We'll soon also host other configurations for general fuzzing, not only
correctness fuzzing in the new tools/clusterfuzz folder.
TBR=yangguo@chromium.org
Bug: chromium:813833
Change-Id: Icd966bfec91cc547522bad5d1a842500b554754f
Reviewed-on: https://chromium-review.googlesource.com/930331
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51480}
This reverts commit eac4b59fd9.
Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/21829
See:
https://github.com/v8/v8/wiki/Blink-layout-tests
Original change's description:
> [Compiler] Use CompilationCache for StreamedScript compilation.
>
> Previously GetSharedFunctionInfoForStreamedScript didn't either check the
> compilation cache or put the result of compilation into the compilation
> cache. This would mean future compiles would need to re-parse / compile
> the same script even if the isolate had already seen it. This CL
> fixes this.
>
> BUG=v8:5203
>
> Change-Id: I421627b80848feb9884e2440c4ee66556e05b3c9
> Reviewed-on: https://chromium-review.googlesource.com/924285
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51469}
TBR=rmcilroy@chromium.org,mythria@chromium.org
Change-Id: Id822b55bd162b74f098160a11e6a3bda6924c1e4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5203
Reviewed-on: https://chromium-review.googlesource.com/931821
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51477}
AddCode and AddOwnedCode (from NativeModule), as well as the WasmCode
constructor are using a default value (false) for determining whether
the code is liftoff-compiled or not. This CL removes the default
value and requires each call to these functions/constructors to explicitly
set the value.
Change-Id: Icd4187d1710c774826c9134078ec65845bc98dd7
Reviewed-on: https://chromium-review.googlesource.com/928921
Commit-Queue: Kim-Anh Tran <kimanh@google.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51475}
This is preparatory cleanup work for eventually tracking the functions
(rather than concrete closures) in the CALL_IC, also for builtins like
the default PromiseCapability [[Resolve]] and [[Reject]] functions. It
adds a new FeedbackCell type, which is used by JSFunctions consistently
now to reference the feedback vector (or undefined if not the function
is not compiled yet or is a native/asm.js function).
This also changes the calling convention for FastNewClosure builtin and
the JSCreateClosure operator in TurboFan to carry the FeedbackCell here
instead of the parent FeedbackVector and the slot index. In addition we
eliminate the now unused %InterpreterNewClosure runtime function.
Bug: v8:2206, v8:7253, v8:7310
Change-Id: Ib4ce456e276e0273e57c163dcdd0b33abf863656
Reviewed-on: https://chromium-review.googlesource.com/928403
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51474}
This is an unfortunate restriction imposed by Worklist::kMaxNumTasks
for now.
This CL unbreaks tests for developers. The CQ didn't catch this breakage
because bots have 8 cores and concurrent marking uses num_cores-1.
R=hpayer@chromium.org
TEST=All tests passed on dev machine (was super broken without this change)
NOTRY=True (to unbreak devs)
Bug: v8:7477,chromium:812178
Change-Id: I644613857c74d1ae00965f3e6d1d7692a4303062
Reviewed-on: https://chromium-review.googlesource.com/931461
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51473}
This avoids generation of duplicate strings. Especially debug builds
suffer from this and generate 16000+ strings, mostly for CSA_ASSERT
and CAST statements. Deduplicating these trims that down to roughly
1000 strings.
Release builds are affected at a smaller scale. There, we have roughly
100 duplicate strings in the snapshot.
Bug: v8:6666
Change-Id: I688d3b97431b8cea1e98983eab5f07278dae91a0
Reviewed-on: https://chromium-review.googlesource.com/931041
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51472}
Perf-sheriffs please revert if this causes any performance regressions.
BUG=
Change-Id: I39075482f3c85d69407d6d8e5643d94c1a4425c2
Reviewed-on: https://chromium-review.googlesource.com/461117
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51470}
Previously GetSharedFunctionInfoForStreamedScript didn't either check the
compilation cache or put the result of compilation into the compilation
cache. This would mean future compiles would need to re-parse / compile
the same script even if the isolate had already seen it. This CL
fixes this.
BUG=v8:5203
Change-Id: I421627b80848feb9884e2440c4ee66556e05b3c9
Reviewed-on: https://chromium-review.googlesource.com/924285
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51469}
This patch adds EmbedderGraph::Node::NamePrefix method that will be used
by Chrome for detached DOM nodes.
Bug: chromium:811925
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I89d3b88a3b90ed85addb1d34f08dd15e0559aa9a
Reviewed-on: https://chromium-review.googlesource.com/926362
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51464}
On ia32, we can encode the address of the stack limit in the operand
directly, saving one mov instruction and reducing register pressure.
R=titzer@chromium.org
Bug: v8:6600
Change-Id: I2742efbfea16d56d648c233a2dba1d8672dc489d
Reviewed-on: https://chromium-review.googlesource.com/930961
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51463}
IterableToListCanBeElided checked that the input was always a HeapObject
but this is not true when an iterator symbol is defined on the Number
prototype, meaning Smi and HeapNumber can also be passed in.
Added a regression test for the crash and some correctness tests for
smi and double input to TA.from.
Also factored out the tests in typedarray-from.js that modify global
state e.g. protector cells, so that one iteration of the top level
loop does not interfere with the next.
Bug: chromium:814643
Change-Id: I364d11f011faf8370446f905a35a945d47e4477f
Reviewed-on: https://chromium-review.googlesource.com/930962
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51461}
For builtin and stub code targets, we can be a bit more descriptive and
print their name along with the code kind.
Before:
0x1fafde09c5cf code target (BUILTIN) (0x1fafde088280)
0x1fafde09c5f0 code target (STUB) (0x1fafde084060)
After:
0x1fafde09c5cf code target (BUILTIN Abort) (0x1fafde088280)
0x1fafde09c5f0 code target (STUB CEntryStub) (0x1fafde084060)
Bug: v8:6666
Change-Id: I27d205361748c6bae5e69e14f65efb7f85f23da7
Reviewed-on: https://chromium-review.googlesource.com/928766
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51459}
The crash happens while adding an embedder edge. The |from| heap entry
can be invalidated when the |to| heap entry is added to the snapshot.
This happens because heap entries are pointers into the std::vector
backing store.
Bug: chromium:813515
Change-Id: I6a61bb3fc383a272887925c5da163766d23a0606
Reviewed-on: https://chromium-review.googlesource.com/926525
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51455}
Private fields should not return undefined on access miss, but instead
should throw a TypeError.
This patch uses a bit on v8::Symbol to mark if this symbol is a
private field or not.
This patch also changes the LookupIterator code path that deals with
LookupIterator::State::DATA to deal with JSReceiver instead of
JSObject.
Note: the error message doesn't output the field name, but that's a
WIP.
Bug: v8:5368
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I8ae960b478eb6ae1ebf9bc90658ce3654d687977
Reviewed-on: https://chromium-review.googlesource.com/905627
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51452}
Bug: v8:5368
Change-Id: I7c4f9101837a0bf4917bbb0c2f09587118168a02
Reviewed-on: https://chromium-review.googlesource.com/923362
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51449}
https://chromium-review.googlesource.com/911731 made things build with
this on x64, and https://chromium-review.googlesource.com/923528 added
x86, arm, arm64, mips, mips64. This are all the configs covered by
v8's trybots. If this breaks yet another config I don't know about,
these two CLs should give you a good idea how to fix them.
Bug: chromium:812686
Change-Id: Ib9a9714a070dd876a8f5911a1bc974ffd7aa3995
Reviewed-on: https://chromium-review.googlesource.com/928842
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51446}
Crankshaft is gone, and this function is not used anywhere.
R=mstarzinger@chromium.org
Bug: v8:7310,v8:6408
Change-Id: Ic1f859e659008c891cc35d20e95a8214de42bd21
Reviewed-on: https://chromium-review.googlesource.com/928981
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51445}
Replace bitwise arithmetic with conditional move / select instructions
on ia32, x64, Arm and Arm64. In local tests this improves --noopt Ignition
performance by between 2-5%.
BUG=chromium:798964
Change-Id: I82832e5d28469a574a575119c1a665b5c2c93bb2
Reviewed-on: https://chromium-review.googlesource.com/916561
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51444}
The compilation logic never used the saved FeedbackVector for Script
compiles when looking up the CompilationCache, so remove it and
simplify the return value of LookupScript to be a
MaybeHandle<SharedFunctionInfo>
Change-Id: Ib1d833f997b299e2e79621bd8509bdfd911d4e10
Reviewed-on: https://chromium-review.googlesource.com/924002
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51443}
This is a first testing CL to add tests for mjsunit assertions to the
message tests.
R=clemensh@chromium.org
Bug: v8:7310
Change-Id: Ibbeafebb116f9608c70687f141986ab4534c6b2a
Reviewed-on: https://chromium-review.googlesource.com/803555
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51441}
They were disabled for some reason, but they are working, so reenable
them.
R=titzer@chromium.org
Change-Id: I24cab05d01060b9eae3d6191a978cdb04daf626b
Reviewed-on: https://chromium-review.googlesource.com/928648
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51440}
Refactor existing and add new Move instructions that get uint32_t
and uint64_t to prevent compiler to set quiet-nan on passing
float and double by value.
Change-Id: I544e98e1bb288666140a3b1d2437b31d9e36ca55
Reviewed-on: https://chromium-review.googlesource.com/928722
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51439}
Unifies GetSharedFunctionForStreamedScript with GetSharedFunctionForScript
so that both share a more similar API and some common code can be moved to
common helpers.
Introduces a Compiler::ScriptDetails struct to hold script meta-data
used to build new script objects.
BUG=v8:5203
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I3e6b4cd50da9bb92ef5a2bfd666a09b3619c34a4
Reviewed-on: https://chromium-review.googlesource.com/924189
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51438}
x86, arm, arm64: no change in behavior
mips, mips64: disasm-mips(64).cc grows an UNREACHABLE that's
maybe optimistic (but if it's not true, then that
looks like a current unintentional fallthrough at
that spot)
test-js-typed-lowering.cc: looks like a clear bug, but test-only code
Follow-up to https://chromium-review.googlesource.com/c/v8/v8/+/911731 which
did this for x64.
Doesn't turn on the warning yet.
Bug: chromium:812686
Change-Id: I7dd79c9885c90f41dd7e3a595256a954ab0ae643
Reviewed-on: https://chromium-review.googlesource.com/923528
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51437}
This is a step towards off-heap (and eventually isolate-independent)
builtins.
Off-heap code cannot use the standard CallStub/CallRuntime mechanisms,
since they directly embed the callee code object pointer within the
caller. There are two main issues with that: 1. the callee may be
moved by GC, and 2. the pc-relative addressing we currently use breaks
(i.e. ends up pointing to a random spot on the heap) when moving the
caller off-heap.
This CL addresses that by introducing a constants list stored on the
roots array. Instead of embedding code targets, we now have the option
of loading them from constants list. The code sequence is:
REX.W movq rax,[r13+0x4a0] // Load the constants cache.
REX.W movq rdx,[rax+0xf] // From there, load the code target.
...
REX.W addq rdx,0x5f // Add instruction_start.
call rdx
There's no visible performance impact on the web tooling benchmark.
This list will later be extended to also contain other constants such
as Strings.
Bug: v8:6666
Change-Id: Ifcf67d1f682804ba0b6d3d0383216e16575b6bf5
Reviewed-on: https://chromium-review.googlesource.com/923729
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51434}
Make --max_old_space_size and friends work with values >= 2**31.
Such values did not work reliably (or sometimes not all) due to
signed integer overflow in size computations, which is UB.
Fixes https://github.com/nodejs/node/issues/18786.
Bug: chromium:814138
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ibe23cef2417fd5b4a727022b8b0d4b50f1417182
Reviewed-on: https://chromium-review.googlesource.com/927063
Commit-Queue: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51433}
WriteBarrierKindFor would always return kMapWriteBarrier in
SimplifiedLowering even if the map that's to be stored is part
of the immortal immovable roots which don't need write barriers
ever.
Bug: v8:7310
Change-Id: I0a87a1c3ddd7f71ccf8ebacba8409067dc00cd1c
Reviewed-on: https://chromium-review.googlesource.com/928564
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51431}
