Commit Graph

68534 Commits

Author SHA1 Message Date
Igor Sheludko
7989e04979 [builtins] Fix Array.prototype.concat with @@species
Bug: chromium:1195977
Change-Id: I16843bce2e9f776abca0f2b943b898ab5e597e42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810787
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73842}
2021-04-07 19:12:46 +00:00
Deepti Gandluri
aa13c15f19 [wasm-simd] Remove ScalarLoweringForTesting
Bug: v8:11613
Change-Id: Ib1ad2dc7bb7235b5f8ef5068a5d3175556d1a65b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806547
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73841}
2021-04-07 18:07:06 +00:00
Ng Zhi An
b49638c524 [x64][ia32] Set lower SSE flags when newer extensions are enabled
If SSE4.2 is enabled, all the previous extensions should also be
enabled. In particular, you cannot have --enable-sse4_1 and
--no-enable-sse3.

Bug: chromium:1195579
Change-Id: Id3e10db24cee2aee14449a77c9e7cff82e97edff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808621
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73840}
2021-04-07 16:25:16 +00:00
Etienne Pierre-doray
baf2b088dd [Jobs]: Cleanup in v8 platform.
This CL completes Jobs cleanup for deprecated and pure virtual functions in
v8 platform.

Bug: chromium:1196703
Change-Id: I823ab06b56077181e92eee5a6468096a355634fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810155
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73839}
2021-04-07 16:00:22 +00:00
Etienne Pierre-doray
2df876ce59 [Jobs]: Delete item-parallel-job.
Now that all users are migrated to Jobs API.

Bug: chromium:1196703
Change-Id: Ic48cce441c1793b1b33f0fc3d6a60847f2eefb2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810156
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73838}
2021-04-07 15:59:16 +00:00
Milad Fa
3dcb0d771c PPC: only clear cr field 6 under simd AnyTrue and AllTrue
From PPC ABI:

>The condition code register fields CR0, CR1, CR5, CR6,
 and CR7 are volatile. The condition code register fields
 CR2, CR3, and CR4 are nonvolatile.

We can safely clear Cr field 6 without the need to save its
content first. Clearing the entire CR register will cause
crashes if it's not restored properly.

Change-Id: I854f5631294f56f542b1a6f4e23dd7dbcf000d7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810802
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73837}
2021-04-07 15:36:06 +00:00
Benedikt Meurer
0d5f6a498c [inspector] Skip special __proto__ property if already present.
The inspector has some magic to add a special __proto__ property to
object value mirrors as long as the object itself has a [[Prototype]].
However it doesn't check whether the object already has a regular
property named __proto__ and thus confuses the front-end by sending two
properties with the same name.

Fixed: chromium:1193250
Change-Id: I75a1cd78ba94aeda4afedcc0f1e69b8dadb6673f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810784
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73836}
2021-04-07 14:56:56 +00:00
Michael Achenbach
e09acfda16 Revert "[liftoff][arm64] Use 64 bit offset reg in mem op"
This reverts commit f645d0b857.

Reason for revert:
https://ci.chromium.org/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release/3544

Original change's description:
> [liftoff][arm64] Use 64 bit offset reg in mem op
>
> Accessing the Wasm memory with a 64 bit offset was truncated to 32 bit,
> which is fine if we check bounds first, but not if we rely on the
> trap handler to catch the OOB.
>
> R=​clemensb@chromium.org
>
> Bug: v8:11587
> Change-Id: I82a3a2906e55d9d640c30e770a5c93532e3a442c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808942
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73829}

Bug: v8:11587
Change-Id: If7396981d43833f32ebc525c20abdbe78020e717
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810785
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73835}
2021-04-07 14:48:11 +00:00
Dominik Inführ
62635abc5b Rename root kTop to kStackRoots
IMHO kStackRoots is more descriptive than kTop.

Change-Id: I9eeffa6974ae0188021cb1628c2b21e691ab9490
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2810782
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73834}
2021-04-07 14:30:21 +00:00
Thibaud Michaud
7a4cece4d6 [wasm][fuzzer] Fuzz Liftoff debug code paths
Add a flag similar to the tiering mask to choose between regular
baseline code or debug code in Liftoff.

R=clemensb@chromium.org

Bug: chromium:1183774
Change-Id: I0e87154e2e1cd57679ce0c57bb1e075a97691248
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807603
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73833}
2021-04-07 14:29:16 +00:00
Clemens Backes
b0b4e6cabb [wasm] Fix --no-wasm-bounds-checks flag
If bounds checks are completely disabled (for performance testing) we
would still emit protected instructions which generate landing pads for
trap handlers in code generation. This CL fixes that by implicitly
disabling trap handling if stack checks are disabled.

R=ahaas@chromium.org

Bug: v8:10949
Change-Id: I1172087fb14ab56e9117c6eee388f71099568a13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808946
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73832}
2021-04-07 14:23:56 +00:00
Maya Lekova
0c3b422051 [compiler] Fix fast_c_api test object constructor
This CL fixes the behaviour of the d8.test.fast_c_api constructor when
the global object has been modified by not allowing calls to it without
the `new` keyword.

Bug: chromium:1196597
Change-Id: I49b4a412d501f5c9adaa72b63beec1483ab4c449
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808943
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73831}
2021-04-07 13:51:06 +00:00
Ulan Degenbaev
22282cabd0 [heap] Fix WriteBarrierForRangeImpl to use the right marking barrier
Change-Id: Ic00ce0856d6ce3f9c6872fa7f35c469f7177c9c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807605
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73830}
2021-04-07 13:11:16 +00:00
Thibaud Michaud
f645d0b857 [liftoff][arm64] Use 64 bit offset reg in mem op
Accessing the Wasm memory with a 64 bit offset was truncated to 32 bit,
which is fine if we check bounds first, but not if we rely on the
trap handler to catch the OOB.

R=clemensb@chromium.org

Bug: v8:11587
Change-Id: I82a3a2906e55d9d640c30e770a5c93532e3a442c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808942
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73829}
2021-04-07 13:05:36 +00:00
Junliang Yan
5dcd080889 s390x: [liftoff] Implement PrepareTailCall
Change-Id: I440b3bdabddce862a45127df4c72846c1f5c7fdd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808555
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73828}
2021-04-07 12:54:26 +00:00
Leszek Swirski
9d33c4e68e [tools] Add a tool for finding builtins
Example usage:
    tools/find-builtin LoadIC | xargs code -g

Change-Id: I12c15d3d4a80edbcddfa9cc8b9a515b839c96fdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808949
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73827}
2021-04-07 12:51:38 +00:00
Dan Elphick
301f3a4d19 [cleanup] Change base::CPU to use kCamelCase
ARM is often defined as a macro so this changes it to kArm and fixes
other cases in the same file.

Bug: v8:11384
Change-Id: Iab0149be03b3b0139e3335b91a25cb4bbb2f56e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808939
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73826}
2021-04-07 12:02:36 +00:00
Jakob Gruber
835f53e440 [regexp] Add --trace-regexp-graph
Until now we've only exposed trace output for the parse- and assembly
stages of regexp codegen. Debug tracing of the graph was missing. The
new --trace-regexp-graph flag fills that hole.

Available regexp codegen tracing flags are now:

--trace-regexp-parser
--trace-regexp-graph
--trace-regexp-assembler

The output of --trace-regexp-graph can be formatted with `dot`, for
example:

 $ d8 --trace-regexp-graph [...] | dot -Tjpg -o regexp-graph.jpg

Change-Id: Ice593c34f7818c94e42d98e98a31533178bb538b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808945
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73825}
2021-04-07 11:40:56 +00:00
Manos Koukoutos
eafdc074fb [wasm] Cache instance node in wrappers
Since wrappers do not get optimized,
https://chromium-review.googlesource.com/c/v8/v8/+/2739976 introduced
some performance regression by not caching nodes in the
WasmGraphBuilder. Therefore, we reintroduce caching of the instance
node. We do it in Start() to ensure the effect chain is correct.
Additional changes:
- Change signature of Start() to void.
- Initialize effect and control in Start().
- Rename BuildLoadInstance() -> GetInstance().

Bug: chromium:1189100
Change-Id: I9147f738e67b4f4b822c845e7d33d9fd4ceb65fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2804679
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73824}
2021-04-07 11:36:26 +00:00
Manos Koukoutos
997d88e64f [wasm] Always set message when TypecheckJSObject fails
Change-Id: Ifca0084272ec1f5ec781452c2a54d25cb4e80c95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807718
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73823}
2021-04-07 11:01:56 +00:00
Maya Lekova
1d63316ad4 [test] Disable fast_c_api exposure on correctness fuzzing
This CL disables exposing the d8.test.fast_c_api constructor when
we're doing correctness fuzzing to prevent TypeError when the object
is not defined (which happens when --turbo-fast-api-calls is not
passed).

Bug: chromium:1196569
Change-Id: I39069c736d11326419b7562189931afc69a485b0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808940
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73822}
2021-04-07 10:12:06 +00:00
Sara Tang
05a89f9382 Guard system-instrumentation with V8_OS_WIN instead of V8_TARGET_OS_WIN. Re-enable ENABLE_SYSTEM_INSTRUMENTATION
Bug: v8:11043, chromium:1196278
Change-Id: I3c3ab07de909ad5b58dd9a99740ff5f59ab8165f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2809530
Reviewed-by: Nico Weber <thakis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73821}
2021-04-07 09:00:23 +00:00
Patrick Thier
59807ec552 Fix d8.test.verifySourcePositions
Add check, that passed argument is a HeapObject.

Bug: chromium:1196503
Change-Id: I23d951b5581781ad3c6867d81c765d13c329d3a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808936
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73820}
2021-04-07 08:59:13 +00:00
Maya Lekova
6fda802284 [test] Skip incompatible test under deopt_fuzzer
This CL skips the fast-api-calls mjsunit test, as it relies
on particular optimization/deoptimization patterns.

Bug: v8:11620
Change-Id: I4c2fd3b1db8aff73935dd6525fd0ad3edc307dd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808935
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73819}
2021-04-07 08:12:13 +00:00
Frank Tang
fb3a854eb7 Fix BestFitMatcher due to invalid locale id in ICU
Somehow we have no-NO-NY locale data in ICU and cause problem.

Bug: v8:11595
Change-Id: I68ba4c4c219bb3fbc88976f901a86219c44ea265
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782602
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73818}
2021-04-07 06:17:53 +00:00
v8-ci-autoroll-builder
e8e9e40d02 Update V8 DEPS.
Rolling v8/base/trace_event/common: 7af6071..cab90cb

Rolling v8/build: f95480f..52bfb9d

Rolling v8/buildtools/linux64: git_revision:a95c8a3ccc7de65eb740aa68a0d021cdc8550205..git_revision:dba01723a441c358d843a575cb7720d54ddcdf92

Rolling v8/third_party/aemu-linux-x64: RDM8t3fsvkJHrC_GtCTB1D0dnK1Xv1ZqnZI2DXJ6_4wC..RQd3qSR12Rp6wgHjC31u-jwbITCfk3M-ZJyL6s1ju4sC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/13c4bd1..41a5e5e

Rolling v8/third_party/depot_tools: da76875..3f562c0

Rolling v8/tools/clang: db62979..a387faa

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I887fb192791aac410a5311afc6e707d60347c203
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2809940
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73817}
2021-04-07 04:07:53 +00:00
Ng Zhi An
84fec6adee [wasm-simd] Move more macro-assembler functions into SharedTurboAssembler
Bug: v8:11589
Change-Id: I875135f4a39f56f14a1f08e149a70b1d884bf68a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808005
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73816}
2021-04-07 00:12:43 +00:00
Junliang Yan
b0d3df5357 s390x: [liftoff] implement emit_i32_cond_jumpi
Change-Id: Iec87fc746329665cc98755260d344580a5e615c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2808256
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73815}
2021-04-06 22:47:52 +00:00
Junliang Yan
7509cd65c7 s390x:[liftoff] implement AtomicStore
Change-Id: I9ca5ffe40f6d548b032609d98a6bf6df23f31e0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2805933
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73814}
2021-04-06 20:48:52 +00:00
Nico Weber
6880cc2ddb Make it possible to cross build linux->win in standalone v8 builds
With this, you can add `target_os = ['win']` to your .gclient file,
re-run runhooks, and then:

    $ cat out/gnwin/args.gn
    target_os = "win"
    use_goma = true

    $ gn gen out/gnwin
    Done. Made 234 targets from 103 files in 311ms

    $ ninja -C out/gnwin d8 -j1000
    ninja: Entering directory `out/gnwin'
    [1051/1051] LINK d8.exe d8.exe.pdb

    $ file out/gnwin/d8.exe
    out/gnwin/d8.exe: PE32+ executable (console) x86-64, for MS Windows

cbruni asked for this in
https://bugs.chromium.org/p/chromium/issues/detail?id=1196278#c6
I thought I'd give it a try and went to my v8 standalone checkout, only
to find that that already had a local diff for this. So I guess someone
else must've asked for this a while ago, so might as well check this in :)

Bug: chromium:1196278
Change-Id: I14909cc79912c0260f8d9db44f511dd7754aa172
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2805934
Auto-Submit: Nico Weber <thakis@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73813}
2021-04-06 19:34:42 +00:00
Michael Achenbach
7aff133fb3 Revert "Reland "[test] Extend testing on Mac on arm64""
This reverts commit f41bc94b13.

Reason for revert: Some failures left:
https://ci.chromium.org/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20release/3522

Original change's description:
> Reland "[test] Extend testing on Mac on arm64"
>
> This is a reland of f187d0a13f
>
> The cctest breakage got fixed in the meantime.
>
> Original change's description:
> > [test] Extend testing on Mac on arm64
> >
> > Ensure more testing of --future for different test types on Mac.
> >
> > No-Try: true
> > Bug: v8:11527
> > Change-Id: Iac499dc48dde3342ad2057f86ef1ad5fa43b4eac
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2772981
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#73514}
>
> No-Try: true
> Bug: v8:11527
> Change-Id: Ie82c69e652f84a7ac43436d28806e70f27aa3e72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807601
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73806}

Bug: v8:11527
Change-Id: Ic696eb094ee745fa405412268c898bed81f5f39a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2805817
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73812}
2021-04-06 16:34:04 +00:00
Patrick Thier
69d706dc5f Allow only JSFunction/JSBoundFunction in d8.test.verifySourcePositions
Explicitly check for JSFunction or JSBoundFunction and throw if any other
JS type is passed to d8.test.verifySourcePositions.

Bug: chromium:1195717
Change-Id: Id65875526d5d6b3f720850d41d0a8192ec407035
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807607
Auto-Submit: Patrick Thier <pthier@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73811}
2021-04-06 16:23:42 +00:00
Igor Sheludko
db2acd7a04 [const-tracking] Ensure map is updated before generalizing constness
... when reconfiguring property attributes.

Bug: chromium:1195331
Change-Id: I65a29f0ad303a603207376a283e943480c4b18d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807608
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73810}
2021-04-06 16:13:32 +00:00
Camillo Bruni
f0399fa1d9 [diagnostics] Disable system instrumentation by default
Disabling temporarily since it breaks chrome cross-builds on linux.

Bug: v8:11043, chromium:1196278
Change-Id: I2d2a0c8b88b357da52217d1672aaa1377759df07
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2805816
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73809}
2021-04-06 15:51:52 +00:00
Clemens Backes
807064368d [Liftoff] Unify builtin calling logic
This factors out the duplicated logic for calling builtins in Liftoff.
Recording a source position is optional, but many call sites so far
missed it even though it would be helpful for debugging e.g. in case of
OOM errors. Thus this CL adds source positions for most builtin calls.

R=ahaas@chromium.org

Change-Id: Id4e3e2d0177dbb5dded533ed3ec294bdbec95e9f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807604
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73808}
2021-04-06 15:12:32 +00:00
Milad Fa
1b9d14a84e PPC/s390: Reland "[sparkplug] OSR Ignition -> Sparkplug"
Port 064ca18ca2

Original Commit Message:

    This is a reland of b9c521d0ea.

    Fixes crashes by calling kInstallBaselineCode from BaselineEntry if
    needed, i.e. when there is no feedback vector (required a bit of
    register rejiggling).
    This can happen with cross-realm calls. The OSR arming is stored as
    part of the BytecodeArray and therefore shared across realms.

    Original change's description:
    > [sparkplug] OSR Ignition -> Sparkplug
    >
    > Add support for OSR to baseline code.
    > We compile baseline and perform OSR immediately when the bytecode budget
    > interrupt hits.
    >
    > Drive-by: Clean-up deoptimizer special handling of JumpLoop by using
    > the newly introduced GetBaselinePCForNextExecutedBytecode instead of
    > GetBaselineEndPCForBytecodeOffset.
    >
    > Bug: v8:11420
    > Change-Id: Ifbea264d4a83a127dd2a11e28626bf2a5e8aca59
    > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2784687
    > Commit-Queue: Patrick Thier <pthier@chromium.org>
    > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#73677}

R=pthier@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: I724e8f7a3a2064daae282d892c0e0d6dbd8b691a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807854
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#73807}
2021-04-06 15:08:02 +00:00
Michael Achenbach
f41bc94b13 Reland "[test] Extend testing on Mac on arm64"
This is a reland of f187d0a13f

The cctest breakage got fixed in the meantime.

Original change's description:
> [test] Extend testing on Mac on arm64
>
> Ensure more testing of --future for different test types on Mac.
>
> No-Try: true
> Bug: v8:11527
> Change-Id: Iac499dc48dde3342ad2057f86ef1ad5fa43b4eac
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2772981
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73514}

No-Try: true
Bug: v8:11527
Change-Id: Ie82c69e652f84a7ac43436d28806e70f27aa3e72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807601
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73806}
2021-04-06 14:17:39 +00:00
Omer Katz
8a26290143 cppgc: Implement testing APIs
These are used by v8_wrapper/heap_test_utilities.* in Blink.
See crrev.com/c/2787126 for usage.

Bug: chromium:1056170
Change-Id: I329b1823f2ac21181a3536577ed72bee3d591347
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2786842
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73805}
2021-04-06 13:44:29 +00:00
Jakob Gruber
089218a87a Remove two ReconfigureX methods on Map
.. and inline them into callsites. These were thin wrappers around
MapUpdater methods.

This is part of moving towards MapUpdater as the bottleneck for map
updates.

Bug: v8:7790
Change-Id: Ie79ee063b83892d3c233581832361295aeb8e90f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807600
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73804}
2021-04-06 13:39:49 +00:00
Patrick Thier
064ca18ca2 Reland "[sparkplug] OSR Ignition -> Sparkplug"
This is a reland of b9c521d0ea.

Fixes crashes by calling kInstallBaselineCode from BaselineEntry if
needed, i.e. when there is no feedback vector (required a bit of
register rejiggling).
This can happen with cross-realm calls. The OSR arming is stored as
part of the BytecodeArray and therefore shared across realms.

Original change's description:
> [sparkplug] OSR Ignition -> Sparkplug
>
> Add support for OSR to baseline code.
> We compile baseline and perform OSR immediately when the bytecode budget
> interrupt hits.
>
> Drive-by: Clean-up deoptimizer special handling of JumpLoop by using
> the newly introduced GetBaselinePCForNextExecutedBytecode instead of
> GetBaselineEndPCForBytecodeOffset.
>
> Bug: v8:11420
> Change-Id: Ifbea264d4a83a127dd2a11e28626bf2a5e8aca59
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2784687
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73677}

Bug: v8:11420
Change-Id: I67325450514ed5a1170b730b1dd59fa6acc6e1d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2800112
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73803}
2021-04-06 12:07:39 +00:00
Dominik Inführ
d0778a8d53 [heap] Make stress_concurrent_allocation more resilient against OOM
Allow all allocations to fail in StressConcurrentAllocatorTask, this
still stresses the concurrent allocation code path but makes
--stress-concurrent-allocation more resilient against OOM. In case the
allocation fails try to start a GC.

Bug: v8:9337
Change-Id: I3633687d67d3a135114a3ea46b5238378153f377
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2797280
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73802}
2021-04-06 11:40:19 +00:00
Maya Lekova
7a17ddf4c0 Reland "[fastcall] Add fast API testing facilities to d8"
This is a reland of 9eba2d85f4.
The reland fixes a global state variable which was incompatible
with the --isolate flag in d8, which runs the same script in a
different isolate.

Original change's description:
> [fastcall] Add fast API testing facilities to d8
>
> This CL provides the minimum necessary functionality to expose fast API
> for testing in mjsunit, exposing the fast path for fuzzing. It exposes
> a d8.test.fast_c_api with an `add_all` method, which exercises primitive
> types. On x64, all integer and floating point types are supported. On
> other platforms currently only 32-bit integers are included in the test.
>
> Design doc:
> https://docs.google.com/document/d/1KUKPfXkSRZTA2gMwaWbpQKlYfw0C-T6AE3XzC4viHbo/
>
> Bug: chromium:1052746
> Change-Id: Icc824199a26dd2abd2b869f5483a39d38e4dce3e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2749154
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73670}

Bug: chromium:1052746
Change-Id: I33b265b97bf7c797eee7d4cce5066999358a8c66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2790174
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73801}
2021-04-06 11:26:09 +00:00
cjihrig
501482cbc7 Fix ValueDeserializer::ReadDouble() bounds check
If end_ is smaller than sizeof(double), the result would wrap
around, and lead to an invalid memory access.

Refs: https://github.com/nodejs/node/issues/37978
Change-Id: Ibc8ddcb0c090358789a6a02f550538f91d431c1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2801353
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73800}
2021-04-06 10:30:49 +00:00
Michael Lippautz
ced669daf9 heap: Remove context disposal GCs
Full GCs on non-main-frame context disposals show up on real-world web
workloads and often cause missed frames. Remove and let the regular
scheduler take over these workloads.

Bug: chromium:1191325
Change-Id: Ib58419e4623c096321860db05c36ddf9c8e9f4e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2773347
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73799}
2021-04-06 09:19:09 +00:00
Michael Achenbach
b19385f555 [foozzie] Suppress .caller access with correctness fuzzing
Bug: chromium:1042556, chromium:1186279
Change-Id: I77e9967891efad4ce151e231f7f6461be2922ba7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2802291
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73798}
2021-04-06 08:49:38 +00:00
K. Moon
1f5da7a7af Fix MSVC builds with is_debug=true
PDFium builds V8 with MSVC and is_debug=true (which is not a
configuration covered by the V8 bots). crrev.com/c/2690588 introduced a
DCHECK_EQ which triggers an MSVC compiler error due to comparing a bool
and a uint8_t value.

This change converts the uint8_t value into a bool using "!!", fixing
the MSVC error. This will unblock V8 rolls into PDFium.

Example build log:
https://logs.chromium.org/logs/pdfium/buildbucket/cr-buildbucket.appspot.com/8851041716432959712/+/steps/compile_with_ninja/0/stdout

Change-Id: I5c365696ead7958709df145ccc2e5f796dec80ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806743
Auto-Submit: K. Moon <kmoon@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73797}
2021-04-06 07:08:39 +00:00
v8-ci-autoroll-builder
4eeedf30ba Update V8 DEPS.
Rolling v8/build: 5ed00b7..f95480f

Rolling v8/buildtools/linux64: git_revision:5667cc61018864b17542e0baff8b790f245583b0..git_revision:a95c8a3ccc7de65eb740aa68a0d021cdc8550205

Rolling v8/third_party/aemu-linux-x64: 3rPTIlJKMg1Z5vCo_OfxOVIQD_pJ1XvXE7OcYDYNk8cC..RDM8t3fsvkJHrC_GtCTB1D0dnK1Xv1ZqnZI2DXJ6_4wC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/3d2081b..13c4bd1

Rolling v8/tools/clang: e9b86a1..db62979

TBR=v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ica14332bc7d6e3905a5f029670f224dbe683fbef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2807159
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#73796}
2021-04-06 04:02:29 +00:00
Shu-yu Guo
627b6b2f06 Reland^2 "[ptr-cage] Rename IsolateRoot to PtrComprCageBase"
This is a reland of e28dadc207

The original failure was due to a stale Win32 bot. The reland failure
was due to idempotent task deduplication returning the exact same
failure. See crbug/1196064

Original change's description:
> [ptr-cage] Rename IsolateRoot to PtrComprCageBase
>
> Currently, IsolateRoot is both the address of the Isolate root and the
> base address of the pointer compression reservation. This CL teases the
> two uses apart by renaming IsolateRoot to PtrComprCageBase.
>
> - In addition to V8_COMPRESS_POINTERS, add a
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).
>
> - Rename GetIsolate* helpers to GetPtrComprCageBase. When
>   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
>   aliases to GetPtrComprCageBase.
>
> - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.
>
> Bug: v8:11460
> Change-Id: I1d715f678ce9a0b5731895612ca14f56579b1c48
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Auto-Submit: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73790}

Bug: v8:11460
No-Try: true
Tbr: ishell@chromium.org
Tbr: rmcilroy@chromium.org
Change-Id: Id69311cf3267ebe1297fff159de0be48b15b65a3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806546
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73795}
2021-04-06 01:55:28 +00:00
Ng Zhi An
4b90ad752a [wasm-simd] Move some macro-assembler functions to shared
These functions have the same signature for both SSE and AVX versions.
We move them all into SharedTurboAssembler. Need to fixup a couple of
callsites, since now we use a template helper to call the right
function, whereas previously it was overloaded and there was implicit
conversions from int to uint8_t.

Bug: v8:11589
Change-Id: I8b4146ba1fb838f6b0d6f78f6b95495b8988fc4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2800569
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73794}
2021-04-06 00:02:18 +00:00
Shu-yu Guo
562c42511a Revert "Reland "[ptr-cage] Rename IsolateRoot to PtrComprCageBase""
This reverts commit 15c78b45a6.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32277/overview

Original change's description:
> Reland "[ptr-cage] Rename IsolateRoot to PtrComprCageBase"
>
> This is a reland of e28dadc207
>
> Relanding to see if Win32 rel failures from
> https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32/32275/overview
> were infra flakes. Could not repro on try bots.
>
> Original change's description:
> > [ptr-cage] Rename IsolateRoot to PtrComprCageBase
> >
> > Currently, IsolateRoot is both the address of the Isolate root and the
> > base address of the pointer compression reservation. This CL teases the
> > two uses apart by renaming IsolateRoot to PtrComprCageBase.
> >
> > - In addition to V8_COMPRESS_POINTERS, add a
> >   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE (vs SHARED_CAGE).
> >
> > - Rename GetIsolate* helpers to GetPtrComprCageBase. When
> >   V8_COMPRESS_POINTERS_IN_ISOLATE_CAGE is true, the helpers remain as
> >   aliases to GetPtrComprCageBase.
> >
> > - Rename kPtrComprIsolateRootAlignment to kPtrComprCageBaseAlignment.
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2783672
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
>
> No-Try: true
> Bug: v8:11460
> Tbr: ishell@chromium.org
> Tbr: rmcilroy@chromium.org
> Change-Id: I0a8c3a48999d6737c8c64d2c2703607f14f3fdd0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806169
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73792}

Bug: v8:11460
Change-Id: Ifee92d622c43a91c15f45ef94ff739237bd2024b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2806545
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73793}
2021-04-05 23:17:00 +00:00