate fork in logic in the simulator, due to the way
the switches are set up, vmov (imm) logic is duplicated across two
different cases, because the switch looks at the top bit of the
immediate. Refactoring this will be a bigger change that is irrelevant
for this bug, so I'm putting that off for now. Instead we extract the
core of vmov (imm) into helpers and call it in the two cases.

Bug: chromium:1112124
Change-Id: I283dbcd86cb0572e5ee720835f897b51fae96701
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2337503
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69315}
2020-08-10 20:41:46 +00:00
Andreas Haas
c392760843 [api] Add API function Isolate::HasPendingBackgroundTasks
This CL adds an API function that tells the embedder if there is ongoing
background work that will eventually post foreground tasks.

Design doc: https://docs.google.com/document/d/18vaABH1mR35PQr8XPHZySuQYgSjJbWFyAW63LW2m8-w

R=adamk@chromium.org

Bug: v8:10787
Change-Id: I9060c5cdc9dbafeb7ea7c5c26d09c2dc744800bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2342847
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69312}
2020-08-10 17:10:36 +00:00
Mythri Alle
68043a0948 Revert "[tuboprop] Disable dynamic map checks for TurboProp"
This reverts commit 07815e876d.

Reason for revert: Dynamic map checks for Turboprop was temporarily disabled to measure impact. Enabling it again.

Original change's description:
> [tuboprop] Disable dynamic map checks for TurboProp
> 
> Temporarily turnoff dynamic map checks for TurboProp to measure the
> impact after changing OSR heuristics.
> 
> Bug: v8:10582, v8:9684
> Change-Id: Ia458be139bf7c281bda40cbcd76e7a0c3fa5d60b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343070
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69294}

TBR=rmcilroy@chromium.org,mythria@chromium.org,gsathya@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10582
Bug: v8:9684
Change-Id: If985b6ff2641f33d0f53cbff6cc668d8c77d2bda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2345965
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69303}
2020-08-10 09:50:25 +00:00
evih
389272acb0 [wasm] Use generic js-to-wasm wrapper for 0 and 1 param cases
A new field for signature type was added to WasmExportedFunctionData.
It is set to 0 or 1 depending on the parameter count.
(It's set and being used only in 0 and 1 parameter cases.)

Added new JS tests for 1 parameter wasm functions.

Bug: v8:10701
Change-Id: I349d881a2860f1a50b91e08d0126ca71c5f6483b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339622
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69302}
2020-08-10 09:44:05 +00:00
Mythri A
07815e876d [tuboprop] Disable dynamic map checks for TurboProp
Temporarily turnoff dynamic map checks for TurboProp to measure the
impact after changing OSR heuristics.

Bug: v8:10582, v8:9684
Change-Id: Ia458be139bf7c281bda40cbcd76e7a0c3fa5d60b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343070
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69294}
2020-08-07 15:14:57 +00:00
Michael Achenbach
7ca7080c2e [test] Make test work with deopt fuzzer
Bug: v8:10788
Change-Id: Iebc3f8dd892fd0f8123feaf11333eae6832589dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2342852
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69292}
2020-08-07 12:54:16 +00:00
Andreas Haas
8cf00222d2 [wasm] Check size of table imports at instantiation time
Up until now. we only checked the size of tables defined in a module
at instantiation time. For imported tables we only checked if the
imported table matched the declared import in size. This causes a
problem because we allocate function tables also for imported tabled
before we actually look at the imported table.

With this CL we first check the size of all tables, and only then start
to initialize and load them.

R=jkummerow@chromium.org

Bug: chromium:1114006
Change-Id: Iaf194ed21fb83304fe3a7f0f7ba7b282396e3954
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339473
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69291}
2020-08-07 12:27:56 +00:00
Andreas Haas
13d252af08 [wasm] Fix sign error in ImportTable
The cast from uint32_t to int caused an integer overflow that let a
bounds check succeed that should have failed.

R=jkummerow@chromium.org

Bug: chromium:1114005
Change-Id: Iea1af70af300be54c2a33d7dd10b3faa34d56eaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339472
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69289}
2020-08-07 11:40:55 +00:00
Marja Hölttä
761f59acdc [Atomics.waitAsync] Tentatively enable GC fuzzer tests
The test have been rewritten to be more robust -> maybe they're
robust enough for the GC fuzzer (DelayedTasksPlatform)?

Bug: v8:10239
Change-Id: I743cc2f804357aaef888bff7985dfb68a7feec5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2342848
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69287}
2020-08-07 10:09:57 +00:00
Leszek Swirski
cf325b5ab1 Revert "[wasm] Ensure that only TurboFan code is serialized"
This reverts commit 60ee70bb40.

Reason for revert: wasm-api-tests/WasmCapiTest.Serialize starts flaking: https://crbug.com/v8/10784

Original change's description:
> [wasm] Ensure that only TurboFan code is serialized
> 
> We have the implicit assumption that Liftoff code will never be
> serialized, and we start relying on that when implementing new features
> (debugging, dynamic tiering).
> 
> This CL makes the serializer fail if the module contains any Liftoff
> code. Existing tests are changed to ensure that we fully tiered up
> before serializing a module (similar to the logic in Chromium).
> The "wasm-clone-module" test needs to serialize the module before
> enabling the debugger.
> 
> Note that chrome currently only serializes a module after it fully
> tiered up, so that should be fine. If other embedders need the ability
> to serialize a module in an arbitrary state, we will have to fix this
> later. With this CL we will be on the safe side though and (gracefully)
> fail serialization instead of accidentally serializing Liftoff code.
> 
> R=​ahaas@chromium.org
> 
> Bug: v8:10777
> Change-Id: I1245e5f7fda3447a544c1e3525e1239cde759174
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336799
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69276}

TBR=ahaas@chromium.org,clemensb@chromium.org

Change-Id: Ic1349375bd562bb0a2724c39c27ef3247461c97b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10777
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2342845
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69284}
2020-08-07 07:38:41 +00:00
Georg Neis
4b84b33a63 [turbofan] Fix a test
The test relies on certain maps not dying but didn't ensure that.

Bug: v8:10783
Change-Id: I708f7fc027ee0bf5656be9bb4f29130f5b924597
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2340912
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69282}
2020-08-06 18:03:16 +00:00
Clemens Backes
60ee70bb40 [wasm] Ensure that only TurboFan code is serialized
We have the implicit assumption that Liftoff code will never be
serialized, and we start relying on that when implementing new features
(debugging, dynamic tiering).

This CL makes the serializer fail if the module contains any Liftoff
code. Existing tests are changed to ensure that we fully tiered up
before serializing a module (similar to the logic in Chromium).
The "wasm-clone-module" test needs to serialize the module before
enabling the debugger.

Note that chrome currently only serializes a module after it fully
tiered up, so that should be fine. If other embedders need the ability
to serialize a module in an arbitrary state, we will have to fix this
later. With this CL we will be on the safe side though and (gracefully)
fail serialization instead of accidentally serializing Liftoff code.

R=ahaas@chromium.org

Bug: v8:10777
Change-Id: I1245e5f7fda3447a544c1e3525e1239cde759174
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336799
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69276}
2020-08-06 15:00:08 +00:00
Marja Hölttä
d8221df3f9 Reland "[Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits"
This is a reland of 28ead05405

The failure is a test that is sensitive to adding a function
in a FunctionTemplate in d8: https://bugs.chromium.org/p/v8/issues/detail?id=10783

Original change's description:
> [Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits
>
> RemoveNode already nullifies the next_ pointer of FutexWaitListNode,
> and DeleteAsyncNode was trying to retrieve it.
>
> Bug: v8:10239
> Change-Id: I595885de87f433d263eeacfc825a689efd467f5e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332812
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69259}

Bug: v8:10239
Tbr: leszeks@chromium.org
Change-Id: Icec590354886433a0b41c8f9b7af7101b54b7690
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339469
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69275}
2020-08-06 14:42:48 +00:00
Marja Hölttä
c813817d55 [compiler] Mark a test which is sensitive to unrelated conditions as [PASS, FAIL]
Bug: v8:10783
No-Try: true
Change-Id: I605813842af639158909bce13e162869b3cfc6db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339621
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69273}
2020-08-06 13:47:48 +00:00
Leszek Swirski
93c10b26d3 Revert "[Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits"
This reverts commit 28ead05405.

Reason for revert: mjsunit/compiler/serializer-transition-propagation
failure seems to bisect to this (despite looking unrelated):
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/32532

Original change's description:
> [Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits
> 
> RemoveNode already nullifies the next_ pointer of FutexWaitListNode,
> and DeleteAsyncNode was trying to retrieve it.
> 
> Bug: v8:10239
> Change-Id: I595885de87f433d263eeacfc825a689efd467f5e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332812
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69259}

TBR=ulan@chromium.org,marja@chromium.org,syg@chromium.org

Change-Id: I5db179aec5a04f59770903b17d059a7150c7efbd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10239
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339466
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69271}
2020-08-06 12:54:30 +00:00
Andreas Haas
4743426571 [wasm] Check size of tables dynamically
We used to check the size of tables at compile time, and threw a
CompilationError if a given size exceeded the implementation-defined
limit. However, the spec defines that an error should only be thrown
when the implementation-defined limit is reached, which is either at
instantiation time of during runtime at a table.grow.

With this CL the V8 implementation becomes spec compliant in this
regard.

R=jkummerow@chromium.org

Bug: v8:10556
Change-Id: I7d0e688b385a65e4060a569e5ab1dec68947ceea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2326331
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69267}
2020-08-06 11:50:43 +00:00
Marja Hölttä
28ead05405 [Atomics.waitAsync] Fix removing multiple nodes when Isolate deinits
RemoveNode already nullifies the next_ pointer of FutexWaitListNode,
and DeleteAsyncNode was trying to retrieve it.

Bug: v8:10239
Change-Id: I595885de87f433d263eeacfc825a689efd467f5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332812
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69259}
2020-08-06 09:24:47 +00:00
Jakob Gruber
82fc74c91b [nci] Check the isolate cache from within compiler.cc
Just like the optimized code cache, the compiler should check the
isolate cache for NCI code objects and return them if they exist.

Drive-by: Skip additional tests to fix the nci_as_highest_tier test
variant. These are related to interactions with deoptimization, which
NCI code doesn't fully support yet.

Bug: v8:8888
Change-Id: I6253811f96993796cfc38fff0da7ffb4f1a5eb24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339095
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69251}
2020-08-05 15:12:36 +00:00
Ng Zhi An
e3caf3f524 [wasm-simd] Add regression test for i64x2.shr_s bug
This test uses a i64x2.shr_s to shift a v128 with all bits set by 1,
resulting in v128 with all bits set (no change). This value is then
dropped, and param[2] (3), is returned.

Without the fix, -1 is returned, since i64x2.shr_s overwrites the
register for param[2] with 0xffffffff.

Bug: v8:10752
Bug: chromium:1111522
Change-Id: I0310bf6039be780a6738689069cdbcfa3a24bbdb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335779
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69233}
2020-08-04 17:51:45 +00:00
Mythri A
1a033ae82f [test] Reduce iteration count in elements-kind test
Change-Id: I0117b0c2b646cb1005b63e9648d604b26581d977
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335187
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69229}
2020-08-04 15:58:04 +00:00
Michael Achenbach
9d5a1fff27 [test] Skip slow tests
No-Try: true
Change-Id: If5ed824ad3ea1a2815a0a48ed2668281733ac533
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332603
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69209}
2020-08-03 19:57:54 +00:00
Shu-yu Guo
c19e57ee82 Disallow \8 and \9 in strict mode and template literals
This reached consensus in the July 2020 TC39:
https://github.com/tc39/ecma262/pull/2054

Bug: v8:10769
Change-Id: Iecea1d9d9c9be5c2fbfb820aed2285719c4e6382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333350
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69206}
2020-08-03 18:05:14 +00:00
Mythri A
9b9ba19e3c [turboprop] Migrate deprecated maps in dynamic map check operator
If incoming map is deprecated, generate code to migrate the map. Since
this involves generating additional code and a call to runtime, we only
do this if one of the receiver maps was a migration target when
optimizing this function. If not, we deoptimize and discard the
optimized code if we see a deprecated map. This is to avoid bailout
loops when we see deprecated maps.

This change does the following:
// We generated code to migrate deprecated maps only if one of the maps
// in feedback vector is a migration target.
if ( there are migration targets in feedback)
{
  if (checkMaps fails) {
     if (incoming map is deprecated) {
        migrate the map
        checkMaps with the new map
     } else {
       bailout
     }
  }
} else {
  if (checkMaps fails)
    bailout;
}

Bug: v8:10582, v8:9684
Change-Id: I8a04c77ed209dd2fb0300a783d844f2335a678c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2292231
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69179}
2020-07-31 16:06:10 +00:00
Clemens Backes
9555464fb2 [d8] Fix worker creation near stack limit
If we are near the stack limit, calling the proxy method might not work
any more. Instead of crashing because of an empty MaybeLocal, handle
this gracefully.

Drive-by: Minor refactoring in TryGetValue.

R=tebbi@chromium.org

Bug: chromium:1110001
Change-Id: I07e7773768166b3dbea2e6b75a3ab8b24bfeee53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2332156
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69161}
2020-07-31 09:37:59 +00:00
Georg Neis
49749bb976 [turbofan] Fix a lazy deopt bug in Array.prototype.map
The bug was that the allocation of the result array (before the loop)
was using the outer frame state, thus returning the allocation's result
(an array full of holes) as the return value of the map operation in
case the allocation triggers a lazy deopt.

Bug: chromium:1104514
Change-Id: I9a6db8a5860472e1b438b6b54414938d61e166c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2324249
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69129}
2020-07-29 14:39:23 +00:00
Mythri A
989a90400d [turboprop] Enable DynamicMapChecks for TurboProp
Bug: v8:10582, v8:9684
Change-Id: Ib29e9b56d4c722cb572e86def7eeb3f588dc9c2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316079
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69128}
2020-07-29 13:36:53 +00:00
Mythri A
c7643fe485 [Turboprop] Add tests for dynamic check maps operator
This cl also
1. Fixes a bug in effect-control-linearizer where we should have
converted fixed array length from Smi to integer
2. Also prints deopt location for the new "bailout" deopt type on
--trace-deopt.

Bug: v8:10582, v8:9684
Change-Id: Iafc5e8abbca5252a8783a5a1184a1667a7f708a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297460
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69115}
2020-07-28 17:28:32 +00:00
Georg Neis
6ef0ec94a2 [turbofan] Do more checks for dead nodes in BranchElimination
Bug: chromium:1109174
Change-Id: I25924afe9ad9c147e7f89299983032c82f74626d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2320668
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69106}
2020-07-28 14:27:31 +00:00
evih
1250fd59aa [wasm] Add a generic js-to-wasm wrapper
This generic wrapper builtin is currently used only when the wasm
function has no parameters and no return value.

Added a new V8 flag to use this generic wrapper.

Also added a JS test function for this generic wrapper.

Bug: v8:10701
Change-Id: Id8cd1771f26922927363b715d8a6ffd384a143ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307240
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Eva Herencsárová <evih@google.com>
Cr-Commit-Position: refs/heads/master@{#69097}
2020-07-28 10:20:31 +00:00
Marja Hölttä
a7bb323bc5 [Atomics.waitAsync] Rewrite a test
This test should've been rewritten in the last
batch rewrite but wasn't.

Bug: v8:10239
Change-Id: Ic2949e6282f72975898ab7e9aefe3210bba71fbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2319988
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69072}
2020-07-27 13:28:25 +00:00
Ng Zhi An
3cbe36a753 [wasm-simd] Fix init of SIMD global
Using uint8_t[] causes decay to pointer issue, which manifests in
copying garbage values in the call to WriteLittleEndianValue. Change it
to use a std::array, which doesn't have the decaying behavior.

Also add a regression test from comment#6 of the linked bug.

Bug: v8:10731
Change-Id: I4a1ca69fe99806642e9931625ca7aeab6663f955
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316465
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69052}
2020-07-24 16:44:22 +00:00
Maya Lekova
c63c7f6b80 [test] Disable mjsunit wasm test on all platforms
Bug: v8:9506
Change-Id: Ie343a4d49e769293d8a10d26bcfc3847b9d433ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2316109
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69049}
2020-07-24 15:31:52 +00:00
Maya Lekova
a269ce201d Revert "Reland "[flags] warn about contradictory flags""
This reverts commit d8f8a7e210.

Reason for revert: Breaks code_serializer variant - https://cr-buildbucket.appspot.com/build/8874070652992164976

Original change's description:
> Reland "[flags] warn about contradictory flags"
> 
> This is a reland of b8f9166664
> Difference to previous CL: Additional functionality to specify
> incompatible flags based on GN variables and extra-flags, used
> to fix the issues that came up on the waterfall.
> 
> This also changes the rules regarding repeated flags: While
> explicitly repeated flags are allowed for boolean values as long
> as they are identical, repeated flags or explicit flags in the
> presence of an active implication are disallowed for non-boolean
> flags. The latter simplifies specifying conflict rules in
> variants.py. Otherwise a rule like
> 
> INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
>   "--gc-interval=*": ["--gc-interval=*"],
> }
> 
> wouldn't work because specifying the same GC interval twice
> wouldn't actually count as a conflict. This was an issue with
> test/mjsunit/wasm/gc-buffer.js, which specifies
> --gc-interval=500 exactly like the extra flag by the stress bot.
> 
> Also, this now expands contradictory flags checking to d8 flags
> for consistency.
> 
> Original change's description:
> > [flags] warn about contradictory flags
> >
> > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> >
> > Bug: v8:10577
> > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68168}
> 
> Bug: v8:10577
> Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68989}

TBR=machenbach@chromium.org,neis@chromium.org,clemensb@chromium.org,tebbi@chromium.org,tmrts@chromium.org

Change-Id: I7969065b0edbc463a94e530485bc2ab623d77b62
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2312782
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68992}
2020-07-22 13:48:32 +00:00
Tobias Tebbi
d8f8a7e210 Reland "[flags] warn about contradictory flags"
This is a reland of b8f9166664
Difference to previous CL: Additional functionality to specify
incompatible flags based on GN variables and extra-flags, used
to fix the issues that came up on the waterfall.

This also changes the rules regarding repeated flags: While
explicitly repeated flags are allowed for boolean values as long
as they are identical, repeated flags or explicit flags in the
presence of an active implication are disallowed for non-boolean
flags. The latter simplifies specifying conflict rules in
variants.py. Otherwise a rule like

INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
  "--gc-interval=*": ["--gc-interval=*"],
}

wouldn't work because specifying the same GC interval twice
wouldn't actually count as a conflict. This was an issue with
test/mjsunit/wasm/gc-buffer.js, which specifies
--gc-interval=500 exactly like the extra flag by the stress bot.

Also, this now expands contradictory flags checking to d8 flags
for consistency.

Original change's description:
> [flags] warn about contradictory flags
>
> Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
>
> Bug: v8:10577
> Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68168}

Bug: v8:10577
Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68989}
2020-07-22 12:22:03 +00:00
Milad Farazmand
15ca7b94da PPC/s390: skip wasm-dynamic-tiering on unsupported platforms
Change-Id: I818534bc2fedd127689bf82f2cdd3a4f2f8c31e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2310574
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#68977}
2020-07-21 18:37:52 +00:00
Arnaud Robin
f181dff3f5 [wasm] Implement dynamic tiering in wasm
On desktop systems, we use a very basic tiering strategy: Everything is
initially compiled with Liftoff, and once that is done, the module can
start being used. Concurrently to the execution, we re-compile all code
with TurboFan, and hot-swap each function once TurboFan finishes.

We should start using a more dynamic strategy where each function is
tiered-up when judged necessary. This change will then tier-up each
liftoff function once it has been called 5 times.

I then added a counter in the native module, that is updated directly
from Liftoff code, and a runtime call is then made when the counter
reaches the goal.

R=clemensb@chromium.org
CC=​thibaudm@chromium.org

Bug: v8:10728
Change-Id: I8dc2b02fdff8d97781bb1cf496886594b3d7f644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306803
Commit-Queue: Arnaud Robin <arobin@google.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68971}
2020-07-21 16:07:01 +00:00
Jakob Gruber
d1fb6b5a7c [infra] Add and enable nci_as_highest_tier variant
With work on NCI proceeding, it makes sense to test multiple
pipeline configurations.

The nci variant (passes --turbo-nci) now spawns dedicated NCI
compilation jobs and inserts generated code into the code cache.

The nci_as_highest_tier variant (passes --turbo-nci-as-highest-tier)
simply replaces TF with NCI code (no extra jobs, no extra caching).
This mode stresses NCI generated code more than the nci variant, in
which NCI code only runs on cache hits.

Bug: v8:8888
Change-Id: I4c2a43cce5271a6c288e7aba195dcc9daed6af9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299361
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68964}
2020-07-21 10:53:31 +00:00
Marja Hölttä
96c5916dd4 Reland2: [Atomics.waitAsync] Implement Atomics.waitAsync
Original design doc:
https://docs.google.com/document/d/1dthXsVHMc1Sd_oYf9a-KZSFOd_a8dUgnt4REAG8YIXA

Design changes:
https://docs.google.com/document/d/1aeEGDm1XSqoJkQQKz9F75WqnuAa2caktxGy_O_KpO9Y

Reland:
- rewrote timing dependent tests to be more robust
- removed 1 flaky test
- disabled tests for DelayedTasksPlatform

Original:  https://chromium-review.googlesource.com/c/v8/v8/+/2202981

TBR=ishell@chromium.org, ulan@chromium.org

Bug: v8:10239
Change-Id: I2a042e419462f4c9f54ec549bfe16ec6684560b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2307211
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68954}
2020-07-21 06:43:48 +00:00
Michael Achenbach
448c25f233 [test] Make mjsunit harness more robust to fuzzers
Some fuzzers replaced strigify and then caused uncaught errors
from harness methods using prettyPrinted.

Bug: chromium:1102897
Change-Id: I7ae6a90040ba0aa5ec1efa4a8b73e053ec75dd79
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304814
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68947}
2020-07-20 15:07:59 +00:00
Maya Lekova
80c3192728 Revert "[Atomics.waitAsync] Disable flaky test"
This reverts commit b995a8a46f.

Reason for revert: Test addition got reverted.

Original change's description:
> [Atomics.waitAsync] Disable flaky test
> 
> TBR=mslekova@chromium.org
> 
> No-Try: true
> Bug: v8:10725, v8:10239
> Change-Id: Ia2f721f8a26a90dda658664315f0170841c3303e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306798
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68931}

TBR=marja@chromium.org,mslekova@chromium.org

Change-Id: I0c5565222f509676fe60af5378ad04f806930da3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10725
Bug: v8:10239
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306800
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68937}
2020-07-20 10:10:31 +00:00
Marja Hölttä
f088491b9e Revert "Reland [Atomics.waitAsync] Implement Atomics.waitAsync"
This reverts commit c5845b47bd.

Reason for revert: Too many tests are flaky

Original change's description:
> Reland [Atomics.waitAsync] Implement Atomics.waitAsync
> 
> Original design doc:
> https://docs.google.com/document/d/1dthXsVHMc1Sd_oYf9a-KZSFOd_a8dUgnt4REAG8YIXA
> 
> Design changes:
> https://docs.google.com/document/d/1aeEGDm1XSqoJkQQKz9F75WqnuAa2caktxGy_O_KpO9Y
> 
> Previous (reverted) version:  https://chromium-review.googlesource.com/c/v8/v8/+/2202981
> 
> Relanding with fix: tests need --noincremental-marking
> 
> TBR=ishell@chromium.org, ulan@chromium.org, syg@chromium.org, ahaas@chromium.org
> 
> Bug: v8:10239
> Change-Id: Id122225d5d2ed67cbeb3269df115c7208a33a281
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306791
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68929}

TBR=ulan@chromium.org,marja@chromium.org,ahaas@chromium.org,ishell@chromium.org,syg@chromium.org

Change-Id: If06da737749806982d1fb95811f540d6667543d5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10239
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306799
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68935}
2020-07-20 09:50:59 +00:00
Thibaud Michaud
69553feaab [wasm][tail-call] Fix CanTailCall check
The CanTailCall check only passes if the return locations are the
same in the caller and the callee. However, stack returns are expected
to be at a different offset depending on the stack space reserved for
parameters.

R=clemensb@chromium.org

Bug: v8:7431
Change-Id: Iaac15fce889d6cd7d1ac88f320a872202281fb5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2289789
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68933}
2020-07-20 09:07:29 +00:00
Marja Hölttä
9df54e0767 [tests] Disable slow tests for gc-stress (they time out)
Bug: v8:9506
Change-Id: If570b71d95030dd5fbe31d86d307ab0b45827308
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306796
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68932}
2020-07-20 08:59:39 +00:00
Marja Hölttä
b995a8a46f [Atomics.waitAsync] Disable flaky test
TBR=mslekova@chromium.org

No-Try: true
Bug: v8:10725, v8:10239
Change-Id: Ia2f721f8a26a90dda658664315f0170841c3303e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306798
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68931}
2020-07-20 08:57:29 +00:00
Marja Hölttä
c5845b47bd Reland [Atomics.waitAsync] Implement Atomics.waitAsync
Original design doc:
https://docs.google.com/document/d/1dthXsVHMc1Sd_oYf9a-KZSFOd_a8dUgnt4REAG8YIXA

Design changes:
https://docs.google.com/document/d/1aeEGDm1XSqoJkQQKz9F75WqnuAa2caktxGy_O_KpO9Y

Previous (reverted) version:  https://chromium-review.googlesource.com/c/v8/v8/+/2202981

Relanding with fix: tests need --noincremental-marking

TBR=ishell@chromium.org, ulan@chromium.org, syg@chromium.org, ahaas@chromium.org

Bug: v8:10239
Change-Id: Id122225d5d2ed67cbeb3269df115c7208a33a281
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2306791
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68929}
2020-07-20 08:08:59 +00:00
Clemens Backes
42b4f15a1e [liftoff] Fix missing stack move
The {operator==} on {VarState} did not check the spill offset, so when
merging stack states, we forgot to move stack values if both source and
destination were stack slots, but at different offsets.
This CL fixes this by removing the {operator==}, because the semantics
(and use) are not clear, and it's only used in one place anyway.
The equality check was mostly redundant, so inlining it also makes the
code smaller and faster.

R=ahaas@chromium.org

Bug: v8:10702
Change-Id: I6c8b2cfd1002274175c9a17d305692e4631fd7dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2304574
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68916}
2020-07-17 13:52:28 +00:00
Mythri A
2ba80497a7 [turbofan] Skip optimizations for large unmapped 'arguments'
We cannot allocate large arrays exceeding the size of
kMaxRegularHeapObjectSize in young space. Bailout of optimization in
such cases.

Bug: chromium:1105746
Change-Id: I4f7357c2dd7b3e70d747f9067660725ecf6ae768
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2300481
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68889}
2020-07-16 12:15:55 +00:00
Georg Neis
cd718536ec [turbofan] Optimize import.meta
Make JSContextSpecialization constant-fold import.meta loads if the
meta object has already been created.

Most of this CL was contributed by Gus Caplan.

This is a verbatim copy of CL
https://chromium-review.googlesource.com/c/v8/v8/+/2170982
which could not be landed due to the wrong email address
being used.

TBR=verwaest@chromium.org
TBR=gsathya@chromium.org

Bug: v8:7044
Change-Id: Ief45f3082dc756265904ff500305d32717071e81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2299375
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68875}
2020-07-15 15:41:11 +00:00