Now that function counts are based on dedicated call counters instead
of FeedbackVector::invocation_count, we can enable optimizations for
block coverage modes.
This significantly speeds up V8 with enabled coverage:
Before this CL, the web-tooling-benchmark regressed by 70% (block
count coverage vs. no coverage). With this CL, the regression is
reduced to 40%.
Bug: v8:6000,v8:9148
Change-Id: I6bb538bd66f32f016c66c1d1996bce3b25958232
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615241
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61582}
Instead of allocating a fixed array in which we write individually allocate
mutable heap numbers, we can allocate a byte array large enough to cover all
heap numbers. That avoids expensive allocation calls, write barriers, and
temporary memory O(number of heap numbers) (we'll just have 1 byte empty byte
array as overhead).
Change-Id: I4ffe16dd91e97a2e8cd8e36ff5af37375599276b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613993
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61581}
We already use {base::AddressRegion} in some places, while other places
still receive {Address} and {size_t}. Those are often created from an
existing {base::AddressRegion}, hence pass that on explicitly.
Drive-by: Rename {AssignRanges} to {AssignRange}.
Drive-by^2: Return {base::AddressRegion} by value (it is trivially
copyable and small).
R=mstarzinger@chromium.org
Bug: v8:9183
Change-Id: Ia9f26cc96e084922f5e27d879209ee4c79c63fee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613242
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61578}
Helper functions to create and warm-up the snapshot blob were
duplicated in various spots (mksnapshot, inspector tests, serializer
cctests). This merges all of these into a single helper function
family declared in snapshot.h.
Bug: v8:9189, chromium:957029
Change-Id: I2d8d6fd8e955ffffd7d805c199d4a858500af588
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1598695
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61576}
Perfetto has a mechanism for getting trace data from buffers held alive
by TraceWriters. We enable this with the SetSMBScrapingEnabled() call.
This means we don't need to delete TraceWriter objects and can just leak
them for now, and eventually use thread-local destructors to ensure they
are eventually deleted on thread exit.
Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: I690bc435c48db6d91eab2fbc7a49ec9feae3b45a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607653
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61575}
Prior to this CL, call counts at function scope were taken from the
FeedbackVector::invocation_count field. This had two major drawbacks:
1. for generator functions, these count the number of resumptions
instead of the number of calls; and 2. the invocation count is not
maintained in optimized code.
The solution implemented here is to add a dedicated call counter at
function scope which is incremented exactly once each time the
function is called.
A minor complication is that our coverage output format expects
function-scope counts in the dedicated CoverageFunction object, and
not as a CoverageBlock. Thus function-scope block counts are initially
marked with magic positions, and later recognized and rewritten during
processing.
This CL thus fixes reported generator function call counts and enables
optimizations in block coverage modes (more to come in a follow-up).
Drive-by: Don't report functions with empty source ranges.
Bug: v8:6000,v8:9148,v8:9212
Cq-Include-Trybots: luci.chromium.try:linux_layout_tests_layout_ng
Change-Id: Idbe5edb35a595cf12b6649314738ac00efd173b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613996
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61574}
When decommitting memory, update the committed code space counters both
for the native module as well as engine-wide (via {WasmCodeManager}).
R=mstarzinger@chromium.org
Bug: v8:8217
Change-Id: I9679b27f2465de2cbc797529d83f90cdac903d01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613239
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61569}
With lazy feedback allocaiton functions may not have feedback vectors.
This causes crashes with clusterfuzz when it uses OptimizeOSR without
ensuring feedback vector. This cl ensures we have a feedback vector
before OSRing.
Bug: v8:8394
Change-Id: I5470c45cec2f6916d142f3bb4a385737083de25c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611809
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61568}
This stores a type alias in the global class list, so we can get
to the declarable and figure out namespace / file.
R=szuend@chromium.org
Bug: v8:7793
Change-Id: I2164b77e559d28fa18da12192a34e0a7264b858e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613989
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61566}
This is a reland of 9141522739
Original change's description:
> Add test to show the crashing of TimeZone::AdoptDefault
>
> The ICU DEPS for chromium is landing in
> https://chromium-review.googlesource.com/c/chromium/src/+/1607506
>
> Bug: chromium:950851
> Change-Id: If16e82d70c319108ead06dd095b22ecda5408a6b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1601370
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61550}
Bug: chromium:950851
Change-Id: I427eba86bb5d4017a43b6767a1da4280d87297eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613896
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61565}
This changes the contract of the CallFunctionTemplate builtins such that
the receiver must always be a JSReceiver, which simplifies the logic and
also makes it possible to have TurboFan completely optimize away the
ConvertReceiver operation, while at the same time ensuring that we
always pass the correct receiver to API functions.
Bug: chromium:961199, v8:8820
Change-Id: Ied9dee3f504bd5b711c29f1e2c00f0434c731d19
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611803
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61563}
This is a reland of d61a9347c8
6th attempt. Relanding after fixing TSan/UBSan issues.
Original change's description:
> [ptr-compr][x64] Temporarily enable pointer compression on x64
>
> ... and make sure that the x64 ptr-compr bots proceed testing V8 without
> pointer compression in order to keep testing the full pointer mode.
>
> Bug: v8:7703
> Change-Id: Ib1498609603cb03be2464043658131d5a2f1e012
> Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_tsan_rel
> Cq-Include-Trybots: luci.chromium.try:fuchsia_x64,linux-rel,mac-rel
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559850
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61416}
Bug: v8:7703
Change-Id: I1fa0989aef9ea08e54fd6dfd32d6989367332ce3
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_tsan_rel
Cq-Include-Trybots: luci.v8.try:v8_linux64_cfi_rel_ng
Cq-Include-Trybots: luci.chromium.try:fuchsia_x64,linux-rel,mac-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1607654
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61559}
Bug: v8:8996
Change-Id: I712f7eea934581f8d0889889a8737548ef8fa255
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611752
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#61558}
This change adds a flag v8_enable_fast_torque, which follows the pattern
of v8_enable_fast_mksnapshot and can improve build times by running an
optimized Torque compiler during debug builds. On my machine, this
change improves rebuild time after changing a .tq file by about 7
seconds.
Change-Id: I7c91d1059c614fe34eefe7ee8c3cba7c931d5a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612160
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61556}
This reverts commit 3e118baf00.
Reason for revert: Reverting as ftang@'s CL here will be reverted.
https://chromium-review.googlesource.com/c/v8/v8/+/1601370, and this was a fix for a bad landing.
Original change's description:
> Update include path to date.h which was moved in the meanwhile
>
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:950851
> Change-Id: Ia5e547e7cd7947f91814cb24de3dcf3b822905da
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611811
> Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61552}
TBR=gdeepti@chromium.org,ishell@chromium.org
Change-Id: Ibe1671b1973afae8db6180d3f5471763786bd23d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:950851
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613637
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61553}
Permit individual calls to CpuProfiler::StartSampling to provide their
own requested sampling interval, to be snapped to the profiler's
sampling interval. Use the greatest common divisor of all sample rates
to determine what sample rate should be chosen for the sampling thread,
and dispatch samples to attached profilers based on their requested
sample periodicity.
Change-Id: I0b076d09761d7176f31725e112578b68ab5da54c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1484461
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#61548}
The main change here is that in isolate-data.h, I'm switching from stateJSON to state.
This routine returns a CBOR encoded state cookie, which is also what we already
use in Chromium (blink).
In inspector-test.cc, I then put this byte vector into a V8 String,
and to make this roundtrip, change the extraction routine to get the
bytes. It's a little weird to store arbitrary bytes inside a v8 string,
but it appears to work fine because these bytes end up in the 8 bit portion,
much like isolatin characters would.
Change-Id: I72a0bdefd85a290f4e91db79be67d86952831685
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1610478
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61544}
All macros defined in "format-macros.h" are dead now (after
https://crrev.com/c/1613243). This CL removes this header, and includes
<cinttypes> instead wherever we use format macros for the types defined
in <cstdint>.
Plus some drive-by cleanup of includes.
R=mlippautz@chromium.org
Bug: v8:9183
Change-Id: Ic379759b79edb50e38833defb1577cc3af7c8150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611800
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61540}
Internalizing is useful if we expect the string to reoccur many times.
Internalizing too long strings will cost due to hashing, and the resulting
strings will be kept alive for longer. Drop the limit to 10 to be more
conservative.
Change-Id: I2ac2109ca03ab05dbc5c01d4efe6f912b12f65b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611805
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61539}
Use feedback from adjecent array elements to speed up object creation.
Change-Id: Ib5c1b07cc63afb1a4b0cf194144a0ecd31139cb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1612898
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61538}
This CL adds a check and a more descriptive error message when no "map"
is passed when constructing an extern class:
extern class Foo extends HeapObject {...}
const f = new Foo {};
R=sigurds@chromium.org
Bug: v8:7793
Change-Id: I0dfa6d5976e98d572bafcf7a87f701ea97cd6a73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611804
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61537}
The 'z' length modifier for {size_t} in format strings was introduced
with C99, hence it is available in all environments we support.
R=jgruber@chromium.org, mlippautz@chromium.org
Bug: v8:9183
Change-Id: I1bc2abec3f9c7b38186128202fef4719853de7d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613243
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61536}
This CL adds support for all kinds of Types to "textDocument/symbol"
requests. While LSP has support for classes and structs, it does not
have support for generic types. Only classes are marked as such,
while all other types are marked as structs in terms of the LSP.
Special care has to be taken with TypeAliases. Generic call sites
introduce a new scope (similar to namespace scopes), where new
TypeAliases are created for Generic type arguments. These TypeAliases
then point to the specialized type inside this call-site specific
scope. To omit the specialized TypeAliaes from the symbols list,
they are marked using the "is_user_defined" flag.
R=sigurds@chromium.org
Bug: v8:8880
Change-Id: I576d1c677a5255d54f7774aa053f431608a4cd0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613240
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61534}
This avoids the need to throw range errors when we run out of stack, limiting
us only by available memory.
The main parser loop is implemented by two subloops.
The first subloop finishes whenever it generates primitive values, empty
arrays, or empty objects. If a non-empty object or array is started, the loop
continues to parse its first member.
The second subloop consumes produced values and either adds them to the parent
array or object, or returns it. The second loop finishes whenever a next value
needs to be produced. When the loop itself produces a finished array or object,
the loop continues.
Exceptions are handled by moving the cursor to end-of-input. Upon end-of-input,
the first loop sets the continuation to "kFail". That causes the second loop to
tear down continuation stack and related handle scopes, resulting in an empty
handle.
The CL additionally buffers all named properties and elements so we can
immediately allocate a correctly shaped object. For object elements we'll take
flat array or dictionary encoding depending on what is more efficient.
This means that element handles are now allocated in their parent HandleScope,
rather than having local handlescopes per-property (of big objects); which is
why I've adjusted the handle-count test to not allocate as many properties. In
the future it would be nice to not have to allocate (as many) handles since
almost everything in the JSON graph will survive JSON parsing...
Bug: chromium:710383
Change-Id: Ia3a7fd0ac260fb1c0e5f929276792b2f8e5fc0ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1609802
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61533}
