Don't deopt when a PropertyCell changes from readonly to writable.
Turbofan doesn't depend on readonly-ness unless the property is
also non-configurable, in which case such a change can't happen.
Change-Id: I3d1078a8adf1ec1b16d973dd71c4295d71003a8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531791
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71184}
This will allow us to target the new executable from existing JS fuzzers
(like the ochang fuzzer). Let's see if this gives more interesting JS
input files.
R=machenbach@chromium.orgCC=szuend@chromium.org
Bug: chromium:1142437
Change-Id: Id5bcfe660a487fbb9d6b80d167f43324cc284e1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536632
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71182}
Change-Id: I2c9f3ac81710b89543b392819a6cce03eaba6cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536639
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71181}
This is a reland of 04cdcd5a88
Got reverted in https://crrev.com/c/v8/v8/+/2534294 due to
TSAN issues. Those are solved in https://crrev.com/c/v8/v8/+/2537693.
Original change's description:
> [compiler] Move InternalizedString to kNeverSerialized
>
> Bug: v8:7790
> Change-Id: I8311b1f4b8239d0688a4b9b9057d6082942bbc00
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534471
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71159}
Bug: v8:7790
Change-Id: I95d68e23e4bc81399bcdcf7ce2fdcf49ddfb66c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536641
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71180}
Isolate::thread_id() may be invoked on a background thread to perform
a check if the thread is the main thread.
This also removes the copy constructor of ThreadLocalTop and clears
its fields explicitly.
Change-Id: I2207bf1ebd655805841fce9f23d23cff7be8f13b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2537693
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71177}
Previously, CodeStubAssembler::AllocateOrderedHashTable() would
allocate hash tables of the (statically known) minimum capacity in-
dicated by the concrete table type.
This CL adds AllocateOrderedHashTableWithCapacity, which is inspired by
AllocateNameDictionary. It takes a Node<IntPtrT> indicating the desired
capacity.
Bug: v8:7569
Change-Id: I4bf28f69286e52773319a1ae37d33b2f55175a84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2503950
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71175}
We now cast it into a DescriptorArrayData where appropiate, as we do
with all the other Data members.
Bug: v8:7790
Change-Id: I5be0aab9c4e80ae246c58a8df719308a0d475e6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534816
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71174}
In a previous CL the logic for generating the description for Trusted Types was added to Blink. Therefore, the corresponding logic remaining in V8 can be deleted safely.
Previous CL: https://chromium-review.googlesource.com/c/v8/v8/+/2502342
Bug: chromium:1048143
Change-Id: I1693fa1d213066cbc1fe822f890d2d7aaf7ce0f6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2502869
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Alfonso Castaño <alcastano@google.com>
Cr-Commit-Position: refs/heads/master@{#71173}
Makes ExternalReference count as a subclass of RawPtrT to enable
either to be passed to these functions as base argument.
BUG=v8:6949,v8:11074
Change-Id: I126856815ff7cdc0612e3c3fcdfdd4938cc19bfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534820
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71171}
Change-Id: I0aede0a2a188fc17492c10c0c13568c052282548
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534822
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71170}
Currently, we assume that stack trace creation always succeeds while
filling in the `exceptionDetails` structure. Stack trace creation can
fail under some circumstances so this CL introduces a null check.
R=clemensb@chromium.org
Bug: chromium:1147552
Change-Id: I4055d5276bbb7bf178b648bfc7bd84a288626c09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532310
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71169}
The first operand of the select op isn't restricted to any particular
replacement SimdType, since we can convert any type to Int32x4.
Change-Id: I1821b2ebdc1a192518a2ecc0cb13951a98bb3337
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534211
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71167}
Per https://tc39.es/proposal-import-assertions/#sec-assert-clause-to-assertions,
import assertions should be sorted by the import assertion [[Key]]s,
in order to prevent hosts from relying on a changing order of the
assertions to determine behavior.
Prior to this change, the assertions were being sorted by pointer. With
this CL, the keys are sorted using a code point ordering so that the
order of the assertions received by the host will be stable and
non-surprising.
This CL also switches the SourceTextModuleDescriptor's ModuleRequestMap,
RegularExportMap, and RegularImportMap to use the code point order
comparison rather than their former shortlex sort. This change will not
be externally visible, but it seems best to make these consistent.
In order to avoid #including the fairly large ast-value-factory.h
into ast/modules.h, I changed ImportAssertions into a separate class
definition rather than keeping it as a typedef. The alternative would
be to define a common AstRawStringComparer in ast-value-factory.h and
then #include ast-value-factory.h in both ast/modules.h and
parsing/parser.h so that the ImportAssertions typedef would have a
full, shared definition of the AstRawStringComparer type.
Bug: v8:10958
Change-Id: I29c9544aa0a4340c56e1ee631be6cabb2a2eb921
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2533038
Commit-Queue: Dan Clark <daniec@microsoft.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71165}
It creates a SharedMutexGuard if the boolean parameter in the
constructor is true.
Bug: v8:7790
Change-Id: I77647f648717af05b1239576b690aec6f4e8b268
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531790
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71162}
FLAG_disable_write_barriers is a constexpr so the V8_LIKELY macro isn't
necessary. Interestingly, it can also cause clang to warn that the code
is unreachable, whereas without `__builtin_expect()` the compiler
doesn't mind. See for example:
```
constexpr bool kNo = false;
void warns() {
if (__builtin_expect(kNo, 0)) {
int a = 42;
}
}
void does_not_warn() {
if (kNo) {
int a = 42;
}
}
```
Compiling V8 for arm64 with both `v8_disable_write_barriers = true` and
`v8_enable_pointer_compression = false` would trigger this warning.
Bug: v8:9533
Change-Id: Id2ae156d60217007bb9ebf50628e8908e0193d05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2534811
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#71157}
The recently-added verifiers for indexed fields have caught a bug: the
definition of SmallOrderedNameDictionary in Torque contained incorrect
padding for builds without pointer compression.
Bug: v8:11063
Change-Id: I2c3d7f06965ec0598ef4fe56923090aa89bc9df1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529013
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#71156}
This CL reverses the count logic for the tiering strategy of the
js-to-wasm wrappers. The initial approach was that calls to each
function were counted up, until a threshold was reached and the function
would tier up. With this CL, each function is assigned a budget of calls
that can be handled through the generic wrapper. Calls are counted down
until the budget is exhausted, which will trigger the tier-up
for the function.
This approach comes with two advantages. Firstly, determining whether
a function's budget is exhausted is as simple as checking the flags set
from the decrement of the budget. Secondly, the code generated by the
generic wrapper does not depend on the specific value of the initial
budget.
Bug: v8:10982
Change-Id: I5e186c6cf836a9c197b41d0f7ad075b07c87a4da
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532300
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Vicky Kontoura <vkont@google.com>
Cr-Commit-Position: refs/heads/master@{#71153}
The fuzzer is expected to generate a lot of syntax and runtime errors,
and the respective messages just flood the fuzzer output. By always
putting a {TryCatch} scope around the execution, we prevent those
messages from being printed.
At the same time, inspector tests need to properly propagate uncaught
exceptions in the backend to the inspector, and fail on uncaught
exceptions in the frontend.
This CL allows for all these behaviours by extending the
{CatchExceptions} enum and the {TryCatch} logic in the task runner.
Drive-by: Use {base::OS::ExitProcess} instead of the explicit
{fflush} and {_exit}.
R=szuend@chromium.org
Bug: chromium:1142437
Change-Id: Ic2cb3b0de2399d25bd8c53090575308cb0e09ab0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529135
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71152}
which was enabled a long ago and is not supposed to be disabled.
In addition this CL adds Representation::MightCauseMapDeprecation()
predicate and ensures it's consistent with the existing
MostGenericInPlaceChange() and CanBeInPlaceChangedTo().
Bug: v8:11104, v8:8865
Change-Id: Ia8046b76822c9b20fe3ce85de6b98570334aad21
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527088
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71151}
This is a reland of e3ec228c0a
Original change's description:
> Temporary compilation failure to test tree closing
>
> This will be reverted after testing the new tree closer.
>
> No-Try: true
> Bug: v8:10661
> Change-Id: I1b47976ee38cda447e2960ca4b6bd274f16425fe
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529131
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Liviu Rau <liviurau@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71081}
No-Try: true
Bug: v8:10661
Change-Id: I90742ecde3f8333c6d069b17e80b185cf26530db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531787
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Liviu Rau <liviurau@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71145}
Now that we loop the entire polymorphic weak fixed array, there's
no need to reorder the deprecated maps.
Bug: v8:10582
Change-Id: Icf03d6c0ada34f385ffb747c7246c79f7341106d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2530875
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71144}
A PropertyCell holding the_hole can't have cell type Undefined when the
compiler sees it.
Change-Id: Idcfe6c57c669a65a4ffbe522803bf25efc8bee5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2531785
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71143}
Instead of just comparing the first 4 elements, load and loop
over the entire array so that we don't miss out on deprecate
maps.
Bug: v8:10582
Change-Id: I67542e2ab24367a11a4bb84b6745a4fa80c42772
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2524441
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71141}
For NCI compilation tasks, we don't actually install the generated
Code object on the function. In that case, we cannot make assertions
about function state.
Bug: v8:8888,chromium:1146013
Change-Id: Ia2342c52e565ccb1f6b5b09dda5e998b3fd3eb3a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532297
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71140}
The target can be used in Chromium to get basic cppgc types without
building the actual library.
Bug: chromium:1056170
Change-Id: Idaed19d265c63b2665e34d667903804708411c45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2532308
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71136}
