Commit Graph

62206 Commits

Author SHA1 Message Date
Manos Koukoutos
a3b5825244 [wasm][gc][refactor] Decode gc types with immediates consistently.
Motivation:
There were three versions of type decoding for wasm in the codebase.
Not all of them decoded gc types with immediates (reference types)
correctly.

Changes:
- Refactor the wasm binary decoder for unify type decoding.
- Update BranchTypeImmediate and SelectTypeImmediate to handle
  reference types.

Reference: https://github.com/WebAssembly/gc

R=jkummerow@chromium.org
Bug: v8:7748

Change-Id: I33b38c911d366570ca6ef2723ded5205698e1979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179003
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67614}
2020-05-06 14:31:29 +00:00
Dan Elphick
2cb1e2efed Reland "[heap] Remove FreeList when sealing RO_SPACE"
This is a reland of afd9493a34

LSAN_IGNORE_OBJECTs for FreeListCategories are now removed.

Original change's description:
> [heap] Remove FreeList when sealing RO_SPACE
>
> This releases the FreeListCategories for each MemoryChunk when sealing
> the ReadOnlySpace and deletes the FreeList.
>
> Additionally this also calls
> ReleaseAllocatedMemoryNeededForWritableChunk for each MemoryChunk when
> sealing when pointer compression is enabled even if no memory is to be
> shared.
>
> Bug: v8:10454
> Change-Id: I45aec59f6d4fddedeb713e13095f58974cda279e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184292
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67598}

Bug: v8:10454
Change-Id: I08fcd122437c65c01af526fa8316d5c9e3ebeb3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184297
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67613}
2020-05-06 14:21:27 +00:00
Igor Sheludko
d914a9af0c [builtins] Fix handling of read-only length in Array.prototype.pop
Bug: v8:10484
Change-Id: I977c5974d33472f5af20d7646ad4cf2c58049632
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182452
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67612}
2020-05-06 14:14:47 +00:00
Jakob Gruber
e4be6d4156 [nci][x64] Add interface descriptors for ic-collecting builtins
These will be used by ic-collecting builtins called from both bytecode
handlers and js-generic-lowering.

For now only x64 is implemented.

Bug: v8:8888
Change-Id: I12a21b40061b7cb6c9b3cbad6134e7457a6cfa44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184237
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67611}
2020-05-06 14:09:07 +00:00
Nico Hartmann
adc2b6432c [turbofan] Fixes undefined in BigInt operations
When the input to a speculative BigInt operation was an undefined
constant, no necessary type check was inserted by the
RepresentationChanger. This CL fixes this.

Bug: chromium:1077804
Change-Id: I3d4e15b1e018803d56e46c7b23b9d4b03832ba8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182455
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67610}
2020-05-06 14:07:07 +00:00
Leszek Swirski
58b12f638d [offthread] Unify compiler.cc finalization logic
This patch unfies the finalization logic between the various unoptimized
compilation paths in compiler.cc, taking the various post-processings and
fixups needed for off-thread finalization and performing them in the same
order for the other finalizations.

It also unifies the general compilation path between streaming script
compilation, main-thread script compilation, and main-thread lazy
compilation, making the main-thread paths both use an iterative execution
and finalization, and making all three use the same job helper methods
and overall finalization helper.

Bug: chromium:1011762
Change-Id: Ibe56f6d2f75a2deffbe9e0b600ded8a02293b722
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172790
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67609}
2020-05-06 13:41:09 +00:00
Leszek Swirski
65d738d432 [parser] Move Compiler::Analyze into Parser
Move rewriting, scope analysis, and internalization, to be unconditional
operations done after parsing rather than a separate compile phase. This
removes some of the complexity about rememberering when to call
Compiler::Analyze, and makes these paths a bit more uniform.

Also, forbid allocating any more AST strings after AstValueFactory
internalization, by nulling out the Zone. Add an InternalizePartial
method which doesn't null out the zone for those cases where we do want
to be able to allocate after internalizing (e.g. internalization before
scope analysis).

Change-Id: Id444246d8362a1d169baf664fc37657d9576fd96
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182458
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67608}
2020-05-06 13:35:37 +00:00
Clemens Backes
2c45f607a2 [wasm] Remove interpreter entry frames
Interpreter entry compilation was removed in
https://crrev.com/c/2172962. This CL removes the
{WasmInterpreterEntryFrame} and the corresponding
{WASM_INTERPRETER_ENTRY} code kind.

Some follow-up cleanups are left as TODOs.

R=jkummerow@chromium.org,bmeurer@chromium.org

Bug: v8:10389
Change-Id: I1a43eba1ac1a751e05990c688088d99fc901231f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182456
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67607}
2020-05-06 13:27:27 +00:00
Leszek Swirski
8c8e6b4117 [offthread] Serialize new-space objects into old space
If an object made it into serialization, it probably deserves to be in
old space when it is deserialized. This will also make off-thread
deserialization simpler, as there is no off-thread new space.

Bug: chromium:1075999
Change-Id: Icabf2f0ae0a3e0205a1094dd0ffe675e69bd1d8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184291
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67606}
2020-05-06 13:16:41 +00:00
Clemens Backes
8e7c6ec606 [wasm][cleanup] Use vector comparison instead of strncmp
{base::Vector} comparison is easier to read (IMO), and more performant,
since {memcmp} will be used internally instead of {strncmp}.

R=ahaas@chromium.org

Bug: v8:10155
Change-Id: If92361688a85e96aa661d3e05cc9966e5ea2d04a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2164796
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67605}
2020-05-06 13:11:57 +00:00
Jakob Gruber
276eaea2c7 Sort interface descriptor list
Just alpha-sort the list.

Tbr: ishell@chromium.org
Bug: v8:8888
Change-Id: I8b31f4176d5ad623557a3c0d8ab3f6be80072566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184236
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67604}
2020-05-06 13:02:23 +00:00
Nico Hartmann
7e41bd38ac Revert "[heap] Remove FreeList when sealing RO_SPACE"
This reverts commit afd9493a34.

Reason for revert: Speculative revert due to https://ci.chromium.org/p/v8/builders/ci/V8%20Clusterfuzz%20Linux%20ASAN%20arm%20-%20debug%20builder/14978?

Original change's description:
> [heap] Remove FreeList when sealing RO_SPACE
> 
> This releases the FreeListCategories for each MemoryChunk when sealing
> the ReadOnlySpace and deletes the FreeList.
> 
> Additionally this also calls
> ReleaseAllocatedMemoryNeededForWritableChunk for each MemoryChunk when
> sealing when pointer compression is enabled even if no memory is to be
> shared.
> 
> Bug: v8:10454
> Change-Id: I45aec59f6d4fddedeb713e13095f58974cda279e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184292
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67598}

TBR=ulan@chromium.org,delphick@chromium.org

Change-Id: I135c1ebc2340a75a30305b84625710ef14d9cdb3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10454
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183921
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67603}
2020-05-06 12:56:55 +00:00
Leszek Swirski
bc2bc6bf72 [offthread] Make Heap::AlignWithFiller static
Enable the use of Heap::AlignWithFiller off-thread by making the method
static.

Bug: chromium:1075999
Change-Id: I8071ae678f954dd4e960b2cd83f63dd22a948920
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184230
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67602}
2020-05-06 12:38:31 +00:00
Nico Hartmann
c64b52a892 [sandbox] Wire ExternalString resource through bottleneck
Bug: v8:10391
Change-Id: Ic92cdaca38c2181427cc12ec5e572d5964afe704
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152647
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67601}
2020-05-06 12:35:46 +00:00
Leszek Swirski
b3b824ba91 [offthread] Allow ReadOnlyRoots from OffThreadHeap
Allow ReadOnlyRoots initialization from an OffThreadHeap, by creating
a FromHeap getter on OffThreadIsolate analogous to the one on Isolate.

Bug: chromium:1075999
Change-Id: Ie00e1547160e24d35bd7b0dd36d1b7eead87341e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184289
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67600}
2020-05-06 12:34:41 +00:00
Leszek Swirski
4f7b00c7dd [offthread] Allow cleared references allocation off-thread
Allow cleared references to be created with an OffThreadIsolate.
This includes allowing isolate_root to be accessed from the
OffThreadIsolate, for pointer decompression.

Bug: chromium:1075999
Change-Id: I62e0fe2c1c6166a7b816593ae1ec5ddb1c25d861
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183911
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67599}
2020-05-06 12:19:06 +00:00
Dan Elphick
afd9493a34 [heap] Remove FreeList when sealing RO_SPACE
This releases the FreeListCategories for each MemoryChunk when sealing
the ReadOnlySpace and deletes the FreeList.

Additionally this also calls
ReleaseAllocatedMemoryNeededForWritableChunk for each MemoryChunk when
sealing when pointer compression is enabled even if no memory is to be
shared.

Bug: v8:10454
Change-Id: I45aec59f6d4fddedeb713e13095f58974cda279e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184292
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67598}
2020-05-06 12:18:01 +00:00
Clemens Backes
b020933717 [wasm] Add some more DCHECKs for native module caching
When updating the native module cache, the native module must have been
created in the same engine before. Hence replace a conditional by a
DCHECK, and add two more DCHECKs to ensure that all involved modules
belong to the same engine.

R=thibaudm@chromium.org

Bug: v8:6847
Change-Id: Ieb66b6b0bda40cd3c4637d38918762bc01c3a2d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182640
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67597}
2020-05-06 11:33:51 +00:00
Jakob Gruber
6817e07428 [snapshot] Properly deserialize JSGlobalProxy.map references
Upon deserialization, serialized references to the global proxy are
replaced by the actual global proxy object. We must do the same for
the global proxy map.

Drive-by: Updated other outdated test skips.

Bug: v8:10504,v8:10416
Change-Id: Ib47ae2d08bbea2ca916f53152e9d4f75bb0a0e15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183913
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67596}
2020-05-06 11:05:01 +00:00
Ross McIlroy
66e1c84d77 [TurboProp] Fully remove successors from schedule on unreachable.
Fully remove the successor blocks when effect-control-linearization
reaches an unreachable node and is maintaining the schedule. Previously
we just updated the current_block_'s successor and removed any
unreachable predecessors from end, however if the current_block_ is not
an original block in the schedule, but a new one added due to control
flow from effect control linearization lowering, the removed successor
blocks could still be re-connected to the end block when they were
lowered. Instead, entirely remove these unreachable blocks from the
predecessor / successor chains, and have the effect-control-linearizer
avoid lowering these blocks entirely.

BUG=chromium:1076569,v8:9684

Change-Id: I4b4216019d55aef5363d88255726b85df8e7ada5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179842
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67595}
2020-05-06 10:55:30 +00:00
Leszek Swirski
366c530854 [offthread] Remove Isolate param from SanityCheck
The Isolate* parameter in the deserializer SanityCheck is unused, and is
blocking the use of the deserializer off-thread.

Bug: chromium:1075999
Change-Id: I0f2acae3c1aff62aafeb2680a2eecb44b1608803
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2184290
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67594}
2020-05-06 10:49:29 +00:00
Tobias Tebbi
467c2062f2 [torque] fix MSVC compile
Change-Id: I4f610400eab6e24fb7eb06465ca9abc63d20fdb2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182474
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67593}
2020-05-06 10:21:09 +00:00
Andreas Haas
90fa771dc3 [wasm][liftoff][arm] Implement CompareExchange
This CL implements all variants of CompareExchange on arm.

Implementing 64-bit CompareExchange on arm requires a lot of registers,
with the additional constraint that the low-word register of new_value
and result have to have an even register code, and that the corresponding
high-word registers have a register code that is by one higher than the
register code of the low-word register.

This register allocation is achieved by assigning fixed registers to
all values.

R=clemensb@chromium.org, v8-arm-ports@googlegroups.com

Bug: v8:10108
Change-Id: I2edfde15e80db0d45621a461793018d88e997431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2172791
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67592}
2020-05-06 10:11:49 +00:00
Tobias Tebbi
a3e97c41ff [torque] improve formatting of try-label
Bug: v8:10421, v8:7793
Change-Id: If11fc7666f04ed0914f5fdfcdaa87acb8655d956
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2169100
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67591}
2020-05-06 09:51:39 +00:00
Marja Hölttä
1ed76a3c2e Move helper SFIs from NativeContext to Isolate, part 1
There's no need for them to be in NativeContext.

This CL moves the minimal subset of SFIs related to async functions
and async generators.

Bug: v8:10482
Change-Id: Ic90e342ae77b406c12dedf6b8f7e3fadb661b205
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179843
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67590}
2020-05-06 09:49:49 +00:00
Clemens Backes
61927f30e1 [wasm] Add histogram for number of live modules
So far we operated under the assumption that only a small number of
modules is being created (and live) at a time, typically just one.
Recently we saw webpages that create multiple modules at the same time.
These counters should give us more insight into the typical number of
modules in the wild.

R=ecmziegler@chromium.org
CC=jwd@chromium.org

Bug: chromium:1076767
Change-Id: I81f657ee76ea155f0df2a5828e6b0f686a7ce7d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182376
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67589}
2020-05-06 08:56:11 +00:00
Zhao Jiazhong
046e693c1d [mips] Add bit left-rotation machine operator
Port c0eee179b3
https://crrev.com/c/2157648

Original Commit Message:

  ROL will be optional operator as arm, arm64 only have ROR.

  The reason for this CL is inefficient Wasm codegen for 64-bit
  left-rotation.

Change-Id: I014575d300a97c6fb7dc54d89328fd997d314d92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182219
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#67588}
2020-05-06 08:02:35 +00:00
Jakob Gruber
c61b13b14a [infra] Add stress_snapshot variant to fyi bots
These are currently expected to fail quite often since support is
still incomplete. Let's add them to fyi bots for now and extend
coverage later.

Bug: v8:10416,chromium:1043058
Change-Id: I1fe60c85f3fcf1e7e2981c28908208b348150b7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181286
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67587}
2020-05-06 07:34:09 +00:00
Clemens Backes
a0059e7135 [platform] Bump maximum number of worker threads
The number of worker threads in the default platform is currently capped
at 8. At runtime, it's also capped by the number of actual cores
available.
Since d8 is often used for benchmarking (both internally and
externally), this CL slightly increases the maximum to 16. At least wasm
compilation is known to scale beyond 8 threads. If this increase does
not cause any problems on bots, we might increase further in the future.

R=mlippautz@chromium.org

Change-Id: I04e138c51d7dc26c38b9384c8ea67a883c976050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182454
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67586}
2020-05-06 07:26:39 +00:00
Jakob Gruber
3c422d1c5e [snapshot] Clear reconstructable data prior to d8 stress_snapshot run
The serializer currently cannot handle a heap state containing
arbitrary compiled Code objects. As a quick fix for the
--stress-snapshot d8 flag, we clear compiled data from the isolate
prior to the serialize-deserialize-verify pass.

With this change, mjsunit tests pass on x64.

The %SerializeDeserializeNow() runtime function would require more
work, since it is not possible to mutate the heap to this extent while
still preserving a runnable host context and isolate. We will need
another solution there.

Drive-by: Skip the stress_snapshot variant except for the mjsunit
suite.

Tbr: machenbach@chromium.org
Bug: v8:10493,v8:10416
Change-Id: Ie110da8b51613fcd69c7f391d3cf8589d6b04dd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182429
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67585}
2020-05-06 07:11:22 +00:00
Jakob Gruber
e7e10aa70c [snapshot] Sanitize isolate during serialization
The isolate snapshot must not contain context-dependent objects, thus
root visitation must not reach context-dependent objects. This CL
sanitizes the isolate around serialization by clearing & later
restoring two lists: 1. feedback vectors for profiling tools, 2.
detached contexts.

Drive-by: Set an array buffer allocator for
SerializeDeserializeAndVerify.
Drive-by: Allow serialization of *another* native context when
serializing a native context.

Bug: v8:10416,v8:10493
Change-Id: I1c49bda364eccd6d44f9499a9926f4bcd31f665d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2179008
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67584}
2020-05-06 06:22:39 +00:00
v8-ci-autoroll-builder
81439fba67 Update V8 DEPS.
Rolling v8/build: 8aef078..3c7540e

Rolling v8/third_party/aemu-linux-x64: i0Kh0s13OUsO28Cn7E_Vm5Rv0jN7IXSm_qrvu2cBDmMC..J3cO22hWB2vC_byojuODbkHgkNGvxvrCAEPaKGOx3GwC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/cd56abf..c5ffb21

Rolling v8/third_party/depot_tools: 0f47d33..4de5413

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ibe41d58bb62a7c53bf223f40892dfedac1da38bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2183356
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#67583}
2020-05-06 03:54:10 +00:00
Ng Zhi An
833b113ce9 [wasm-simd][fuzzer] Add more f64x2 ops to fuzzer
Bug: v8:10180
Change-Id: I8026a25d9b1a62a7c5d7b20b99f6474374333445
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2171551
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67582}
2020-05-05 23:00:30 +00:00
Anton Bikineev
d5e0e5cb21 cppgc: Introduce Sweeper
This ports sweeper logic from Blink into a separate entity - Sweeper.
Concurrent sweeping is in a followup.

Bug: chromium:1056170
Change-Id: I41196225f0d882cb0ab5190d23e297ee2498df6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2167858
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67581}
2020-05-05 22:38:59 +00:00
Seth Brenith
23719f6dbe [torque] Don't crash when failing to find a non-constexpr type
Marja pointed out that the following code causes a Torque crash:

Convert<Smi>(MessageTemplate::kFoo)

This change is a small fix to not crash in that case.

Bug: v8:7793, v8:10475
Change-Id: I7856366856a4cd7facdb19686a2d4c92b0d04516
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182175
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#67580}
2020-05-05 22:32:48 +00:00
Dan Elphick
6a178193b3 [heap] fix recursive include in memory-chunk.h
Removes spurious self-include in src/heap/memory-chunk.h

Bug: v8:10473
Change-Id: I0bdf3b6b62f3b3a241225a99d681ddc1f1bd6bc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181329
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67579}
2020-05-05 21:47:27 +00:00
Ng Zhi An
201049ad17 [wasm-simd] Fix f32x4.sqrt codegen
It was assuming that the input is always a register, but it isn't.

Bug: chromium:1078399
Change-Id: If14abb8ea34f9febfc04a67a8da260a7e66af7f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182176
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67578}
2020-05-05 21:22:07 +00:00
Deepti Gandluri
dd1b1de11f Revert "[compiler,api] Pass non-strings to the modifying callback when unconditional codegen is on."
This reverts commit 0c9a0072db.

Reason for revert: Breaks tests on the blink bots, will block roll.
https://ci.chromium.org/p/v8/builders/ci/V8%20Blink%20Linux/4465

Original change's description:
> [compiler,api] Pass non-strings to the modifying callback when unconditional codegen is on.
> 
> In the current state, when unconditional compilation is on, strings are evaluated and other objects are passed through unchanged. After this, non-strings are passed to the modifying callback which could unwrap and eval them. eval(string) is not affected.
> 
> If a non-modifying callback is set, it still takes the precedence, and the non-string object is returned as it would be currently (line 1933).
> 
> Change-Id: I835b976b3420635baba245c08f8563a9e5b3b246
> Bug: chromium:1024786
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917147
> Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#67570}

TBR=vogelheim@chromium.org,mvstanton@chromium.org,ssanfilippo@chromium.org,verwaest@chromium.org

Change-Id: I75637347e92e805361f954be3515f84ca55d756b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1024786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182178
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67577}
2020-05-05 20:17:24 +00:00
Georg Neis
de2c0a3b2b [turbofan] Turn some DCHECKs into CHECKs in Schedule methods
Bug: chromium:1076708
Change-Id: I7f065791310606e11fe89936a36f0fe7cb0d38e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182639
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67576}
2020-05-05 19:34:03 +00:00
Bill Budge
ae2a8ac430 [wasm] Torqueify WasmTableGet, WasmTableSet, and WasmRefFunc
- Port WasmTableGet, WasmTableSet, and WasmRefFunc to Torque.
- Breaks WasmBuiltinsAssembler into .cc and .h files.

Change-Id: I0f62715ce10beedabf7b4f9502c9476de9efdd5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2175090
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67575}
2020-05-05 19:19:00 +00:00
Ng Zhi An
4ca768db8f [wasm-simd] Indicate possible non-determinism in the interpreter
Bug: chromium:1077198
Change-Id: I74f7afbd2c0d7753ef620e5d5ddee60ee8a16718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2176892
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67574}
2020-05-05 19:12:29 +00:00
Clemens Backes
e337fc687a [platform] Remove DefaultPlatform::SetThreadPoolSize
This function is always called right after creating the DefaultPlatform,
hence merge it into the constructor.

R=mlippautz@chromium.org

Change-Id: I4afb14c83740224056157665db6b854c659da0c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182635
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67573}
2020-05-05 17:57:49 +00:00
Liviu Rau
5f7bc600a6 [testing] Collect all relevant data about slow tests
Slow tests are now collected in a heap with a fixed size.
When the maximum size is reached we evict the fastest test
after adding a new test to the heap.

Bug: v8:10168
Change-Id: If3298df85d6e924451f55fe9350e293169cc849d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2106205
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67572}
2020-05-05 17:35:09 +00:00
Philip Pfaffe
37cdcdf421 Support .external_debug_info symbol references
Wasm modules generated by emscripten today have two ways to point to
debug symbol files, the source mapping url and external debug info
custom sections. To support both, this CL extends CDP to appropriately
report the symbol type and location.

Bug: chromium:1064248
Change-Id: I9076034f6d73901d8a9c5cfd7c2988fb30bb14c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2116208
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67571}
2020-05-05 16:45:49 +00:00
Stefano Sanfilippo
0c9a0072db [compiler,api] Pass non-strings to the modifying callback when unconditional codegen is on.
In the current state, when unconditional compilation is on, strings are evaluated and other objects are passed through unchanged. After this, non-strings are passed to the modifying callback which could unwrap and eval them. eval(string) is not affected.

If a non-modifying callback is set, it still takes the precedence, and the non-string object is returned as it would be currently (line 1933).

Change-Id: I835b976b3420635baba245c08f8563a9e5b3b246
Bug: chromium:1024786
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1917147
Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67570}
2020-05-05 16:27:29 +00:00
Marja Hölttä
6a7b21c5d8 [Promise.any] Stage Promise.any
Bug: v8:9808
Change-Id: I24df18562c5b1277a8151d35eb07b836e70f1149
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182457
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67569}
2020-05-05 16:07:59 +00:00
Philip Pfaffe
abad484607 [wasm-debug-eval] expose wasm debug eval on the inspector protocol
Allow the DevTools frontend to evaluate variables in a wasm frame context by
reusing the existing Debugger expression evaluation API. Where previously the
API expected JavaScript expressions, which would in general just fail, now the
expression is expected to be base64 encoded Wasm that creates a JSON string in
linear memory.

Bug: chromium:1020120 chromium:1068571
Change-Id: I4b31fdb9d3b21b4e08c4995ec2f07880923959e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2087396
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67568}
2020-05-05 15:50:39 +00:00
Michael Lippautz
4570ce146c heap: Introduce EmbedderHeapTracer::kForced
The flag is used by V8 to propagate information on whether this GC was
somehow forced.

This allows the embedder using EmbedderHeapTracer to easily figure out
whether a GC was forced based on a local flag without depending on GC
prologue/epilogue callbacks.

Bug: chromium:1074061
Change-Id: Ic04c93ae58da854e54c6da1ca4aac03b5ab49897
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2182473
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67567}
2020-05-05 15:38:09 +00:00
Samuel Groß
961c21b1ca [sandbox] Access external pointers in embedder slots via bottlenecks
Bug: v8:10391
Change-Id: I55d4d33820c83711d3ea3c6a2f3a20a36707fe36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151354
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67566}
2020-05-05 15:27:49 +00:00
Hannes Payer
db8f64b85a [heap] Cleanup RawSweep for better readability.
Change-Id: Ia316db16fb338e3f26b0666de88d5e53f375f8be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2181263
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67565}
2020-05-05 14:43:34 +00:00