Commit Graph

1271 Commits

Author SHA1 Message Date
Sigurd Schneider
73d6037c20 Revert "[in-place weak refs] Add in-place weak references & migrate one WeakCell to it."
This reverts commit 07c1e641d9.

Reason for revert: Breaks TSAN build.

https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/19784

Original change's description:
> [in-place weak refs] Add in-place weak references & migrate one WeakCell to it.
> 
> Implement in-place weak reference handling in GC.
> 
> Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this
> is the only in-place weak reference at this point).
> 
> (See bug for design doc.)
> 
> BUG=v8:7308
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I0f9f992cb4ee0457c40b7c868317dfb607bfb906
> Reviewed-on: https://chromium-review.googlesource.com/873638
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51722}

TBR=ulan@chromium.org,marja@chromium.org,yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,ishell@chromium.org,bmeurer@chromium.org

Change-Id: I75a7dd99fbfd2f5922a6c4d2000bea2adfdeac11
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/948522
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51723}
2018-03-05 11:38:41 +00:00
Marja Hölttä
07c1e641d9 [in-place weak refs] Add in-place weak references & migrate one WeakCell to it.
Implement in-place weak reference handling in GC.

Turn FeedbackVector::optimized_code_or_smi into an in-place weak reference (this
is the only in-place weak reference at this point).

(See bug for design doc.)

BUG=v8:7308

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I0f9f992cb4ee0457c40b7c868317dfb607bfb906
Reviewed-on: https://chromium-review.googlesource.com/873638
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51722}
2018-03-05 11:11:48 +00:00
jgruber
abcc28ced0 [builtins] Enable embedded builtins and add testing variants
This enables the v8_enable_embedded_builtins gn flag on non-ia32 builds
and adds a new --stress-off-heap-code test mode to fyi bots.

v8_enable_embedded_builtins=true changes accesses to constants and
external references to go through the root list in builtins code.

--stress-off-heap-code copies builtins code off-heap on isolate
creation.

A few drive-by-fixes:
- ensure that we actually inspect the correct builtin during
  isolate-independence testing.
- relax tests to decrease maintenance (now we only fail if a builtin
  should be isolate-independent but isn't).
- switch to a different off-heap-trampoline register on arm due to
  conflicts with custom stub linkages.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:6666
Change-Id: I09ad3c75cb4342f4c548ea780f275993730896c8
Reviewed-on: https://chromium-review.googlesource.com/934281
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51717}
2018-03-05 09:50:01 +00:00
Marja Hölttä
10d8aab1de [objects.h splitting] Move Microtask-related classes.
BUG=v8:5402,v8:7310

Change-Id: I5861e6508668a751e458216961edd1a03192236b
Reviewed-on: https://chromium-review.googlesource.com/934282
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51591}
2018-02-27 10:44:53 +00:00
Michael Starzinger
fafd1cdd35 Move exception handler table into instruction stream.
This changes the encoding of the {HandlerTable} from an array of Smi
values to a byte array. It allows embedding of said array into the
instruction stream of {Code} objects (similar to how safepoint tables
work). For interpreted bytecode the table is attached as a {ByteArray}
to the bytecode.

The advantage of this approach is a more compact encoding and also the
ability to move such tables easily off the GC'ed heap if needed (as is
done for WebAssembly code for example).

R=jarin@chromium.org

Change-Id: I3320415dff69b3d1053825bda0d667a28232bf6d
Reviewed-on: https://chromium-review.googlesource.com/934642
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51589}
2018-02-27 10:20:35 +00:00
Marja Hölttä
dd3c4fca2f [objects.h splitting] Move Promise-related classes.
BUG=v8:5402,v8:7310

Change-Id: Ic3ee7d2dec0403e7831f51735365c26caadc6a7b
Reviewed-on: https://chromium-review.googlesource.com/934136
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51565}
2018-02-26 13:19:00 +00:00
Michael Achenbach
22fb961b70 [foozzie] Rename folder to account for new clusterfuzz configs
We'll soon also host other configurations for general fuzzing, not only
correctness fuzzing in the new tools/clusterfuzz folder.

TBR=yangguo@chromium.org

Bug: chromium:813833
Change-Id: Icd966bfec91cc547522bad5d1a842500b554754f
Reviewed-on: https://chromium-review.googlesource.com/930331
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51480}
2018-02-22 17:42:39 +00:00
Nico Weber
dab696e7ae v8: Turn on -Wimplicit-fallthrough.
https://chromium-review.googlesource.com/911731 made things build with
this on x64, and https://chromium-review.googlesource.com/923528 added
x86, arm, arm64, mips, mips64.  This are all the configs covered by
v8's trybots.  If this breaks yet another config I don't know about,
these two CLs should give you a good idea how to fix them.

Bug: chromium:812686
Change-Id: Ib9a9714a070dd876a8f5911a1bc974ffd7aa3995
Reviewed-on: https://chromium-review.googlesource.com/928842
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51446}
2018-02-21 18:33:33 +00:00
jgruber
ad74be52fa [builtins] Add builtins constants list to roots
This is a step towards off-heap (and eventually isolate-independent)
builtins.

Off-heap code cannot use the standard CallStub/CallRuntime mechanisms,
since they directly embed the callee code object pointer within the
caller.  There are two main issues with that: 1. the callee may be
moved by GC, and 2. the pc-relative addressing we currently use breaks
(i.e. ends up pointing to a random spot on the heap) when moving the
caller off-heap.

This CL addresses that by introducing a constants list stored on the
roots array.  Instead of embedding code targets, we now have the option
of loading them from constants list. The code sequence is:

REX.W movq rax,[r13+0x4a0]  // Load the constants cache.
REX.W movq rdx,[rax+0xf]    // From there, load the code target.
...
REX.W addq rdx,0x5f         // Add instruction_start.
call rdx

There's no visible performance impact on the web tooling benchmark.

This list will later be extended to also contain other constants such
as Strings.

Bug: v8:6666
Change-Id: Ifcf67d1f682804ba0b6d3d0383216e16575b6bf5
Reviewed-on: https://chromium-review.googlesource.com/923729
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51434}
2018-02-21 15:07:42 +00:00
Ross McIlroy
d2a370494e [Compiler] Move BackgroundParsingTask to compiler.cc
Moves BackgroundParsingTask to compiler.cc and renames as BackgroundCompileTask.
This moves code out api.cc and parsing/ into compiler.cc where it belongs.

BUG=v8:7311,v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I08a72ab8a6bdb480f519d42b36875d347b801ddc
Reviewed-on: https://chromium-review.googlesource.com/919481
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51421}
2018-02-21 11:18:22 +00:00
jgruber
b88db2588e [builtins] Add v8_enable_embedded_builtins gn flag
This flag will be used to toggle things for isolate-independent
builtins during development.

Bug: v8:6666
Change-Id: I8a97f08b3d677a01a2a55a4c6445e71e74471f51
Reviewed-on: https://chromium-review.googlesource.com/924067
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51325}
2018-02-16 13:52:25 +00:00
Yang Guo
4128082eb1 [api] remove legacy debug API.
R=jgruber@chromium.org

Bug: v8:5510
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic0ba012ed7ff66f034c5a54554b2ab36d1d70d2c
Reviewed-on: https://chromium-review.googlesource.com/911110
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Commit-Queue: ปอ คับ <misspor061853@gmail.com>
Cr-Commit-Position: refs/heads/master@{#51245}
2018-02-12 14:49:29 +00:00
Vasili Skurydzin
13d67667cc Fixes to V8 GN build process on AIX
Change to v8/BUILD.gn regarding GN build of V8. Excluding platform-posix-time.h
and platform-posix-time.cc from the sources list on AIX os. The changes affect
AIX only.

Bug: chromium:616029
Change-Id: I5e5d46aa4c62f70544ff593294e459c607a03c67
Reviewed-on: https://chromium-review.googlesource.com/897124
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51183}
2018-02-08 17:51:44 +00:00
Peter Marshall
a2aac98ddf [typedarray] Share SpeciesCreateByLength between CSA code.
Move the class declaration for SpeciesCreateByLength to a header file
so that we can share more TypedArray CSA code.

Delete the C++ implementation of species create for typed arrays
because it is no longer used.

Change-Id: I7c43b8ef144ba9a8ce12516f7cb8fb570491cb26
Reviewed-on: https://chromium-review.googlesource.com/904987
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51139}
2018-02-07 11:26:56 +00:00
Gabriel Charette
7d58b3c46c Isolate ItemParallelJob implementation in CC file.
This CL is a pure code move based on top of
https://chromium-review.googlesource.com/c/v8/v8/+/899365

Having it all in the header was becoming more and more tedious:
requiring large rebuilds for impl changes and
requiring exporting unrelated symbols merely so that unittests
could link
@ https://chromium-review.googlesource.com/c/v8/v8/+/899365
and https://chromium-review.googlesource.com/c/v8/v8/+/904523/2

R=mlippautz@chromium.org

Bug: chromium:651354
Change-Id: Ib34043d061dd3b1221cd06799eddc888090fe1c1
Reviewed-on: https://chromium-review.googlesource.com/904167
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51132}
2018-02-06 21:55:49 +00:00
Peter Marshall
71ea148ec3 [csa] Move the GrowableFixedArray into its own file.
We want to be able to use this from other builtins as well, so move it
to somewhere common.

Also adds typing and cleans up the coding style to match newer CSA code
a bit more. GrowableFixedArray is now a subclass of CodeStubAssembler
to make things easier and cleaner. The growing strategy has also been
slightly changed so that empty arrays can be produced.

Change-Id: I20cbd1069d489a6875804736d3e5abab80d0f777
Reviewed-on: https://chromium-review.googlesource.com/901324
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51107}
2018-02-06 09:06:55 +00:00
Michael Achenbach
770a40bdbb Revert "[builtins] Add .incbin cctest"
This reverts commit b012816155.

Reason for revert: Still breaks the bot:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/1217

Original change's description:
> [builtins] Add .incbin cctest
> 
> Just to ensure this is portable across all platforms.
> 
> Credits go to https://github.com/graphitemaster/incbin, bits of the
> .incbin code were taken from there. Thanks!
> 
> Reland of https://crrev.com/c/881181
> 
> Bug: v8:6666
> Change-Id: I5c0dbf56b1c987fd88607dca69b39d65b59cdefc
> Reviewed-on: https://chromium-review.googlesource.com/895597
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51042}

TBR=machenbach@chromium.org,jgruber@chromium.org

Change-Id: I41a48908b6e0ff6a28beb8b28a1a9a739302081a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/897788
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51044}
2018-02-01 17:34:32 +00:00
jgruber
b012816155 [builtins] Add .incbin cctest
Just to ensure this is portable across all platforms.

Credits go to https://github.com/graphitemaster/incbin, bits of the
.incbin code were taken from there. Thanks!

Reland of https://crrev.com/c/881181

Bug: v8:6666
Change-Id: I5c0dbf56b1c987fd88607dca69b39d65b59cdefc
Reviewed-on: https://chromium-review.googlesource.com/895597
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51042}
2018-02-01 17:04:40 +00:00
Tobias Tebbi
49a5f6dafd [turbofan] LoopVariableOptimizer: use generic FunctionalList implementation
Change-Id: I963215506a87945ae863427c572989c857bca2ff
Reviewed-on: https://chromium-review.googlesource.com/897608
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51039}
2018-02-01 15:48:09 +00:00
Clemens Hammacher
51af4f58c0 [wasm] [fuzzer] Remove wasm_call fuzzer
The wasm call fuzzer is superseded by the wasm compile fuzzer, thus
remove it.

The chromium side will land in https://crrev.com/c/895531.

R=ahaas@chromium.org

Change-Id: I211d9f8ad2ca5432dbbc6ecce0b6e13760f1af60
Reviewed-on: https://chromium-review.googlesource.com/895534
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51034}
2018-02-01 14:30:49 +00:00
jgruber
ca1d44e35f [builtins] Add --stress-off-heap-code to test off-heap code
If enabled, this mode moves code for isolate-independent builtins off
the JS heap at Isolate creation. The Code object itself is rewritten
to tail-call the off-heap instruction stream.

Drive-by-fix: Support lazy deserialization in asm-wasm instantiation.

Bug: v8:6666
Change-Id: Ic109527ff478cfc6e8942e924413fc7532da6eaf
Reviewed-on: https://chromium-review.googlesource.com/888562
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51015}
2018-02-01 08:04:09 +00:00
Nico Weber
b596ca4bf6 Explicitly suppress -Wimplicit-fallthrough for v8.
No behavior change since that warning isn't enabled anywhere yet, and
it's opt-in.  This is a prerequisite for
https://chromium-review.googlesource.com/c/chromium/src/+/895726

Whil here, also remove -Wsign-compare, since that's enabled by default for -Wextra
(http://llvm-cs.pcc.me.uk/tools/clang/include/clang/Basic/DiagnosticGroups.td#723)
and v8 builds with the chromium_code config which sets -Wextra.

Bug: chromium:177475
Change-Id: I32f140296cab13ed57be08168a3f6b1d1218e4e6
Reviewed-on: https://chromium-review.googlesource.com/895704
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51009}
2018-01-31 19:11:26 +00:00
Predrag Rudic
d2ad89d846 [cctest] Skip test-run-wasm-simd if SIMD is not supported
For mips, if 'mips_arch_variant=="r6"' and if 'mips_use_msa' flag is set
to 'true', then test-run-wasm-simd tests won't be skipped for mips. It
will also force 'MIPS_SIMD' bit in CpuFeatures to be set.
ARM processors are assumed to support SIMD.

Change-Id: Iea668b97ef995ca4949ddbf2ffc734aad89d3aa3
Reviewed-on: https://chromium-review.googlesource.com/868430
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#50981}
2018-01-31 10:08:14 +00:00
Michael Starzinger
5cc8a2c50b [wasm] Move ScheduledErrorThrower into wasm-js.cc file.
R=clemensh@chromium.org

Change-Id: I9f4fcddca2e478d5074d68870d0293aacdeb4aa1
Reviewed-on: https://chromium-review.googlesource.com/813920
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50951}
2018-01-30 10:57:36 +00:00
Daniel Clifford
ca1508fc3b Refactor ArrayBuiltinsAssembler to split into a header and source file
This makes the ArrayBuiltinsAssembler consistent with the StringBuiltinsAssembler
and paves the way for tools that expect the assemblers to have a common structure.

Change-Id: I7470fc2cf144f9cc2fdbcee99b31daed267550be
Reviewed-on: https://chromium-review.googlesource.com/889933
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50920}
2018-01-29 09:15:27 +00:00
Leszek Swirski
c53f9f970e [compile] Remove AST numbering
Bug: v8:7178
Change-Id: Ib86942acff8419699d739c6fb28479613b04e745
Reviewed-on: https://chromium-review.googlesource.com/878179
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50846}
2018-01-24 17:15:55 +00:00
Michael Achenbach
d65b53cf23 [test] Add benchmarks to deopt-fuzzer and remove obsolete configs
This adds the benchmarks suite to the deopt fuzzer and removes the
obsolete deopt configs, which since a while are part of the num-fuzz
configs.

TBR=sergiyb@chromium.org

Bug: v8:6900
Change-Id: I9202e2a66a132eca5940b4444fda97816b034e54
Reviewed-on: https://chromium-review.googlesource.com/876085
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50720}
2018-01-19 13:47:06 +00:00
Michael Achenbach
cdc6f7e1c6 [test] Add d8_default isolate to fuzzer bundle
TBR=sergiyb@chromium.org
NOTRY=true

Bug: v8:6972
Change-Id: Id1bdaa1fe4cd0a02f1b59eb7b7f4cecda36ded9a
Reviewed-on: https://chromium-review.googlesource.com/876004
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50713}
2018-01-19 11:39:00 +00:00
jgruber
633b70b126 [regexp] Initial go at a builtins fuzzer
This fuzzer randomly generates calls to regexp builtins, runs each on
the slow and fast path, and verifies that their result is the same.

Change-Id: Ia91b0c8afcdaf64835a9bb7b9a470610fbb75fc8
Reviewed-on: https://chromium-review.googlesource.com/833922
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50670}
2018-01-18 11:02:57 +00:00
Ben L. Titzer
84326fc49b [wasm] Hide SyncValidate() behind WasmEngine interface.
This is the first in a series of CLs that will separate the JS API
from the implementation of WebAssembly by bottlenecking interactions
through the WasmEngine. In the long run, the JS API and much of V8
should rely only on the WasmEngine interface, which will represent
the "public interface" for embedding WebAssembly.

Next: hide compilation-related methods behind WasmEngine.
Bug: v8:7316
Change-Id: I93404f0dc8a201ae99d30b4c1ca34606e3dddbca
Reviewed-on: https://chromium-review.googlesource.com/868590
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50660}
2018-01-17 15:20:13 +00:00
Michael Achenbach
45833d9bb8 [test] Group test features behind a single GN switch
This will switch on various testing features in sanitizer builds and
for correctness fuzzer builds.

Currently we group enabling the slow-path runtime flag and allocation
timeout for atomic gc stress, but more features could be added in the
future.

This will enable gc fuzzer, clusterfuzz and correctness fuzzer to use
both slow-path and atomic gc stress in release sanitizer builds.

Bug: v8:6972
Change-Id: I5cade68241a8a0711f8a388be7e1543aab0035fa
Reviewed-on: https://chromium-review.googlesource.com/869932
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50656}
2018-01-17 14:06:58 +00:00
Andreas Haas
a7b26c6b83 [turbofan] Add fuzzer to test different signatures for multi-returns
This CL makes a fuzzer out of the cctest
test-multiple-return/ReturnMultipleRandom. The fuzzer creates a
CallDescriptor with input parameters and returns, and a function which
maps input parameters to returns. The fuzzer then calls this function
with a wrapper which checks that the correct mapping happened.

R=clemensh@chromium.org

Change-Id: Ib89c4063638baae69540a44486d7b2e9d13f8c1f
Reviewed-on: https://chromium-review.googlesource.com/859768
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50532}
2018-01-12 12:20:27 +00:00
Ben L. Titzer
3a79d5bcc5 [wasm] Move (almost all) constants to wasm-constants.h
This CL centralizes constants related to decoding from several places
into one place and makes it no longer necessary to include
wasm-opcodes.h for some simple constants.

R=clemensh@chromium.org

Bug: 
Change-Id: I53aa81e34167df467bc7455b717bf67083033943
Reviewed-on: https://chromium-review.googlesource.com/859764
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50503}
2018-01-11 12:25:54 +00:00
Timothy Gu
ddfbbc5537 [builtins] Port Proxy.revocable() to CSA
Bug: v8:7245
Change-Id: Ia8931037021b935e776230a6a50c580ad82efba8
Reviewed-on: https://chromium-review.googlesource.com/844065
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50394}
2018-01-07 10:20:13 +00:00
Yang Guo
309944d0d0 [gn] do not hide symbols for monolithic build.
Otherwise dynamic linking with dlopen, as is the case with Node.js
addons, would not work.

R=fhinkel@chromium.org

Bug: v8:6105
Change-Id: I5a884afc003fdfdb9de7e9b0c736f1894ba0019a
Reviewed-on: https://chromium-review.googlesource.com/850112
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50384}
2018-01-05 16:11:55 +00:00
Clemens Hammacher
ae299377f5 Add gn flag to control mitigations for untrusted code
This adds the gn flag 'v8_untrusted_code_mitigations', which defaults to
true. If false, the DISABLE_UNTRUSTED_CODE_MITIGATIONS preprocessor
macro will be defined, which sets the default for the
--untrusted-code-mitigations runtime flag to false.

R=machenbach@chromium.org, hablich@chromium.org
CC=​bmeurer@chromium.org

Bug: chromium:798964
Change-Id: Ief037e194dc9eeb7fe224b5d414a4ea8e69beb20
Reviewed-on: https://chromium-review.googlesource.com/852074
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50380}
2018-01-05 11:05:11 +00:00
Bill Budge
699144a225 [Memory] Add PageAllocator concept to v8::Platform.
- Adds abstract base class PageAllocator, defined in v8-platform.h. Adds
  GetPageAllocator method to v8::Platform.
- Implements a DefaultPageAllocator, implemented in terms of base::OS
  page allocation methods.

Bug: chromium:756050
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iece0b261a07294a49c30ac25e848dc39cb1a32e2
Reviewed-on: https://chromium-review.googlesource.com/809778
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50282}
2017-12-21 19:46:23 +00:00
peterwmwong
bce199bbe7 Reland "[builtins] Port Object.p.toLocaleString to CSA from JS"
This is a reland of ab38b03d1b
Original change's description:
> [builtins] Port Object.p.toLocaleString to CSA from JS
>
> - Added ObjectPrototypeToLocaleString TFJ
> - Remove v8natives.js
> - Move GetMethod and GetIterator into prologue.js
>
> TBR=adamk@chromium.org
>
> Bug: v8:6005
> Change-Id: I2b5b65892304e62bf64375458f8ffb9473b2c9b7
> Reviewed-on: https://chromium-review.googlesource.com/826479
> Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
> Cr-Commit-Position: refs/heads/master@{#50120}

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng

TBR=adamk@chromium.org

Bug: v8:6005
Change-Id: Ie8c8810c5231e933e61ea8babe963e58bb6dcaed
Reviewed-on: https://chromium-review.googlesource.com/831156
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#50218}
2017-12-19 19:46:10 +00:00
Michael Achenbach
faf8d4dc17 Revert "[builtins] Port Object.p.toLocaleString to CSA from JS"
This reverts commit ab38b03d1b.

Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/20480

https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [builtins] Port Object.p.toLocaleString to CSA from JS
> 
> - Added ObjectPrototypeToLocaleString TFJ
> - Remove v8natives.js
> - Move GetMethod and GetIterator into prologue.js
> 
> TBR=adamk@chromium.org
> 
> Bug: v8:6005
> Change-Id: I2b5b65892304e62bf64375458f8ffb9473b2c9b7
> Reviewed-on: https://chromium-review.googlesource.com/826479
> Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
> Cr-Commit-Position: refs/heads/master@{#50120}

TBR=adamk@chromium.org,peter.wm.wong@gmail.com,jgruber@chromium.org

Change-Id: Ib406a55562735cc4d879d62b76f27edf3f1ed211
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6005
Reviewed-on: https://chromium-review.googlesource.com/828813
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50123}
2017-12-15 08:49:16 +00:00
peterwmwong
ab38b03d1b [builtins] Port Object.p.toLocaleString to CSA from JS
- Added ObjectPrototypeToLocaleString TFJ
- Remove v8natives.js
- Move GetMethod and GetIterator into prologue.js

TBR=adamk@chromium.org

Bug: v8:6005
Change-Id: I2b5b65892304e62bf64375458f8ffb9473b2c9b7
Reviewed-on: https://chromium-review.googlesource.com/826479
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#50120}
2017-12-15 06:18:19 +00:00
Michael Starzinger
f4dde20044 [simulator] Refactor redirections to be process-wide.
This refactors the list of redirections of runtime call targets that
simulators maintain to be process-wide (as opposed to be per Isolate).
Such redirections are used for static C++ call targets which themselves
are process-wide, which makes this model a closer fit. Access is already
properly synchronized via a mutex.

Along the way this also introduces the {SimulatorBase} class as a common
base class for all simulator implementations.

R=clemensh@chromium.org

Change-Id: Iae8602c44b1b34cb916dde2b22c9403b0496b3d4
Reviewed-on: https://chromium-review.googlesource.com/823966
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50074}
2017-12-13 13:28:10 +00:00
Justin Ridgewell
cedec225c9 Implement DFA Unicode Decoder
This is a separation of the DFA Unicode Decoder from
https://chromium-review.googlesource.com/c/v8/v8/+/789560

I attempted to make the DFA's table a bit more explicit in this CL. Still, the
linter prevents me from letting me present the array as a "table" in source
code. For a better representation, please refer to
https://docs.google.com/spreadsheets/d/1L9STtkmWs-A7HdK5ZmZ-wPZ_VBjQ3-Jj_xN9c6_hLKA

- - - - -

Now for a big copy-paste from 789560:

Essentially, reworks a standard FSM (imagine an
array of structs) and flattens it out into a single-dimension array.
Using Table 3-7 of the Unicode 10.0.0 standard (page 126 of
http://www.unicode.org/versions/Unicode10.0.0/ch03.pdf), we can nicely
map all bytes into one of 12 character classes:

00. 0x00-0x7F
01. 0x80-0x8F (split from general continuation because this range is not
    valid after a 0xF0 leading byte)
02. 0x90-0x9F (split from general continuation because this range is not
    valid after a 0xE0 nor a 0xF4 leading byte)
03. 0xA0-0xBF (the rest of the continuation range)
04. 0xC0-0xC1, 0xF5-0xFF (the joined range of invalid bytes, notice this
    includes 255 which we use as a known bad byte during hex-to-int
        decoding)
05. 0xC2-0xDF (leading bytes which require any continuation byte
    afterwards)
06. 0xE0 (leading byte which requires a 0xA0-0xBF afterwards then any
    continuation byte after that)
07. 0xE1-0xEC, 0xEE-0xEF (leading bytes which requires any continuation
    afterwards then any continuation byte after that)
08. 0xED (leading byte which requires a 0x80-0x9F afterwards then any
    continuation byte after that)
09. 0xF1-F3 (leading bytes which requires any continuation byte
    afterwards then any continuation byte then any continuation byte)
10. 0xF0 (leading bytes which requires a 0x90-0xBF afterwards then any
    continuation byte then any continuation byte)
11. 0xF4 (leading bytes which requires a 0x80-0x8F afterwards then any
    continuation byte then any continuation byte)

Note that 0xF0 and 0xF1-0xF3 were swapped so that fewer bytes were
needed to represent the transition state ("9, 10, 10, 10" vs.
"10, 9, 9, 9").

Using these 12 classes as "transitions", we can map from one state to
the next. Each state is defined as some multiple of 12, so that we're
always starting at the 0th column of each row of the FSM. From each
state, we add the transition and get a index of the new row the FSM is
entering.

If at any point we encounter a bad byte, the state + bad-byte-transition
is guaranteed to map us into the first row of the FSM (which contains no
valid exiting transitions).

The key differences from Björn's original (or his self-modified) DFA is
the "bad" state is now mapped to 0 (or the first row of the FSM) instead
of 12 (the second row). This saves ~50 bytes when gzipping, and also
speeds up determining if a string is properly encoded (see his sample
code at http://bjoern.hoehrmann.de/utf-8/decoder/dfa/#performance).

Finally, I've replace his ternary check with an array access, to make
the algorithm branchless. This places a requirement on the caller to 0
out the code point between successful decodings, which it could always
have done because it's already branching.

R=marja@google.com

Bug: 
Change-Id: I574f208a84dc5d06caba17127b0d41f7ce1a3395
Reviewed-on: https://chromium-review.googlesource.com/805357
Commit-Queue: Justin Ridgewell <jridgewell@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50012}
2017-12-11 21:36:13 +00:00
Sigurd Schneider
37eb501b92 Move VectorSlotPair to its own files
This is a preparation for a larger CL that needs VectorSlotPair
throughtout the compilation chain (including deoptimizer.cc).

Bug: v8:7127
Change-Id: Ia746805ca3fa294eedba19d23656f858840cd501
Reviewed-on: https://chromium-review.googlesource.com/813934
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49928}
2017-12-07 13:01:20 +00:00
Michal Majewski
7ff3005e22 [test] Stress start of young generation collection.
Introduce new flag for starting young generation collection early
based on the current new space size.

Bug: v8:6972
Change-Id: I73dd28b8ac7df873b5c3e6ca4b3e55bdec5295a1
Reviewed-on: https://chromium-review.googlesource.com/811304
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49927}
2017-12-07 12:23:56 +00:00
Igor Sheludko
42a7c0be4c [runtime] Introduce Load/StoreHandler heap objects.
They will eventually be used instead of Tuple3/FixedArray by the IC system.

Bug: v8:5561, v8:7159
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I39faad1b2dc10ce7d42cb7477ea87b64d1e0b44c
Reviewed-on: https://chromium-review.googlesource.com/806178
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49908}
2017-12-06 18:19:07 +00:00
Michal Majewski
c436429c0e [test] AllocationObserver for stress marking.
Observer that increases frequency of checking if we reached
marking limit. Works only with --stress-marking.

Bug: v8:6972
Change-Id: I13544fdd8bb33738d78adbac96feb70222b5b634
Reviewed-on: https://chromium-review.googlesource.com/802434
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49907}
2017-12-06 18:12:01 +00:00
Mircea Trofin
355e2f0888 [wasm] s/wasm-heap/wasm-code-manager
Rename to better capture what the files contain.

Removed includes of wasm-code-manager.h from .h files to improve
build time.

Bug: 
Change-Id: I0f0108cfb00b061c4433b6ff9670e9c4cae9c699
Reviewed-on: https://chromium-review.googlesource.com/807368
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49875}
2017-12-05 16:30:06 +00:00
Eric Holk
5fb4b176fa [wasm] Move wasm objects from Isolate to new WasmEngine object
This is a small refactoring that moves the WasmCodeManager and
CompilationManager from being a part of the Isolate directly to living in a new
WasmEngine object. This makes it easier to change Wasm components without
rebuilding so much of V8, and also enables future changes to Wasm without
affecting unrelated parts of V8.

Bug: v8:7109
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic89bfc3974483aa909d12556d1386e18785a1d71
Reviewed-on: https://chromium-review.googlesource.com/804824
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49848}
2017-12-05 01:32:21 +00:00
Georg Neis
fb54e570e1 Enable clang's -Wunreachable-code warning.
The motivation is to avoid bugs such as the one fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/800270.

Bug: v8:7109
Change-Id: I82a55f4a78d289d00ae7bafe78b45d92bab07a6b
Reviewed-on: https://chromium-review.googlesource.com/800291
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49829}
2017-12-04 13:09:25 +00:00
Marja Hölttä
e9c9322339 [objects.h splitting] Move JSCollection + related classes.
BUG=v8:5402,v8:7109

Change-Id: Ifee03125d8894181acffc7ed9c6bda44e3939d2d
Reviewed-on: https://chromium-review.googlesource.com/803336
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49792}
2017-12-01 13:52:17 +00:00