Commit Graph

58385 Commits

Author SHA1 Message Date
Toon Verwaest
f02b27aca1 [factory] Harden NewByteArray against negative length
Other array allocation methods in the factory already do the same anyway.

Bug: chromium:1003679
Change-Id: I05201dd5d124b530eb6b578abb1486e65d076cc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1806683
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63893}
2019-09-19 13:45:06 +00:00
Jakob Gruber
99d31b432f [build] Define V8_TARGET_OS_ and consider it in x64 codegen
This CL allows us to distinguish between the host- and target OS. The
host OS is defined by V8_OS_ macros (e.g. V8_OS_WIN). The target OS is
defined by V8_TARGET_OS_ macros (e.g. V8_TARGET_OS_WIN).

V8_TARGET_OS_ macros are defined by gn, based on the `target_os` gn
variable. If a V8_TARGET_OS_ is set, we also define V8_HAVE_TARGET_OS
(this determines fall-back behavior in V8; if it is not defined, we set
V8_TARGET_OS_ to equal the equivalent V8_OS_ define).

Besides adding the defines, this CL also adds logic to consider the
target OS in codegen. Specifically, x64 builds now look at the
V8_TARGET_OS_WIN define instead of V8_OS_WIN or _WIN64. This
effectively makes cross-compilation to x64 Windows in mksnapshot
possible.

In future work, we could add similar support for cross-compiling to
other platforms such as ia32 Windows.

Bug: v8:9736,chromium:803591
Change-Id: I689f3de8c206b743c4bef703f5ade0bba32ce995
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809374
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63892}
2019-09-19 13:38:56 +00:00
Dominik Inführ
ce304db8dc Revert "[heap] Disable old-to-new invalidation"
This reverts commit ac3c4fcfab.

Reason for revert: Tested this CL for backport.

Original change's description:
> [heap] Disable old-to-new invalidation
> 
> Disable invalidation of old-to-new slots for now. Invalidation doesn't
> match behavior of clearing slots directly in the remembered set.
> 
> Bug: chromium:1004365
> Change-Id: Ib6a21457827faafa75be88720c214e5ec483c71b
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813028
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63890}

TBR=ulan@chromium.org,dinfuehr@chromium.org

Change-Id: Id3d210cd970ea7b8e28571b7801b7a395e4f0af3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1004365
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813745
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63891}
2019-09-19 13:30:28 +00:00
Dominik Inführ
ac3c4fcfab [heap] Disable old-to-new invalidation
Disable invalidation of old-to-new slots for now. Invalidation doesn't
match behavior of clearing slots directly in the remembered set.

Bug: chromium:1004365
Change-Id: Ib6a21457827faafa75be88720c214e5ec483c71b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813028
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63890}
2019-09-19 13:27:56 +00:00
Ulan Degenbaev
337611a443 [api] Add [Shared]ArrayBuffer::New that takes a BackingStore
This complements [Shared]ArrayBuffer::GetBackingStore and allows the
embedder to transfer (shared) array buffers using only BackingStores.

Bug: v8:9380
Change-Id: I4714a27e06d5be43aef06dc633f11f2d43e4ee75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1811037
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63889}
2019-09-19 12:51:56 +00:00
Ross McIlroy
513c75116d [CSA] Ensure we only call ToName once in KeyedLoadICGeneric.
BUG=v8:6949,v8:9396,chromium:1005400

Change-Id: I18f50fc385dd83c8f1c551d1a3dc32714122eb00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813022
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63888}
2019-09-19 12:39:46 +00:00
Nico Weber
a776f00ad8 msan: Stop explicitly setting use_prebuilt_instrumented_libraries.
It's now set by default if is_msan is set.

Bug: v8:9715
Change-Id: I84e05ff9a495b666292891a12a3ebe485e4a768a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1810558
Auto-Submit: Nico Weber <thakis@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63887}
2019-09-19 12:37:55 +00:00
Clemens Hammacher
815df7d2c2 Revert "[ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly"
This reverts commit 6f9b2bd48a.

Reason for revert: Fails on nvidia bots, blocking LKGR: https://ci.chromium.org/p/v8/builders/ci/Win%20V8%20FYI%20Release%20(NVIDIA)/5005

Original change's description:
> [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly
> 
> On-heap typed arrays contain HeapObject value in |base_pointer| field
> and an offset in |external_pointer| field. When pointer compression is
> enabled we want to combine decompression with the offset addition.
> In order to do that we add an isolate root to the external_pointer value
> and therefore the data pointer computation can is a simple addition of
> a (potentially sign-extended) |base_pointer| loaded as Tagged_t value
> and an |external_pointer| value.
> 
> Bug: v8:9706
> Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63874}

TBR=ulan@chromium.org,neis@chromium.org,jgruber@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: I901280dd191e78d02969600f775c4f0da796921f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9706
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1813027
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63886}
2019-09-19 12:15:49 +00:00
Santiago Aboy Solanes
089a48813b [cleanup] Change VariableList to initializer lists when appropiate.
There are cases where using VariableList is the way to go, e.g BuildFastLoop.

Change-Id: I0dad242b69145b94725ce206938455127aabeb29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1806684
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63885}
2019-09-19 10:51:54 +00:00
Clemens Hammacher
7dd85c1d2f [wasm] Make compilation more predictable
If predictable compilation is requested (via --predictable,
--single-threaded, or --wasm-num-compilation-tasks=0), do compile and
commit one function at a time. This makes function allocation
independent of the timing.

R=ahaas@chromium.org

Bug: v8:9751, v8:9752
Change-Id: I451a436800c19574caa5e03901bd900d80e53eee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809371
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63884}
2019-09-19 10:08:04 +00:00
Ulan Degenbaev
55c48820f8 [api] Add [Shared]ArrayBuffer::GetBackingStore()
This adds an additional V8 API to get the backing store of an array
buffer. Unlike the existing API, the backing store comes wrapped
in a std::shared_ptr, making lifetime management with the embedder
explicit. This obviates the need for the old GetContents() and
Externalize() APIs, which will be deprecated in a future CL.

Contributed by titzer@chromium.org


Bug: v8:9380
Change-Id: I8a87f5dc141dab684693fe536b636e33f6e45173
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807354
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63883}
2019-09-19 10:03:02 +00:00
Santiago Aboy Solanes
cd8100b61e [CSA][cleanup] TNodify builtins promise gen (pt. 2)
The promise file is too big so I am splitting it in several CLs.

TNodified:
 * AllocatePromiseReaction
 * AllocatePromiseReactionJobTask
 * AllocatePromiseResolveThenableJobTask
 * CreatePromiseResolvingFunctions
 * CreatePromiseResolvingFunctionsContext
 * CreatePromiseContext

This CL introduces some CASTs that will be deleted once the file is
TNodified in full.

Bug: v8:6949
Change-Id: Ia3006faa5e9fd0e6fa3c58511772857910326532
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809360
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63882}
2019-09-19 10:01:57 +00:00
v8-ci-autoroll-builder
e8d74ad039 Update V8 DEPS.
Rolling v8/build: aae0a7b..050608e

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b4e53c4..2ad5356

Rolling v8/third_party/depot_tools: 6f9a023..c6be56e

Rolling v8/third_party/icu: faee8bc..2ecd66c

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I2f313f6893d13af4a2e8a351948a8df00a9bc3c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1811148
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63881}
2019-09-19 03:46:18 +00:00
Irina Yatsenko
a0d01b658f [heap] GC should not retain filler objects tracked by deferred handles
Added tests for the scenario when the fillers would be evacuated within the
new space and when they would be promoted into the old space.

The fix is to treat the deferred handles the same as the local ones:
call FixStaleLeftTrimmedHandlesVisitor for them.

Bug: v8:9739
Change-Id: Idac233716295f53793657164561bb81f8f729065
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809815
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63880}
2019-09-18 22:17:18 +00:00
Ng Zhi An
5097dcb706 Specify temp FP/SIMD register
Change-Id: Icb6a95efd042b116cb495d8bbee1d7261c4f1a05
Bug: v8:9643
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1706128
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63879}
2019-09-18 20:27:47 +00:00
Ng Zhi An
2cf821cc01 [wasm-simd] Implement QFMA and QFMS on x64
Quasi Fused Multiply-Add and Quasi Fused Multiply-Subtract performs, on floats, a + b * c and a - b * c respectively.
When there is only a single rounding, it is a fused operation. Quasi in this case means that the result can either be fused or not fused (two roundings), depending on hardware support.

It is tricky to write the test because we need to calculate the expected value, and there is no easy way to express fused or unfused operation in C++, i.e.
we cannot confirm that float expected = a + b * c will perform a fused or unfused operation (unless we use intrinsics).
Thus in the test we have a list of simple checks, plus interesting values that we know will produce different results depending on whether it was fused or not.

The difference between 32x4 and 64x2 qfma/qfms is the type, and also the values of b and c that will cause an overflow, and thus the intermediate rounding will affect the final result.
The same array can be copy pasted for both types, but with a bit of templating we can avoid that duplication.

Change-Id: I0973a3d28468d25f310b593c72f21bff54d809a7
Bug: v8:9415
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779325
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63878}
2019-09-18 20:25:07 +00:00
Ng Zhi An
72b8a49f7d Add disasm for vshl (register) on arm
Change-Id: Ib07ad54ef20877597dcf50a995a8f8a8e8dcb1c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809816
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63877}
2019-09-18 19:21:06 +00:00
Benedikt Meurer
42c98392a8 [debug] Don't disable the RegExp compilation cache when debugger is active.
Disabling the RegExp compilation cache comes with performance implications,
and it doesn't seem to be necessary for debugging.

Bug: chromium:992277
Change-Id: I24841f4814bcacb18a3968c37490f201c0c1ccac
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg,v8_linux64_gc_stress_custom_snapshot_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1805637
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63876}
2019-09-18 19:14:36 +00:00
Milad Farazmand
1225709e51 [wasm-simd] Adding Simd128ReverseBytes to all supported architectures
WASM only supports Little-endian byte ordering and we need a mechanism to
reverse the ordering efficiently on Big-endian machines.
Up until now this was done using TF graphs within wasm-compiler.
The new approach allows for having more machine level optimizations
by introducing the new "kSimd128ReverseBytes" opcode which gets executed
only on Big-endian machines.

Change-Id: I63c6c3c42ca9ff9d9b2af2d45070a70cf1b3cefc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803494
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#63875}
2019-09-18 19:01:16 +00:00
Igor Sheludko
6f9b2bd48a [ptr-compr] Make on-heap JSTypedArrays smi-corrupting friendly
On-heap typed arrays contain HeapObject value in |base_pointer| field
and an offset in |external_pointer| field. When pointer compression is
enabled we want to combine decompression with the offset addition.
In order to do that we add an isolate root to the external_pointer value
and therefore the data pointer computation can is a simple addition of
a (potentially sign-extended) |base_pointer| loaded as Tagged_t value
and an |external_pointer| value.

Bug: v8:9706
Change-Id: Id5c546c353c81fb25e3598921bc78165d10a9c44
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807369
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63874}
2019-09-18 16:43:11 +00:00
Dominik Inführ
c271cb7436 [heap] Emit debugging data before crashing
We see crashes in the wild, however the minidump does not contain enough
information for properly investigating this. This is temporary code
that should be deleted as soon as possible.

Bug: chromium:1004365
Change-Id: I25e119d891e03f980d63f5d559fcb4429b574cb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809373
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63873}
2019-09-18 15:05:44 +00:00
Mike Stanton
3c3bd14791 [Turbofan] Wiser zone allocation for child serializers
The serialization step in the pipeline gets an initial zone, and thus
far, it's allocated all of it's hinting information in that zone.
However, much of this comes from stepping into calls and
walking the bytecode of the called function. Once we finished
recursing into a call, we should be able to throw all those
hints away -- they've served their purpose, and the "output"
of their work is a set of new objects made visible to the broker.

Therefore, we should create and destroy a child zone.

On a run of typescript, this reduces absolute max (high water mark)
allocation of the serialization phase from 10 MB to 5 MB.

Bug: v8:7790
Change-Id: Icbb35abed28b1a924328541df82be23594152a8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800570
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63872}
2019-09-18 14:53:54 +00:00
Toon Verwaest
c45c2b9ced [ic] Only use StorePropertyWithInterceptor if there's an own setter
This fixes the issue highlighted in
https://chromium-review.googlesource.com/c/v8/v8/+/1803236.

Change-Id: Iea2d6c4f9585a56d017f2cb1eb8e23b52de1f795
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807356
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63871}
2019-09-18 14:10:13 +00:00
Michael Starzinger
e6f8d122f3 [wasm] Move {WasmModuleObject::GetContainingFunction}.
This introduces {GetContainingWasmFunction} to replace the above method,
since calculating offsets into the wire bytes is independent of the
concrete module object and hence only needs the shared decoded module.

R=clemensh@chromium.org
BUG=v8:6847

Change-Id: I145d527506289686653979dbb135480cc42ea4c8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809369
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63870}
2019-09-18 13:31:15 +00:00
Dan Elphick
33b5ca20d8 [builtins] Tnodify builtins-microtask-queue-gen.cc
Bug: v8:6949
Change-Id: I47f6832a01b7090229c80163012f3874d15d831f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809358
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63869}
2019-09-18 12:57:53 +00:00
Jakob Gruber
0721118d70 [snapshot] Allow an empty v8_extra_library_files
... and do not artificially add at least one dummy.js file.

Until this CL we used to ensure the existence of at least one 'extra
native' by appending a short dummy.js file if v8_extra_library_files
was empty. This file is uselessly compiled and run at startup.

This CL removes that mechanism along with a minor tweak to handle an
empty natives blob.

Bug: v8:9736
Change-Id: I05bf7c54380e77a9105d5c1a1a76983c692faf60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809372
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63868}
2019-09-18 12:49:19 +00:00
Ingvar Stepanyan
31f44eeab0 Fix Wasm reporting to multiple inspectors
Separate creating Wasm translations from reporting them to an agent.
This is done in order to support multiple connected sessions.

Previously connecting more than one agent would fail assertion in debug
mode and overwrite translation objects over and over
(and potentially do something worse) in release mode.

Bug: v8:9725
Change-Id: I13fde5ebf6e64e7268eb6870f9c21ac9a5bed81e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807273
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ingvar Stepanyan <rreverser@google.com>
Cr-Commit-Position: refs/heads/master@{#63867}
2019-09-18 12:48:13 +00:00
Simon Zünd
db3df9f67c Remove unnecessary HasOwnProperty check from Array#sort
During deletion in the write-back phase, we do not necessarly need
to check with HasOwnProperty before calling DeleteProperty. Since this
is observable behavior when using proxies, we remove the HasOwnProperty
check to mirror more closely what Spidermonkey does.

R=jgruber@chromium.org

Change-Id: I67768b1d8b13e695b956b2fa0624dcb28fd0664d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809366
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63866}
2019-09-18 12:39:43 +00:00
Ross McIlroy
b946521f18 [CSA][cleanup] Use Name instead of String type for var_name in KeyedLoadICGeneric.
BUG=v8:6949,v8:9396,chromium:1004912

Change-Id: Ifa8207283aadad258281bffda6d49da574402a24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809370
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63865}
2019-09-18 11:22:28 +00:00
Andreas Haas
761a2e7111 [arm64] Remove unnecessary calls to CPURegList::IsValid
In the mjsunit/wasm/asm-wasm-f32 test, {IsValid} caused 10% of the
overall runtime. In absolute numbers, {IsValid} wasm called more
than 6.000.000.000 times. I moved the calls to {IsValid} from
before-use to after-modification. I removed the calls in {Combine}
and {Remove}, because these operations cannot create an invalid
CPURegList.
These changes reduce the number of calls to {IsValid} to about
100.000.000 in the test mentioned above, and saves for that test
about 10 seconds out of before 2 minutes absolute runtime.

R=v8-arm-port@googlegroups.com

Bug: v8:9396
Change-Id: If3059f471e423405ec6f34ddef89e314dee1cbaf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801851
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63864}
2019-09-18 11:13:35 +00:00
Clemens Hammacher
8da3ed0802 Reland "Disallow nullptr arguments for {CopyChars}"
This is an unmodified reland of
60624b5692. Nosnap bots do not block
LKGR any more: https://crbug.com/v8/9737#c10.

Original change's description:
> Disallow nullptr arguments for {CopyChars}
>
> This allows to remove special casing for the {count == 0} case, which
> was needed because {memmove} does not accept {nullptr} arguments even
> if the {count} is zero.
>
> R=leszeks@chromium.org
>
> Bug: v8:9396
> Change-Id: Iaef3cdbbffa74c2ba1c4e4501dafd943282cbcd9
> Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807366
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63838}

TBR=leszeks@chromium.org

Bug: v8:9396
Change-Id: I6ab13575f13df060b450ff105e4b9db516671dcf
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809365
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63863}
2019-09-18 11:01:55 +00:00
Michael Starzinger
ebe0ae55f4 [wasm] Move {WasmModuleObject::GetFunctionOffset}.
This introduces {GetWasmFunctionOffset} to replace the above method,
since calculating offsets into the wire bytes is independent of the
concrete module object and hence only needs the shared decoded module.

R=clemensh@chromium.org
BUG=v8:6847

Change-Id: I6818de4589e26dd8f69dfb71d15bbca127c7ee3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809368
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63862}
2019-09-18 10:37:41 +00:00
Santiago Aboy Solanes
26372107aa [CSA][cleanup] TNodify builtins numbers gen
TNodify related methods in CSA:
 * TaggedToWord32OrBigInt
 * TaggedToWord32OrBigIntWithFeedback
 * TaggedToWord32OrBigIntImpl

Remove Sloppy-ness in RelationalComparison

Bug: v8:6949
Change-Id: I970a40a424f6e8cdc45544eb79c95291a5a5a608
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807362
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63861}
2019-09-18 10:01:52 +00:00
Michael Starzinger
d7903dd3de [wasm] Move {WasmModuleObject::DisassembleFunction}.
This introduces {DisassembleWasmFunction} to replace the above method,
since disassembling a function is independent of the concrete module
object and hence can be done for shared decoded modules.

R=clemensh@chromium.org
BUG=v8:6847

Change-Id: I5abea2a1381a9b8d3717a55d0b2b937dfbbafefd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809359
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63860}
2019-09-18 09:29:34 +00:00
Michael Starzinger
9d8aa1a6d1 [wasm] Make {Script} object reference {NativeModule} directly.
This is a first step towards being able to share the same script for
multiple {WasmModuleObject} objects. In general it should be possible
for the inspector to debug (i.e. disassemble, set breakpoints) multiple
modules if they all have the same URL (and the same wire bytes). These
are the same conditions under which we can canonicalize the modules to
be based on the same underlying {NativeModule} as well. Hence it makes
sense to establish a link from {Script} to {NativeModule} in this CL.

Subsequent CLs will eventually deprecate the {wasm_module_object} field.

R=clemensh@chromium.org
BUG=v8:6847

Change-Id: I5cfb617e18d9b06682e6437b2a2146ea5665c1c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807371
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63859}
2019-09-18 09:08:23 +00:00
Victor Gomes
0d6aa842e6 [Heap] Allocate descriptor array in young
This hopefully fix the regression test from c693e005a7

Bug: v8:1004766
Change-Id: If3c554070af6b795e4b3f99cd592a62453028874
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809363
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@google.com>
Cr-Commit-Position: refs/heads/master@{#63858}
2019-09-18 08:39:54 +00:00
Clemens Hammacher
3b808dee68 Reland^2 "Remove all custom CopyCharsUnsigned implementations"
This is an unmodified reland of
9febc505bd. Nosnap bots do not block
LKGR any more: https://crbug.com/v8/9737#c10.

Original change's description:
> Reland "Remove all custom CopyCharsUnsigned implementations"
>
> This is a reland of 5d8c489000
>
> Original change's description:
> > Remove all custom CopyCharsUnsigned implementations
> >
> > It's unclear whether the custom implementation have any advantage over
> > the standard library one's.
> > Since we update our toolchain and standard library regularly, it might
> > well be the case that the custom implementations are slower by now.
> >
> > Thus this CL removes all {CopyCharsUnsigned} implementations and
> > implements {CopyChars} generically using {std::copy_n}.
> >
> > Note that this does not touch the {MemMove} and {MemCopy} functions
> > yet, as we have seen regressions when trying to remove them before
> > (https://crbug.com/v8/8675#c5).
> >
> > R=leszeks@chromium.org
> >
> > Bug: v8:9396
> > Change-Id: I97a183afebcccd2fbb567bdba02e827331475608
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800577
> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#63808}
>
> Bug: v8:9396
> Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
> Change-Id: I9cd754ebe6b802bb4aabd6d2a448de41da040874
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807357
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63823}

TBR=leszeks@chromium.org

Bug: v8:9396
Change-Id: I793524d76b8b9c93d2a98c73e8d72967880fe1cf
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809362
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63857}
2019-09-18 07:45:43 +00:00
v8-ci-autoroll-builder
08454413d1 Update V8 DEPS.
Rolling v8/build: 3bf1aad..aae0a7b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/b19a360..b4e53c4

Rolling v8/third_party/depot_tools: 2c210a4..6f9a023

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I397f67e56c63bf89744a6d12729cb017023a8acc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809568
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63856}
2019-09-18 03:53:03 +00:00
Deepti Gandluri
766827d25f [wasm] Enable shared GrowMemory by default
ArrayBuffer tracking has landed, turning on GrowMemory for Shared
WebAssembly.memory on by default. Enable all variants of tests based
on the new implementation.

Bug: v8:8564, v8:9221, v8:8832
Change-Id: I0ff8688636303896450b788b2ff5a7268d386050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1808106
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63855}
2019-09-17 23:41:43 +00:00
Adam Klein
24c35b92bc Revert "Reland "Remove all custom CopyCharsUnsigned implementations""
This reverts commits 9febc505bd
(along with followup commit 60624b5692).

Reason for revert: Breaks win32 nosnap shared, blocking lkgr & roll:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20nosnap%20-%20shared/35145

nosnap bots may be deprecated, but as long as they're in LKGR
we need to mind them.

Original change's description:
> Reland "Remove all custom CopyCharsUnsigned implementations"
>
> This is a reland of 5d8c489000
>
> Original change's description:
> > Remove all custom CopyCharsUnsigned implementations
> >
> > It's unclear whether the custom implementation have any advantage over
> > the standard library one's.
> > Since we update our toolchain and standard library regularly, it might
> > well be the case that the custom implementations are slower by now.
> >
> > Thus this CL removes all {CopyCharsUnsigned} implementations and
> > implements {CopyChars} generically using {std::copy_n}.
> >
> > Note that this does not touch the {MemMove} and {MemCopy} functions
> > yet, as we have seen regressions when trying to remove them before
> > (https://crbug.com/v8/8675#c5).
> >
> > R=leszeks@chromium.org
> >
> > Bug: v8:9396
> > Change-Id: I97a183afebcccd2fbb567bdba02e827331475608
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800577
> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#63808}
>
> Bug: v8:9396
> Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
> Change-Id: I9cd754ebe6b802bb4aabd6d2a448de41da040874
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807357
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63823}

TBR=leszeks@chromium.org,clemensh@chromium.org

Change-Id: Ic53ab2293d5dc7722a1121d1aa1159328a6ed8f5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9396
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1808035
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63854}
2019-09-17 23:32:55 +00:00
Shu-yu Guo
0424b5efba Add syg@chromium.org as DEPS owner for test262 rolls
NOTRY=true

Bug: v8:7834
Change-Id: I84bd68dd6e94a882a1c20075b9b23ba08dab4136
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1801257
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63853}
2019-09-17 19:29:11 +00:00
Georg Neis
f1fb43a0ab [runtime] Remove buggy dead code path from Runtime_CreateRegExpLiteral
Runtime_CreateRegExpLiteral pretends to handle the case where we
already have a boilerplate but the code just passes an empty handle
to JSRegExp::Copy. This CL replaces the code with a CHECK that the
boilerplate doesn't exist.

A few mostly cosmetic changes along the way.

Change-Id: I856c77c1cdf58f09e920b773b66b037c5178edc7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1809357
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63852}
2019-09-17 17:22:02 +00:00
Z Nguyen-Huu
84d724deda [builtins] Port Regexp exec to Torque
Bug: v8:8976
Change-Id: Iede3b662188392303949edf2a9f0c585976695ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1806100
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63851}
2019-09-17 17:10:31 +00:00
Frank Tang
9849000141 [Intl] Fix m(ax|in)imumFractionDigits for currency
Fix m(ax|in)imumFractionDigits of Intl.NumberFormat
resolvedOptions are set to 0. For example, currency
instance for CPY or KRW.

Bug: chromium:1003748
Change-Id: Ia1963d8d070b066bd5afa61f8c4716a21450af05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807742
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63850}
2019-09-17 16:34:00 +00:00
Santiago Aboy Solanes
4dfbe61ab9 [CSA][cleanup] TNodify builtins promise gen (pt. 1)
The promise file is too big so I am splitting it in several CLs.
This is the first one.

TNodified:
 * AllocateAndInitJSPromise (three versions)
 * PerformPromiseThen
 * AllocateJSPromise

Bug: v8:6949
Change-Id: I57ae8de3f929c00a9127ea4be51ffe7703b44959
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807370
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63849}
2019-09-17 16:30:50 +00:00
Santiago Aboy Solanes
7fcbde16e7 [CSA][cleanup] TNodify builtins regexp gen
Bug: v8:6949, v8:9396
Change-Id: I035a00f61077e49377c9cd39ae1b216a80c98e6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803615
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63848}
2019-09-17 16:10:50 +00:00
Dan Elphick
c3d7f5f188 [csa] Tnodify builtins-intl-gen.cc
This moves PointerToSeqStringData from CSA to IntlBuiltinsAssembler
since that the only place it's used and converts a few Node*s to TNodes.

Bug: v8:6949, v8:9396
Change-Id: I2511c9f807fa0bc3101dd531f6724a170fed6bd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807372
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63847}
2019-09-17 15:26:55 +00:00
Santiago Aboy Solanes
29bdb26bcb [CSA][cleanup] TNodify builtins conversion gen
One Node* remains since it is crashing when TNodified since it
has the empty Context. When this happens, it means the Context
might not be needed. In this case it's hard to see if that's the
case since it is propagated all over the place. Created a TODO
so we can solve it later, when TNodification is more complete.

Bug: v8:6949
Change-Id: I7db8c507689e30779f102a8272e1b13ecdc3e5e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807274
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63846}
2019-09-17 15:19:49 +00:00
Ross McIlroy
11b819c679 [CSA][cleanup] TNodify TryToName, TryToIntPtr and TryInternalizeString.
BUG=v8:6949,v8:9396

Change-Id: Icd65e16f6b5b41ad56d1b8767a73e8ca15d05b74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807365
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63845}
2019-09-17 14:56:34 +00:00
Georg Neis
1f3b2d4ec2 [api] Support CreationContext() on module namespace objects
Bug: v8:9713
Change-Id: I80b8f72ce4617b314f6c4991297a6464f67cbbec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1807364
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63844}
2019-09-17 14:55:29 +00:00