Commit Graph

10953 Commits

Author SHA1 Message Date
Camillo Bruni
f60ccbf57c [tools] Use profiler code-source-info in processor.mjs
Attach SourcePositionInfo objects to existing code entries if we find
code-source-info log entries. This improves fixes finding scripts for
anonymous functions.

Bug: v8:10644
Change-Id: I6fc1e029b17107cacce89dc74a67d4d448d9a979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562672
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71482}
2020-11-30 11:34:49 +00:00
Camillo Bruni
79896eeb4b [tools] Add code-creation timeline track to system-analyzer
Drive-by-fix:
- better handle tooltip text

Bug: v8:10644
Change-Id: Ibe20a1e0a0ebd298855afcbdc6f28e6fa4d1e64e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563660
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71479}
2020-11-30 11:19:08 +00:00
Zhi An Ng
2ad3328c88 [cleanup] Remove unnecessary flags in test
The flags were added because scalar lowering was not implemented for the
instructions in the test. Now that scalar lowering is complete, we can
remove these flags.

Fixed: v8:11137
Change-Id: Ic7bdedbfe558fafebe98917fe4e6a7922203ba91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2565078
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71474}
2020-11-30 08:17:38 +00:00
Camillo Bruni
8547ac388e [tools][system-analyzer] Improve timeline.mjs
Make Timeline.selectTimeRange run in O(log(n)) instead of
O(n) comparisons.

Drive-by-fix:
- Use *Index for variable names in Timeline

Bug: v8:10644
Change-Id: I65f3be9f259e6bebcec489526a54712daffd4d15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2507714
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71461}
2020-11-27 19:24:06 +00:00
Manos Koukoutos
304fd7cc96 [wasm] Interface should only be called for 'br' if ok()
See also: https://chromium-review.googlesource.com/c/v8/v8/+/2557515

Bug: chromium:1152937
Change-Id: I8043f88f3a64a3e45e00c8e6848cb6e4ec6f8a42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2562239
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71444}
2020-11-27 06:59:26 +00:00
Jakob Kummerow
e82a3b4d47 [bigint] Fix possibly-uninitialized leading digit on right shift
Fixed: chromium:1151890
Change-Id: I26f5c76494a9ff3f5a141f381e1c9a543e368571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2561618
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71422}
2020-11-26 09:24:15 +00:00
Andreas Haas
73a35c3555 [wasm][generic-wrapper] Fix number of parameters popped off the stack
In the generic wrapper we popped the wrong number of parameters off the
stack. We always popped the number of parameters needed by the generic
wrapper, according to the signature. The correct number though is
max(parameters provide, parameters needed).

R=victorgomes@chromium.org, thibaudm@chromium.org
CC=vkont@google.com

Bug: v8:10982
Change-Id: If9b8d4dbe093eb6df08ddf9f3594d5c60b9be33f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2558317
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71406}
2020-11-25 15:27:14 +00:00
Gus Caplan
20b417503a Add 'at' to Array.prototype[@@unscopables]
Bug: v8:10961
Change-Id: I3746dca570de005d203a2648dcffedd81122f215
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2553157
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Gus Caplan <snek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71377}
2020-11-24 15:41:11 +00:00
Georg Neis
ba1b2cc09a [compiler] Fix a bug in SimplifiedLowering
SL's VisitSpeculativeIntegerAdditiveOp was setting Signed32 as
restriction type even when relying on a Word32 truncation in order to
skip the overflow check. This is not sound.

Bug: chromium:1150649
Change-Id: I3113a2102c62d6ecef342c98d25daf31431c01ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2557498
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71364}
2020-11-24 11:09:40 +00:00
Bill Budge
86991d0587 Reland "stack-trace-api: implement getEnclosingLine/Column"
This reverts commit 5557a63beb.

Reason for revert: Sheriff's mistake, failing test was previously flaking.

Original change's description:
> Revert "stack-trace-api: implement getEnclosingLine/Column"
>
> This reverts commit c48ae2d96c.
>
> Reason for revert: Breaks a profiling test:
> https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/30010
>
> Original change's description:
> > stack-trace-api: implement getEnclosingLine/Column
> >
> > Introduces getEnclosingColumn and getEnclosingLine on CallSite
> > so that the position can be used to lookup the original symbol
> > for function when source maps are used.
> >
> > BUG=v8:11157
> >
> > Change-Id: I06c4c374d172d206579abb170c7b7a2bd3bb159f
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547218
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Commit-Queue: Benjamin Coe <bencoe@google.com>
> > Cr-Commit-Position: refs/heads/master@{#71343}
>
> TBR=jkummerow@chromium.org,yangguo@chromium.org,bencoe@google.com
>
> Change-Id: Iab5c250c1c4fbdab86971f4a7e40abc8f87cf79c
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:11157
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2555384
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71345}

TBR=bbudge@chromium.org,jkummerow@chromium.org,yangguo@chromium.org,bencoe@google.com

# Not skipping CQ checks because this is a reland.

Bug: v8:11157
Change-Id: I8dba19ceb29a24594469d2cf79626f741dc4cad3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2555499
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71348}
2020-11-23 20:05:02 +00:00
Bill Budge
5557a63beb Revert "stack-trace-api: implement getEnclosingLine/Column"
This reverts commit c48ae2d96c.

Reason for revert: Breaks a profiling test:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/30010

Original change's description:
> stack-trace-api: implement getEnclosingLine/Column
>
> Introduces getEnclosingColumn and getEnclosingLine on CallSite
> so that the position can be used to lookup the original symbol
> for function when source maps are used.
>
> BUG=v8:11157
>
> Change-Id: I06c4c374d172d206579abb170c7b7a2bd3bb159f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547218
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Benjamin Coe <bencoe@google.com>
> Cr-Commit-Position: refs/heads/master@{#71343}

TBR=jkummerow@chromium.org,yangguo@chromium.org,bencoe@google.com

Change-Id: Iab5c250c1c4fbdab86971f4a7e40abc8f87cf79c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11157
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2555384
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71345}
2020-11-23 19:19:04 +00:00
bcoe
c48ae2d96c stack-trace-api: implement getEnclosingLine/Column
Introduces getEnclosingColumn and getEnclosingLine on CallSite
so that the position can be used to lookup the original symbol
for function when source maps are used.

BUG=v8:11157

Change-Id: I06c4c374d172d206579abb170c7b7a2bd3bb159f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2547218
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Benjamin Coe <bencoe@google.com>
Cr-Commit-Position: refs/heads/master@{#71343}
2020-11-23 15:44:41 +00:00
Victor Gomes
1df2f22fb6 [nci] Fix arguments order in call of ConstructWithSpread_WithFeedback
ConstructWithSpread_WithFeedback uses the same argument order as JS linkage, therefore arguments should be inserted in reversed order.
See https://source.chromium.org/chromium/chromium/src/+/master:v8/src/codegen/interface-descriptors.h;drc=c7cb9beca18d98ba83c3b75860b912219d425d0e;l=507

Change-Id: I4d3ded048a08ba9a2a4d30da4c41044d9669becc
Bug: chromium:1145990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549952
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71341}
2020-11-23 15:13:01 +00:00
Jakob Kummerow
db5ede7ff8 Fix rare stack overflow in instanceof
For a very particular special case (long "chains" of bound
functions with an undefined @@hasInstance handler), evaluating
the `instanceof` operator could lead to a very deep recursion.
This patch adds a stack check to make sure we throw rather than
crash on stack overflow.

Bug: v8:11115
Change-Id: I6bf941b9e75e9fe3a52112ade27388ac4fbbda2f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545624
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71335}
2020-11-23 10:48:49 +00:00
Michael Achenbach
7f607cfdae Reland "[foozzie] Suppress access to CurrentTimeValue"
This is a reland of e26863df27

The test now works with the no-i18n case.

Original change's description:
> [foozzie] Suppress access to CurrentTimeValue
>
> This stubs out CurrentTimeValue for differential fuzzing as otherwise
> the non-deterministic value leaks from Intl.DateTimeFormat format and
> formatToParts.
>
> This also affects other date creations, like Date.now(), which is
> already stubbed out on the JS side. We keep that code for
> backwards-compatibility to keep bisection stable.
>
> Bug: chromium:1149050
> Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71294}

Cq-Include-Trybots: luci.v8.try.triggered:v8_linux_noi18n_rel_ng_triggered
Bug: chromium:1149050
Change-Id: I4a750b580495532ca0ffb125522f8f5958e4cad6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2552401
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71309}
2020-11-20 11:27:04 +00:00
Vasili Skurydzin
e53c7972e2 Skip no-i18n tests for aix due to lack of tzdata in PASE environment
Change-Id: I233972d124c3582ed8eba7f1c1a31fa9d61fda8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2544902
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Milad Fa <mfarazma@redhat.com>
Commit-Queue: Vasili Skurydzin <vasili.skurydzin@ibm.com>
Cr-Commit-Position: refs/heads/master@{#71299}
2020-11-19 21:20:38 +00:00
Ben Smith
0d58297f03 Revert "[foozzie] Suppress access to CurrentTimeValue"
This reverts commit e26863df27.

Reason for revert: Fails on noi18n bot, see https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/34852/overview

Original change's description:
> [foozzie] Suppress access to CurrentTimeValue
>
> This stubs out CurrentTimeValue for differential fuzzing as otherwise
> the non-deterministic value leaks from Intl.DateTimeFormat format and
> formatToParts.
>
> This also affects other date creations, like Date.now(), which is
> already stubbed out on the JS side. We keep that code for
> backwards-compatibility to keep bisection stable.
>
> Bug: chromium:1149050
> Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71294}

TBR=machenbach@chromium.org,cbruni@chromium.org,clemensb@chromium.org

Change-Id: I958ca723de826ab427d27f5121f96618cf50c832
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1149050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2551314
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71298}
2020-11-19 20:23:09 +00:00
Michael Achenbach
e26863df27 [foozzie] Suppress access to CurrentTimeValue
This stubs out CurrentTimeValue for differential fuzzing as otherwise
the non-deterministic value leaks from Intl.DateTimeFormat format and
formatToParts.

This also affects other date creations, like Date.now(), which is
already stubbed out on the JS side. We keep that code for
backwards-compatibility to keep bisection stable.

Bug: chromium:1149050
Change-Id: Ifd82844c9fb8ce7262b55da6cf9f88f544268942
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546685
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71294}
2020-11-19 19:14:47 +00:00
Marja Hölttä
a07c14f679 [super] Fix: receiver can be null / undefined
When accessing a super property which is a getter, the receiver
is not restricted the same way as when doing normal property access.

In particular, the receiver can be null / undefined.

Bug: v8:9237, chromium:1148758, v8:11161
Change-Id: Ic6bc2053e5d046d4b19e868312aa9b50025256a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2549941
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71281}
2020-11-19 15:29:47 +00:00
Gus Caplan
b91f929dbc implement Array/String/TypedArray item methods
Bug: v8:10961
Change-Id: I79f8410cac1c949100231d4c57dbea0379e88475
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2441128
Commit-Queue: Gus Caplan <snek@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71279}
2020-11-19 14:40:54 +00:00
Frank Emrich
300573aca8 [classes] Fix enumeration order bugs when accessors shadow dynamic prop.
AddToDictionaryTemplate in literal-objects.cc was missing several
cases when handling the overwriting between properties with statically
known and dynamically computed names. This led to wrong enumeration
orders in class prototypes created from class templates.

Bug: v8:11158
Change-Id: I7381b4680ec533bd307a6c32d75c8a66394869df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536464
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71266}
2020-11-18 16:47:21 +00:00
Jakob Gruber
3edf54337a [compiler] Rename --turboprop-dynamic-map-checks
... to --turbo-dynamic-map-checks. With the upcoming use in NCI code,
this feature is no longer used exclusively by Turboprop.

Bug: v8:8888
Change-Id: I61e01db086fd2e8566d2e2a09574be74b6e5a7bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546693
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71263}
2020-11-18 15:52:55 +00:00
Toon Verwaest
4575e97767 [snapshot] Support normalized elements on the global object
Bug: v8:11166
Change-Id: I39d2b7e926d9954c25dec149a741c24d6a0e7353
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2545707
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71262}
2020-11-18 15:12:25 +00:00
Andreas Haas
4e12eddda6 [wasm] Introduce <bot> type for unreachable br_table again
This CL implements the spec change done in
https://github.com/WebAssembly/reference-types/pull/116.

R=manoskouk@chromium.org

Bug: v8:10994
Change-Id: Ic2b4e0a52af225b5640447fe051a9c36e6d41be2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534818
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71260}
2020-11-18 15:02:05 +00:00
Jakob Gruber
da888fed4b [stress_snapshot] Skip failing tests
To be unskipped once root cause is fixed.

Bug: v8:11166
Change-Id: I03c3ac9a7e715fce7683d230965bd92a410c8f91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546681
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71248}
2020-11-18 09:13:59 +00:00
Jakob Gruber
3599cce1f5 [nci] Share smi feedback and enable related optimizations
This CL enables a first batch of feedback-based optimizations in NCI
code. Specifically, optimizations based on unary, binary, compare,
for-in-next, and for-in-prepare feedback are now enabled.

This has two main implications:

1. NCI code can now deopt. Deoptimized code is currently thrown away
permanently and cannot be reused. Now that shared/cached NCI code can
deopt, this leads to an interesting question of what should happen
with deoptimized NCI code. The answer in this CL is to remove the
cache entry (it may later be re-added).

2. Tiering up from NCI to TF still requires feedback; since NCI code,
starting with this CL, no longer collects full feedback, feedback must
be created in some other way. This is solved by sharing a
context-independent encoding of feedback across native contexts.

Feedback is shared through a new SerializedFeedback object type,
essentially a byte array of serialized feedback. Currently, only
smi-based feedback is shared, but map-based feedback will be added in
the future.

SerializedFeedback is kept in the NCI cache alongside NCI Code
objects.  It is created on NCI cache insertion, and deserialized upon
NCI cache hits.

Bug: v8:8888
Change-Id: Ic0d5fbea3aa4d3b0a165624dab9d0283b07dcee7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531775
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71224}
2020-11-17 11:13:56 +00:00
Georg Neis
c85ab364d6 [compiler] Disable some tests on NCI
Split globals.js into two parts, one being skipped on NCI due to
assertions about optimization status.

Change-Id: Ifc572526d9c6aed369802a65d12c4456cde65ce0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2539909
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71199}
2020-11-16 10:31:47 +00:00
Georg Neis
2869fdfb17 [runtime][compiler] Be less strict about PropertyCell changes
Don't deopt when a PropertyCell changes from readonly to writable.
Turbofan doesn't depend on readonly-ness unless the property is
also non-configurable, in which case such a change can't happen.

Change-Id: I3d1078a8adf1ec1b16d973dd71c4295d71003a8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531791
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71184}
2020-11-13 16:29:03 +00:00
Shu-yu Guo
5f18a2e6a7 [flags] Remove --harmony-private-methods
It's shipped since M84.

Bug: v8:8330
Change-Id: Ia643948c0de83fc9a8faf7307b7fd86a1e117dc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2511034
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71166}
2020-11-12 23:21:53 +00:00
Marja Hölttä
cdcf3c3134 [super] Use a feedback-collecting builtin in JSGenericLowering
Bug: v8:9237
Change-Id: I1e308a5a325b01fcdc9236f13080653f3be6d328
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527095
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71155}
2020-11-12 15:06:39 +00:00
Igor Sheludko
15c9ff0758 [runtime] Remove --modify-field-representation-inplace flag
which was enabled a long ago and is not supposed to be disabled.

In addition this CL adds Representation::MightCauseMapDeprecation()
predicate and ensures it's consistent with the existing
MostGenericInPlaceChange() and CanBeInPlaceChangedTo().

Bug: v8:11104, v8:8865
Change-Id: Ia8046b76822c9b20fe3ce85de6b98570334aad21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527088
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71151}
2020-11-12 13:44:15 +00:00
Jakob Gruber
e14e1e4c56 [nci] Fix DCHECK(function->is_compiled()) in CompileOptimized
For NCI compilation tasks, we don't actually install the generated
Code object on the function. In that case, we cannot make assertions
about function state.

Bug: v8:8888,chromium:1146013
Change-Id: Ia2342c52e565ccb1f6b5b09dda5e998b3fd3eb3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532297
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71140}
2020-11-12 07:56:49 +00:00
Shu-yu Guo
f1ae68351f [flags] Remove --harmony-promise-any
It's shipped since M85.

Bug: v8:9808
Change-Id: I0c2dcda601aad33d4acb379b242799f9b09e8930
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2510869
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71137}
2020-11-12 01:09:38 +00:00
Jakob Gruber
273df17d8e [nci] Check Isolate::concurrent_recompilation_enabled
... instead of FLAG_concurrent_recompilation. The
optimizing_compile_dispatcher may be nullptr despite the flag being
set.

Bug: v8:8888,chromium:1145988
Change-Id: Ia3a6b1a95dde2b8cdd43dd2beebf04c66f145f78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531781
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71116}
2020-11-11 13:18:18 +00:00
Mythri Alle
2d3d382153 Revert "[turboprop] Disable dynamic map checks for measuring impact"
This reverts commit b5823ea717.

Reason for revert: This was meant to be temporary to measure impact.

Original change's description:
> [turboprop] Disable dynamic map checks for measuring impact
>
> Bug: v8:10582
> Change-Id: I1ee996ff4490136a2f97ed0ebf56da074663230e
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523311
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Auto-Submit: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71028}

TBR=rmcilroy@chromium.org,mythria@chromium.org,gsathya@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:10582
Change-Id: Ief903f57942e3351ea297fd3ab9e028ea51a3d32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531777
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71106}
2020-11-11 10:35:48 +00:00
Marja Hölttä
04f5085dfe [super] Disable --deopt-every-n-times in super property optimization tests
The tests assert that funcs are optimized / deoptimized a certain way.

Bug: v8:9237, v8:11138
Change-Id: Ia4879e722e442be52de0bf93919eb03fecb88147
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529136
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71087}
2020-11-10 13:50:07 +00:00
Michael Achenbach
6b5d6d105f Revert "Temporary failure for tree-closer test"
This reverts commit a9252d7085.

Reason for revert: experiment done

Original change's description:
> Temporary failure for tree-closer test
>
> CL to test tree-closure. This CL will be reverted afterwards.
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I07cdedc530dd3718a9537bca51fbb40b83a3e8b9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527100
> Commit-Queue: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71075}

TBR=machenbach@chromium.org,mslekova@chromium.org,liviurau@chromium.org

Change-Id: I830daa57a10f284d96e8532b6117d627817f1da8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10661
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529138
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71083}
2020-11-10 12:57:51 +00:00
Marja Hölttä
0be88a57e5 [super] Optimize super property access in JSNativeContextSpecialization
This is the second reland of
https://chromium-review.googlesource.com/c/v8/v8/+/2487122 , this time
without RuntimeCallStats in the tests.

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I782df6e032ff8191082b425e68d68b69cef0a560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527092
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71077}
2020-11-10 11:24:44 +00:00
Michael Achenbach
a9252d7085 Temporary failure for tree-closer test
CL to test tree-closure. This CL will be reverted afterwards.

No-Try: true
Bug: v8:10661
Change-Id: I07cdedc530dd3718a9537bca51fbb40b83a3e8b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527100
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71075}
2020-11-10 10:44:16 +00:00
Frank Tang
a547b61da1 [intl] skip tz test on android
Bug: v8:11131
Change-Id: I7007a11e3cfc5ea4ebab6bedc8b6ba4c7cafa456
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527787
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71063}
2020-11-10 00:25:04 +00:00
Clemens Backes
89ca48c907 [wasm][liftoff] Fix register usage for i64_addi
The arm implementation made the assumption that the {lhs} and {dst}
registers are either the same, or there is no overlap. This assumption
does not hold.
ia32 on the other hand has a lot of complicated logic (and unnecessary
code generation) for different cases of overlap.

This CL fixes the arm issue *and* simplifies the ia32 logic by making
the arm assumption hold, and using it to eliminate special handling on
ia32.

R=thibaudm@chromium.org

Bug: chromium:1146861
Change-Id: I8753c2ed70349e735c03293130c899c0c8a3a671
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2526388
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71060}
2020-11-09 18:30:39 +00:00
Shu-yu Guo
d9a0b7b11e Revert "[super] Optimize super property access in JSNativeContextSpecialization"
This reverts commit 30ca51ec48.

Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34104

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71052}

TBR=marja@chromium.org,neis@chromium.org

Change-Id: I2b10963a9a99f7b482f1014472a6a281fcf9b8c1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527184
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71058}
2020-11-09 17:42:41 +00:00
Marja Hölttä
30ca51ec48 [super] Optimize super property access in JSNativeContextSpecialization
This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71052}
2020-11-09 15:28:09 +00:00
Georg Neis
27900f17b8 [compiler] Fix use of HeapObjectMatcher
In a few places we incorrectly assumed to know the instance type of the
heap object. In particular, in JSCallReducer::ReduceDataViewAccess,
doing map inference on the receiver and determining that all maps are
JSDataView maps does not guarantee that the receiver is a JSDataView
constant because we might deopt before getting to the data view
operation.

Bug: chromium:1146652
Change-Id: I1611308c3ebe0d33fa6b0cf0938d777b4e6449ff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2524440
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71034}
2020-11-09 07:52:24 +00:00
Mythri A
b5823ea717 [turboprop] Disable dynamic map checks for measuring impact
Bug: v8:10582
Change-Id: I1ee996ff4490136a2f97ed0ebf56da074663230e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523311
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71028}
2020-11-09 06:37:21 +00:00
Clemens Backes
d90b2c0cda [wasm][test] Increase stack size for return-calls test
The test started failing on win64 ASan after a DEPS roll. Increase the
stack size to mitigate this.
Also, add a comment so say why we are restricting the stack size in the
first place.

R=thibaudm@chromium.org
CC=ahaas@chromium.org

Bug: v8:11120
Cq-Include-Trybots: luci.v8.try:v8_win64_asan_rel_ng
Change-Id: If0c084653687aef95acee8caa6712a1c872d2bca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523203
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71016}
2020-11-06 15:53:04 +00:00
Clemens Backes
fe0c98a36b Revert "[super] Optimize super property access in JSNativeContextSpecialization"
This reverts commit 0147db5a4a.

Reason for revert: Data races: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34056

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70988}

TBR=marja@chromium.org,mvstanton@chromium.org,neis@chromium.org

Change-Id: Ib5ddb919ae569fe5ddf266d986f1c8bc0fe9621a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520908
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70992}
2020-11-05 16:31:04 +00:00
Marja Hölttä
0147db5a4a [super] Optimize super property access in JSNativeContextSpecialization
Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70988}
2020-11-05 13:58:11 +00:00
Jakob Gruber
2dc1799585 Revert "[nci] Enable --turbo-nci behind --future to gather perf data"
This reverts commit c3b2b64be4.

Reason for revert: Scheduled revert.

The flag flip is in 88.0.4315.0. Group report links:

https://chromeperf.appspot.com/group_report?rev=70949
https://chromeperf.appspot.com/group_report?rev=823663

Original change's description:
> [nci] Enable --turbo-nci behind --future to gather perf data
>
> .. to be reverted in a day or two.
>
> Bug: v8:8888
> Change-Id: Iee156da614b50c351ca9a07cc497177c92de865d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512907
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Lutz Vahl <vahl@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70949}

TBR=machenbach@chromium.org,jgruber@chromium.org,vahl@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8888,v8:11087
Change-Id: I57411474d885dd69613a85f5fa3a801a573fcd08
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2517690
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70982}
2020-11-05 09:26:56 +00:00
Victor Gomes
f383a92396 Reland "[x64][ia32] Add stack overflow check in InvokePrologue"
This is a reland of adceb45979
Redesign test to not be OS dependent.

Original change's description:
> [x64][ia32] Add stack overflow check in InvokePrologue
>
> In case of no arguments adaptor frame, we massage the arguments in InvokePrologue pushing undefined objects if the actual argument count is below the parameter count. This CL adds a stack overflow check before pushing these undefined objects to the stack.
>
> Change-Id: I2a88bf6fdfd17958f6f6884143a67d50ea842fd2
> Bug: v8:10201
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491039
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70927}

Bug: v8:10201
Change-Id: Ifab3413b748cdf3bb998a5080cd1fcb3b67a737b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2517921
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70973}
2020-11-04 19:26:09 +00:00