Commit Graph

55340 Commits

Author SHA1 Message Date
Michael Hablich
d03c6b1712 Revert "[wasm] Add off-by-default runtime flag for growing shared memory"
This reverts commit 656f57bd78.

Reason for revert: This blocks lkgr advancement/rolling, see https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/31263. Please fix upstream tests first.

Original change's description:
> [wasm] Add off-by-default runtime flag for growing shared memory
> 
> Grow memory isn't ready to ship in M75.
> 
> Bug: v8:8564, chromium:951795
> Change-Id: I75602bce833653b7943f5606236a97ca6dbad5c9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566239
> Reviewed-by: Ben Smith <binji@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60836}

TBR=binji@chromium.org,adamk@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8564, chromium:951795
Change-Id: If212f1b21699394b66e9e306d12a3baf37ccf4b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565901
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60848}
2019-04-15 14:22:14 +00:00
Dan Elphick
f12e8d64ab [compiler] Don't collect source positions when throwing exceptions
While crrev.com/c/1520721 tried to avoid collecting source positions
when throw exceptions, it failed because they were still collected in
Isolate::CaptureStackTrace.

This removes that collection point and lets SetStackFrameCacheCommon
bail out when trying to set the stack frame cache for a bytecode that
doesn't have source positions.

It also adds tests that ensure source positions are not collected when
an exception is thrown (although one is disabled as it does not yet
work).

Bug: v8:8510
Change-Id: Id5caf579dda549d637fa9b3129c419d524be5ff2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565898
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60847}
2019-04-15 14:10:15 +00:00
Frederik Gossen
87792715c9 [wasm-hints] Add Tests for Lazy Modules
Added test cases for entirely lazily compiled modules. They are treated
just like empty modules are.

Bug: v8:9003
Change-Id: Ic0fcae7de32e50a0aac271567c18159bf8154028
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562130
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60846}
2019-04-15 13:35:14 +00:00
Clemens Hammacher
71ed7f4b32 [wasm][gc] Decrement ref count when replacing code
This CL introduces the first (and most important) place where we need
to decrement the ref count of wasm code. When installing new code in
the code table and jump table, the prior code becomes unreachable via
new function calls.
This change executes many code paths that were unreachable before,
since the ref count was never decremented.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: Ibe33df562f240f7cd5996f6061809e93838be425
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566512
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60845}
2019-04-15 12:42:34 +00:00
Michael Starzinger
97bad6be44 Make {StackFrame::unchecked_code} fail gracefully.
This makes sure that all overrides of {StackFrame::unchecked_code}
return a value, even if there is no {Code} object associated with the
frame. This ensures debug functions like {StackTraceFailureMessage}
continue working for all stack traces.

R=neis@chromium.org
BUG=chromium:952761

Change-Id: Ie42b301e4d43ebf67acc80e6c1b7bcb4cdc7c947
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566515
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60844}
2019-04-15 12:40:54 +00:00
Clemens Hammacher
c7b43ae5f3 [wasm][gc] Add code ref on NativeModule::GetCode
Since {NativeModule::GetCode} returns a raw pointer to {WasmCode}, it
needs to increment the reference counter on that code object.
{HasCode} on the other hand does not return a code pointer, so it's
implemented separately now.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: I812981aaf89281fb0296682114f248079e57a5e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566514
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60843}
2019-04-15 12:34:14 +00:00
Peter Marshall
a32c97cca1 [cleanup] Clean up space names in the heap
- Remove AllocationSpaceName() which was in SHOUTY_CASE and did not
  actually handle CODE_LO_SPACE.
- Make GetSpaceName() static because it is.
- Change callers of old AllocationSpaceName() to use GetSpaceName().
- Change the input type to a AllocationSpace rather than int given the
  function crashes on invalid values.

Space::name() now returns a lower case result but this is only used by
functions guarded by gc_verbose or trace_fragmentation so I don't think
this will break anything.

Change-Id: Ice9a955365d4a22233af7ba39126ad8e5cff2aab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565474
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60842}
2019-04-15 12:17:14 +00:00
Sergiy Belozorov
fd8ce36550 [tools] Enable vpointer-sanitation on UBSan bots
Even though we override chromiums UBSan settings in our own BUILD.gn to
include all sanitizers, vptr is still excluded. The reason is that
the vptr sanitizer requires RTTI to be enabled.

The "is_ubsan_vptr" flag will enable RTTI as well as some linker flags
to export libc++abi symbols. Both are required by the vptr sanitizer.

Change-Id: I803ed71781bb3edc824bbe5d1aaa830841b4b304
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566511
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60841}
2019-04-15 11:54:24 +00:00
Sergiy Belozorov
b7af29cfdf Update V8 DEPS.
Rolling v8/build: bee1272..a7f62a0

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2309843..b614c56

Rolling v8/third_party/icu: 4ae7482..35f7e13

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Bug: v8:9131
Change-Id: Ie342eb673ea4c987bc8f2010e37e15a6626ae9d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1567282
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#60840}
2019-04-15 11:23:24 +00:00
Frederik Gossen
25d6ba73a2 [wasm-hint] Add Test Cases for Streaming Compilation
Tests streaming compilation with Wasm compilation hints enabled. In
particular, validation errors in lazily compiled functions are covered.

Bug: v8:9003
Change-Id: I81611988b8451ce2f6562962dbd50561f5086aef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561310
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60839}
2019-04-15 10:35:14 +00:00
v8-ci-autoroll-builder
8aabeffde5 Update V8 DEPS.
Rolling v8/build: f10a653..bee1272

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/095babf..2309843

Rolling v8/third_party/depot_tools: 1de3cd4..db58954

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ice4dafc17dcddb8f9a6026ce4f4bca8f3ec1cd67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566248
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#60838}
2019-04-13 03:27:05 +00:00
Yu Yin
c5033ebc93 [mips64][heap] Clean-up keys of oldspace weakmaps during scavenge
port https://crrev.com/c/1541476

Original Commit Message:

     This CL adds handling for cleaning up weakmap (EphemeronHashTable)
     keys during scavenge, even if the weakmap resides in oldspace.

Change-Id: If0598a499641ba502b00857204e32ca63e0712c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564320
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#60837}
2019-04-13 01:15:12 +00:00
Adam Klein
656f57bd78 [wasm] Add off-by-default runtime flag for growing shared memory
Grow memory isn't ready to ship in M75.

Bug: v8:8564, chromium:951795
Change-Id: I75602bce833653b7943f5606236a97ca6dbad5c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566239
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60836}
2019-04-13 00:05:03 +00:00
Sathya Gunasekaran
f1a30b740b [ESNext] Stage Promise.allSettled
Bug: v8:9060
Change-Id: Ibea24457354a6b7d32449ae41c680ff37481341e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565541
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60835}
2019-04-12 23:25:32 +00:00
Z Duong Nguyen-Huu
56873d9616 Handle COW map for sealed, frozen object
Basically, SetPropertyInternal is called without handling COW map.

Improve test coverage as well.

Bug: chromium:951438
Change-Id: Iea8c818ab6a8ddea204f86a9d676a1ea42fd07f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562731
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60834}
2019-04-12 19:43:39 +00:00
Ross McIlroy
e65e50142c [Test] Re-enable math-floor-global.js on gc-stress
Should no longer be flaky since bug is fixed.

BUG=v8:8964
TBR=machenbach@chromium.org

Change-Id: I3fc124aca8bcfc16ddf7560d48d84dc01d4ce332
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564069
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60833}
2019-04-12 19:08:09 +00:00
Sathya Gunasekaran
40004881f6 Revert "Fix array.concat with double for sealed, frozen object"
This reverts commit 68ba8574f6.

Reason for revert: breaks windows builds https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20builder/27839

Original change's description:
> Fix array.concat with double for sealed, frozen object
> 
> Treat packed sealed, frozen element as packed element.
> Also rename to IsPackedFrozenOrSealedElementsKind.
> 
> Bug: chromium:951988
> Change-Id: Ia636f0a14a229e4c44772627728927db1b877f27
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565470
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#60831}

TBR=jarin@chromium.org,ishell@chromium.org,verwaest@chromium.org,duongn@microsoft.com

Change-Id: I84caf106dbdd2209aef0a994173e1c3982e9f7b1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:951988
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565542
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60832}
2019-04-12 18:00:09 +00:00
Z Duong Nguyen-Huu
68ba8574f6 Fix array.concat with double for sealed, frozen object
Treat packed sealed, frozen element as packed element.
Also rename to IsPackedFrozenOrSealedElementsKind.

Bug: chromium:951988
Change-Id: Ia636f0a14a229e4c44772627728927db1b877f27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565470
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60831}
2019-04-12 17:50:23 +00:00
Sathya Gunasekaran
1f6d27e8df [ESNext] Implement Promise.allSettled
Bug: v8:9060
Change-Id: Ia58f7f9e19726f26dd09665d32efc1037f71e7e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1560409
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60830}
2019-04-12 17:49:17 +00:00
Z Duong Nguyen-Huu
b151cd2f7f Fix array.includes undefined for sealed/frozen object
For slow-path of array.includes, it should be able to handle if arguments is undefined for sealed/frozen object

Bug: chromium:951780
Change-Id: I42dcf1e23ab07bfcd87e7a5d27b52e66b2d1d2ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565031
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60829}
2019-04-12 17:36:32 +00:00
Georg Neis
d7fb4a64c1 [turbofan] Basic brokerization for ReduceNamedAccess
Bug: v8:7790
Change-Id: I65e050929a45c3391c5c9c9b0d814ae536664cf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564067
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60828}
2019-04-12 17:35:28 +00:00
Santiago Aboy Solanes
20a93efef5 [Turbofan][ptr-compr] Change native context specialisation for Compressed (Any)
This CL can be used as a base for specialising CompressedSigned and
CompressedPointer.

B

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng,v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I43c8e7f57021ac506822aba5bbd4bdf6cc3159ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543731
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60827}
2019-04-12 17:34:24 +00:00
Georg Neis
549031b44f [interpreter] Add a comment regarding CreateArrayFromIterable
R=rmcilroy@chromium.org

Change-Id: I41739db4d6cb06e798ff6a323a526329b4ac0af4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562132
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60826}
2019-04-12 17:33:18 +00:00
Clemens Hammacher
6832f29250 Revert "[heap] Skip ro-space from heap iterators, add CombinedHeapIterator."
This reverts commit 3d1d8eae77.

Reason for revert: Speculative revert; seems to break all nosnap bots, e.g. https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap/25240

Original change's description:
> [heap] Skip ro-space from heap iterators, add CombinedHeapIterator.
> 
> Read-only space sharing requires an iterator independent of heap. This
> also enables future removal of read-only space from heap.
> 
> Bug: v8:7464
> Change-Id: Ia07a9369494ea2c547d12c01ffa1d7b8b6bbeabc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552795
> Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60819}

TBR=ulan@chromium.org,hpayer@chromium.org,delphick@chromium.org,goszczycki@google.com

Change-Id: I64b58b1b0c5eb073a6d2cfae81bb4de65f0511bf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565895
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60825}
2019-04-12 16:38:00 +00:00
Sergiy Belozorov
168c186c4b [tools] Add a log line when retrying runnables
TBR=machenbach@chromium.org, tmrts@chromium.org

No-Try: true
No-Tree-Checks: true
Bug: chromium:872257
Change-Id: I12a61a7e09ab240a9ee0f3e4a06f1190583075c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565894
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60824}
2019-04-12 15:46:57 +00:00
Maciej Goszczycki
6b82682561 [cleanup] Remove out of date comment
Bug: v8:8834
Change-Id: I76d952685f5172844fb0f3189078c0a0bc764b41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559746
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#60823}
2019-04-12 14:44:18 +00:00
Benedikt Meurer
f11ba854e5 [map] Support in-place field representation changes.
This adds a new flag --modify-field-representation-inplace (enabled by
default), which lets the runtime perform field representation changes
for Smi to Tagged or for HeapObject to Tagged in-place instead of
creating new maps and marking the previous map tree as deprecated.

That means we create (a lot) fewer Maps and DescriptorArrays in the
beginning and also need to self-heal fewer objects later (migrating
off the deprecated maps). In TurboFan we just take the "field owner
dependency" whenever we use the field representation, which is very
similar to what we already do for the field types. That means if we
change the representation of a field that we used in optimized code,
we will simply deoptimize that code and have TurboFan potentially
later optimize it again with the new field representation.

On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
time from around 415ms to around 352ms, which corresponds to a **15%**
improvement. The overall Speedometer2 score improves from around 74.1
to around 78.3 (on local runs with content_shell), corresponding to a
**5.6%** improvement here. 🎉

On the CNN desktop browsing story, it seems that we reduce map space
utilization/fragmentation by about 4-5%. But since we allocate a lot
less (fewer Maps and DescriptorArrays) we also significantly change
the GC timing, which heavily influences the results here. So take this
with a grain of salt. 🤷

Note: For Double fields, this doesn't change anything, meaning they
still create new maps and deprecate the previous map trees.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: Ibd70efcb59be982863905663dbfaa89aa5b31e14
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Doc: http://bit.ly/v8-in-place-field-representation-changes
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565891
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60822}
2019-04-12 14:37:07 +00:00
Clemens Hammacher
4515df1aed [wasm] Avoid busy-waiting on foreground thread
When all units started compiling, but not all are finished yet, the
main thread waits in a busy loop.
This CL fixes that by introducing a semaphore which is signalled when
baseline compilation finishes or compilation fails. The foreground
thread waits on this semaphore if there are no more units to start.

R=mstarzinger@chromium.org

Bug: v8:8916
Change-Id: I7351c0b777f008fef3aa1d1d16089c4e6fd91106
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564055
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60821}
2019-04-12 14:06:47 +00:00
Mythri Alle
63856ed612 Revert "[ic] Remove the check for fast prototypes in LoadIC_Uninitialized"
This reverts commit d14ed12e56.

Reason for revert: breaks mjsunit tests in lite mode: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/3557

Original change's description:
> [ic] Remove the check for fast prototypes in LoadIC_Uninitialized
> 
> When handling load named properties (without feedback vectors) we used
> to miss to runtimes if the prototypes aren't set. This was because we
> wanted to give the prototype a chance to become fast, since most prototypes
> start in slow mode but move to fast after the initial setup. Though this
> check is not really useful when we don't have feedback vectors, and once
> feedback vectors are allocated we will turn the prototypes fast anyway.
> 
> Bug: v8:8394, v8:8860
> Change-Id: Ib2247e5e921f6375bda65310560ac832fd0339bf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561316
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60818}

TBR=mythria@chromium.org,verwaest@chromium.org

Change-Id: I28e420951483c93363e8a78621a247a7723d735f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8394, v8:8860
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565893
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60820}
2019-04-12 13:45:39 +00:00
Maciej Goszczycki
3d1d8eae77 [heap] Skip ro-space from heap iterators, add CombinedHeapIterator.
Read-only space sharing requires an iterator independent of heap. This
also enables future removal of read-only space from heap.

Bug: v8:7464
Change-Id: Ia07a9369494ea2c547d12c01ffa1d7b8b6bbeabc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552795
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60819}
2019-04-12 13:26:34 +00:00
Mythri A
d14ed12e56 [ic] Remove the check for fast prototypes in LoadIC_Uninitialized
When handling load named properties (without feedback vectors) we used
to miss to runtimes if the prototypes aren't set. This was because we
wanted to give the prototype a chance to become fast, since most prototypes
start in slow mode but move to fast after the initial setup. Though this
check is not really useful when we don't have feedback vectors, and once
feedback vectors are allocated we will turn the prototypes fast anyway.

Bug: v8:8394, v8:8860
Change-Id: Ib2247e5e921f6375bda65310560ac832fd0339bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561316
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60818}
2019-04-12 13:24:44 +00:00
Georg Neis
45df2e8a10 [turbofan] Teach the serializer about many more bytecodes
... all of the kind that modifies the accumulator but no other
registers. Also move a few of that kind out of the IGNORED_BYTECODES
list, where they didn't belong.

R=mslekova@chromium.org

Bug: v8:7790
Change-Id: I67189750e5e01fc8a3b6b5117b61a0d21837693a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561320
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60817}
2019-04-12 12:56:14 +00:00
Michael Achenbach
1ea09f0b4f [test] Ignore optimization state in tests on number fuzzer
This enable test suites to check which test driver framework is used.
When using number fuzzer on mjsunit, we add a JS file that
switches off the optimization-state assertions.

Checking intrinsic state is not feasible on the number fuzzer and in
the past, we needed to skip tests on demand, which is a maintenance
burden. The main function of the fuzzer, to check for dcheck errors and
tsan issues, is retained.

Bug: v8:9127
Change-Id: I699b85d5f7c9aaed337a2130d9eddc160c059d7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565892
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60816}
2019-04-12 12:50:55 +00:00
Georg Neis
9f37b2f74b [turbofan] Lift incorrect restriction in serializer
Bug: v8:7790
Change-Id: Iab5df5e0f387612dfdb1f68b34941e65fe8e256c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561314
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60815}
2019-04-12 12:43:54 +00:00
Sergiy Belozorov
3478f053d4 [tools] Implement retry mechanism for failures and use it for some flaky tests
This is not fixing the root cause of the flakiness, but prevents us from loosing
data in the short to medium term as investigation proved to be difficult and
will likely take even more time.

R=machenbach@chromium.org, tmrts@chromium.org

Bug: chromium:872257
Change-Id: Id5fbd0a00058f8612089ee4d6a858193924bd868
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564204
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60814}
2019-04-12 12:25:44 +00:00
Benedikt Meurer
3a7ce5decc [debug] Forcibly instantiate lazy accessor pairs when setting break points.
Previously we had some kind of self-healing when calling lazy accessor
pairs via InvokeApiFunction(), but we also have other paths for calling
into FunctionTemplateInfos directly, which didn't do this check. Since
we already walk the heap when installing the DebugBreakTrampoline, and
compile all uncompiled functions, we can also just forcibly instantiate
all the lazy accessor pairs at that time and not have to worry about the
break-at-entry later.

Bug: v8:178, v8:7596, v8:8834
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Change-Id: I514392cf328fc8ed0b80ad19009f32e20ff850b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565890
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60813}
2019-04-12 12:12:35 +00:00
Nico Weber
0c08a7565e Remove explicit -Wextra-semi, -Winconsistent-missing-override flags.
They're  enabled via the chromium_code config already these days.
No intended behavior change.

Bug: chromium:926235,chromium:428099
Change-Id: I4f7024ab78cb9672ec3db686e0155b2d835a4790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564694
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Auto-Submit: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60812}
2019-04-12 11:56:04 +00:00
Igor Sheludko
c359728085 [ptr-compr] Fix handling of compressed spill slots
To keep things simple, we just ensure that the spill slots always
contain full uncompressed pointers before GC sees them.

Bug: v8:8977, v8:7703
Change-Id: I54eab1b3e79e8525200139e487ff64d82ae157e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564198
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60811}
2019-04-12 11:43:55 +00:00
Sergiy Belozorov
f7afe0087e [tools] Refactor run_perf.py and run_perf_test.py
- Remove all relative imports from mock and os
- Fix mocking in a few tests to prevent cross-test side-effects
- Add run_perf_test.py to v8_presubmit.py
- The vpython config was not added since root .vpython already includes
  coverage and mock libraries
- Convert all double-quoted strings to single-quoted (PS8->PS9)

R=sergiyb@chromium.org

Bug: chromium:123456
Change-Id: I7b3a08dc5d950b0f51cc7a5eb3a012ea953ca824
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564206
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60810}
2019-04-12 11:34:54 +00:00
Simon Zünd
0c1d1a4094 Reland "Reserve two in-object properties slots for JSErrors"
This is a reland of 21adacab88

The failure that caused this revert is unrelated to this change
and is fixed in a separate CL (https://crbug.com/v8/9123).

Original change's description:
> Reserve two in-object properties slots for JSErrors
>
> The most common use-case for creating errors is "new Error('message')".
> The resulting JSError object has two properties. The message passed to
> the constructor and an accessor for the stack.
>
> This CL reserves two in-object property slots for these two, so no
> PropertyArray has to be created.
>
> Bug: v8:9116
> Change-Id: I84467453446f333bf65425807707ee6581894e61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564195
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60791}

Bug: v8:9116
Change-Id: I5b0e0183ca0cbc55739aae9097c08aee34b4fa54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564059
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60809}
2019-04-12 11:10:24 +00:00
Jaroslav Sevcik
d1e849ef00 Expose the bytecode limit for optimization as a flag
Bug: v8:9119, v8:8598
Change-Id: Ia4765c19e60b58d938fe778776ee654b60631e39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564203
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60808}
2019-04-12 10:58:14 +00:00
Michael Hablich
48efe388d8 Revert "[map] Support in-place field representation changes."
This reverts commit 1416d5a565.

Reason for revert: blocks roll https://chromium-review.googlesource.com/c/chromium/src/+/1564550

Original change's description:
> [map] Support in-place field representation changes.
> 
> This adds a new flag --modify-field-representation-inplace (enabled by
> default), which lets the runtime perform field representation changes
> for Smi to Tagged or for HeapObject to Tagged in-place instead of
> creating new maps and marking the previous map tree as deprecated.
> 
> That means we create (a lot) fewer Maps and DescriptorArrays in the
> beginning and also need to self-heal fewer objects later (migrating
> off the deprecated maps). In TurboFan we just take the "field owner
> dependency" whenever we use the field representation, which is very
> similar to what we already do for the field types. That means if we
> change the representation of a field that we used in optimized code,
> we will simply deoptimize that code and have TurboFan potentially
> later optimize it again with the new field representation.
> 
> On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
> time from around 415ms to around 352ms, which corresponds to a **15%**
> improvement. The overall Speedometer2 score improves from around 74.1
> to around 78.3 (on local runs with content_shell), corresponding to a
> **5.6%** improvement here. 🎉
> 
> On the CNN desktop browsing story, it seems that we reduce map space
> utilization/fragmentation by about 4-5%. But since we allocate a lot
> less (fewer Maps and DescriptorArrays) we also significantly change
> the GC timing, which heavily influences the results here. So take this
> with a grain of salt. 🤷‍♂️
> 
> Note: For Double fields, this doesn't change anything, meaning they
> still create new maps and deprecate the previous map trees.
> 
> Bug: v8:8749, v8:8865, v8:9114
> Change-Id: I694a53f87ae5caeb868fd98a21809b66d4297d35
> Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
> Doc: http://bit.ly/v8-in-place-field-representation-changes
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561132
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60764}

TBR=jarin@chromium.org,neis@chromium.org,ishell@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: I666975d08d51bbe7ab4faec9428b9a1f88e9b322
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564208
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60807}
2019-04-12 10:37:04 +00:00
Frank Tang
e4b5fcebdf Make Date.to(Date|UTC|)String use 4 digits for negative year
Bug: v8:9081
Change-Id: I505e8ee4bf58f2da09962ae9a7056931435c10f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562587
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60806}
2019-04-12 10:00:39 +00:00
Simon Zünd
d78014455b Revert "Reland^2 "[torque] Throw exception instead of aborting if something goes wrong""
This reverts commit ffe6940fbc.

Reason for revert: Breaks UBSan bot

Original change's description:
> Reland^2 "[torque] Throw exception instead of aborting if something goes wrong"
> 
> This is a reland of 251d1623f3
> 
> The reland fixes ASAN component builds by adding RTTI build config to both
> torque executables. Big thanks to sigurds for finding the fix.
> 
> Original change's description:
> > Reland "[torque] Throw exception instead of aborting if something goes wrong"
> >
> > This is a reland of 3bd49f9b90
> >
> > The issue on the windows bot is apparently a compiler bug in MSVC related to
> > move construction. The fix seems to be to change the order of the fields in
> > "JsonParseResult" (go figure).
> >
> > Drive-by-change: Fix LS on windows by emitting correct line endings and
> > enabling exceptions for the LS executable as well.
> >
> > Original change's description:
> > > [torque] Throw exception instead of aborting if something goes wrong
> > >
> > > This CL enables exceptions for the Torque compiler and Torque language
> > > server. Instead of aborting when something goes wrong during
> > > compilation, a TorqueError is thrown, containing the error message
> > > and a source position. The compiler executable still prints the error
> > > and aborts, while the language server will pass this information
> > > along to the client (not included in this CL).
> > >
> > > R=danno@chromium.org
> > >
> > > Bug: v8:8880
> > > Change-Id: Iad83c46fb6a91c1babbc0ae7dbd94fbe4e7f1663
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1526003
> > > Reviewed-by: Daniel Clifford <danno@chromium.org>
> > > Commit-Queue: Simon Zünd <szuend@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#60512}
> >
> > Bug: v8:8880
> > Change-Id: I00e6591bbb4c516dd7540a7e27196853bc637f11
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545995
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Simon Zünd <szuend@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#60736}
> 
> Bug: v8:8880
> Change-Id: Iba198d771169283e83e74324f27aa9e90b8d8975
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1563770
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60804}

TBR=sigurds@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: I30ccec8ac28158c102a4e9a01074432172685f96
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8880
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564207
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60805}
2019-04-12 09:59:36 +00:00
Simon Zünd
ffe6940fbc Reland^2 "[torque] Throw exception instead of aborting if something goes wrong"
This is a reland of 251d1623f3

The reland fixes ASAN component builds by adding RTTI build config to both
torque executables. Big thanks to sigurds for finding the fix.

Original change's description:
> Reland "[torque] Throw exception instead of aborting if something goes wrong"
>
> This is a reland of 3bd49f9b90
>
> The issue on the windows bot is apparently a compiler bug in MSVC related to
> move construction. The fix seems to be to change the order of the fields in
> "JsonParseResult" (go figure).
>
> Drive-by-change: Fix LS on windows by emitting correct line endings and
> enabling exceptions for the LS executable as well.
>
> Original change's description:
> > [torque] Throw exception instead of aborting if something goes wrong
> >
> > This CL enables exceptions for the Torque compiler and Torque language
> > server. Instead of aborting when something goes wrong during
> > compilation, a TorqueError is thrown, containing the error message
> > and a source position. The compiler executable still prints the error
> > and aborts, while the language server will pass this information
> > along to the client (not included in this CL).
> >
> > R=danno@chromium.org
> >
> > Bug: v8:8880
> > Change-Id: Iad83c46fb6a91c1babbc0ae7dbd94fbe4e7f1663
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1526003
> > Reviewed-by: Daniel Clifford <danno@chromium.org>
> > Commit-Queue: Simon Zünd <szuend@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#60512}
>
> Bug: v8:8880
> Change-Id: I00e6591bbb4c516dd7540a7e27196853bc637f11
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545995
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60736}

Bug: v8:8880
Change-Id: Iba198d771169283e83e74324f27aa9e90b8d8975
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1563770
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60804}
2019-04-12 09:27:07 +00:00
Simon Zünd
5292b45bdb Properly call 'PrepareFunctionForOptimization' in mjsunit test
Adding a 'PrepareFunctionForOptimization' call will prevent the test
case in question to become flaky when stress testing bytecode flushing.

R=jarin@chromium.org

Bug: v8:9123
Change-Id: If192ebf571d3cd4f0d1ee31bc3f6313b74d3c866
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564202
Auto-Submit: Simon Zünd <szuend@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60803}
2019-04-12 09:18:57 +00:00
Sergiy Belozorov
27a6a4456a [tools] Remove cctest from non-ref official archives
R=machenbach@chromium.org, tmrts@chromium.org

Bug: v8:8969
Change-Id: I2e565b114383d085ea5c8dbcff45e3794d4f1f6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564201
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60802}
2019-04-12 09:17:52 +00:00
Simon Zünd
93d6356c47 [stack-trace] Remove JSArray wrapper for simple stack traces
This CL changes the Symbol "stack_trace_symbol" to directly hold a
FrameArray instead of wrapping it with a JSArray first.

Bug: v8:9115
Change-Id: I2ac0b1fb380211568abdc6d9f50431c405349dec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564060
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60801}
2019-04-12 08:54:43 +00:00
Clemens Hammacher
a35d999b1e [wasm] Avoid compiling top-tier units on foreground
For synchronous compilation, the foreground thread takes part in
compilation. It should only compile Liftoff functions though, otherwise
it might unnecessarily delay initial compilation by executing expensive
TurboFan units.

Drive-by: Minor refactoring to avoid else after return.

R=mstarzinger@chromium.org

Bug: v8:8916
Change-Id: Ibf994a9a48417943652f13096419afd73cb59f85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564192
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60800}
2019-04-12 07:52:52 +00:00
Yu Yin
653a5ad5c1 Mov "compress changes" functions in V8_COMPRESS_POINTERS
This fix build error(mksnapshot) on mips64el after
https://crrev.com/c/1526009. We should implements
"compress changes" functions on mips64, but now mips64 build
failed while enable pointer compression, we need port some
more pacth to mips64, for example: https://crrev.com/c/1477215

Change-Id: I745cc9b0cf60825f526720db7f5eaedd923b4634
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1549133
Commit-Queue: Yu Yin <xwafish@gmail.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60799}
2019-04-12 04:44:52 +00:00