Commit Graph

27191 Commits

Author SHA1 Message Date
Michael Lippautz
ea818f0733 cppgc: Fix testing APIs that enable garbage collection
The APIs require that the CppHeap is moved into a permanently detached
state that moves the heap out of a no-gc scope.

Bug: chromium:1056170
Change-Id: I1fc08451b3fdfaa4cfe58e6a1ddbe5dbed7efe5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2718146
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73025}
2021-02-24 19:20:48 +00:00
Austin Eng
db34c5a140 [fastcall] Introduce a builder pattern for specifying type modifiers
- Add a CFunctionBuilder interface to allow adding modifier flags
  to argument types. This will be used to support IDL attributes
  like [EnforceRange], [Clamp], and [AllowShared]. This CL adds
  only the interface, but the actual modifier flags do not exist
  yet as they would not be implemented.
- Remove the internals of the old CFunction type inference and
  implement it on top of CFunctionBuilder.

Bug: chromium:1052746
Change-Id: I09a7cba07105097517a8426a8eeb891393883ac6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2686686
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Austin Eng <enga@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73024}
2021-02-24 19:17:28 +00:00
Thibaud Michaud
ef24469bc3 Revert "[wasm][eh] Stage exception handling"
This reverts commit 1db61fb30b.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20debug/34083/overview

Original change's description:
> [wasm][eh] Stage exception handling
>
> This was staged through a back-merge in v8.9. Also stage it for the
> upcoming v9.0 release.
>
> R=​ahaas@chromium.org
>
> Bug: v8:8091
> Change-Id: Ie9e6d25bbc5d428e5c9128345209f95f2078b733
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715524
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#73013}

Bug: v8:8091
Change-Id: I18b9706e8aab4883a3d3c120a6cd06e7232aecf7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2718148
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73016}
2021-02-24 17:38:25 +00:00
Seth Brenith
bac84a5324 Don't treat ScopeInfos as arrays in heap snapshot
This is a partial reland of https://crrev.com/c/v8/v8/+/2601880 .

I think it makes more sense to list ScopeInfos under "(system)" in the
dev tools, like most other V8 internal types.

Change-Id: If85f869e805d7c374fc7584a79155bb4f400e4b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707249
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#73015}
2021-02-24 17:09:43 +00:00
Thibaud Michaud
1db61fb30b [wasm][eh] Stage exception handling
This was staged through a back-merge in v8.9. Also stage it for the
upcoming v9.0 release.

R=ahaas@chromium.org

Bug: v8:8091
Change-Id: Ie9e6d25bbc5d428e5c9128345209f95f2078b733
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715524
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73013}
2021-02-24 15:53:13 +00:00
Manos Koukoutos
40ebe8453a [wasm][turbofan] Implement loop unrolling for wasm
Design doc: https://docs.google.com/document/d/1AsUCqslMUB6fLdnGq0ZoPk2kn50jIJAWAL77lKXXP5g/

Currently, wasm loop unrolling is disabled by default. We intend to
further investigate its compilation time cost and running time benefits
before enabling it.

Additional changes:
- Introduce LoopFinder::FindUnnestedLoopFromHeader() as a lightweight
  loop analysis.
- Move EliminateLoopExit into LoopPeeling and expose it.
- Introduce loop_info_ field into WasmGraphBuildingInterface, fill it
  up in Loop().
- Break after encountering the first loop in BuildNestedLoopExits.
- Introduce struct WasmLoopInfo. A WasmLoopInfo vector is instantiated
  in ExecuteTurbofanWasmCompilation, passed to BuildGraphForWasmFunction
  to be filled up by WasmGraphBuildingInterface, and then passed to
  GenerateCodeForWasmFunction to be used in WasmLoopUnrollingPhase.
- Introduce WasmLoopUnrollingPhase and insert it into the wasm
  compilation pipeline.
- Fix an issue where exception values were not wrapped in
  WasmGraphBuilderInterface.
- Update --wasm-loop-unrolling flag description.

Bug: v8:11298
Change-Id: I4b57cf2ea8520931f60769f843ffd57b3ca6399b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2697349
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73009}
2021-02-24 14:44:24 +00:00
Kim-Anh Tran
806352179e [debugger] Re-compile top-level functions in GetPossibleBreakpoints
This adds a re-compilation of top level functions in
getPossibleBreakpoints if no candidates could be found.
This step is necessary as the GC may remove SharedFunctionInfo about
top-level functions.

Bug: chromium:1137141
Change-Id: I8830438d78751ba318d65f43d790ee98f306a57e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2696154
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73008}
2021-02-24 14:42:14 +00:00
Georg Neis
e278b6d754 [cleanup] Replace redundant BytecodeArrayIterator class
It had essentially become a synonym for BytecodeArrayAccessor.
This removes the BytecodeArrayIterator class and renames
BytecodeArrayAccessor to BytecodeArrayIterator.

Change-Id: I79cf8574f3c8804822f90c8f921c17ca7ab85f48
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2715523
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73005}
2021-02-24 13:54:53 +00:00
Gus Caplan
26902dbc34 [test] add module serialization test
Bug: v8:10855
Change-Id: I0f28603421ba36176d177bfcc25f18a26a097c29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716062
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Gus Caplan <snek@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73004}
2021-02-24 13:34:28 +00:00
Emanuel Ziegler
895748e6c2 [wasm] Correcting error message method name for new WebAssembly.Table
When calling new WebAssembly.Table, the returned error message refers
accidentally to the WebAssembly.Module() constructor.

There will be a corresponding Chromium CL fixing expected error messages
in WPTs.

R=ahaas@chromium.org

Bug: v8:11356
Change-Id: I57f5e071d5c542615523345283d7c3613fb7a616
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2663155
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72998}
2021-02-24 11:06:31 +00:00
Clemens Backes
96a0677a22 [Liftoff] Use ValueKind instead of ValueType
The precise type is only used for validation. For code generation,
knowing the kind is more than enough. Hence, only store and pass the
ValueKind in Liftoff, and not the full ValueType.

R=manoskouk@chromium.org

Bug: v8:11477
Change-Id: Ia42c0fa419f75b508bd2f210c767b631e93d3398
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707170
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72997}
2021-02-24 10:07:51 +00:00
Dan Elphick
23fa9ffd9c [build] Fold v8-profiler.h and v8-util.h into v8_headers
These are headers that are used by the inspector, debugger and other
parts of chrome so they should be in the main v8_headers target.

test-api-interceptors.cc does not use anything from v8-util.h so remove
the include and some other unneeded using declarations.

Bug: v8:7330
Change-Id: Iea1546de3fc2dbc1c41f0dd7109b6c7ef5557045
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2716384
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72996}
2021-02-24 09:33:11 +00:00
Michael Achenbach
ed60adb549 [test] Skip flaky test on ODROIDs
No-Try: true
Bug: v8:11134
Change-Id: Ic63d0ffc0d64a3f06048cf811a526afd46e34cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2714548
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72994}
2021-02-24 08:13:31 +00:00
Ng Zhi An
f8654c4e6b [wasm-simd][fuzzer] Fuzz extadd pairwise instructions
Bug: v8:11086
Change-Id: I3413a6cd3e9ea6078ce014a0596c51b092e44cfe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707778
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72980}
2021-02-23 22:07:13 +00:00
Thibaud Michaud
d1552fa73b [wasm][eh] Remove kCatchInArity
The arity depends on the exception type now. Take the max over all
exceptions since we only need a conservative estimate.

R=clemensb@chromium.org

Bug: v8:8091
Change-Id: Id5a3e12d89c5d48219e8981e16c2b679d80b67db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2691051
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72976}
2021-02-23 18:09:18 +00:00
Deepti Gandluri
4b37f202f6 [wasm][fuzzer] Don't generate SIMD operations on unsupported arches
Bug: chromium:1177804
Change-Id: Ic8044fb4bfe414101edb923a9bb6e71282808e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706351
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72974}
2021-02-23 17:57:44 +00:00
Thibaud Michaud
55fe15dc17 [wasm] Fix thread_in_wasm_flag in exception handling
The flag should not be set after an exception is thrown in a runtime
function. The unwinder still runs after the destructor, and should take
care of setting the flag depending on the catching frame.

R=ahaas@chromium.org,jkummerow@chromium.org

Bug: chromium:1180690
Change-Id: I0013c90f759a5145309f6e08d61ed36aeecbac63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713103
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72972}
2021-02-23 17:43:33 +00:00
Thibaud Michaud
4a5724d408 [wasm][interpreter][eh] Fix delegate end label offset
R=clemensb@chromium.org

Bug: chromium:1180457
Change-Id: I50b776af243fa17856945fecc018a87356694a97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712242
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72970}
2021-02-23 17:32:53 +00:00
Ng Zhi An
b8f9829afa [wasm] Convert float to int without using external calls
Follow-up from https://crrev.com/c/2649147/. There are still 2 usages of
_wrapper functions in the interpreter, these are slightly more annoying
to get rid of since the definitions have a ifdef for MSCV/OS_WIN.

Bug: v8:11384
Change-Id: Ic5ca860678f406e1c832c99398b235707da058f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713166
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72969}
2021-02-23 17:30:33 +00:00
Seth Brenith
ede2740711 [torque] Add LazyNode support
This change adds a new abstract type Lazy<T> which can be used to
interoperate with CSA code that uses LazyNode. This new type has special
code-generation rules because its generated type is not TNode<...> but
std::function<TNode<...>()>. Torque code can do nothing with this type
except pass it around, but passing it to the CSA function RunLazy is an
easy way to execute the std::function and get back a normal value.
Torque code can also create Lazy<T> values using the intrinsic function
%MakeLazy, which takes the name of a macro as its first parameter,
followed by arguments to that macro which will be passed when the
LazyNode is evaluated. We use the macro's name because the language
doesn't support taking references to macros, and implementing such a
feature would be complicated.

Bug: v8:7793
Change-Id: I09120960e3492dd51be0d4c57e14ff3826b99262
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2701752
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72964}
2021-02-23 16:51:53 +00:00
Clemens Backes
9cdff48c4b [wasm] Fix instance caching with dynamic tiering
After the runtime call for dynamic tiering, the instance cache is
invalidated. This was assumed to be done in {SpillAllRegisters}, but the
instance is still being accessed after that call, so the instance cache
register might still be set after the runtime call.

R=ahaas@chromium.org

Bug: chromium:1179065
Change-Id: I375e7c388e5a74789050e374db50d21c2efe27e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2714544
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72958}
2021-02-23 15:01:38 +00:00
Michael Achenbach
2a8514b65a [test] Skip flaky tests
No-Try: true
Bug: v8:11338, v8:11413
Change-Id: I5a3365e557bc3727071d8d73e9b3f9da1ae6d011
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2714704
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72953}
2021-02-23 13:16:53 +00:00
Jakob Gruber
f8083d1425 [compiler] Fix return type of GetCharAsString
.. which can return Undefined if reading out of bounds, so the return
type is ObjectRef and not StringRef (if we had torque-like union types
it'd be StringRef|OddballRef). Also change the function name to
GetCharAsStringOrUndefined.

Bug: v8:7790,chromium:1181246
Change-Id: Icf9e8fd03d11c3936e87a509b9117e547972d283
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712965
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72952}
2021-02-23 13:02:11 +00:00
Clemens Backes
5c237388f0 [backend] Fix source position annotations
If two call instructions were generated right after each other, the
source position table could get populated with two entries for the same
PC (triggered by the follow-up CL: https://crrev.com/c/2697359).
This CL fixes that by slightly changing the carry-over of source
positions from nodes to instructions.

The call node which has a source position attached generates two
instructions:
      18: gap () ([rax|R|tp] = v16(-); [rbx|R|t] = v17(-);)
          [rax|R|t] = ArchCallWasmFunction [immediate:4] #-1 [rax|R|tp] [rbx|R|t] [immediate:5]
      19: gap () ()
          ArchJmp [immediate:6]

Those are then reversed, and the source position is attached to the first
one (the ArchJmp). After reversing it again later, the source position
will be set to the pc *after* the call instruction, which in the example
happened to be just another call instruction which already had a source
position, resulting in this code:

[...]
0x388ee467d426    66  e875feffff     call 0x388ee467d2a0     ;; wasm stub: WasmThrow
0x388ee467d42b    6b  e850feffff     call 0x388ee467d280     ;; wasm stub: WasmStackGuard
[...]
Source positions:
 pc offset  position
        6b         5
        6b         0

By attaching the source position to the *last* instruction (after
reversing), we ensure that it will be generated for an instruction
*before* the call, or the call itself if this is the first instruction
emitted for that node.

R=jgruber@chromium.org

Bug: v8:11490, v8:11496
Change-Id: Ie95c87d0d9daea56ca14a811abcd02ac07a4cf84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2697358
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72951}
2021-02-23 12:49:11 +00:00
Marja Hölttä
655ae222dd [map transitions] Fix setting writable=false for sealed objects
Also fixes existing tests which were asserting the wrong behavior (that
setting writable=false won't have an effect).

The bug was introduced by https://chromium-review.googlesource.com/c/v8/v8/+/1442640 .

Bug: chromium:1158138
Change-Id: I2d85721848eb4e7d530a980a9ecef7f8693bb9a2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2691050
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72948}
2021-02-23 10:43:20 +00:00
Santiago Aboy Solanes
7705ab1fbb [csa][cleanup] Remove Sloppy from TNodes in more methods
Remove from:
 * Smi
 * RawPtrT
 * Oddball
 * Float32T
 * Float64T
 * IntPtrT
 * WordT
 * Word32T

Bug: v8:6949, v8:11384
Change-Id: Ia79fdedd23cd09c49ada05d031a04a1a48c2d9c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712784
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72946}
2021-02-23 10:01:10 +00:00
Clemens Backes
ca89bf259f [no-wasm] Exclude asm->wasm translation code
The v8_enable_webassembly=false configuration will not be a able to run
any wasm code, hence remove the whole asm to wasm translation from the
binary.

In order to skip specific unit tests in that configuration, we move the
definition of the v8_enable_webassembly gn argument from BUILD.gn to
v8.gni, such that it is available in all gn files.

R=ecmziegler@chromium.org, machenbach@chromium.org

Bug: v8:11238
Change-Id: Id4e290df3e42ffd2f05c377bdd3a368871815daf
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712562
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72945}
2021-02-23 09:51:40 +00:00
Clemens Backes
2dd28df97a [wasm] Move regression tests to wasm directory
This moves all tests that construct a wasm module (and load
wasm-module-builder.js) from test/regress to the test/regress/wasm
directory. This will make it easier to skip them all in the
v8_enable_webassembly=false configuration.

R=ahaas@chromium.org

Bug: v8:11238
Change-Id: Ib22b0fb40a58f213182e68b78b34041651c436d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712243
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72942}
2021-02-23 09:32:34 +00:00
Jakob Gruber
4f75235da5 Skip slow test regress-779407 in experimental_regexp variant
The experimental engine struggles to compile this large pattern.

Change-Id: I0abd5c7ed9f6f62b1c18b5c3dc1cb6a25e130c53
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712754
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72941}
2021-02-23 09:07:50 +00:00
Bill Budge
942af6c77d Revert "Reland "Reland "Reland "[compiler][wasm] Align Frame slots to value size""""
This reverts commit 9da4e36390.

Reason for revert: Fuzzers revealed that Liftoff doesn't use the CallDescriptor when pushing arguments, breaking linkage.

tbr=ahaas@chromium.org,neis@chromium.org,jgruber@chromium.org

Original change's description:
> Reland "Reland "Reland "[compiler][wasm] Align Frame slots to value size"""
>
> This is a reland of 352b9ecbdb
>
> The test/fix CL has been merged in, as the fixes to return slot
> accounting are needed to fix Arm64 issues turned up by the fuzzers:
>
> https://chromium-review.googlesource.com/c/v8/v8/+/2644139
>
> Original change's description:
> > Reland "Reland "[compiler][wasm] Align Frame slots to value size""
> >
> > This is a reland of 1694925c72
> >
> > Minor fix to linkage for constexpr.
> >
> > TBR=ahaas@chromium.org,neis@chromium.org
> >
> > Original change's description:
> > > Reland "[compiler][wasm] Align Frame slots to value size"
> > >
> > > This is a reland of cddaf66c37
> > >
> > > Original change's description:
> > > > [compiler][wasm] Align Frame slots to value size
> > > >
> > > > - Adds an AlignedSlotAllocator class and tests, to unify slot
> > > >   allocation. This attempts to use alignment holes for smaller
> > > >   values.
> > > > - Reworks Frame to use the new allocator for stack slots.
> > > > - Reworks LinkageAllocator to use the new allocator for stack
> > > >   slots and for ARMv7 FP register aliasing.
> > > > - Fixes the RegisterAllocator to align spill slots.
> > > > - Fixes InstructionSelector to align spill slots.
> > > >
> > > > Bug: v8:9198
> > > >
> > > > Change-Id: Ida148db428be89ef95de748ec5fc0e7b0358f523
> > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2512840
> > > > Commit-Queue: Bill Budge <bbudge@chromium.org>
> > > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#71644}
> > >
> > > Bug: v8:9198
> > > Change-Id: Ib91fa6746370c38496706341e12d05c7bf999389
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2633390
> > > Commit-Queue: Bill Budge <bbudge@chromium.org>
> > > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#72195}
> >
> > Bug: v8:9198
> > Change-Id: I91e02b823af8ec925dacf075388fb22e3eeb3384
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2640890
> > Reviewed-by: Bill Budge <bbudge@chromium.org>
> > Commit-Queue: Bill Budge <bbudge@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#72209}
>
> Bug: v8:9198
> Change-Id: I8258f87463f66417c7028b9a1fed4b9b6d82a3be
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2669892
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72506}

Bug: v8:9198
Change-Id: I7f344e4d018ce3c02333b0b08efeecdd8cddf082
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713207
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72937}
2021-02-23 00:25:23 +00:00
Ng Zhi An
4c92f23cc1 [wasm-simd][ia32] Fix load lane and run spec tests
Load lanes require that dst == src1 when AVX is not supported, add that
constraint to the instruction selector. For Liftoff, we change the macro
defintions of Movlps and Movhps to do the move if dst != src1.

Bug: v8:10975
Change-Id: Ic4f499845f0728db250ea23b1b053e0a9fbe99b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2708825
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72936}
2021-02-23 00:24:19 +00:00
Ng Zhi An
1bd29073a4 [wasm-simd] Move extadd pairwise out of post-mvp
Bug: v8:11086
Change-Id: Id7ec472d5311c3a1e4e54d9df65fee9c87ae6ec7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707777
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72935}
2021-02-22 23:48:29 +00:00
Bill Budge
9a540436e4 Revert "[compiler][wasm] Fix Wasm linkage"
This reverts commit 0818d13807.

Reason for revert: Rolling back to previous greedy slot allocator.

tbr=ahaas@chromium.org

Original change's description:
> [compiler][wasm] Fix Wasm linkage
>
> - Fixes a problem when constructing Wasm CallDescriptors, where the
>   allocation tries to treat parameters and returns as if they are in the
>   same frame. This doesn't work when slots may be aligned in their
>   frame. Instead, allocate parameters and returns separately and offset
>   return slots by the number of parameter slots.
> - Adds argument slot padding in the CallDescriptor lowering case, to
>   prepare for when 32 bit targets align stack frames and require
>   padding.
> - Adds a regression test.
>
> Bug: chromium:1174500
> Change-Id: I60d96a94b171a0d27ff61cbab35623976b0c6da8
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2683024
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72588}

Bug: chromium:1174500
Change-Id: I1d1c389acde43bd56e6d2a27e1a3eb8ea4d6073c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713206
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72934}
2021-02-22 23:01:48 +00:00
Ng Zhi An
93bcd62e4f [wasm-simd][x64][arm64] Remove i32x4.widen_i8x16_{s,u}
This is essentially a revert of 3 commits:

- a1d39bbaed
- 5a0938e593
- 74362ae3e2

with merge conflicts fixed.

These instructions were not merged into the SIMD proposal.

Bug: v8:11297
Change-Id: Ifffe7c61cae10fadc345d0faa1b0ba45ce74e946
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704950
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72933}
2021-02-22 22:41:26 +00:00
Bill Budge
396c2635cb Revert "[codegen][frames] Generalize argument padding slot code"
This reverts commit 8cf4eec7d8.

Reason for revert: Rolling back to previous greedy slot allocator.

tbr=neis@chromium.org,jgruber@chromium.org

Original change's description:
> [codegen][frames] Generalize argument padding slot code
>
> - Removes kPadArguments boolean.
> - Changes ShouldPadArguments to ArgumentPaddingSlots to reflect
>   that on some architectures more than 1 padding slot may be needed.
> - Adds AddArgumentPaddingSlots and ShouldPadArguments convenience
>   functions.
>
> Bug: v8:9198
>
> Change-Id: Iba87518e071a75fb951b490d3f75a87ca715cc23
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2679109
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72605}

Bug: v8:9198
Change-Id: Ie93d32d4b93c67840e4792acb017f28a826bd030
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2713205
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72931}
2021-02-22 22:02:36 +00:00
Dan Elphick
075c4ffe61 [build] Move v8-platform.h into v8_config_headers
Also add v8_config_headers dependency to cctest_headers. This reduces
the number of gn check failures from 194 to 178.

Bug: v8:7330
Change-Id: I6453b9789503c9d8ca3ed6bbe94bce3e2a69653f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2712564
Auto-Submit: Dan Elphick <delphick@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72912}
2021-02-22 14:34:50 +00:00
Dan Elphick
3a9975191a [build] Improve build dependencies for gn check
Currently if gn check is enabled (with v8/third_party ignored), there
are many errors due to headers being used without adding the proper
dependency in BUILD.gn (or because it's being used transitively without
a public_deps chain).

This makes the number of errors go from 2114 to 195.

Apart from adding dependencies, it also moves _v8_internal_Node_Print
from objects-printer.cc to node.cc so it can see the Node::Print method
which wouldn't otherwise be possible without a circular dependency. Also
removes the previously deleted compiler/graph-builder-tester.h file.

Bug: v8:7330
Change-Id: Icb34585fbef621588265cf4267cfc88ecbcf0a72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2702331
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72908}
2021-02-22 13:13:30 +00:00
Clemens Backes
96bfcfb845 [no-wasm] Make --expose-wasm flag readonly
If webassembly is disabled via a gn arg, we will not be able to enable
it via command-line switch. Hence make this flag read-only in that
configuration.

R=ecmziegler@chromium.org

Bug: v8:11238
Change-Id: Ib93a55f74d4f018477f110b8b52aa9b645e86553
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2710426
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Emanuel Ziegler <ecmziegler@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72905}
2021-02-22 12:19:20 +00:00
Jakob Gruber
2e8443779d Reland "[compiler] Direct heap reads for JSArrayRef"
This is a reland of 76a2ab06a1

Changes since the original CL:
- Handle unserialized elements (optional result in getter).
- Merge should_access_heap and --turbo-direct-heap-access paths.
- Slightly update the serialized path in GetOwnCowElement.
- Fix the cctest, add a regression test.

Atomic JSObject::elements/JSArray::length setters are addressed
in this CL: crrev.com/c/2704076.

Original change's description:
> [compiler] Direct heap reads for JSArrayRef
>
> There are two aspects to the non-JSObject parts of JSArrayRef:
>
> - JSArrayRef::length. Relevant only in two spots, 1. when reading
> (immutable) array boilerplates and 2. for GetOwnCowElement.
>
> - JSArrayRef::GetOwnCowElement. May read into a copy-on-write backing
> store. Relies on the invariant that cow backing stores are immutable.
>
> This CL renames the length accessor to length_unsafe to make the
> danger explicit at callsites.
>
> For GetOwnCowElement the refactor is slightly larger, since we now
> need to read into the backing store while keeping full control of
> object reads (e.g. JSArray::length and JSArray::elements_kind). We
> make all reads explicit at the call site by requiring that elements,
> elements kind, and length are passed in as arguments to
> GetOwnCowElement. Inside GetOwnCowElement, consistency between these
> is *not* guaranteed due to concurrency. At runtime, consistency *is*
> guaranteed through the reference-equality check on the elements seen
> during compilation. The actual elements read is implemented in
> ConcurrentLookupIterator::GetOwnCowElement.
>
> Bug: v8:7790
> Change-Id: I9aa169ce4f2b1e2bfe1e9232007669eb7654a995
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2695403
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72834}

Bug: v8:7790
Change-Id: I7577ad554992cafff81099a28c34f27db9bd8042
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2710431
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72904}
2021-02-22 12:15:50 +00:00
Clemens Backes
4cd9625998 [asm] Move regression tests to own directory
This moves all asm.js tests (tests that use "%IsAsmWasmCode") into a
separate directory. This will make it easier to skip them all in the
v8_enable_webassembly=false configuration.

R=ahaas@chromium.org

Bug: v8:11238
Change-Id: I805f222b7977f5508f7dbee1f1bd61a88ccd34aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2710427
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72900}
2021-02-22 11:35:30 +00:00
Clemens Backes
1813665413 [no-wasm] Skip wasm tests if wasm is disabled
This CL introduces a test runner flag to detect if webassembly has been
disabled. Since all tests that require wasm are alrady skipped in
lite mode, we introduce a has_webassembly flag for the test runner which
checks for v8_enable_webassembly=true and v8_enable_lite_mode=false.
As a drive-by, we also do not set the V8_ENABLE_WEBASSEMBLY
preprocessor flag if lite mode is enabled.

The status files are updated by splitting wasm tests from the
"lite_mode" section and checking for "not has_webassembly" instead.

Note that the v8_enable_webassembly=false configuration is not tested
on any bot currently, but I will make sure that all tests keep passing
on further changes in this configuration.

R=machenbach@chromium.org

Bug: v8:11238
Cq-Include-Trybots: luci.v8.try:v8_linux64_no_wasm_compile_rel
Change-Id: I1841eb1f1633cb47e0c079f4a4a4d769ca3a9cbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2710425
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72898}
2021-02-22 11:06:40 +00:00
Clemens Backes
a3776a6382 [wasm] Move ValueKind out of ValueType
Backends do not care about the concrete type, they only need to know the
"kind" (e.g. "ref" or "i32").
In order to prepare Liftoff to use the value kind instead of the
value type for all stored data, this CL moves the kind out of the
ValueType and makes it a top-level enum.

R=manoskouk@chromium.org

Bug: v8:11477
Change-Id: I489d6c5207e6ff1b66e2afbe78a156d66df27eb3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707169
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72896}
2021-02-22 10:52:50 +00:00
Santiago Aboy Solanes
4b41989a62 [csa] [cleanup] Remove SloppyTNode from several methods
Removed the ones for types:
 * Symbol
 * Object
 * WordT
 * Int32T
 * HeapNumber

Bug: v8:6949, v8:11384
Change-Id: Id09de31fe23d2a74d771100b293e45362c36a469
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707171
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72892}
2021-02-22 10:42:11 +00:00
Thibaud Michaud
c0ded6c83d [wasm][interpreter] Reload after caught StackOverflow
If a StackOverflow is caught, reload the pc and the limit from the
catching frame, not from the target.

R=clemensb@chromium.org

Bug: chromium:1180339
Change-Id: I41bf94e6c7525106e990306913e446f2c4269df1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2710436
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72891}
2021-02-22 10:21:40 +00:00
Frank Tang
00038e19ca Fix Use-of-uninitialized-value
v8::internal::JSDateTimeFormat::New

Bug: chromium:1177812, chromium:1177623
Change-Id: I91e6babd796c6735e96e3cd1541d8aba51aaefee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2706353
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72878}
2021-02-19 21:11:27 +00:00
Thibaud Michaud
8229983acc [wasm][eh] Fix merge with phi in delegate
We always built a new Phi node for the delegate merge, which is
incorrect when the target block's exception is already a Phi. Use
CreateOrMergeIntoPhi instead.

R=clemensb@chromium.org

Bug: v8:11472
Change-Id: I8af3ab07d536ddfe247ace04cc844207d32adb99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2707167
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72874}
2021-02-19 17:14:46 +00:00
Clemens Backes
63946bd50e [liftoff] Add support for throwing exceptions
This is the first part of exception handling support in Liftoff. For
now, the only supported instruction is throw, and only with empty
payload or only i32 values.

R=thibaudm@chromium.org

Bug: v8:11453
Change-Id: I9fdf1328ef46655674a05186fb93216518886d03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704659
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72871}
2021-02-19 16:32:02 +00:00
Mike Stanton
be6990457b [TurboFan] Mark Code object as never serialized
Code objects are exposed through JSFunction and SharedFunctionInfo.
If they are builtins, we don't have to worry about background threads
seeing partially initialized code objects. If they are optimized code
objects, we may. Background threads read the code fields with
AcquireLoad semantics. The fields are set on the main thread with
ReleaseStore semantics when appropriate.

Special care is taken when setting an optimized code object in a closure
in the interpreter entry stub. Since the MacroAssembler doesn't support
ReleaseStore semantics, this CL ensures that the optimized code object
is stored with those semantics in the feedback vector, where the
interpreter entry stub finds it.

Bug: v8:7790
Change-Id: I41ecedfe0e9d1ad5091cbe9a97f66c66ca9e07dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2676633
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72869}
2021-02-19 14:49:47 +00:00
Santiago Aboy Solanes
a786179c47 [csa][cleanup] Simplify StoreFixedArrayElement
We can remove some of the method definitions, as well as the
sloppy-ness from the method.

Bug: v8:6949, v8:11384
Change-Id: I04880daa3fcce097b79009f12bd24128a47c2c80
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2690591
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72867}
2021-02-19 14:01:50 +00:00
Clemens Backes
6b86436154 [liftoff] Fix bug in instance caching
In {MergeFullStackWith}, we were accidentally looking at the cached
instance in the current {cache_state_} instead of the state passed as
{source}. This could lead to missing reload of the instance after a
conditional branch.

R=thibaudm@chromium.org

Bug: chromium:1179182
Change-Id: Ida3c06491f7973a183c43745159abbf6aa8a058b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2704081
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72864}
2021-02-19 13:13:05 +00:00