Commit Graph

65036 Commits

Author SHA1 Message Date
Ng Zhi An
ebcff9e131 [wasm] Read prefixed opcodes as u32v
Prefixed opcodes have a 1 byte prefix, followed by LEB-encoded u32. This
changes all prefixed opcodes (gc, numeric, atomic), to that. (Simd was
already so.)

We can clean up read_prefix_opcode to return the total number of bytes,
1 byte prefix + leb encoded, that will be in a future patch.

Bug: v8:10810,v8:10994
Change-Id: Ia74604acc059c1336b87e9f477598732de219ca9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465057
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70544}
2020-10-15 17:10:48 +00:00
Ng Zhi An
4dc2246b09 Skip regression test that is blocking DEPS upgrade
Bug: chromium:1138117
Change-Id: I7b4f5de864ede23672b9c5032556e71a85e09d18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476533
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70543}
2020-10-15 17:09:43 +00:00
Ng Zhi An
7fc881f50e [x64] Move modrm decoding up the scope
Instead of decoding in each branch, move the decoding up in scope, since
all branches do the same decoding.

Bug: v8:10933
Change-Id: I99ef03e4271cc111428f9a243f61b26af6f85780
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2472758
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70542}
2020-10-15 16:17:23 +00:00
Victor Gomes
152372985b [x64] Simplify AssembleReturn
- Shortcut return when argc < param_count
- Simplify return code due to PopAndReturn invariant

Change-Id: Ie41d559cdbe0ba2cc4fdbfbbb622b0aec8429f03
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474777
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70541}
2020-10-15 16:13:08 +00:00
Milad Fa
382ae3f7b8 PPC: Update inline asm constraint in cctest-utils
"std/stw" must always store to a memory address.
Destination cannot be another register.

Change-Id: I424bd535033937b3876f58ca5a4530aeac43e182
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476064
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70540}
2020-10-15 16:12:03 +00:00
Maya Lekova
d84109963d Revert "[wasm-gc] Implement call_ref on WasmJSFunction"
This reverts commit 6227c95e5f.

Reason for revert: Breaks Mac64 GC stress - https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8866365194967638384/+/steps/Check_-_d8/0/logs/call-ref/0

Original change's description:
> [wasm-gc] Implement call_ref on WasmJSFunction
>
> Changes:
> - Introduce turbofan builtin WasmAllocatePair.
> - Implement call_ref for WasmJSFunction in wasm-compiler.cc.
> - Remove WasmJSFunction trap.
> - Improve and extend call-ref.js test.
>
> Bug: v8:9495
> Change-Id: I8b4d1ab70cbbe9ae37887a6241d409eec638fd28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463226
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70535}

TBR=clemensb@chromium.org,manoskouk@chromium.org

Change-Id: Ifad2cd8185df5e8d6766cefbcd3f28234a157dfb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9495
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2475735
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70539}
2020-10-15 15:22:18 +00:00
Shu-yu Guo
ed0b63a600 Mark assignment to call expression test262 tests as deliberate incompat
Expressions like `foo() = 42` are specified as syntax errors but due to
web compat must be kept as runtime errors.

Bug: v8:10976
Change-Id: If2b549a3a1c35248c46319fa0e898872d40789a8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2471979
Auto-Submit: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70538}
2020-10-15 15:21:15 +00:00
Mike Stanton
2595997846 Enable disabled profiler test
test-heap-profiler/AllocationSitesAreVisible was disabled unnecessarily
for quite some time. With a minor fix, it's possible to validate that
an AllocationSite can be seen through the heap profiler interface.

Change-Id: I0ac6c218da12ab268bd08c65926149f5c00e5b06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474778
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70537}
2020-10-15 14:54:43 +00:00
Ross McIlroy
13436edce2 [TurboProp] Handle allocation of phis which are never used
In certain situations a phi might not be used by later code, and so
is neither spilled nor has a register allocated to it. Handle this
by removing the incorrect DCHECK.

BUG=chromium:1137979,v8:9684

Change-Id: I702dc05dba22e23dac5c1a366a770f18bac45c52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2471998
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70536}
2020-10-15 14:52:33 +00:00
Manos Koukoutos
6227c95e5f [wasm-gc] Implement call_ref on WasmJSFunction
Changes:
- Introduce turbofan builtin WasmAllocatePair.
- Implement call_ref for WasmJSFunction in wasm-compiler.cc.
- Remove WasmJSFunction trap.
- Improve and extend call-ref.js test.

Bug: v8:9495
Change-Id: I8b4d1ab70cbbe9ae37887a6241d409eec638fd28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463226
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70535}
2020-10-15 14:30:23 +00:00
Ross McIlroy
679a97093d [TurboProp] Avoid spills when merging blocks by adding gap moves.
When merging blocks in the mid-tier register allocator, try to avoid
spilling registers if we can instead introduce a gap move to move the
register choosen to hold a virtual register to the register that is
holding that virtual register in the successor block. This gives
around 1.5% speedup on Octane.

BUG=v8:9684

Change-Id: I352d1e0e2c3b89ab6bd203d76339b93ef474028f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2466117
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70534}
2020-10-15 13:26:43 +00:00
Martin Bidlingmaier
2061be2f27 [regexp] Fix interrupt test that flaked due to fallback
Bug: v8:11023
Change-Id: I0722338c6d82b665120f9ef8c7076e0c4983b4c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474773
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Cr-Commit-Position: refs/heads/master@{#70533}
2020-10-15 13:22:33 +00:00
Victor Gomes
ee41b15784 [cleanup] Sync frames.h and frame-constants.h
- Add a frame inheritance hierarchy comment.
- Rename StandardFrame from frame.h to CommonFrame: StandardFrame usually means a JavaScript frame in other files.
- Create a TypedFrame and adjust every frame that depends on it.

Change-Id: I105a4ba95954c02e43bcbe2b677e554b9e9af092
Bug: v8:10933
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431568
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70532}
2020-10-15 13:14:03 +00:00
Victor Gomes
f4c42cabcf [asmjs] Fix InstantiateAsmJs when no arguments adaptor
Change-Id: Idd0443968cc097a4e7339d7f26ca049909a8eddc
Bug: chromium:1138776, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474791
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70531}
2020-10-15 12:46:03 +00:00
Zhao Jiazhong
a58de79c4f [mips] Fix floating-point rounding ops
The RoundFloat/RoundDouble functions should return the Canonical
NaN if the input is a NaN.

Change-Id: I19928a8a3d78770757c6fe2e240254efe9944bdc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2475493
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70530}
2020-10-15 12:33:03 +00:00
Clemens Backes
10dbddd1e8 [wasm] Fix stepping from a non-breakable position
... at function start. Otherwise we run into a position mismatch:
In a non-flooded function, we add the function-entry breakpoint (for
"hook on function call") with the position of the first opcode.
In the flooded function though, we skip that special breakpoint because
we will stop at the first instruction anyway. But then the first
instruction is non-breakable, so we don't actually emit a breakpoint for
it.
Hence during OSR we do not find a corresponding position in the new
code.

This CL fixes this by postponing the function-entry breakpoint until the
first breakable opcode is found, and only emits it if that position does
not have a breakpoint anyway.
This way, we can also move the handling for function-entry breakpoints
from {StartFunctionBody} to {EmitDebuggingInfo}, where it fits much
better.

R=thibaudm@chromium.org

Bug: chromium:1137710
Change-Id: Idfa658fa0897cca89ba5ee3066cd414f68864d06
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474774
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70529}
2020-10-15 11:35:43 +00:00
Clemens Backes
b47c42e3ab [wasm][test] Consolidate stepping tests
Stepping always happens in Liftoff now, and always by byte offset. Thus
remove the redundant "wasm-stepping-byte-offset" test, which was fully
subsumed by "wasm-stepping-liftoff". Also, rename
"wasm-stepping-liftoff" to "wasm-stepping".

R=thibaudm@chromium.org

Bug: chromium:1137710
Change-Id: Ifb68ce795ecdcbb1f85500dc4be4c2e64d15a9c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474116
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70528}
2020-10-15 11:11:33 +00:00
Michael Lippautz
86facf07b2 cppgc: Fix TraceTrait for JSMember
Template specializations must use exact types to match.

Bug: chromium:1056170
Change-Id: I2278e9b40712fc209044fe565023029cc5ae3ff3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474776
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70527}
2020-10-15 10:55:13 +00:00
Georg Neis
193cfbf011 [compiler,cleanup] Remove some redundant stuff
In particular: initial values of local ArchOpcode variables that
get overwritten anyways. Creating these variables uninitialized makes
that obvious.

Change-Id: Ia205b5397c60769a46bf28ed60b299ac652f4b28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470557
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70526}
2020-10-15 10:03:53 +00:00
Omer Katz
718fbb89ef cppgc: Support ephemeron tracing
Cppgc exposes EphemeronPair that contains a WeakMember key and a Member
value and can be used to denote ephemeron semantics in the standalone
library.
Tracing EphemeronPairs goes through TraceEphemeron that is exposed on
the api for the blink usecase.

Bug: chromium:1056170
Change-Id: I9fbaa284fa2034248cdf36ea8b0cd5be6a55f676
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467842
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70525}
2020-10-15 10:01:23 +00:00
Santiago Aboy Solanes
58b4f729a1 [unwinder] Add support for the remanining unwinder tests
This gives Arm32/64 test parity with x64.

Bug: v8:10833
Change-Id: I51c3a61c1529dd17782c60ca5aa6508c6e57ce1a
Fixed: v8:10833
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467850
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70524}
2020-10-15 09:02:03 +00:00
Javad Amiri
52baa13143 [heap] Add missing third-party heap guards
Bug: v8:9533
Change-Id: I912bd5acd2cdb4c9d111711d17a01ba635b76660
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463006
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70523}
2020-10-15 08:36:03 +00:00
Georg Neis
04c85d7cf8 Revert "[compiler, heap] Create LocalHeap outside of ExecuteJob"
This reverts commit 44708a5b6f.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/33692

Original change's description:
> [compiler, heap] Create LocalHeap outside of ExecuteJob
>
> Create LocalHeap directly in the Task or in GetOptimizedCodeNow and
> pass its reference as argument to ExecuteJob. This allows us to create
> LocalHeap differently for the main and background thread, e.g. by
> passing an additional argument to the constructor in the future.
> It will be required in the future anyways when the main thread will
> have its own LocalHeap/LocalIsolate.
>
> Extending the scope of LocalHeap, also made
> HandleBase::IsDereferenceAllowed more precise and uncovered two
> potential issues: heap accesses in
> OptimizingCompileDispatcher::CompileNext and PipelineImpl::AssembleCode
> with --code-comments.
>
> LocalHeap can now be created in the parked state. Also fixed a data
> race with LocalHeap's destructor publishing write barrier entries
> without holding the lock.
>
> Bug: v8:10315
> Change-Id: I9226972601a07b87108cd66efbbb6a0d118af58d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2460818
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70521}

TBR=ulan@chromium.org,neis@chromium.org,leszeks@chromium.org,solanes@chromium.org,dinfuehr@chromium.org

Change-Id: I9dd1f8ca6237d5716b6d8938cef0ee3f642f3166
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2474118
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70522}
2020-10-15 07:51:55 +00:00
Dominik Inführ
44708a5b6f [compiler, heap] Create LocalHeap outside of ExecuteJob
Create LocalHeap directly in the Task or in GetOptimizedCodeNow and
pass its reference as argument to ExecuteJob. This allows us to create
LocalHeap differently for the main and background thread, e.g. by
passing an additional argument to the constructor in the future.
It will be required in the future anyways when the main thread will
have its own LocalHeap/LocalIsolate.

Extending the scope of LocalHeap, also made
HandleBase::IsDereferenceAllowed more precise and uncovered two
potential issues: heap accesses in
OptimizingCompileDispatcher::CompileNext and PipelineImpl::AssembleCode
with --code-comments.

LocalHeap can now be created in the parked state. Also fixed a data
race with LocalHeap's destructor publishing write barrier entries
without holding the lock.

Bug: v8:10315
Change-Id: I9226972601a07b87108cd66efbbb6a0d118af58d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2460818
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70521}
2020-10-15 06:11:03 +00:00
Ng Zhi An
944dad59c8 [x64] Add movlps and movhps to assembler
These instructions will be used for prototyping Wasm SIMD's store lane
later on, separated the implementation for assembler and disassembler
into this patch to make things smaller.

Curiously, movhps and movlhps seems to have the same encoding, 0f 16, so
I'm not sure not sure how to differentiate them in the disassembler
besides using the mod field, since movlhps only takes xmm registers,
whereas movhps always take 1 operand.

Bug: v8:10975
Change-Id: I8be9a31b1c9a5515038f9c8c55ef30d1ba063ea7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2471977
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70520}
2020-10-15 00:37:32 +00:00
Zhao Jiazhong
8a4194ddad [mips64][wasm-simd] Fix codegen for floating-point min/max ops
dst may be the same register as src0/src1, so it shouldn't be
overwritten if we still need src0 and src1's values.

And the NaN was not properly canonicalized, this CL adds fmin/fmax
instructions to canonicalize the result.

Change-Id: Ia65829015eb6c4de160298719d694ca9490883b7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465775
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Cr-Commit-Position: refs/heads/master@{#70519}
2020-10-15 00:34:03 +00:00
Ng Zhi An
752aba9dce [wasm-simd] LoadTransform is always a SIMD operation
LoadTransform is always a SIMD operation (it always results in a v128),
so it should unconditionally set has_simd_.

Bug: chromium:1137583
Change-Id: I8496e787c89edec734f4bbfd16dd8b5995fab98a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2472638
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70518}
2020-10-15 00:07:03 +00:00
Ng Zhi An
8387acfab2 [x64] Change pextrw and pextrb to take uint8_t immediates
Make everything consistent, pinsr family was converted in
https://crrev.com/c/2443494.

Bug: v8:10933
Change-Id: I9d09bd477520ce71fccdcf4336135b54c058185c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470203
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70517}
2020-10-14 21:21:12 +00:00
Ng Zhi An
96b7d98a92 [x64] Use macro list to define AVX instructions
We were already using it to define the SSE instructions.

Bug: v8:10933
Change-Id: I8c70c027449ee8b0d00a06298087310ced11cafc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470200
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70516}
2020-10-14 21:14:22 +00:00
Michael Lippautz
86b458396f cppgc: Pass on source location when tracing roots
Bug: chromium:1056170
Change-Id: Ib03a09db010f3ad06701520fc39e7e83055dbb9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467855
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70515}
2020-10-14 20:39:02 +00:00
Z Nguyen-Huu
b22f5ac6e7 [turbofan] Avoid relaxing node that has other effect use
It is related to Reduce consecutive overflow addition with constants.
Turned out that we needs to consider also effect use before relaxing it.

This fixed the issue that fuzzer found in e93a369f7a.

Bug: chromium:1137586
Change-Id: I32fee5ecc7a6ce40d6f739f9c6e2440a647a2222
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469597
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70514}
2020-10-14 19:16:02 +00:00
Milad Fa
04221a96a3 [snapshot] Remove RELATIVE_CODE_TARGET from the serializer mask
kModeMask needs to match the previous declaration of
mode_mask which was removed in this CL:
https://crrev.com/c/2452689

Bug: v8:11007
Change-Id: I2435309b0147b05438902eef440816e3f82aff9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2466053
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70513}
2020-10-14 17:46:21 +00:00
Milad Fa
6e59e92701 AIX: workaround the aix FP glibc bug
Due to a bug on AIX, some of the glibc FP functions do not
preserve the sign bit when a negative input is passed by
value and the output is rounded to 0:
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97086

This CL forces the use of "-0.0" in such cases.

Change-Id: If9935596e32e97720f3cb22f27975267ac1124d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2468618
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70512}
2020-10-14 17:42:51 +00:00
Ng Zhi An
36359cc91a [arm64] Fix a stale todo and reorder opcodes
The todo is "fixed", in that we found the root cause, and recent
refactorings have given us more breathing space in the number of
opcodes, and also a static_assert was added to give a clearer error
message.

Bug: v8:10930
Change-Id: Ied47bf6a61a2bc70949c45f9d00d714b313a5192
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469157
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70511}
2020-10-14 17:30:51 +00:00
Martin Bidlingmaier
1e1f9ffc66 [regexp] Enable fallback to experimental engine by default
This CL enables the functionality that was added in d4febb6b46 by
flipping the corresponding feature flag.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Bug: v8:11021
Change-Id: Id061a274b016c71e6a4f7d7934a9c287d3124228
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470568
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70510}
2020-10-14 17:29:46 +00:00
Zentaro Kavanagh
85992b6585 Mark classes with final dtors as final
- -Wfinal-dtor-non-final-class warns on classes with final dtors but
  not final classes.
- Error messages are better when the class is marked final.
- Fix existing issues in code base and remove warning exemption

Bug: chromium:999886
Test: no errors building
Change-Id: Ied2a7a2ff890ecbaf0a4c84f5323f0c9d32def58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467000
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Zentaro Kavanagh <zentaro@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70509}
2020-10-14 17:28:41 +00:00
Clemens Backes
0af542c8dd [wasm] Grow number of compilation queues dynamically
Instead of querying the platform for the number of available threads,
and allocating exactly N+1 queues, do grow the number of queues
dynamically. This allows for more than N+1 concurrent threads,
which then allows us to contribute to compilation instead of waiting
doing nothing. This will be added in a follow-up CL.

Special care is being taken to not synchronize too much between threads.
We take a shared mutex whenever stealing tasks, but not on the default
path where we pick a unit from the task's own queue.

R=thibaudm@chromium.org
CC=​etiennep@chromium.org

Bug: v8:11005
Change-Id: I1f67f15fb22b95ef246c37eb80c03132d8a1d149
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_isolates_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg_ng
Cq-Include-Trybots: luci.v8.try:v8_mac64_gc_stress_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467844
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70508}
2020-10-14 16:07:19 +00:00
Dominik Inführ
41b5c8d052 [heap] Reset time_to_collection_scope_ on TearDown
Scope might still be in progress and needs to be closed when starting
tear down. There will be no GC after starting tear down anymore.

Bug: v8:11022, v8:10315
Change-Id: I50ea02b13b84ef4fbbc08985ca9e25e0b0ec856d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470572
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70507}
2020-10-14 15:22:39 +00:00
Seth Brenith
67bae938f7 [torque] Verify the verifiers
This change adds test functions to check that the Torque-generated
verifiers can catch a few basic kinds of errors and crash the process.

Bug: v8:7793
Change-Id: If0d2b1e8834c3e602c2677253ad3a920566414bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469039
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#70506}
2020-10-14 15:07:09 +00:00
Victor Gomes
2cae49cce0 [builtins] Update arguments size DCHECK in CPP builtins
Change-Id: I468d64df5d1a06a395249d16c8974d3dec85fe7b
Bug: chromium:1138197, v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470570
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70505}
2020-10-14 13:55:29 +00:00
Almothana Athamneh
19076e1ade Delete reverse_jsargs bots
Bug: v8:11018
Change-Id: I36fc948ebea7c5a648307f82e1940678068d2990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470559
Commit-Queue: Almothana Athamneh <almuthanna@chromium.org>
Reviewed-by: Liviu Rau <liviurau@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70504}
2020-10-14 13:33:50 +00:00
Vicky Kontoura
26310718e4 [wasm] Replace generic js-to-wasm wrapper when threshold is reached
This CL adds a basic tiering strategy for the js-to-wasm wrappers.
When applicable, calls to exported WebAssembly functions are initially
handled through the generic js-to-wasm wrapper. If these calls
through the generic wrapper reach a constant threshold, the specific
(per-signature) wrapper is compiled synchronously for the function
and the generic wrapper is replaced.

Bug: v8:10982
Change-Id: I65e706daffb5cb6e723ce2f7b785f7ecb7b2fa7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2461243
Commit-Queue: Vicky Kontoura <vkont@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70503}
2020-10-14 13:21:59 +00:00
Victor Gomes
50ddb12d2c [cleanup] Remove V8_REVERSE_JSARGS flag
Change-Id: I2f262f4545de9e421310094d0dfab2f6147869b5
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2466116
Reviewed-by: Junliang Yan <junyan@redhat.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70502}
2020-10-14 12:25:06 +00:00
Clemens Backes
d2d7f47655 [wasm] Fix --trace-wasm-decoding for boolean validation
With boolean validation, we don't keep the PC for stack values any more.
This CL fixes the --trace-wasm-decoding logic to just not print the
opcode which produced a value. The producer can also be found by looking
back in the trace.
This also makes the tracing output a lot more concise, hence easier to
read.

Also fix the TraceFailed method to not try to print buffer relative
offsets if no PC is there.

R=zhin@chromium.org

Bug: v8:10969
Change-Id: I5a7a69ea5aa461a277401d87ee24635266517d3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2465837
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70501}
2020-10-14 11:57:06 +00:00
Martin Bidlingmaier
d4febb6b46 [regexp] Use experimental engine if backtrack limit exceeded
We fall back from irregexp to the experimental engine if a backtrack
limit is exceeded and the experimental engine can handle the regexp.
The feature can be turned on with a boolean flag, and an uint-valued
flag controls the default backtrack limit.  For regexps that are
constructed with an explicit backtrack limit (API,
%NewRegExpWithBacktrackLimit), we choose the lower of the explicit and
default backtrack limits.
The default backtrack limit does not apply to regexps that can't be
handled by the experimental engine, and for such regexps an explicitly
specified backtrack limit is handled as before by returning null if we
exceed it.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:10765
Change-Id: I580df79bd847520985b6c2c2159bc427315c89d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2436341
Commit-Queue: Martin Bidlingmaier <mbid@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70500}
2020-10-14 11:18:37 +00:00
Victor Gomes
a0af1c2bc2 [test] Fix StackAlignment test
Change-Id: Icd094eaa12b957bc7a658807aaa565665a184c81
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2470561
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70499}
2020-10-14 10:48:27 +00:00
Michael Lippautz
0b48da8be8 cppgc: Add HoH::Trace utility method
Bug: chromium:1056170
Change-Id: I65a2b38c85a93ac2822cb7d2b7ac4bd66540348a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2468996
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70498}
2020-10-14 08:36:56 +00:00
Victor Gomes
2e7a9b0449 [x64] Turn on v8_disable_arguments_adaptor
Change-Id: Ie8e2a87fa079b602f895c3c98053b7e7dfc61f45
Bug: v8:10201
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440098
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70497}
2020-10-14 08:13:56 +00:00
Jakob Gruber
d5a80ba4df Reland "[nci] Prepare JSForInPrepare and JSForInNext for feedback input"
This is a reland of 16cd5995f9

Changes since the original CL: generic lowering support for ForInPrepare
and ForInNext.

Original change's description:
> [nci] Prepare JSForInPrepare and JSForInNext for feedback input
>
> These two operators are still missing feedback collection in generic
> lowering (reminder: all operations that collect FB in the interpreter
> must also collect FB in generic lowering).
>
> This CL prepares for that by adding the feedback vector as an input,
> and additionally adds node wrappers to improve useability.
>
> The actual collection logic will be added in a following CL.
>
> Bug: v8:8888
> Change-Id: I04627eedb2dc237dc4e417091c44d2a95bd98f5f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454712
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70372}

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:8888
Change-Id: Idc294ffd2a24922edd08db6897d32d5724956995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2459373
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70496}
2020-10-14 06:18:36 +00:00
v8-ci-autoroll-builder
5b68566824 Update V8 DEPS.
Rolling v8/base/trace_event/common: e0f2b84..ea3ab7b

Rolling v8/build: 18a5f87..4af5c07

Rolling v8/third_party/aemu-linux-x64: PL87Lj_q7GOEzYJ2eJIJAzMtQbuLWVnmjDQPqfu2O64C..7vSUW_nuKSjSwu_SJlXmDCOkdOAMe1nyjgN02vO04jEC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/cd2eebd..01898ca

Rolling v8/third_party/depot_tools: b073999..6e970e5

Rolling v8/tools/clang: 7e5979b..d4827bf

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I26b4159ee973fab9af5d540d1fb269d19eed105e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2469819
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70495}
2020-10-14 03:39:26 +00:00