Commit Graph

254 Commits

Author SHA1 Message Date
Clemens Hammacher
e5847dd82a [fuzzer] Improve wasm-compile fuzzer
For short inputs (<= size of the type we want to generate), we fell back
to just generating constants. This CL changes that to only fall back to
constants once a single byte remains, and adds options to use constants
already before that.

R=ahaas@chromium.org

Bug: v8:894307
Change-Id: Ic4bf05d06090f52b67de2b322a9d5dcab6bbbe39
Reviewed-on: https://chromium-review.googlesource.com/c/1337739
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57573}
2018-11-16 14:15:48 +00:00
Clemens Hammacher
a0409f0528 [wasm] Fix test generation for shared memory
R=gdeepti@chromium.org

Change-Id: I8fabe18101b7e23b5e2971fedd0bd3591783dc85
Reviewed-on: https://chromium-review.googlesource.com/c/1329699
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57441}
2018-11-12 16:40:14 +00:00
Ben L. Titzer
0227b62fdb [compiler] Move some files to backend/ directory
This CL splits the backend of TurboFan off into its own directory,
without changing namespaces. This makes ownership management a bit
more fine-grained with a logical separation.

R=mstarzinger@chromium.org,jarin@chromium.org,adamk@chromium.org

Change-Id: I2ac40d6ca2c4f04b8474b630aae0286ecf79ef42
Reviewed-on: https://chromium-review.googlesource.com/c/1308333
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57437}
2018-11-12 15:06:56 +00:00
Clemens Hammacher
cc70a6b050 [wasm] Rename GrowMemory to MemoryGrow
The "grow_memory" opcode was renamed to "memory.grow", and the spec
repo was updated to use kExprMemoryGrow internally instead of
kExprGrowMemory (https://github.com/WebAssembly/spec/pull/720).
This CL does the same change for v8.

Drive-by: Rename "current_size" to "memory.size", and a minor cleanup
in wasm-graph-builder.js to bring it in line with the version in the
js-api tests in the spec repo.

R=titzer@chromium.org

Change-Id: If525dba898b2c248890a616d3392c22b45f698ef
Reviewed-on: https://chromium-review.googlesource.com/c/1302057
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57089}
2018-10-29 14:06:24 +00:00
Clemens Hammacher
267e6b0cb7 [wasm][fuzzer] Enforce input size limit
The "max_len" argument for fuzzer targets is deprecated. We need to
enforce the limit internally.

R=ahaas@chromium.org

Bug: chromium:894939
Change-Id: I2206bc63d5e39f1aa189e11042a6a0bbcca31b0d
Reviewed-on: https://chromium-review.googlesource.com/c/1299020
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56998}
2018-10-25 15:57:29 +00:00
Clemens Hammacher
9716f689b8 [wasm] Do not store ModuleEnv
Instead, create it when needed and pass it down to the actual
compilation.
This saves memory by making the WasmCompilationUnit smaller and will
eventually allow us to implement the trap handler fallback correctly by
using an updated ModuleEnv in background compilation and tier up.

R=mstarzinger@chromium.org

Bug: v8:5277, v8:8343
Change-Id: I0dc3a37fb88e54eb4822dc99d58ff024f4b2a367
Reviewed-on: https://chromium-review.googlesource.com/c/1293953
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56896}
2018-10-23 12:47:14 +00:00
Clemens Hammacher
7921b73afb [wasm] Use getter for WasmResult::value
Previously, this was just a field on the WasmResult, which is not
allowed according to the style guide.
A special r-value accessor for the value is needed for the cases where
the contained type is not copyable, e.g. unique_ptr.

R=titzer@chromium.org

Bug: v8:8238
Change-Id: Ia3c14c4c62c3c2e07f1dc4594f1bc9d1da88f91e
Reviewed-on: https://chromium-review.googlesource.com/c/1290974
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56823}
2018-10-19 14:32:02 +00:00
Jakob Gruber
34ec9ec7ca [regexp] Fix invalid access into empty string
If `out` is empty accessing `out.back()` is invalid.

TBR=yangguo@chromium.org

Bug: chromium:894934
Change-Id: I7286c5b6a9857f1cdb2bcaf383094bee65bac393
Reviewed-on: https://chromium-review.googlesource.com/c/1282565
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56669}
2018-10-16 08:17:24 +00:00
Sigurd Schneider
b79147d5f2 [multi-return-fuzzer] Fix clusterfuzz issue in test
Change-Id: I20ee0d411155e23d87c731f0d909b14c55088c4c

R=ahaas@chromium.org
Also-By: ahaas@chromium.org

Bug: chromium:892435
Change-Id: I70ca2982ea0ddc39fecfbab983a7295707fe8873
Reviewed-on: https://chromium-review.googlesource.com/c/1264283
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56407}
2018-10-05 10:49:10 +00:00
Sigurd Schneider
52bd944db8 [wasm,test] Pass correct code kind in Wasm tests
Change-Id: I8fd0ce9ac2dc37e2daa0728b5d4c119a2bd1f340
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/1256865
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56338}
2018-10-02 14:21:53 +00:00
Michael Starzinger
9ce331f22f [wasm] Cleanup and document {NativeModule} mutex.
This also makes the {AddCodeCopy} method more specific to only apply to
import wrappers, otherwise the use of {set_code} would be unprotected.

R=clemensh@chromium.org
BUG=v8:8015

Change-Id: I62561560f57e4cc235a338c0e769e50ff55ec42d
Reviewed-on: https://chromium-review.googlesource.com/1238477
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#56137}
2018-09-21 12:58:29 +00:00
Florian Sattler
1edbf16697 [cleanup] Refactor general tests to use default members.
Fixing clang-tidy warning.

Bug: v8:8015
Change-Id: I4236a2cf85a414f9d7d1fbdaaaaf1c72a84f02e3
Reviewed-on: https://chromium-review.googlesource.com/1224093
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#55912}
2018-09-14 14:40:47 +00:00
Andreas Haas
3e545e4045 Reland "[wasm] Implement the new API for WebAssembly.instantiateStreaming"
The problem was that in AsyncCompileJob::FinishModule we allocate a
handle, but when this function is called from streaming compilation, then
there was no HandleScope around AsyncCompileJob::FinishModule. This issue
was fixed in another CL, https://crrev.com/c/1172357. This CL is just a
rebase of the original CL.

Original change's description:
> [wasm] Implement the new API for WebAssembly.instantiateStreaming

> This is the second V8 CL to refactor WebAssembly.instantiateStreaming to
> make it spec compliant again. The design doc where the whole change is
> discussed is available in the tracking bug. The tracking bug also
> references prototype implementations of the whole change, which includes
> the changes in this CL.

R=starzinger@chromium.org

Bug: chromium:860637
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ib0cb25488654d2b325b4f529d33b76b846c64436
Reviewed-on: https://chromium-review.googlesource.com/1172429
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55106}
2018-08-14 08:20:19 +00:00
Ben L. Titzer
6aa2a25313 [wasm] Add WasmFeatures to enable/detect features
This CL introduces a set of configuration options implemented as
a struct of booleans that together comprise the set of enabled
or detected features. The configuration options replace command-line
flags that were checked deep in the implementation. As such, it is
necessary to plumb them through multiple levels of abstraction.

R=ahaas@chromium.org
CC=mstarzinger@chromium.org
BUG=chromium:868844

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I1b82f5826e4fd263f68e8cafcd923bac5818a637
Reviewed-on: https://chromium-review.googlesource.com/1163670
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55018}
2018-08-09 10:58:22 +00:00
Clemens Hammacher
897e17a255 [wasm][fuzzer] Generate more and longer sequences
In Liftoff, bugs often happen only if specific cache states are
constructed. For this, longer sequences of instructions are needed.
Thus, add a few rules to increase the chance of generating longer
sequences.

R=ahaas@chromium.org

Change-Id: I8f112edf0280282bf275585e8a15772013c25245
Reviewed-on: https://chromium-review.googlesource.com/1158695
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54927}
2018-08-06 14:58:05 +00:00
Andreas Haas
fea9300d9f Revert "[wasm] Implement the new API for WebAssembly.instantiateStreaming"
This reverts commit b556c9eaa6.

Reason for revert: Flakes in layout tests: https://crbug.com/870187

Original change's description:
> [wasm] Implement the new API for WebAssembly.instantiateStreaming
> 
> This is the second V8 CL to refactor WebAssembly.instantiateStreaming to
> make it spec compliant again. The design doc where the whole change is
> discussed is available in the tracking bug. The tracking bug also
> references prototype implementations of the whole change, which includes
> the changes in this CL.
> 
> R=​mstarzinger@chromium.org
> 
> Bug: chromium:860637
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I776c0f24959ab5663727d3dfee0248a9b0642a42
> Reviewed-on: https://chromium-review.googlesource.com/1143187
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54834}

TBR=mstarzinger@chromium.org,ahaas@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:860637
Change-Id: Icbf2603143068a49c61de162aa7185a753703e5d
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1160261
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54872}
2018-08-02 13:29:47 +00:00
Florian Sattler
e2201a4458 Reland "Applied noexcept to all mctors and massigns"
This is a reland of baa055c7a6

Original change's description:
> Applied noexcept to all mctors and massigns
> 
> Refactoring the code base to use noexcept for their move constructors and move
> assignment operators.
> 
> Bug: v8:7999
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I13d24eddba3bfa601cff26fd680a040cf4e71426
> Reviewed-on: https://chromium-review.googlesource.com/1152817
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#54841}

Bug: v8:7999
Change-Id: I72394e326a4f8da462ee6285511d721440ceb21d
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1158646
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#54863}
2018-08-02 10:37:09 +00:00
Clemens Hammacher
8332c0ff11 Revert "Applied noexcept to all mctors and massigns"
This reverts commit baa055c7a6.

Reason for revert: mips compile failure: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Mips%20-%20builder/18458

Original change's description:
> Applied noexcept to all mctors and massigns
> 
> Refactoring the code base to use noexcept for their move constructors and move
> assignment operators.
> 
> Bug: v8:7999
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I13d24eddba3bfa601cff26fd680a040cf4e71426
> Reviewed-on: https://chromium-review.googlesource.com/1152817
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Florian Sattler <sattlerf@google.com>
> Cr-Commit-Position: refs/heads/master@{#54841}

TBR=marja@chromium.org,yangguo@chromium.org,ahaas@chromium.org,jgruber@chromium.org,sattlerf@google.com

Change-Id: I49757025daac368a647887a63164e927f0106803
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7999
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1158644
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54843}
2018-08-01 13:19:09 +00:00
Florian Sattler
baa055c7a6 Applied noexcept to all mctors and massigns
Refactoring the code base to use noexcept for their move constructors and move
assignment operators.

Bug: v8:7999

Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I13d24eddba3bfa601cff26fd680a040cf4e71426
Reviewed-on: https://chromium-review.googlesource.com/1152817
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Florian Sattler <sattlerf@google.com>
Cr-Commit-Position: refs/heads/master@{#54841}
2018-08-01 13:00:30 +00:00
Andreas Haas
b556c9eaa6 [wasm] Implement the new API for WebAssembly.instantiateStreaming
This is the second V8 CL to refactor WebAssembly.instantiateStreaming to
make it spec compliant again. The design doc where the whole change is
discussed is available in the tracking bug. The tracking bug also
references prototype implementations of the whole change, which includes
the changes in this CL.

R=mstarzinger@chromium.org

Bug: chromium:860637
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I776c0f24959ab5663727d3dfee0248a9b0642a42
Reviewed-on: https://chromium-review.googlesource.com/1143187
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54834}
2018-08-01 08:56:21 +00:00
Andreas Haas
a2a3817594 [wasm][multi-return][arm64] Pad parameter slots
Stack parameters on arm64 require padding. Since the stack areas for
parameters and returns should not overlap, we have to pad the parameters
already during the construction of the CallDescriptor so that we can set
the correct stack offset for returns.

R=mstarzinger@chromium.org

Bug: chromium:838098
Change-Id: I23389dc35037054b750e61ea6b1bfdfc4c5bc868
Reviewed-on: https://chromium-review.googlesource.com/1150178
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54716}
2018-07-26 11:04:04 +00:00
Marja Hölttä
cd5fbf635c Reland: [iwyu] Remove sfi-inl.h -> wasm include
This significantly reduces the build time when modifying wasm
files: before touching all wasm headers required 684 steps to
rebuild, now it's 216.

BUG=v8:7754,v8:7490
TBR=clemensh@chromium.org, ulan@chromium.org, tebbi@chromium.org, verwaest@chromium.org, jgruber@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I9003b5b73ac568a29688c5f97ec718c9de8aaaef
Reviewed-on: https://chromium-review.googlesource.com/1150163
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54699}
2018-07-25 14:54:37 +00:00
Leszek Swirski
d850f7ea68 Revert "[iwyu] Remove sfi-inl.h -> wasm include"
This reverts commit 9d18a7fd55.

Reason for revert: Breaks build https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20noi18n%20-%20debug/21856

Original change's description:
> [iwyu] Remove sfi-inl.h -> wasm include
> 
> This significantly reduces the build time when modifying wasm
> files: before touching all wasm headers required 684 steps to
> rebuild, now it's 216.
> 
> BUG=v8:7754,v8:7490
> 
> Change-Id: Id7ff6f9063168556daad4840ee614cf68144cdb2
> Reviewed-on: https://chromium-review.googlesource.com/1145264
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54681}

TBR=ulan@chromium.org,marja@chromium.org,titzer@chromium.org,jgruber@chromium.org,clemensh@chromium.org,tebbi@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

Change-Id: I3b4087916f65b16db75974dba58914c8ea377a08
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7754, v8:7490
Reviewed-on: https://chromium-review.googlesource.com/1149920
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54683}
2018-07-25 09:23:26 +00:00
Marja Hölttä
9d18a7fd55 [iwyu] Remove sfi-inl.h -> wasm include
This significantly reduces the build time when modifying wasm
files: before touching all wasm headers required 684 steps to
rebuild, now it's 216.

BUG=v8:7754,v8:7490

Change-Id: Id7ff6f9063168556daad4840ee614cf68144cdb2
Reviewed-on: https://chromium-review.googlesource.com/1145264
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54681}
2018-07-25 09:07:14 +00:00
Michael Starzinger
131fb7248a [wasm] Remove Isolate from module decoder entry points.
R=ahaas@chromium.org

Change-Id: I7c6fd17f36d33451ce7605e74002515295c7ad1c
Reviewed-on: https://chromium-review.googlesource.com/1145195
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54629}
2018-07-24 08:59:32 +00:00
Ross Mcilroy
64e3912f10 [cleanup] Remove deprecated calls to Write[OneByte/Utf8].
Replace with isolate version.

BUG=v8:7754

Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Iac7091b983960d22b892074c5fd0a97dee9025c9
Reviewed-on: https://chromium-review.googlesource.com/1146332
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54604}
2018-07-23 09:01:08 +00:00
Andreas Haas
8f07a87df0 [wasm][fuzzer] Do not execute code with potential non-determinism
The WebAssembly spec is not fully deterministic: the sign bit of NaN
can be arbitrary. This sign bit can be observed by several WebAssembly
opcodes. In the testcase the sign bit of NaN makes the difference
between terminating code and an infinite loop.

In the libfuzzer fuzzer we have to prevent infinite loops ourselves.
At the moment we do this by only execute generated code of WebAssembly
modules for which the interpretation of the code ends in a limited
number of steps. With the non-determinism described above we cannot
guarantee the absence of infinite loops with this method. Therefore
we stop now to execute generated code of WebAssembly modules for which
we observe possible non-determinism in the interpreter.

R=clemensh@chromium.org

Bug: chromium:863829
Change-Id: I461d67df87d672bed25d6c915ba7ea5134cb5890
Reviewed-on: https://chromium-review.googlesource.com/1141945
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54541}
2018-07-19 08:55:55 +00:00
Max Moroz
3b0fd6bd24 [fuzzer] Fix OOM in v8_json_parser_fuzzer due to unnecessary long input.
Bug: Chromium:798921
Change-Id: I6cd3dbe49f586cdedfc70c6c6ad83391240a65d9
Reviewed-on: https://chromium-review.googlesource.com/1138550
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54494}
2018-07-17 14:25:27 +00:00
Max Moroz
087cc34788 [fuzzer] Fix timeout in v8_script_parser_fuzzer due to unnecessary long inputs.
Bug: Chromium:841975
Change-Id: Ife77805fa3977dc874087ca7ae810eded2ae1c55
Reviewed-on: https://chromium-review.googlesource.com/1136986
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54468}
2018-07-16 14:29:24 +00:00
Dan Elphick
c55875b493 [explicit isolates] Remove GetIsolate from objects.cc
All auto-generated with some fix-ups including marking the following
classes as NeverReadOnlySpaceObject so their GetIsolate/GetHeap methods
are safe to use:
Code, CodeDataContainer, AbstractCode, DeoptimizationData,
CompilationCacheTable, NormalizedMapCache, Script, SharedFunctionInfo

TBR=yangguo@chromium.org

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I6cb5dcca88a0bc99b5afe80f553e06a661b5da3c
Reviewed-on: https://chromium-review.googlesource.com/1135306
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54439}
2018-07-13 12:42:14 +00:00
Michael Starzinger
44483870dc [fuzzer] Switch code kind for multi-return fuzzer.
The code under test is handling of multi-return values in TurboFan and
hence actually independent of WebAssembly. The only reason to generate
WasmCode is in order to use the WebAseembly linkages. This changes the
generated code to have {STUB} kind instead of {WASM_FUNCTION} kind to
avoid having stack checks in the generated code which would require a
proper WasmInstanceObject to be allocated.

R=ahaas@chromium.org
BUG=chromium:862508

Change-Id: I4feb7bff1a42bbf59cfc5f249f2e0585ce7011ad
Reviewed-on: https://chromium-review.googlesource.com/1136438
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54436}
2018-07-13 12:09:24 +00:00
Clemens Hammacher
cbe423467c [wasm][fuzzer] Test combinations of Turbofan and Liftoff
Currently the fuzzer only tests Turbofan and Liftoff in isolation. In
order to test that both tiers use the same ABI, it should also test
calls from one tier to the other.
This CL introduces a new flag which controls which function will be
compiled by which tier, and uses that in the fuzzer.

R=ahaas@chromium.org

Bug: chromium:862931, v8:6600
Change-Id: I450b906700972cfdb496b1734faed9f8208d652f
Reviewed-on: https://chromium-review.googlesource.com/1134775
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54409}
2018-07-12 12:56:30 +00:00
Clemens Hammacher
dad67377c3 [wasm] "Vectorize" fuzzer
Instead of passing {uint8_t*, size_t} pairs as arguments, pass
{Vector<uint8_t>}. This is less error prone and {Vector} provides some
helpful methods.

R=ahaas@chromium.org

Bug: v8:7754
Change-Id: I7469054774618e0bd5c9d38501759b1b2c51d104
Reviewed-on: https://chromium-review.googlesource.com/1134773
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54406}
2018-07-12 12:44:39 +00:00
Sigurd Schneider
1299ba9681 [turbofan] Thread through AssemblerOptions
This CL surfaces AssemblerOptions to CodeAssembler::GenerateCode and
to pipeline methods. To allow forward declaring AssemblerOptions,
AssemblerBase::Options was moved out of the AssemblerBase class.

Bug: v8:6666
Change-Id: If9fc50d3d4767bb5dd39a0c3b6e094021f4cae2b
Reviewed-on: https://chromium-review.googlesource.com/1127039
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54286}
2018-07-06 09:42:00 +00:00
Andreas Haas
df41fa7a8a [wasm][fuzzer] Do not execute modules with start function
In the WebAssembly fuzzers we detect infinite loops with the
interpreter: if the interpreter does not finish after a finite number
of steps, we do not execute the compiled code. However, we cannot
redirect the start function to the interpreter in the fuzzer, and
therefore we cannot detect infinite loops in the start function. With
this CL we avoid the problem completely by not instantiating a module
in the fuzzer which has a start function. Note that the module still
gets compiled.

R=clemensh@chromium.org

Bug: chromium:858914
Change-Id: Icbbe9a003544918d5267cdd1d9405b21bb681133
Reviewed-on: https://chromium-review.googlesource.com/1126766
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54246}
2018-07-05 10:35:48 +00:00
Clemens Hammacher
2bc78a1c9e [wasm][fuzzer] Improve error output for exception mismatch
The current output of release builds is not very helpful, as it does
not contain the line number, nor the values of {expect_exception} or
{i_isolate->has_pending_exception()}.

R=ahaas@chromium.org

Bug: chromium:854011
Change-Id: I0bc1b8be6151d5420310eb67b2ebd0dc866fc9a6
Reviewed-on: https://chromium-review.googlesource.com/1122869
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54164}
2018-07-03 11:55:34 +00:00
Clemens Hammacher
ad57eec545 [wasm] Store WasmModule directly in the NativeModule
Instead of storing both the {NativeModule} and the {WasmModule} in a
{Managed} object, just store the {WasmModule} in the {NativeModule}
directly. This fixes crashes that happen if the {Managed<WasmModule>}
dies before the {Managed<NativeModule>}.

R=mstarzinger@chromium.org

Bug: chromium:854794, v8:7879, v8:7889
Change-Id: I6b11729943fe7a03d225138782655ee5dafd26a6
Reviewed-on: https://chromium-review.googlesource.com/1118171
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54090}
2018-06-28 14:10:36 +00:00
Deepti Gandluri
096927c123 [wasm] Fix memory flags for fuzzer test generation
R=clemensh@chromium.org
CC=titzer@chromium.org

Change-Id: Ie9cfc0902e765fe3c7945540a609be9901faedff
Reviewed-on: https://chromium-review.googlesource.com/1110847
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53986}
2018-06-23 00:34:29 +00:00
Clemens Hammacher
76ac6372fa [wasm] Prepare enabling liftoff by default on ia32 and x64
Before flipping the flag, some tests need to be adapted. This CL
prepares these tests, such that the flag flip CL really just flips a
flag.

R=titzer@chromium.org, hablich@chromium.org

Bug: v8:6600, chromium:787421
Change-Id: I8030df69cda5f3fb81354350a37f65c0d1c669bd
Reviewed-on: https://chromium-review.googlesource.com/1110363
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53959}
2018-06-22 11:06:26 +00:00
Clemens Hammacher
77e4b2de2d [wasm] wasm-fuzzer: Add ability to generate test case
Other fuzzers already have this ability. This CL adds it to the fuzzer.
The input has to be valid bytes, otherwise we cannot generate the text
representation.

R=titzer@chromium.org
CC=gdeepti@chromium.org

Change-Id: If1ba8accc707bee3b042e93f4201949f0233c90e
Reviewed-on: https://chromium-review.googlesource.com/1109794
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53926}
2018-06-21 12:53:58 +00:00
Sigurd Schneider
0db5e7b80d [TurboFan] Return MaybeHandle from TurboFan compiler
TurboFan returned null handles if compilation did not succeed. This CL
changes that to a MaybeHandle to make it explicit that client code needs
to handle the error.

Bug: v8:7856
Change-Id: I6087e6263faa1150b9788213dd22c398b4a2fc2d
Reviewed-on: https://chromium-review.googlesource.com/1104688
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53824}
2018-06-19 09:33:18 +00:00
Clemens Hammacher
6be6ec0091 [wasm] Store WasmModule in shared_ptr during async compilation
We currently store the {WasmModule} (generated during decoding) in a
unique_ptr and pass ownership to the {WasmModuleObject} after
compilation.
I plan to move the {Managed<NativeModule>} from {WasmCompiledModule} to
{WasmModuleObject}, which will force us to create the
{WasmModuleObject} *before* compilation, so that the {CompilationState}
is available during compilation.

This CL prepares that refactoring by storing the {WasmModule} in a
{shared_ptr} in the {AsyncCompileJob}. Note that it will eventually be
stored in a {shared_ptr} in the {Managed} anyway.

R=titzer@chromium.org

Change-Id: Iac5e3c1067af2801e938f77a455a68807801526a
Reviewed-on: https://chromium-review.googlesource.com/1104117
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53801}
2018-06-18 15:10:03 +00:00
Clemens Hammacher
8e2e125791 Reland "Introduce StdoutStream which prints to Android log or stdout"
This is a reland of 0909dbe3d6.
Added missing V8_EXPORT_PRIVATE to AndroidLogStream.

TBR=mstarzinger@chromium.org

Original change's description:
> Introduce StdoutStream which prints to Android log or stdout
>
> The often used construct {OFStream(stdout)} does not work on Android.
> This CL introduces an {StdoutStream} which behaves exactly like
> {OFStream(stdout)} on non-android platforms, and redirects to the
> Android log on appropriate systems and configurations.
>
> R=mstarzinger@chromium.org
>
> Bug: v8:7820
> Change-Id: Ia682fdf6d064e37c605c19b032f5a10b96ac825b
> Reviewed-on: https://chromium-review.googlesource.com/1088911
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53692}

Bug: v8:7820
Change-Id: I8164bad78a401dbe4246c9ffcacd050fe511ed58
Reviewed-on: https://chromium-review.googlesource.com/1100636
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53733}
2018-06-14 13:29:01 +00:00
Michael Achenbach
d2e1620cd4 Revert "Introduce StdoutStream which prints to Android log or stdout"
This reverts commit 0909dbe3d6.

Reason for revert: Blocks roll:
https://chromium-review.googlesource.com/c/chromium/src/+/1099143

Original change's description:
> Introduce StdoutStream which prints to Android log or stdout
> 
> The often used construct {OFStream(stdout)} does not work on Android.
> This CL introduces an {StdoutStream} which behaves exactly like
> {OFStream(stdout)} on non-android platforms, and redirects to the
> Android log on appropriate systems and configurations.
> 
> R=​mstarzinger@chromium.org
> 
> Bug: v8:7820
> Change-Id: Ia682fdf6d064e37c605c19b032f5a10b96ac825b
> Reviewed-on: https://chromium-review.googlesource.com/1088911
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53692}

TBR=mstarzinger@chromium.org,jarin@chromium.org,jgruber@chromium.org,clemensh@chromium.org,bmeurer@chromium.org

Change-Id: Iadadd9a0df10dca0fad647138a83db50148e864d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7820
Reviewed-on: https://chromium-review.googlesource.com/1100635
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53725}
2018-06-14 06:23:17 +00:00
Clemens Hammacher
0909dbe3d6 Introduce StdoutStream which prints to Android log or stdout
The often used construct {OFStream(stdout)} does not work on Android.
This CL introduces an {StdoutStream} which behaves exactly like
{OFStream(stdout)} on non-android platforms, and redirects to the
Android log on appropriate systems and configurations.

R=mstarzinger@chromium.org

Bug: v8:7820
Change-Id: Ia682fdf6d064e37c605c19b032f5a10b96ac825b
Reviewed-on: https://chromium-review.googlesource.com/1088911
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53692}
2018-06-13 09:57:29 +00:00
Ben L. Titzer
d775c9561f [wasm] Remove the isolate_ field from WasmCodeManager
The isolate is mainly used for accounting purposes. As such, it
doesn't need a field in the WasmCodeManager, and cannot have one
if it is to be made isolate independent. Instead, pass the isolate
explicitly in the appropriate cases.

R=mstarzinger@chromium.org
BUG=v8:7424

Change-Id: I539c2b33692e57605a280530bd704ef25269ad0f
Reviewed-on: https://chromium-review.googlesource.com/1073412
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53676}
2018-06-12 16:46:06 +00:00
Dan Elphick
6cddfd50db [parsing] Remove most GetIsolate calls
Removes most[1] explicit calls to GetIsolate() in parsing/ by passing
it through calling function functions and implicit calls via the single
argument Handle constructor and handle function.

[1] One remains in preparsed-scope-data.cc:
data_->GetIsolate()->PushStackTraceAndDie()

Bug: v8:7786
Change-Id: I4c445995a73c19bdf4649b65487b7443d56ddd2a
Reviewed-on: https://chromium-review.googlesource.com/1085057
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53513}
2018-06-05 08:54:58 +00:00
Dan Elphick
03c85c23cf [regexp] Eliminate all GetIsolates
Remove all uses of GetIsolate/GetHeap by passing Isolate in from all
call sites.

Bug: v8:7786
Change-Id: I64ff8d5796db9d602e86bff4d0b9297cbe700d0d
Reviewed-on: https://chromium-review.googlesource.com/1080819
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53467}
2018-06-01 07:55:19 +00:00
Andreas Haas
8a95da2415 [wasm] Reimplement WebAssembly.instantiate without desugaring
At the moment, WebAssembly.instantiate(bytes) is implemented by
desugaring it to WebAssembly.compile(bytes).then(WebAssembly.instantiate).
The problem is that the {then} in this snippet is observable. With this
CL I introduce a CompilationResultResolver which allows to do the
desugaring internally and thereby make the {then} unobservable.
Unfortunately the result of WebAssembly.instantiate(bytes) is different
than the result of WebAssembly.instantiate(module). Therefore I also
introduced an InstantiationResultResolver for symmetry with
WebAssembly.compile.

R=mstarzinger@chromium.org
Bug: chromium:837417

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I2d98e03d65f2ada19041d5a9e2df5da91b24ccca
Reviewed-on: https://chromium-review.googlesource.com/1059783
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53347}
2018-05-24 22:15:52 +00:00
Andreas Haas
6380476c71 [wasm] Make wasm::ValueType independent of the MachineRepresentation
R=clemensh@chromium.org
CC=​titzer@chromium.org

Change-Id: I4951bf7ffc8baf51225e7bef60349186811b9f76
Reviewed-on: https://chromium-review.googlesource.com/1024037
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53020}
2018-05-07 11:54:56 +00:00