- 29 Jun, 2020 10 commits
-
-
Michael Achenbach authored
It is obsolete to filter out error-message differences since the time we pass --correctness-fuzzer-suppressions to d8, which already stubs all messages: https://cs.chromium.org/chromium/src/v8/src/execution/messages.cc?l=1031 No-Try: true Bug: chromium:1100114 Change-Id: Iac42a8e2a32f9bae4034f79eaff429bf3ee41724 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270024Reviewed-by:
Maya Lekova <mslekova@chromium.org> Reviewed-by:
Tamer Tas <tmrts@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#68577}
-
Michael Achenbach authored
This simplifies the lengthy main method by extracting some code and by replacing the scattered returns with exceptions. We introduce two exceptions for early bail-out. This enables helper methods on multiple layers. The early bail-out on time-out is moved to the point where it is detected. Previously on timeout and crash we also printed out the step number. Clusterfuzz doesn't parse this, it was only for statistical purposes, and the latest version of the experimental workbench only parses crashes and timeouts, not the step in which they happened. Hence, this CL removes those step numbers. Except the change described in the last paragraph, this CL doesn't intend to change behavior. No-Try: true Bug: chromium:1100114 Change-Id: Ie8c18f183e4fc538577f3eb49aaf6df1acd1e4e1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270547Reviewed-by:
Liviu Rau <liviurau@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#68576}
-
Camillo Bruni authored
This slows down promise benchmarks since we process all unhandled promises. Bug: vu:1099632 Change-Id: I2188a2842ec0a69ca93e5d406f10371ceff60f9b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270235Reviewed-by:
Michael Stanton <mvstanton@chromium.org> Commit-Queue: Camillo Bruni <cbruni@chromium.org> Cr-Commit-Position: refs/heads/master@{#68575}
-
Jakob Kummerow authored
The per-module caches for subtype relations and type equivalences are accessed from several background compile jobs, so these accesses must be guarded by a lock. This issue was found by our TSan bots and caused the following revert: https://chromium-review.googlesource.com/c/v8/v8/+/2270734 Bug: v8:7748 Change-Id: I0322972f8f72ca8aff3538bf3f78d4329e5f3a44 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2272564 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Cr-Commit-Position: refs/heads/master@{#68574}
-
Simon Que authored
This sets up a relative path symlink to the XCode sysroot. Bug: chromium:1100006 Change-Id: I04bd8ff5158f6e00a91391e6a49530cf1a46f6eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2269452Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#68573}
-
Manos Koukoutos authored
Drive-by: Fix ref.is_null calling is_reference_type to typecheck its argument (which would also allow rtts). Bug: v8:7748 Change-Id: I2ad01d0f70ac15d37ac4cc344bd0280a7ca08073 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264094 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#68572}
-
Nico Weber authored
Does step 5 of the linked bug. Bug: chromium:1098923 Change-Id: I590cbaddb803f6343a61f7b49f7b8a4cb9773220 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270704 Auto-Submit: Nico Weber <thakis@chromium.org> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#68571}
-
Camillo Bruni authored
This adds a simple test runner that prints a line for every test with the appropriate status prefix: PASS, FAIL, CRASH or TIMEOUT Change-Id: Ic1ba78667c38cd4392af027bb6cb671b274680b7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264098Reviewed-by:
-
Zhao Jiazhong authored
Port 2332ebd8 https://crrev.com/c/2264099 Original Commit Message: - Add a separate function to load return slots, instead of encoding this in the offset, - Add fast path for single return. Change-Id: I065c35b95dbc6546387ea54d298bb5765bc342cd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2269456Reviewed-by:
-
Nico Weber authored
Bug: chromium:1098899 Change-Id: I3ff79c00063f7da36b141a3a7b0d2daa71c9801a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270705 Commit-Queue: Peter Marshall <petermarshall@chromium.org> Reviewed-by:
Peter Marshall <petermarshall@chromium.org> Auto-Submit: Nico Weber <thakis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68568}
-
- 26 Jun, 2020 14 commits
-
-
Shu-yu Guo authored
This reverts commit 04ce88ea. Reason for revert: TSAN failure: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/32135 Original change's description: > [wasm-gc] Implement rtt.sub > > RTTs are internally represented as Maps. To store supertype information, > this patch introduces a WasmTypeInfo object, which is installed on Wasm > objects' Maps and points at both the off-heap type information and the > parent RTT. > In this patch, rtt.sub always creates a fresh RTT. The canonicalization > that the proposal requires will be implemented later. > > Bug: v8:7748 > Change-Id: I8286dd11f520966155cd95c2bd844ec34fccd131 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260566 > Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68564} TBR=ulan@chromium.org,jkummerow@chromium.org,tebbi@chromium.org Change-Id: I311732e1ced4de7a58b87d4a9b6056e0d62aa986 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:7748 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270734Reviewed-by:
Shu-yu Guo <syg@chromium.org> Commit-Queue: Shu-yu Guo <syg@chromium.org> Cr-Commit-Position: refs/heads/master@{#68567}
-
Milad Farazmand authored
Test and Instruction Selection changes are not included and must be added when opcode is added to SIMD proposal. Bug: v8:10583 Change-Id: I140d3477d4f3281b24974090c25807eb86af757f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2261162 Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Reviewed-by:
Zhi An Ng <zhin@chromium.org> Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#68566}
-
Milad Farazmand authored
Change-Id: I1f323ecb531880feb49cb70797b8f39ad863a75d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2269841Reviewed-by:
-
Jakob Kummerow authored
RTTs are internally represented as Maps. To store supertype information, this patch introduces a WasmTypeInfo object, which is installed on Wasm objects' Maps and points at both the off-heap type information and the parent RTT. In this patch, rtt.sub always creates a fresh RTT. The canonicalization that the proposal requires will be implemented later. Bug: v8:7748 Change-Id: I8286dd11f520966155cd95c2bd844ec34fccd131 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2260566 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#68564}
-
Milad Farazmand authored
Change-Id: I663da3357f6e88848048ec42832fe7017d563ac4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264952Reviewed-by:
-
Michael Achenbach authored
TBR=mslekova@chromium.org No-Try: true Bug: v8:10647 Change-Id: I177abffb3286703df110f1875c70ac1120d07595 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270541Reviewed-by:
-
Michael Achenbach authored
Bug: chromium:1099623 Change-Id: Icbb6b0ebcc10628fafbef57cc6d1af7861e408f4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270170Reviewed-by:
-
Benedikt Meurer authored
The `Debugger.getScriptSource()` and `Debugger.getWasmBytecode()` methods in the CDP return Wasm wire bytes as protocol::Binary, which is send as Base64-encoded JSON string in the communication to the DevTools front-end, and hence leads to either crashing the renderer that is being debugged or the renderer that's running the front-end if we allow arbitrarily huge Wasm byte sequences here. This CL introduces a limit, based on the maximum allowed string length, to avoid the crash and instead signal a proper error to the DevTools front-end. Bug: chromium:1099680 Change-Id: I356d617301d17a4012f7f845773cf14e6ad1e4a7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270174 Commit-Queue: Benedikt Meurer <bmeurer@chromium.org> Commit-Queue: Yang Guo <yangguo@chromium.org> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Cr-Commit-Position: refs/heads/master@{#68560}
-
Manos Koukoutos authored
Motivation: The immediate-argument classes defined in function-body-decoder.h were often adding an offset to the provided pc. This was inconsistent, bug-prone, and counterintuitive. This CL imposes that all immediates are passed as pc the start of the immediate argument they are parsing. Some other smaller inconsistencies are fixed as well. Changes: src/wasm/: - Enforce that all Immediates are passed the pc at the start of the argument they are parsing. Adapt all call sites. - Remove unneeded offset arguments from two SIMD related immediates. - Add a pc argument to all Validate functions for immediates instead of using the Decoder's current pc. - Remove the (unused) pc argument from all Complete functions for immediates. - Introduce Validate() for BranchOnExceptionImmediate. - In WasmDecoder::Decode(), make sure len is updated before breaking out of the loop in case of a Validate() failure. - Change the default prefix_len of DecodeLoadMem/DecodeStoreMem to 1. wasm-interpreter.cc: - Change the default prefix_len of ExecuteLoad/Store to 1. - Adapt offsets in calls to Immediates. - Remove redundant opcode_length argument from ExecuteSimdOp, use len in its place. function-body-decoder-unittest.cc - Adapt offsets in calls to Immediates. - Introduce and use EXPECT_OK, as is done in other tests. Change-Id: I534606c0e238af309804d4a7c8cec75b1e49c6ad Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2267381 Commit-Queue: Manos Koukoutos <manoskouk@chromium.org> Reviewed-by:
-
Andreas Haas authored
R=clemensb@chromium.org Bug: v8:10108 Change-Id: I44c03a7c39cca8f35e4221c659f918e109d85353 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270166 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Clemens Backes authored
It turns out that Liftoff often needs to know the size of a value in bytes. Currently we are loading the size_log_2 from an array and then performing a shift by that amount. We can slightly speed this up by just loading the correct value directly. Drive-by: Use {int8_t} for the internal array, since all values will easily fit in that range. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: I1b832ba404ff9913e2272d332f312b371b6ce3d4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2267302Reviewed-by:Thibaud Michaud <thibaudm@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#68557}
-
Michael Achenbach authored
Bug: chromium:1099623 Change-Id: I88ab0cec0ba505dcfc77d2f5eb271321633ca3be Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2270165Reviewed-by:
-
Santiago Aboy Solanes authored
We would like that to make sure every time we read map's prototype's map we read the same one. CL created after the discussion on https://chromium-review.googlesource.com/c/v8/v8/+/2210233. Bug: v8:7790 Change-Id: I4b6ffe733cf0b011b1bd1a3620ae8f1f35fa5c87 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264101 Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68555}
-
Clemens Backes authored
Each single branch in the switch was push a new value on the operand stack, but the code for that was not shared. This CL refactors this such that we only allocate once, and then modify the new slot as needed. This makes the generated code a lot smaller (771 bytes instead of 1052 bytes on x64), and hopefully also faster. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: I65cd5b7d91f881b4c236414d39f1dfd54e200b97 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2266533 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
- 25 Jun, 2020 16 commits
-
-
Ng Zhi An authored
Prototype f64x2.ceil on ARM for both ARM v7 and ARM v8. ARM v8 has support for vrintp, and for ARM v7 we fallback to runtime. Since ARM v8 uses vrintp, which is the same instruction used for Float64RoundUp (scalar), wasm-compiler reuses the Float64RoundUp check. Bug: v8:10553 Change-Id: I5841c6a06f260debe8ae90d331bdcc2a0fa3278c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2258813Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#68553}
-
Andreas Haas authored
This is a reland of f7a1932e There was a wpt test in Chrome that expected the incorrect behavior. I disable the test in https://crrev.com/c/2264418 so that we can land the fix here. Original change's description: > [wasm] Re-exported globals preserve their identity > > V8 fails a recently added spec test that when an imported global get > re-exported, it should preserve its identity. This CL fixes the behavior > in V8. > > Drive-by change: fix the object printer of globals: a global which > stores a reference type only has a tagged buffer, a global which stores > a value type only has an untagged buffer. > > R=clemensb@chromium.org > > Bug: v8:10556 > Change-Id: I949d147fe4395610cfec6cf60082e1faecb23036 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235702 > Commit-Queue: Andreas Haas <ahaas@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Cr-Commit-Position: refs/heads/master@{#68513} Bug: v8:10556 Change-Id: I8e1b08fc9f72dde166cba167e6e320e714796769 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264097Reviewed-by:
-
Thibaud Michaud authored
The current code for AssignRegisterOnReload starts the search at the first interval instead of relying on the cached {current_interval_}, which seems to be a main cause for slow compile time in the linked issue's test case. Moreover, it does not take into account live range holes of the current range. This change uses FirstIntersection instead which already handles both issues. Since inactive ranges are sorted by their next start, we can also break early from the loop. R=sigurds@chromium.org Bug: v8:10533 Change-Id: I454df95376011462ce22e850a1c143d523b68538 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2263152 Commit-Queue: Thibaud Michaud <thibaudm@chromium.org> Reviewed-by:Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#68551}
-
Ng Zhi An authored
This implements I32x4DotI16x8S for arm. Bug: v8:10583 Change-Id: I4541f4f5bc7daba03c6ab2040589893c8ef571bc Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2230787Reviewed-by:
-
Ng Zhi An authored
Bitmask requires wasm_simd_post_mvp because it was merged into SIMD proposal after 84 cut, which Origin Trial starts. For now, bitmask is the only instruction that requires this flag to be set, and no other post mvp instructions are included in the fuzzer. We should revert this change (and also move bitmask out of the flag) after this OT is over. Bug: chromium:1098666 Change-Id: I7d45c805aaa18bfc1a5180e70b912d5f17d4a31d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264628Reviewed-by:
-
Clemens Backes authored
Similar tests are already skipped on tsan, using the same bug to also skip this test. Note that it's a slightly different test, but based on the same "worker-ping-test.js". TBR=ahaas@chromium.org Bug: v8:9506 Change-Id: Ie8d0aab5b1fd3ae6c77a65fa04ac4772b2836a1c No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2267301Reviewed-by:
-
Clemens Backes authored
Add an experimental flag to allow modules up to a size slightly below 2GB, to make sure that we don't run into integer overflows. Modules this large are not tested at all currently, hence the explicit "experimental" in the flag name. Drive-by: Fix one comparison to use ">" instead of ">=". R=ahaas@chromium.org CC=bmeurer@chromium.org Bug: v8:10642 Change-Id: I91cfc290c262b9b81750e3c8af5358c1cd2572b1 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2266535Reviewed-by:
-
Milad Farazmand authored
Port 2332ebd8 Original Commit Message: - Add a separate function to load return slots, instead of encoding this in the offset, - Add fast path for single return. R=thibaudm@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Ia302772478b58fd25ee53a18e6ee03ac4b2ea9f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2267477Reviewed-by:
-
Ulan Degenbaev authored
It will be used in a Finch experiment to evaluate if icache flushing helps with crashes on certain CPUs. Bug: chromium:889460 Change-Id: I1218ce93db001833e29fdeca8fde3e863e26dfdd Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2267297Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#68545}
-
Clemens Backes authored
The immediate itself is just the index, and the local type can easily be looked up in every environment where the immediate is used. Hence remove that field. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: If3176fa4880a75bdc475ec61dea60e08001220f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2266532 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Alex Turner authored
This retrieves script name directly from StackFrameBase, bypassing building of StackFrameInfo if one hasn't already been initialized, thus avoiding computation of expensive properties that are not required. This matches current behavior of GetScriptNameOrSourceURL() and is a workaround until a dedicated API is available. Bug: chromium:1098530 Change-Id: I181dc7feeebaf2f45758bbd29be24ab036e44b19 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2261736Reviewed-by:
Simon Zünd <szuend@chromium.org> Commit-Queue: Alex Turner <alexmt@chromium.org> Cr-Commit-Position: refs/heads/master@{#68543}
-
Andreas Haas authored
The BigInt proposal got to stage 4 and integrated into the main spec. Therefore the proposal tests are unnecessary and will be outdated soon. R=thibaudm@chromium.org Change-Id: I149de015f098a89333dd907bf5a4d18a36086c2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264095Reviewed-by:
-
Clemens Backes authored
Local type information was stored in the {WasmFullDecoder}, and a pointer to that vector was handed to {WasmDecoder}. Since {WasmFullDecoder} inherits from {WasmDecoder}, we can just move the vector to the {WasmDecoder} class, and save an indirection and an unnecessary nullptr check. Drive-by: Rename {GetLocalType} to {local_type}, since it's a simple accessor. Drive-by 2: Move fields of {WasmDecoder} to the end of the class, as mandated in the style guide. Drive-by 3: Rename some locals in the 'let' decoding to make the meaning more clear. R=thibaudm@chromium.org Bug: v8:10576 Change-Id: I6ab9831f0c1955e47562e84c5fbf15807439b024 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2264360Reviewed-by: -
Marja Hölttä authored
Design doc: https://docs.google.com/document/d/1BU-Zyco8YPP2Ra0Y3eVZ_BllzpUkJaJhmVmmnGD44Yc/edit#heading=h.mmdxlkic7kqd Bug: v8:10239 Change-Id: Ie1b953c8242e32a0447440aaae7c2ed377c97511 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259933 Commit-Queue: Marja Hölttä <marja@chromium.org> Reviewed-by:
Michael Lippautz <mlippautz@chromium.org> Reviewed-by:
-
Lutz Vahl authored
Change-Id: Ic302912d11ada06a1ce13668df85b9e582e651d5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2266737Reviewed-by:
Lutz Vahl <vahl@chromium.org> Reviewed-by:
Michael Hablich <hablich@chromium.org> Commit-Queue: Lutz Vahl <vahl@chromium.org> Cr-Commit-Position: refs/heads/master@{#68539}
-
Jakob Gruber authored
... and extend JS node wrapper functionality. Node wrappers now have accessors for value inputs and context/control/effect/frame-state inputs. Accessors are typed, although types aren't very meaningful so far (in current examples we only distinguish between Object/HeapObject). The following node kinds now take an additional feedback vector input, and use the new node wrapper functionality above: - CloneObject - CreateLiteralArray - CreateLiteralObject - CreateLiteralRegExp - GetIterator - GetTemplateObject - HasProperty - LoadProperty - StoreProperty Bug: v8:8888 Change-Id: I1eb33c078b11725a72ec983bbaa848b9a3c7b0d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2259936 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
