Commit Graph

74861 Commits

Author SHA1 Message Date
Junliang Yan
19e05d6dbf ppc64: [baseline] port PrologueFillFrame and VerifyFrameSize
Change-Id: I23376b2ad0dc8616048f8c9c7122d5bf38fa70d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3615013
Commit-Queue: Junliang Yan <junyan@redhat.com>
Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80269}
2022-04-28 21:47:17 +00:00
Michael Lippautz
cf0d464735 [handles] Simplify GlobalHandles 2nd pass callback handling
- Rely on GCCallbacksScope to avoid nesting callbacks.
- Use a single entrypoint consistently for all callsites.

Change-Id: I6be1f749a2d6bfc9d5db4c84c753e9176472bce2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605821
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80268}
2022-04-28 21:46:09 +00:00
Adam Klein
349d45134f Revert "[heap] Refactor atomic marking phase"
This reverts commit a3f66927f9.

Reason for revert: test failures on TSAN/no-concurrent-marking bot:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/8549/overview

Original change's description:
> [heap] Refactor atomic marking phase
>
> The atomic marking phase was organized in many distinct smaller
> phases. In particular, before http://crrev.com/c/3584115 the marking
> phase split into two large separate phases.
>
> This CL reorganizes marking into two phases that perform regular V8
> heap marking, Oilpan, and ephemerons:
> - A parallel phase that likely drains all marking worklists;
> - A single-threaded final phase to catch any left overs;
>
> This avoids artificial splitting in phases and also avoids repeated
> starting and joining of jobs.
>
> Change-Id: I5cccfc5777837d9ece10d8f4925781bf2d07d9da
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602507
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80265}

Change-Id: I4838e9316bd30f8a0b78fa6a27820d3457e1e579
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3614972
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80267}
2022-04-28 21:40:19 +00:00
Junliang Yan
48123d6b30 ppc64: [baseline] implement Switch function
Change-Id: Iae749161f5a6f2347a64f45579d9bd9d5e0ccaf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3613387
Reviewed-by: Milad Farazmand <mfarazma@redhat.com>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80266}
2022-04-28 18:37:15 +00:00
Michael Lippautz
a3f66927f9 [heap] Refactor atomic marking phase
The atomic marking phase was organized in many distinct smaller
phases. In particular, before http://crrev.com/c/3584115 the marking
phase split into two large separate phases.

This CL reorganizes marking into two phases that perform regular V8
heap marking, Oilpan, and ephemerons:
- A parallel phase that likely drains all marking worklists;
- A single-threaded final phase to catch any left overs;

This avoids artificial splitting in phases and also avoids repeated
starting and joining of jobs.

Change-Id: I5cccfc5777837d9ece10d8f4925781bf2d07d9da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3602507
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80265}
2022-04-28 18:20:58 +00:00
Milad Fa
692aeb278d PPC: [builtins] Add 'RestartFrameTrampoline'
Port b011817158

Original Commit Message:

    This CL adds a new builtin called "RestartFrameTrampoline". This
    trampoline is relatively simple: It leaves the current frame and
    re-invokes the function. This essentially restarts the function and
    is one of the key components required to bring back the "Restart
    frame" DevTools debugging feature.

    The builtin is closely related to the "FrameDropperTrampoline"
    removed in the CL https://crrev.com/c/2854750. The key difference
    is that the "FrameDropperTrampoline" dropped to an "arbitrary"
    frame pointer before restarting the function (arbitrary in the
    sense that it was provided as an argument). This caused issues
    as the feature was implemented in a way that the frame pointer
    wasn't necessarily valid anymore.

    In comparison, the "RestartFrameTrampoline" relies on the V8
    unwinder to drop it in the correct frame first and is then
    invoked via either the CEntry stub or the deoptimizer
    (see design doc for details).

R=szuend@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Id742eeaa59a540ec206a92308fb72bb50413e267
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3613391
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80264}
2022-04-28 18:06:38 +00:00
Leszek Swirski
cb4fb3b571 [maglev] Add a write barrier to StoreField
StoreField wasn't emitting a write barrier after performing the store,
leading to the usual set of hard-to-debug issues. Now it does.

The write barrier requires some of its registers to be in fixed
locations, and others to be clobberable. Thsi patch extends the
temporaries mechanism to allow requesting a specific temporary, in this
case for the slot address scratch register.

Bug: v8:7700
Change-Id: I506856071e0f44feafb98c2685ef1b3362b0e41e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3613388
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80263}
2022-04-28 15:45:18 +00:00
Dominik Inführ
23b2d571a7 Reland "[heap] Store size with invalidated object"
This is a reland of commit 5d235def26

The previous version of this CL got reverted because the cached
size of an invalidated object wasn't up-to-date when performing a GC.

Not all size changes go through NotifyObjectLayoutChange, so
https://crrev.com/c/3607992 introduced NotifyObjectSizeChange as a
bottleneck for object size changes/right-trimming. This method is
now used to update the size of invalidated objects.

Original change's description:
> [heap] Store size with invalidated object
>
> When updating pointers during a full GC, a page might not be swept
> already. In such cases there might be invalid objects and slots recorded
> in free memory. Updating tagged slots in free memory is fine even though
> it is superfluous work.
>
> However, the GC also needs to calculate the size of potentially dead
> invalid objects in order to be able to check whether a slot is within
> that object. But since that object is dead, its map might be dead as
> well which makes size calculation impossible on such objects. The CL
> changes this to cache the size of invalid objects. A follow-up CL will
> also check the marking bit of invalid objects.
>
> Bug: v8:12578, chromium:1316289
> Change-Id: Ie773d0862a565982957e0dc409630d76552d1a32
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3599482
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80169}

Bug: v8:12578, chromium:1316289
Change-Id: I1f7c6070b8e7d116aeb1a8d03d4f87927ab40872
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608632
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80262}
2022-04-28 15:35:09 +00:00
Victor Gomes
56adca8ed6 [maglev] Generic CreateEmptyArrayLiteral node
We should just call the builtin while we don't have inlined
allocations.

Bug: v8:7700
Change-Id: I6da605cc756b0f44fb1366e90e6c0dac60ae9beb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3613326
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80261}
2022-04-28 14:42:58 +00:00
Camillo Bruni
8a744da3b4 [snapshot] Reduce startup snapshot checksum check overhead
Avoid calculating the checksum on every snapshot deserialization.

- Desktop: by default only in release
- Android: once per process

Most snapshot corruptions happen on android devices but there we also
have the highest overhead from calculating the checksum.

Findings doc: https://docs.google.com/document/d/e/2PACX-1vQWdJjrZpTL5VjbP_LHH-qQj-9vcmuLez93WPZhoacJT2bTXfCAdJpbexfJWP9jrAI5ek_416uZE6_W/pub

Bug: v8:12195
Change-Id: Ic7f2f45a9e8ade31c3774a7b659d9c30769e2b44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3583983
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80260}
2022-04-28 14:35:18 +00:00
Igor Sheludko
449ece383b Reland "[rwx][mac] Support fast W^X permission switching on Apple Silicon (M1)"
This is a reland of commit 9d31f8663a
There were issues with --future flag implications on M1.

Original change's description:
> [rwx][mac] Support fast W^X permission switching on Apple Silicon (M1)
>
> ... for V8 code space. The feature is currently disabled.
>
> In order to use fast W^X permission switching we must allocate
> executable pages with readable writable executable permissions (RWX).
> However, MacOS on ARM64 ("Apple M1"/Apple Silicon) prohibits further
> permission changing of RWX memory pages. This means that the code page
> headers must be allocated with RWX permissions too because otherwise
> it wouldn't be possible to allocate a large code page over the freed
> regular code page and vice versa.
>
> When enabled, the new machinery works as follows:
>
> 1) when memory region is reserved for allocating executable pages, the
>    whole region is committed with RWX permissions and then decommitted,
> 2) since reconfiguration of RWX page permissions is not allowed on
>    MacOS on ARM64 ("Apple M1"/Apple Silicon), there must be no attempts
>    to change them,
> 3) the request to set RWX permissions in the executable page region
>    just recommits the pages without changing permissions (see (1), they
>    were already allocated as RWX and then discarded),
> 4) in order to make executable pages inaccessible one must use
>    OS::DiscardSystemPages() instead of OS::DecommitPages() or
>    setting permissions to kNoAccess because the latter two are not
>    allowed by the MacOS (see (2)).
> 5) since code space page headers are allocated as RWX pages it's also
>    necessary to switch between W^X modes when updating the data in the
>    page headers (i.e. when marking, updating stats, wiring pages in
>    lists, etc.). The new CodePageHeaderModificationScope class is used
>    in the respective places. On unrelated configurations it's a no-op.
>
> The fast permission switching can't be used for V8 configuration with
> enabled pointer compression and disabled external code space because
> a) the pointer compression cage has to be reserved with MAP_JIT flag
>    which is too expensive,
> b) in case of shared pointer compression cage if the code range will
>    be deleted while the cage is still alive then attempt to configure
>    permissions of pages that were previously set to RWX will fail.
>
> This also CL extends the unmapper unit tests with permissions tracking
> for discarded pages.
>
> Bug: v8:12797
> Change-Id: Idb28cbc481306477589eee9962d2e75167d87c61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3579303
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80238}

Bug: v8:12797
Change-Id: I0fe86666f31bad37d7074e217555c95900d2afba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610433
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80259}
2022-04-28 14:08:11 +00:00
Benoît Lizé
03b69480db [base/platform] Simplify /proc/self/maps parsing
There are three ways to parse /proc/self/maps in platform-linux.cc,
remove one to use common code. In the process, add a unit test, and fix
some issues in the latest iteration of /proc/self/maps parsing.

Change-Id: I4701ea49fe8cce53aea0179e194dc48fbebb2ff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605226
Commit-Queue: Benoit Lize <lizeb@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80258}
2022-04-28 14:00:18 +00:00
Omer Katz
cf6ad387ff cppgc: Revise WeakContainerTest.*
For some reason the compiler was optimizing away the reference to the
object in WeakContainerTest.ConservativeGCTracesWeakContainer and thus
not finding it conservatively.
This CL revises the tests such that the compiler is no longer able to
optimize references away.

Bug: v8:12824
Change-Id: Ie598a1cf1124c2983a6c61fd4e990734d36f5832
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610627
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80257}
2022-04-28 13:31:42 +00:00
Camillo Bruni
42138ac2e9 [flags] Avoid endless lops when enforcing flag implications
Change-Id: Ide8935a02cb64134c3bdeb8b3e38e9a6e043e13c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610432
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80256}
2022-04-28 13:30:39 +00:00
Victor Gomes
4837f37279 [maglev] Float64 box/unbox elision
- Supports Float64 Add for SmiAdd bytecode
- Adds a Float64Constant and ChangeInt32ToFloat64 nodes
- Converts floats to tagged in Phi node inputs
- Fixes spill double representation
- Fixes materialisation during a deopt of a double in the stack

Bug: v8:7700
Change-Id: I9217a64313b4bd5d0015f935c23771ecf9a2c7ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610426
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80255}
2022-04-28 13:17:48 +00:00
Simon Zünd
b011817158 [builtins] Add 'RestartFrameTrampoline'
Doc: https://bit.ly/revive-restart-frame
Context: https://crrev.com/c/3582395 (jumbo CL with the whole feature)

This CL adds a new builtin called "RestartFrameTrampoline". This
trampoline is relatively simple: It leaves the current frame and
re-invokes the function. This essentially restarts the function and
is one of the key components required to bring back the "Restart
frame" DevTools debugging feature.

The builtin is closely related to the "FrameDropperTrampoline"
removed in the CL https://crrev.com/c/2854750. The key difference
is that the "FrameDropperTrampoline" dropped to an "arbitrary"
frame pointer before restarting the function (arbitrary in the
sense that it was provided as an argument). This caused issues
as the feature was implemented in a way that the frame pointer
wasn't necessarily valid anymore.

In comparison, the "RestartFrameTrampoline" relies on the V8
unwinder to drop it in the correct frame first and is then
invoked via either the CEntry stub or the deoptimizer
(see design doc for details).

Bug: chromium:1303521
Change-Id: I7bd46620808f8694c2c776b8bcd267e525d5b581
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585944
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80254}
2022-04-28 13:11:28 +00:00
Andreas Haas
231dfdef4c [wasm] Disable limits test on Android
The test is very resource intensive and is therefore not reliable on
weaker systems. The limits are the same for all configurations, so it's
not a problem if we disable the test for some configurations.

R=machenbach@chromium.org

Fixes: v8:12836
Change-Id: If187bd3d5d352b1685d3a6e43a76860a263f53de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3608631
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80253}
2022-04-28 12:53:38 +00:00
Camillo Bruni
759e841a05 [api] Rename isolate variables
* Prefix all isolate variables with i_ for i::Isolate and
  v8_ for v8::Isolate
* Change _DO_NOT_USE macro suffix to _INTERNAL

Change-Id: I005efbe0192cf202741448c63a4263e6a4b1fa1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610429
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80252}
2022-04-28 12:51:08 +00:00
Victor Gomes
a6b8d064cc [baseline] Create flag to use UserBlocking threads for CSP
Since Sparkplug compiles pretty quickly and it might impact loading
time, there is an argument that we should actually use high priority
threads for CSP.

This adds a flag so that we create a finch experiment to test this
hypothesis.

Change-Id: Ib8965fbea015ddaeb25503bd92873bfff5daa1ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605245
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80251}
2022-04-28 12:48:29 +00:00
Victor Gomes
4b419c0672 [cleanup] Rename TranslatedFrame with inlined arguments
... from ArgumentsAdaptorFrame to InlinedExtraArguments.

Change-Id: I772e0546dd50282a4cd14723625fd5bf774f424c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609968
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80250}
2022-04-28 10:38:21 +00:00
Samuel Groß
f3f7b4e5c6 [base] Fix wrong variable name in platform-fuchsia.cc
Bug: chromium:1320126
Change-Id: Ieab14e0793e64c607ffee656eed66efe31be65f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610434
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Samuel Groß <saelo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80249}
2022-04-28 09:46:58 +00:00
Victor Gomes
844f3d6482 [maglev] Use higher level Smi macro assembler operations
Bug: v8:7700
Change-Id: Ia601631de4cbc8099a87be0bda4a68ddffa8de74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610428
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80248}
2022-04-28 09:05:18 +00:00
Marja Hölttä
b8f88be06e [rab/gsab] Temporarily stage --harmony-rab-gsab to enable fuzzing
Please revert this commit if anything breaks!

Bug: v8:11111
Change-Id: Ieaf8a57846df011abc245109c22a5cabe627a087
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610430
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80247}
2022-04-28 08:54:18 +00:00
Keith Smiley
75325a32ba [bazel] Include handler-include-posix on m1 macs
Previously building `//:noicu/mksnapshot` on M1 macs produced this
linker error:

```
Undefined symbols for architecture arm64:
  "v8::internal::trap_handler::TryHandleSignal(int, __siginfo*, void*)", referenced from:
      v8::TryHandleWebAssemblyTrapPosix(int, __siginfo*, void*) in libv8_libshared_noicu.lo(api.o)
  "v8::internal::trap_handler::RegisterDefaultTrapHandler()", referenced from:
      v8::internal::trap_handler::EnableTrapHandler(bool) in libv8_libshared_noicu.lo(handler-outside.o)
ld: symbol(s) not found for architecture arm64
clang: error: linker command failed with exit code 1 (use -v to see invocation)
```

Because this branch that enabled the trap handler:

```
// Arm64 (non-simulator) on Mac.
 #elif V8_TARGET_ARCH_ARM64 && V8_HOST_ARCH_ARM64 && V8_OS_DARWIN
```

Wasn't handled in the build, so the file was excluded.

Change-Id: Ie2ed9d3aeab849b1479cad5d4f9ca48e6eb51bf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3589296
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80246}
2022-04-28 08:49:58 +00:00
Samuel Groß
18159ba610 [base] Abort on unexpected failures in OS::SetPermissions
It is expected that changing page permissions can fail due to the system
running out of memory. However, any other failure is unexpected and
likely indicates a bug in the caller, such as changing the permissions
of an invalid memory region. To allow distinguishing between these
unexpected failures and expected OOM failures, this CL adds CHECKs into
the low-level memory management routines to abort when an unexpected
failure occurs.

Similar logic could later be added to other low-level memory management
routines that can legitimately fail due to OOM as well.

Bug: chromium:1320126
Change-Id: I3de6f4b2aed8962c91770b81382df34384584501
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610445
Commit-Queue: Samuel Groß <saelo@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80245}
2022-04-28 08:12:20 +00:00
Marja Hölttä
a64bb79987 [rab/gsab] Atomics.*: Support RAB / GSAB
Bug: v8:11111
Change-Id: I3c350dd98b3da995b52c8366876d66b87fc47c28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605611
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80244}
2022-04-28 08:05:18 +00:00
Dominik Inführ
b087443883 [heap] Remove MarkCompactCollectorBase
Remove the common base class of MarkCompactCollector and
MinorCompactCollector as a cleanup.

Change-Id: Ib6a931b2bd397ac7c9425b0e268b847a38125a57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610424
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80243}
2022-04-28 06:35:08 +00:00
Lu Yahan
359c48d908 [riscv64] Delete extra scratch reg
Change-Id: Ib145fcc89ff15d06de8205e67280798ed8f36aac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3612667
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#80242}
2022-04-28 06:15:58 +00:00
Andreas Haas
ee866433ad [wasm] Remove SIMD proposal tests
The SIMD proposal has been merged into the main spec, it is not
necessary anymore to execute the SIMD proposal tests additionally.

R=gdeepti@chromium.org

Change-Id: I1c5847a1bfba2d0c956cf353816fd71417506a1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3609848
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80241}
2022-04-28 05:22:59 +00:00
Frank Tang
f09026a6f2 [Temporal] Add PlainDateTime.from
Also add AOs: ToTemporalDateTime, ParseTemporalDateTimeString,
InterpretTemporalDateTimeFields

Spec Text:
https://tc39.es/proposal-temporal/#sec-temporal.plaindatetime.from
https://tc39.es/proposal-temporal/#sec-temporal-totemporaldatetime
https://tc39.es/proposal-temporal/#sec-temporal-parsetemporaldatetimestring
https://tc39.es/proposal-temporal/#sec-temporal-interprettemporaldatetimefields

Bug: v8:11544
Change-Id: I3cf5c7c0f876dd8f384d62a47d7b24d8780bf03f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3538667
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80240}
2022-04-27 23:39:04 +00:00
Adam Klein
10807c9f5e Revert "[rwx][mac] Support fast W^X permission switching on Apple Silicon (M1)"
This reverts commit 9d31f8663a.

Reason for revert: crashes on Mac/arm64 bots:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac%20-%20arm64%20-%20debug/5923/overview

Original change's description:
> [rwx][mac] Support fast W^X permission switching on Apple Silicon (M1)
>
> ... for V8 code space. The feature is currently disabled.
>
> In order to use fast W^X permission switching we must allocate
> executable pages with readable writable executable permissions (RWX).
> However, MacOS on ARM64 ("Apple M1"/Apple Silicon) prohibits further
> permission changing of RWX memory pages. This means that the code page
> headers must be allocated with RWX permissions too because otherwise
> it wouldn't be possible to allocate a large code page over the freed
> regular code page and vice versa.
>
> When enabled, the new machinery works as follows:
>
> 1) when memory region is reserved for allocating executable pages, the
>    whole region is committed with RWX permissions and then decommitted,
> 2) since reconfiguration of RWX page permissions is not allowed on
>    MacOS on ARM64 ("Apple M1"/Apple Silicon), there must be no attempts
>    to change them,
> 3) the request to set RWX permissions in the executable page region
>    just recommits the pages without changing permissions (see (1), they
>    were already allocated as RWX and then discarded),
> 4) in order to make executable pages inaccessible one must use
>    OS::DiscardSystemPages() instead of OS::DecommitPages() or
>    setting permissions to kNoAccess because the latter two are not
>    allowed by the MacOS (see (2)).
> 5) since code space page headers are allocated as RWX pages it's also
>    necessary to switch between W^X modes when updating the data in the
>    page headers (i.e. when marking, updating stats, wiring pages in
>    lists, etc.). The new CodePageHeaderModificationScope class is used
>    in the respective places. On unrelated configurations it's a no-op.
>
> The fast permission switching can't be used for V8 configuration with
> enabled pointer compression and disabled external code space because
> a) the pointer compression cage has to be reserved with MAP_JIT flag
>    which is too expensive,
> b) in case of shared pointer compression cage if the code range will
>    be deleted while the cage is still alive then attempt to configure
>    permissions of pages that were previously set to RWX will fail.
>
> This also CL extends the unmapper unit tests with permissions tracking
> for discarded pages.
>
> Bug: v8:12797
> Change-Id: Idb28cbc481306477589eee9962d2e75167d87c61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3579303
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#80238}

Bug: v8:12797
Change-Id: Ic07948e036db36326d464a2a901d052aa060a406
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3611665
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Auto-Submit: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80239}
2022-04-27 23:29:11 +00:00
Igor Sheludko
9d31f8663a [rwx][mac] Support fast W^X permission switching on Apple Silicon (M1)
... for V8 code space. The feature is currently disabled.

In order to use fast W^X permission switching we must allocate
executable pages with readable writable executable permissions (RWX).
However, MacOS on ARM64 ("Apple M1"/Apple Silicon) prohibits further
permission changing of RWX memory pages. This means that the code page
headers must be allocated with RWX permissions too because otherwise
it wouldn't be possible to allocate a large code page over the freed
regular code page and vice versa.

When enabled, the new machinery works as follows:

1) when memory region is reserved for allocating executable pages, the
   whole region is committed with RWX permissions and then decommitted,
2) since reconfiguration of RWX page permissions is not allowed on
   MacOS on ARM64 ("Apple M1"/Apple Silicon), there must be no attempts
   to change them,
3) the request to set RWX permissions in the executable page region
   just recommits the pages without changing permissions (see (1), they
   were already allocated as RWX and then discarded),
4) in order to make executable pages inaccessible one must use
   OS::DiscardSystemPages() instead of OS::DecommitPages() or
   setting permissions to kNoAccess because the latter two are not
   allowed by the MacOS (see (2)).
5) since code space page headers are allocated as RWX pages it's also
   necessary to switch between W^X modes when updating the data in the
   page headers (i.e. when marking, updating stats, wiring pages in
   lists, etc.). The new CodePageHeaderModificationScope class is used
   in the respective places. On unrelated configurations it's a no-op.

The fast permission switching can't be used for V8 configuration with
enabled pointer compression and disabled external code space because
a) the pointer compression cage has to be reserved with MAP_JIT flag
   which is too expensive,
b) in case of shared pointer compression cage if the code range will
   be deleted while the cage is still alive then attempt to configure
   permissions of pages that were previously set to RWX will fail.

This also CL extends the unmapper unit tests with permissions tracking
for discarded pages.

Bug: v8:12797
Change-Id: Idb28cbc481306477589eee9962d2e75167d87c61
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3579303
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80238}
2022-04-27 22:05:21 +00:00
Camillo Bruni
1332c740b1 [runtime] DHECK that builtins correctly return the exception object
Runtime and Builtin function should always return the exception object
as a marker if there is a pending_exception on the current isolate.

Change-Id: I7c255aa501800384c288664a9ca6578afbe0a103
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610449
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80237}
2022-04-27 21:43:21 +00:00
Camillo Bruni
e5c1ada31f [counters] Remove unused counters from V8
Change-Id: Iec93e286c8067453cc1f9a978fa09b8734999f83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3596159
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80236}
2022-04-27 20:40:51 +00:00
Clemens Backes
bbdb891668 [wasm] Fix termination on breakpoint
If the debug handler (called via {OnDebugBreak}) requests termination of
the isolate, this would only get considered on the next stack check,
where it is turned into a proper termination exception.

Handling this correctly is further complicated by the {DebugScope}
blocking any handling of interrupts via the included
{PostponeInterruptsScope}.

Hence this CL refactors the code to call any debug handlers in a second
function which has the {DebugScope}, and to check for interrupts after
leaving that scope.

R=thibaudm@chromium.org
CC=bmeurer@chromium.org

Bug: chromium:1319343
Change-Id: Ia2df0f2610d50eedc6437841c4bf1d2ad3ac9125
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605228
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80235}
2022-04-27 19:58:41 +00:00
Milad Fa
bf582f16e6 [wasm] skip spec-test on ppc
Tests runs out of code space on ppc as size exceeds 32MB.
More details can be found under the comment section of this CL:
https://crrev.com/c/3605814.

Bug: v8:11577
Change-Id: Iadfbc3b9618a0873f5f08a030b799d5761946671
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610628
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80234}
2022-04-27 18:29:51 +00:00
Frank Tang
19e733fd26 [Temporal] Correct typo and extra space
Bug: v8:7834
Change-Id: Iedd97d665df91ccbdceaaeb68d936b210c31b662
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3611662
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80233}
2022-04-27 18:00:41 +00:00
Frank Tang
2ae06b31b5 [test262] Roll test262
33a5433d..8f5c7aed09

Bug: v8:7834
Change-Id: I0b1419127becef463044a5c1b62fb45a2a9569ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3606546
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80232}
2022-04-27 17:18:51 +00:00
Nikolaos Papaspyrou
1ce4c29120 heap: Inline GCTracer::Scope::Name
This is a follow-up to https://crrev.com/c/3581774.
It inlines method GCTracer::Scope::Name so that the calculation of the
name of the trace event can be performed at compile time and optimized
away, at most call sites.

This is a reland of 370cae1d8f
which was reviewed here: https://crrev.com/c/3602511

Bug: chromium:1318062
Change-Id: I617fcad07448ebbd63790600a071e51964baf85c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3605811
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80231}
2022-04-27 17:15:01 +00:00
Camillo Bruni
bccb536c98 [runtime] DHCECK terminating exception in Microtasks
Check that we don't accidentally end up entering a microtask if we have
a pending terminating exception.

Bug: chromium:1319267
Change-Id: Id1ec7e3deb39aa18f08c363e17bb8df599379d66
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610624
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80230}
2022-04-27 16:18:01 +00:00
Jakob Linke
b1fbd0dc19 Revert "[test] Move cctest/test-regexp to unittests"
This reverts commit b36c87e358.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/42210/overview

Original change's description:
> [test] Move cctest/test-regexp to unittests
>
> ... /regexp/regexp-unittest.
>
> Bug: v8:12781
> Change-Id: I3c3ba4c519ff503b242c39d0e3b2350f25d7e84c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607370
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#80217}

Bug: v8:12781
Change-Id: I0c5fae4b156df0a305b83acfa639bb0ff6eeb87f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610626
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80229}
2022-04-27 15:44:11 +00:00
Omer Katz
dc5bcb2ea6 [heap] Drop unnecessary ToSpaceContains methods
ToSpaceContainsSlow is only from Heap:InSpaceSlow that is never used for
new space.
FromSpaceContains is never called.
ToSpaceContains is called from unittests and from Heap::Contains, and
replacing it wioth  NewSpace::Contains should keep things fast as that
one relies on a page flag.

Bug: v8:12612
Change-Id: I58d63a85fd66aa27f9c4a7794e21838a59aab3d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610447
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80228}
2022-04-27 15:27:21 +00:00
Milad Fa
29e737bdef [test] skip peephole tests on big endian
tests where moved from cctest to unittests under this cl:
https://crrev.com/c/3607370

Bug: v8:12781
Change-Id: If625e0dda51034e731c5e7fe87d591dce9804888
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3611182
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Milad Farazmand <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#80227}
2022-04-27 15:09:21 +00:00
George Wort
d67a14b2fc [turbolizer] Display live ranges in portrait mode
Allow live ranges to be displayed beside the
instruction sequence in turbolizer.

Bug: v8:7327
Change-Id: Idec5130655ccc9365dd32ec6927d8615a3e5c570
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3585960
Commit-Queue: George Wort <george.wort@arm.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80226}
2022-04-27 15:08:19 +00:00
Leszek Swirski
750b5f37fb [maglev] Add a generic StoreNamed node
Bug: v8:7700
Change-Id: I44b5fd2172522034bfe9566ab314dc93e05b2e80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610425
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80225}
2022-04-27 15:07:14 +00:00
Sergey Ulanov
10a8e20fd9 [Fuchsia] Add Fuchsia-specific implementation of TimeTicks::Now()
Previously the POSIX version of TimeTicks::Now() was used on Fuchsia.
It's more efficient to call zx_clock_get_monotonic() directly.

Bug: chromium:1317914
Change-Id: I56da954a2567bcb866100c157878176bcb7cf319
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3595601
Auto-Submit: Sergey Ulanov <sergeyu@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80224}
2022-04-27 15:06:10 +00:00
Camillo Bruni
b4165a3590 [d8] Add ValueSerializer JS api for better fuzzing
Change-Id: Ib94979f4cf7f52a1544f2b3c0d51c0266a4fa14c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3586985
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80223}
2022-04-27 15:05:07 +00:00
Camillo Bruni
5647e65451 [log] Rename v8::Log to v8::LogFile
Bug: v8:12795, chromium:1316443
Change-Id: I0ecaf8ebbf1a83d0d5b305fd014bc5a765c0d2f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610446
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80222}
2022-04-27 15:04:03 +00:00
Leszek Swirski
7ada6c8bbc [maglev] Add LoadDoubleField
Add an unboxing double field load node, and fix a couple of locations
where it might be used enough to pass tests.

Bug: v8:7700
Change-Id: Ic134484e87a4fa363cbd8a3de667ac8e8116d502
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610623
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#80221}
2022-04-27 13:12:17 +00:00
Nico Hartmann
c84b8fa42f Revert "[test] Move cctest/test-log to unittests/logging/log-unittest"
This reverts commit f196c878da.

Reason for revert: https://crbug.com/v8/12838

Original change's description:
> [test] Move cctest/test-log to unittests/logging/log-unittest
>
> Bug: v8:12781
> Change-Id: If94de50440b15f000ff2f961f2dd77abd9c90ca4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3607389
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: 王澳 <wangao.james@bytedance.com>
> Cr-Commit-Position: refs/heads/main@{#80209}

Bug: v8:12781
Change-Id: I9e2d9496f16581ebbb851fb207191d6b77b51c0d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3610448
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#80220}
2022-04-27 12:57:21 +00:00