- Add a new broker mode kRetired, in which the heap can
again be accessed.
- Change the way modes work. We now always start in kDisabled.
If FLAG_concurrent_compiler_frontend is on, we eventually move
to kSerializing, then to kSerialized, then to kRetired.
- Add an ObjectDataKind to ObjectData that indicates whether the
data is just a dummy (i.e. created while broker was in kDisabled
mode).
This also happens to fix a bug found by clusterfuzz.
Bug: v8:7790, chromium:889722
Change-Id: I38833fe7ad26d2d3efb15ba560576defb82f673a
Reviewed-on: https://chromium-review.googlesource.com/1245425
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56260}
Make {AllocateForCode} return an actual buffer, and move the OOM check
into that method. This allows us to generate more precise OOM messages.
R=mstarzinger@chromium.org
Change-Id: Ie9ed81248fe8068c92eec29a4911ffef43032de2
Reviewed-on: https://chromium-review.googlesource.com/1245769
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56258}
This fixes a bug that the variables used to implement labels with
parameters in CSA leak into the user-accessible scope.
Example:
macro Foo() labels Bar(Smi) {
Bar0 = 5;
}
Bug: v8:7793
Change-Id: I33bf5a207c7e9e7337fa79fc7591c05901b2fa5b
Reviewed-on: https://chromium-review.googlesource.com/1246183
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56257}
There is a data race if several background threads check for a tracing
flag concurrently. Both will call {GetCategoryGroupEnabledInternal}.
The first one not find the category in the {g_category_group_enabled}
array, and hence will add it and call {UpdateCategoryGroupEnabledFlag}
to initialize the flag. The second thread then finds the entry in the
array and reads it without any synchronization, which is a data race.
Since we do not really care about this race, we just use a
{Relaxed_Load} to read the field. TSan is fine with that.
R=yangguo@chromium.orgCC=ofrobots@google.com
Bug: v8:8221
Change-Id: Ie09141e3d845956d3c487a463f00b7d6cd413513
Reviewed-on: https://chromium-review.googlesource.com/1245424
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56256}
This reverts commit 0352ea97da.
Reason for revert: A dependent patch broke the build https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20gcc%204.8/22123
Original change's description:
> [heap profiler] Refactor: remove SnapshotFiller proxy
>
> Long time ago there were two passes over heap. One was counting
> objects and edge and another was filling them. Since then we have
> just a single pass, but the filler object is still there.
>
> Remove it for the sake of layering simplicity.
>
> Change-Id: Ic873eb5ca616b9dcae17fe388197dde8f539026f
> Reviewed-on: https://chromium-review.googlesource.com/1244380
> Commit-Queue: Alexei Filippov <alph@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56246}
TBR=ulan@chromium.org,alph@chromium.org,mlippautz@chromium.org
Change-Id: If71ddcc0008d138054074fc4cca3f38e032763e0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1246234
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56247}
Long time ago there were two passes over heap. One was counting
objects and edge and another was filling them. Since then we have
just a single pass, but the filler object is still there.
Remove it for the sake of layering simplicity.
Change-Id: Ic873eb5ca616b9dcae17fe388197dde8f539026f
Reviewed-on: https://chromium-review.googlesource.com/1244380
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56246}
That change is attempting to surface the root cause of a recent flake,
see the related bug.
Bug: v8:8228
Change-Id: Iebed5b8f46db3fd47154031856dc7ea173cf3d7f
Reviewed-on: https://chromium-review.googlesource.com/1245771
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56244}
Before I gave the preparser its own zone this was the case. I somewhat
accidentally dropped it when I used set_zone instead; causing large regressions
for certain types of pages.
Bug: chromium:889086
Change-Id: Ib3cf1f926b5c65506c66a97981c4544dccb372aa
Reviewed-on: https://chromium-review.googlesource.com/1245767
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56243}
Deprecate GetCodeRange(void** start, size_t* length_in_bytes) in favor
of a new signature MemoryRange GetCodeRange() which is consistent with
that of GetEmbeddedCodeRange.
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic5e244981422a2c75485c851ca768e54914cc539
Reviewed-on: https://chromium-review.googlesource.com/1245741
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56241}
This method only has a single user, and can be implemented in a few
lines, so just inline it.
R=ahaas@chromium.org
Bug: v8:8015
Change-Id: I26247d97ebb939274fa72cc5441e8c2e0c6bc869
Reviewed-on: https://chromium-review.googlesource.com/1245743
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56239}
The idea of movable data structures is to pass them by value. This is
also preferred by the style guide.
R=ahaas@chromium.orgCC=sattlerf@google.com
Bug: v8:8015
Change-Id: Ica016425d624f4497e374b25b363c1f2eb49b4c0
Reviewed-on: https://chromium-review.googlesource.com/1245762
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56238}
Surviving large objects are directly promoted to the old generation.
Bug: chromium:852420
Change-Id: I460649714544d4338e01085f487d4b70065ecfb5
Reviewed-on: https://chromium-review.googlesource.com/1238173
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56237}
In particular: MapForFixedTypedArray() and EmptyFixedTypedArrayForMap().
And make ReadOnlyRoots object independent of the Heap.
Bug: v8:8015
Change-Id: Ifd17294661fac21c8e7545145280c8a2dedfe8c3
Reviewed-on: https://chromium-review.googlesource.com/1243131
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56234}
This reverts commit eccf186749.
Reason for revert: Speculative revert because it seems to introduce a pretty stable flake on gc stress tests, see https://bugs.chromium.org/p/v8/issues/detail?id=8229
Original change's description:
> [interpreter] Separate bytecodes for one-shot property loads and stores
>
> Create LdaNamedPropertyNoFeedback and StaNamedPropertyNoFeedback
> for one-shot property loads and stores. This CL replaces the runtime
> calls with new bytecodes for named property load stores in one-shot code.
> the runtime calls needed extra set of consecutive registers and
> additional move instructions. This increased the size of
> bytecode-array and possibly extended the life time of objects.
> By replacing them with NoFeedback bytecodes we avoid these issues.
>
> Bug: v8:8072
> Change-Id: I20a38a5ce9940026171d870d354787fe0b7c5a6f
> Reviewed-on: https://chromium-review.googlesource.com/1196725
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Chandan Reddy <chandanreddy@google.com>
> Cr-Commit-Position: refs/heads/master@{#56211}
TBR=rmcilroy@chromium.org,yangguo@chromium.org,jarin@chromium.org,neis@chromium.org,cbruni@chromium.org,chandanreddy@google.com
Change-Id: I445db58e6d4c275b434fabad5fad775bf259033f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8072
Reviewed-on: https://chromium-review.googlesource.com/1245421
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56232}
Atomics.{load,store,add,sub,and,or,xor,exchange,compareExchange}
are updated to support BigInt and BigInt64Array/BigUint64Array inputs.
Atomics.{wait,wake,isLockFree} are left unchanged for now.
Bug: v8:8100
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I8862d7e18c58ae08784535e9c010ba94f067a0ee
Reviewed-on: https://chromium-review.googlesource.com/1237294
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56228}
The CHECK was introduced in d7ae63e6f2.
The first time the property got read by ToDateTimeOptions
and the test will cause the needsDefault in ToDateTimeOptions
be false. Then in step 22 of InitializeDateTimeFormat,
it will get all undefined and cause the
skeleton to be empty string. If we only pass in empty options, the
defaults will be filled by ToDateTimeOptions and won't cause any
CHECK failure.
Bug: chromium:888299
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I3ee14434f0708eaaea78cc8857591152d1bdef8a
Reviewed-on: https://chromium-review.googlesource.com/1241316
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56226}
src/compiler/ppc/instruction-selector-ppc.cc: ensure that input register
does not alias any temporary registers in VisitWord64ReverseBytes method.
Change-Id: I18ddfc5cbe37ba7551ca25efa59d4973f77ffb02
Reviewed-on: https://chromium-review.googlesource.com/1244617
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#56225}
This is a reland of bcb8d49b2cTBR=petermarshall@chromium.org
Original change's description:
> [snapshot] add checksum to startup snapshot
>
> We already had checksumming for code cache data. We now extend
> checksumming to the startup snapshot to catch data corruption early.
>
> The performance impact for deserialization is a regression of 1-2%,
> which should be acceptable.
>
> Sample output for the included test with --profile-deserialization:
>
> [Verifying snapshot checksum took 0.023 ms]
> [Deserializing isolate (134348 bytes) took 1.891 ms]
> [Verifying snapshot checksum took 0.024 ms]
> [Deserializing isolate (134348 bytes) took 1.654 ms]
> [Deserializing context #0 (47208 bytes) took 0.331 ms]
> Deserialization will reserve:
> 208168 bytes per isolate
> 123368 bytes per context #0
> Snapshot blob consists of:
> 134492 bytes in 6 chunks for startup
> 115272 bytes for builtins
> 47152 bytes in 31 chunks for context #0
> [Verifying snapshot checksum took 0.048 ms]
> [Verifying snapshot checksum took 0.043 ms]
>
> R=peria@chromium.org, petermarshall@chromium.org
>
> Bug: chromium:881417
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: Ibc57520d459c86be8972f731aa35045b5e3751d7
> Reviewed-on: https://chromium-review.googlesource.com/1241874
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56217}
Bug: chromium:881417
Change-Id: I037f378fc2d45c3e0fa670bf538df68cbba5c53c
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1243191
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56224}
Maybe (defined in include/v8.h) is an API object, not meant to be used
in internal code. Instead of failing, it will call a callback on the
isolate.
It also adds one word to the size of each WasmCode object.
This CL avoids its use WasmCode. Instead, we use a sentinel value as the
function index of anonymous functions and add proper DCHECKs.
R=mstarzinger@chromium.org
Bug: v8:8015
Change-Id: I4bb155e814d8d0cc9e40b33202b4431718ac79b1
Reviewed-on: https://chromium-review.googlesource.com/1242096
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56222}
This reverts commit bcb8d49b2c.
Reason for revert: MSan compile error: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/23025
Original change's description:
> [snapshot] add checksum to startup snapshot
>
> We already had checksumming for code cache data. We now extend
> checksumming to the startup snapshot to catch data corruption early.
>
> The performance impact for deserialization is a regression of 1-2%,
> which should be acceptable.
>
> Sample output for the included test with --profile-deserialization:
>
> [Verifying snapshot checksum took 0.023 ms]
> [Deserializing isolate (134348 bytes) took 1.891 ms]
> [Verifying snapshot checksum took 0.024 ms]
> [Deserializing isolate (134348 bytes) took 1.654 ms]
> [Deserializing context #0 (47208 bytes) took 0.331 ms]
> Deserialization will reserve:
> 208168 bytes per isolate
> 123368 bytes per context #0
> Snapshot blob consists of:
> 134492 bytes in 6 chunks for startup
> 115272 bytes for builtins
> 47152 bytes in 31 chunks for context #0
> [Verifying snapshot checksum took 0.048 ms]
> [Verifying snapshot checksum took 0.043 ms]
>
> R=peria@chromium.org, petermarshall@chromium.org
>
> Bug: chromium:881417
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: Ibc57520d459c86be8972f731aa35045b5e3751d7
> Reviewed-on: https://chromium-review.googlesource.com/1241874
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56217}
TBR=peria@chromium.org,yangguo@chromium.org,petermarshall@chromium.org
Change-Id: Iccb82092858ab68a5d6ae9552fa716108eda354b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:881417
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1243190
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56221}
For WASM import calls to JSFunctions where the arity is mismatched,
we currently generate code that inlines the formal parameter count
of the target function as a constant in a call to the arguments
adapter. This CL changes this to generate code that loads the formal
parameter count from the function at runtime in order to permit
more sharing later.
R=mstarzinger@chromium.orgCC=clemensh@chromium.org
Change-Id: I5cce97fc338f6468f9d42d48f5bc860b25fb7d73
Reviewed-on: https://chromium-review.googlesource.com/1243108
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56220}
I moved AnalyzePartially from ParseFunctionLiteral to SkipFunction, but arrow
functions only used the ResetAfterPreparsing part.
Bug: chromium:888825
Change-Id: I08de99af128b28031df6ed86a725e4dc918078f8
Reviewed-on: https://chromium-review.googlesource.com/1243383
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56218}
We already had checksumming for code cache data. We now extend
checksumming to the startup snapshot to catch data corruption early.
The performance impact for deserialization is a regression of 1-2%,
which should be acceptable.
Sample output for the included test with --profile-deserialization:
[Verifying snapshot checksum took 0.023 ms]
[Deserializing isolate (134348 bytes) took 1.891 ms]
[Verifying snapshot checksum took 0.024 ms]
[Deserializing isolate (134348 bytes) took 1.654 ms]
[Deserializing context #0 (47208 bytes) took 0.331 ms]
Deserialization will reserve:
208168 bytes per isolate
123368 bytes per context #0
Snapshot blob consists of:
134492 bytes in 6 chunks for startup
115272 bytes for builtins
47152 bytes in 31 chunks for context #0
[Verifying snapshot checksum took 0.048 ms]
[Verifying snapshot checksum took 0.043 ms]
R=peria@chromium.org, petermarshall@chromium.org
Bug: chromium:881417
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ibc57520d459c86be8972f731aa35045b5e3751d7
Reviewed-on: https://chromium-review.googlesource.com/1241874
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56217}
.. otherwise V8 crashes on attempt to use imported function as part
of expression passed to Debugger.evaluateOnCallFrame.
R=neis@chromium.org
Bug: chromium:878029
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I61b837f5c7b84a80d91a9cdaaac0422a24aa1620
Reviewed-on: https://chromium-review.googlesource.com/1241475
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56216}
This reduces the size a "Throw" or "Rethrow" takes in generated code by
switching from runtime calls to using WebAssembly runtime stubs. It also
removes a specialized runtime function and instead uses {Runtime_Throw}
which is generic and used by all code (including JavaScript code).
R=clemensh@chromium.org
BUG=v8:8091
Change-Id: Id4f637525f2ea9d81227931b1290d90ca5f376d1
Reviewed-on: https://chromium-review.googlesource.com/1243106
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56215}
Whenever we insert new code in the module, we call {set_code} and
{PatchJumpTable}. This CL refactors these two calls into a new
{InstallCode} method. This method will be extended in a future CL to
maintain a counter of potentially dead code and trigger GC.
R=mstarzinger@chromium.org
Bug: v8:8217
Change-Id: I1a1421806c8518cf7b6b78fe4aa2e969d4e4dde6
Reviewed-on: https://chromium-review.googlesource.com/1243003
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56214}
The lifetime of the AsyncCompileJob does not depend on the lifetime of
the stream which feeds data into it. Multiple checks guarantee that the
AsyncCompileJob still exists when the stream wants to call it. With
this CL we add an additional level of defense to make sure that
streaming does not continue after the AsyncCompileJob got destructed.
It is not clear if this CL fixes the bug referenced below. However, the
crashes there could be caused when streaming accesses the
AsyncCompileJob after it got destructed already. I was not able though
to find a scenario where this is possible.
R=clemensh@chromium.org
Bug: chromium:888170
Change-Id: Id5c6cc34842735a3adaf3e09c57cbe923cfc2630
Reviewed-on: https://chromium-review.googlesource.com/1241961
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56213}
This CL makes UnoptimizedCompilationJob a simple proxy for
BackgroundCompilerTask. A follow-up CL will remove UnoptimizedCompilationJob
entirely and have CompilerDispatcher deal directly with BackgroundCompilerTasks
BUG=v8:8041, v8:8015
Change-Id: Ia53d05c015c4ca2ee32a4d1c5d0c65edb3caeda8
Reviewed-on: https://chromium-review.googlesource.com/1236257
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56212}
Create LdaNamedPropertyNoFeedback and StaNamedPropertyNoFeedback
for one-shot property loads and stores. This CL replaces the runtime
calls with new bytecodes for named property load stores in one-shot code.
the runtime calls needed extra set of consecutive registers and
additional move instructions. This increased the size of
bytecode-array and possibly extended the life time of objects.
By replacing them with NoFeedback bytecodes we avoid these issues.
Bug: v8:8072
Change-Id: I20a38a5ce9940026171d870d354787fe0b7c5a6f
Reviewed-on: https://chromium-review.googlesource.com/1196725
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#56211}
