Commit Graph

14035 Commits

Author SHA1 Message Date
Camillo Bruni
1b8d4e3adb [api] Remove FLAG_log_api
API logging has not been used in a while and we have valid alternatives:
- Runtime call stats
- Profiling
- Timer events

Together they make --log-api superfluous and we can remove it and reduce
the number of branches when calling into the V8 API.

Change-Id: Ie10f70b61ebdb82166270e7630ebcf20a27c4902
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574549
Reviewed-by: Marja Hölttä <marja@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79904}
2022-04-11 06:24:44 +00:00
Anton Bikineev
8b1fb3abda cppgc: young-gen: Enable concurrent sweeping for minor GCs
Similar to full GCs, the GC defers metric reporting until sweeping is
finished.

Bug: chromium:1029379
Change-Id: Ib06adb3be691c1ad2bd530eb77fc01cc22537338
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3576130
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Nikolaos Papaspyrou <nikolaos@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79891}
2022-04-08 14:40:15 +00:00
Leszek Swirski
fef7720fd3 Revert "[osr] Enable concurrent OSR"
This reverts commit 6879c515d0.

Reason for revert: Speculative revert for roll failures
https://ci.chromium.org/ui/p/chromium/builders/try/win_optional_gpu_tests_rel/80674/overview

Original change's description:
> [osr] Enable concurrent OSR
>
> Fixed: v8:12161
> Change-Id: Ie6e83dd4f261fff2d1fa8613116e83ef6b61561f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3576116
> Auto-Submit: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79857}

Change-Id: I05bd9594e8ce3db71acb31cf4c626c066158ceaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3579163
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79890}
2022-04-08 14:33:06 +00:00
Thibaud Michaud
04b8124b34 [wasm] Clean up type size computation
Rename element_size_bytes() to value_kind_size(), and add
the uncompressed version: value_kind_full_size().

R=clemensb@chromium.org

Change-Id: I956142937fd1134ecbdaaa617c402ed8fff2cf17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568477
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79884}
2022-04-08 12:46:45 +00:00
Michael Lippautz
ec09a8236c heap: Convert embedder tracing tests to unittests
test-embedder-tracing.cc -> embedder-tracing-unittest.cc

In addition
- Add heap helpers
- CHECK -> EXPECT macros

Bug: v8:12781
Change-Id: Ibd17a4e6d527c963170af54c57f6abc51cb08808
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3576127
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79883}
2022-04-08 12:43:55 +00:00
Manos Koukoutos
b09d550605 [wasm-gc] Enable runtime subtyping checks for functions
Bug: v8:7748
Change-Id: Ic65c09726994fddf73979b5f25b98f7ce4c5d6ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574556
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79870}
2022-04-08 08:19:16 +00:00
Jakob Gruber
6879c515d0 [osr] Enable concurrent OSR
Fixed: v8:12161
Change-Id: Ie6e83dd4f261fff2d1fa8613116e83ef6b61561f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3576116
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79857}
2022-04-07 13:24:24 +00:00
Clemens Backes
08e514a894 [codegen][x64] Improve code for float to int64
This improves the code generated for float to int64 conversions on x64.
Instead of explicitly checking the input for specific values and
executing conditional jumps, just convert the integer back to a float
and check if this results in the rounded input. The "success value" is
then materialized via vmov + and instead of via branches.

old:
   7  c4e1fb2cd9           vcvttsd2siq rbx,xmm1
   c  ba01000000           movl rdx,0x1
  11  49ba000000000000e0c3 REX.W movq r10,0xc3e0000000000000
  1b  c441f96efa           vmovq xmm15,r10
  20  c5792ef9             vucomisd xmm15,xmm1
  24  7a08                 jpe 0x3599421714ee  <+0x2e>
  26  7408                 jz 0x3599421714f0  <+0x30>
  28  4883fb01             REX.W cmpq rbx,0x1
  2c  7102                 jno 0x3599421714f0  <+0x30>
  2e  33d2                 xorl rdx,rdx

new:
   7  c463010bf90b         vroundsd xmm15,xmm15,xmm1,0xb
   d  c4e1fb2cd9           vcvttsd2siq rbx,xmm1
  12  c4e1832ac3           vcvtqsi2sd xmm0,xmm15,rbx
  17  c4c17bc2c700         vcmpss xmm0,xmm0,xmm15, (eq)
  1d  c4e1f97ec2           vmovq rdx,xmm0
  22  83e201               andl rdx,0x1

A follow-up step would be to replace the explicitly materialized success
value by a direct jump to the code handling the error case, but that
requires more rewrite in TurboFan.

R=tebbi@chromium.org

Bug: v8:10005
Change-Id: Iaedc3f395fb3a8c11c936faa8c6e55c2dfe86cd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560434
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79854}
2022-04-07 12:38:44 +00:00
Georgia Kouveli
16b5fc3c57 [arm64] Remove template argument of PushCPURegList and friends
Callee saved registers do not include the LR anymore, so we can
now remove the last place where we pass a non-default template
argument to PushCPURegList/PopCPURegList (in the code generator).
This makes the template argument redundant, so we can remove the
template altogether.

Change-Id: I07f0c0a10840817df8a5afc1dc74330e290ce5bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571816
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/main@{#79842}
2022-04-07 09:12:45 +00:00
jiepan
9ba6aff285 [x64] Implement 256-bit assembler for cmp ops
Bug: v8:12228
Change-Id: Iab09881d9c8bcd851fd89bf5d6bbd3f2cfb0f3d0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3303808
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jie Pan <jie.pan@intel.com>
Cr-Commit-Position: refs/heads/main@{#79838}
2022-04-07 04:05:23 +00:00
Corentin Pescheloche
ca51ae3ac8 [api][profiler] Get StartProfiling, StopProfiling to accept integer ID rather than string
This CL adds support for interacting with CpuProfile with their integer
id.
A String ID is problematic because it forces an allocation when stopping
or cancelling a Profiler which can happen during a GC when this
is not allowed.

Change-Id: I9a8e754bd67214be0bbc5ca051bcadf52bf71a68
Bug: chromium:1297283
Co-Authored-By: Nicolas Dubus <nicodubus@fb.com>
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3522896
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Corentin Pescheloche <cpescheloche@fb.com>
Commit-Queue: Corentin Pescheloche <cpescheloche@fb.com>
Cr-Commit-Position: refs/heads/main@{#79835}
2022-04-06 19:29:14 +00:00
Jakob Gruber
e36e6a8844 Simplify DeoptimizeKind usage in compiler/
With kLazy deopts gone, we can remove the stored DeoptimizeKind from
Deoptimize nodes and all related spots - all Deoptimize nodes are
eager deopts.

Bug: v8:12765
Change-Id: I8e727e046c498198e50d9b7dba25442fb54f5da9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3568456
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79830}
2022-04-06 16:54:03 +00:00
Leszek Swirski
b24896c6d7 [test] Move single-threaded platform cctest to unittests
Also add a mixin for using the single-threaded default platform instead
of swapping it in with SetPlatformForTesting.

Bug: v8:12781
Change-Id: I304303e58ed713e5558d108cd7eb826c17abb40f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574553
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79829}
2022-04-06 16:45:46 +00:00
Seth Brenith
4e45eed954 Categorize more objects as kCode in heap snapshots
Currently, the category named “(compiled code)” contains Code,
SharedFunctionInfo, and Script objects. However, there are various other
object types that are allocated per script function, such as
BytecodeArray and FeedbackVector. There are also plain FixedArrays which
are used for function-specific data such as polymorphic feedback and
code deoptimization data. I propose we move all of this to the
“(compiled code)” category, because this memory usage is related to the
number of functions in the script, the size of those functions, and/or
the number of times those functions have been called.

Bug: v8:12769
Change-Id: Ib5e0265a9ef88063596c17419f5b65f683156c52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569876
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#79827}
2022-04-06 16:07:29 +00:00
Omer Katz
38facbaae8 heap: Remove NewSpace::TearDown
TearDown was actually redundant and can be replaced with the dtor.

Bug: v8:12612
Change-Id: Idc4a77c3f20372a53b0003cda6fb00ae7ec0035c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571806
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79819}
2022-04-06 12:54:34 +00:00
Clemens Backes
489f43b485 Reland "[wasm] --liftoff-only should disable --wasm-dynamic-tiering"
This is a reland of commit 54e360d141.
The two WasmGC cctests which require SSE4.1 support in Liftoff are now
skipped, so we can keep disallowing any bailout (even for missing CPU
features) in --liftoff-only.

Original change's description:
> [wasm] --liftoff-only should disable --wasm-dynamic-tiering
>
> A Liftoff only configuration should never tier up to TurboFan, hence add
> a proper implication to disable dynamic tiering if --liftoff-only is
> set.
> Also, add a DCHECK to ensure we never accidentally compile with TurboFan
> if --liftoff-only is set.
>
> R=jkummerow@chromium.org
>
> Bug: v8:12281
> Change-Id: Ia9b81add503cc939f59fde3f4d3bb67252facf2c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569741
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79779}

Bug: v8:12281
Change-Id: I334bd81f75c3ef6d31b6117da5ef59a33fb46ae2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3572043
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79813}
2022-04-06 09:50:13 +00:00
Leszek Swirski
c35ca2b712 Revert "[string] Non-transitioning shared strings"
This reverts commit 8ba60b7a8e.

Reason for revert: code_serializer failures: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/38940/overview

Original change's description:
> [string] Non-transitioning shared strings
>
> Instead of transitioning shared strings to ThinString on
> internalization, use a forwarding table to the internalized string and
> store the index into the forwarding table in the string's hash field.
>
> This way we don't need to handle concurrent string transitions that
> modify the underlying string data.
>
> During stop-the-world GC, live strings in the forwarding table are
> migrated to regular ThinStrings.
>
> Bug: v8:12007
> Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Jakob Linke <jgruber@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Patrick Thier <pthier@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79801}

Bug: v8:12007
Change-Id: I740904f3edfc395331f06c7218e89476b06b0563
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3574543
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#79810}
2022-04-06 09:35:46 +00:00
Leszek Swirski
3bb9ab5646 [test] Fix unused variable in cctest loop
Change-Id: Ia574baaa796f1b2d6feea3e76364c9c417fb8ceb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3571899
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79808}
2022-04-06 09:15:26 +00:00
Patrick Thier
8ba60b7a8e [string] Non-transitioning shared strings
Instead of transitioning shared strings to ThinString on
internalization, use a forwarding table to the internalized string and
store the index into the forwarding table in the string's hash field.

This way we don't need to handle concurrent string transitions that
modify the underlying string data.

During stop-the-world GC, live strings in the forwarding table are
migrated to regular ThinStrings.

Bug: v8:12007
Change-Id: I6c6f3d41c6f644e0aaeafbf25ecec5ce0aa0d2d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536647
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Linke <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79801}
2022-04-06 07:59:33 +00:00
Hannes Payer
e220866e61 [heap] Separate GC phases flag.
This CL introduces the --separate-gc-phases flag, which prevents that young and old generation GCs can happen at the same time. When incremental marking is in progress and a young generation GC triggers, marking is forced to finish and the full collection takes care of the young generation.

Bug: v8:12503
Change-Id: Ia3e4814f46bff0fdc404b0ac618dfd48fe7cf20c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3351973
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79799}
2022-04-06 07:23:39 +00:00
Michael Lippautz
fd7c100a9c [heap] Avoid re-scanning roots during incremental finalization step
Incremental finalization previously used to rescan roots to avoid any
new work showing up in the atomic pause.

With concurrent marking we should be way faster in finalizing, so that
we can save ourselves this work. In particular, if we finalize in the
same JS execution we would be doubling work as the atomic pause
anyways needs to rescan all roots.

Bug: v8:12775
Change-Id: I58a5a931da72c8d5c8aee4cd5dad4512954668b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3570427
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79784}
2022-04-05 17:41:42 +00:00
Leszek Swirski
49c507dc99 [test] Make cctest run one test, with maybe custom platform
Remove cctest's ability to run multiple tests (which has long been
deprecated and mostly broken). We can then make platform & V8
initialisation be part of running the test's Run method.

In particular, this allows us to inject custom logic into the platform
initialisation, like setting up a platform wrapper. Add a
TEST_WITH_PLATFORM which exercises this by registering a platform
factory on the test, and wrapping the default platform using this
factory. This allows these tests to guarantee that the lifetime of the
platform is longer than the lifetime of the isolate.

As a result of this, we can also remove the complexity around draining
platform state in the TestPlatform (since it will now have a longer
lifetime than the Isolate using it), and as a drive-by clean up the
TestPlaform to use a CcTest-global "default platform" instead of trying
to scope over the "current" platform.

As another drive-by, change the linked-list of CcTests and the linear
search through it into an std::map of tests.

Change-Id: I610f6312fe042f29f45cc4dfba311e4184bc7759
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3569223
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79772}
2022-04-05 09:39:18 +00:00
Jakob Gruber
1ff685d8b1 [deoptimizer] Remove soft deopts
.. since they are the same as eager deopts (% an unused counter).

Fixed: v8:12765
Change-Id: I2be6210e476ead4ac6629a49259f28321e965867
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3565717
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79729}
2022-04-04 10:26:36 +00:00
Manos Koukoutos
c3ed607d63 [wasm-gc] Implement runtime-type canonicalization
Add an array of canonical rtts on the isolate. Each wasm instance
copies its rtts from there, based on the type index -> canonical index
mapping in the module.

Bug: v8:7748
Change-Id: I0958686c51ecab15a3215a0da3bee1ad6d543cb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548821
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79712}
2022-04-01 13:49:01 +00:00
Igor Sheludko
c4e66b89b4 [runtime] Fix handling of interceptors, pt.3
... in JSObject::DefineOwnPropertyIgnoreAttributes().
Don't execute interceptor again if it declined to handle the operation.

Bug: chromium:1311641
Change-Id: If61ed40665ff7d81e96fa6bf29bbb5dfbeadfcc1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3562979
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79707}
2022-04-01 10:36:01 +00:00
Manos Koukoutos
cfa8d0b35a Reland "[wasm-gc] Implement isorecursive canonicalization"
This is a reland of commit e76ad5c6d9

Changes compared to original:
- Move invocation of LAZY_INSTANCE_INITIALIZER to a static global
  variable, as some builds were failing with a function-level static.
- Drive-by: Improve documentation a bit.

Original change's description:
> [wasm-gc] Implement isorecursive canonicalization
>
> This implements isorecursive canonicalization for static types.
>
> Not implemented in this CL:
> - Runtime type canonicalization.
> - Cross-module signature canonicalization for purposes of call_indirect.
>
> Bug: v8:7748
> Change-Id: I6214f947444eea8d7b15a29b35c94c3d07ddb525
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541925
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79665}

Bug: v8:7748
Change-Id: I493fba1906491762f7d8bae50108e3e4a743391d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3560480
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79692}
2022-03-31 15:45:49 +00:00
Stephen Roettger
a8beac553b Deprecate some signature checks
Deprecate signature checks in
* Template::SetNativeDataProperty
* ObjectTemplate::SetAccessor
These are not used in Chrome and require some complicated check in the IC code, which we want to remove.

Change-Id: I413fafc8658e922fd590e7fe200600a624f019a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557253
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Stephen Röttger <sroettger@google.com>
Cr-Commit-Position: refs/heads/main@{#79689}
2022-03-31 12:11:21 +00:00
Marja Hölttä
185d6116ae [super IC] Fix API getter related bugs and re-enable super IC
Bug: chromium:1308360,chromium:1309467,v8:9237
Change-Id: I2923e3ee60b4b30c4e2b57b9c8569a030fc7bfbd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550588
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79676}
2022-03-30 13:09:20 +00:00
Jakob Gruber
57d985a584 Refactor OptimizationMarker and ConcurrencyMode enums
.. with readability and simplicity in mind.

- Rename OptimizationMarker to the (shorter) TieringState. 'Tiering'
  also matches 'TieringManager' terminology.
- Rename the values:
  kNone -> kNone
  kInOptimizationQueue -> kInProgress
  kCompileFoo_NotConcurrent -> kRequestFoo_Synchronous
  kCompileFoo_Concurrent -> kRequestFoo_Concurrent
- Likewise rename ConcurrencyMode::kNotConcurrent to kSynchronous.
- Add predicates to test enum values.
- Consistent lower case names for accessors on JSFunction and
  FeedbackVector.
- Instead of having to call HasOptimizationMarker() before using any
  other accessor, simply have optimization_marker() return kNone if
  no feedback vector exists.
- Drive-by: Enable the Unreachable() in MaybeOptimizeCode()
  unconditionally - this should never happen, there's no reason not
  to protect against this in release builds as well.

Bug: v8:12161
Change-Id: I67c03e2b7bd0a6b86d0c64f504ad8cb47e9e26ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3555774
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Linke <jgruber@chromium.org>
Auto-Submit: Jakob Linke <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79669}
2022-03-30 08:37:42 +00:00
Nico Hartmann
98db200c3d Revert "[wasm-gc] Implement isorecursive canonicalization"
This reverts commit e76ad5c6d9.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20shared/19438/overview

Original change's description:
> [wasm-gc] Implement isorecursive canonicalization
>
> This implements isorecursive canonicalization for static types.
>
> Not implemented in this CL:
> - Runtime type canonicalization.
> - Cross-module signature canonicalization for purposes of call_indirect.
>
> Bug: v8:7748
> Change-Id: I6214f947444eea8d7b15a29b35c94c3d07ddb525
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541925
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79665}

Bug: v8:7748
Change-Id: I9e26696a7113b1bacafa800c8d6ef24df38c41fd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3557233
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79667}
2022-03-30 07:47:00 +00:00
Manos Koukoutos
e76ad5c6d9 [wasm-gc] Implement isorecursive canonicalization
This implements isorecursive canonicalization for static types.

Not implemented in this CL:
- Runtime type canonicalization.
- Cross-module signature canonicalization for purposes of call_indirect.

Bug: v8:7748
Change-Id: I6214f947444eea8d7b15a29b35c94c3d07ddb525
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541925
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79665}
2022-03-30 06:23:30 +00:00
Leszek Swirski
0a110021d2 [deoptimizer] Remove non-fixed-size deopts
All architectures have kSupportsFixedDeoptExitSizes = true, so we can
remove kSupportsFixedDeoptExitSizes entirely and always have fixed-size
deopts.

Change-Id: Ib696f6d2431f60677cc7fa2193ee27b9b0f80bc8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3550268
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79654}
2022-03-29 12:54:58 +00:00
Dominik Inführ
a847182056 [heap] Initialize pages with placement-new
Define ctors for BasicMemoryChunk, ReadOnlyPage, MemoryChunk, Page and
LargePage. We can use those with placement-new to initialize pages. We
now initialize chunks at once either for ReadOnlyPage, Page or
LargePage. Previously initialization happened in multiple locations
starting with BasicMemoryChunk::Initialize.

Adding ctors to these classes should improve debugging, since debug
info for classes without ctors was removed with the compiler flag
`-fuse-ctor-homing`.

Change-Id: Ib842bb9b1e93a6576cad8299b7c5dbfe299baa33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3545092
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79638}
2022-03-28 09:18:55 +00:00
Tobias Tebbi
e71ce3093d Revert "[heap] Only start incremental marking when V8 is not in GC VM state."
This reverts commit f124b28d46.

Reason for revert: https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8818719400214419665/+/u/Check_-_stress_concurrent_allocation__flakes_/flush-baseline-code

Original change's description:
> [heap] Only start incremental marking when V8 is not in GC VM state.
>
> Bug: v8:12503
> Change-Id: Icda291d9770c46c7fee3c70dd4df97f320b1956a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398113
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#79623}

Bug: v8:12503
Change-Id: I067b308cfc4511d89144d2bb65a1dba24db62179
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3553104
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Owners-Override: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79629}
2022-03-25 16:07:53 +00:00
legendecas
0a0ad98a5a [ShadowRealm] WrappedFunction properties
Implement WrappedFunction properties name/length.

Bug: v8:11989
Change-Id: I050af5814537552ef6c2077802ffc726f2e08fa3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3507201
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Chengzhong Wu <legendecas@gmail.com>
Cr-Commit-Position: refs/heads/main@{#79628}
2022-03-25 16:00:33 +00:00
Hannes Payer
f124b28d46 [heap] Only start incremental marking when V8 is not in GC VM state.
Bug: v8:12503
Change-Id: Icda291d9770c46c7fee3c70dd4df97f320b1956a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3398113
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79623}
2022-03-25 11:53:23 +00:00
Marja Hölttä
c6b68cbfbd [super IC] Turn off super ICs
They make assumptions which don't hold for API handlers.

Bug: v8:9237,chromium:1308360
Change-Id: I9f122c4e75a24d83ef3653cbf7a223ed522e4d13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548899
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79614}
2022-03-24 17:59:52 +00:00
Igor Sheludko
0981e91a4f [runtime] Fix handling of interceptors
Bug: chromium:1309225
Change-Id: Ifd62639a2aa18b633e7cf36632677ee16c977afd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3548458
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79613}
2022-03-24 17:50:12 +00:00
Benedikt Meurer
3eb6b7aca6 [debug] Hold on to promises weakly from the debugger's promise stack.
The debugger maintains a stack of promises used for catch prediction
with promise builtins and async functions. Previously this stack would
hold on to the individual promises strongly, and subtle bugs that lead
to not properly cleaning up the stack in some corner cases would often
lead to significant memory issues (e.g. leaking whole iframes).

This refactors the PromiseOnStack to be

  (a) on the V8 heap, rather than allocating C++ structs with global
      handles pointing to the promises, and
  (b) hold on to the promises only weakly.

While this will not guarantee proper promise stack management, it will
at least ensure that edge cases don't lead to catastrophic (debugger
only) leaks.

Bug: chromium:1292063
Change-Id: I9c293ca2032de3a59e1e9624f132d37187805567
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3545176
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79594}
2022-03-24 08:16:32 +00:00
Michael Lippautz
f6386018d4 [api] Remove TracedGlobal<>
Remove deprecated TracedGlobal<>, greatly simplifying handling of
traced references in general.

Also saves a word per v8::TracedReference as there's no need to keep a
possible callback around.

Bug: v8:12603
Change-Id: Ice35d7906775b912d02e97a27a722b3e1cec28d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3532251
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79589}
2022-03-23 21:04:51 +00:00
Michael Lippautz
542a78458f MockTracingPlatform: Fix uaf with stack-scoped platform
This fixes a general race with stack-scoped `TestPlatform` which
may go out of scope while tasks on workers are still running.

Add a barrier for workers, implemented through tasks, to synchronize
destruction of `TestPlatform`.

While this fixes general races, such short-lived platforms still
break if tasks cache the global platform pointer.

Bug: v8:12635
Change-Id: Ifc6ecc29f0e2b7297ca52051eae9bd81013b60ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3536651
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79587}
2022-03-23 20:22:42 +00:00
Joyee Cheung
639c09a341 [class] fix read-only private references in logical assignments
Since assignments to read-only private references can be skipped due
to short-circuiting in logical assignments, we should not eagerly
emit the error of invalid writes, and should instead load the values
as usual, only emitting an error when the assignment happens,
which can be handled by BytecodeGenerator::BuildAssignment().

Bug: v8:12680, v8:8330, v8:10372
Change-Id: Ia5fea9090bc48b0af8a9c8d6f95174f7aa2d86f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3509298
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/main@{#79583}
2022-03-23 16:16:32 +00:00
David Sanders
cabf441d12 Fix typos, intial* -> initial*
Change-Id: Ia5066069304ae2eee442cd3e224c0c0c0816fd75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3543179
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79574}
2022-03-23 13:20:33 +00:00
Benedikt Meurer
0447ba447e [debug] Mark debug-evaluate script as shared-cross-origin.
Following up on https://crrev.com/c/3540145, this also changes local
debug evaluate scripts to be marked as shared-cross-origin.

Drive-by-fix: This also updates the test for global debug evaluate to
use the official (debug) API instead of peaking into the V8 internals
unnecessarily.

Bug: chromium:1295750
Change-Id: Ief0bc76a4333671f8db761d1f6a5fb740aae698e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541780
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79568}
2022-03-23 10:30:22 +00:00
Lu Yahan
da5b5f66a6 [riscv64] Remove dynamic map checks and custom deoptimization kinds
Port b2978927d8

Bug: v8:12552
Change-Id: I73e76fc5cc8905a0fbfc801b2f794735866d19e8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3544725
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#79561}
2022-03-23 07:29:54 +00:00
Liu Yu
38940b7098 [loong64][mips] Remove dynamic map checks and custom deoptimization kinds
Port commit b2978927d8

Fixed: v8:12552
Change-Id: Ic2fbded9a662ed840a0350e3ce049e147fbf03a0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3541527
Auto-Submit: Yu Liu <liuyu@loongson.cn>
Reviewed-by: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/main@{#79557}
2022-03-22 03:49:00 +00:00
Benedikt Meurer
b426c2d30d [debug] Mark global debug-evaluate scripts as shared-cross-origin.
This way Blink will not sanitize error events coming from JavaScript
entered via the DevTools console, and instead forward the original error
event as-is, which is more likely to match the developers' expectations.

Bug: chromium:1295750
Change-Id: Id02c048e4af21d0c232d8e44d11115f6b61c0bf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3540145
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79549}
2022-03-21 14:14:29 +00:00
Jakob Gruber
b2978927d8 Remove dynamic map checks and custom deoptimization kinds
This CL removes:

- Dynamic map checks aka minimorphic property loads (TF support,
  builtins).
- "Bailout" deopts (= drop to the interpreter once, but don't
  throw out optimized code).
- "EagerWithResume" deopts (= part of dynamic map check
  functionality, we call a builtin for the deopt check and deopt
  or resume based on the result).

Fixed: v8:12552
Change-Id: I492cf1667e0f54586690b2f72a65ea804224b840
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3401585
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79544}
2022-03-21 13:01:16 +00:00
Jakob Gruber
52d4ea6c09 [osr] Minor refactors in OSR-related code
- Restructure the runtime function implementation.
- Rename osr_loop_nesting_level to osr_urgency and add helpers.

The motivation for the latter: I've always struggled with the
`osr_loop_nesting_level` term; it neither matches terminology of
what it's compared against (= the loop depth), nor implies what it's
used for (= osr is triggered when `loop depth < osr nesting level`).

In this CL it's renamed to `osr_urgency` to reflect that as urgency
rises, we consider more and more loops as OSR candidates.

Bug: v8:12161
Change-Id: I194ec5a3f1f02526641af1c7796ee0956b6fd3a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3528735
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79509}
2022-03-17 10:09:16 +00:00
Jakob Gruber
697a1aa3ee [maglev] Towards concurrent Maglev compilation
This CL implements most parts of the concurrent maglev pipeline.

- MaglevConcurrentDispatcher: controls concurrent jobs.
- MaglevCompilationInfo: holds job-global data, controls handle
  fiddling between the main isolate and local isolates, owns
  job-global state like the Zone.
- MaglevCompilationUnit: same as before, holds per-unit data.

Still missing: job finalization.

Bug: v8:7700
Change-Id: I281178d945e79a0ba97fa2ac7023285d84a16641
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3516036
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#79489}
2022-03-16 08:54:23 +00:00