Commit Graph

58431 Commits

Author SHA1 Message Date
Ulan Degenbaev
c199f828a8 Fix initalization of embedder fields for ArrayBuffers
This moves the initialization to JSArrayBuffer::SetupEmpty, which is the
proper bottleneck for all paths constructing array buffers.

Bug: chromium:1006600,v8:9380
Change-Id: I1887cb867627d69ade20654e5bc372b1ba1ac4e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815132
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63939}
2019-09-24 09:39:27 +00:00
v8-ci-autoroll-builder
56d694265c Update V8 DEPS.
Rolling v8/build: c05af3e..04fbb76

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fa002e6..8669b37

Rolling v8/third_party/depot_tools: 7cb60e8..ba5bc99

Rolling v8/tools/clang: 235f673..e514199

Rolling v8/tools/swarming_client: 96f1257..885b3fe

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I755fb986c321cffd5ea4e6a14d31d50bec82f9fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817576
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63938}
2019-09-24 03:49:04 +00:00
Yu Yin
663c7251a5 [mips][wasm-c-api] Correct the saved return address.
port f5ab7d3 https://crrev.com/c/1627539.

Change-Id: Ibe721144301bff6d843b6d1861b5a20890a057bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1818004
Commit-Queue: Yu Yin <xwafish@gmail.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63937}
2019-09-24 02:15:14 +00:00
Bill Budge
b12a07c29c Revert "[ptr-compr] Switch to 31 bit Smis on 64-bit architectures"
This reverts commit 12a9ee3a5b.

Reason for revert: Breaks arm64 sim bot

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/17467

Original change's description:
> [ptr-compr] Switch to 31 bit Smis on 64-bit architectures
> 
> 32 bit Smis are incompatible with pointer compression so we land disable
> them before enabling pointer compression in order to separate memory and
> performance regressions caused by 31 bit Smis from pointer compression
> change.
> 
> Bug: v8:9767
> Change-Id: I3d4a675df4208f808b1ba6e7816be545eae0dc24
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815249
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63934}

TBR=ishell@chromium.org,verwaest@chromium.org

Change-Id: Icc5a5b676a7f7d3fdb3fe3cf84007d4f9bce6eaf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9767
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815842
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63936}
2019-09-23 17:29:45 +00:00
Santiago Aboy Solanes
40c0f84a38 [builtins] Avoid reloading undefined value in InterpreterEntryTrampoline
Since we were already loading the undefined value a few lines above,
we could avoid loading it again.

Bug: v8:9771
Change-Id: Id05a77494c06a212612a365b5c0dcba4803ba756
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817609
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63935}
2019-09-23 16:58:19 +00:00
Igor Sheludko
12a9ee3a5b [ptr-compr] Switch to 31 bit Smis on 64-bit architectures
32 bit Smis are incompatible with pointer compression so we land disable
them before enabling pointer compression in order to separate memory and
performance regressions caused by 31 bit Smis from pointer compression
change.

Bug: v8:9767
Change-Id: I3d4a675df4208f808b1ba6e7816be545eae0dc24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815249
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63934}
2019-09-23 15:58:31 +00:00
Joshua Litt
2c17e49a7f [protectors] Migrate another batch of protectors
Bug: v8:9463
Change-Id: Ie0e04e102b56ffdfb636e94ef293bb0d46e5f4a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1808485
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63933}
2019-09-23 15:32:21 +00:00
Dan Elphick
33ff3b05a3 [cleanup] Move many builtin String related functions out of CSA
Moves the following functions only used in string builtins out of
CodeStubAssembler:

StringAdd
AllocateConsString
StringFromSingleUTF16EncodedCodePoint
BranchIfCanDerefIndirectString
DerefIndirectString
MaybeDerefIndirectString
MaybeDerefIndirectStrings

Bug: v8:9396
Change-Id: Ib89966b9c170ca23dd7535a0f550c69966a6e21c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817608
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63932}
2019-09-23 15:29:21 +00:00
Georg Neis
3616229f12 [turbofan] Improve a comment
Change-Id: I4ddb49bb4cb2cda52247354c53386369ad0e0844
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817610
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63931}
2019-09-23 15:17:21 +00:00
Dan Elphick
e121d23599 [cleanup] Move TypedArray functions out of CodeStubAssembler
Move CodeStubAssembler::StoreJSTypedArrayElementFromTagged,
SetJSTypedArrayOnHeapDataPtr and SetJSTypedArrayOffHeapDataPtr into
TypedArrayBuiltinsAssembler.

Bug: v8:9396
Change-Id: I16e6aa82d0de9bd1d29a9e2c095032f2c6dd5e29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817611
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63930}
2019-09-23 14:55:11 +00:00
Dominik Inführ
95b8b10bf3 [heap] Explicitly clear slot in MigrateFastToFast
Since invalidation is disabled at the moment, slots still need to be
cleared explicitly. This was not the case in MigrateFastToFast in
case a slot transitioned from tagged to untagged.

Bug: chromium:1006630
Change-Id: I8d32ab9196603dabad9a382ec49b39144624c30d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815248
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63929}
2019-09-23 13:47:59 +00:00
Ulan Degenbaev
39ecc997eb Fix construction of empty backing stores for SharedArrayBuffers
Bug: chromium:1006629,v8:9380
Change-Id: I8e45759fe3ad1b0ef8f1ebdb33919c84e1e8a044
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815244
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63928}
2019-09-23 13:42:29 +00:00
Dominik Inführ
3803d4d32d Revert "[heap] Emit debugging data before crashing"
This reverts commit c271cb7436.

Reason for revert: CL is not needed anymore.

Original change's description:
> [heap] Emit debugging data before crashing
> 
> We see crashes in the wild, however the minidump does not contain enough
> information for properly investigating this. This is temporary code
> that should be deleted as soon as possible.
> 
> Bug: chromium:1004365
> Change-Id: I25e119d891e03f980d63f5d559fcb4429b574cb1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809373
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63873}

TBR=ulan@chromium.org,dinfuehr@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1004365
Change-Id: Ic8765790bfc96ec144ad02dbdf84e53c6f3e6571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815252
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63927}
2019-09-23 12:40:06 +00:00
Michael Starzinger
d1e9b884ae [asm.js] Fix parsing of float coercion arguments.
This fixes how arguments of a call to {fround} are being parsed. It now
accepts a single "AssignmentExpression" only instead of an "Expression"
which could potentially be a whole comma-separated list of expressions.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-1006592
BUG=chromium:1006592

Change-Id: Ifaf0c2b048e4ec18429cc6039c0e7dcdecc1d0bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815255
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63926}
2019-09-23 12:26:26 +00:00
Clemens Hammacher
500f4ba25c [wasm][cleanup] Remove redundant newline
This is a very minor cleanup, which makes the output of
--trace-wasm-compiler more compact.

R=mstarzinger@chromium.org

Change-Id: I6b941f32e2ec6c3963e14dd376f8a1d65cf46ec6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815254
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63925}
2019-09-23 12:17:46 +00:00
Michael Starzinger
ca02d58b34 [wasm] Load call builtin in JS-to-JS wrappers.
This loads the call builtin from the Isolate root instead of embedding
it into the instruction stream. This can be more efficient, but more
importantly it fixes an issue with tracing and eventually allows for
background compilation of these wrappers.

R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regress-crbug-1006631
BUG=chromium:1006631

Change-Id: Ife1bc513340d233a3c01789c7b56126fe3b87f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815245
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63924}
2019-09-23 10:43:51 +00:00
Clemens Hammacher
6b6c2317fe Revert "[wasm] Fix TODO and skip test on win32"
This reverts commit ad83fa921b.

Reason for revert: Crashes odroid: https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/11234

Original change's description:
> [wasm] Fix TODO and skip test on win32
> 
> In the {Fixed} variant, the {GrowingVsFixedModule} test first reserves
> 1GB of memory, then allocates another 1GB to add it to the module as
> code. This uses too much memory on win32, making the test fail.
> Before this CL, the {NativeModule} only reserved 128kB upfront (in
> contrast to the actual expectation of the test).
> 
> Since all other aspects of this test are already covered by other
> tests, we just skip this test on win32.
> This allows us to resolve the TODO.
> 
> Drive-by: Clean up the unittests status file a bit.
> 
> R=​mstarzinger@chromium.org
> 
> Bug: v8:9477
> Change-Id: I575dd1a3f486e1805e0256e8ee6071246f2c24c4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816505
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63921}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: Ia9d9b9e311ff8b7524938aeb02543bf2c01bdd27
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9477
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1815250
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63923}
2019-09-23 10:29:43 +00:00
Dan Elphick
00d2c18ad5 [csa] tnodify Uint8 clamp functions
This tnodifies CodeStubAssembler::Float64ToUint8Clamped and
Int32ToUint8Clamped.

Bug: v8:6949
Change-Id: I79c8cd45dc4c8333f268cf0a62234d75369f89b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813024
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63922}
2019-09-23 10:20:09 +00:00
Clemens Hammacher
ad83fa921b [wasm] Fix TODO and skip test on win32
In the {Fixed} variant, the {GrowingVsFixedModule} test first reserves
1GB of memory, then allocates another 1GB to add it to the module as
code. This uses too much memory on win32, making the test fail.
Before this CL, the {NativeModule} only reserved 128kB upfront (in
contrast to the actual expectation of the test).

Since all other aspects of this test are already covered by other
tests, we just skip this test on win32.
This allows us to resolve the TODO.

Drive-by: Clean up the unittests status file a bit.

R=mstarzinger@chromium.org

Bug: v8:9477
Change-Id: I575dd1a3f486e1805e0256e8ee6071246f2c24c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816505
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63921}
2019-09-23 09:28:10 +00:00
Dan Elphick
4921821b2f [parser] Prevent lazy parsing of arrow functions
Change Parser::AllowsLazyParsingWithoutUnresolvedVariables to return
false if it may be parsing an arrow function.

Bug: v8:9758, v8:8510
Change-Id: Ic5d213d4358ff954a169c03e449197c3f050880c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816510
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63920}
2019-09-23 08:59:18 +00:00
huangjunming
8d7c581a2a [heap] Remove unnecessary function call for GetRandomMmapAddr on Mac
Change-Id: I140b530fcb6332c08d45ef10445619e24987e3ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817997
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63919}
2019-09-23 08:39:12 +00:00
v8-ci-autoroll-builder
37cd203d6c Update V8 DEPS.
Rolling v8/build: 5742923..c05af3e

Rolling v8/third_party/depot_tools: 82ae4b4..7cb60e8

Rolling v8/tools/clang: d2e7b20..235f673

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I1432b0b73744d87f669811f253ddb9fa4e34d7b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817562
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63918}
2019-09-23 03:40:10 +00:00
v8-ci-autoroll-builder
26fd582d85 Update V8 DEPS.
Rolling v8/build: 2a85930..5742923

Rolling v8/third_party/depot_tools: d4d1ba4..82ae4b4

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I44564080c86c20b9cf3200191b18ed35e3366a6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817560
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63917}
2019-09-22 03:47:19 +00:00
v8-ci-autoroll-builder
3633ecebda Update V8 DEPS.
Rolling v8/build: 9417d7b..2a85930

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/535cd16..fa002e6

Rolling v8/third_party/depot_tools: 7735f52..d4d1ba4

Rolling v8/tools/clang: b6e35ab..d2e7b20

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I276eb908a02e912bdaa9ae79f999314dc10d670d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1817557
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63916}
2019-09-21 03:52:30 +00:00
Pavol Marko
1d0ed2ed55 Revert "[Heap] Allocate descriptor array in young"
This reverts commit 0d6aa842e6.

Reason for revert: Suspected to be triggering many test flakes - https://crbug.com/1005723

Original change's description:
> [Heap] Allocate descriptor array in young
>
> This hopefully fix the regression test from c693e005a7
>
> Bug: v8:1004766
> Change-Id: If3c554070af6b795e4b3f99cd592a62453028874
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809363
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@google.com>
> Cr-Commit-Position: refs/heads/master@{#63858}

TBR=ulan@chromium.org,victorgomes@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:1004766, chromium:1005723
Change-Id: I763036ea6873b4b95783981e9e9f4e79782e7a4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816515
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63915}
2019-09-20 18:32:29 +00:00
Ng Zhi An
bcb31fe4df [wasm-simd] Fix simd 128 load and store memarg reading in interpreter
Add a new test SimdLoadStoreLoadMemargOffset to test this, without this fix
this test would have failed.

Bug: v8:9753
Change-Id: I119adda8e3c6c7adb0ad4023298bbce9c0c64a01
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1811457
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63914}
2019-09-20 18:04:29 +00:00
Joshua Litt
10883f561a [hole-check-elimination] Simplest possible hole check elimination
doc: https://docs.google.com/document/d/1Y9uF3hS2aUrwKU56vGxlvEs_IiGgmWSzau8097Y-XBM/edit

Bug: v8:7427
Change-Id: Iedd36c146cefff7e6687fdad48d263889c5c8347
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778902
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63913}
2019-09-20 17:27:49 +00:00
Suraj Sharma
99188fc477 [ic] Add support for StoreSlow() in Global Dispatcher
Global Objects now use the Smi handler StoreSlow() to perform
StoreGlobalIC_Slow.

Bug: chromium:1004037
Change-Id: I365ab918383525278590ca4369a4b1b0d9636d29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1812657
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#63912}
2019-09-20 17:05:09 +00:00
Joshua Litt
f25edf22e7 [d8] Terminate execution instead of omitting quit in d8 asan
Bug: v8:4653
Change-Id: I2b2e0e12dc7c3734dd554aa6dd5ed71c90a77758
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1806796
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63911}
2019-09-20 16:38:19 +00:00
Irina Yatsenko
934dd8d7f8 [tools] Add !rs command to print remembered sets.
Produces output similar to:

Remembered set in chunk 0x29d0cd40000
  <empty>
Remembered set in chunk 0x891f200000
  <empty>
Remembered set in chunk 0x2fb14780000
  bucket 0x1ff381b09d0:
    0x2fb14780128 -> 0x6d7e080119
    0x2fb14780130 -> 0x6d7e080129
    0x2fb14780138 -> 0x6d7e080139
    0x2fb14780140 -> 0x6d7e080149
    0x2fb14780148 -> 0x6d7e080159
    0x2fb14780150 -> 0x6d7e080169
    0x2fb14780158 -> 0x6d7e080179
    0x2fb14780160 -> 0x6d7e080189
    0x2fb14780168 -> 0x6d7e080199
    0x2fb14780170 -> 0x6d7e0801a9
  10 remembered pointers in chunk 0x2fb14780000
Remembered set in chunk 0x5360700000
  <empty>

0: 000> !rs
Change-Id: I783322a2648ccba8a27aae72a459c742357e8e11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801253
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63910}
2019-09-20 16:33:09 +00:00
Joshua Litt
39cc400dea [top-level-await] Add support for top level await to d8
This cl adds support for top level await to d8, but still
does not allow top level await through parsing.
Unfortunately, due to that restriction this cl has no automated
tests, but I added a 'top-level-await' variant and manually
confirmed it passes locally.

Bug: v8:9344
Change-Id: I3528442768107f5ad1ed1e9e947cfceae91c0cc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1808483
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63909}
2019-09-20 16:04:49 +00:00
Seth Brenith
1d3c4975be [tools] Use instance types of known Maps in v8_debug_helper
If we can read an object's Map pointer but not any data from the Map
itself, we may still be able to accurately describe the object's type if
the Map pointer matches one of the known Maps from the snapshot.
GetObjectProperties uses that data in one of two ways:
- If it is sure that the Map pointer matches a known Map, then it uses
  the type from that Map and continues as if it read the type normally.
- If the Map pointer is at the right offset within a heap page to match
  a known Map, but the caller didn't provide the addresses of the first
  pages in Map space or read-only space, then the type of that Map is
  just a guess and gets returned in a separate array. This gives the
  caller the opportunity to present guessed types to the user, and
  perhaps call again using the guessed type as the type hint.

Bug: v8:9376
Change-Id: I187f67b77e76699863a14534a9d635b79f654124
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1787986
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63908}
2019-09-20 16:00:59 +00:00
Sathya Gunasekaran
0336a33c52 Revert "[Context] Add a bit flag to indicate if extension might exist"
This reverts commit d7b67ce206.

Reason for revert: broke tsan https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8901789268326050304/+/steps/Check/0/logs/enumeration-order/0

Original change's description:
> [Context] Add a bit flag to indicate if extension might exist
> 
> Checking the bit flag instead of comparing pointers should improve performance.
> This will also allow us to remove the extension slot in Context and save memory.
> 
> Bug: v8:9744
> Change-Id: I7ab9feeadfb934955798d877d13bc0e1d78a191c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1814918
> Commit-Queue: Victor Gomes <victorgomes@google.com>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63906}

TBR=ulan@chromium.org,leszeks@chromium.org,victorgomes@google.com

Change-Id: I3d2261e24c9c7da5f5a1d49803361bc6f0770330
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9744
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816514
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63907}
2019-09-20 15:16:11 +00:00
Victor Gomes
d7b67ce206 [Context] Add a bit flag to indicate if extension might exist
Checking the bit flag instead of comparing pointers should improve performance.
This will also allow us to remove the extension slot in Context and save memory.

Bug: v8:9744
Change-Id: I7ab9feeadfb934955798d877d13bc0e1d78a191c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1814918
Commit-Queue: Victor Gomes <victorgomes@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63906}
2019-09-20 14:12:55 +00:00
Ana Peško
ad1feec8d5 [regexp] Turn on regexp tier-up with ticks = 1
This CL enables regexp interpreter and tier-up to the compiler after one
execution by setting the --regexp-tier-up flag to true by default. The
number of times a regexp is interpreted before tiering-up is controlled
by the --regexp-tier-up-ticks flag which is already set to 1 by default.

Change-Id: I79ff7fcd159f50f2f5351b339d8ffb21af039a86
Bug: v8:9566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816501
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Ana Pesko <anapesko@google.com>
Cr-Commit-Position: refs/heads/master@{#63905}
2019-09-20 13:19:44 +00:00
Clemens Hammacher
8ede52bacd [wasm] Skip deadlocking tests on predictable platform
The predictable platform can make tasks deadlock if the spawning task
is holding a lock that the spawn task also wants to take. This is
because the spawned task is just executed immediately within the
"context" of the spawning task.

The wasm async compile tests deadlock because the
{BackgroundCompileTask}s hold the shared {BackgroundCompileToken}
(reader lock) while spawning new tasks via {OnBackgroundTaskStopped} ->
{RestartBackgroundTasks}. The new tasks might want to cancel
compilation via {BackgroundCompileToken::Cancel}, which takes the
writer lock and hence deadlocks.
This can not happen on any other platform, since tasks are not nested
that way.

R=ahaas@chromium.org

Bug: v8:9760
No-Try: true
Change-Id: I9fc34d5de386aa5c6fdd64a1570fddcff872ec95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1816502
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63904}
2019-09-20 10:23:14 +00:00
Clemens Hammacher
87287908b3 [wasm] Add test for creating 10k modules in one process
With --wasm-far-jump-table, it will be possible to create 10k (and
more) modules in one process. So far, we hit the virtual address space
limit around 1k modules, because each module makes a reservation of
{kMaxWasmCodeMemory} upfront. After this change, each module will only
reserve the estimated needed code size (if --wasm-far-jump-table is
set).

The test is carefully optimized to not execute too much code in the
loop, so it can still run in simulators in reasonable time. Note that
the time for actually compiling the module is spent in C++, which is
fast in simulator builds.

R=mstarzinger@chromium.org

Bug: v8:9477, v8:9651
Change-Id: If74a825d272a65b82ca5433cb648b6a2271872e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1811038
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63903}
2019-09-20 09:34:34 +00:00
Pierre Langlois
92e8b924a4 [arm64] Use the default code to represent invalid registers.
The CPURegister class has an additional "type" field to represent an invalid
register while the cross-platform RegisterBase class uses -1 as a register code.

For consistency and to avoid potential bugs from confusing x0 and
`CPURegister::no_reg()`, use -1 as a register code as well in CPURegister.

Change-Id: I1a36230091433bc854a5966f36e3c25e33a406c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813746
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#63902}
2019-09-20 08:43:24 +00:00
v8-ci-autoroll-builder
232ed8a7d5 Update V8 DEPS.
Rolling v8/build: 050608e..9417d7b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2ad5356..535cd16

Rolling v8/third_party/depot_tools: c6be56e..7735f52

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ie3a7b8566ff031dc64dbd774ef3bd81947eb86ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1814282
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63901}
2019-09-20 03:52:14 +00:00
Dmitry Gozman
6f60c36248 inspector: V8StackTraceId serialization/deserialization
This makes it possible to plumb string representation of stack trace id
across various channels, e.g. for network requests.

Drive-by: extracted class V8DebuggerId, which encapsulates operations
with pair<int64_t, int64_t>.

Bug: chromium:988842
Change-Id: I348c91390a85bf07c746d1b1c4a7775f44c7d769
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725193
Commit-Queue: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63900}
2019-09-20 00:38:24 +00:00
Frank Tang
8d1b4774bf [Intl] Sync ListFormat to latest spec.
1. Add StringListFromIterable based on
https://tc39.es/proposal-intl-list-format/#sec-createstringlistfromiterable
2. Adjust other parts to sync with the new version.

Bug: v8:9747
Change-Id: I14202f2963463e6a3e9816209f087bfe8e73cb91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809902
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63899}
2019-09-19 20:02:53 +00:00
Igor Sheludko
dc1a93b85c Reland "[ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly"
This is a reland of 6f9b2bd48a

We must load JSTypedArray::base_pointer in TurboFan as tagged value otherwise
this value may become stale pointer after GC.

Original change's description:
> [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly
>
> On-heap typed arrays contain HeapObject value in |base_pointer| field
> and an offset in |external_pointer| field. When pointer compression is
> enabled we want to combine decompression with the offset addition.
> In order to do that we add an isolate root to the external_pointer value
> and therefore the data pointer computation can is a simple addition of
> a (potentially sign-extended) |base_pointer| loaded as Tagged_t value
> and an |external_pointer| value.
>
> Bug: v8:9706
> Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63874}

Bug: v8:9706, chromium:1005599
Cq-Include-Trybots: luci.chromium.try:gpu-fyi-try-win10-nvidia-rel-64
Change-Id: I7bbd2a439306cdd11f2bb0dab5863498624d9740
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813744
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63898}
2019-09-19 16:53:59 +00:00
Georg Neis
35d8b9a548 [turbofan] Protect against overflow of node id and input index field
- Check validity of node id in Node constructor.
- Turn overflow check in NextNodeId() into debug check only, since that
  is not checking the interesting overflow anyway.
- Increase width of Use::InlineCountField to use all available bits.

Bug: chromium:1003286
Change-Id: I59af68e29a466e151f7048e1f15bd56d3fa58e5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813019
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63897}
2019-09-19 16:02:36 +00:00
Clemens Hammacher
45558d498c [wasm] Fix patching of new jump tables
The {code_table_} only contains entries for the declared functions, and
is indexed by a slot index. The {PatchJumpTableLocked} and
{PatchJumpTablesLocked} functions on the other hand expected a function
index (offset by the number of imported functions). From that it
computes the slot index again.
This translation was missing in one place. This CL fixes this by
directly passing the slot index instead of the function index to these
methods. In all locations, we computed the slot index anyway for
addressing the code table.

Drive-by: Use more unique_ptr for managing the {code_table_}. This
avoids ever having to store raw pointers.

R=ahaas@chromium.org

Bug: v8:9477
Change-Id: I81caa53b74da010aee5854879e98e82b7773098b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813742
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63896}
2019-09-19 15:58:52 +00:00
Jakob Kummerow
e2bfd48fb3 [heap] Fix weird unaligned allocation limits
Allocation observers used to set allocation limits with the intention
to statistically sample allocations that crossed those points. Those
limits had random alignment, but since object allocations are always
kTaggedSize-aligned, there is no benefit to having the limit be finer
grained. This patch makes sure that the limit is always aligned, which
in turn implies that the available space in a linear allocation area
is always a multiple of kTaggedSize.

Bug: v8:9700
Change-Id: Ib2980b4b8e792cf516cb734b451862c9e2a98029
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813026
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63895}
2019-09-19 14:48:06 +00:00
Igor Sheludko
ecafe04b37 [ic] Fix accessor to data reconfiguration case
... in object literals.

Bug: chromium:997056
Change-Id: Ifc210ff53b751c6ef26f16b73c9ac52426a845fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813021
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63894}
2019-09-19 14:35:46 +00:00
Toon Verwaest
f02b27aca1 [factory] Harden NewByteArray against negative length
Other array allocation methods in the factory already do the same anyway.

Bug: chromium:1003679
Change-Id: I05201dd5d124b530eb6b578abb1486e65d076cc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1806683
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63893}
2019-09-19 13:45:06 +00:00
Jakob Gruber
99d31b432f [build] Define V8_TARGET_OS_ and consider it in x64 codegen
This CL allows us to distinguish between the host- and target OS. The
host OS is defined by V8_OS_ macros (e.g. V8_OS_WIN). The target OS is
defined by V8_TARGET_OS_ macros (e.g. V8_TARGET_OS_WIN).

V8_TARGET_OS_ macros are defined by gn, based on the `target_os` gn
variable. If a V8_TARGET_OS_ is set, we also define V8_HAVE_TARGET_OS
(this determines fall-back behavior in V8; if it is not defined, we set
V8_TARGET_OS_ to equal the equivalent V8_OS_ define).

Besides adding the defines, this CL also adds logic to consider the
target OS in codegen. Specifically, x64 builds now look at the
V8_TARGET_OS_WIN define instead of V8_OS_WIN or _WIN64. This
effectively makes cross-compilation to x64 Windows in mksnapshot
possible.

In future work, we could add similar support for cross-compiling to
other platforms such as ia32 Windows.

Bug: v8:9736,chromium:803591
Change-Id: I689f3de8c206b743c4bef703f5ade0bba32ce995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809374
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63892}
2019-09-19 13:38:56 +00:00
Dominik Inführ
ce304db8dc Revert "[heap] Disable old-to-new invalidation"
This reverts commit ac3c4fcfab.

Reason for revert: Tested this CL for backport.

Original change's description:
> [heap] Disable old-to-new invalidation
> 
> Disable invalidation of old-to-new slots for now. Invalidation doesn't
> match behavior of clearing slots directly in the remembered set.
> 
> Bug: chromium:1004365
> Change-Id: Ib6a21457827faafa75be88720c214e5ec483c71b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813028
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63890}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: Id3d210cd970ea7b8e28571b7801b7a395e4f0af3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1004365
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813745
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63891}
2019-09-19 13:30:28 +00:00
Dominik Inführ
ac3c4fcfab [heap] Disable old-to-new invalidation
Disable invalidation of old-to-new slots for now. Invalidation doesn't
match behavior of clearing slots directly in the remembered set.

Bug: chromium:1004365
Change-Id: Ib6a21457827faafa75be88720c214e5ec483c71b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813028
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63890}
2019-09-19 13:27:56 +00:00