Commit Graph

4824 Commits

Author SHA1 Message Date
Tobias Tebbi
bfda81d1a1 [turboshaft] introduce SnapshotTable
Bug: v8:12783

Change-Id: Ie8e578105065ed5ad833fbf2a525b149e39d3424
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3971368
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83966}
2022-10-28 06:36:55 +00:00
Nikolaos Papaspyrou
dbda17a58e [heap] Fix tests for OSB and CSS
Since crrev.com/c/3973310 which renamed the isolate scopes, the unit and
cctests for the object-start bitmap and the conservative stack visitor
have broken.

Bug: v8:13257
Change-Id: If8a498827f2085108cf0740a9c5c994145424fc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3980255
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83960}
2022-10-27 15:52:05 +00:00
Omer Katz
4d95ff1a21 [heap] Prevent new space from allocation small LABs
Update the free list implementation for new space to set a larger
minimum size and skip redundant step in the allocation logic.

Bug: v8:12612
Change-Id: I480fe99cf4cfad7c25d687540b7841cd56d41d47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3976508
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83920}
2022-10-26 09:12:04 +00:00
Dominik Inführ
34d6823f8b [heap] Rename safepoint scopes
This CL simplifies safepoint scopes, there are now three kinds of
safepoint scopes:

1) IsolateSafepointScope - performs an isolate local safepoint
2) GlobalSafepointScope - a global safepoint across multiple isolates
3) SafepointScope - chooses based on condition between local/global

This CL is not supposed to change current safepointing behavior in
any way. The CL renames the current SafepointScope to
IsolateSafepointScope and changes GlobalSafepointScope to always
perform a global safepoint. It then also introduces the new
SafepointScope and makes use of it for snapshotting and in heap.cc.

Bug: v8:13267
Change-Id: Ie7e1f81b6158c98d3d98552ba735cc73c9b869c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973310
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83912}
2022-10-25 16:32:55 +00:00
Lei Zhang
3cc6fc8538 Remove unused code in swiss-hash-table-helpers.h.
This code looks like it was copied over of Abseil. However, parts of it
are not used anywhere, aside from their own unit tests, so delete them.
The unused functions are:

- MatchEmptyOrDeleted()
- CountLeadingEmptyOrDeleted()
- ConvertSpecialToEmptyAndFullToDeleted()

In turn, _mm_cmpgt_epi8_fixed() is also unused and can be deleted.

Bug: v8:11388
Change-Id: I35b84600690e6f044a1d5ab4bf41e7f67fb76d87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3965230
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83892}
2022-10-24 17:31:02 +00:00
Clemens Backes
35cc93aa42 [wasm] Detemplatize immediates
The wasm decoder immediates are currently templatized by the {validate}
enum value. They do not need to be though; the only difference is in the
constructor, so the constructor should be templatized instead.

This CL implements that, and also changes the {validate} enum to be a
tag (a typename) instead. This is needed in order to enable template
parameter deduction for the constructor calls (C++ does not allow to
explicitly define the template parameter at constructor calls).

As a nice side effect, this produces nicer symbolized stack traces.
Before:
v8::internal::wasm::Decoder::read_u32v<(v8::internal::wasm::Decoder::ValidateFlag)1>
After:
v8::internal::wasm::Decoder::read_u32v<v8::internal::wasm::Decoder::BooleanValidationTag>

R=jkummerow@chromium.org

Change-Id: I013c909ebaf2c8c495f32b5ce598905f3eccc3ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3973267
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83889}
2022-10-24 17:27:49 +00:00
Michael Lippautz
c23bc72c83 [handles] Split off traced handles from regular global handles
v8::TracedReference and their underlying traced handles are not
actually phantom references but have been historically represented as
such. This patch splits off their backing implementaton into
`TracedHandles`.

As a drive-by, re-organize the free list to rely on indices instead of
pointers, saving a full word for each node. In additon, the setup also
allows for freeing fully empty node blocks after GCs.

Allocation/free of nodes is also organized in a way that avoids
jumping between handles/blocks/nodes for accounting purposes.

Removing CRTP in GlobalHandle internals is left for a follow up.

Bug: v8:13372
Change-Id: Ib55aa9ba71202d5918b486c161fe6f747d31c719
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3966952
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83872}
2022-10-24 10:04:08 +00:00
Manos Koukoutos
d1a11dd15a [wasm-gc] array/struct.new_default should work with immutable fields
Bug: v8:7748
Change-Id: I05f97786f7a5f7b829ce66ba55ffd7c00bfa4d50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3974509
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83868}
2022-10-24 08:54:16 +00:00
Simon Zünd
8090f2cd43 [inspector] Remove experimental_async_stack_tagging_api flag
The feature has been enabled since M106 so we can safely remove the
flag with M109.

R=bmeurer@chromium.org

Bug: chromium:1334585
Change-Id: Iefe0b10e3be59d6dde54d676b5f1e0cf938851ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959659
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83865}
2022-10-24 05:23:50 +00:00
Adam Klein
9e55d25735 [cleanup] Remove Wasm SIMD flag & deprecate embedder-enabling API
It's been enabled by default since Chrome 91.

Bug: v8:6020
Change-Id: Id26b7fb0b7dffe19a88a6f0071dd59203b06415a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3957636
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83862}
2022-10-22 00:47:42 +00:00
Marja Hölttä
724e7ce174 [arraybuffers, api] Implement [[ArrayBufferDetachKey]] support
Bug: chromium:1344595
Change-Id: Ic1075361b92c776789ce2fbf1e105dea174f3a2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925936
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83847}
2022-10-21 12:55:18 +00:00
Seth Brenith
d1dcdd9a21 Also copy scope info and flags when merging deserialized script
When merging a newly deserialized script into an existing one from the
compilation cache, it is often the case that a SharedFunctionInfo from
the cached script ("old SFI") has been flushed and the corresponding
SharedFunctionInfo from the new script ("new SFI") is compiled. In that
case, it is sufficient to copy the bytecode array and feedback metadata
from the new SFI to the old SFI, as already implemented.

However, there is another case to consider: perhaps the new SFI is
compiled and the old SFI was never compiled. In that case, the old SFI
has no ScopeInfo and some of its flags may be incorrect.

To fix the problem, this CL updates CompleteMergeInForeground to copy
everything except script_or_debug_info from the new SFI to the old SFI.

This change implies some duplication of ScopeInfos, since each ScopeInfo
can point to its parent, so matching parent ScopeInfos from the new and
old scripts will coexist. However, this isn't a new problem: similar
duplication is already caused by the portion of the merge algorithm
which attaches new compiled SFIs into the old Script where the old
Script doesn't have a matching SFI. I don't see any way in which this
duplication would cause incorrect behavior. In fact, it is possible to
get duplicated ScopeInfos without any merging at all, which indicates to
me that such duplication is safe. Duplication occurs if a SFI is flushed
or removed while one of its descendant functions is still alive, and
subsequently the same function literal is compiled again.

Bug: v8:12808, chromium:1359773
Change-Id: I2a3a720021c797c62a87d10e999603ff5e29a027
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3965723
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#83825}
2022-10-20 15:48:32 +00:00
Adam Klein
fafd7c5d22 [cleanup] Remove flag for Wasm threads & atomics
It's been enabled everywhere since Chrome 88, and the related
Chromium flag was removed in https://crrev.com/c/2886421.

Bug: v8:6532
Change-Id: I987a5761f9453d4e7d77d16199e8f0b3a659c70a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3956131
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83809}
2022-10-19 23:05:37 +00:00
Omer Katz
7a21b5b6a2 [heap] Don't finalize all of sweeping for MinorMC
For MinorMC it is sufficient to finalize new space sweeping.
Starting MinorMC will only ensure that background tasks are paused and
all new space pages are swept.

Accounting becomes more complicated since we can have minor sweeping
and full sweeping running at the same time. To support that, new space
sweeping is split to a separate sweeping scope. Also, the
Notify*SweepingCompleted methods are updated for the possibility of
nested sweeping. The distinction is that Notify*SweepingCompleted
knows what kind of sweeping we want to finalize, but not what kind
is currently running.

Bug: v8:12612
Change-Id: If46fa3bc036080d4231171e613fa3aefe7400246
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945098
Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83800}
2022-10-19 13:51:40 +00:00
Dominik Inführ
d4c1da341a [heap] Remove Heap::map_space_ field and MapSpace class
Bug: v8:12578
Change-Id: I724164405cf3ba6d433655fa0fde5b9986fe04a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959661
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83786}
2022-10-19 08:04:27 +00:00
Omer Katz
30708892ef [heap] Enable concurrent sweeping for MinorMC
Remove the dedicated MinorMC sweeping flag and merge with the
general concurrent sweeping flag.

Bug: v8:12612
Change-Id: I278f274e293a7160839259df38b4a2951df31e91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3936272
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83767}
2022-10-18 10:26:26 +00:00
Michael Achenbach
bf9ffddf05 Revert "[cleanup] More C++20 fixes"
This reverts commit 918b998dc7.

Reason for revert: Win32 gets crashy:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win32%20-%20debug/39198/overview
https://ci.chromium.org/ui/p/v8/builders/try.triggered/v8_flako/b8799988959011833553/overview

Original change's description:
> [cleanup] More C++20 fixes
>
> Fix C++20 removing implicit 'this' copy capture in lambdas by preferring
> [&](...){...} over [=](...){...} lambdas (predominantly in CSA).
>
> Bug: chromium:3956795
> Change-Id: Ieb4b9f700d32a0676c95dea08b46f9474020d5ce
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959742
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83752}

Bug: chromium:3956795
Change-Id: I2232c30eeb516a6a02ec0e9c925a9baac79499bb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959817
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83755}
2022-10-18 06:32:56 +00:00
Leszek Swirski
918b998dc7 [cleanup] More C++20 fixes
Fix C++20 removing implicit 'this' copy capture in lambdas by preferring
[&](...){...} over [=](...){...} lambdas (predominantly in CSA).

Bug: chromium:3956795
Change-Id: Ieb4b9f700d32a0676c95dea08b46f9474020d5ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3959742
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83752}
2022-10-17 16:15:05 +00:00
Marja Hölttä
f85f1e19ff Revert "[classes] Ship --omit-default-ctors"
This reverts commit 9027afd67a.

Reason for revert: Several fuzz bugs

Original change's description:
> [classes] Ship --omit-default-ctors
>
> Breakage is expected, please revert if needed.
>
> Bug: v8:13091
> Change-Id: Iede9e0b88a501c9cbf855da39cef0148229a114e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3937966
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83702}

Bug: v8:13091,chromium:1375000,chromium:1375043,chromium:1375047,chromium:1374995,chromium:1374746,chromium:1375074,chromium:1375086,chromium:1365114,chromium:1375073,chromium:1375135
Change-Id: I5781b9645c6f3c33d58e70e5135067f2c25921a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3956241
Commit-Queue: Marja Hölttä <marja@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83734}
2022-10-17 06:29:08 +00:00
Matthias Liedtke
7ff8d6eb9e [wasm-gc] Add new ref.cast taking any reference
The new ref.cast (opcode 0xfb41) takes any reference and
expects a Heaptype immediate. the HeapType can be a
concrete or an abstract type.
Differently to the old ref.cast instruction, it traps on
null. A variant which doesn't trap on null (ref.cast null)
will be added in a future CL.

Bug: v8:7748
Change-Id: Id5764a7553a57c5cb838682c9ec331d15d7d25c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3948663
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83724}
2022-10-14 16:24:16 +00:00
Clemens Backes
9920e5c249 [wasm][pgo] Including tiering information
Serialize tiering information in the profile (which functions were
executed, which functions were tiered up). Use this information during
compilation (only synchronous compilation supported so far) to
immediately compile or tier up those functions.

R=jkummerow@chromium.org

Bug: v8:13209
Change-Id: I13d859ae57f60dbdb0dad3f1daf7aa0b920526d3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3898997
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83720}
2022-10-14 14:32:55 +00:00
Omer Katz
8aef1fb204 [heap] Implement concurrent sweeping for MinorMC
This CL aligns minor sweeping with full sweeping such that no
sweeping happens in the atomic pause. If concurrent sweeping is
disabled, sweeping will be either on allocation or when we start
the next GC.

This CL doesn't yet enable concurrent sweeping for MinorMC.
Regressions on benchmarks with MinorMC enabled are expected.

Bug: v8:12612
Change-Id: I6df808b94783559122ee78306af932809860703d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3934769
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83712}
2022-10-14 11:28:46 +00:00
Matthias Liedtke
d4a3ebeb2b Reland "Reland "[wasm-gc] Ref types: Convert dataref to structref""
This is a reland of commit 3b883e787d

Fixed a test case that was merged in the meantime still using the old
kExprRefAsData which is now called kExprRefAsStruct.

Original change's description:
> Reland "[wasm-gc] Ref types: Convert dataref to structref"
>
> This is a reland of commit 20327d1599
>
> Changed in reland:
> - Added new flag wasm-gc-structref-as-dataref which defaults to true
>   and preserves the existing behavior.
> - Passing --no-wasm-gc-structref-as-dataref enables the new behavior.
> - The flag affects static subtyping information between structref and
>   arrays and the corresponding cast, test and br_on instructions.
> - Even with the old behavior the name still changed to "structref".
>
> Original change's description:
> > [wasm-gc] Ref types: Convert dataref to structref
> >
> > This change changes the type hierarchy in a non-backwards compatible
> > way: dataref is replaced with structref meaning that arrayref is
> > no longer a subtype of it.
> >
> > Bug: v8:7748
> > Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#83515}
>
> Bug: v8:7748
> Change-Id: I2d8dd49dbc56246c087ac93452a87f860ead2195
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945109
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83697}

Bug: v8:7748
Change-Id: I54f7b141ffc5b7597420fa0c838412be825a260b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952936
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83706}
2022-10-14 09:32:25 +00:00
Marja Hölttä
9027afd67a [classes] Ship --omit-default-ctors
Breakage is expected, please revert if needed.

Bug: v8:13091
Change-Id: Iede9e0b88a501c9cbf855da39cef0148229a114e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3937966
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83702}
2022-10-14 07:21:31 +00:00
Jakob Kummerow
8aa6006533 Revert "Reland "[wasm-gc] Ref types: Convert dataref to structref""
This reverts commit 3b883e787d.

Reason for revert: gc-optimizations test is broken due to in-flight collision with another CL: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8800403395649311857/+/u/Check/gc-optimizations

Original change's description:
> Reland "[wasm-gc] Ref types: Convert dataref to structref"
>
> This is a reland of commit 20327d1599
>
> Changed in reland:
> - Added new flag wasm-gc-structref-as-dataref which defaults to true
>   and preserves the existing behavior.
> - Passing --no-wasm-gc-structref-as-dataref enables the new behavior.
> - The flag affects static subtyping information between structref and
>   arrays and the corresponding cast, test and br_on instructions.
> - Even with the old behavior the name still changed to "structref".
>
> Bug: v8:7748
> Change-Id: I2d8dd49dbc56246c087ac93452a87f860ead2195
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945109
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83697}

Bug: v8:7748
Change-Id: Icb273a6d433c47a372563d0daf68725c6c5b15e3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3952514
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83698}
2022-10-13 16:55:15 +00:00
Matthias Liedtke
3b883e787d Reland "[wasm-gc] Ref types: Convert dataref to structref"
This is a reland of commit 20327d1599

Changed in reland:
- Added new flag wasm-gc-structref-as-dataref which defaults to true
  and preserves the existing behavior.
- Passing --no-wasm-gc-structref-as-dataref enables the new behavior.
- The flag affects static subtyping information between structref and
  arrays and the corresponding cast, test and br_on instructions.
- Even with the old behavior the name still changed to "structref".

Original change's description:
> [wasm-gc] Ref types: Convert dataref to structref
>
> This change changes the type hierarchy in a non-backwards compatible
> way: dataref is replaced with structref meaning that arrayref is
> no longer a subtype of it.
>
> Bug: v8:7748
> Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83515}

Bug: v8:7748
Change-Id: I2d8dd49dbc56246c087ac93452a87f860ead2195
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3945109
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83697}
2022-10-13 16:19:14 +00:00
Matthias Liedtke
0cae66a5cb [wasm] Fix memory leak in WebAssembly streaming interface
A circular ownership of ref-counted resources caused the leak as the
wasm::StreamingDecoder stored a callback that contained the decoder in
its scope (needed for the URL).

Bug: chromium:1368609
Change-Id: Ib07b066c92f16b658daa1daf482f71c33a16e89a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3942066
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83695}
2022-10-13 15:54:14 +00:00
Vasili Skurydzin
57c99bb4da Aix: Skip FreezeFlags unittest for component build
Change-Id: I8c91e53bfc08f4690bb15ae9f2efa7a614536624
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929099
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83685}
2022-10-13 13:55:18 +00:00
Clemens Backes
fb3321ea27 [wasm] Store local types in a plain array
After the let instruction was removed again, the number and types of
locals stays constant throughout the decoding of a function. Hence store
it in a plain array instead of a ZoneVector. This makes the decoder
smaller and saves bounds checks for the "safe libc++".

R=thibaudm@chromium.org

Bug: chromium:1358853
Change-Id: Iad69aa0cfdc254710e1c2219cfb2c972241ef473
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3944929
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83671}
2022-10-13 09:24:42 +00:00
Michael Lippautz
cbb37fc04f cppgc-js: Gracefully handle v8::TracedReference::Reset() calls from dtor
Reset() calls from the destructor of an Oilpan object were not
supported. There was no check that would prohibit such a call though
which would yield in a memory corruption.

Going forward, we support bailing out on such Reset() calls in a
graceful way, i.e., such calls are nops and merely reset the pointer
to the global handle. A subsequent GC would clean up unused nodes.

Bug: chromium:1371512, v8:13372
Change-Id: Icc86b442183fc2ab9ecd83b9a675266719acdad4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3941890
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83656}
2022-10-12 14:50:11 +00:00
Omer Katz
51aef72aeb [heap] Various MinorMC refactorings
Bug: v8:12612
Change-Id: I9b63815f361c2bf5bd858ef3364903c48053060f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3948664
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83653}
2022-10-12 14:14:11 +00:00
Omer Katz
9ee2cbf1d4 [heap] MinorMC shrinks during sweeping/evacuation
MinorMC cannot shrink the space while concurrent sweeping is active.
This results in races between sweeping empty pages concurrently and
releasing them on the main thread.

Without concurrent sweeping, MinorMC sweeps all empty pages, then
preallocates more pages if needed, then shrinks by releasing some of
those empty/new pages.

MinorMC can instead shrink during sweeping/evacuation in the atomic
pause, before concurrent sweeping is active.
This resolves the conflict between concurrent sweeping and shrinking and
generally reduces the amount of work the GC has to do (i.e. don't
sweep/preallocate pages that will then be released by shrinking).

Bug: v8:12612
Change-Id: If898e5111c65b0b11d6ee9ee5dcd45751024650b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3933056
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83638}
2022-10-12 07:32:00 +00:00
Shu-yu Guo
dbc6180e29 [interpreter] Remove AsyncGeneratorYieldNoAwait
AsyncGeneratorYieldNoAwait is equivalent to AsyncGeneratorResolve with
the constant false passed as the last argument. Remove it in favor of
calling AsyncGeneratorResolve directly.

Bug: v8:13275
Change-Id: Ie6a47e1f152285bccdc00ec1b7140e82460caf31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3947530
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83637}
2022-10-11 23:48:17 +00:00
Benedikt Meurer
ade6d191c8 [debug] Treat Comma-separated Expressions like Statements when Stepping.
This CL introduces statement positions before the right-hand side of
comma expressions, in order to align the stepping behavior (and also
generally the breakpoint behavior) around semicolon (;) and comma (,)
separated expressions.

The motivation here is that left-hand sides of comma expressions are
evaluated purely for their side-effects and as such, they aren't
really any different from statements from a developers perspective.
And more importantly, minifiers (like UglifyJS, terser, or esbuild)
by default turn statement expression lists into comma-separated
expressions, thus implicitly changing the stepping behavior in ways
that are difficult to understand for developers.

Doc: http://go/chrome-devtools:comma-stepping-proposal
Demo: https://devtools-dbg-stories.netlify.app/crbug-1370200.html
Video: https://i.imgur.com/5WC03wF.gif
Fixed: chromium:1370200
Change-Id: I38f288d964bc992d1de0dce2ed2becd4220793df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3934288
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83599}
2022-10-10 13:14:57 +00:00
Clemens Backes
033c2e49a6 [wasm] Rename functions / parameters: verify -> validate
The process of checking a function body for validity is called
"validation" in the spec, hence also use this term in the code instead
of "verification".

R=jkummerow@chromium.org

Bug: v8:13371
Change-Id: Icef65282f829f600975ae4b10eb0847ba75e7ae3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3941887
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83598}
2022-10-10 12:52:06 +00:00
Anton Bikineev
cd552e12bb cppgc: young-gen: Switch from std::set to slot-set.
The CL makes Oilpan use the same data-structure (two-layer bitmap) as V8
uses for the remembered set.

Bug: chromium:1029379
Change-Id: I1213d3ae06da5e85466430875378e3b8dfdee16e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3701592
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83594}
2022-10-10 11:54:36 +00:00
Marja Hölttä
283791d250 [inspector] Remove Type Profiler
See https://docs.google.com/document/d/1dJHFRXKE4NUchvYweuyzsolXDEWACr-jJZEPyC6f9EQ/edit?usp=sharing

Change-Id: Ie5b30db30d55ba701a336d8a59dbff7771276e96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3936281
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83593}
2022-10-10 11:50:16 +00:00
jameslahm
e2f9097647 [json-parse-with-source] Implement the JSON.parse source text
... access proposal.

Bug: v8:12955
Change-Id: I339c4ee1849c67f85d7b975105a53a17d2b2360c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3911270
Commit-Queue: 王澳 <wangao.james@bytedance.com>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83586}
2022-10-10 07:33:07 +00:00
Anton Bikineev
055e242a98 cppgc: Fix largest_new_freelist_entry computation
If the largest freelist block was at the end of the page, it was not
accounted for sweep-on-allocation.

Change-Id: Ia7cfc9543c9c448b580444b1ce96eb37f7738ece
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3938228
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83579}
2022-10-07 20:22:50 +00:00
Nikolaos Papaspyrou
98e46e7bef [heap] Revise conservative stack scanning visitor
This CL revises the conservative stack scanning visitor, to use the
implementation of inner pointer resolution based on the marking bits.

Bug: v8:13257
Change-Id: I97203e1f571d89912f91b3513cff24521c1df662
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3934342
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83573}
2022-10-07 16:10:08 +00:00
Michael Lippautz
c2fd1f09a6 cppgc: Fix configs in stand-alone tests
Fix breakage from moving configs into a central place
(https://crrev.com/c/3911515).

Change-Id: Id68d5c104cffccb4793417eff3088d7748a179fc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3938068
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83569}
2022-10-07 08:06:13 +00:00
Nikolaos Papaspyrou
0c3919d5e2 [heap] Fix inner pointer resolution unit test
This CL fixes two bugs in the unit test for inner pointer resolution,
implemented using the marking bitmap. First, the tests would not compile
after crrev.com/c/3925548, which moved the marking state from the
collector to the heap. Second, some tests would fail in builds without
pointer compression, because the size of words in heap is different.

Bug: v8:13257
Change-Id: I8e6c9c70daa9ed9a8f0ebd5a06f7c017445400e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3937964
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83563}
2022-10-06 15:26:35 +00:00
Clemens Backes
a134066748 [wasm][IWYU] Remove unused heavy includes
The function-body-decoder-impl.h header is really heavy, and a comment
at its beginning says that it should only be included for new
implementations of WasmFullDecoder.
While there are other nice reasons to include it (e.g. for the Immediate
types), many includes were not needed.

This CL removes them, and adds other needed includes as needed instead.

R=jkummerow@chromium.org

Bug: v8:13312
Change-Id: I84efab0814fc1a38643960f49c7641c824b75f71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3933055
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83561}
2022-10-06 14:46:13 +00:00
Omer Katz
ede9b86bef [heap] Revert no preallocation and releasing of pages
This CL reverts crrev.com/c/3925977 and crrev.com/c/3929040 due to
benchmark regressions.

Bug: v8:12612, v8:13362
Change-Id: Ida25a99266e55e2563f17ebae9f172082ed720c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3937962
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83558}
2022-10-06 13:33:33 +00:00
Omer Katz
096fefc03a [heap] Move Sweeper from collectors to heap
This is needed to simplify concurrent sweeping for MinorMC.

Also: move evacuation verifiers to a separate file so that they can be
used from heap.cc as well.

Bug: v8:12612
Change-Id: I2a738a31e83a357f4fdded8a30ccb2ff6ba70553
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3932720
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83557}
2022-10-06 13:30:33 +00:00
Anton Bikineev
fec788a0f9 cppgc: young-gen: Reuse SlotSet.
The CL sligthly generalizes SlotSet by parameterizing it with slot size.
SlotSet is abstracted into BasicSlotSet, which is moved to heap::base::.
V8 GC related parts stay in slot-set.h

Bug: chromium:1029379
Change-Id: I093332b77682d2b31e61a91d4b0110fa95b5c908
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3695595
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83553}
2022-10-06 09:23:01 +00:00
Shu-yu Guo
d3c1b5a849 [interpreter] Remove await from async generator yield*
Implements the normative change
https://github.com/tc39/ecma262/pull/2819, which removes the await
inside async generator yield*. The delegating iterator result is already
awaited, and this effectively removes an extra tick and unwrapping.

The implementation of `yield` uses the existing AsyncGeneratorYield
builtin, which already performs an Await. It is renamed to
AsyncGeneratorYieldWithAwait.

The implementation of `yield*` uses a new builtin named
AsyncGeneratorYieldNoAwait, which does not perform an Await.

Bug: v8:13275
Change-Id: I88569f1e982edfb6a193c2fa07544fc59732f380
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3919916
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83545}
2022-10-05 21:49:47 +00:00
Matthias Liedtke
661f0220c7 Revert "[wasm-gc] Ref types: Convert dataref to structref"
This reverts commit 20327d1599.

Reason for revert: The code for structref/dataref is in use in
combination with array types, so the change breaks their use cases.
Reverting to restore the previous semantics of dataref.

Original change's description:
> [wasm-gc] Ref types: Convert dataref to structref
>
> This change changes the type hierarchy in a non-backwards compatible
> way: dataref is replaced with structref meaning that arrayref is
> no longer a subtype of it.
>
> Bug: v8:7748
> Change-Id: I965267d9ed11ea7c7d7df133cc39ee63e6b5abc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3929041
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#83515}

Bug: v8:7748
Change-Id: I2a0bcafafe6f67df87aac86813f74573b708cce4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3936156
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#83544}
2022-10-05 16:48:37 +00:00
Omer Katz
8efa1719f0 [heap] Move marking states to heap.
Detach the marking state from the collectors and move them to heap.
Also update users to access via heap and reduce dependencies on the
collectors.

This is a prerequisite for moving sweeper to the heap, which is needed
for concurrent sweeping in MinorMC.

Bug: v8:12612
Change-Id: Ia0bb2b7566b24eeb0d75c911edbfd626f07dad0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3925548
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83542}
2022-10-05 16:22:57 +00:00
Marja Hölttä
9358b3f118 [cleanup] Cleanup: Rename the FindNonDefaultConstructor bytecode
FindNonDefaultConstructor -> FindNonDefaultConstructorOrConstruct

Bug: v8:13091
Change-Id: I7887ea0543c525926e1894f2b96f16dfe8c9af6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3933051
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#83535}
2022-10-05 11:40:47 +00:00