Add test mode to ignore allocation hints

This randomizes new memory allocations and reservations. It's currently
used to test far jump tables in wasm better, but might be helpful
generally for testing arbitrary virtual memory layouts.

R=mstarzinger@chromium.org

Bug: v8:9477
Change-Id: Ie60b7c6dd3c4cd0f3b9eb8e2172912e0851c357d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1803340
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63802}

src/flags/flag-definitions.h

@@ -967,6 +967,10 @@ DEFINE_BOOL(gc_experiment_less_compaction, false,
 
 DEFINE_BOOL(disable_abortjs, false, "disables AbortJS runtime function")
 
+DEFINE_BOOL(randomize_all_allocations, false,
+            "randomize virtual memory reservations by ignoring any hints "
+            "passed when allocating pages")
+
 DEFINE_BOOL(manual_evacuation_candidates_selection, false,
             "Test mode only flag. It allows an unit test to select evacuation "
             "candidates pages (requires --stress_compaction).")

src/utils/allocation.cc

@@ -10,6 +10,7 @@
 #include "src/base/logging.h"
 #include "src/base/page-allocator.h"
 #include "src/base/platform/platform.h"
+#include "src/flags/flags.h"
 #include "src/init/v8.h"
 #include "src/sanitizer/lsan-page-allocator.h"
 #include "src/utils/memcopy.h"
@@ -166,6 +167,9 @@ void* AllocatePages(v8::PageAllocator* page_allocator, void* hint, size_t size,
   DCHECK_NOT_NULL(page_allocator);
   DCHECK_EQ(hint, AlignedAddress(hint, alignment));
   DCHECK(IsAligned(size, page_allocator->AllocatePageSize()));
+  if (FLAG_randomize_all_allocations) {
+    hint = page_allocator->GetRandomMmapAddr();
+  }
   void* result = nullptr;
   for (int i = 0; i < kAllocationTries; ++i) {
     result = page_allocator->AllocatePages(hint, size, alignment, access);

test/mjsunit/wasm/multiple-code-spaces.js

@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --randomize-all-allocations
 // Flags: --wasm-far-jump-table --wasm-max-initial-code-space-reservation=1
 
 load('test/mjsunit/wasm/wasm-module-builder.js');