Doing a `!(B > A)` which is equal to `A >= B`. This way
we use one less instruction.
Change-Id: I49d50f11096e2d542eaabab82c17225c83e89b63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2846980
Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#74125}
Unordered floating-point (non-)equality is implemented using two flags
on x64: kUnorderedNotEqual as "not_equal OR parity_even" and
kUnorderedEqual as "equal AND parity_odd". Only the first flag was
checked.
This change fixes the kUnorderedNotEqual case by emitting a second
cmov to also move the "true" value if the parity_even flag is set. The
kUnorderedEqual case is covered by inverting the condition in the
instruction selector.
This should also be optimal according to the code emitted by clang -O3
for equivalent C++ code.
Drive-by: remove unused overload of EmitWithContinuation.
R=neis@chromium.orgCC=ahaas@chromium.org
Bug: chromium:1200184
Change-Id: Iae438d29fb5897ca910a154f140a5a6a904490ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2844651
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74122}
Currently the --single-generation flags disables inline allocations
and forces all allocations to go via runtime where they are redirected
to the old generation.
This patch implements the young to old redirection in CSA and TF.
Bug: v8:11644
Change-Id: Ie945ba684fb0f41d5414a05be2f25245d4869d6c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839010
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74121}
Until this CL, the JSHeapBroker::GetPropertyAccessInfo (GPAI) process
was as follows:
1. GPAI is called on the main thread (MT) during the serialization
phase to create and cache PAIs.
2. GPAI is called again from the background thread (BT); only cached
PAIs from step 1 are usable.
As part of concurrent inlining, the goal is to move GPAI fully to the
background thread. This CL takes a major step in that direction by
making GPAI itself callable from the BT without resorting solely to PAIs
that were previously cached on the MT.
There are two main reasons why GPAI previously had to run on the MT:
a) Concurrent access to Maps and other heap objects.
b) Serialization and creation of ObjectRefs for objects discovered
during GPAI.
This CL addresses only reason a) and leaves b) for future work. This
is done by keeping the two-pass approach, s.t. the initial call of
GPAI on the MT discovers and serializes objects. We then clear all
cached PAIs. The second call of GPAI on the BT thus runs full logic in a
concurrent setting.
Once all relevant objects (= maps and prototypes) no longer require
MT-serialization, reason b) is also addressed and the first pass can be
removed.
The new logic is implemented behind the runtime flag
--turbo-concurrent-get-property-access-info (default true), intended
to be removed in the future.
Bug: v8:7790
Change-Id: Idbdbfe091d7316529246a686bb6d71c2a0f06f8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2817793
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74120}
Bug: v8:11675
Change-Id: I8046e61d92b502a8c96f11e3ecfc528544c6ba97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843953
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74114}
As we can still intend to run the web-exposed profiler outside of an
origin-isolated environment, add support back for filtering by
v8::Context.
This reverts commit 05af368100.
Bug: chromium:956688
Change-Id: Idd98bea3213b5963f689a04de6c3743073efc587
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2785806
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#74112}
Instead of {func-index}+{pc of instruction relative to function}, make
it {func-index}:{pc of instruction in module}. This is more consistent
with existing conventions
(https://webassembly.github.io/spec/web-api/index.html#conventions) and
other tools (like output of wasm-objdump).
Bug: v8:10773
Change-Id: I7ceecafd984e2d1adbb57266e1f7448762e23ac9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2842267
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74110}
After appending 'unimplemented instruction' we need to increase the data
pointer to avoid an endless loop and to fulfill a later DCHECK.
R=jkummerow@chromium.org
Bug: chromium:1201114
Change-Id: I707809f81a4d9a6b3653b94b4836482c006b76ad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843819
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74108}
This reverts commit fd16e67e49.
Reason for revert: TSAN no-CM flaky failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20no-concurrent-marking/3413
Original change's description:
> Reland "[compiler] Perform MapRef's SupportsFastArray methods concurrently"
>
> This is a reland of ebd9dcdaac
>
> Reason for reland: std::atomic<> only works for primitive types i.e. it
> does not work for Object. We can change it to read/write the Object's
> Address, instead.
>
> Original (reverted) CL can be seen in PS1.
>
> Original change's description:
> > [compiler] Perform MapRef's SupportsFastArray methods concurrently
> >
> > We are safe to go through the native_contexts_list_ since we do it
> > through IsAnyInitialArrayPrototype which disallows the GC. Furthermore,
> > we read that list with an acquire load which guarantees that the fields
> > have been initialized.
> >
> > Bug: v8:7790
> > Change-Id: I778d51f4ead44e472f842693a7e9ff577d6acfe3
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826541
> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#74086}
>
> Bug: v8:7790
> Change-Id: I721c3a1e962951b0bc073dc74baf7fbeababc243
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843813
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74104}
Bug: v8:7790
Change-Id: I4efa8165b680eaa6c5c525d85d21962e6a5b1abb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843822
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74106}
This is a reland of 47077d9449 without
changes. The revert was false alarm.
Original change's description:
> [compiler] Fix more truncation bugs in SimplifiedLowering
>
> Bug: chromium:1200490
> Change-Id: I3555b6d99bdb4b4e7c302a43a82c17e8bff84ebe
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840452
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74097}
Bug: chromium:1200490
Change-Id: I75cac59050bc393d157a1ee5bed776c8986a7bbe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843817
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74105}
This is a reland of ebd9dcdaac
Reason for reland: std::atomic<> only works for primitive types i.e. it
does not work for Object. We can change it to read/write the Object's
Address, instead.
Original (reverted) CL can be seen in PS1.
Original change's description:
> [compiler] Perform MapRef's SupportsFastArray methods concurrently
>
> We are safe to go through the native_contexts_list_ since we do it
> through IsAnyInitialArrayPrototype which disallows the GC. Furthermore,
> we read that list with an acquire load which guarantees that the fields
> have been initialized.
>
> Bug: v8:7790
> Change-Id: I778d51f4ead44e472f842693a7e9ff577d6acfe3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826541
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74086}
Bug: v8:7790
Change-Id: I721c3a1e962951b0bc073dc74baf7fbeababc243
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843813
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74104}
For handles and external refs, use Move32BitImmediate directly rather
than mov -- mov will first try more compact encodings which will almost
certainly fail for embedded pointers, so it's not worth trying to use it
in baseline compilation where the compiler speed matters.
Bug: v8:11420
Change-Id: Ic0ed9f95d28302ae9737567aa863dc93666239e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843814
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74103}
This CL hardens the test function for unwrapping the C++ object to
only do so if the correct API object is passed from JS.
Bug: chromium:1201057
Change-Id: I81eb16efe2711bd788c775e3bcb712720bbe4782
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843347
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74102}
Changes:
- Remove TypeCheckBranchResult. Change TypeCheckBranch() to return bool.
Refactor call sites to reflect this (decouple current code
reachability check from type check).
- Unify TypeCheckBranch(), TypeCheckFallthrough(), and the type-checking
part of Return() into TypeCheckStackAgainstMerge().
- Make sure all TypeCheck* functions are only called within VALIDATE.
- In graph-builder-interface, rename end_env -> merge_env to reflect
its function for loops.
- Change expected error messages in some tests.
Change-Id: I857edc18db9c2454ad12d539ffe7a10e96367710
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839560
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74100}
This CL extracts CommandLineAPIScope from V8Console and exposes it
as V8CommandLineAPIScope. Also, it exposes V8InspectorSession::createCommandLineAPI.
These changes will be used by InspectorPageAgent to install command
line APIs when evaluating scripts added using CDP's command
Page.addScriptToEvaluateOnNewDocument.
Chromium CL: https://crrev.com/c/2835786
Doc: https://docs.google.com/document/d/1zGG7-NZMb-aOfFfHf1u4VsP4C-lZettopCvYDC6pkBw/
Bug: chromium:1200705
Change-Id: I39b27f957cfb6d682ea84e385eaf25d09d261b58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835712
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74096}
Similar to the recent change to --code-comments, make --debug-code a
build-time enabled flag, enabled by default on debug builds.
This also removes the emit_debug_code() option from the assembler,
instead using the flag directly (there were no cases where this option
didn't match the global flag).
Change-Id: Ic26b0d37b615a055508c9dda099ffbe979eae030
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843348
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74095}
- Add filter to skip baseline handlers
- Make profiler types more readable
- Refactor tickprocessor test to use serialized symbols
- Add large tickprocessor stress test with a complete V8 log
Change-Id: Icc09c2eb8ea63c1805d793d2d47f79b0d5080b5b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2784686
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74094}
Based on some test compiles (of three.js and jquery) we can get a decent
estimate of expected bytecode offset table size for a given bytecode
size. Reserve this expected size to avoid resize overhead.
Bug: v8:11420
Change-Id: I8288b01fa796e765a20b11219687fa3d23272416
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843354
Reviewed-by: Patrick Thier <pthier@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74093}
Since there usually aren't many pending 32-bit constants, we can avoid
the cost of malloc/free for most compiles by using a base::SmallVector
instead of std::vector.
I picked a value of 32 entries as the SmallVector's inline size, based
on compiling three.js and jquery with Sparkplug, and printing the size
of the constant pool when emitted. 93% of emitted constant pools had
<=32 entries.
Bug: v8:11420
Change-Id: I7d62da74c60feae08f8a4b16b1e7f93ea69d2c95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2840447
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74092}
This CL disables two more fast API calls tests that shouldn't be run
on stress_snapshot and jitless variants.
Change-Id: I2e3270ba7b93e598219b87195640675cfc4571ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843362
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74091}
Use the general VLQ implementation for RelocInfo, rather than a custom
varint implementation. Note that this reverses the tagging logic (from
end bit to continuation bit) as this is more efficient for small values
(that now don't need to be tagged/untagged when written/read).
Change-Id: I09283f0557f9e182b4466858a2786922affb1453
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839555
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74089}
This reverts commit ebd9dcdaac.
Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20gcc/11378/overview
Original change's description:
> [compiler] Perform MapRef's SupportsFastArray methods concurrently
>
> We are safe to go through the native_contexts_list_ since we do it
> through IsAnyInitialArrayPrototype which disallows the GC. Furthermore,
> we read that list with an acquire load which guarantees that the fields
> have been initialized.
>
> Bug: v8:7790
> Change-Id: I778d51f4ead44e472f842693a7e9ff577d6acfe3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826541
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#74086}
Bug: v8:7790
Change-Id: I4ef0056fb5ab9bd037375f67ec704f842e003283
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843360
Auto-Submit: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74087}
We are safe to go through the native_contexts_list_ since we do it
through IsAnyInitialArrayPrototype which disallows the GC. Furthermore,
we read that list with an acquire load which guarantees that the fields
have been initialized.
Bug: v8:7790
Change-Id: I778d51f4ead44e472f842693a7e9ff577d6acfe3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2826541
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74086}
We have roughly a 7x (5x on ia32) ratio between bytecode and sparkplug
code. Using this number to preallocate the buffer for the emitted code
we can avoid a few copies for larger functions.
Drive-by-fix: Make sure EnsureSpace is marked V8_INLINE
Bug: v8:11420
Change-Id: I6ec48717d2e030c6118c59f5cdc286c952ec2843
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2835732
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74085}
It can happen that the {value} handle initially (when we stored its
contents into the property cell) contained a ThinString but was
subsequently patched by the scavenger to hold the InternalizedString
directly.
Bug: v8:11675
Change-Id: Ia3e5fed5bd28313b6fd2031eee0658ac4136a7ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843350
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74083}
Flag reads from background threads are unfortunately scattered and
hard to completely avoid in the current state of V8. An example TSAN
failure:
ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20TSAN/36369/overview
The root cause is that FlagScope destruction modifies flag values on
the main thread, racing with flag reads from the background thread. In
cctests, there's no need to reset flags back to initial values at the
end of tests. Let's simply remove the problematic flag scopes.
Bug: v8:11658
Change-Id: I59ed3794ddc9ed570772726a423dc22afc4dc207
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843346
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74082}
Templatize the VLQ methods to avoid std::function overheads, and add a
few optimisations (small value fast path, split writing and tagging).
Change-Id: I840d60c972916d1a6023c8ea2a67bbd540f2d159
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2839554
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74081}
Turning on V8_ENABLE_SYSTEM_INSTRUMENTATION by default has broken
node-v8 builds on Windows, tracked here:
https://github.com/nodejs/node-v8/issues/192. It looks like it is due
to the fact that Node uses pre-compiled headers, which undefines
some macros needed for the event trace APIs to work. (see
src/base/win32-headers.h)
Bug: v8:11043
Change-Id: I3a6caeaaabab59d42e14b79defb2e37efd9ad04d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2830550
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sara Tang <sartang@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#74080}
This CL hardens the test facility in d8 for interface types for
the fast C API.
Bug: chromium:1201011
Change-Id: Ibfe1bb242f86b4a5edd0d195e049852430f8a2fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2843344
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74079}
