Commit Graph

64745 Commits

Author SHA1 Message Date
Frank Tang
be3550bf70 Fix "japanese" and "chinese" calendar
Roll the icu to include the fix. The roll include previously
mistakenly filter out required resources.
Fix "japanese" under "ja" and calendar: "chinese" under "zh"
Depends on https://chromium-review.googlesource.com/c/chromium/deps/icu/+/2433166

This CL prepare for such landing:
1. Add test to show the correct result.
2. Wrap the number format static cast to DecimalFormat only if
   the concrete class is DecimalFormat. This is needed after the landing
   because the new resource enable other subclass of NumberFormat.
3. Change test to allow the additional numberingSystems.

Roll the the DEPS of chromium in
https://chromium-review.googlesource.com/c/chromium/src/+/2437820

Bug: v8:10960
Change-Id: Ib10b11862a093d1d487070f79556505bfc10bcc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432801
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70253}
2020-10-01 10:32:42 +00:00
Dominik Inführ
0e127b12e8 [heap] Update path of xml file in chromium for GarbageCollectionReason
Change-Id: Ib9956fb8ad6a129bf0df0775bc1e691a059cbd27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2442614
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70252}
2020-10-01 10:10:02 +00:00
Leszek Swirski
c5c67ce7be [heap] Lazily sort CodeObjectRegistry pointers
Rather than keeping a known-sorted list of existing Code objects, and an
eagerly sorted set of new Code objects, instead store a single vector
which is lazily sorted when needed.

We keep the distinciton between adding an existing or a new Code object,
so that we only have to clear the "sorted" bit when adding the latter;
plus we check if adding the new Code object would serendipitously keep
the vector sorted, just in case the new Code object is allocated after
all previous Code objects on that page (not unlikely given linear
allocation areas),

Change-Id: I70778ba624f1b437bd992616749a8cd08ad33613
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431204
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70251}
2020-10-01 09:09:52 +00:00
Ulan Degenbaev
8ee03b1130 [heap] Use LiveObjectRange in MarkingVerifier
This removes custom object iteration in MarkingVerifier.

Change-Id: I2e597dab6014ff4443faa60cd3d4be20a2dc1b56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438067
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70250}
2020-10-01 08:56:31 +00:00
Dominik Inführ
b187504e98 [heap] New mechanism for requesting GC from background threads
Background threads use a new mechanism to request a GC from the main
thread. Previously they used MemoryPressureNotification to request the
collection. However this conflicts with the embedder's usage of
MemoryPressureNotification.

Bug: v8:10315
Change-Id: Ib25a13a43e1f6a8785bb0d421dd056ae06a4a350
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2429270
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70249}
2020-10-01 08:53:41 +00:00
Peter Marshall
82efa4bd7a [cpu-profiler] Refactor ProfileGenerator
Rename it to Symbolizer because it does exactly that.

Change the SymbolizeTickSample method to return the symbolized state
rather than pass it on to the ProfilesCollection. This makes it easier
to test as now it only relies on the CodeMap provided to it.

Make EntryForVMState a free-floating function as it doesn't rely on
state and then we can avoid importing the StateTag definition in the
header.

Remove the UNREACHABLE from EntryForVMState as the compiler got smarter
and doesn't need it anymore.

Pass the CpuProfilesCollection to SamplingEventsProcessor instead,
as it is now responsible for putting the symbolized samples into the
collection to be sorted into the appropriate profiles.

Change-Id: I104290eff22b7d94a1bd34ba904036badccf4e13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440522
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70248}
2020-10-01 08:33:11 +00:00
Leszek Swirski
a769ea7a44 [parser] Fix AST func reindexing for function fields
AST reindexing has to skip visiting fields that are already in the
member initializer, as they will have already been visited when
visiting said initializer. This is the case for private fields and
fields with computed names.

However, the reindexer was incorrectly assuming that all properties
with a FunctionLiteral value are methods (and thus not fields, and
can safely be visited). This is not the case for fields with
function expression values.

Now, we correctly use the class property's "kind" when making this
visitation decision.

Fixed: chromium:1132111
Change-Id: Ia53d1fe713453e361b818dfb0b5f88a90cecdf21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440519
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70247}
2020-10-01 07:53:01 +00:00
Manos Koukoutos
98a9f0511a [wasm-gc][bug] Fix type checking of GC instructions in unreachable code
Decoding of gc/reference type instructions assumed that popping a value
from the stack would either throw an error or return a value of the
expected type. This is not true in unreachable contexts, where a
bottom-typed value can be returned.
This CL fixes this problem, adds tests which expose it, and improves
AddFunction() in the infrastructure of
function-body-decoder-unittest.cc.

Bug: v8:7748
Change-Id: I7e9d0caa9ba1687b68a5cdad7b99c054285d9f0e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440577
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70246}
2020-10-01 07:36:53 +00:00
Leszek Swirski
c7416d9ea0 Revert "[wasm] Update spec tests"
This reverts commit 1110ccf628.

Reason for revert: Various failures, e.g. https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8867662180901819968/+/steps/Check_-_ODROID/0/logs/simd_f32x4_pmin_pmax/0

Original change's description:
> [wasm] Update spec tests
>
> The change is auto-generated by v8/tools/wasm/update-wasm-spec-tests.sh.
>
> R=​manoskouk@chromium.org
>
> Change-Id: I1ebe8c3e56754e1242d279124a07f74edaab89c1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436456
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70244}

TBR=ahaas@chromium.org,manoskouk@chromium.org

Change-Id: Ifafa7ed7e7deb7d94e12e2aee9e79b207199b618
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440594
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70245}
2020-10-01 07:35:51 +00:00
Andreas Haas
1110ccf628 [wasm] Update spec tests
The change is auto-generated by v8/tools/wasm/update-wasm-spec-tests.sh.

R=manoskouk@chromium.org

Change-Id: I1ebe8c3e56754e1242d279124a07f74edaab89c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436456
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70244}
2020-10-01 06:15:48 +00:00
Manos Koukoutos
54536f4fa4 [wasm][formatting] Split ValueType class into regions
Additional change: Add ValueType::is_bottom()

Change-Id: I8e294c6318b6e51efac0a07ac0ec059ea9dc5654
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440515
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70243}
2020-10-01 06:11:08 +00:00
Etienne Pierre-doray
0763e924a8 [Heap]: Evacuate uses Jobs
Replaces ItemParallelJob by std::vector to hold work items.
IndexGenerator is used to iterate over evacuation items.

Change-Id: I63ea246f267d8cbe140c47c022b95b3873bc957a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2425339
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70242}
2020-10-01 00:37:28 +00:00
Ng Zhi An
19e6ead05c [wasm-simd][arm64] Consolidate fp rounding opcodes
Remove 8 NEON rounding opcodes, merging them into the existing float
rounding opcodes, since the instruction used is the same, only the
register format is different, and can be determined at codegen time.

Bug: v8:10930
Change-Id: Ice19c1e2a31f6913c748976fe3a021035a752d88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436617
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70241}
2020-09-30 20:05:04 +00:00
Milad Fa
88dfe1c8f7 PPC: [wasm-simd] Implement Bitmask operations
This CL has started using new vector instructions introduced
in Power 9, which includes:

- Move To VSR Double Doubleword
- Vector Extract

Change-Id: Ieda677b33f4aae059afb3ab94d18f044001887a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438956
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70240}
2020-09-30 19:37:14 +00:00
Ng Zhi An
2d236b904a [wasm] Fix test arguments for i64.trunc_f64_s
It was incorrectly using int64 test arguments, it should be using
double. After changing the test, it was failing for values outside of
int64 range (UB), so check and skip those values, see
https://source.chromium.org/chromium/chromium/src/+/master:v8/test/cctest/wasm/test-run-wasm-64.cc;l=762-767;drc=0c918bd8418b92a095885dc98ef5a939febf4069

Change-Id: I2f97c3f78e197b39cbf320468daefc339844d515
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436639
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70239}
2020-09-30 17:42:34 +00:00
Etienne Pierre-doray
b376a124e2 Reland "Reland "[Heap] ScavengerCollector use Jobs.""
This is a reland of 92f815a80d
Safe to reland as-is with task id lifetime fix in
https://chromium-review.googlesource.com/c/v8/v8/+/2437005

Original change's description:
> Reland "[Heap] ScavengerCollector use Jobs."
>
> This is a reland of 9e8c54f830
> Safe to reland as-is with fix in AcquireTaskId
> https://chromium-review.googlesource.com/c/v8/v8/+/2401964
>
> Additional changes are made in the reland:
> -TRACE_GC is be split for background/foreground scope.
> -New IndexGenerator is used for dynamic work assignement.
>
> Original change's description:
> > [Heap] ScavengerCollector use Jobs.
> >
> > No yielding is necessary since the main thread Join()s.
> >
> > max concurrency is determined based on either
> > remaining_memory_chunks_ or global pool size
> > (copied_list_ + promotion_list_)
> >
> > Change-Id: Ie30fa86c44d3224b04df5d79569bce126ce7d96b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2354390
> > Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#69746}
>
> Change-Id: Id9d7a5bf3b2337ae4cf1e76770f4b14ebb8ca256
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2399041
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70135}

Change-Id: Id0451b6eca9a125c7695d251d1a7d813e0664dd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2432071
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70238}
2020-09-30 16:29:54 +00:00
Marja Hölttä
b2c4fec576 [super property speed] Switch --super-ic on under --future
This enables correctness fuzzing.

Bug: v8:9237
Change-Id: I9b8e5506cf22a482cf39e92d3d67629382ac4b39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436539
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70237}
2020-09-30 16:15:45 +00:00
Mike Stanton
abab49d930 [Turbofan] Never serialize CallHandlerInfo objects
CallHandleInfos are observed for optimizing API calls in TurboFan.
The place to be careful is on allocation and installation of these
objects in a FunctionTemplate. As long as store order is preserved there,
we can safely directly access the class members.

Bug: v8:7790
Change-Id: I6acb318d01c19d97725c7218e913765c33e0d8b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435096
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70236}
2020-09-30 16:08:43 +00:00
Clemens Backes
43f0f49d8c [wasm] Add a "boolean validation" mode
All instantiations of the function body decoder (validation, Liftoff,
TurboFan) currently generate precise error messages. For Liftoff though,
the error message and location is never used. Thus we can save some
binary size and performance by only keeping a flag whether an error
occured or not. In the error case, the TurboFan compiler will execute
right afterwards anyway, generating a proper error message.

As as follow-up, we can avoid storing the pc in {ValueBase} and
{ControlBase}, because that's only used for error reporting.

R=thibaudm@chromium.org

Bug: v8:10969
Change-Id: I65c46cb9d8b654f9476f2c34ca9a8dd45d6bbbc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436347
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70235}
2020-09-30 15:50:56 +00:00
Jakob Gruber
29bcdaad1d Rename legacy code kinds
CodeKind::OPTIMIZED_CODE -> TURBOFAN

Kinds are now more fine-grained and distinguish between TF, TP, NCI.

CodeKind::STUB -> DEOPT_ENTRIES_OR_FOR_TESTING

Code stubs (like builtins, but generated at runtime) were removed from
the codebase years ago, this is the last remnant. This kind is used
only for deopt entries (which should be converted into builtins) and
for tests.

Change-Id: I67beb15377cb60f395e9b051b25f3e5764982e93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440335
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70234}
2020-09-30 15:39:23 +00:00
Jakob Kummerow
9c55b1d69d Fix Array.p.pop() for read-only length 0
Array.prototype.pop() must throw a TypeError whenever the array's
length is readonly; there is no exception to that when the length
is 0. This patch moves the length==0 special case after the read-
only length check in both fast paths (CSA and C++).

Fixed: v8:10908
Change-Id: I4a77439478cffeaf11022ff8beb78b0a907290d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440576
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70233}
2020-09-30 15:34:48 +00:00
Jakob Kummerow
6c07d6e3d8 [typedarray] Throw rather than crash when too large to sort
Sorting a TypedArray with a custom compare function requires us to
copy the array's contents to a FixedArray. When the TypedArray is
larger than FixedArray::kMaxLength, we should throw a RangeError
rather than crashing with an OOM message.

Fixed: v8:10931
Change-Id: I8a27cc0ac80a9172bc5e8e154fdf4ccce5974317
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440575
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70232}
2020-09-30 15:20:33 +00:00
Leszek Swirski
74f3665c64 Revert "[serializer] Allocate during deserialization"
This reverts commit 5d7a29c90e.

Reason for revert: UBSan -- https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/13100

Original change's description:
> [serializer] Allocate during deserialization
>
> This patch removes the concept of reservations and a specialized
> deserializer allocator, and instead makes the deserializer allocate
> directly with the Heap's Allocate method.
>
> The major consequence of this is that the GC can now run during
> deserialization, which means that:
>
>   a) Deserialized objects are visible to the GC, and
>   b) Objects that the deserializer/deserialized objects point to can
>      move.
>
> Point a) is mostly not a problem due to previous work in making
> deserialized objects "GC valid", i.e. making sure that they have a valid
> size before any subsequent allocation/safepoint. We now additionally
> have to initialize the allocated space with a valid tagged value -- this
> is a magic Smi value to keep "uninitialized" checks simple.
>
> Point b) is solved by Handlifying the deserializer. This involves
> changing any vectors of objects into vectors of Handles, and any object
> keyed map into an IdentityMap (we can't use Handles as keys because
> the object's address is no longer a stable hash).
>
> Back-references can no longer be direct chunk offsets, so instead the
> deserializer stores a Handle to each deserialized object, and the
> backreference is an index into this handle array. This encoding could
> be optimized in the future with e.g. a second pass over the serialized
> array which emits a different bytecode for objects that are and aren't
> back-referenced.
>
> Additionally, the slot-walk over objects to initialize them can no
> longer use absolute slot offsets, as again an object may move and its
> slot address would become invalid. Now, slots are walked as relative
> offsets to a Handle to the object, or as absolute slots for the case of
> root pointers. A concept of "slot accessor" is introduced to share the
> code between these two modes, and writing the slot (including write
> barriers) is abstracted into this accessor.
>
> Finally, the Code body walk is modified to deserialize all objects
> referred to by RelocInfos before doing the RelocInfo walk itself. This
> is because RelocInfoIterator uses raw pointers, so we cannot allocate
> during a RelocInfo walk.
>
> As a drive-by, the VariableRawData bytecode is tweaked to use tagged
> size rather than byte size -- the size is expected to be tagged-aligned
> anyway, so now we get an extra few bits in the size encoding.
>
> Bug: chromium:1075999
> Change-Id: I672c42f553f2669888cc5e35d692c1b8ece1845e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404451
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70229}

TBR=ulan@chromium.org,jgruber@chromium.org,leszeks@chromium.org

Change-Id: I2bd792a24861e8f54897e51522769b50f8f814e2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1075999
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440827
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70231}
2020-09-30 14:24:01 +00:00
Gus Caplan
1682a876e4 [regexp] Refactor experimental instruction emits and labels
This is some general cleanup for the experimental regexp implementation.
DeferredLabels have been merged into Labels, label APIs more closely
resemble other parts of V8, and instruction codegen has been moved into
its own class.

Bug: v8:10765
Change-Id: I139c0a0df30e539ee39eae70fc206e6406d898b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2433058
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Gus Caplan <snek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70230}
2020-09-30 14:14:54 +00:00
Leszek Swirski
5d7a29c90e [serializer] Allocate during deserialization
This patch removes the concept of reservations and a specialized
deserializer allocator, and instead makes the deserializer allocate
directly with the Heap's Allocate method.

The major consequence of this is that the GC can now run during
deserialization, which means that:

  a) Deserialized objects are visible to the GC, and
  b) Objects that the deserializer/deserialized objects point to can
     move.

Point a) is mostly not a problem due to previous work in making
deserialized objects "GC valid", i.e. making sure that they have a valid
size before any subsequent allocation/safepoint. We now additionally
have to initialize the allocated space with a valid tagged value -- this
is a magic Smi value to keep "uninitialized" checks simple.

Point b) is solved by Handlifying the deserializer. This involves
changing any vectors of objects into vectors of Handles, and any object
keyed map into an IdentityMap (we can't use Handles as keys because
the object's address is no longer a stable hash).

Back-references can no longer be direct chunk offsets, so instead the
deserializer stores a Handle to each deserialized object, and the
backreference is an index into this handle array. This encoding could
be optimized in the future with e.g. a second pass over the serialized
array which emits a different bytecode for objects that are and aren't
back-referenced.

Additionally, the slot-walk over objects to initialize them can no
longer use absolute slot offsets, as again an object may move and its
slot address would become invalid. Now, slots are walked as relative
offsets to a Handle to the object, or as absolute slots for the case of
root pointers. A concept of "slot accessor" is introduced to share the
code between these two modes, and writing the slot (including write
barriers) is abstracted into this accessor.

Finally, the Code body walk is modified to deserialize all objects
referred to by RelocInfos before doing the RelocInfo walk itself. This
is because RelocInfoIterator uses raw pointers, so we cannot allocate
during a RelocInfo walk.

As a drive-by, the VariableRawData bytecode is tweaked to use tagged
size rather than byte size -- the size is expected to be tagged-aligned
anyway, so now we get an extra few bits in the size encoding.

Bug: chromium:1075999
Change-Id: I672c42f553f2669888cc5e35d692c1b8ece1845e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404451
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70229}
2020-09-30 14:04:03 +00:00
Michael Achenbach
bf3adea58a [test] Add fallback to legacy output directory
The infrastructure will soon start using the canonical build output
location out/build. New flake bisect jobs will then be started with
--outdir=out/build.

This change picks the current out/Release or out/Debug as an
alternative output location to be compatible with the future value
of the flag.

This code will be removed when the property change happens.

This prepares:
https://crrev.com/c/2426643

Bug: chromium:1132088
Change-Id: I1fe3bcb239b05d069a1006646bc9306a16a3cecd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440336
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70228}
2020-09-30 13:36:03 +00:00
Samuel Groß
919d1dd770 Fix unhandled promise rejections in REPRL mode
Previously, unhandled promise rejections weren't reset between REPRL
executions, leading to incorrect exit statuses being reported. This CL
fixes the issue and adds further tests to verify the correct behaviour.

Change-Id: Ied47d9359b0fbc05ebb211667687a0a4041ef767
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431205
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#70227}
2020-09-30 13:34:23 +00:00
Jakob Kummerow
5f1ae37a01 [messages] Cap string length we try to format
When building the error message for a TypeError when e.g.
a non-callable is called, we should avoid running into the
max string length. Printing many megabytes there isn't going
to be useful anyway.

Fixed: v8:10963
Change-Id: Ief89800f660bdd48585f84c3e3d4ece21b02b760
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438068
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70226}
2020-09-30 13:29:53 +00:00
Milad Fa
44355d750a PPC: Mark console-messages-limits as slow
Bug: v8:10965
Change-Id: Iba23cfcfaed44b52fe38851713e2ffedd118430f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2437172
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70225}
2020-09-30 13:23:53 +00:00
Clemens Backes
2a71b32062 [wasm] Rename {ValidateFlag} constants
As a preparation to add a "boolean validation" mode, rename the existing
flags. This removes many unrelated changes from the follow-up change and
makes it easier to review.

R=thibaudm@chromium.org

Bug: v8:10969
Change-Id: I5f71405b525a7caa91be46c035e31d4d960e4e4c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440036
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70224}
2020-09-30 13:19:03 +00:00
Michael Achenbach
7b24b13981 [test] Use the correct precedence for choosing the build directory
This breaks looking for build output after finding valid output.
Otherwise build output with lower precedence can overwrite output
with higher precedence.

This also moves a static method.

Bug: chromium:1132088
Change-Id: I1824028243f964ab0956e54ca24921e6f32f2ca3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440337
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70223}
2020-09-30 13:01:43 +00:00
Igor Sheludko
60de9d5a6f [runtime] Fix assert in EnsureInitialMap()
Bug: chromium:1132640
Change-Id: I40e8aecc98d9fc20bbe1df6e31be127af8710723
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436334
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70222}
2020-09-30 12:39:43 +00:00
Jakob Gruber
c11a054ea0 [nci] Update invocation count in the NCI prologue
The invocation count is part of call feedback, and is used during
tier-up to determine inlining candidates. For bytecode, it is updated
by the InterpreterEntryTrampoline, which can be seen as a global
prologue for all bytecode functions.

Since NCI tiers up, it must also track the invocation count. This CL
adds it to the NCI prologue sequence (emitted as part of every NCI
code object).

Bug: v8:8888
Change-Id: I04b33c9c8b0bdd975aceb97145f159798e18b97b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436340
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70221}
2020-09-30 11:06:57 +00:00
Victor Gomes
d8217c3257 [wasm] Remove arguments adaptor frame
Change-Id: I33294dc5b93d5842a3a51779bfec30f20bf4f23f
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436345
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70220}
2020-09-30 11:03:01 +00:00
Victor Gomes
f5456f37dd [frames] Fix GetActualArgumentCount typo
Change-Id: I624b16162dd859dc88b5f26cfc7d1a4a15089095
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438455
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70219}
2020-09-30 10:58:57 +00:00
Thibaud Michaud
e60d8600b5 [wasm] Add GenericJSToWasmWrapper to the list of executable builtins
Ensure that a valid off-heap trampoline is created for the
GenericJSToWasmWrapper builtin by adding it to the list of executable
builtins.

R=ahaas@chromium.org
CC=​evih@chromium.org

Bug: v8:10701
Change-Id: I49b8144237aca20f5f663c7b32810a16f715ad5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438415
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70218}
2020-09-30 10:45:47 +00:00
Vicky Kontoura
30c0326a83 [wasm] Support fast transformation for heap numbers in js-to-wasm wrapper
This CL extends fast-path transformations of JavaScript parameters
when calling an exported WebAssembly function from JavaScript
to support heap numbers for types kF32 and kF64.

Bug: v8:10943
Change-Id: Ifbb745cb7bee3ef34bb40b7c01597703fde340bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435366
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70217}
2020-09-30 10:33:37 +00:00
Zhao Jiazhong
2abb9de6f5 [mips] Skip inspector/debugger/wasm-scope-info* tests
Since the inspector/debugger/wasm-scope-info* tests need simd128,
but not all mips cpus support it, we skip the tests on mips
platforms without simd support.

Change-Id: Iebefa5d6b33d80d707ad0077be7d4f25e3e52b4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2439769
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70216}
2020-09-30 10:15:05 +00:00
Manos Koukoutos
2e9cb16c14 [wasm][bug] Compare signatures correctly in ResolveWasmImportCall
Changes:
- Implement WasmExportedFunction::MatchesSignature.
- Use it over comparison with == in ResolveWasmImportCall.
- Add a test which exposes the existing bug.
- Add a few reminder TODOs.

Bug: v8:9495
Change-Id: Ibbe31dbf550be212dbf2170ab8cdab9b4b6de734
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2438060
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70215}
2020-09-30 09:56:27 +00:00
Zhao Jiazhong
90f9decefa [mips] Fix floating point abs operation
Float32/64 abs operation should only clear the sign bit, but abs.s
and abs.d instructions of mips64r2 would convert nan to canonical
nan.

Change-Id: Ibbd05cdb3a73acfe0e532030d1815d262c3ac433
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2439768
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70214}
2020-09-30 09:37:07 +00:00
Jakob Gruber
75b8c238dc [turboprop] Add TURBOPROP code kind
Turboprop-generated Code objects will now have the dedicated
TURBOPROP code kind instead of OPTIMIZED_FUNCTION. When possible,
the code kind is used as the source of truth instead of
FLAG_turboprop. This is the initial step towards implementing
tier-up from Turboprop to Turbofan.

Future work: Rename OPTIMIZED_FUNCTION to TURBOFAN, rename STUB to
DEOPT_ENTRIES_OR_FOR_TESTING, implement TP tier-up.

No-Try: true
Bug: v8:9684
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Change-Id: I3c9308718d7e9a2b7e6796e7ea94f17e5ff84c0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2424140
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70213}
2020-09-30 08:52:57 +00:00
v8-ci-autoroll-builder
83133d95f2 Update V8 DEPS.
Rolling v8/build: 38a49c1..3ede101

Rolling v8/buildtools: 3ff4f50..4be464e

Rolling v8/third_party/aemu-linux-x64: FfxmX7LQ9OID3pVAmcemr6u9lK3xjXzAXxvqzEcclMwC..oJeWXQJJ1lVY6P7l39pBV-mrbeWlw0swPZQuNmcix5AC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/18d69fb..0f6ed71

Rolling v8/third_party/depot_tools: 1099c11..991ead1

Rolling v8/third_party/instrumented_libraries: 3c52ccd..6ba978c

Rolling v8/third_party/zlib: 4668fea..26211a5

Rolling v8/tools/clang: 3017eda..bd8e096

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Icb156ce2fe693cd4838c7e11b31cb96282125c92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2439341
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70212}
2020-09-30 04:03:46 +00:00
Zhao Jiazhong
656a687902 [mips] Support unaligned loading and storing kWord8 value
Change-Id: Ib5728e22815339096dec72cc3a6d8732da436062
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2437514
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70211}
2020-09-30 01:59:34 +00:00
Ng Zhi An
d8a36591ed [wasm-simd][scalar-lowering] Fix sign extend/masks of lanes
For replacing lanes (i8x16 and i16x8) the replacement value is stored in
a word32. Simply storing it will cause us to have the wrong value, we
need to mask (for overflow) and extend appropriately.

Same for extracting, the values are stored in sign-extended form,
unsigned extracts should zero the top bits.

Bug: v8:10507
Change-Id: If5ed79f5b6bdb64f900a54b9e148b2d96a74f312
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436612
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70210}
2020-09-30 00:16:24 +00:00
Andrey Kosyakov
582de025d8 Do not pause on breaks while installing additional command line API
A break may cause the session disconnect (and therefore agents destruction)
on a nested message loop. The runtime agent code is generally prepared to
handle this during evaluate, but the code outside of it may be not. Besides,
having a break before the console API installed is generally not what
user wants or expects, so just disable all breaks while installing the API.

Bug: chromium:1122487
Change-Id: I1d40f5007f2e1e4ec07a50ef57988513d0309b7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2437383
Commit-Queue: Andrey Kosyakov <caseq@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70209}
2020-09-30 00:12:24 +00:00
Ng Zhi An
ed7204bbde [wasm-simd] Add saturating conversion opcodes to wasm-module-builder.js
Bug: v8:10933
Change-Id: I6709dac3598f9dea96fe6f5efec452c1bbdcbc2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436611
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70208}
2020-09-29 20:18:13 +00:00
Etienne Pierre-doray
6d776e5792 [Jobs]: Fix task id lifetime.
Delegate kept task id around for longer than the worker is considered
active, thus breaking the task_id < num_worker garantee. The fix is to
adjust the delegate lifetime.

Change-Id: I9aabb1286d507c09bfe9be4fd4f810f232d6e6b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2437005
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70207}
2020-09-29 18:00:33 +00:00
Ng Zhi An
805f19319e [wasm-simd] Rename load splat and load extend (arch)
Perform the renames for all arch-dependent opcodes too.
This is a follow-up of https://crrev.com/c/2422357.

Bug: v8:10946,v8:10933
Change-Id: I02f048b64dd4d75f06d6b7919660ffebd0e78b50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431798
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70206}
2020-09-29 17:29:43 +00:00
Ng Zhi An
98e2796555 [wasm-simd] Protected load transforms are not eliminatable
LoadTransform operators contain a LoadKind, which can be unaligned,
protected, poisoned, normal.

If it is protected, we cannot eliminiate that load,
since we rely on the segv signal handling. So, we use partial template
specialization on LoadKind::kProtected, and don't set the operator to
not be eliminatable.

Bug: chromium:1132461
Change-Id: If45fc6562348ffd4dbaa27058e6c5d4242f79abb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436081
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70205}
2020-09-29 17:24:53 +00:00
Samuel Groß
32e2584405 [sandbox][x64] Access external pointer through a table
This change moves external pointers into a separate table and turns
external pointers in heap objects into indices into that table.

This CL implements one of two possible ownership models for the table
entries. With this one, every heap object owns its table entries, and
they are allocated when the owning object is allocated. As such, setting
external pointer fields does not require allocation of table entries. On
the other hand, table indices cannot be shared between multiple objects.

This CL does not yet implement freeing of external pointer table
entires. This will later happen by a table garbage collector.

Bug: v8:10391
Change-Id: I4d37785295c25a7d1dcbc9871dd5887b9d788a4f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235700
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Samuel Groß <saelo@google.com>
Cr-Commit-Position: refs/heads/master@{#70204}
2020-09-29 17:13:43 +00:00