It doesn't need to implement its own iteration logic, if we refactor a bit.
BUG=v8:10425
Change-Id: I9b33911c2fab9ac85cae847473dbef0c2e88ea96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153224
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67232}
This reverts commit ecc61b30b2.
Reason for revert: I will reland with the flag disabled.
Original change's description:
> [heap] Add a flag for performing incremental marking on allocation
>
> The flag is true by default and passing
> --noincremental-marking-on-allocation disables starting of incremental
> marking on allocation and incremental marking steps on allocation.
>
> Change-Id: I4537e0eeaaf93fb713fcacd3860e29b98df441fc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154194
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67228}
TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org
Change-Id: I7dd847513d1628e7137d9e10cb5e9058781a9634
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154803
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67231}
Space::AllocationStep already allocates a filler object at the given
address, so there's no need to do another filler object allocation in
the sampling profiler. In addition, this breaks allocation stepping over
areas that have already been initialized, such as off-thread pages being
merged.
Instead, we replace it with a DCHECK that there is a map at the start of
the allocated chunk, which serves as a proxy for "this area is
iteratable"
Change-Id: Ia0a1375ac83b944cf5631e6bef341805d27b6e96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122029
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67230}
The flag is true by default and passing
--noincremental-marking-on-allocation disables starting of incremental
marking on allocation and incremental marking steps on allocation.
Change-Id: I4537e0eeaaf93fb713fcacd3860e29b98df441fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154194
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67228}
These GC events will not be visualized in DevTools UI. The intention
is to have these events in JSON trace file for manual inspection during
offline/postmortem investigation of GC performance issues.
Bug: chromium:1072352
Change-Id: I3b05a0b2e5299f9d00d4c940eaf598a48f746aa2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154796
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67227}
The fast store handlers create elements and if we have a typed array
on the prototype chain it is not easy to check when it is OK to create
new elements. The TypedArrays swallow all OOB stores, and there is no
easy way to check if the current store is OOB for JSObjects. So use
slow stub when there are typed arrays on the prorotype chain of
JSObjects.
Bug: chromium:1068492
Change-Id: I9eea9cf00e3eb84931c5545d18ba53c4ec39f353
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2134138
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67226}
Previously, one single retained maps list was used across all contexts. When one context was disposed, this entire list of retained maps was disposed as well. This caused maps that were still alive to be disposed leading to deopts when such maps were embedded in code objects.
This patch makes the list of retained maps be per context so we can dispose only the dead maps.
Bug: v8:9684, v8:10431
Change-Id: I0a50f4f49c9f6d72367c62e950828a039220fdfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2122016
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67225}
Deserializer can trigger OOB read in the marking bitmap inside the
RegisterDeserializedObjectsForBlackAllocation function. This happens
for example if an internalized string is deserialized as the last object
on a page and is the turned into a thin-string leaving a one-word filler
at the end of the page. In such a case IsBlack(filler) will try to fetch
a cell outside the marking bitmap.
The fix is to increase the size of the marking bitmap by one cell, so
that it is always safe to query markbits of any object on a page.
Bug: chromium:978156
Change-Id: If3c74e4f97d2caeb3c3f37a4147f38dea5f0e5a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152838
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67223}
... against potential typer bugs. Instead of simply eliminating the
operation, insert an aborting bounds check instead.
Also move this transformation out of SimplifiedLowering, which is
already complex enough without doing these kinds of optimizations.
Unfortunately this will result in some missed optimization opportunities
because we may have more precise types during SimplifiedLowering. Let's
see if this makes a visible performance difference.
Change-Id: I9c16ad33104c29fdba39bf729d69ee03fc9797d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2129633
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67222}
This patch replaces V8's tracing implementation (i.e., the TRACE_EVENT
macros) with the track event base implementation from Perfetto. The
advantages of doing this are:
1) This allows us to remove most tracing-related backend code from V8.
2) V8 can start writing strongly typed trace event arguments, which
are more compact, easier to process and more extensible than legacy
JSON-based trace arguments.
For the time being, we still support the old trace macros when V8 is
embedded into Chrome and other embedders.
Design doc: https://docs.google.com/document/d/1f7tt4cb-JcA5bQFR1oXk60ncJPpkL02_Hi_Bc6MfTQk/edit#heading=h.398p6b4eaen2
Bug: chromium:1006766
Change-Id: Ie71474fbe065821772b13d851487ebbca680c4ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1947688
Commit-Queue: Sami Kyöstilä <skyostil@chromium.org>
Auto-Submit: Sami Kyöstilä <skyostil@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67217}
And a new flag --experimental-wasm-gc, which doesn't do anything yet.
Bug: v8:7748
Change-Id: I927d1d90559249db3ee9f8d240775d45098e52a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154197
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67215}
{StaticCharVector}, according to its name, should return a
{Vector<const char>}. For getting a {Vector<const uint8_t>}, the method
should be called {StaticOneByteVector}, analog to the
{OneByteVector} methods that already exist.
Also, {StaticCharVector} is constexpr, but {StaticOneByteVector} cannot
be, since it contains a {reinterpret_cast}. The same holds for
{Vector::cast} in general.
This CL
- changes the return type of {StaticCharVector} to be
{Vector<const char>},
- introduces a new {StaticOneByteVector} which returns
{Vector<const uint8_t>},
- fixes constexpr annotations at various methods returning {Vector}s,
- refactors users of {StaticCharVector} to either use
{StaticOneByteVector} instead, or work on {char} if that makes more
sense.
R=leszeks@chromium.org
Bug: v8:10426
Change-Id: I71e336097e41ad30f982aa6344ca3d67b3a01fe3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154196
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67213}
Currently it's possible to hit an internal compiler error by declaring a
non-extern class that doesn't extend anything. It's not very meanigful
for a class to not extend from anything, so the parser should enforce
this requirement.
Change-Id: I38064f87345d28ce84521261bbfd33d9b1c71334
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153847
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67212}
Test some constexpr factories. StaticCharVector is not actually
constexpr, this will be fixed in a follow-up CL.
R=leszeks@chromium.org
Bug: v8:10426
Change-Id: I16fdf79cd7d4b3f54d7cf73e15bdff2306810f06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154192
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67210}
These opcodes are not officially specified yet, they are defined
in the "prototype implementation spec" at https://bit.ly/3cWcm6Q.
Drive-by: drop a unit test whose entire coverage can be provided
by a compile-time check.
Bug: v8:7748
Change-Id: Icefa6dd321802c8a01c4561178b9d21eca1fbaa3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152841
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67208}
Even though {Factory::InternalizeString} was declared as a template,
only two instantiations exists: uint8_t and uint16_t. Using any other
type leads to link-time errors, which is inconvenient.
This CL implements the two instantiations explicitly, and provides a
third implementation taking a {Vector<const char>}. This will be used
after the next CL, which changes {StaticCharVector} to actually return a
{Vector<const char>}.
This also avoid the cumbersome template exports.
R=leszeks@chromium.org
Bug: v8:10426
Change-Id: I3f669fae2c711ade6f5a087e59210ad457423a66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152837
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67207}
This adds another enum value in the {ForDebugging} enum for stepping
code.
By not adding the code to the code table and jump table, we will never
execute this code via a wasm function call. The code will only be used
for the one frame where we want to step through.
This speeds up stepping over recursive calls enormously, since the
recursive calls don't run into the flooded breakpoints any more.
It also fixes issues with non-local control flow, i.e. catching a trap
and reentering the same wasm function.
R=thibaudm@chromium.org
Bug: v8:10235
Change-Id: Idb304dd465418f842016a20c21d68989bb78cf1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153205
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67205}
Stepping only happens in one frame at a time, so we don't need to
rewrite the whole stack. This allows us to remove the
{flooded_function_index_}, since no function is globally flooded any
more.
A follow-up CL will ensure that the code will also not be installed in
the code table and jump table any more, to fix issues with non-local
control flow (i.e. catching a trap and reentering wasm), where we
could currently accidentally execute flooded code. It will also speed
up stepping over recursive calls enormously, since the recursive calls
don't run into the flooded breakpoints any more.
R=thibaudm@chromium.org
Bug: v8:10235
Change-Id: Ifae5e35c3242c95e1fe1a89a169ce874b818a288
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152646
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67202}
NEONFormatDecoder::Substitute function utilizes snprintf()
to substitute arrangement specifier into a format string.
Some instruction format strings (e.i. ld4r) are specified
with '%n$' positional parameter fields, but on Windows
snprintf function doesn't support these parameters.
NEONFormatDecoder logic is extended to handle four parameters
in order to avoid using positional parameters.
Bug: v8:10365
Change-Id: I79d4014c6b45d698ca47090a74c30e4eae856334
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2148776
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67201}
This changelist adds to the GDB stub (in class wasm::gdb_server::Target) the
logic to decode and execute GDB-remote commands and to format response packets
to be sent back to the debugger.
Here most of the commands still act as a NOOP; the actual implementation
requires interactions with the Wasm engine and will be implemented in the next
CL of this series.
Build with: v8_enable_wasm_gdb_remote_debugging = true
Run with: --wasm-gdb-remote
Bug: chromium:1010467
Change-Id: Icfa63be9e1eaa657c05876d0d4e86927e0885b90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1938466
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67200}
GAS have a auto-align function which will align all the directive
data into it's nature boundary. And we're using .octa to present
data in embedded.S, which will be auto-aligned into 128-bit boundary.
It can break relatve offset in generated binary.
So we workaround it by forcing generate .long DataDirective on MIPS.
Also I rewoked WriteByteChunk so it can accept any kind of directive
now. Further more, implementation of HexLiteral is indentical on
generic, aix and mac so I merged them into base.
Bug: v8:10420
Change-Id: I0ff791412360769510735659f909524c5f96d3e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153187
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67198}
This changelist adds the logic to format, decode, sends and receive packets in
the format specified by the GDB-remote protocol
(https://sourceware.org/gdb/onlinedocs/gdb/Overview.html#Overview).
Build with: v8_enable_wasm_gdb_remote_debugging = true
Run with: --wasm-gdb-remote
Bug: chromium:1010467
Change-Id: Ibc9c6713c561d06847b472fab591c208c193199f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1929409
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67196}
Check that the argument passed to %OptimizeOsr is smi before accessing
it. If it isn't an Smi we crash unless we are fuzzing. When fuzzing,
this returns early (turns into a Nop) if the argument isn't an Smi.
Bug: chromium:1071045
Change-Id: Iff1ee3e368dfffdbbbab4107dc355d5460b996e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2150602
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67195}
Instead of putting the 16 immediate bytes on the stack,
we move them into a temporary register.
The instruction-selector then has to change, to ensure that
the operands are distinct from the temporary.
Tested on the two workloads given in
https://github.com/zeux/wasm-simd/issues/2#issuecomment-614399004
For slow, the row "filter:" oct12 goes from ~50ms to ~27ms,
the rest of the figures look about the same or slightly faster.
For optimal, the same figure goes from ~25ms to ~24ms,
the rest of the figures look slightly faster.
Raw outputs are uploaded to bug.
Bug: v8:10117
Change-Id: I7f77a3066b5e24584f1c01574aa9311f56bd7fb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152853
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67190}
.type directive is required on arm to enable ARM/Thumb interworking.
Bug: chromium:1071168
Change-Id: I2ff5046719b9c8f611e81970bfa61c68ed850362
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153207
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67188}
A new realm doesn't contain the mocks and suppressions on the global
object for correctness fuzzing. We replace Realm.eval with eval to
keep exercising the code.
Bug: chromium:1071133
Change-Id: Iffe82d37bf08829fc5937c17c2089277403e71dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2153206
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67187}
SIMD opcodes consist of the prefix byte, then an LEB128 encoded int. We
were decoding this incorrectly as a fixed uint8. This fixes the decoder
to properly handle multi bytes.
In some cases, the multi byte logic is applied to all prefixed opcodes.
This is not a problem, since for values < 0x80, the LEB encoding is a
single byte, and decodes to the same int. If the prefix opcode has
instructions with index >= 0x80, it would be required to be LEB128
encoded anyway.
There are a bunch of trivial changes to test-run-wasm-simd, to change
the macro from BUILD to BUILD_V, the former only works for single byte
opcodes, the latter is a new template-based macro that correct handles
multi-byte opcodes. The only unchanged test is the shuffle fuzzer test,
which builds its own sequence of bytes without using the BUILD macro.
Bug: v8:10258
Change-Id: Ie7377e899a7eab97ecf28176fd908babc08d0f19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2118476
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67186}
This is a follow-up fix for https://crrev.com/c/v8/v8/+/1491608
Bug: chromium:1051186
Change-Id: Ia76ad0e7665fe17013b45816350238c35e7199f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2049899
Reviewed-by: Frank Tang <ftang@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Yury Semikhatsky <yurys@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67184}
