Port CreateBreakIterator and BreakIterator.prototype.resolvedOptions to
C++, refactoring the entire class into another one called
JSV8BreakIterator that would be a subclass of JSObject.
TBR: benedikt@chromium.org
Bug: v8:8111
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I9bd1d82ec34b210c8ed59ea6576548d45a34b8d5
Reviewed-on: https://chromium-review.googlesource.com/1198946
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55627}
Since the benchmark is very fast, a warmup is useful to reduce the noise
created by optimization.
Change-Id: I4902c5c1695099be766d0fcc563c2f5d0892d3a9
Reviewed-on: https://chromium-review.googlesource.com/1204112
Commit-Queue: Hai Dang <dhai@google.com>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55618}
This fixes an off-by-one in the ordering restriction check for exception
sections in a module. It also adds proper testing for exception handling
of indirect calls. This in turn adds a table section that triggers the
aforementioned bug.
R=clemensh@chromium.org
TEST=mjsunit/wasm/exceptions,unittests/WasmModuleVerifyTest
BUG=v8:8091
Change-Id: Ie44ad4dee1b0c623f069fca7661c4282492b52d6
Reviewed-on: https://chromium-review.googlesource.com/1203993
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55615}
{go} sounds active, as if the state would be changed. {reached} sounds
like an accessor.
Drive-by: Make the accessor const to further clarify that this is just
an accessor.
R=titzer@chromium.org
Bug: v8:8015
Change-Id: I80d5223b9573345d3de386d68871a9e828621fc0
Reviewed-on: https://chromium-review.googlesource.com/1203992
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55614}
Utf*Characterstream caches the data pointer of ExternalStrings through
ExternalStringStream, so lock the strings in ExternalStringStream.
Bug: chromium:877044
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I241caaf64e109b33e2f9982573e11c514410509c
Reviewed-on: https://chromium-review.googlesource.com/1194003
Commit-Queue: Benoit L <lizeb@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55613}
Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.
This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.
This reland addresses several issues:
* Removed "sparse" array support from splice.
* Addressed ClusterFuzz issue 876443:
The test and code that uses the fix is in this CL.
The fix in isolation can be seen here:
https://chromium-review.googlesource.com/c/v8/v8/+/1199403
* Removed dead code in elements.cc
BUG=chromium:876443, v8:8131, v8:1956, v8:7221
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
Reviewed-on: https://chromium-review.googlesource.com/1201783
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55610}
Since https://crrev.com/c/1112003, the memory size is stored as size_t
instead of uint32_t in order to support 4GB memories.
Loading it as uint32_t only works on little-endian systems, and only for
memory sizes <4GB. This CL fixes this to load and process the memory
size as pointer-sized value.
Additional platform-specific methods are added to perform a shift by a
constant value. This can be reused to improve the generated code for
other shifts.
R=titzer@chromium.org
Bug: v8:8130, v8:6600
Change-Id: Ifa688a3ed0e2809190571f24bdf47a7f53880b3d
Reviewed-on: https://chromium-review.googlesource.com/1203950
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55609}
Also extend the API to reflect this new feature.
R=jgruber@chromium.org, szuend@google.com, ulan@chromium.org
Bug: v8:8125
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ic7a7604a8c663ba04b324eb8902ff325a25654e7
Reviewed-on: https://chromium-review.googlesource.com/1202087
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55604}
This fixes exception creation (by the WebAssembly throw operation) so
that it is not observable by JavaScript. Internal properties are now
stored with symbol names instead of string names, which also prevents
them from being accessed or monkey-patched directly by JavaScript.
R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regress-8094
BUG=v8:8094
Change-Id: I33cb27f4373114cd4db28d9aef23560093e55242
Reviewed-on: https://chromium-review.googlesource.com/1203951
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55602}
WebAssembly.Instantiate would silently fail when the passed in memory
object did not have guard regions even though the compiled module assumes
so. This lead to an inconsitent state and a DCHECK error. Instead, now
throw a LinkError.
Change-Id: I68bab842bcc40d3325aea4b19979d80054ed407c
Reviewed-on: https://chromium-review.googlesource.com/1180892
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55601}
The wasm compiler used Pipeline::GenerateCodeForTesting to generate code
for various stubs. This change adds a dedicated entry point and moves
some common code there.
Bug: v8:8015
Change-Id: Ied628ba14c36e68826cb71d00506994184cc4763
Reviewed-on: https://chromium-review.googlesource.com/1196885
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55599}
In general, whether an error thrown from a script will be muted is
passed as (part of) ScriptOriginOptions when the script is compiled.
Currently, when eval is called, that information is not given, and it
uses the default options (IsSharedCrossOrigin = false,
IsOpaque = false). Give it the options for the script in which eval
is called.
Bug: chromium:875153
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng;luci.chromium.try:linux_chromium_rel_ng
Change-Id: I4b5b872b4a8c2b8e503d457f199d85892a4c817c
Reviewed-on: https://chromium-review.googlesource.com/1188052
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55596}
The previous typing rules for ToNumeric and ToNumber didn't match on the
NonBigIntPrimitive input set, which causes trouble when we morph ToNumeric
nodes into ToNumber nodes, and generally lead to worse typings in the
graph, and thus worse code generation. This change improves the existing
typing rules and turns ToNumber into a chokepoint again.
Bug: chromium:879898, v8:8015
Change-Id: I4a7ff0e9c420c5dcfdb2b96884e019a5943828a4
Reviewed-on: https://chromium-review.googlesource.com/1201522
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55595}
This reverts commit 1b3b808a54.
Reason for revert: crbug/879988
TBR=kozy@chromium.org
Original change's description:
> inspector: find magic comment using V8 scanner
>
> Inspector tries to provide sourceURL and sourceMappingURL for scripts
> with parser errors. Without this CL we convert source of each script
> to inspector string and search for magic comment there. Some web sites
> use pattern when they get some data from network and constantly try to
> parse this data as JSON, in this case we do a lot of useless work.
>
> So we can parse magic comments on V8 side only for compilation errors
> (excluding parse JSON errors), to do it we can reuse scanner by running
> it on each potential comment.
>
> R=alph@chromium.org,verwaest@chromium.org,yangguo@chromium.org
>
> Bug: chromium:873865,v8:7731
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I77c270fd0e95cd7b2c9ee4b7f72ef344bc1fa104
> Reviewed-on: https://chromium-review.googlesource.com/1182446
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Alexei Filippov <alph@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55280}
TBR=alph@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org,verwaest@chromium.org
# Not skipping CQ checks because original CL landed > 1 day ago.
Bug: chromium:873865, v8:7731, chromium:879988
Change-Id: Ia7ac766e19f9b58562d9430811f10b25c4556a46
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1202583
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55594}
Now that we've removed kRootRegister from all ia32 interface
descriptors, let's make sure it does not sneak back in.
Bug: v8:6666
Change-Id: Ie3528908a142c36f106b0053041ed974216533d4
Reviewed-on: https://chromium-review.googlesource.com/1202083
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55590}
Just a minor refactoring that loads parameters just prior to their
uses to reduce register spills and restores. CSA is not smart enough
to do this on its own.
Bug: v8:6666
Change-Id: I6d01abc35b333b2b0d99fa86daaa6ecb6afcf6c0
Reviewed-on: https://chromium-review.googlesource.com/1201883
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55588}
The isolate can be efficiently loaded through other means: either as a
root-relative load (if embedded builtins are enabled), or as an embedded
external reference (i.e. the absolute pointer is included in the
instruction stream) otherwise.
The generated code should be at least as fast as previously. On x64
(with embedded builtins):
Before:
// Register moves in prologue:
0x7f47a6b4860a a 488955e0 REX.W movq [rbp-0x20],rdx
// And the load from a stack slot at each use-site.
0x7f47a6b486f2 f2 488b7de0 REX.W movq rdi,[rbp-0x20]
After:
// Each use-site just loads a root-relative offset.
0x7f1645fcc6ce ee 498dbd38ffffff REX.W leaq rdi,[r13-0xc8]
On ia32 (no embedded builtins), before:
0x5c608930 10 8955f0 mov [ebp-0x10],edx
0x5c6089fb db 891424 mov [esp],edx
After:
0x41d0898d 8d b80033b156 mov eax,0x56b13300
Removal reduces register pressure, and frees up ebx as the root register
on ia32.
Note that the set of allocatable registers was only reduced on ia32 to
exclude the root register.
Bug: v8:6666
Change-Id: I14e401e2823c82042c76acae10c3c935b9982993
Reviewed-on: https://chromium-review.googlesource.com/1201586
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55587}
In preparation for kRootRegister support on ia32.
Instead of pushing the register args first thing within the builtin to
free up needed scratch registers, we just pass the last 3 arguments on
the stack.
Drive-by: Update documentation of helper function.
Bug: v8:6666
Change-Id: I4a194d6885ac9cdfb9f5e66d687522442fae39ba
Reviewed-on: https://chromium-review.googlesource.com/1199025
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55585}
PreParser types, e.g., PreParserExpression, PreParserList,
PreParserFormalParameter. This also enhances ThreadedLists to be used
on the same class more than once.
Bug: v8:7926
Change-Id: Ied204120e5d12ab1f1c4192f6b3c05971a12683b
Reviewed-on: https://chromium-review.googlesource.com/1199262
Commit-Queue: Florian Sattler <sattlerf@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55584}
When v8_enable_embedded_bytecode_handlers is true, initialize the
bytecode dispatch table from the builtins table. Also stops creating
the handlers more than once as the SetupInterpreter will now always do
nothing even when not starting from a snapshot.
In the short term, with the flag enabled all the bytecode handlers are
eagerly deserialized.
Finally, the bytecode handlers are marked as non-isolate independent to
prevent them being embedded in the binary until they can be converted.
Bug: v8:8068
Change-Id: I9e5ef7f1dce1b2d11c7aa26526f06b53f8939697
Reviewed-on: https://chromium-review.googlesource.com/1188477
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55581}
After https://chromium-review.googlesource.com/c/v8/v8/+/1101323 some
AllocationSites can have dropped weak_next field, but this doesn't suported in
serializer/deserializer.
This CL adds support for such AllocationSites.
Change-Id: Ibf495ae4effdf4e127892d906967d8e30eebfc87
Reviewed-on: https://chromium-review.googlesource.com/1183238
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55579}
This CL replaces occurrences of "length" with the CSA macro
LengthStringConstant().
R=jgruber@chromium.org
Bug: v8:8015
Change-Id: Idf095587940f859e4c634865560abae325cd9fb4
Reviewed-on: https://chromium-review.googlesource.com/1201782
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55578}
