Implementation of anyfunc parameters. Different to anyref parameters we
have to do a validation in the js-to-wasm wrapper: Only exported wasm
functions are allowed. I implemented this check in a runtime function.
R=titzer@chromium.org
Bug: v8:7581
Change-Id: I6145782fb8578124ddc21b50133c82235d666f19
Reviewed-on: https://chromium-review.googlesource.com/c/1417470
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58885}
Refactor all call sites to use the new API introduced in
https://crrev.com/c/1411347 and remove the legacy constructors.
R=mstarzinger@chromium.org
Bug: v8:8689, v8:8562
Change-Id: Id73686413726b2860f551dd200ef4b8823ef3034
Reviewed-on: https://chromium-review.googlesource.com/c/1415491
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58884}
We're not even sure such a situation could ever arise (ignoring
--stress-opt).
R=jarin@chromium.org
Bug: v8:7790
Change-Id: I4e498c3984b9e00cccc6234ad82ffac6f95576c2
Reviewed-on: https://chromium-review.googlesource.com/c/1414918
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58883}
Change-Id: I1bdb803a66a004f1a6dfdee149f459b0d0210f2f
Reviewed-on: https://chromium-review.googlesource.com/c/1414922
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58882}
Refactor the AllocateAssemblerBuffer helper for the new Assembler API.
This is the only non-mechanical part, all other callsites that create
Assembler instances can be trivially changed to the new API. This will
be done in a separate CL.
R=mstarzinger@chromium.org
Bug: v8:8689, v8:8562
Change-Id: I6c150748eeea778d9b70f41fd66fbb1221035a1b
Reviewed-on: https://chromium-review.googlesource.com/c/1415490
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58881}
This triggers the optimizing StoreField lowering in the MemoryOptimizer.
Drive-by cleanup: Remove useless return values in CSA store functions.
Bug: v8:7793
Change-Id: I08417a81ca321dcd27ff5cc3a11ef74262d419fb
Reviewed-on: https://chromium-review.googlesource.com/c/1414911
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58880}
This updates the InterfaceDescriptor for JSRunMicrotasksEntry and
RunMicrotasksTrampoline from DummyDescriptor to RunMicrotasksEntryDescriptor.
Bug: v8:8124
Change-Id: I4522fd45bd18b33a2a4471b76c217d2a0f504cb0
Reviewed-on: https://chromium-review.googlesource.com/c/1412132
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58879}
This CL fixes two bugs. First, when looking for a free spot while
moving elements to the front, the prototype chain was also considered,
even though an object at a specific index might have a hole (free
spot).
Second, when moving an element to the front, we are not allowed to
delete it immediately (to preserve semantics when interacting with
non-extensible objects). Such an element is then a free spot, but
won't be recognised as such. This CL sets that element to undefined
after it was moved, to mark it as a free spot.
R=jgruber@chromium.org
Bug: chromium:897512,v8:8369
Change-Id: I79207215b8b0a3c714f064450d8fe5ca0ea4a096
Reviewed-on: https://chromium-review.googlesource.com/c/1417171
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58878}
For instance, now there's only one place where the
destination file is chosen.
Bug: v8:7790
Change-Id: I8d6a093808fec1d47aee78748537c5c22169e79b
Reviewed-on: https://chromium-review.googlesource.com/c/1414910
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58877}
This is a reland of fd49c8bb43
Original change's description:
> [heap] Optimize MemoryChunk::FromAnyPointerAddress
>
> Currently this function requires the caller to hold a mutex for the
> large page chunk hashtable and performs a hashtable lookup.
>
> This patch adds a header sentinel field in each MemoryChunk. The field
> is then used to distinguish large object slots from ordinary slots.
>
> Bug: chromium:915233
> Change-Id: I9fbeeb4f07f49573d0a21f9a2cc934370e417d68
> Reviewed-on: https://chromium-review.googlesource.com/c/1391752
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58732}
Bug: chromium:915233
Change-Id: I10d23a928328169a2dc6bab78d2b7d2c5d00ebb6
Reviewed-on: https://chromium-review.googlesource.com/c/1406672
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58876}
Add a special handle of TypedArray elements in TestElementsIntegrityLevel
Bug: v8:8082
Change-Id: I60be644801618b576b0b8b1883ac67bf0040c849
Reviewed-on: https://chromium-review.googlesource.com/c/1412133
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58874}
This CL adds handling for almost all calls, and for some load and store
bytecodes in the serializer and marks the relevant call targets as
"serialized for compilation".
Design doc:
https://docs.google.com/document/d/1vCQYhtFPqXafSMweSnGD8l0TKEIB6cPV5UGMHJtpy8k/edit?ts=5bf7d341
Bug: v8:7790
Change-Id: I2bd24c1b0541e83c108422b66902a5b979f1e1a8
Reviewed-on: https://chromium-review.googlesource.com/c/1351014
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58873}
The previous implementation of MicrotaskQueue::RunMicrotasks() didn't
support non-default MicrotaskQueue as RunMicrotasks builtin couldn't
take a parameter.
This CL updates the entry trampoline for RunMicrotasks builtin to pass
a MicrotaskQueue parameter to support non-default one.
Bug: v8:8124
Change-Id: I817238cd9a1fd6c20dcd58022274736c5e86229a
Reviewed-on: https://chromium-review.googlesource.com/c/1369906
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Taiju Tsuiki <tzik@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58872}
The function body decoder already tracks reachability and only calls
the backend for reachable code. Thus the checks in the TF backend can
be skipped.
Note that there was already a DCHECK in place that checks whether
{SsaEnv::reached()} always returns true. This was to give fuzzers a
chance to prove the reachability analysis in the function body decoder
wrong. Since this did not happen, we can not remove the {reached()}
method from SsaEnv, since it always returned true anyway.
R=titzer@chromium.org
Bug: v8:8423, v8:8611
Change-Id: I2336aa7a092e381e3d94d87051b6e14db0dbab99
Reviewed-on: https://chromium-review.googlesource.com/c/1415493
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58871}
Add benchmarks for String.prototype.startsWith in order to keep track
of performance ahead of the torque port.
Bug: v8:8400
Change-Id: I0276b84b315024bba1a0d6f761ee2c6cf2c516a2
Reviewed-on: https://chromium-review.googlesource.com/c/1416070
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58870}
and TurboAssembler. Instead of listing all the different combinations
of arguments (which is one more now, temporarily), just forward all
arguments down via MacroAssembler and TurboAssembler to
TurboAssemblerBase.
Interestingly, this requires more specific types sometimes (int instead
of size_t), since further down the forwarding chain, the compiler does
not recognize any more that the value is a constant, and emits a
warning about a possibly truncating implicit conversion.
R=mstarzinger@chromium.org
Bug: v8:8689, v8:8562
Change-Id: Ifd13d2210ee64251c0075c0d9b68cacd5107d9ab
Reviewed-on: https://chromium-review.googlesource.com/c/1414913
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58869}
Make the description return the class name as it used to be.
BUG=chromium:919292
Change-Id: Idbc07643f15014a39a08a545a5003be891d95bd3
Reviewed-on: https://chromium-review.googlesource.com/c/1416318
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58867}
Port 1a3aab51f6
Original Commit Message:
When generating an Assembler, you currently have two choices: Either
let the Assembler allocate a growable internal buffer, which is owned
by the Assembler. Or provide an externally allocated buffer, which
cannot grow.
This CL changes this interface to allow providing any implementation of
a buffer. The provided buffer can be a view to an externally owned
buffer, which still can grow.
This will be used to split WebAssembly compilation and code submission.
The buffer needs to be able to grow, but cannot be owned by the
Assembler because it has to survive until the code is submitted.
R=clemensh@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N
Change-Id: Id9383db813b13ea1d9eab485724aeb55b08cdfee
Reviewed-on: https://chromium-review.googlesource.com/c/1416310
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#58865}
Fix WebAssembly's global/value-get-set. The argument must not be
undefined.
mjsunit tests were updated.
Bug: v8:8319
Change-Id: Id3d3c9b18cbc8854e589481dfc7c52f35cfb7bf7
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/1411886
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Cr-Commit-Position: refs/heads/master@{#58863}
After moving to its own header, this CL cleans up some parts of the
interface. It fixes names and const-declarations of simple accessors,
and adds a named constructor to make it explicit that an EnumSet should
be constructed from an integral value.
Also refactor the use in cctest.h to have less statically declared
constants. Instead, just create the set of extensions in the individual
tests.
R=titzer@chromium.org
Bug: v8:8562
Change-Id: I6178d1aba25afa1d7f54c29ccf81505c165e7cd3
Reviewed-on: https://chromium-review.googlesource.com/c/1409366
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58862}
With the changes in this patch, it is now possible to add methods to
both Torque's class and struct types. As a special case, "constructor"
methods are used to initialize the values of classes and structs when
they are constructed.
The functionality in this patch includes:
- The refactoring of class- and struct-handling code to share field
and method declaration code between both.
- Addition of the "%Allocate" intrinsic that allocates raw bytes to be
allocated from the V8 GC's NewSpace heap as the basis for freshly
created, initialized class objects.
- An implementation of a CallMethodExpression AST node that enables
calling methods and constructors, including special handling of
passing through the "this" pointer for method calls on structs by
reference. The syntax for struct construction using "{}" remains as
before, but now calls the struct's matching constructor rather than
implicitly initializing the struct fields with the initialization
arguments. A new syntax for allocation classes is introduced: "new
ClassName{constructor_param1, constructor_param1, ...}", which
de-sugars to an %Allocate call followed by a call to the matching
constructor.
- class constructors can use the "super" keyword to initialize their
super class.
- If classes and struct do not have a constructor, Torque creates a
default constructor for them based on their field declarations,
where each field's initial value is assigned to a same-typed
parameter to the the default constructor. The default constructor's
parameters are in field-declaration order, and for derived classes,
the default constructor automatically uses a "super" initialization
call to initialize inherited fields.
- Class field declarations now automatically create ".field" and
".field=" operators that create CSA-compatible object accessors.
- Addition of a no-argument constructor for JSArrays that creates an
empty, PACKED_SMI_ELEMENTS JSArray using the machinery added
elsewhere in this patch.
Bug: v8:7793
Change-Id: I31ce5f4b444656ab999555d780aeeba605666bfa
Reviewed-on: https://chromium-review.googlesource.com/c/1392192
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58860}
The table.copy bytecode copies a range of table entries in a similar
way to memcopy. This CL implements the behavior in a runtime call
that calls into the wasm engine.
R=mstarzinger@chromium.org,binji@chromium.org
BUG=v8:7747
Change-Id: I420451202b1b78ea92cbd10387a644ed57e111c8
Reviewed-on: https://chromium-review.googlesource.com/c/1414919
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58858}
This changes the existing --print-wasm-code to no longer print code for
runtime stubs (or any other stub code). The new --print-wasm-stub-code
can be used to specifically print such stubs. This does not affect the
existing --print-code behavior.
R=ahaas@chromium.org
Change-Id: I7a00722bf6e7cfbc210245cfd00dac16905f8902
Reviewed-on: https://chromium-review.googlesource.com/c/1411883
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58857}
A minor cleanup I saw while working on related stuff.
R=mstarzinger@chromium.org
Bug: v8:8562
Change-Id: If11fe1dae3820e61ed3807cfefd33dc229903ffb
Reviewed-on: https://chromium-review.googlesource.com/c/1414915
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58855}
This new method returns no value and just verifies that the Maybe is not
Empty. This is intended to be used for functions like Object::Set that
return a Maybe<bool> but only use "emptiness" to indicate its result and
where ToLocalChecked() appears to be discarding information.
Also comments Object::Set to indicate that Check() is the preferred way
of asserting that the Set should always succeed.
R=yangguo
Bug: v8:8562
Change-Id: Ic3b45e42fa9ba0b53f1a764660a56041e64f087b
Reviewed-on: https://chromium-review.googlesource.com/c/1414912
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58852}
That makes the declaration in sync with how dynamic references are resolved,
avoiding duplicate variable creation in the likely case that the variable is
also referenced within the eval.
Bug: v8:5112, v8:5135, v8:8693
Change-Id: I0c55495f573fe8b5076b1627c139ff72d1adda74
Also-by: leszeks@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/c/1408890
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58850}
_xgetbv is reserved for the implementation and shouldn't be used by user
code. Newer GCCs and clang trunk define _xgetbv, leading to a name
collision if xsaveintrin.h gets included transitively.
This unbreaks building v8 with clang trunk and libstdc++ 4.9, which
happens to pull in xsaveintrin.h transitively through <algorithm>. Newer
versions of libstdc++ don't seem to do that anymore which is why this
issue never showed up before.
R=bmeurer@chromium.org
Change-Id: If94efaf4798e5420738064bcbf26880f904c76a9
Reviewed-on: https://chromium-review.googlesource.com/c/1414858
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58849}
When generating an Assembler, you currently have two choices: Either
let the Assembler allocate a growable internal buffer, which is owned
by the Assembler. Or provide an externally allocated buffer, which
cannot grow.
This CL changes this interface to allow providing any implementation of
a buffer. The provided buffer can be a view to an externally owned
buffer, which still can grow.
This will be used to split WebAssembly compilation and code submission.
The buffer needs to be able to grow, but cannot be owned by the
Assembler because it has to survive until the code is submitted.
R=mstarzinger@chromium.org
Bug: v8:8689
Change-Id: Ib6c5ebffc8b71d0778944abac34f02c5cc7dbd79
Reviewed-on: https://chromium-review.googlesource.com/c/1411347
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58848}
This doesn't need to be static as the whole SamplerManager class has
only one static instance anyway, via instance().
This might also fix the weird lock behavior we are seeing on Nexus 5x
where the atomic_bool lock seems to never be released.
Bug: v8:8649
Change-Id: If44b6361c9e2a124265ca5b15b997538475a2ec9
Reviewed-on: https://chromium-review.googlesource.com/c/1414854
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58847}
Replace std::find_if in AdvanceUntil with a manual loop, which can
then return early, skipping the branch comparing to buffer_end_.
Change-Id: If49ed3667877751fcb0103a742750f03e5bd50db
Reviewed-on: https://chromium-review.googlesource.com/c/1411351
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58846}
It's already added somewhere else, and otherwise it shows up twice. We only
need to collect it for DebugEvaluate.
Bug: chromium:921339
Change-Id: I8e8890ecf19e0c7d1196c32e9358962c984001da
Reviewed-on: https://chromium-review.googlesource.com/c/1414851
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58844}
Storing a VariableProxy in declarations means that a declaration and
initialisation assignment are tightly coupled to use the same var. In
particular, this means that Var declarations in with scopes have to
clone the VariableProxy to split the declaration and initializer LHS
lookup.
This patch changes declarations to point directly to the Variable, not
the VariableProxy. This will allow future refactoring to decouple
declarations and initialisations.
Change-Id: I0baa77bfd12fe175f9521d292740d7d712cffd37
Reviewed-on: https://chromium-review.googlesource.com/c/1406683
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58843}
When building v8 using MSVC (as for Node.js), clang-cl is not available
to act as an assembler. This change allows mksnapshot to accomodate this
fact by emitting assembly in the MSVC ARM assembler's format.
Incidentally, the MSVC ARM asm format is just the ARM, Holdings assembler's
asm format with a small handful of unimplemented features.
https://docs.microsoft.com/en-us/cpp/assembler/arm/arm-assembler-reference
Bug: chromium:893460,v8:8645
Change-Id: I1a6b765b0f9b4d117d7a6f100015a4f124442865
Reviewed-on: https://chromium-review.googlesource.com/c/1394758
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58842}
With this change, splinters inherit the bundle from
their parent and hence get the same registers allocated
(if possible) that are used by the parent. This might
improve performance and should reduce code size.
Change-Id: I0f3b5211cf47976a16b37204a1ce34d92725bc33
Reviewed-on: https://chromium-review.googlesource.com/c/1403126
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58840}
On ia32, arm and mips we generate miscellaneous memcpy-related functions
at runtime:
arm: memcpy for uint8-uint8 and uint16-uint8 {dest-source} pairs.
ia32: memmove
mips: memcpy uint8-uint8
In jitless mode, runtime codegen is disallowed, so these must be
converted into builtins.
As far as I can tell, the mips64 files were dead code (#ifdef'd to
V8_HOST_ARCH_MIPS instead of MIPS64).
Note also the slightly changed implementation of ia32's MemMove's
jump tables.
Bug: v8:8675
Change-Id: I5dc2a50fcbad332ce9f78228425b987b0d9acdf3
Reviewed-on: https://chromium-review.googlesource.com/c/1407067
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58839}
Now the embedder can instruct V8 to restore the initial heap limit
once the heap size drops below the given percentage of the heap limit.
Bug: chromium:922038
Change-Id: Ib668406c5d59c02b45a8eae7de96527ebc3f2b4d
Reviewed-on: https://chromium-review.googlesource.com/c/1411606
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58837}
