WeakFixedArrays can also contain strong pointers.
(Separating this fix from
https://chromium-review.googlesource.com/c/v8/v8/+/1075053 ; after that CL tests
will fail without this fix.)
BUG=v8:7308
Change-Id: I0d47ab179625bcbf6149cf02ad696f8af250ae8d
Reviewed-on: https://chromium-review.googlesource.com/1075270
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53386}
This extends the validity checking of relocation information from only
non-anonymous {WasmCode} objects to all (even anonymous) such objects,
including code being copied in from the garbage-collected heap.
R=jgruber@chromium.org
Change-Id: Icbc842ad819f4471cc11d3d19bbde1d192731569
Reviewed-on: https://chromium-review.googlesource.com/1073284
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53383}
Introduce a new public API called CodeEventListener to allow embedders
to better support external profilers and other diagnostic tools without
relying on unsupported methods like --perf-basic-prof.
Bug: v8:7694
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I063cc965394d59401358757634c9ea84c11517e9
Co-authored-by: Daniel Beckert <daniel@sthima.com.br>
Reviewed-on: https://chromium-review.googlesource.com/1028770
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53382}
Port 111c5735ef
Original Commit Message:
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the ArrayConstructorStub to a builtin.
R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: Icc6af15d80eb5c95a191832eb9636ebe97e61e07
Reviewed-on: https://chromium-review.googlesource.com/1074548
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53377}
Port 0094defac4
Original Commit Message:
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the ArrayNArgumentsConstructorStub to a builtin.
R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: Ibf5e33cd14ef5baece9ddb660ab54b07233e8a20
Reviewed-on: https://chromium-review.googlesource.com/1073056
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53372}
Port of commit 8ac37bc392.
RelocInfo::INTERNAL_REFERENCE_ENCODED is used only on mips, mips64
and ppc.
Original commit message:
`The RelocInfo::RUNTIME_ENTRY relocation mode is only used for deopt
points in JavaScript code and should never appear in WebAssembly code.`
Change-Id: Ic595103740dc3c349836114f9cbc815865c5b54c
Reviewed-on: https://chromium-review.googlesource.com/1073420
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53370}
Port 70cede3916
Original Commit Message:
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
CallApiGetter and the 0/1 argument case of CallApiCallback to
builtins.
R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: I15677f91ad1f5cac05d4760f4cdd1561982a0621
Reviewed-on: https://chromium-review.googlesource.com/1073055
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53369}
Port 5674812cfb
Original Commit Message:
At runtime, calls to embedded builtins do not need to take the
indirection through the off-heap trampoline. We can simply inline the
trampoline instead.
R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: I4b18f3a957a41af28da34b503015271573949888
Reviewed-on: https://chromium-review.googlesource.com/1073193
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53366}
This was originally a flag for debugging the compilation of a module
by skipping compilation of the first N functions in a module. This
flag is not properly respected anymore, and is an unnecessary complication.
R=herhut@chromium.org
Change-Id: If9bf80245f6982a8383ca3865c599d58319feba9
Reviewed-on: https://chromium-review.googlesource.com/1061468
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53365}
Its contents are now inlined into the one remaining call site.
Bug: v8:6666
Change-Id: Icfcf89013506fec880ffd84eaa88b91e818e28c0
Reviewed-on: https://chromium-review.googlesource.com/1073311
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53363}
Modifies several Type:: methods to take an Isolate to pass through to
BitSetType::Lub as well as their call sites.
Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I9ac769c4c658995421fd28b9b1d77d6f84627116
Reviewed-on: https://chromium-review.googlesource.com/1071515
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53362}
Removes use of HeapObject::GetIsolate() from Object::BooleanValue in
preparation for removing the method.
Requires adding Isolate parameter to CommonOperatorReducer constructor.
Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: If735e71df3288bf1eb11576605c2d95a19472181
Reviewed-on: https://chromium-review.googlesource.com/1071653
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53361}
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the InternalArrayConstructorStub to a builtin.
Bug: v8:6666
Change-Id: I8cd801bd9218ca9ef0853ed99c7a69090af5c9f9
Reviewed-on: https://chromium-review.googlesource.com/1072608
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53360}
If the optional fields are not set, trying to cast to the Object subtype fails.
Change-Id: I386c6b23cbd3d282a72093dfc78966d0046578c3
Reviewed-on: https://chromium-review.googlesource.com/1073307
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53358}
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the ArrayConstructorStub to a builtin.
Bug: v8:6666
Change-Id: Iff4bff99cd911a7f5f138819801c7812b75ea969
Reviewed-on: https://chromium-review.googlesource.com/1071519
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53357}
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
the ArrayNArgumentsConstructorStub to a builtin.
Bug: v8:6666
Change-Id: Ied303334874251415a9057abf612d76dd8330aa6
Reviewed-on: https://chromium-review.googlesource.com/1071450
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53356}
Calls from embedded builtins to stubs are expensive due to the
indirection through the builtins constants table. This moves
CallApiGetter and the 0/1 argument case of CallApiCallback to
builtins.
Bug: v8:6666
Change-Id: I49c4917253f790a3b947f42c50d6308a1ab99d91
Reviewed-on: https://chromium-review.googlesource.com/1070980
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53355}
At runtime, calls to embedded builtins do not need to take the
indirection through the off-heap trampoline. We can simply inline the
trampoline instead.
Bug: v8:6666
Change-Id: Idb7d504fdfee173a0b134fbc74bd5dc6d09629cb
Reviewed-on: https://chromium-review.googlesource.com/1068742
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53354}
This loads references to {null} values from the instance object instead
of embedding them into the generated code. It is one step towards making
the {WasmCode} objects independent of the Isolate.
Note that this also fixes an issue with the serializer/deserializer that
failed to properly serialize {null} values and accidentally collapsed
them to {undefined} values instead.
R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-7785
BUG=v8:7424,v8:7785
Change-Id: Ie436c2d96890e7c8c89ffe2bd4189a759254775b
Reviewed-on: https://chromium-review.googlesource.com/1070981
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53352}
This adds basic support to emit IA disassembly to the json files
digested by turbolizer.
Change-Id: I8964c2f44565e8242e09c9be879c7db2654b65b6
Reviewed-on: https://chromium-review.googlesource.com/1071669
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53351}
This addresses one of the major remaining slowdowns with embedded
builtins on x64.
When generating code for a call to a builtin callee from a builtin
caller, we'd look up the Code target object from the builtins constant
list, calculate the location of the first instruction, and jump to it.
Note that for embedded builtin callees, the Code object is itself only
a trampoline to the off-heap code and thus an additional indirection.
An example of the call sequence in pseudo-asm:
// Load from the constants list.
mov reg, [kRootPointer, kBuiltinsConstantListOffset]
mov reg, [reg, offset_of_the_code_constant]
// Calculate first instruction and call it.
add reg, Code::kHeaderOffset
call reg
// The trampoline forwards to the off-heap area.
mov kOffHeapTrampolineRegister, <off-heap instruction_start>
jmp kOffHeapTrampolineRegister
This CL changes calls to embedded builtin targets to use pc-relative
addressing. This reduces the above instruction sequence to:
call <pc-relative offset to target instruction_start>
Embedded-to-embedded calls jump directly to the embedded instruction
stream, bypassing the trampoline. Heap-to-embedded calls (and all
calls to heap-builtins) use pc-relative addressing targeting the
on-heap Code object.
Other relevant platforms (arm,arm64,mips,mips64) do not use pc-relative
calls. For these, we'll need a different solution, e.g. a table of
embedded builtin addresses reachable from the root pointer, similar to
the external reference table.
Bug: v8:6666
Change-Id: Ic0317d454e2da37d74eaecebcdfcbc0d5f5041ad
Reviewed-on: https://chromium-review.googlesource.com/1068732
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53349}
Port ea7499f5da
Original Commit Message:
Currently, we context allocate all parameters for generators.
With this CL, we keep arguments on stack (unless they escape to inner
closure) and copy them between the stack and the generator's register
file on suspend/resume. This will save context allocation in most cases.
- Suspend copies arguments and registers to the generator.
- Resume copies only the registers from the generator, the arguments
are copied by the ResumeGenerator trampoline.
R=jarin@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: I4a22024ce4e29a4e0217697a3b53b1c7bba0ddf1
Reviewed-on: https://chromium-review.googlesource.com/1072309
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#53348}
At the moment, WebAssembly.instantiate(bytes) is implemented by
desugaring it to WebAssembly.compile(bytes).then(WebAssembly.instantiate).
The problem is that the {then} in this snippet is observable. With this
CL I introduce a CompilationResultResolver which allows to do the
desugaring internally and thereby make the {then} unobservable.
Unfortunately the result of WebAssembly.instantiate(bytes) is different
than the result of WebAssembly.instantiate(module). Therefore I also
introduced an InstantiationResultResolver for symmetry with
WebAssembly.compile.
R=mstarzinger@chromium.org
Bug: chromium:837417
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I2d98e03d65f2ada19041d5a9e2df5da91b24ccca
Reviewed-on: https://chromium-review.googlesource.com/1059783
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53347}
Implement lowering for simd operations I32x4ConvertI16x8 and
I16x8ConvertI8x16. Also, remove skip tests from status files that
were overriden when tests were renamed.
TEST=cctest/test-run-wasm-simd/RunWasm_I16x8ConvertI8x16_turbofan
Change-Id: If428f5039a32995c8ee64294c936419173a87aa7
Reviewed-on: https://chromium-review.googlesource.com/1069007
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53343}
Aseem is the main auther of simd-scalar-lowering and should therefore be
able to lgtm changes to that file.
No-Try: true
No-Tree-Checks: true
R=titzer@chromium.orgCC=aseemgarg@chromium.org
Change-Id: If62d895fb18e8fd59735fec63faa38ca7a6598c5
Reviewed-on: https://chromium-review.googlesource.com/1070984
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53342}
The RelocInfo::RUNTIME_ENTRY relocation mode is only used for deopt
points in JavaScript code and should never appear in WebAssembly code.
R=titzer@chromium.org
Change-Id: Ied1d61e2b1eb886565d13448442dd6a6ed35d3f0
Reviewed-on: https://chromium-review.googlesource.com/1070197
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53340}
This CL completely removes the C++ builtin implementation of the
DataView.prototype.buffer, DataView.prototype.byteLength, and
DataView.prototype.byteOffset getters, and moves them to
a Torque implementation (that still relies on a bit of CSA).
Change-Id: Id46678ae709c3787b7b93d0f78bd2a6e16e00f7b
Reviewed-on: https://chromium-review.googlesource.com/1070369
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53339}
