Commit Graph

28075 Commits

Author SHA1 Message Date
Chong Gu
13a5125212 [Fuchsia] Filter failing tests on Fuchsia
This will allow Fuchsia tests to be run on v8 CI

Bug: v8:11843, chromium:934932
Change-Id: I516329d8f29d9c94d46aa010fa729fa3ca0993ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2935024
Commit-Queue: Chong Gu <chonggu@google.com>
Auto-Submit: Chong Gu <chonggu@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74993}
2021-06-07 19:18:16 +00:00
Seth Brenith
82b673bcbc Fix counting ignition dispatches
The flag --trace-ignition-dispatches has been broken for a long time,
since it was not designed to work with bytecode handlers that are
generated ahead of time by mksnapshot. This splits the existing
--trace-ignition-dispatches logic into two separate parts:

1. A gn argument which instructs mksnapshot to include dispatch counting
   in the bytecode handlers, and ensures that the Interpreter allocates
   the array of counters, and
2. A runtime flag which enables the ignition-statistics extension which
   implements the JS-accessible function getIgnitionDispatchCounters().

Change-Id: I89323425697f5641451f67b9ddcc0303b8ca209f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2937564
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74992}
2021-06-07 18:47:24 +00:00
Patrick Thier
03dade3ec2 [sparkplug] Fix NumFuzz issues with batch-compilation test
Add flag --lazy-feedback-allocation to prevent NumFuzz errors.

Bug: v8:11853
Change-Id: I5170ef9db374e168cf248b86dbed3c3e7c87f826
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2944428
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74990}
2021-06-07 16:16:14 +00:00
Igor Sheludko
f9857fdf74 [runtime] Fix handling of interceptors
Bug: chromium:1216437
Change-Id: Ic417583813ccef4d93b46d5b53af6dd0e6ba9840
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2940889
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74988}
2021-06-07 16:00:34 +00:00
Marja Hölttä
b308c41a07 [ast] Fix de-duping "get 0 {}" and "0: ..." inside objects
This fix makes ObjectLiteral::CalculateEmitStore work correctly.

Bug: v8:11810
Change-Id: I60f3d5cb657f4b2ca574d5224c8f1cb7a8216354
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917040
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74986}
2021-06-07 15:43:24 +00:00
Santiago Aboy Solanes
a6207b54d0 [object] Make the interaction [String::Get()-access guard] explicit
We have recursive calls such ThinStrings where we go String::Get into
ThinString::Get into String::Get again for the internalized string. If
we need to, we would acquire the StringAccessGuard in the first
String::Get and it wouldn't be needed to be re-acquired for the second
String::Get. Trying to re-acquire it would in fact be an error since we
are already holding the lock.

The code, however, didn't know if we acquired it or not. It was working
correctly due to the way the methods were defined and called. By passing
down the access guard through the Get() calls we make this interaction
explicit.

Also add some thin string tests to test the interaction.

Bug: v8:7790
Change-Id: I1181edec1e802cb754c4d1d1ac268577257b92f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2936598
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74984}
2021-06-07 15:00:15 +00:00
Andreas Haas
ad9384560f [wasm] Allow WebAssembly.Global.value.set to be called with undefined
A spec test (wasm-js/global/value-get-set) requires
WebAssembly.Global.value.set to throw an exception if it is called with
0 arguments. The implementation in V8, however, just checked if the
first parameter is `undefined`. This implementation indeed threw an
exception if 0 arguments were provided, but it also threw an exception
when `undefined` is provided as a parameter. This, however, violates
the spec, because globals can be reset to `undefined`.

With this CL we replace the checking for `undefined` by checking the
length of the arguments that get provided.

R=ecmziegler@chromium.org

Bug: chromium:1211342
Change-Id: Ic87a0b369dea3e49eddb8f71f2c29dc6a8f5f558
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2940901
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74982}
2021-06-07 14:17:34 +00:00
Clemens Backes
15e489574b [wasm] Fix integer overflow on memory growing on 32-bit
When growing a memory without a maximum, we should still check against
the spec'ed limit, to avoid an overflow when computing the new number of
pages.

R=ahaas@chromium.org

Bug: chromium:1215808
Change-Id: I476b954268277e7dce1106a9b8c3c713b0d1a560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2944433
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74980}
2021-06-07 13:16:24 +00:00
Manos Koukoutos
d55942e478 [wasm] Update spec tests
Change-Id: Id502aa02a778d17c32996b0438ac3a7c85166430
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2940892
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74972}
2021-06-07 11:45:44 +00:00
Jakob Kummerow
df7f886a6a Reland^2 "[bigint] Karatsuba multiplication"
This is a reland of 81dd3f42be,
which was a reland of 59eff3bfaa

Original change's description:
> [bigint] Karatsuba multiplication
>
> The Karatsuba algorithm is used for BigInts with 34 or more internal
> digits, and thanks to better asymptotic complexity provides greater
> speedups the bigger the inputs.
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74916}

Bug: v8:11515
Change-Id: I08f7d59dfa39fb3b532684685afd9fa750e0e84e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933666
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74969}
2021-06-07 11:01:14 +00:00
Marja Hölttä
d1a0896da6 [web snapshots] Support arrow / async / generator funcs
Bug: v8:11525
Change-Id: I0ac9f252e0de16480036e3630edf7efefe8d8571
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928501
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74968}
2021-06-07 10:40:55 +00:00
Mathias Bynens
d33df16103 [Object.hasOwn] Add Test262 feature-to-flag mapping
Bug: chromium:1213927
Change-Id: I85f5559863524717355ec61694ce007a2be7c8a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931799
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74967}
2021-06-07 10:39:54 +00:00
Andreas Haas
ae2f476c79 [wasm] Improve error message in the streaming decoder
Bug: chromium:1213097
Change-Id: If768725a5645b7d21f59845692ca5491e8674bfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2940896
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74964}
2021-06-07 09:35:29 +00:00
Paolo Severini
8b0cbd232b Fix flaky tests mjsunit/compiler/call-with-arraylike-or-spread*
The tests are not compatible with the --stress-background-compile flag.

Bug: v8:11821
Change-Id: Iecef6a2838109fddc9f0ecc145a9f8971bc9bc3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2918214
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74959}
2021-06-07 05:44:43 +00:00
Dominik Inführ
c91c72706e Reland "[heap] Remove unused LocalSpace class"
This is a reland of b0c70710a4

The first CL got reverted because of build errors. This CL replaces the
remaining usage of is_local_space() with is_compaction_space().
Supposedly this was a leftover because https://crrev.com/c/2928189
landed at roughly the same time.

Original change's description:
> [heap] Remove unused LocalSpace class
>
> LocalSpace was introduced for off-heap spaces with concurrent bytecode
> compilation finalization. However, finalization ended up using
> LocalHeap for concurrent allocations. LocalSpace is therefore unused
> and can be removed.
>
> This CL removes LocalSpace and renames all mentions of local space to
> compaction space. Compaction space was the only local space left.
>
> Change-Id: I12a8a2724f777a77ddb9957fe2d8e89febfebbaf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930169
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74914}

Change-Id: I993c47fe85f4140f5d6137afde2653a48047cafb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939983
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74957}
2021-06-06 19:09:13 +00:00
Milad Fa
f6a53a4eb4 [wasm-simd] Fix endianness issue on AddExtAddPairwise tests
ReadLittleEndianValue needs to be used to make sure
value is returned correctly on BE machines.

Change-Id: I02a64cded4f5dcccd39f1109c4179bebf9231a70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2941038
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74954}
2021-06-04 22:00:06 +00:00
Manos Koukoutos
a40dd830d0 [wasm] Maintain existing values in TypeCheckStackAgainstMerge
Replacing existing values leads to type errors and printing wrong pcs in
errors.

Change-Id: I513eae0a7e0cb5764d307eb172a378d328ca3660
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2936596
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74953}
2021-06-04 21:37:16 +00:00
Daan de Graaf
723d1af0a0 [wasm-simd][arm64] Fuse signed extadd_pairwise and add SIMD instructions.
The two instructions are fused into a single Sadalp instruction,
improving performance of quantized neural network operator
implementations such as XNNPACK.

This change also includes some formatting changes to the unit
tests that were made automatically by clang-format, which I am
happy to revert if preferred.

Bug: v8:11546
Change-Id: I2afc8940a52186617cffd276c82733ad3020b728
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878742
Commit-Queue: Daan de Graaf <daagra@google.com>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74952}
2021-06-04 17:44:01 +00:00
Manos Koukoutos
f9db82ab33 [wasm] Simplify Immediates in decoder
Changes:
- Merge all immediates which read a u32_v index into IndexImmediate.
  Refactor overloaded Validate(const byte*, [Type]Immediate) functions
  to Validate[Type](const byte*, IndexImmediate).
- Move MemoryIndexImmediate/MemoryAccessImmediate validation into their
  own Validate functions. Remove CheckHasMemory(), move its
  functionality into these Validate() functions.
- Refactor MemoryInitImmediate, TableInitImmediate and
  CallIndirectImmediate as composite immediates.
- Change field initializations for some Immediates to constructor
  initializers. This helps us drop some useless default constructors.
- Use the correct pc in StackEffect for struct.new_default.

Bug: v8:11831
Change-Id: I878f69a33f8473dc275184995b3b7b88fe0dfc8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928498
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74948}
2021-06-04 12:18:26 +00:00
Andreas Haas
1b3fbeaae1 [wasm] Update wasm spec tests
R=thibaudm@chromium.org

Change-Id: I6fcd78ffb2683ed92e056d67ec4ef792c0d2ec0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939986
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74947}
2021-06-04 10:42:06 +00:00
Vicky Kontoura
892591e1f4 [web snapshot] Introduce an ExplicitRealmScope in d8
This CL introduces an ExplicitRealmScope in d8 for entering an existing
Realm on demand.

Bug: v8:11525, v8:11706
Change-Id: I3b556aed85fc615bb5efbd4a072e075534617258
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2936602
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74946}
2021-06-04 08:48:16 +00:00
Georg Neis
928da8091f [compiler] Add a few regression tests
Tbr: nicohartmann@chromium.org
Bug: chromium:1198705, chromium:1199345, chromium:1200490
Change-Id: I4a486df636e084279423e6cd3b867137bfe3fd6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2939984
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74945}
2021-06-04 08:37:26 +00:00
Vicky Kontoura
e30cbccd54 [web snapshot] Pass exports to the serializer as a Local<PrimitiveArray>
This CL updates WebSnapshotSerializer::TakeSnapshot() to accept exports
as a Local<PrimitiveArray>.

Bug: v8:11525, v8:11706
Change-Id: Ie3a752ac7dbcc51fc4fb258eb44ce42d0cfc6a0f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930173
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#74936}
2021-06-03 12:11:56 +00:00
Deepti Gandluri
87afe62bf0 [wasm] Atomics wait operators should trap on the main thread
Bug: chromium:1190951
Change-Id: I2c314a143c77a9fee288f7822fea84f900c3059b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2921033
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74930}
2021-06-02 16:04:33 +00:00
Georg Neis
022b312d55 [heap] Don't assume that optimizing-compile-dispatcher exists
Bug: chromium:1215514, chromium:1211215
Change-Id: I6ebc1d4138d6bee66c3fd9a8369741b8df960807
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933663
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74929}
2021-06-02 16:02:13 +00:00
Clemens Backes
bef4af3ee0 Revert "Reland "[bigint] Karatsuba multiplication""
This reverts commit 81dd3f42be.

Reason for revert: Does not compile on MSVC: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20-%20msvc/18017/overview

Original change's description:
> Reland "[bigint] Karatsuba multiplication"
>
> This is a reland of 59eff3bfaa
>
> Original change's description:
> > [bigint] Karatsuba multiplication
> >
> > The Karatsuba algorithm is used for BigInts with 34 or more internal
> > digits, and thanks to better asymptotic complexity provides greater
> > speedups the bigger the inputs.
> >
> > Bug: v8:11515
> > Change-Id: I5ab0e318173ea4a02ced3f156d3c17e0259c5036
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
> > Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74916}
>
> Bug: v8:11515
> Change-Id: I5ece2ff29ef11ea304980c053887d9746cfc80bc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933497
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74922}

Bug: v8:11515
Change-Id: Ie4a80256174fc8d9f714c01f012ac2dc6247a220
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933665
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74926}
2021-06-02 15:30:04 +00:00
Shu-yu Guo
eb798db452 Reland "[weakrefs] Clear unregister token-related fields when clearing weak cells"
This is a reland of 360c7afca5

Changes since revert:
  - Read the unregister token using a relaxed read during marking

Original change's description:
> [weakrefs] Clear unregister token-related fields when clearing weak cells
>
> Bug: chromium:1213770
> Change-Id: Ic063e79bfa8f3dabdd29d1cc9ed74c7af44d0c31
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2923294
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74890}

Bug: chromium:1213770
Change-Id: I8d0b946359b85a4760113e26dbaeaa9479e3b5fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930554
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74925}
2021-06-02 14:46:43 +00:00
Vicky Kontoura
f7945e53c2 [web snapshot] Fix GC issues when deserializing functions
This CL fixes WebSnapshotDeserializer::DeserializeFunctions(), so that
the new Script is created after both the SharedFunctionInfoTable and
SharedFunctionInfo are allocated.

Also, this CL re-enables mjsunit tests for web snapshots (disabled in
https://chromium-review.googlesource.com/c/v8/v8/+/2931806).

Bug: v8:11842, v8:11525, v8:11706
Change-Id: I13503eab3fa70b128ba1faae75eed62b6c5bb636
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933145
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#74923}
2021-06-02 14:36:06 +00:00
Jakob Kummerow
81dd3f42be Reland "[bigint] Karatsuba multiplication"
This is a reland of 59eff3bfaa

Original change's description:
> [bigint] Karatsuba multiplication
>
> The Karatsuba algorithm is used for BigInts with 34 or more internal
> digits, and thanks to better asymptotic complexity provides greater
> speedups the bigger the inputs.
>
> Bug: v8:11515
> Change-Id: I5ab0e318173ea4a02ced3f156d3c17e0259c5036
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74916}

Bug: v8:11515
Change-Id: I5ece2ff29ef11ea304980c053887d9746cfc80bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933497
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74922}
2021-06-02 14:26:53 +00:00
Milad Fa
3dd195240b [sparkplug] Fix Batch compilation on unsupported platforms
Few of the changes added under https://crrev.com/c/2891656
do not compile if sparkplug is not implement on a platform.

Bug: v8:11790, v8:11421
Change-Id: Iec40e89ab56a6923b30a5567e4a49e4f1763eece
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933656
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74921}
2021-06-02 14:21:33 +00:00
Jakob Kummerow
c6cdb07854 [wasm-gc] Implement rtt.fresh_sub
This instruction is a non-standard V8-only experiment for now,
hidden behind the --experimental-wasm-gc-experiments flag.
The motivation is to provide a way to set up non-canonicalized
RTT hierarchies, to enable expressing the type system of Java-like
languages in terms of WasmGC constructs.

Bug: v8:7748
Change-Id: Idf1c18e9944c983f40f1e01b2032ee5fdc2fd81b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930478
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74920}
2021-06-02 13:45:23 +00:00
Maya Lekova
a589277ca7 Revert "[bigint] Karatsuba multiplication"
This reverts commit 59eff3bfaa.

Reason for revert: Breaks UBSan - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/16697/overview

Original change's description:
> [bigint] Karatsuba multiplication
>
> The Karatsuba algorithm is used for BigInts with 34 or more internal
> digits, and thanks to better asymptotic complexity provides greater
> speedups the bigger the inputs.
>
> Bug: v8:11515
> Change-Id: I5ab0e318173ea4a02ced3f156d3c17e0259c5036
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74916}

Bug: v8:11515
Change-Id: Ifd3d651a26441ba36a23724c6eb1a9915f6e41a8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933496
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74918}
2021-06-02 13:06:04 +00:00
Jakob Kummerow
59eff3bfaa [bigint] Karatsuba multiplication
The Karatsuba algorithm is used for BigInts with 34 or more internal
digits, and thanks to better asymptotic complexity provides greater
speedups the bigger the inputs.

Bug: v8:11515
Change-Id: I5ab0e318173ea4a02ced3f156d3c17e0259c5036
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2782283
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74916}
2021-06-02 12:35:03 +00:00
Clemens Backes
c538b9b473 Revert "[heap] Remove unused LocalSpace class"
This reverts commit b0c70710a4.

Reason for revert: Lots of compile errors.

Original change's description:
> [heap] Remove unused LocalSpace class
>
> LocalSpace was introduced for off-heap spaces with concurrent bytecode
> compilation finalization. However, finalization ended up using
> LocalHeap for concurrent allocations. LocalSpace is therefore unused
> and can be removed.
>
> This CL removes LocalSpace and renames all mentions of local space to
> compaction space. Compaction space was the only local space left.
>
> Change-Id: I12a8a2724f777a77ddb9957fe2d8e89febfebbaf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930169
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74914}

Change-Id: I3a654da0ddb556c1fb8767f8401ecd3b46786bea
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2933140
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74915}
2021-06-02 12:01:15 +00:00
Dominik Inführ
b0c70710a4 [heap] Remove unused LocalSpace class
LocalSpace was introduced for off-heap spaces with concurrent bytecode
compilation finalization. However, finalization ended up using
LocalHeap for concurrent allocations. LocalSpace is therefore unused
and can be removed.

This CL removes LocalSpace and renames all mentions of local space to
compaction space. Compaction space was the only local space left.

Change-Id: I12a8a2724f777a77ddb9957fe2d8e89febfebbaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930169
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74914}
2021-06-02 11:53:43 +00:00
Patrick Thier
6ff1129ca3 [sparkplug] Batch compilation
Instead of compiling a function with baseline immediately when the
interrupt budget is hit, we compile functions in batches to save some
memory protection flips on code pages.

This CL introduces batch compilation behind --baseline-batch-compilation
(enabled on future) and adds a flag
--baseline-batch-compilation-threshold to control the size of batches.

Bug: v8:11790

Change-Id: I3efc360424a14e4b07c6570e48860509ae59e591
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891656
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74913}
2021-06-02 11:41:33 +00:00
Manos Koukoutos
dd329e1950 [wasm-gc] Fix/simplify unreachable code validation
- Maintain the correct stack in unreachable code for all type casts.
- Compute the correct type for the pushed stack value for ref.cast.
- Check if current_code_reachable_and_ok_ instead of checking the
  popped values' types against bottom.
- Add unit tests.

Bug: v8:7748
Change-Id: I02c26f526060f40884c4ff1e541315f71d8ad90a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928191
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74912}
2021-06-02 11:24:43 +00:00
Camillo Bruni
562d00688a [mjsunit] Skip tickprocesssor end-to-end test
os.system seems to be flaky on certain bots. Disabling this until we
have a proper fix.

Change-Id: I075542772ba8eb968c96942923f76b87a2f18d47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931809
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74910}
2021-06-02 10:18:48 +00:00
Camillo Bruni
96f3103a31 [mjsunit][tools] Skip tickprocessor tests for asan
... it's too slow otherwise.

Change-Id: I5809912521cf91ca4fcdd1a0590c430e2282719c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931803
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74908}
2021-06-02 09:14:58 +00:00
Maya Lekova
5d6568ea7c [test] Disable crashing web-snapshot test
Failure link:
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/37294/overview

Started crashing after CL:
https://chromium-review.googlesource.com/c/v8/v8/+/2929382

Bug: v8:11842
No-Try: true
Change-Id: I68613a9cede8f2f90a46725e34cde87cb6e46d81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2931806
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74907}
2021-06-02 09:12:37 +00:00
Camillo Bruni
99bfa28bca Reland "[mjsunit][tools][d8] Full roundtrip tickprocessor test"
This is a reland of ed7e4554db:
- fixing platform names for tickprocessor
- UnixCppEntriesProvider => LinuxCppEntriesProvider
- MacCppEntriesProvider => MacOSCppEntriesProvider

Original change's description:
> [mjsunit][tools][d8] Full roundtrip tickprocessor test
>
> - Add os.d8Path property
> - Add os.name property
> - Change tickprocssor test to use command line arguments for testing
>   various configurations
> - Change tickprocessor test to create a temporary v8.log and read it
>   back in on linux only
> - Rearrange code in tickprocessor.mjs to allow instantiating the
>   CppEntriesProvider directly
> - Drop complete symbol-list for tickprocessor-test-large.log for better
>   code searching in V8
>
> Change-Id: Ib56dd0a1ba5377282c84c4de6f17e2fd69ee8123
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929120
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74892}

Change-Id: I5e121ba11f407af50108a2712d27c32867a22eb0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929382
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74902}
2021-06-02 07:02:48 +00:00
Camillo Bruni
73ce48ed6d [mjsunit][tools] Skip tickprocessor tests when run with simulator
These tests are too slow and we get enough coverage by running in
other configurations.

Change-Id: Ib07136b01ae1e5c57589ca97114c283258a958f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929385
Auto-Submit: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74898}
2021-06-01 21:29:17 +00:00
Clemens Backes
72564ba765 Revert "[mjsunit][tools][d8] Full roundtrip tickprocessor test"
This reverts commit ed7e4554db.

Reason for revert: new test fails on Mac: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac64/40407/overview

Original change's description:
> [mjsunit][tools][d8] Full roundtrip tickprocessor test
>
> - Add os.d8Path property
> - Add os.name property
> - Change tickprocssor test to use command line arguments for testing
>   various configurations
> - Change tickprocessor test to create a temporary v8.log and read it
>   back in on linux only
> - Rearrange code in tickprocessor.mjs to allow instantiating the
>   CppEntriesProvider directly
> - Drop complete symbol-list for tickprocessor-test-large.log for better
>   code searching in V8
>
> Change-Id: Ib56dd0a1ba5377282c84c4de6f17e2fd69ee8123
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929120
> Reviewed-by: Patrick Thier <pthier@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74892}

Change-Id: I7d7506b370f96365552a21fa767b1c5c608ebb1c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929380
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74894}
2021-06-01 18:05:08 +00:00
Shu-yu Guo
705527f839 Revert "[weakrefs] Clear unregister token-related fields when clearing weak cells"
This reverts commit 360c7afca5.

Reason for revert: TSAN https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/3437/overview

Original change's description:
> [weakrefs] Clear unregister token-related fields when clearing weak cells
>
> Bug: chromium:1213770
> Change-Id: Ic063e79bfa8f3dabdd29d1cc9ed74c7af44d0c31
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2923294
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74890}

Bug: chromium:1213770
Change-Id: I9655db1a20d983c187779199e9009f6aeb5b46df
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930553
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74893}
2021-06-01 17:41:08 +00:00
Camillo Bruni
ed7e4554db [mjsunit][tools][d8] Full roundtrip tickprocessor test
- Add os.d8Path property
- Add os.name property
- Change tickprocssor test to use command line arguments for testing
  various configurations
- Change tickprocessor test to create a temporary v8.log and read it
  back in on linux only
- Rearrange code in tickprocessor.mjs to allow instantiating the
  CppEntriesProvider directly
- Drop complete symbol-list for tickprocessor-test-large.log for better
  code searching in V8

Change-Id: Ib56dd0a1ba5377282c84c4de6f17e2fd69ee8123
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929120
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74892}
2021-06-01 17:38:37 +00:00
Milad Fa
986299250e [wasm-simd] Skip tests which require Simd enabled
These tests require Simd enabled which causes failures
on machines without the support.

They are already skipped on Mips: https://crrev.com/c/2841887

Change-Id: I4b9a9bb3cb208a0e9aa12dc135393bc515ad766e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2927210
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74891}
2021-06-01 17:09:27 +00:00
Shu-yu Guo
360c7afca5 [weakrefs] Clear unregister token-related fields when clearing weak cells
Bug: chromium:1213770
Change-Id: Ic063e79bfa8f3dabdd29d1cc9ed74c7af44d0c31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2923294
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74890}
2021-06-01 16:28:48 +00:00
Vicky Kontoura
e2ebe3b181 [web snapshot] Add more mjsunit tests
This CL adds all relevant cctests as mjsunit tests as well.

Bug: v8:11525, v8:11706
Change-Id: I2d05e21adc6f665613249b67f24695c82e2ea455
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930157
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74885}
2021-06-01 14:22:47 +00:00
Maya Lekova
6e6e10d479 [fastcall] Fix unused functions in lite mode
Change-Id: Iddb3e161535fb3639e5883443d07520fdfe06c4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930166
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74884}
2021-06-01 13:45:37 +00:00
Camillo Bruni
a345a442d3 [d8][mjsunit][tools] Improve d8 file API
- Add d8.file.read() and d8.file.execute() helpers
- Change tools and tests to use new d8.file helper
- Unify error throwing in v8::Shell::ReadFile

Change-Id: I5ef4cb27f217508a367106f01e872a4059d5e399
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928505
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74883}
2021-06-01 13:37:57 +00:00
Thibaud Michaud
2b77ca200c [wasm][liftoff] Always zero-extend 32 bit offsets
The upper 32 bits of the 64 bit offset register are not guaranteed to be
cleared, so a zero-extension is needed. We already do the zero-extension
in the case of explicit bounds checking, but this should also be done if
the trap handler is enabled.

R=clemensb@chromium.org
CC=jkummerow@chromium.org

Bug: v8:11809
Change-Id: I21e2535c701041d11fa06c176fa683d82db0a3f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917612
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74881}
2021-06-01 12:59:17 +00:00
Vicky Kontoura
def58d04ff [web snapshot] Support empty objects
This CL fixes the deserialization of the map for empty objects, so that
the initial empty map is used.

Bug: chromium:1213851, v8:11525, v8:11706
Change-Id: I37de0b147b9c89ead9c96f776e5fbf88da4630cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928192
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74880}
2021-06-01 12:58:07 +00:00
Wenyu Zhao
e1716becb2 [heap] Add a global allocation site tracking flag
This CL adds a v8_allocation_site_tracking flag to control the allocation and
tracking of memento objects.

Disables FLAG_allocation_site_pretenuring if v8_allocation_site_tracking
is disabled.

v8_enable_single_generation implies !v8_allocation_site by default.

Change-Id: Ib07528bd37d91de6bb6ea0bfea1699be4e17fae9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897326
Commit-Queue: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74879}
2021-06-01 12:44:07 +00:00
Benedikt Meurer
3740764cca [debug][cleanup] Use consistent StepInto and StepOver naming.
In the Chrome DevTools Protocol, the step actions are named StepOut,
StepOver, and StepInto, but internally we used StepOut, StepNext, and
StepIn instead. This change adjusts the naming to be consistent.

Bug: chromium:901814, chromium:1162229
Change-Id: Id3502a1b0a4aadd94734ec3d1fef73c1782fa220
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928510
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74877}
2021-06-01 11:26:57 +00:00
Camillo Bruni
dff35b65a9 [mjsunit][tools] Run tickprocessor and dumpcpp tests on fewer systems
Limit tests to release, linux and macos since they are mostly for
checking whether the tools work correctly rather than JS correctness.

Change-Id: I26e49fbda33a4dac8d774b2e03fa07ae1f2f142a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2930156
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74875}
2021-06-01 11:18:47 +00:00
Camillo Bruni
5dbd342b8d [tools] Cleanup Arguments processing in tools
- Move readFile helper to LogReader.readFile
- Add static BaseArgumentsProcessor.process helper
- Move SourceMap handling to the TickProcessor
- Always skip example file mjsunit/tools/tickprocessor-test-large.js
- Run tickprocessor and dumpcpp tests only in release mode

Change-Id: I635fb2d2839233219b058faf9710fd0f19880fd2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2929117
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74873}
2021-06-01 09:43:46 +00:00
Manos Koukoutos
9323085aa3 [wasm-gc] Add ArrayTooLarge trap
This will be thrown during array allocations if the requested size is
larger than kV8MaxWasmArrayLength.

Additional changes:
- In test-gc.cc, add the possibility to check against the trap message
  in CheckHasThrown.
- Small reorganization of WasmGCTester in test-gc.cc.

Bug: v8:7748
Change-Id: I6f74b525bd7087fcc66f43c451ef130df022b0f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922247
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74867}
2021-05-31 17:56:26 +00:00
Georg Neis
cb25099bb4 [TurboFan] Add missing BigInt case in RepresentationChanger
Bug: chromium:1212583
Change-Id: I6cce7e419b108a0d30cf4d9d9bb0ba304fb0803e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922249
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74864}
2021-05-31 15:22:06 +00:00
Mathias Bynens
c211cb43a0 [inspector] Support printing RegExps with overridden toString
Prior to this patch, regular expression objects with a monkeypatched
`toString` were printed using the `toString` result value, rather than
actually representing the regular expression’s contents.

    const re = /./;
    re.toString = () => 'whoops!';
    console.log(re);
    // → logs 'whoops!'

Now that `v8::RegExp::GetSource` properly escapes special characters in
the source pattern [1], just like `RegExp#toString`, there is no longer
any reason to avoid it.

[1]: https://chromium-review.googlesource.com/c/v8/v8/+/2900737

Bug: v8:11693
Change-Id: I9a69cdb6813f76b669bdc24e4823c6d261f2ae73
Fixed: v8:11836
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928188
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74862}
2021-05-31 13:51:56 +00:00
Maya Lekova
7261bf01d7 [fastcall] Extend the fast API interface with sequences
This CL enhances the interface of the fast C API with constants and
structs necessary for supporting JSArrays, TypedArrays and ArrayBuffers.
It also adds checks for incompatible combinations of argument type/flags.

Bug: chromium:1052746
Change-Id: I032167d0739d33f8151f78574c89d565cb9bd821
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903147
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74857}
2021-05-31 12:18:16 +00:00
Camillo Bruni
0e6263ec22 [test] Skip RuntimeCallStatsTest.GarbageCollection for gc stress tests
Bug: v8:11820
Change-Id: Iec8c75737648ca239363069511fd7783c26a5d64
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928497
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74856}
2021-05-31 12:10:56 +00:00
Thibaud Michaud
ca1a2cfb39 [wasm][interpreter][eh] Fix unreachable ref
The delegate instruction is executed when an exception is thrown, not
after the last instruction of the block. Handle reachability
accordingly.

R=ahaas@chromium.org

Bug: chromium:1212396
Change-Id: I55e342cd73da44142cfbad7e16ab65ef513e6a60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928499
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74855}
2021-05-31 11:58:46 +00:00
Patrick Thier
67e97125eb [api] Properly escape RegExp source
Change API RegExp::GetSource to return a string identical to ToString()
and RegExp.prototype.source.

Bug: v8:11693
Change-Id: I3d148883fe6f8a3ff49e552ddd72b1e92f52baf3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900737
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74854}
2021-05-31 10:17:56 +00:00
Vicky Kontoura
819d3cb57a [web snapshot] Refactor mjsunit tests
This CL refactors mjsunit tests, so that the common core of all tests is
abstracted away.

Bug: v8:11525, v8:11706
Change-Id: I24a1af4298380e21a64e4d17149422c32fbf8a4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2914882
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#74853}
2021-05-31 09:43:16 +00:00
Maya Lekova
8c9c0cf77f [test] Skip flaky cpu profiler test
Bug: v8:10996
No-Try: true
Change-Id: Ic75702e2d9db17762b21cd3d90e6fbf461c634bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928178
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74852}
2021-05-31 09:22:16 +00:00
Victor Gomes
456855a476 [Object.hasOwn] Implementation Object.hasOwn tc39 proposal
Bug: chromium:1213927
Change-Id: I11729540d9f20b437411f0b9f8077be2a7f066b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922117
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74850}
2021-05-31 08:46:56 +00:00
Lu Yahan
90363c7ac9 [ptr-compr][riscv64] Implement pointer compression
And add s10 to scratch_register_list. Clean up t* register used in macroassembler

Bug: v8:7703

Change-Id: Ib8477cd7528b8c2a2297da3f46659f30af45286e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2914246
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/master@{#74841}
2021-05-28 10:06:15 +00:00
Michael Lippautz
f19e2e68c6 cppgc: Use reference instead of pointers in HeapVisitor
Bug: v8:11822
Change-Id: I35f3b5ce71ab5f86a5d9991bb9d729a2fe56f6dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919955
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74840}
2021-05-28 09:13:55 +00:00
Paolo Severini
3e12e60a27 [fastcall] Resolve CFunction overloads based on arity
To support Fast API calls with overloads, implement compile-time
function resolution based on the number of arguments passed to the JS
function.

Bug: v8:11739
Change-Id: I96839dc0b6fc540eff94573ac9e77f678908fc3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901249
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74837}
2021-05-27 21:30:55 +00:00
Omer Katz
88e5b8f503 cppgc, heap: Implement UMA reporting for cppgc library.
This CL does 2 things:
1) Implements forwarding of histogram reporting from cppgc to v8 via
CppHeap.
2) Establishes the pipeline in GCTracer for sending the histograms to
the embedder.

Currently only cppgc histograms are populated.

See crrev.com/c/2916956 for usage.

Bug: chromium:1154636
Change-Id: I8150116f757e105d0dfac96a3f6e7dd95717f5bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917033
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74830}
2021-05-27 16:02:35 +00:00
Georg Neis
d9328fe69d Fix FeedbackNexus::SetSpeculationMode
This function broke abstraction and as a result became incorrect when
the call feedback was extended with the CallFeedbackContent flag.

Bug: v8:11821, v8:9974
Change-Id: Ic40dc45440a697a554d015dd50f0178e79963920
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919820
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74823}
2021-05-27 14:39:03 +00:00
Vicky Kontoura
6f14b897e5 [web snapshot] Mark flag as experimental
This CL renames the --d8-web-snapshot-api flag to explicitly mark it as
experimental, so that it is ignored by fuzzers.

Bug: v8:11525, v8:11706
Change-Id: Iff8a9d5697b60d0ade841773d1f0b537fcb19b70
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922109
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#74820}
2021-05-27 12:55:18 +00:00
Igor Sheludko
1decfe647f Regression test for http://crbug/1195977
Bug: chromium:1195977
Change-Id: Ic2fe906be7d700701f402c7bfb36c42f5a93ce24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919824
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74818}
2021-05-27 12:43:13 +00:00
Igor Sheludko
64b7d34f42 Regression test for http://crbug/1201938
Bug: chromium:1201938
Change-Id: I5b2540f9bd817ab1a7b1f31bbf5e7eadbd1a004c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922108
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74816}
2021-05-27 12:29:43 +00:00
Michael Lippautz
c80331af72 cppgc: Fix snapshot unittest
Bug: chromium:1056170
Change-Id: I84bc0f77ac4a27d310416bb00c4caf7fa3d76551
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2922104
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74815}
2021-05-27 11:36:23 +00:00
Clemens Backes
2542ce2562 Move DISABLE_ASAN macro to base/sanitizer/asan.h
Bug: chromium:1056170
Change-Id: I09c6764c62cb459f3cfe317508bbc663debb66b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919961
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74813}
2021-05-27 11:03:23 +00:00
Frank Tang
6da3dc6e3c Implement "Extend TimeZoneName Option Proposal"
https://tc39.es/proposal-intl-extend-timezonename/
https://chromestatus.com/guide/edit/4506375298220032

Bugs: v8:11661

Change-Id: I6d7e1bccf5a26ca02d39dc72d9362134a60ad6b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2757899
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74809}
2021-05-27 08:49:22 +00:00
Manos Koukoutos
dfdc8f6879 [wasm-gc] Implement array.copy (experimental)
Changes:
- Add --experimental-wasm-gc-experiments flag.
- Add array.copy opcode. Implement it in decoding and code generation
  behind the new flag.
- Add WasmCodeBuilder::BoundsCheckArrayCopy. Move BoundsCheckArray to
  the private section.
- Add WasmArrayCopy and WasmArrayCopyWithChecks builtin.
- Add WasmArrayCopy runtime function.
- Add WasmArray::ElementSlot.
- Always print two hex digits in CHECK_PROTOTYPE_OPCODE.
- In test-gc, print the thrown-error message if the function should not
  throw.
- In test-gc, add GetResultObject with one argument.

Bug: v8:7748
Change-Id: I58f4d37e254154596cdef5e78482b55260dd3782
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912729
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74806}
2021-05-27 08:46:08 +00:00
Derek Tu
115db49c25 [riscv64] Add RVC Instr CB and fix some RVC Instr CA
Adds the following CB type RISC-V instructions to the assembler:
c.beqz, c.bnez, c.andi, c.srai, c.srli. Also removes sext_xlen
from RVC instructions c.xor, c.or, c.and.

Change-Id: I96ce4693019c28235ccd4f85d0a68ca89a3f4096
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912922
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74801}
2021-05-27 01:52:40 +00:00
Manos Koukoutos
85a5e2089a Reland "Reland "[wasm][bug] Fix a couple of bugs in validation of unreachable code""
This is a reland of 916eb86952

Change compared to original:
Remove ternary operator from lambda, as this triggers a gcc bug.

Original change's description:
> Reland "[wasm][bug] Fix a couple of bugs in validation of unreachable code"
>
> This is a reland of 4a037f871e
>
> Changes compared to original change: None. This seems not to create
> problems after all.
>
> Original change's description:
> > [wasm][bug] Fix a couple of bugs in validation of unreachable code
> >
> > Changes:
> > - SetBlockType now instantiates the block's start merge with values of
> >   the correct type in unreachable code.
> > - EnsureStackArguments now keeps the existing stack values and moves
> >   them over the new bottom values.
> > - Drop stack size validation in Drop().
> > - Add new tests in unreachable-validation.js.
> >
> > Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733
> > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74650}
>
> Change-Id: Id620f7fb6677b772b0dcfd38108256384db44439
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905598
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74677}

Bug: v8:11819
Change-Id: I9b8d915547ec9aee7cb5233937089d431db54c8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919833
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74797}
2021-05-26 18:24:29 +00:00
Igor Sheludko
ddc43d9cad [wasm-gc][ic] Support WasmObjects in LoadIC
Bug: v8:11804
Change-Id: I6eddf2d836c3916622768ef2a7d878157e89e4c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2772980
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74796}
2021-05-26 17:49:49 +00:00
Igor Sheludko
db245ed83a [wasm-gc] Support WasmObject field loading in runtime
The new functionality is hidden behind the --wasm-gc-js-interop flag.

Bug: v8:11804
Change-Id: I9dd779efe3dbf3c773948b6fd8872e3aea8cd7a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912784
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74790}
2021-05-26 15:03:19 +00:00
Omer Katz
c2d5e408b5 cppgc: Reduce noise and increase tolerance in flaky test
Bug: v8:11367
Change-Id: I2d21d3deea73a9930acb3bf2efd3268ec1fd64b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2919830
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74788}
2021-05-26 13:35:09 +00:00
Michael Lippautz
1924e5b9db cppgc: Returns BasePage::space() as reference
Also change:
- {NormalPageSpace, LargePageSpace}::From()
- ObjectAllocator::*

Bug: v8:11822
Change-Id: I78a1a5379e16fc1e1c95136d7aa8cc34caed0413
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917042
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74784}
2021-05-26 11:46:10 +00:00
Vicky Kontoura
c32ba7e04d [web snapshot] Support mjsunit tests
This CL adds support for testing web snapshots through mjsunit tests.
To allow for taking and using web snapshots from JavaScript, two
methods, Realm.takeWebSnapshot() and Realm.useWebSnapshot(), are
introduced in d8.

Both of these methods accept a Realm as a parameter, allowing for
mjsunit tests to create and use the snapshot in different realms.

To return the snapshot data, Realm.takeWebSnapshot() creates and
returns a snapshot object with the snapshot data stored as an embedder
field.

Bug: v8:11525, v8:11706
Change-Id: I6e514e10eabf5bdb96d81e2697d4ddc49d92de73
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905610
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#74783}
2021-05-26 11:37:42 +00:00
Jakob Gruber
1f89ee1fb3 Revert "Reland "[wasm][bug] Fix a couple of bugs in validation of unreachable code""
This reverts commit 916eb86952.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20gcc/11805/overview

Original change's description:
> Reland "[wasm][bug] Fix a couple of bugs in validation of unreachable code"
>
> This is a reland of 4a037f871e
>
> Changes compared to original change: None. This seems not to create
> problems after all.
>
> Original change's description:
> > [wasm][bug] Fix a couple of bugs in validation of unreachable code
> >
> > Changes:
> > - SetBlockType now instantiates the block's start merge with values of
> >   the correct type in unreachable code.
> > - EnsureStackArguments now keeps the existing stack values and moves
> >   them over the new bottom values.
> > - Drop stack size validation in Drop().
> > - Add new tests in unreachable-validation.js.
> >
> > Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733
> > Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74650}
>
> Change-Id: Id620f7fb6677b772b0dcfd38108256384db44439
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905598
> Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74677}

Tbr: manoskouk@chromium.org
Change-Id: Ia24aa453735464bdd3aafca4617beabb0cbf8823
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917601
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74771}
2021-05-26 07:27:13 +00:00
Paolo Severini
9e4c05a8bb Fix failing mjsunit/compiler/call-with-arraylike-or-spread*
Fixes an issue with tests mjsunit/compiler/call-with-arraylike-or-spread*
that fail when run with the fuzzer.

Bug: v8:11821
Change-Id: I6b75c065397d66062a7f552198ca92d151d89a4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917814
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74764}
2021-05-25 19:02:15 +00:00
Georg Neis
ec6134a4c7 Reland "[compiler] Remove one ObjectRef constructor"
This reland is a manual revert of the previous revert
(commit 815bab9faa). Manual
due to merge conflicts. No other changes.

Original change's description:
> [compiler] Remove one ObjectRef constructor
>
> Remove the handle-taking ObjectRef constructor in favor of
> (Try)MakeRef as bottleneck.
>
> Bug: v8:7790
> Change-Id: I3cc3a1dcef4bac53a91c573d1a532332b88c6eb4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883664
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74593}

Bug: v8:7790
Tbr: jgruber@chromium.org
Change-Id: Iafc68f68df06ca9f404427d272b663c218d6550a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917039
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74757}
2021-05-25 16:38:45 +00:00
Michael Lippautz
69dd0c140c cppgc: Use reference instead of pointers when guaranteed not-null
Switches internals of BasePage and some getters to references that are
guaranteed non-null.

Bug: v8:11822
Change-Id: I484c4451720dc7e04f8b89dbe4fef03a3eaf817e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917038
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74756}
2021-05-25 16:33:25 +00:00
Ulan Degenbaev
8788721ed1 [test] Do not stress GC in RuntimeCallStatsTest.GarbageCollection
The test performs manual GC with custom GC flags.

Bug: v8:11820
Change-Id: I717411b3c32e468066060e8c4cb8b794a2fe219f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2917035
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74750}
2021-05-25 14:41:42 +00:00
Ulan Degenbaev
9d9bbddf8c Reland "[test] Re-enable test-heap/OutOfMemory* test"
This is a reland of 83c11a308f

Original change's description:
> [test] Re-enable test-heap/OutOfMemory* test
>
> The underlying issue was fixed in
> https://chromium-review.googlesource.com/c/v8/v8/+/2505724
>
> Bug: v8:7605,v8:8296
> Change-Id: I4a35fd4b73f86934a9d1339655433e2d4c26bd53
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912890
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74729}

Bug: v8:7605
Bug: v8:8296
Change-Id: I734ad0424d8432d01bf1d1701a232f4535b32569
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2916817
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74749}
2021-05-25 14:36:33 +00:00
Igor Sheludko
f051293f5e [wasm-gc] Make WasmObject a subclass of JSReceiver
This is a first step towards supporting unwrapped WasmObject objects on
JavaScript side.

In addition this CL
1) introduces Representation::WasmValue which is used for all WasmObject
   fields exposed to JavaScript side.
2) adds creation of meaningful DescriptorArrays for WasmObject's Maps.

Bug: v8:11804
Change-Id: I4afcd39da5cb77b659943da54a2ca34d13bcc9bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912776
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74744}
2021-05-25 12:11:42 +00:00
Clemens Backes
2d04a6275e [wasm] Clean up spec'ed max memory vs dynamic max
There are two different limits for the maximum memory size in
WebAssembly:
1) A 4GB limit which is the same on all platforms, and is observable for
JS programs. It is used to limit the allowed declared maximum size of a
wasm memory.
2) A potentially lower limit (2GB on 32-bit systems, 4GB otherwise)
which can be further limited using a command-line flag. This limit is
used whenever actually allocating or growing a wasm memory. This limit
is not directly observable, but we make sure that no wasm memory will
ever be bigger than this limit.

The second limit is the one we should check against when allocating or
growing memory, while the first limit should be used when validating
a module (or the parameters for WebAssembly.Memory). The compiler can
rely on no memory being bigger than the second limit, which again is
never bigger than the first limit.

This CL adds some more documentation to the two limits, and cleans up
all usages.
This also makes {kPlatformMaxPages} and {kMaxMemoryPagesAtRuntime}
obsolete.

R=jkummerow@chromium.org

Bug: chromium:1207263
Change-Id: I43541aafd3f497d1c368bd9400e9bc667bdfd3d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910787
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74742}
2021-05-25 11:49:32 +00:00
Ulan Degenbaev
e46ce494e1 [test] Fix unittests/RuntimeCallStatsTest.GarbageCollection
The previous fix force --single-threaded-gc, but that has no effect
without reapplying flag implication as done in this fix.

Bug: v8:11413
Change-Id: Iecb2d74c7eb8322638dcc843723c560dcbb7bf50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912892
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74741}
2021-05-25 11:11:13 +00:00
Mythri A
d8c6aa70b1 [d8] Fix d8 to always return a global proxy for Realm.Global
Bug: chromium:1197053, chromium:324812
Change-Id: I2cccabf838e3a3acbb3adfed33aa59400ec91b11
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2821547
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74740}
2021-05-25 10:52:07 +00:00
Clemens Backes
95af09e634 Revert "[test] Re-enable test-heap/OutOfMemory* test"
This reverts commit 83c11a308f.

Reason for revert: Test is consistently timing out on TSan: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36827/overview

Original change's description:
> [test] Re-enable test-heap/OutOfMemory* test
>
> The underlying issue was fixed in
> https://chromium-review.googlesource.com/c/v8/v8/+/2505724
>
> Bug: v8:7605,v8:8296
> Change-Id: I4a35fd4b73f86934a9d1339655433e2d4c26bd53
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912890
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74729}

Bug: v8:7605
Bug: v8:8296
Change-Id: Ie1dab9bef269ac980dcd2663c76f80713a68d9d6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910631
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74738}
2021-05-25 10:48:14 +00:00
Ulan Degenbaev
32d5c4cfda Re-enable mozilla/ecma/Date/15.9.5.26-1 on arm64
Bug: v8:3716
Change-Id: Id884bf17dd4173546012aabe24263dac6d68b620
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910782
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74736}
2021-05-25 09:20:52 +00:00
Dominik Inführ
f6ac5064ba Reland "[heap] Disable the young generation in shared heaps"
This is a reland of 1186fc5008

This reland fixes NewSpaceAllocationTopAddress() and
NewSpaceAllocationLimitAddress() by returning nullptr if no new space
is available. This is okay since those are never used later on.

We can't make this a build-time flag because we may only want to disable
the new space for the shared heap.

Original change's description:
> [heap] Disable the young generation in shared heaps
>
> A shared heap will not have a young generation in the beginning.
>
> Bug: v8:11708
> Change-Id: I947ddb91a23a72a8cee3aa3e554723dda8146011
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891569
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74697}

Bug: v8:11708
Change-Id: I254b919f7076ce624d15c924e63cbde5eb4df749
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912731
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74735}
2021-05-25 09:19:32 +00:00
Ross McIlroy
1dd70d42b7 [compiler] Add back EarlyGraphTrimming.
Trimming is required before the Typer phase to ensure that all nodes
that might be reached via use links have been typed.

Add this phase back on the (background thread) OptimizeGraph
step instead of the (main-thread) CreateGraph phase since there
is no need to do it on the main thread.

BUG=chromium:1212244

Change-Id: I136aadb62d623c8f1898e4e9c0441266d5690be6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912709
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74733}
2021-05-25 09:06:42 +00:00
Ulan Degenbaev
3e0f116b67 [test] Re-enable test-mark-compact/MarkCompactCollector on arm
Bug: v8:3742
Change-Id: Ib63b7bacac07456dc1d7bf496b67980a34be306c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912883
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74731}
2021-05-25 08:04:02 +00:00
Ulan Degenbaev
83c11a308f [test] Re-enable test-heap/OutOfMemory* test
The underlying issue was fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/2505724

Bug: v8:7605,v8:8296
Change-Id: I4a35fd4b73f86934a9d1339655433e2d4c26bd53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912890
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74729}
2021-05-25 07:50:52 +00:00
Ulan Degenbaev
4d7e6f4ce7 [test] Make cctest/test-spaces/OldLargeObjectSpace more robust
The test has a loop that allocates large objects until it gets an
allocation failure. The test then asserts that the subsequent allocation
should also fail. That however does not necessarily hold because the
previously allocated objects may be collected to free up the space.

This change creates a handle for each allocated object. It also
restricts the size of the heap to 20MB to reduce memory consumption.

Bug: v8:11172
Change-Id: Ic3dc1a0f5f235b0313bab2071546b59a77bd55e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912884
Auto-Submit: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74728}
2021-05-25 07:48:02 +00:00
Andreas Haas
fc29fa8f2f [wasm] Validate type of ref.null in init expressions
With this CL it is not possible anymore to initialize a func ref table
with extern ref ref.null.

R=manoskouk@chromium.org

Change-Id: If6023da6fc21844dd813cc6191f2a4ca595f8b00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912577
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74727}
2021-05-25 07:30:02 +00:00
Paolo Severini
baa8c6e5de Fix lite-mode buils broken by Generalize CallWithArrayLike optimization
Lite-mode builds were broken by
https://chromium-review.googlesource.com/c/v8/v8/+/2805623
[compiler] Generalize CallWithArrayLike optimization
This patch fixes the build.

Bug: v8:9974
Change-Id: I07530307e321a260a5d8ff59ab2c440764ebfc41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2915678
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74726}
2021-05-25 07:07:12 +00:00
Paolo Severini
fed41a9235 [compiler] Generalize CallWithArrayLike optimization
CallWithArrayLike was optimized in TF only for 'arguments' in inlined
functions. Here we add logic to optimize also in non inlined functions,
enabling the rewriting of Function.prototype.apply(f, [1, 2, 3])
as f(1, 2, 3).

Bug: v8:9974
Change-Id: Icc9ccfc2276f75d06755176b55e7a02ddfdb04ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2805623
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74723}
2021-05-24 19:44:36 +00:00
Georg Neis
3871f04891 [compiler] Add --no-always-opt to Flags line of a test
Bug: v8:11805
Change-Id: Ieb366a45ef0bdb69a64b4e3cc7b0715d7617141d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2912592
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74716}
2021-05-21 16:05:08 +00:00
Michael Achenbach
ee56a9863e [test] Run heavy tests sequentially
This adds a new status file indicator "HEAVY" to mark tests with high
resource demands. There will be other tests running in parallel,
but only a limited number of other heavy tests. The limit is
controlled with a new parameter --max-heavy-tests and defaults to 1.

The change also marks a variety of tests as heavy that recently had
flaky timeouts. Heavy also implies slow, hence heavy tests are
executed at the beginning with a higher timeout like other slow tests.

The implementation is encapsulated in the test-processor chain. A
new processor buffers heavy tests in a queue and adds buffered tests
only if other heavy tests have ended their computation.

Bug: v8:5861
Change-Id: I89648ad0030271a3a5af588ecc9c43285b728d6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905767
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74712}
2021-05-21 12:59:49 +00:00
Ross McIlroy
55cbb2ce3b Remove one-shot function optimizations.
They have been disabled for some time and are superseeded by lazy
feedback vector allocation.

Change-Id: Iafc3989b0c1f866ce7d6295d9b13ccaa5ef1c115
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905609
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74711}
2021-05-21 12:38:18 +00:00
Andreas Haas
c4cf087a1d [wasm] Update spec tests
R=ecmziegler@chromium.org

Change-Id: Ibe9b1793a60d21ba853501b19c53647be5321288
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2910786
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74710}
2021-05-21 12:13:03 +00:00
Manos Koukoutos
e916c7d7c4 [wasm-gc] Implement br_on_non_{func, data, i31}
Additional changes:
- Clean up liftoff implementation of br_on_*.
- Bundle operations everywhere based on operation rather than type.
- Remove reference argument from WASM_BR_ON_* macros, to bring them in
  sync with WASM_BR_ON_CAST.
- Add missing function decoding unittests for br_on_*.

Bug: v8:7748
Change-Id: I5f5ebfac5b50b5a9a201acb435344d7471326242
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2909857
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74709}
2021-05-21 12:11:58 +00:00
Santiago Aboy Solanes
4636b43bdb [cleanup] Remove synchronized_ from slot_count and used accessors
Continuing the cleanups and using the tags rather than synchronized_
in the name of the accessors.

Bug: v8:7790
Change-Id: I3fe942b1decae3b248f8662547d793777acd0e8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897096
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74700}
2021-05-20 15:19:48 +00:00
Sathya Gunasekaran
bd32997620 Revert "[heap] Disable the young generation in shared heaps"
This reverts commit 1186fc5008.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20UBSan/16531/overview

Original change's description:
> [heap] Disable the young generation in shared heaps
>
> A shared heap will not have a young generation in the beginning.
>
> Bug: v8:11708
> Change-Id: I947ddb91a23a72a8cee3aa3e554723dda8146011
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891569
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74697}

Bug: v8:11708
Change-Id: I8de67f70b00b5bd3066659e07fb1fd3ecfb76211
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2909693
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74699}
2021-05-20 14:09:09 +00:00
Dominik Inführ
1186fc5008 [heap] Disable the young generation in shared heaps
A shared heap will not have a young generation in the beginning.

Bug: v8:11708
Change-Id: I947ddb91a23a72a8cee3aa3e554723dda8146011
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891569
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74697}
2021-05-20 13:28:08 +00:00
Clemens Backes
3871bc8466 Fix unaligned access in Relaxed_Memcpy
The old code was relying on identical alignment of both the source and
the destination of the Relaxed_Memcpy. This is not always given, thus
check for alignment of both.

R=mlippautz@chromium.org

Bug: chromium:1208782, v8:11704
Change-Id: Ic5dca3a5f0ecaea0df6eb123105520bd7785853c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905611
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74694}
2021-05-20 10:50:00 +00:00
Ulan Degenbaev
350be8d461 [test] Re-enable ReleaseStackTraceData with --always-opt
Change-Id: Idbe26a82ba0e208985ab2b1e5b85c6f98c3ec925
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844663
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74692}
2021-05-20 10:34:39 +00:00
Georg Neis
a08820c10e [compiler] Add simple mjsunit test using %VerifyType
Also make the output more helpful in the error case.

Bug: v8:11724
Change-Id: Ibb8bd328f936f3d4f847ba7e14adf9c30b9460f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903158
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74691}
2021-05-20 10:10:59 +00:00
Andreas Haas
6d08c94cb5 [wasm][debug] Provide WebAssembly Table entries to DevTools
With this CL, V8 adds an internal field to the WebAssembly Table object
that is sent to DevTools to also show table entries. As WebAssembly
Tables get initialized lazily, V8 only shows the name of the function
instead of the function object itself.

Screenshot before change: https://imgur.com/a/XFvy3lA
Screenshot after change: https://imgur.com/kT84kst
R=kimanh@chromium.org

Change-Id: I56a0b07785ff3484f1447419fe39ae5ec3f93247
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897097
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74690}
2021-05-20 09:59:09 +00:00
Manos Koukoutos
e90c366be4 Reland "[wasm-gc] Implement br_on_cast_fail"
This is a reland of 8f39a58586

Changes compared to original:
Change the type of arguments of WASM_I32V from byte to int for MSVC
compatibility.

Original change's description:
> [wasm-gc] Implement br_on_cast_fail
>
> Bug: v8:7748
> Change-Id: I7894ad51ccf8ac41a5081c272a583a4ff25c1835
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900225
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74652}

Bug: v8:7748
Change-Id: I39f39ff6979382f5618683a8e7754f56df4ec9e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905599
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74689}
2021-05-20 09:35:09 +00:00
Luis Fernando Pardo Sixtos
3ef42c03d0 Refactor of ScopeInfo::ContextSlotIndex
Refactoring ScopeInfo::ContextSlotIndex so it accepts a pointer to
LookupResult instead of references to the individual arguments.

Change-Id: I52bc7800f14e790bd4788c213ab0eff2354ab20e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900837
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74683}
2021-05-19 18:12:40 +00:00
Manos Koukoutos
916eb86952 Reland "[wasm][bug] Fix a couple of bugs in validation of unreachable code"
This is a reland of 4a037f871e

Changes compared to original change: None. This seems not to create
problems after all.

Original change's description:
> [wasm][bug] Fix a couple of bugs in validation of unreachable code
>
> Changes:
> - SetBlockType now instantiates the block's start merge with values of
>   the correct type in unreachable code.
> - EnsureStackArguments now keeps the existing stack values and moves
>   them over the new bottom values.
> - Drop stack size validation in Drop().
> - Add new tests in unreachable-validation.js.
>
> Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74650}

Change-Id: Id620f7fb6677b772b0dcfd38108256384db44439
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905598
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74677}
2021-05-19 15:30:01 +00:00
Benedikt Meurer
ea3ee6da79 [inspector] Derive breakpoint hint based on resolved location.
When setting a breakpoint on a line (in the DevTools front-end), the
front-end sends a columnNumber of 0 and the inspector automatically
resolves the actual location (in bytecode execution order). In order
to also support changing source code, the inspector memorizes a text
hint, and uses that to adjust the location upon reload. This hint was
however taken based on the original line and column numbers, rather than
the resolved location, which causes trouble when syntactic order doesn't
match execution order, as in case of `await o.m()`.

In order to address that we now remember the textual hint based on the
resolved location.

Fixed: chromium:1081162
Also-By: kimanh@chromium.org
Change-Id: I7d08373440693b7abc18c29c1a05929d771d3031
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905606
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74675}
2021-05-19 14:46:57 +00:00
Omer Katz
2c80e71484 cppgc: Check mark bit on assignment from prefinalizer.
Check that the marked bit of an object is set if assigned during a
prefinalizer to a Member in a live object or a Persistent.

Bug: v8:11749
Change-Id: I993c0d226a4157698591e1f7bc0c55e5c79239b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897093
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74672}
2021-05-19 14:17:38 +00:00
Patrick Thier
da300746b4 [test] Skip baseline for variant stress_concurrent_inlining
We compile with Sparkplug when we allocate the feedback vector with lazy
feedback vector allocation. --stress-concurrent-inlining implies
--no-lazy-feedback-allocation, so it doesn't make sense to run
baseline tests with this variant.

Change-Id: I7fd4c2b11cf2a9bb29d6f78c5973aed80abab85e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903118
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74669}
2021-05-19 12:58:18 +00:00
Michael Lippautz
0052640ef2 cppgc: Avoid double-accounting live bytes through Steele barrier
The barrier just re-added a black object to the worklist (making it
gray) which results in double-accounting live bytes.

Trace directly as the barrier is not widely used.

Bug: chromium:1056170
Change-Id: I06a55c13f6e82652ad1939a12c4e23f3a3ebd3fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904212
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74668}
2021-05-19 12:53:12 +00:00
Clemens Backes
98ecaf6091 [cctest] Test SharedMutex plus sampling
The combination of pthread_rwlock_t and signals causes spurious
deadlocks on Mac (see linked issue).
This adds a cctest which tests this combination. This test is skipped on
Mac, where it would deadlock. This test can be used to document and
further investigate the issue, and test potential fixes.

R=jkummerow@chromium.org

Bug: v8:11399
Change-Id: I5d1fcdd84db253ec2d0637575239f212aae2ecb7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2856553
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74662}
2021-05-19 12:11:28 +00:00
Manos Koukoutos
1d0719c7fe [wasm][fuzzer] Integrate wasm-module-builder.js changes
Recent changes in wasm-module-builder.js were not translated to the
fuzzer JS output. After this CL, the fuzzer should generate .js files
that output back the fuzzed module.

Change-Id: I8bc33ab7f4f838a519c7aa47e425d8ac65b88d45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2904217
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74659}
2021-05-19 12:07:08 +00:00
Sathya Gunasekaran
fc91261600 Revert "[wasm-gc] Implement br_on_cast_fail"
This reverts commit 8f39a58586.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64%20-%20msvc/17874/blamelist

Original change's description:
> [wasm-gc] Implement br_on_cast_fail
>
> Bug: v8:7748
> Change-Id: I7894ad51ccf8ac41a5081c272a583a4ff25c1835
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900225
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74652}

Bug: v8:7748
Change-Id: I90ca2d789e943cd00c2344e2d333c9175fcedee5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903482
Auto-Submit: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74658}
2021-05-19 10:50:09 +00:00
Manos Koukoutos
2e09d7eb95 Revert "[wasm][bug] Fix a couple of bugs in validation of unreachable code"
This reverts commit 4a037f871e.

Reason for revert: Bot failures, including MSVC compilation.

Original change's description:
> [wasm][bug] Fix a couple of bugs in validation of unreachable code
>
> Changes:
> - SetBlockType now instantiates the block's start merge with values of
>   the correct type in unreachable code.
> - EnsureStackArguments now keeps the existing stack values and moves
>   them over the new bottom values.
> - Drop stack size validation in Drop().
> - Add new tests in unreachable-validation.js.
>
> Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74650}

Change-Id: Icb16af9a8ed16e593fe345ab727b992d9c9b1500
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2905597
Auto-Submit: Manos Koukoutos <manoskouk@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74657}
2021-05-19 10:38:09 +00:00
Marja Hölttä
587a04f02a [rab/gsab] Simplify BackingStore::ResizeInPlace
The logic is different for shared and non-shared memory, so it's
cleaner to have different functions for them.

Bug: v8:11111
Change-Id: I95d43b54c207b8059ea59d6d0f873623de946be3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903152
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74656}
2021-05-19 09:49:48 +00:00
Manos Koukoutos
8f39a58586 [wasm-gc] Implement br_on_cast_fail
Bug: v8:7748
Change-Id: I7894ad51ccf8ac41a5081c272a583a4ff25c1835
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900225
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74652}
2021-05-19 07:10:48 +00:00
Manos Koukoutos
4a037f871e [wasm][bug] Fix a couple of bugs in validation of unreachable code
Changes:
- SetBlockType now instantiates the block's start merge with values of
  the correct type in unreachable code.
- EnsureStackArguments now keeps the existing stack values and moves
  them over the new bottom values.
- Drop stack size validation in Drop().
- Add new tests in unreachable-validation.js.

Change-Id: Ie68b3d9abb0a41d1623d4a123fb526e71941c4e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902733
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74650}
2021-05-19 06:58:48 +00:00
Manos Koukoutos
ece98870b7 [wasm][bug] Fix global.get in element segments
We used to verify its index as if it was a function index.

Bug: chromium:1210447

Change-Id: I5e015b1b11b22b6b7e7e13dac4945f8eb6f3d846
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903153
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74649}
2021-05-19 06:12:58 +00:00
Jakob Gruber
b457c6845f Add --no-concurrent-inlining to finalizationregistry test
The test relies on deterministic GC behavior.

Bug: v8:11771
Change-Id: I4c04f683ca51e0849e11736c97a2f2342977cc36
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902735
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74639}
2021-05-18 14:17:07 +00:00
Jakob Gruber
24ff68e8bc Reland "[compiler] Consider IsPendingAllocation in Ref construction"
This is the second reland of 4683d6fe52

Initial CL:   crrev.com/c/2874663
First reland: crrev.com/c/2886861

The first reland fixes Ref construction failures in:
- MapRef::instance_descriptors
- NativeContext reads (see also crrev.com/c/2891575)

The second reland (this CL):
- Adds required infrastructure (e.g. kAssumeMemoryFence) but
  without enabling the IsPendingAllocation check. Enabling the check
  will be done separately to avoid further revert chains.

Original change's description:
> [compiler] Consider IsPendingAllocation in Ref construction
>
> The logic in JSHeapBroker::TryGetOrCreateData assumes that parts
> of the object are safe to read. In particular, the instance type
> must be readable for the chain of `Is##Name()` type checks.
>
> This is guaranteed if
>
>  - a global memory fence happened after object initialization and
>    prior to the read by the compiler; or
>  - the object was published through a release store and read through
>    an acquire read.
>
> The former is protected by the new call to ObjectMayBeUninitialized
> (which internally calls IsPendingAllocation) in TryGetOrCreateData.
>
> The latter must be marked explicitly by calling the new
> MakeRefAssumeMemoryFence variant.
>
> Note that support in this CL is expected to be incomplete and will
> have to be extended in the future as more cases show up in which
> MakeRef calls must be converted to MakeRefAssumeMemoryFence or to
> TryMakeRef.
>
> Bug: v8:7790,v8:11711
> Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74474}

Bug: v8:7790,v8:11711,chromium:1207680,chromium:1207679
Change-Id: I123b2962df724a13dd2c7334ae949234bc3bf27a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902738
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74638}
2021-05-18 14:03:57 +00:00
Patrick Thier
98ba4acc89 [test] Skip baseline for variant no_lfa
We compile with Sparkplug when we allocate the feedback vector with lazy
feedback vector allocation.
With --no-lazy-feedback-allocation, it doesn't make sense to run
baseline tests.

Change-Id: Ib71e8624531ba927680e83c2e813c0886c460da4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903148
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74637}
2021-05-18 13:46:17 +00:00
Michael Achenbach
5abe0ffe6b [test] Mark slow tests
No-try: true
Bug: v8:11784
Change-Id: I7d40cbead84d27a7783d3e05eeedcc8ea7597bc0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2903151
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74636}
2021-05-18 13:42:17 +00:00
Michael Lippautz
e54c81a410 cppgc: Add build time option to verify live bytes
The marking verifier already traverses the whole heap using page
iteration. Add an option to allow checking that the verifier pass
finds the same amount of live bytes as the marker traversal.

Bug: chromium:1056170
Change-Id: I1dc4cd0c04147b8cd3e3eb7678276b665336e615
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902724
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74630}
2021-05-18 10:03:06 +00:00
Michael Lippautz
69be929b64 cppgc: Fix marked bytes accounting for weak containers
Conceptually, Oilpan uses tri-color marking even though the
implementatin only uses a single mark bit. The difference between gray
and black is represented by the fact that an objet is contained within
a worklist.

Live bytes are accounted on gray->black transition and must only
happen once. This is generally implemented when retrieving an object
from the work list and processing it.

For weak containers this CL fixes the following issues:

1. Weak containers that are strongified during stack scanning were
   double accounted as they were just added to the marking worklist.
   Instead, directly process them during stack scanning.
2. Accounting was missing in case of purely weak collections without
   ephemeron tracing. In such a case, the backing store would not be
   added to a worklist and be considered as black immediately. The fix
   is to directly account the marked bytes in such a scenario.

Bug: chromium:1056170
Change-Id: I350ae1b90ad1753d024a3ce33fc3ec3126a2095d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900661
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74629}
2021-05-18 09:49:12 +00:00
Lu Yahan
e5a53a4c61 [riscv64] Fix error in LeaveExitFrame
Bug: v8:11767
Change-Id: Ie697921bf9d4247d1032015bddcbcc892223efdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2902341
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/master@{#74626}
2021-05-18 08:00:24 +00:00
Lu Yahan
8c0bd711f6 [riscv64][wasm] Implement atomic
Change-Id: I0fb3a4738c8e9b4b4328b8a1e142eefed61ec998
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2881494
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74623}
2021-05-18 07:57:10 +00:00
Sathya Gunasekaran
abfdbaf2b7 Revert "Reland "[compiler] Consider IsPendingAllocation in Ref construction""
This reverts commit 4683d6fe52.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36744/overview


Original change's description:
> Reland "[compiler] Consider IsPendingAllocation in Ref construction"
>
> This is a reland of 5f0ac36cc6
>
> Fixes Ref construction failures in:
> - MapRef::instance_descriptors
> - NativeContext reads (see also crrev.com/c/2891575)
>
> Original change's description:
> > [compiler] Consider IsPendingAllocation in Ref construction
> >
> > The logic in JSHeapBroker::TryGetOrCreateData assumes that parts
> > of the object are safe to read. In particular, the instance type
> > must be readable for the chain of `Is##Name()` type checks.
> >
> > This is guaranteed if
> >
> >  - a global memory fence happened after object initialization and
> >    prior to the read by the compiler; or
> >  - the object was published through a release store and read through
> >    an acquire read.
> >
> > The former is protected by the new call to ObjectMayBeUninitialized
> > (which internally calls IsPendingAllocation) in TryGetOrCreateData.
> >
> > The latter must be marked explicitly by calling the new
> > MakeRefAssumeMemoryFence variant.
> >
> > Note that support in this CL is expected to be incomplete and will
> > have to be extended in the future as more cases show up in which
> > MakeRef calls must be converted to MakeRefAssumeMemoryFence or to
> > TryMakeRef.
> >
> > Bug: v8:7790,v8:11711
> > Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74474}
>
> Bug: v8:7790,v8:11711,chromium:1207680,chromium:1207679
> Change-Id: Ib3dbf59909e6982a3230dd6a67c9fb7d6ffb9ab4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886861
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74587}

Bug: v8:7790
Bug: v8:11711
Bug: chromium:1207680
Bug: chromium:1207679
Change-Id: I8cd45ac006b7b5f3d668d0df272bcba880c75926
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901990
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74621}
2021-05-18 06:33:45 +00:00
Shu-yu Guo
8804443f47 [class] Disallow return in class static blocks
Bug: v8:11719
Change-Id: Ib9064e09a77b03adc1234e2f1739983cdab24113
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2898778
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74619}
2021-05-18 06:19:07 +00:00
Sathya Gunasekaran
815bab9faa Revert "[compiler] Remove one ObjectRef constructor"
This reverts commit 59bb432572.

Reason for revert: 4683d6fe52 broke TSAN, reverting all its dependencies first (including this)
https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36744/overview


Original change's description:
> [compiler] Remove one ObjectRef constructor
>
> Remove the handle-taking ObjectRef constructor in favor of
> (Try)MakeRef as bottleneck.
>
> Bug: v8:7790
> Change-Id: I3cc3a1dcef4bac53a91c573d1a532332b88c6eb4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883664
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74593}

Bug: v8:7790
Change-Id: Ifdecf93a3a8c09a3da7118a269fc66c2ae0f1a09
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2901988
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74618}
2021-05-18 06:17:55 +00:00
Shu-yu Guo
69a8284275 [class] Fix await-as-identifier cases in class static blocks
Bug: v8:11718
Change-Id: If903f5e336729fa55bec03acef40025ce20d6ce7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2898176
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74614}
2021-05-18 00:49:54 +00:00
Frank Tang
72b4ec49a2 [test262] Roll test262
https://chromium.googlesource.com/external/github.com/tc39/test262/+log/70bc32e..6d353a

Bug: v8:7834, v8:10958
Change-Id: Ifa497643d8de2f8dc0f01af2d14c79f5aa84d7d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900879
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74613}
2021-05-18 00:16:06 +00:00
Clemens Backes
aee11991d0 [nowasm] Add missing includes
This fixes a compile error after https://crrev.com/c/2891829 if
webassembly is disabled (v8_enable_webassembly = false).

R=pfaffe@chromium.org

Change-Id: Ia425a49d3de11e7c71bb65680ac6a94acd63599e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2900231
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74610}
2021-05-17 16:13:43 +00:00
Santiago Aboy Solanes
f4d362b6fd [cleanup] Remove synchronized_ from map accessors
Continuing the cleanups and using the tags rather than synchronized_
in the name of the accessors.

Bug: v8:7790
Change-Id: I3c2d0ccf54fa6161dbd9d12b1b9743a046534521
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897095
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74609}
2021-05-17 15:07:46 +00:00
Michael Lippautz
f5b84bc48e cppgc: Improve Member checking
Create verification state on first assignment and check that
the reference slot is contained within the values heap if it
is an on-heap reference.

Bug: chromium:1056170
Change-Id: I0ce0e2bbd751186429950bb4f6bad97b273b3128
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2887509
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74607}
2021-05-17 13:48:26 +00:00
Philip Pfaffe
b4942eb3a3 Reland "[ic] Fix handling of API properties with side effects"
This is a reland of 0ce36e7d0e

The reland includes two fixes:
- Move the EvaluateGlobalForTesting into libv8 to avoid linkage issues
  and to avoid having to export ThreadLocalTop symbols.
- Give the ExecutionMode enum a uint8_t backing type to avoid endianess
  issues.

Original change's description:
> [ic] Fix handling of API properties with side effects
>
> DebugEvaluate can evaluate expressions in side-effect-free mode, where
> any operation that would cause observable side effects throws an
> exception. Currently, when accessors are backed by callbacks, it's
> possible that ICs call those accessors directly, bypassing the
> side-effect checks. This CL introduces a bailouts to runtime in those
> cases.
>
> Fixed: chromium:1201781
> Also-By: ishell@chromium.org, pfaffe@chromium.org
> Change-Id: Ie53bfb2bff7b3420f2b27091e8df6723382cf53c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2857634
> Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74507}

Fixes: v8:11761
Change-Id: I58cde8bd11ba0fc9d83adc19fa87733628ab6c13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891829
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74602}
2021-05-17 12:47:24 +00:00
Omer Katz
6a5cb6891c Reland "cppgc-js: Add unittest for CollectCustomSpaceStatisticsAtLastGC"
This is a reland of 4f4b4f74dc

Original change's description:
> cppgc-js: Add unittest for CollectCustomSpaceStatisticsAtLastGC
>
> Drive-by: fix delayed task implementation in cpp-heap.cc.
>
> Bug: chromium:1056170
> Change-Id: Ie92d909056532047b378ebfafeb98273997e60e9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883618
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74530}

Bug: chromium:1056170
Change-Id: Ic3a7bb269e23acf728af57a9733600567659e76b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897084
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74601}
2021-05-17 12:32:54 +00:00
Jakob Kummerow
7e6bb868cc [test] Fix TypedArray::sort for multi-mapped mock allocator
Turns out std::sort() gets angry when various ranges of an array
alias each other in memory. We wouldn't like it when it's angry.

Fixed: chromium:1209152
Change-Id: Ic927b46c59d10f7d3856768628c773b344005979
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897098
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74598}
2021-05-17 12:01:40 +00:00
Michael Lippautz
78313016a9 cppgc: Introduce ObjectView
ObjectView abstracts Start/End/Size of an object over the different
internal representations (HeapObjectHeader and LargePage).

Bug: chromium:1056170
Change-Id: I4e888f907fff94c1b02d5e21b4ec3f4a78a471f8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892081
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74594}
2021-05-17 11:12:40 +00:00
Georg Neis
59bb432572 [compiler] Remove one ObjectRef constructor
Remove the handle-taking ObjectRef constructor in favor of
(Try)MakeRef as bottleneck.

Bug: v8:7790
Change-Id: I3cc3a1dcef4bac53a91c573d1a532332b88c6eb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883664
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74593}
2021-05-17 10:54:10 +00:00
Santiago Aboy Solanes
8256254513 [object] Remove synchronized_ from smi accessors
This ends up cleaning up the last of the macros in object-macros which
were using `synchronized_`. There are still a few methods which use
`synchronized_` but those were defined ad-hoc (i.e. w/o macros).

Bug: v8:7790
Change-Id: Ib2d35030fd032293e746c09e10156e526af8d032
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897085
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74589}
2021-05-17 09:38:30 +00:00
Clemens Backes
3974115a00 [trap-handler] Remove dependencies on macros, globals, flags
This will allow us to refactor those V8 files without being concerned
about potential interference with the security of the trap handler.

This requires the duplication of V8_EXPORT_PRIVATE, the CHECK/DCHECK
macros, and V8_DISABLE_ASAN. The trap-handler specific definitions
are prefixed with "TH_".

R=ahaas@chromium.org

Bug: v8:11755
Change-Id: Iac39b553704ef50e51937375c8db805d57ce2625
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2880218
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74588}
2021-05-17 09:32:40 +00:00
Jakob Gruber
4683d6fe52 Reland "[compiler] Consider IsPendingAllocation in Ref construction"
This is a reland of 5f0ac36cc6

Fixes Ref construction failures in:
- MapRef::instance_descriptors
- NativeContext reads (see also crrev.com/c/2891575)

Original change's description:
> [compiler] Consider IsPendingAllocation in Ref construction
>
> The logic in JSHeapBroker::TryGetOrCreateData assumes that parts
> of the object are safe to read. In particular, the instance type
> must be readable for the chain of `Is##Name()` type checks.
>
> This is guaranteed if
>
>  - a global memory fence happened after object initialization and
>    prior to the read by the compiler; or
>  - the object was published through a release store and read through
>    an acquire read.
>
> The former is protected by the new call to ObjectMayBeUninitialized
> (which internally calls IsPendingAllocation) in TryGetOrCreateData.
>
> The latter must be marked explicitly by calling the new
> MakeRefAssumeMemoryFence variant.
>
> Note that support in this CL is expected to be incomplete and will
> have to be extended in the future as more cases show up in which
> MakeRef calls must be converted to MakeRefAssumeMemoryFence or to
> TryMakeRef.
>
> Bug: v8:7790,v8:11711
> Change-Id: Ic2f7d9fc46e4bfc3f6bbe42816f73fc5ec174337
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874663
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74474}

Bug: v8:7790,v8:11711,chromium:1207680,chromium:1207679
Change-Id: Ib3dbf59909e6982a3230dd6a67c9fb7d6ffb9ab4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886861
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74587}
2021-05-17 08:53:20 +00:00
Lu Yahan
97788f034d [riscv64] Skip incompatible inspector test
Bug: v8:11767

Change-Id: I8ddd578bbc60c72c8d8e269da5492e6fce68482d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2894025
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Cr-Commit-Position: refs/heads/master@{#74586}
2021-05-17 08:43:50 +00:00
Wenyu Zhao
0518000439 [heap] Fix TPH heap capacity checks and skip three more tests
This CL fixes a failed DCHECK due to incorrect heap capacity.

Also skips three new tests that create multiple isolates.

Bug: v8:11641
Change-Id: I1061b3370efbe2b272bd490705fc728d6bb26910
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2896644
Auto-Submit: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74583}
2021-05-17 07:33:50 +00:00
Michael Achenbach
b67f228206 [test] Mark slow test
Led to time-outs and tree closure:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/36738

No-Try: true
Change-Id: Ia1e5294cf823429d4917b30b6478231a64c81b7f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897252
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74582}
2021-05-17 06:36:40 +00:00
Junliang Yan
89e3b1ee3c ppc/s390: replace LoadP with LoadU64
Change-Id: I636b9e8ab8ac89cbdf9814bc1bce2eaad2bcf030
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892606
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Junliang Yan <junyan@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74578}
2021-05-15 13:35:08 +00:00
Frank Tang
59b43b1fc3 Add feature flag mapping for 'Intl.Locale-info' tests
Map 'Intl.Locale-info' to '--harmony_intl_locale_info',
To be ready for https://github.com/tc39/test262/pull/2987

Bug: v8:11638
Change-Id: I119068612867648de30f63aa64c3c2bc5d63e50b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893824
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74577}
2021-05-15 04:12:08 +00:00
Ng Zhi An
34dc2607db [wasm-simd][inspector] Use no_simd_sse to skip test
wasm-scope-info requires SIMD, since it prints the value of the SIMD
value in scope. We skip it using statusfile when SIMD is not supported.

Change-Id: Id64e130a1c497bae95ec5e794ad05816f8c908e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893568
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74573}
2021-05-14 18:23:57 +00:00
Manos Koukoutos
0e1cf1fa05 [wasm-gc] Implement br_on_non_null
Bug: v8:7748
Change-Id: I9a4dad42f433ce0adf928461cf0db589df3d69e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2897087
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74571}
2021-05-14 15:27:29 +00:00
Yuri Iozzelli
50d725f1e5 Implementation of the branch hinting proposal for WebAssembly.
See https://github.com/WebAssembly/branch-hinting for a description of
the proposal.

Change-Id: Ib6e980fc20aa750decabdeb9e281f502c9fe84ed
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2784696
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74569}
2021-05-14 13:40:57 +00:00
Vicky Kontoura
add69092c5 [web snapshot] Support RegExp
This CL adds support for regular expressions. To serialize a regular
expression, the pattern and flags are extracted and serialized as
strings.

Also, JSRegExp::StringFromFlags() is introduced to allow for
transforming back from JSRegExp::Flags to the corresponding flag string.
To verify that this implementation is on par with
RegExp.prototype.flags, unittests are introduced under
regexp/regexp-unittest.cc and RegExpBuiltinsAssembler::FlagsGetter()
is updated to include a slow path that calls JSRegExp::StringFromFlags()
through a runtime function.

Bug: v8:11525, v8:11706
Change-Id: I9cad4c464129ba1cbf64672130d8410730d7d679
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878751
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74566}
2021-05-14 10:27:57 +00:00
Benedikt Meurer
679ccde045 [wasm][debug] Properly mark WebAssembly APIs as side-effect free.
Various WebAssembly APIs that don't have observable side-effects aren't
marked as such, leading to the inability of DevTools front-end to
generate eager evaluation previews in the Console, and also making them
unusable in conditional breakpoints and logpoints.

Bug: chromium:1164241
Change-Id: I8f0675d2ed5b362b34a6f6c756d372a61e9e8564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891571
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74563}
2021-05-14 05:23:07 +00:00
Shu-yu Guo
8613ac24bc Revert "[ptr-cage] Better support sharing CodeRange with re-embedded builtins"
This reverts commit a61aa4919f.

Reason for revert: Did not fix the original issue with chromium
tests toggling jitless mode after V8 has already been initialized
on Win64.

Original change's description:
> [ptr-cage] Better support sharing CodeRange with re-embedded builtins
>
> If a shared CodeRange is already allocated when creating an Isolate in
> jitless mode, the CodeRange will be used. This is to better support the
> following use pattern:
>
> ```
> FLAG_jitless = false;
> v8::Isolate::New();
> FLAG_jitless = true;
> v8::Isolate::New();
> ```
>
> Note that the other direction of toggling jitless from true to false is
> unsupported and may have undefined behavior.
>
> Bug: v8:11460
> Change-Id: I1c451c53bc160be4122056d8b309323a94d4b8b6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2890591
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74535}

TBR=ishell@chromium.org

Bug: v8:11460
Change-Id: I0acd7d0d444efbf6b9860bcc5e91034319b78601
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893827
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74559}
2021-05-13 21:40:27 +00:00
Bill Budge
9ee5bdc975 Revert "Reland^3 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"""
This reverts commit 8b74fd4590.

Reason for revert: Blocking the roll into Chromium, example failure on Windows 64 bot:

https://ci.chromium.org/p/chromium/builders/try/win10_chromium_x64_rel_ng/863189?

Original change's description:
> Reland^3 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64""
>
> This is a reland of 054ff044bc
>
> Change since revert:
>
> - Remove assignment to FLAG_enable_short_builtins in test since
>   it's write-once in CFI.
>
> Original change's description:
> > Reland^2 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"
> >
> > This is a reland of 1f504c36da
> >
> > Changes since revert:
> >
> > - Removed disabling of RO heap sharing when --stress-snapshot is passed;
> >   was fixed by f4a6c628c9
> > - Fixed crashing tests that caused revert separately in
> >   a61aa4919f
> >
> > Original change's description:
> > > > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> > > >
> > > > Reviewed-on:
> > > https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#74422}
> > >
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > Reviewed-by: Adam Klein <adamk@chromium.org>
> > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > Reviewed-by: Dan Elphick <delphick@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#74448}
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Commit-Queue: Shu-yu Guo <syg@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74546}
>
> TBR=adamk@chromium.org
>
> Bug: v8:11460
> Change-Id: Ib7526270d421a562cb00aec9a28b4fc2296e4a86
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893567
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74548}

Bug: v8:11460
Change-Id: Ie1a6a5d7e7928f6b90571a33dc743ca5d1d082b4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893823
Auto-Submit: Bill Budge <bbudge@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74557}
2021-05-13 19:21:08 +00:00
Lu Yahan
eda9412286 [riscv64] Skip incompatible cctests
In debug mode, these will currently cause a DCHECK failure or a
segmentation fault.

See also: https://github.com/riscv/v8/issues/490

Change-Id: I2a4b8e0c9b0fb85393b41b1016b2caa2f013bcc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2881505
Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74550}
2021-05-13 02:33:46 +00:00
Shu-yu Guo
8b74fd4590 Reland^3 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64""
This is a reland of 054ff044bc

Change since revert:

- Remove assignment to FLAG_enable_short_builtins in test since
  it's write-once in CFI.

Original change's description:
> Reland^2 "[ptr-cage] Turn on shared pointer cage by default for arm64 and x64"
>
> This is a reland of 1f504c36da
>
> Changes since revert:
>
> - Removed disabling of RO heap sharing when --stress-snapshot is passed;
>   was fixed by f4a6c628c9
> - Fixed crashing tests that caused revert separately in
>   a61aa4919f
>
> Original change's description:
> > > [ptr-cage] Turn on shared pointer cage by default for arm64 and x64
> > >
> > > Reviewed-on:
> > https://chromium-review.googlesource.com/c/v8/v8/+/2873226
> > > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#74422}
> >
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878855
> > Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> > Reviewed-by: Adam Klein <adamk@chromium.org>
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Reviewed-by: Dan Elphick <delphick@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74448}
>
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891460
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Commit-Queue: Shu-yu Guo <syg@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74546}

TBR=adamk@chromium.org

Bug: v8:11460
Change-Id: Ib7526270d421a562cb00aec9a28b4fc2296e4a86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2893567
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74548}
2021-05-13 01:36:36 +00:00
QiuJi
c7d8556355 [riscv64] Add flag to control disassembling of C-ext
Also handling kArchStackPointerGreaterThan in AssembleArchBoolean

Change-Id: I253c1a6cb924364eead3b9fe58c7cf7d6f0696af
Bug: v8:11737
Bug: v8:11747
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2876854
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Brice Dobry <brice.dobry@futurewei.com>
Commit-Queue: Brice Dobry <brice.dobry@futurewei.com>
Cr-Commit-Position: refs/heads/master@{#74543}
2021-05-12 22:04:43 +00:00
Bill Budge
59d59b518f Revert "cppgc-js: Add unittest for CollectCustomSpaceStatisticsAtLastGC"
This reverts commit 4f4b4f74dc.

Reason for revert: New unittest is failing on TSAN bot:

https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20stress-incremental-marking/3210

Original change's description:
> cppgc-js: Add unittest for CollectCustomSpaceStatisticsAtLastGC
>
> Drive-by: fix delayed task implementation in cpp-heap.cc.
>
> Bug: chromium:1056170
> Change-Id: Ie92d909056532047b378ebfafeb98273997e60e9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883618
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74530}

Bug: chromium:1056170
Change-Id: I7e50f20178854081b6fd23aa6d31afc4b9e49850
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891462
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74540}
2021-05-12 21:13:24 +00:00
Michael Lippautz
fc49e77f26 api,heap: Avoid dropping global handles when stack state is overridden
This CL only affects non-production code. In non-production code, test
runners may invoke tasks (base::RunLoop()) with an interesting stack.
V8 assumes that it can clear certain data structures when running from
a non-nested task due to not having any interesting stack on top.
During testing this can lead to UAF on stack as data structures are
prematurely cleared.

With cppgc this failure can be fixed as the information on whether
test runners invoke tasks with a non-trivial stack is actually
present.

Example failure: https://logs.chromium.org/logs/chromium/buildbucket/cr-buildbucket.appspot.com/8847453411432681120/+/steps/webkit_unit_tests__with_patch__on_Ubuntu-18.04/0/logs/Flaky_failure:_WebSocketStreamTest.ConnectWithFailedHandshake__status_CRASH_SUCCESS_/0

Change-Id: Ib9f6fb2d8a1aa43d0b973afeb2d0a740c769e784
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891574
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74539}
2021-05-12 19:20:23 +00:00
Omer Katz
86af7c6a76 cppgc: Rename HoH methods
Replaces Payload* terminiology with Object* terminology.
HoH::ObjectSize = just the object, without the header.
HoH::AllocatedSize = both the object and the header.

Payload terminology is retained only for pages.

Bug: chromium:1056170
Change-Id: I568a324ae8728f098be642b024493c375ec873cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892079
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74538}
2021-05-12 18:54:43 +00:00
Michael Lippautz
3fe40a3fdc cppgc: Support conservatively tracing large objects
We would use a payload size of 0 and end up walking up the stack till
we crash.

Bug: chromium:1056170
Change-Id: I12a69ada24697faaf05e2f4ab210045d54cf34e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891657
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74537}
2021-05-12 17:28:03 +00:00
Milad Fa
3abb253d5d PPC: remove unused OWNERS files
As mentioned in this CL https://crrev.com/c/2510070,
PPC_OWNERS file is the only necessary file applied
to all *-ppc* files.

Change-Id: I2052186660c6d186e3ead3e8e127a9129814377f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2892602
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74536}
2021-05-12 16:44:03 +00:00
Shu-yu Guo
a61aa4919f [ptr-cage] Better support sharing CodeRange with re-embedded builtins
If a shared CodeRange is already allocated when creating an Isolate in
jitless mode, the CodeRange will be used. This is to better support the
following use pattern:

```
FLAG_jitless = false;
v8::Isolate::New();
FLAG_jitless = true;
v8::Isolate::New();
```

Note that the other direction of toggling jitless from true to false is
unsupported and may have undefined behavior.

Bug: v8:11460
Change-Id: I1c451c53bc160be4122056d8b309323a94d4b8b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2890591
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74535}
2021-05-12 16:38:16 +00:00
Omer Katz
4f4b4f74dc cppgc-js: Add unittest for CollectCustomSpaceStatisticsAtLastGC
Drive-by: fix delayed task implementation in cpp-heap.cc.

Bug: chromium:1056170
Change-Id: Ie92d909056532047b378ebfafeb98273997e60e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2883618
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74530}
2021-05-12 15:50:43 +00:00
Manos Koukoutos
02ac71e256 [turbofan] Disallow floating control in wasm
Loop unrolling did not work properly with floating control. Seeing as
very few spots in the wasm compiler introduced floating control, we
decided to disallow it altogether.
Changes:
- When lowering 64-bit rol/ror/clz/ctz in 32-bit platforms, we use a
  diamond operator, which used to introduce floating control. This CL
  adds a control edge to these operators so that the diamond can be
  chained to that control instead.
- During loop analysis, as an additional safety check, we check that the
  explored loop does not have floating control. Exceptionally, floating
  control pointing directly do start() is allowed.
- Change wasm-compiler so that generated floating projections point to
  start() even after stack check patch-in.

Bug: chromium:1184929, v8:11298
Change-Id: I1ee063f5250037ae6c84d2f16b0bd8fff3923117
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2876851
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74527}
2021-05-12 15:26:33 +00:00
Dan Clark
13bf4f38c6 Make IsolateData::ModuleResolveCallback throw if module was not found
The callback IsolateData::ModuleResolveCallback, used by the fuzzer,
can return an empty MaybeLocal.
In this case v8::internal::SourceTextModule::PrepareInstantiate expects
it to have thrown an exception, and DCHECKs.

The fuzzer can hit this case because it doesn't load the entire module
graph before starting to tell V8 to instantiate modules. So if a module
fails to compile or load, another module trying to import it will hit
this DCHECK because we didn't bail out prior to module instantiation
like we should have.

This doesn't happen in Chromium because Blink loads the entire module
graph before trying to instantiate/link modules, ensuring that the
'real' ModuleRecord::ResolveModuleCallback never fails; indeed this is
mandated by the spec (see
https://html.spec.whatwg.org/#fetch-the-descendants-of-and-link-a-module-script).

To satisfy the fuzzer, this change makes
IsolateData::ModuleResolveCallback throw if it can't find the module.

Note, the bug's testcase doesn't involve import assertions. I don't
think this issue is new with my change
9d72d08a8c
but maybe that changed the crash stack or something in a way that
caused the issue to be reported.

Bug: chromium:1207078
Change-Id: I1fbc80faa099e040cdc489c965a5f2f5daafb38e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2890589
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Dan Clark <daniec@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74526}
2021-05-12 13:20:36 +00:00
Benedikt Meurer
d50b583945 [inspector] Validate samplingInterval in HeapProfiler.startSampling
The HeapProfiler.startSampling method accepts a samplingInterval
parameter, which is assumed to be a positive (non-zero) number,
but doesn't validate the input (the renderer process just crashes
hard on a CHECK instead).

Fixed: chromium:1197392
Change-Id: Ib8e34f4b9881cd195214791ca0a3892e7b49bf55
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891573
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74523}
2021-05-12 12:11:31 +00:00
Georg Neis
719cffa3b2 [compiler] Make ContextRef never-serialized
Also delete undefined ContextRef methods and make
Context::set_previous private (it is only used when
creating a new context).

Bug: v8:7790
Change-Id: I25a701f317f0f4e82432f7537eec1d63c5ef63f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886860
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74521}
2021-05-12 10:27:21 +00:00
Maya Lekova
57afcaf4f5 [fastcall] Allow receiver to be passed as Object
This CL enhances the fast C API in a way to allow passing the receiver
to the fast callback as Local<Object> instead of Local<Value>. It also
fixes documentation comments.

Bug: chromium:1052746
Change-Id: I424aa83023c2e6633b9df08ee040bf170db32b3d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2887510
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74519}
2021-05-12 09:55:37 +00:00
Benedikt Meurer
32f80efe7e [inspector] Improve RemoteObject description for Wasm functions.
The WebAssembly specification requires the "name" property of (exported)
function wrappers to hold the index of the function within the module,
and the default ToString algorithm for Function instances thus generates
something along the lines of `function 42() { [native code] }`, which is
technically correct, but not very useful to developers to diagnose
(humans don't think of functions in a module in terms of their indices).
With this CL, we change the description returned for Wasm (exported)
functions to use the debug name of the Wasm function instead.

Screenshot: https://imgur.com/a/FVPeXDU.png
Doc: http://bit.ly/devtools-wasm-entities
Fixed: chromium:1206620
Bug: chromium:1164241
Change-Id: I096abc287ea077556c13c71f8d71f64452ab4831
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891570
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74517}
2021-05-12 09:35:17 +00:00
Benedikt Meurer
203f527619 [inspector] Side-effect free FunctionMirror descriptions.
Drive-by-fix: Remove command line API fn.toString() override, which was
still in place from the early days when much of the inspector was
implemented in JavaScript.

Fixed: chromium:1207867
Bug: chromium:1206620
Change-Id: I8429f109da5f021f729f184fd824160a24e60897
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2887508
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74516}
2021-05-12 09:30:37 +00:00
Maya Lekova
ba6a1a7c34 Revert "[ic] Fix handling of API properties with side effects"
This reverts commit 0ce36e7d0e.

Reason for revert: Speculative revert for a Chromium build breakage causing a blocked roll - https://bugs.chromium.org/p/v8/issues/detail?id=11761

Original change's description:
> [ic] Fix handling of API properties with side effects
>
> DebugEvaluate can evaluate expressions in side-effect-free mode, where
> any operation that would cause observable side effects throws an
> exception. Currently, when accessors are backed by callbacks, it's
> possible that ICs call those accessors directly, bypassing the
> side-effect checks. This CL introduces a bailouts to runtime in those
> cases.
>
> Fixed: chromium:1201781
> Also-By: ishell@chromium.org, pfaffe@chromium.org
> Change-Id: Ie53bfb2bff7b3420f2b27091e8df6723382cf53c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2857634
> Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74507}

Change-Id: Ifb5c24682af29572591d436ab92b0304058e99af
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2891650
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#74515}
2021-05-12 07:54:08 +00:00
Camillo Bruni
f64bd67f82 [codegen] Rename TurboAssembler::Set to Move
On x64 we can emit more compact instructions for mov(reg, imm). However
currently this only happens when using the Set method explicitly.
This CL renames Set to Move to avoid confusion and yield better code
by default.

Also use the new Move helper for Smis as well.

Change-Id: I06558e88d1142098f77fb98870f09742d494f3dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2874450
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74512}
2021-05-11 21:53:44 +00:00
Dominik Inführ
e404af787f [heap] Support simple shared GCs without any clients
Allow GC of the shared heap without any attached clients. This
CL also disables incremental marking for shared heaps for now.

Bug: v8:11708
Change-Id: I1eb47a42fe3ced0f23f679ecaae0c32e09eab461
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886878
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74511}
2021-05-11 20:04:04 +00:00
Luis Fernando Pardo Sixtos
0acdf36510 Adding support for const redeclaration on REPL mode.
This change adds support for `const` redeclaration on REPL mode with
the semantincs recommended in the design doc:

1) REPL scripts should not be able to reassign bindings to `const`
   variables.

2) Re-declaring `const` variables of page scripts is not allowed in
   REPL scripts.

3) Re-declearing `const` variables is not allowed in the same REPL
   script.

4) `const` re-declaration is allowed across separate REPL scripts.

5) Old references to previously declared variables get updated with the
   new value, even those references from within optimized functions.

Design doc: https://goo.gle/devtools-const-repl

Bug: chromium:1076427
Change-Id: Ic73d2ae7fcfbfc1f5b58f61e0c3c69e9c4d85d77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2865721
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Luis Fernando Pardo Sixtos <lpardosixtos@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74510}
2021-05-11 16:47:04 +00:00
Philip Pfaffe
0ce36e7d0e [ic] Fix handling of API properties with side effects
DebugEvaluate can evaluate expressions in side-effect-free mode, where
any operation that would cause observable side effects throws an
exception. Currently, when accessors are backed by callbacks, it's
possible that ICs call those accessors directly, bypassing the
side-effect checks. This CL introduces a bailouts to runtime in those
cases.

Fixed: chromium:1201781
Also-By: ishell@chromium.org, pfaffe@chromium.org
Change-Id: Ie53bfb2bff7b3420f2b27091e8df6723382cf53c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2857634
Commit-Queue: Philip Pfaffe <pfaffe@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74507}
2021-05-11 14:26:04 +00:00
Victor Gomes
4f51af6de8 [runtime] TryFastArrayFill can throw exception
Bug: chromium:1206994, chromium:1206754, chromium:1206822
Change-Id: I8ccd501c5a918613fad59afdd65ca499ee57d7a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2882805
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74500}
2021-05-11 11:12:59 +00:00
Camillo Bruni
cc06b8c778 [cleanup] Convert some global enums to enum class
Convert StoreOrigin, TypeOfMode, SaveFPRegsMode and ArgvMode to
enum classes with k-prefixed values.

Change-Id: Ib6ca3a9995297e8303a7e013b1d829613c0db510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2885042
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74497}
2021-05-11 10:47:49 +00:00
Michael Lippautz
c29395ae51 cppgc: Relax Member checks
Member is sometimes still used from off-heap storage which prohibits
getting the heap from the Member's slot address.

Bug: v8:11756
Change-Id: I61658ce07a8b02a8c400232ff21c75f0d8b95dcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2886879
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Anton Bikineev <bikineev@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74496}
2021-05-11 10:44:49 +00:00
Dominik Inführ
8a9129efbe [execution] Replace UseAsSharedIsolate() with Isolate::NewShared()
Isolate::UseAsSharedIsolate() was invoked after the Isolate was already
created. I think it is cleaner to have the shared-flag right when
constructing an Isolate. This way we can use that property already
when setting up the isolate.

Bug: v8:11708
Change-Id: Ibbfee09122b7b0361a5af7a1b559796594834813
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2885041
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74495}
2021-05-11 10:37:59 +00:00
Paolo Severini
a7980d43e0 [fastcall] Add vector of CFunction overloads to FunctionTemplate
As a first step to support Fast API calls with overloads, adds a
new FunctionTemplate constructor that accepts a vector of CFunction*.

Bug: v8:11739
Change-Id: I112b1746768f52df52c893a4f1fb799b6bd90856
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2860838
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74481}
2021-05-10 17:07:20 +00:00
Michael Lippautz
1ced5f8386 Reland "cppgc: Implement basic Member and Persistent checks"
This is a reland of 7458e67c4e

Original change's description:
> cppgc: Implement basic Member and Persistent checks
>
> Adds check for
> - same heap on assignment
> - header and containment
>
> The verification state is eagerly created for on-heap Member
> references using caged heap and lazily created on first assignment for
> all others.
>
> Bug: chromium:1056170
> Change-Id: I38ee18eeb7ac489f69a46670cc5e5abe07f62dfa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2878745
> Reviewed-by: Omer Katz <omerkatz@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74449}

Bug: chromium:1056170
Change-Id: I9cecfcf7ba2cb70650fd51f345fbf740b96ff6ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2882804
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74468}
2021-05-10 12:31:05 +00:00
Samuel Groß
6328961158 [sandbox][x64] Switch to AND-based type checks
This change turns the previously used XOR-based type checks for external
pointers into AND-based type checks. With those, the type tag is ORed
into the top bits of an external pointer when it is written, and the
type check performed on every load is done by ANDing the value with the
inverted tag. This will later allow type checking and masking off the GC
marking bits of external pointers in a single operation.

Bug: v8:10391
Change-Id: I89f2b22588b3f7467c79c7916c11f25cd9bcc82d
Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2850639
Commit-Queue: Samuel Groß <saelo@google.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74464}
2021-05-10 11:21:13 +00:00
Maya Lekova
a44685da8d [test] Remove FlagScope use in test-api.cc
Resetting the flag in the scope desctructor causes concurrent access to
the flag value, triggering a TSAN failure when
--stress-concurrent-inlining is on. The behaviour of the stress flag
was changed in crrev.com/c/2824440 to improve test coverage, so this
CL replaces the scope usage with simple flag assignment.

Bug: v8:11740
Change-Id: Ie706edaa50486dd3b6eaabc9d1f26a8d03068418
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2882801
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74461}
2021-05-10 09:26:38 +00:00
Wenyu Zhao
f2450cd701 [heap] Fix build and test errors for TPH
* Set v8_enable_pointer_compression_shared_cage = false for TPH.
* Skip three more tests that creates multiple isolates (which is not supported by TPH at the moment).

Bug: v8:11641
Change-Id: Iefec0ea3e2ed51e8973546441f5daaa2ac02ab57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2881510
Auto-Submit: Wenyu Zhao <wenyu.zhao@anu.edu.au>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74460}
2021-05-10 09:25:33 +00:00
Marja Hölttä
3160edf011 [rab/gsab] ResizableArrayBuffer / GrowableSharedArrayBuffer part 1
Detailed list of changes:
https://docs.google.com/document/d/15i4-SZDzFDW7FfclIYuZEhFn-q-KpobCBy23x9zZZLc/edit?usp=sharing

Bug: v8:11111
Change-Id: I931003bd4552cf91d57de95af04a427a9e6d6ac9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2814259
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74459}
2021-05-10 08:29:41 +00:00