Commits · 0a47bc63f3b1af819216e06f468fafc137d84597 · Linshizhi / V8

26 Jul, 2019 1 commit

[turbofan] Eliminate more non-const reference arguments · 0a47bc63

Georg Neis authored Jul 25, 2019

... mostly by turning them into pointer arguments.

After this CL, all remaining non-const reference arguments in
the compiler directory are in the backend.

Bug: v8:9429
Change-Id: I6a546da0fe93179e1a0b12296632591cbf209808
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719185Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62930}

0a47bc63

25 Jul, 2019 25 commits

[wasm-simd] Implement I64x2 Shl ShrS ShrU for arm64 · 0cedd864

Ng Zhi An authored Jul 25, 2019

Bug: v8:8460
Change-Id: I70bdd71909fd103f3cc537d3184d2f7225cf8cfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719034
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62929}

0cedd864

[wasm-simd] Implement I64x2 splat extract_lane replace_lane for arm64 · 1a1138f5

Ng Zhi An authored Jul 25, 2019

Bug: v8:8460
Change-Id: Ic92efbcb7c64184c237d0fb00c3c7aa75323a3e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717662
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62928}

1a1138f5

Revert "Reland "[wasm] Compile JS to WASM wrappers asynchronously"" · 11e27b5e

Zhi An Ng authored Jul 25, 2019

This reverts commit 801930f5.

Reason for revert: blink layout tests failure https://bugs.chromium.org/p/v8/issues/detail?id=9554

Original change's description:
> Reland "[wasm] Compile JS to WASM wrappers asynchronously"
> 
> Original CL had an issue with builtins being accessed through the
> isolate after the isolate died. See:
> https://ci.chromium.org/p/v8/builders/try.triggered/v8_win64_rel_ng_triggered/b8907837534672203296
> 
> Initial upload is the original CL and the following patch sets will
> attempt to fix it.
> 
> Original CL:
> 
> > [wasm] Compile JS to WASM wrappers asynchronously
> >
> > R=mstarzinger@chromium.org, ahaas@chromium.org
> >
> > Bug: v8:9231
> > Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699
> > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#62672}
> 
> R=mstarzinger@chromium.org, ahaas@chromium.org
> 
> Bug: v8:9231
> Change-Id: I1b01d5d2b9f728d6f6a90fe9b642f5ba3bf686eb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708485
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62918}

TBR=mstarzinger@chromium.org,thibaudm@chromium.org

Change-Id: I3a6829692614c44bacb764ef02723e61a3d61763
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9231
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719231Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62927}

11e27b5e

Revert "[wasm] Simplify module creation" · bf7284b9

Zhi An Ng authored Jul 25, 2019

This reverts commit 425fa3ae.

Reason for revert: test failure https://bugs.chromium.org/p/v8/issues/detail?id=9554 reverting the root cause has merge conflicts due to changes in same file

Original change's description:
> [wasm] Simplify module creation
> 
> This includes WasmEngine::NewNativeModule() and WasmModuleObject::New().
> The intent is to make the various ways of creating a module (sync,
> async, deserialize, import) more similar.
> 
> After this change, a NativeModule will always be created before a
> WasmModuleObject. This will make it easier to look up a cached
> NativeModule given its wire bytes.
> 
> The following changes are made:
> 
> * Use WasmCodeManager::EstimateNativeModuleCodeSize() to find the code
>   size estimate by default. A different code size estimate is only used in
>   tests.
> * Change CompileJsToWasmWrappers() to allocate a new FixedArray instead of
>   assuming the array was created with the correct size. This simplifies
>   WasmModuleObject::New(), and matches what CompileToNativeModule()
>   does.
> * Remove the WasmModuleObject::New() constructor that creates a
>   NativeModule. This case was only used in DeserializeNativeModule() and
>   in test code.
> 
> Change-Id: I6bdfc425057f92de11abbbf702d052d40aa8267d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717497
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62925}

TBR=binji@chromium.org,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I8dcad7ddcd4601f657b6263bf22009907284fce3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719230Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62926}

bf7284b9

[wasm] Simplify module creation · 425fa3ae

Ben Smith authored Jul 25, 2019

This includes WasmEngine::NewNativeModule() and WasmModuleObject::New().
The intent is to make the various ways of creating a module (sync,
async, deserialize, import) more similar.

After this change, a NativeModule will always be created before a
WasmModuleObject. This will make it easier to look up a cached
NativeModule given its wire bytes.

The following changes are made:

* Use WasmCodeManager::EstimateNativeModuleCodeSize() to find the code
  size estimate by default. A different code size estimate is only used in
  tests.
* Change CompileJsToWasmWrappers() to allocate a new FixedArray instead of
  assuming the array was created with the correct size. This simplifies
  WasmModuleObject::New(), and matches what CompileToNativeModule()
  does.
* Remove the WasmModuleObject::New() constructor that creates a
  NativeModule. This case was only used in DeserializeNativeModule() and
  in test code.

Change-Id: I6bdfc425057f92de11abbbf702d052d40aa8267d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717497
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62925}

425fa3ae

[wasm simd] Implement I64x2 Min and Max on x64 · 8c58e051

Ng Zhi An authored Jul 22, 2019

Bug: v8:8460
Change-Id: I913406a4079c766432a56d059a6cb9861fd469bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1703993Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62924}

8c58e051

Fix layout of the Space class for members accessed via an offset · 84a641fa

Bill Ticehurst authored Jul 24, 2019

Bug: v8:9118
Change-Id: I2271a158226a12f69a7efdfcb6c4faccccf98d15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715090
Commit-Queue: Bill Ticehurst <billti@microsoft.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62923}

84a641fa

[wasm simd] Implement F64x2 Add Sub Mul on x64 · f9b2f665

Ng Zhi An authored Jul 24, 2019

Bug: v8:8460
Change-Id: Ia9b2360c414abedfd9690e97b555c4e9b19fa1b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708451Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62922}

f9b2f665

[obj-stats] Fix heap-stats label order · 1d4079b3

Leszek Swirski authored Jul 25, 2019

Data in the viewer has to be in the same order as the labels.

Change-Id: I2e64fb30ebc0e3585c7b9d364553cb6a5ec1f3cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718159
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62921}

1d4079b3

[turbofan] First part of brokerization/serialization for instanceof · f9512482

Georg Neis authored Jul 25, 2019

- Move SerializePrototype out of DependOnStablePrototypes into
  ComputePropertyAccessInfo.
- Brokerize JSNativeContextSpecialization::InferHasInPrototypeChain.
- Brokerize JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance
  (modulo the call to ReduceJSInstanceOf).
- Brokerize JSNativeContextSpecialization::ReduceJSHasInPrototypeChain.
- Serialize for JSCallReducer::ReduceObjectPrototypeIsPrototypeOf.
- Serialize for JSNativeContextSpecialization::ReduceJSInstanceOf. This
  is still incomplete.

Bug: v8:7790
Change-Id: Ic56eab5ddd8d725a13d2980e5b55db53ae82e822
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709408
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62920}

f9512482

[regexp] Use stricter bounds check to avoid additional iteration · f42b1a5d

Seth Brenith authored Jul 22, 2019

The motivating example is JetStream 2's UniPoker test, which tests
whether a sorted string of Unicode playing cards contains a five-card
straight using a regular expression. In the top-level generated loop for
this RegExp, we see this loop exit condition:

00000350000C2067    27  83fffe         cmpl rdi,0xfe
00000350000C206A    2a  0f8da8e40000   jge 00000350000D0518  <+0xe4d8>

Meaning if the current position is pointing at the very last (16-bit)
character, then we exit the loop. Otherwise we go on and try to find
various matches starting at the current position. However, we can see
in the original expression that any possible match is at least 10
characters (5 astral-plane Unicode values), so we're wasting a lot of
time attempting to find matches in cases where we're too close to the
end of the string for any match to succeed.

This example might be a bit contrived, but I expect that an improvement
in this bounds check would help a larger family of regular expressions,
where the minimum match length is large relative to the string being
matched and we don't meet the other necessary criteria for fast Boyer-
Moore lookahead.

To get the desired bounds check in this case, this patch does the
following:
1. Compute accurate EatsAtLeast values for every node during the
   analysis phase. This could end up doing more work than the current
   implementation, but analysis already has to touch every node, so it
   seems like a cache-friendly time to compute these values. In some
   cases, this might be less total work than the current implementation,
   because the current implementation might recompute the same node
   multiple times.
2. When emitting a quick check, use the EatsAtLeast value from the
   predecessor ChoiceNode for the bounds check.

This improves the UniPoker score on my machine by about 4%, because it
cuts the time spent checking for straights roughly in half, and checking
for straights originally accounted for about 8% of the total time.

Bug: v8:9305
Change-Id: I110b190c2578f73b2263259d5aa5750e921b01be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1702125
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62919}

f42b1a5d

Reland "[wasm] Compile JS to WASM wrappers asynchronously" · 801930f5

Thibaud Michaud authored Jul 22, 2019

Original CL had an issue with builtins being accessed through the
isolate after the isolate died. See:
https://ci.chromium.org/p/v8/builders/try.triggered/v8_win64_rel_ng_triggered/b8907837534672203296

Initial upload is the original CL and the following patch sets will
attempt to fix it.

Original CL:

> [wasm] Compile JS to WASM wrappers asynchronously
>
> R=mstarzinger@chromium.org, ahaas@chromium.org
>
> Bug: v8:9231
> Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62672}

R=mstarzinger@chromium.org, ahaas@chromium.org

Bug: v8:9231
Change-Id: I1b01d5d2b9f728d6f6a90fe9b642f5ba3bf686eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708485
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62918}

801930f5

[ptr-compr] Avoid (de)compressions in CheckSmi · 31518ccc

Santiago Aboy Solanes authored Jul 24, 2019

Avoids unnecessary compression and decompression nodes since we
are going to be able to check for smis without needing to decompress and
re-compress.

It was doing a CheckedInt32ToTaggedSigned ->
ChangeTaggedSignedToCompressedSigned combo, where we could just do
CheckedInt32ToCompressedSigned.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I0bbbbb5bd4744c49840c84b2fcb775fe6b603de0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714878
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62917}

31518ccc

[torque] disallow tail calls from macros · a6c859f9

Tobias Tebbi authored Jul 25, 2019

Bug: v8:7793
Change-Id: I36daa0ef26cc7c274c64cfdba7e3a196677a7bc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718156Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62916}

a6c859f9

[turbofan] Remove some obsolete serialization calls · 52dbefd6

Georg Neis authored Jul 25, 2019

Bug: v8:7790
Change-Id: I774601b25f4dbe104875d18c03e17244efc1a0e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718157Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62915}

52dbefd6

[obj-stats] Count more field types (Smi, boxed double, string) · b50ee58c

Leszek Swirski authored Jul 25, 2019

Distinguish between generic Tagged and Smi in-object fields, and special
case (boxed) double values and string data rather than lumping those
into generic "raw data"

Change-Id: I5d635434ab94065c077a40110948424c31ead73d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718154
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62914}

b50ee58c

[regexp] Add UseCounter for matchAll with non-g RegExp · dd7190a9

Mathias Bynens authored Jul 25, 2019

Per the July TC39 meeting consensus, we'd like to make the
upcoming String.prototype.replaceAll proposal throw for
non-global RegExp searchValues. However,
String.prototype.matchAll currently does not throw in this
case, causing consistency concerns.

This patch adds a use counter for String.prototype.matchAll
with a non-global RegExp as the searchValue. Hopefully, this
pattern isn't too common in real-world code today, in which case
we can both a) change matchAll and b) proceed with the desired
replaceAll semantics.

https://github.com/tc39/proposal-string-replaceall/issues/16

V8 CL: https://chromium-review.googlesource.com/c/v8/v8/+/1718145
Chromium CL: https://chromium-review.googlesource.com/c/chromium/src/+/1718367

BUG=v8:9551

Change-Id: Ica660a0a6189d84c3d33398c98305d0bcb9f8c23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718145
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62913}

dd7190a9

[ptr-compr] Fix literal field copy iteration size · 61a3f827

Leszek Swirski authored Jul 25, 2019

When iterating over fields to copy, we should copy kTagged-sized fields,
not kPointer-sized fields, to avoid overwriting something allocated after
the last slot of an object if the end of the object isn't kPointer
aligned.

Bug: v8:8948
Change-Id: Ic3d933157ca1962a779dba6ae58facb558d75ca0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718151
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62912}

61a3f827

Update V8 version to 7.8 · 6c46b203

Maya Lekova authored Jul 25, 2019

TBR=machenbach@chromium.org
NOTRY=true

Change-Id: Ibe9b8e034ad71a45d3d5eeba70d7d07cd897dee3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718158Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62911}

6c46b203

[wasm] Grow reserved code space exponentially · 9afbef1e

Clemens Hammacher authored Jul 25, 2019

If a new code allocation request cannot be fulfilled, do not just
reserve enough to fulfill this one request, but request at least 20
percent of the total reserved code space so far. This ensures that
the reserved space grows exponentially instead of linearly.

R=mstarzinger@chromium.org

Bug: chromium:987560
Change-Id: I3fc4dd0f7acee2a380495a87c0425c58058551bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718144Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62910}

9afbef1e

[turbofan][cleanup] Do a Word32Equal since inputs are 32 bits · 7f130475

Santiago Aboy Solanes authored Jul 25, 2019

The two inputs are a Word32And and an Int32Constant. There is no need to
do this in 64 bits.

Bug: v8:9396
Change-Id: Ie564ac2f43e98192bf9853855b6c766248264886
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715462Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62909}

7f130475

Reland "[turbofan] Brokerize Function.prototype.bind" · 60d2018f

Maya Lekova authored Jul 24, 2019

This is a reland of 49f8323f

Re-applied previous fix for an undefined symbol,
changing std::max to i::Max.

Original change's description:
> [turbofan] Brokerize Function.prototype.bind
>
> Bug: v8:7790
> Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62895}

Bug: v8:7790
Change-Id: I1f141ea097054f069b94563e6140848e41c0ae1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715459Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62908}

60d2018f

[mips][wasm] Access "CEntryStub" from the root set. · 484c1558

Yu Yin authored Jul 25, 2019

Port 55643564 https://crrev.com/c/1714656

Original Commit Message:

    This removes a shortcut to a "CEntryStub" from the instance object and
    instead loads those values via the root set which is also referenced
    from the instance. It makes instance objects smaller.

Change-Id: I62d16960cb18e3cd69c2fa56da85a6bfc6064db4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716473Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#62907}

484c1558

[wasm][bulk-memory] Adjust elem and data segment to recent spec changes · 81efb932

Andreas Haas authored Jul 18, 2019

R=binji@chromium.org

Change-Id: I8eeff7dbc92749c4b9ea6bedd9123b9e6635ab5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709048
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62906}

81efb932

Update wasm-spec. · 0ed85c1d

v8-ci-autoroll-builder authored Jul 25, 2019

Rolling v8/test/wasm-js/data: https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+log/1a411f7..b0c936c

[interpreter] Downgrade to Ocaml 4.02 (#1044) (Andreas Rossberg)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/b0c936c

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I9726e31b94e0ffa2e4b10f0dc447b0253f03deb5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716001Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62905}

0ed85c1d

24 Jul, 2019 14 commits

Reland "Reland "[regexp] Call the regexp interpreter without CEntry overhead"" · 3a0f407d

Patrick Thier authored Jul 24, 2019

This is a reland of c2ee4a79

Original change's description:
> Reland "[regexp] Call the regexp interpreter without CEntry overhead"
> 
> This is a reland of d4d28b73
> 
> Original change's description:
> > [regexp] Call the regexp interpreter without CEntry overhead
> > 
> > Previously all RegExp calls went through Runtime_RegExpExec when --regexp-interpret-all was set.
> > 
> > This CL avoids the runtime overhead by calling into the interpreter directly from the RegExpExec Builtin when the regular expression subject was already compiled to ByteCode (i.e. after the first call).
> > 
> > Bug: v8:8954
> > Change-Id: Iae9dfcef3370b772a05b2942305335d592f6f15a
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698391
> > Commit-Queue: Patrick Thier <pthier@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#62753}
> 
> Bug: v8:8954
> Change-Id: I1f0b6de9c6da65bcb582ddb41a37419116a5c510
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1706053
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Patrick Thier <pthier@google.com>
> Cr-Commit-Position: refs/heads/master@{#62794}

Bug: v8:8954
Change-Id: Ice77c05240f1fabd36bf97b8e789dd4c25a9718f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715451Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62904}

3a0f407d

[Intl] Adding volume units. · 5bd57783

Frank Tang authored Jul 24, 2019

Add 'fluid-ounce','gallon', 'liter', and 'milliliter'
Also roll ICU to 682a2309

Sync with https://github.com/tc39/proposal-unified-intl-numberformat/pull/48


Bug: v8:9475
Change-Id: If45a20f17f5973b860893b0f70e724cc93c6550a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1699759
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62903}

5bd57783

Move potentially reentrant allocation out of the middle of Module::Reset · 61e2b67e

Daniel Clark authored Jul 22, 2019

During Module::Reset(), the module is in an unstable state between the
change to SourceTextModule::code and Module::status.  Any reentrancy
between these points is problematic because the normal invariants about
the value of SourceTextModule::code in relation to Module::status do not
hold.

An allocation of the exports hash table in the middle of Module::Reset()
was causing reentrancy during this problematic time.  This change fixes
the issue by moving the allocation earlier in Reset() before any fields
are modified.

Bug: v8:9522
Change-Id: Ia941af60a0b31f05a6d8da610b9a270e7f79dac2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1712449Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dan Clark <daniec@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62902}

61e2b67e

[arm64] Add support for pointer authentication instructions · 7cb9984e

Georgia Kouveli authored Jul 24, 2019

Change-Id: I29c88d9e5de34e9a940b76ab76a40376d251c25f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1373781
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62901}

7cb9984e

[wasm simd] Fix two reversing swizzles. · 95c7148d

Bill Budge authored Jul 23, 2019

- Fixes bugs in x64 and ia32 reversing swizzles.

Change-Id: Iea0beccab804fd8e68dc58bc0fa11db46ac391c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1330104
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62900}

95c7148d

Revert "Add postmortem debugging helper library" · 6747e3a1

Zhi An Ng authored Jul 24, 2019

This reverts commit 517ab73f.

Reason for revert: Test failures https://bugs.chromium.org/p/v8/issues/detail?id=9538

Original change's description:
> Add postmortem debugging helper library
> 
> This change begins to implement the functionality described in
> https://docs.google.com/document/d/1evHnb1uLlSbvHAAsmOXyc25x3uh1DjgNa8u1RHvwVhk/edit#
> for investigating V8 state in crash dumps.
> 
> This change adds a new library, v8_debug_helper, for providing platform-
> agnostic assistance with postmortem debugging. This library can be used
> by extensions built for debuggers such as WinDbg or lldb. Its public API
> is described by debug-helper.h; currently the only method it exposes is
> GetObjectProperties, but we'd like to add more functionality over time.
> The API surface is restricted to plain C-style structs and pointers, so
> that it's easy to link from a debugger extension built with a different
> toolchain.
> 
> This change also adds a new cctest file to exercise some basic
> interaction with the new library.
> 
> The API function GetObjectProperties takes an object pointer (which
> could be compressed, or weak, or a SMI), and returns a string
> description of the object and a list of properties the object contains.
> For now, the list of properties is entirely based on Torque object
> definitions, but we expect to add custom properties in future updates so
> that it can be easier to make sense of complex data structures such as
> dictionaries.
> 
> GetObjectProperties does several things that are intended to generate
> somewhat useful results even in cases where memory may be corrupt or
> unavailable:
> - The caller may optionally provide a type string which will be used if
>   the memory for the object's Map is inaccessible.
> - All object pointers are compared against the list of known objects
>   generated by mkgrokdump. The caller may optionally provide the
>   pointers for the first pages of various heap spaces, to avoid spurious
>   matches. If those pointers are not provided, then any matches are
>   prefixed with "maybe" in the resulting description string, such as
>   "maybe UndefinedValue (0x4288000341 <Oddball>)".
> 
> Bug: v8:9376
> 
> Change-Id: Iebf3cc2dea3133c7811bcefcdf38d9458b02fded
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628012
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62882}

TBR=yangguo@chromium.org,mvstanton@chromium.org,jgruber@chromium.org,tebbi@chromium.org,seth.brenith@microsoft.com

Change-Id: Ia078f2e8d101d2375b5db88021b2d65d28f1b075
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9376
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716033Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62899}

6747e3a1

[parser] Templaterificate ScopedPtrList into ScopedList · db37c0fb

Leszek Swirski authored Jul 24, 2019

This will allow us to use ScopedPtrList for other contents than just
pointers.

Change-Id: Ib16d388d5dd556f5e01593279f463ae25510f2be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715455Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62898}

db37c0fb

PPC/s390: [wasm] Access "CEntryStub" from the root set. · 6cd231bc

Milad Farazmand authored Jul 24, 2019

Port 55643564

Original Commit Message:

    This removes a shortcut to a "CEntryStub" from the instance object and
    instead loads those values via the root set which is also referenced
    from the instance. It makes instance objects smaller.

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I2ad2f3479431dae71f47af7ad5c722e46fd592d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716368Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62897}

6cd231bc

Revert "[turbofan] Brokerize Function.prototype.bind" · cceeba8f

Sathya Gunasekaran authored Jul 24, 2019

This reverts commit 49f8323f.

Reason for revert: breaks https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20cfi/21302

Original change's description:
> [turbofan] Brokerize Function.prototype.bind
> 
> Bug: v8:7790
> Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62895}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I7cf4ca1ef50d5d467484b94e067f7fc1b54d7a94
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715454Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62896}

cceeba8f

[turbofan] Brokerize Function.prototype.bind · 49f8323f

Maya Lekova authored Jul 24, 2019

Bug: v8:7790
Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62895}

49f8323f

Reland "[turbofan] Make code and comment match in FastFunctionPrototypeBind" · 629d3c85

Maya Lekova authored Jul 24, 2019

This is a reland of 7ba8e662

Fixed unresolved symbol error on CFI build.

Original change's description:
> [turbofan] Make code and comment match in FastFunctionPrototypeBind
>
> Additionally, used number of own descriptors in both CSA and the
> reduction of Function.prototype.bind.
>
> Change-Id: I7b86e059d20faa1160cdc0126932fff924226eee
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714655
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62885}

Change-Id: If4d6b4c963a089dca09dd9aa9ec94784b3a21825
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715450
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62894}

629d3c85

Add a flag for enabling the single generation mode in V8 · b2140c59

Rong Wang authored Jul 24, 2019

This flag ensures that all allocations are performed in the old generation. This only works when inline allocation and allocation folding are both disabled.

Bug: v8:9533

Change-Id: I9ad5e8bf492c43603ab2a4a1292198e1b9882dfe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710335Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62893}

b2140c59

[turbofan] Brokerize array builtins reductions · e8571c6a

Maya Lekova authored Jul 24, 2019

Bug: v8:7790
Change-Id: I3f0cf874eb77b803e35ee934b7b18bc0f64dc23f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714651
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62892}

e8571c6a

[stack-trace] Cache source position for JavaScript stack frames · 4a0cf0b9

Simon Zünd authored Jul 24, 2019

Retrieving the source position for a JavaScript stack frame is a
costly operation (it requires decoding the source position table).

The source position is usually retrieved twice, once for the line
number, and once for the column number.

This CL caches the resolved source position the first time around,
improving relevant stack trace serialization micro benchmarks by ~6%.

R=jgruber@chromium.org

Bug: v8:8742
Change-Id: Ife9903208d2be100e272ccad805a77c33e0df93a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715447Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62891}

4a0cf0b9