Commit Graph

57562 Commits

Author SHA1 Message Date
Joshua Litt
b6731abef0 [turbofan] Revert algorithm simplification in Math.hypot
When a fast path was added for Math.hypot, the algorithm was also
simplified. This simplification turns out to be incorrect in some rare
edge cases. This cl reverts back to the original algorithm and converts it to torque.

Original cl: https://chromium-review.googlesource.com/c/v8/v8/+/1684178

Bug: v8:9546
Change-Id: If4e21504732f46081a8de823f50f499917f1a20c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725200
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63070}
2019-08-05 11:12:58 +00:00
Clemens Hammacher
779bdef36e [wasm] Prepare for multiple jump tables
This CL prepares {NativeModule} and {WasmCodeAllocator} for multiple
code spaces with separate jump tables. {WasmCodeAllocator} calls back
to the {NativeModule} for each code space it allocates, and
{NativeModule} stores data (especially the jump table) for each code
space.
A jump table is currently only created for the first code space added,
so nothing changes there yet.

R=mstarzinger@chromium.org

Bug: v8:9477
Change-Id: I3ddeb8e251648b07ba8b7b4638abafe2364b47ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730996
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63069}
2019-08-05 11:11:32 +00:00
Clemens Hammacher
c425a337cb [utils] Simplify chaining of BitFields
Instead of exposing a {kNext} constant to be used to construct the next
bitfield, expose a templatized {Next} type alias. This ensures that the
storage type is the same for all bitfields created this way. It's also
shorter.

Apart from the expected changes in the code base, the AST node classes
are changed to expose a {NextBitField} templated type alias instead of
a {kNextBitFieldIndex} constant. They thus follow the same pattern as
{BitField} itself.

R=jkummerow@chromium.org, mstarzinger@chromium.org, verwaest@chromium.org

Bug: v8:9396
Change-Id: I70a1b0bd71cde694ec53444de0ca55e4cf0a3836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728615
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63068}
2019-08-05 11:08:48 +00:00
Georg Neis
cf81e87573 Revert "[turbofan] Introduce Hints::SingleConstant helper"
This reverts commit a82ffb1711.

Reason for revert: dependency for reverting 9499ec0d43

Original change's description:
> [turbofan] Introduce Hints::SingleConstant helper
> 
> Bug: v8:7790
> Change-Id: I499e74f45a3997d32e75c962f0c59ce5c6819c5f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730989
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63030}

TBR=neis@chromium.org,mslekova@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7790
Change-Id: I7b264cf913935219adf11022231cb5002175500d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735314
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63067}
2019-08-05 11:02:58 +00:00
Michael Achenbach
cfdbab36d9 Revert "[test] Print hanging tests on linux on test-runner termination"
This reverts commit 3fc9663159.

Reason for revert: _on_event clashes with a the same function in timeout proc.

Original change's description:
> [test] Print hanging tests on linux on test-runner termination
> 
> This will print the list of processes still running before and after
> joining workers during termination. This will help debugging hanging
> tests during flake-bisect or with num-fuzzer, which both terminate
> on total timeout and currently still sometimes hang without printing
> processes.
> 
> Bug: v8:8292
> Change-Id: I124b65fa35b8d7a6aa198fcf50f2c20df94dc51a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735312
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63065}

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ic29013e92c77a9905e06ee13a2449e033285eb36
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8292
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735317
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63066}
2019-08-05 10:52:53 +00:00
Michael Achenbach
3fc9663159 [test] Print hanging tests on linux on test-runner termination
This will print the list of processes still running before and after
joining workers during termination. This will help debugging hanging
tests during flake-bisect or with num-fuzzer, which both terminate
on total timeout and currently still sometimes hang without printing
processes.

Bug: v8:8292
Change-Id: I124b65fa35b8d7a6aa198fcf50f2c20df94dc51a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735312
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63065}
2019-08-05 10:21:48 +00:00
Georg Neis
20a7055cfb Revert "[turbofan] Introduce SerializationPolicy enum"
This reverts commit 6d31360757.

Reason for revert: dependency for reverting 9499ec0d43

Original change's description:
> [turbofan] Introduce SerializationPolicy enum
> 
> This improves overall readability by replacing bool arguments.
> 
> Bug: v8:7790
> Change-Id: I02f8f43088497c9503f253788ee5e0015c7edc2d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730991
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63032}

TBR=neis@chromium.org,mslekova@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7790
Change-Id: If6fc192bd8ad9c75fde2cc4aac69922217bfb8f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735313
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63064}
2019-08-05 10:07:13 +00:00
Simon Zünd
b6c555bd88 Add ApiNatives::InstantiateFunction that explicitly takes native context
This CL changes {CreateApiFunction} to take an explicit native context
to set on the newly created JSFunction. The CL also adds a new variant
of {ApiNatives::InstatiateFunction}, that takes a native context and passes
it through to {CreateApiFunction}.

This is a refactoring in preparation for a bugfix.
AccessorPairs can be instantiated lazily. At the time of
lazy instantiation, the current context does not necessarily match
the creation context of the holder of an AccessorPair.

Bug: chromium:986063, chromium:989909
Change-Id: Idea4b5052f2baff5c3d916f5ab8ed5017b60699b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735308
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63063}
2019-08-05 10:06:08 +00:00
Mu Tao
e0b3fbee11 [mips][codegen] Change two class's visibility to make cctest build pass
Building cctest has linking error when gn's args has "is_component_build = true".
This CL make the visibility of "MemOperand" and "UseScratchRegisterScope" from
"hidden" to "default" to solve this problem.

Change-Id: I3ebfaa25d598b4f2d626861b947c93d111d95456
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731213
Auto-Submit: Mu Tao <pamilty@gmail.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63062}
2019-08-05 09:15:48 +00:00
Darius Mercadier
4919e5dc6d [heap] make FreeListCategory::is_linked() more precise
Change-Id: I2e0632756ac92b18d2d9a30b03b698b533b34862
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722564
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Cr-Commit-Position: refs/heads/master@{#63061}
2019-08-05 09:10:50 +00:00
Ulan Degenbaev
8b66189b6f [heap] Bump up the number of scavenging tasks
Increasing the number of scavenging tasks in the previous CL
https://chromium-review.googlesource.com/c/v8/v8/+/1697245
has helped with GC performance but increased memory usage.

This CL ensures that there are at least two scavenging tasks if the
new space size is larger than one MB.

Bug: chromium:982663,chromium:985731
Change-Id: I6edff8b90beb2740a5b75a51cf25f48aa5442482
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733074
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63060}
2019-08-05 08:40:26 +00:00
Joshua Litt
91e53e2695 Reland "[atomics] Wire up 64 bit atomic Wait in JS"
Relands 64bit atomic wait with ubsan fix, previously reviewed at:
https://chromium-review.googlesource.com/c/v8/v8/+/1728260

This reverts commit 2a383f4cf1.

Bug: v8:8100, v8:9576
Change-Id: Ibeec86c8a796bfbef9884cdb836892e902030bf3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733389
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63059}
2019-08-05 07:44:12 +00:00
Ujjwal Sharma
8ab0eed20c [cleanup] Fix whitespace issue in BUILD.gn
Fix the issue involving inconsistent whitespace in BUILD.gn which broke
Node's GN scraper.

Refs: https://github.com/nodejs/node-v8/issues/113
Bug: v8:9579
Change-Id: I5313cd652634b393fb3eab13f0f2bd483a3c6a97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1734946
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63058}
2019-08-05 06:10:42 +00:00
v8-ci-autoroll-builder
0d07272a7f Update V8 DEPS.
Rolling v8/build: afb3374..d57f70e

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ib9125d2ace76afc466b898e362dceb5aa9efbe86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735187
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63057}
2019-08-05 03:41:52 +00:00
v8-ci-autoroll-builder
2cf99b3467 Update V8 DEPS.
Rolling v8/build: b2d6a40..afb3374

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I25440be508ac8ae6605e2bfbb099c4a524a90436
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1735186
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63056}
2019-08-04 03:21:51 +00:00
v8-ci-autoroll-builder
f6e5b55ec4 Update V8 DEPS.
Rolling v8/base/trace_event/common: d0793a0..5e4fce1

Rolling v8/build: 7e9c87e..b2d6a40

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/ec6ed57..93ee550

Rolling v8/third_party/depot_tools: 59bb8cc..921f6a1

Rolling v8/tools/clang: 8215b08..cd2137f

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Id9283dede4d0e54a263c0dbc848f6e03f61d4792
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731381
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63055}
2019-08-03 03:39:45 +00:00
Ulan Degenbaev
f391faf1d1 [heap] Add a flag for setting the initial heap size
When the --initial-heap-size flag is set V8's heap will grow to that
value without full GCs. Additionally, full GCs will be skipped
if the heap size drops below that value.

This patch also adds a comment for the initial_heap_size_in_bytes
parameter of ResourceConstraints:ConfigureDefaultsFromHeapSize

Change-Id: I85fda14bc6422af7bf2193d530efbc9b0bd0553d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728622
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63054}
2019-08-02 16:14:39 +00:00
Ng Zhi An
e17ac92556 [wasm-simd] Implement F64x2 min max for x64
Also add a IsExtreme(double) overload.
This wasn't causing issues because there was no codepath
which exercised it (only approx operations did).

Change-Id: If7583fb567137c428d16c0d2cdfc37e086f7f3fd
Bug: v8:8460
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726675
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63053}
2019-08-02 15:44:10 +00:00
Dan Elphick
5cf67ad933 Reland "Enable lazy source positions by default"
4th attempt to reland this after this revert:
https://chromium-review.googlesource.com/c/v8/v8/+/1680553

Required fixes for default values in arrow function parameters and for
eval scopes:
https://chromium-review.googlesource.com/c/v8/v8/+/1710671
https://chromium-review.googlesource.com/c/v8/v8/+/1733077

Original change's description:
> Enable lazy source positions by default
>
> Also adds a compile time flag which allows the default to be configured
> so node can disable it since it hangs the node cpu profiler tests.

Bug: v8:8510
Change-Id: I20fd82f636527e405d73fd5941b1b4c2f134b666
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733078
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63052}
2019-08-02 15:36:09 +00:00
Leszek Swirski
9cf089e968 [scopes] Skip dynamic vars in eval scopes during lookup
For variable proxies in a function inside an eval scope that point to
a dynamic variable in the eval scope, the current scope resolution will
find this variable only when the function is eagerly compiled, as the
eval scope only exists during top-level eval compilation. This causes
a mismatch between lazy- and eager- compiled functions.

With this patch, we skip these dynamic variables during lookup, so that
the lookup for the variable proxy always finds a kDynamicLocal or
kDynamicGlobal, both when compiled lazily and eagerly. This is a minor
pessimisation of performance (as we know that the lookup has to be
dynamic), but unblocks other improvements which require idempotent
bytecode generation (such as lazy source positions).

Note that the alternative, of simply not tracking dynamic variables on
the eval scope at all, is not viable due to needing this information
during conflict detection.

Bug: v8:8510
Bug: v8:9511
Change-Id: Ifa72ec05e9a97b7be418912340081b9656765fd4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733077
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63051}
2019-08-02 14:55:13 +00:00
Yu Yin
4de8edce07 [mips][wasm] Correct wasm address space limit.
MIPS64 has a user space of 2^40 bytes on most processors, address
space limits needs to be smaller. 256G is ok, but it will cause
many wasm tests get a OOM error.

This patch also skip some tests which need correct IEEE-745 2008
NaN bit patterns on mips.

Change-Id: I52968df3934e8748b2c42a0abf19db1540441d2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1712929
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#63050}
2019-08-02 14:54:08 +00:00
Michael Starzinger
d335cb6a11 [wasm] Make {WebAssembly.Function} work on any iterable.
This makes sure the "parameters" and "results" properties of the passed
FunctionType object can be arbitrary iterable objects, not just plain
JavaScript arrays.

R=clemensh@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: Icba18c418e549deba9fff1855be4956813b1a953
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733071
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63049}
2019-08-02 13:47:19 +00:00
Simon Zünd
f51e0368ea Add regression tests that check the native context of accessors
This CL adds regression tests for two bugs where the wrong native
context is used when lazy accessors are instantiated.

The first bug injects an object created in context 1, into another
context 2. The object has an accessor pair installed via
FunctionTemplate. In context 2, the property descriptor of this
accessor is retrieved, causing the JSFunction to be instantiated
with the current context (context 2) instead of the creation
context of the object (context 1).

The second bug is similar. When breakpoints are set, the whole heap
is walked and all lazy accessor pairs are instantiated. This again
uses the current context instead of using the context from which
a AccessorPair originates.

Bug: chromium:986063, chromium:989909
Change-Id: Iaaea6e81f1b9f6b55fc7583b260aa9aea035a8d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730999
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63048}
2019-08-02 13:46:11 +00:00
Leszek Swirski
475b35f92a [test] Skip regress-331444 on full_debug
It's too slow and flakes on "V8 Linux - full debug"

Change-Id: I2a83a7a2de6a3865d230edb847a658b1b8b23bec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733076
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63047}
2019-08-02 13:23:54 +00:00
Joshua Litt
2a383f4cf1 Revert "[atomics] Wire up 64 bit atomic Wait in JS"
This reverts commit 6a87a478e6.

Reason for revert: breaks ubsan

Original change's description:
> [atomics] Wire up 64 bit atomic Wait in JS
> 
> Bug: v8:8100
> Change-Id: Ia93319493352e81e727596582cbb23e6e7d604fd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728260
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63040}

TBR=jkummerow@chromium.org,joshualitt@chromium.org

Change-Id: Iac014af8238d4eef8fc95128b4603b8118ed3dc4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8100
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733387
Auto-Submit: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63046}
2019-08-02 13:22:50 +00:00
Mike Stanton
0b02ebfb8c [TurboFan] Fix failure in JSCallReducerTest
JSBoundFunctionRef::serialized() and JSFunctionRef::serialized() should
tolerate being called when the heap broker is disabled, because these
methods are now called in the JSCallReducer (in order to log whether
information was missing at serialization time).

Bug: v8:7790
Change-Id: Iac8e68178422bd9bb4ebe2acb412ff42ac87cf4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733075
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63045}
2019-08-02 12:55:20 +00:00
Santiago Aboy Solanes
fd9c5a78a3 [turbofan] Poison according to NeedsPoisoning return value
Previously we were also taking into account the machine type

Change-Id: Ic76aad578f00ef24cf17b349d94cdade8f9ee29d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1733072
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63044}
2019-08-02 12:25:40 +00:00
Santiago Aboy Solanes
d1a4706af9 Reland "[ptr-compr][arm64] Temporarily enable pointer compression on arm64"
This is a reland of f5611402f7

Original change's description:
> [ptr-compr][arm64] Temporarily enable pointer compression on arm64
>
> ... and make sure that the arm64 ptr-compr bots proceed testing V8 without
> pointer compression in order to keep testing the other config.
>
> Commented out the 'extra' variant since it was crashing. Opened a bug
> regarding that: https://bugs.chromium.org/p/v8/issues/detail?id=9568
>
> Similar to x64's https://chromium-review.googlesource.com/c/v8/v8/+/1607654
>
> Bug: v8:7703
> Change-Id: Ifd46b029bab34524f9f536dcdbd1574f2ddcbf37
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724216
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63019}

Cq-Include-Trybots: luci.v8.try:v8_android_arm64_n5x_rel_ng
Bug: v8:7703
Change-Id: I1a82b87bf6db4e6d100aeffc29dae60ba73d8119
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730998
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63043}
2019-08-02 11:37:35 +00:00
Milad Farazmand
5df9be934b [deoptimizer, cleanup] Separating the implementation of GetFloatRegister
Trying to use double_registers for fetching single precision fp values creates
four different implementations of this method depending on the architecture, hence
separating them out into their respective folder.


Change-Id: Ide61fe2e7a95bd8427b377959b262633d8c57e61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730663
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#63042}
2019-08-02 10:52:48 +00:00
Ulan Degenbaev
5611f70b3d "Reland x4 [arraybuffer] Rearchitect backing store ownership"
This is a reland of bc33f5aeba

Contributed by titzer@chromium.org

Original change's description:
> [arraybuffer] Rearchitect backing store ownership
>
> This CL completely rearchitects the ownership of array buffer backing stores,
> consolidating ownership into a {BackingStore} C++ object that is tracked
> throughout V8 using unique_ptr and shared_ptr where appropriate.
>
> Overall, lifetime management is simpler and more explicit. The numerous
> ways that array buffers were initialized have been streamlined to one
> Attach() method on JSArrayBuffer. The array buffer tracker in the
> GC implementation now manages std::shared_ptr<BackingStore> pointers,
> and the construction and destruction of the BackingStore object itself
> handles the underlying page or embedder-allocated memory.
>
> The embedder API remains unchanged for now. We use the
> v8::ArrayBuffer::Contents struct to hide an additional shared_ptr to
> keep the backing store alive properly, even in the case of aliases
> from live heap objects. Thus the embedder has a lower chance of making
> a mistake. Long-term, we should move the embedder to a model where they
> manage backing stores using shared_ptr to an opaque backing store object.

TBR=yangguo@chromium.org

BUG=v8:9380,v8:9221,chromium:986318

Change-Id: If671a4a9ca0476e8f084efae46e0d2bf99ed99ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731005
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63041}
2019-08-02 10:40:43 +00:00
Joshua Litt
6a87a478e6 [atomics] Wire up 64 bit atomic Wait in JS
Bug: v8:8100
Change-Id: Ia93319493352e81e727596582cbb23e6e7d604fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728260
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63040}
2019-08-02 10:39:38 +00:00
Zhang, Shiyu
ad47996d7e Avoid a FixedArray allocation in date parser
During date parsing, a FixedArray is allocated to store intermediate values,
which is slow. This CL holds the values on stack instead to save time.

This increases the score of JetStream2 Date-format-tofte-SP case by ~2%
on WhiskeyLake Chromebook.

Contributed by hao.a.xu@intel.com

Change-Id: I0d7a20a3ad9c57e3a225fff03efc2e434b20fbbc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726744
Commit-Queue: Shiyu Zhang <shiyu.zhang@intel.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63039}
2019-08-02 10:33:58 +00:00
Joey Gouly
f557b2e457 [arm64][liftoff] Fix LiftoffAssembler::LoadTaggedPointerFromInstance
Before this change, the tagged pointer that was loaded was not decompressed.
This makes LoadTaggedPointerFromInstance match the x64 implementation.

Bug: v8:9568
Change-Id: I8fd6d3e8dd13514ae3ef423d1c417f72e1396e4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730993
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63038}
2019-08-02 10:25:58 +00:00
Ulan Degenbaev
3ec397b759 [heap] Update comments in SlotSet
Bug: chromium:648568
Change-Id: I09ef3911d1817b57d5984ca4121b2579093a1d93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722563
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63037}
2019-08-02 09:19:11 +00:00
Georg Schmid
b1db8d847f [torque] Infer type arguments of generic struct initializers
Previously when creating a new generic struct, one had to explicitly provide all type arguments, e.g., for the generic struct

  struct Box<T: type> {
    const value: T;
  }

one would initialize a new box using

  const aSmi: Smi = ...;
  const box = Box<Smi> { value: aSmi };

With the additions in this CL the explicit type argument can be omitted. Type inference proceeds analogously to specialization of generic callables.

Additionally, this CL slightly refactors class and struct initialization, and make type inference more permissive in the presence of unsupported type constructors (concretely, union types and function types).

R=jgruber@chromium.org, tebbi@chromium.org

Change-Id: I529be5831a85d317d8caa6cb3a0ce398ad578c86
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728617
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63036}
2019-08-02 09:10:01 +00:00
v8-ci-autoroll-builder
f2f0562f52 Update V8 DEPS.
Rolling v8/build: bc4a3ca..7e9c87e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/471a922..ec6ed57

Rolling v8/third_party/depot_tools: 447b45d..59bb8cc

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I19360b89c4dddcfa9c5533c12fe0ba8037636b3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731372
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63035}
2019-08-02 07:07:50 +00:00
Ng Zhi An
843e2ef456 Update wasm coversion opcodes
Based on the updates to spec at
https://github.com/WebAssembly/simd/pull/89

Change-Id: Ie60037e4de7a6953708a98c708afc9a820e6aa97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728347
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63034}
2019-08-02 01:59:13 +00:00
Rong Wang
ae60ea7e7d [heap] Add a flag for disabling write barriers
The mode without write barriers works only if incremental marking
is disabled and the single generation mode is enabled.

Bug: v8:9533
Change-Id: Iecf83b0810f757c9b50e7fb338a2905af938f1d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716471
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63033}
2019-08-01 14:32:55 +00:00
Georg Neis
6d31360757 [turbofan] Introduce SerializationPolicy enum
This improves overall readability by replacing bool arguments.

Bug: v8:7790
Change-Id: I02f8f43088497c9503f253788ee5e0015c7edc2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730991
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63032}
2019-08-01 13:56:34 +00:00
Maya Lekova
5a624dc465 [turbofan] Fix crash with --trace-turbo-inlining
When the flag is on and some of the functions don't have bytecode,
we should gracefully print "no bytecode" instead of crashing.

Bug: chromium:983267
Change-Id: Id4e3385cd871a2dd5bead38c29a41b38319cc8d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731003
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63031}
2019-08-01 12:56:05 +00:00
Georg Neis
a82ffb1711 [turbofan] Introduce Hints::SingleConstant helper
Bug: v8:7790
Change-Id: I499e74f45a3997d32e75c962f0c59ce5c6819c5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730989
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63030}
2019-08-01 12:48:34 +00:00
Clemens Hammacher
33dc36d789 [wasm][gc] Make pages inaccessible instead of discarding them
On Linux, both APIs uses {madvise} (and {SetPermissions} additionally
does an {mprotect}), on windows they use different APIs. It turns out that
{SetPermissions} with {kNoAccess} uses {VirtualFree} with
{MEM_DECOMMIT}, so the pages will only be "reserved" afterwards.
{DiscardSystemPages} on the other hand uses the {DiscardVirtualMemory}
which tells the OS that the content of that memory can be discarded,
but the pages stay "committed".
Thus {SetPermissions} with {kNoAccess} frees significantly more memory
than using {DiscardSystemPages}.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: I3555462a9c692f15ecb3eca7834eb181617d9ef9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730992
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63029}
2019-08-01 11:46:06 +00:00
Georg Neis
9499ec0d43 [TurboFan] Brokerize remaining feedback vector slots
This CL adds new ProcessedFeedback subclasses, corresponding to various IC
types:

* ForIn
* Comparison ops
* Binary/Unary ops
* InstanceOf
* Calls

The feedback is gathered at serialization time and used in several places,
namely:

* Bytecode graph building,
* and its helper class JSTypeHintLowering (with its "early lowering")
* Native context specialization
* JSCallReducer

Design doc: https://docs.google.com/document/d/1JLG0VFV8xmsAIJexU19xzlbNyP51ONqfo_Gf_2DcPC8/edit?usp=sharing

Bug: v8:7790
Change-Id: I53c3d7a17f844384f38c4ee0f0b082c114217a02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710663
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63028}
2019-08-01 11:27:34 +00:00
Georg Neis
2f0fc46f18 [turbofan] Rename a function for clarity
From JSNativeContextSpecialization::ReduceKeyedLoadFromHeapConstant
to JSNativeContextSpecialization::ReduceElementLoadFromHeapConstant.

Change-Id: Ib07a6a4bd599dc71a9a100b2f1f6baef68acbe0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728618
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63027}
2019-08-01 10:38:04 +00:00
Joshua Litt
b8ddc84e0d [harmony-numeric-separator] remove flag
now that we are shipping this by default, we can remove the flag.

Change-Id: I298691df3eec934a5add1aa2a2748a0f3a884ab6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726452
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63026}
2019-08-01 10:10:24 +00:00
Clemens Hammacher
c75db59a0a [wasm] Add test mode without implicit allocations
The unittest for {WasmCodeManager} currently disables implicit
allocations for win64 unwind info, but still deals with the implicitly
allocated jump table. With the addition of a far jump table, this logic
would get even more complex.
Thus this CL introduces a testing flag on the {WasmCodeManager} to
disable all implicit allocations, and uses that instead in the
{WasmCodeManagerTest}.

R=mstarzinger@chromium.org

Bug: v8:9477
Change-Id: I45e4bc6b9fec6d7286bf6b45f778681ae0dba746
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725622
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63025}
2019-08-01 09:54:24 +00:00
Maya Lekova
5a45eab1e8 [turbofan] Remove remaining FastPropertyAt call
Now PropertyAccessBuilder::TryBuildLoadConstantDataField is
heap-access free.

Bug: v8:7790
Change-Id: Ibcc644270325d25da01af7f66e8a26fb57614718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725614
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63024}
2019-08-01 09:46:27 +00:00
Leszek Swirski
7677b2efd0 Revert "[ic] Don't transition to premonomorphic state"
This reverts commit 159df2488c.

Reason for revert: Breaks large-classes-properties test (https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8906338563361079200/+/steps/Bisect_159df248/0/steps/Retry_-_isolates/0/logs/large-classes-properties/0)

Original change's description:
> [ic] Don't transition to premonomorphic state
> 
> We used to use premonomorphic state to delay initializing the ICs.
> This optimization was to avoid the cost of setting up handlers if the
> code executed only once. With lazy feedback allocation we no longer
> need this.
> 
> This cl also renames LoadIC_Uninitialized to LoadIC_Nofeedback and
> StoreIC_Uninitialized to StoreIC_Nofeedback since we now miss to
> runtime in the uninitialized state and use the builtin when there
> is no feedback.
> 
> 
> Change-Id: I1633e61ea74664da51348e362c34c47a017a264a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683525
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63020}

TBR=mythria@chromium.org,verwaest@chromium.org

Change-Id: I4fad4e8b881d4a3f8d12149e1797b217a317eaee
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730995
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63023}
2019-08-01 09:42:56 +00:00
Leszek Swirski
33b93f3d88 Revert "[ptr-compr][arm64] Temporarily enable pointer compression on arm64"
This reverts commit f5611402f7.

Reason for revert: arm64 sim MSAN failures (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/28059)

Original change's description:
> [ptr-compr][arm64] Temporarily enable pointer compression on arm64
> 
> ... and make sure that the arm64 ptr-compr bots proceed testing V8 without
> pointer compression in order to keep testing the other config.
> 
> Commented out the 'extra' variant since it was crashing. Opened a bug
> regarding that: https://bugs.chromium.org/p/v8/issues/detail?id=9568
> 
> Similar to x64's https://chromium-review.googlesource.com/c/v8/v8/+/1607654
> 
> Bug: v8:7703
> Change-Id: Ifd46b029bab34524f9f536dcdbd1574f2ddcbf37
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724216
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63019}

TBR=machenbach@chromium.org,tmrts@chromium.org,solanes@chromium.org

Change-Id: I7d96c8aa83fcabff7e9a82e0556811398fedc34c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1730994
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63022}
2019-08-01 09:26:54 +00:00
Michael Starzinger
51d1573b2a [turbofan] Simplify handling of calls with saved registers.
This removes the explicit {kCallWithCallerSavedRegisters} opcode which
is just a regular call node with special handling for saving/restoring
caller saved registers before/after the call. This is now handled via
the {CallDescriptor::kCallerSavedRegisters} flag.

R=neis@chromium.org
BUG=v8:9396

Change-Id: Ie6421085eb2be8a067040222cd5215a9b1013048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728611
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63021}
2019-08-01 08:59:15 +00:00