Commits · 1b88d4e93d9faaed80c31314b03013103e7fa975 · Linshizhi / V8

16 Sep, 2021 3 commits

Floods correctness fuzzers (e.g. https://crbug.com/1249941 ) · 1b88d4e9

Patrick Thier authored Sep 16, 2021

Revert "[x64][ia32] Activate Argument Count Consistency"

This reverts commit b7355768.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [x64][ia32] Activate Argument Count Consistency
>
> Activate argument count consistency (receiver is always included in
> JS argument count) for x64 and ia32.
>
> Bug: v8:11112
> Change-Id: If60000b6566846c84f1042473d25d79bf5c86a9d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160198
> Auto-Submit: Patrick Thier <pthier@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76838}

Bug: v8:11112
Change-Id: I98e4127dcedaf7e19751ac29175700817b1b2202
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162607Reviewed-by: Patrick Thier <pthier@chromium.org>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76860}

1b88d4e9

Reland "[test] Avoid disabling of RCS during runtime" · b8146576

Dominik Inführ authored Sep 15, 2021

This is a reland of 11045926

The first version of this CL uncovered a TSAN failure when not disabling
RCS anymore. The problem was that a background thread was still updating
RCS counters, while the main thread already dumped those values during
tear down. This CL fixes this by dumping counters only after all
background threads are stopped.

Original change's description:
> [test] Avoid disabling of RCS during runtime
>
> Test was flaky since disabling of RCS at runtime is unsafe. Some code
> (e.g. TRACE_GC) is run only in case RCS is enabled and such code paths
> might also DCHECK that RCS is enabled.
> A background thread (sweeping in this case) could've already
> entered such a code path right before RCS is disabled. In this case the
> guard at the entry still saw that RCS is enabled but subsequent DCHECKs
> that ensure that RCS is enabled might fail.
>
> We could fix this by completing the sweeper tasks before disabling RCS
> but there might be other similar tasks which might be run at that point
> in the future (e.g. memory unmapper).
>
> Disabling the flag doesn't even seem to be needed for the initial
> regression test, so it seems simpler to just not disable RCS anymore.
>
> Bug: v8:12026
> Change-Id: I878f7dd9a7a4abb6a501f7a7651a1240ef2082a6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162043
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76845}

Bug: v8:12026, v8:12234
Change-Id: I5cb577051d188d17b02ca7da79a3f1d9aa646cae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162050
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76859}

b8146576

Update V8 DEPS. · 0fe20577

v8-ci-autoroll-builder authored Sep 16, 2021

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/1384630..590c648

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/287ed7c..5307522

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/cb29f9c..0faacf9

Rolling v8/tools/luci-go: git_revision:dc21267f89df3981e809fe9566591d6916ae758b..git_revision:028cd41e0f4b2bec99d94c780caf2f978e09b182

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: Ie1336651a1a87dfebd3d4597284a2c4c636de398
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162251Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76858}

0fe20577

15 Sep, 2021 25 commits

Enable inlining of JS->Wasm calls by default · e0974192

Paolo Severini authored Sep 15, 2021

Bug: v8:11092
Change-Id: I8d0dc34b28f0f2627069b7e4cbaf3f2d0ba49869
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163276Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Paolo Severini <paolosev@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#76857}

e0974192

Verify mac-arm64 wheels for v8/.vpython spec. · eb1d0ee7

Brian Ryner authored Sep 15, 2021

vpython's default verification does not yet include this platform,
so this allows us to ensure that v8 vpython specs stay mac-arm64
compatible.

Bug: chromium:1235841
Change-Id: I0cfe369f07a786a0606f7dac13b581820c060445
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163003
Commit-Queue: Brian Ryner <bryner@google.com>
Auto-Submit: Brian Ryner <bryner@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76856}

eb1d0ee7

[ia32][x64] Reorganize macro-assembler functions and move to shared · 2d9dc54d

Ng Zhi An authored Sep 14, 2021

Group all the SIMD (SSE/AVX) functions in macro-assembler-x64 together,
and move Ucomisd/Ucomiss to shared-macro-assembler.

Bug: v8:11589
Change-Id: Ia2246e816615aa8e143e94a1064838b2c314d8f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160698Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76855}

2d9dc54d

[disasm][x64] Remove unnecessary initialization code · f67ee467

Ng Zhi An authored Sep 14, 2021

These tests don't depend on initializing VM (for Context) or even an
isolate, so we can remove the setup code, and use UNINITIALIZED_TEST
(will not even set up an isolate).

Bug: v8:12207
Change-Id: I4b509b95cc8272db22892c32b53464678403dc7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160748Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76854}

f67ee467

[log] Fix off-thread use of string.Get · be526b1e

Leszek Swirski authored Sep 15, 2021

Fixed: v8:12233
Change-Id: If23330e2edd6f4e2352800c145fc3ad5a360be5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162055
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76853}

be526b1e

Revert "[wasm][externref] Support default value for the table.set" · 46540df8

Clemens Backes authored Sep 15, 2021

This reverts commit 6b578980.

Reason for revert: Fails layout tests: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Blink%20Linux/13751/overview

Original change's description:
> [wasm][externref] Support default value for the table.set
>
> WebAssembly.Table.set allows a default value instead of the second
> parameter, which was not supported by V8 so far.
>
> R=thibaudm@chromium.org
>
> Bug: v8:7581
> Change-Id: I417790722b1cb4f854cd0056ecb8377c330c45fa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141574
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76846}

Bug: v8:7581
Change-Id: I83d9be59c66ece3184b5708e5b8a3b401e4938ed
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3163257
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76852}

46540df8

Revert "[arm64][wasm-simd] Use Cm(0) for integer comparison with 0" · 9068522b

Clemens Backes authored Sep 15, 2021

This reverts commit 16df1dfa.

Reason for revert: Multiple failures, e.g. https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux/43844/overview

Original change's description:
> [arm64][wasm-simd] Use Cm(0) for integer comparison with 0
>
> Use an immediate zero operand for integer comparison when possible. This
> gives ~1% runtime performance improvement in some benchmarks on Neoverse
> N1.
>
> Change-Id: I727a8104f8e6ca3d122d6b5b8b3d38d7bdd76c47
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158327
> Reviewed-by: Zhi An Ng <zhin@chromium.org>
> Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
> Cr-Commit-Position: refs/heads/main@{#76847}

Tbr: zhin@chromium.org
Change-Id: I7039106d885c59aecad24dd8dda4d151b8e1f022
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162053Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Owners-Override: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76851}

9068522b

[wasm][test] CFI also prints UBSan errors · e366c4b7

Clemens Backes authored Sep 15, 2021

Instead of trying to detect which sanitizer we run on, just allow the
output that any sanitizer would produce.
Note that the regular expression syntax is pretty limited, so we cannot
express this as a single regex.

This removes the single use of {V8_USE_UNDEFINED_BEHAVIOR_SANITIZER}
again, but for completeness I leave it in {macros.h} for now.

TBR=jkummerow@chromium.org

Bug: v8:12226
Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_cfi_rel_ng
Change-Id: I37a6d15ebb9fdafbdbee0158ba6c540582c31301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162046Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76850}

e366c4b7

[wasm] Change type() for js-api objects · 0af529a3

Andreas Haas authored Sep 15, 2021

The type() function is now part of the js-api object and not part of the
constructor anymore, see
https://github.com/WebAssembly/js-types/blob/master/document/js-api/index.bs#L971

This fixes a failing spec test, but there is a bug in the test itself,
so it cannot be enabled yet.

R=thibaudm@chromium.org

Bug: v8:12227, v8:7742
Change-Id: I41e3752ad2e9af85c7197617f573dd0dc1a7a77f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162036Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76849}

0af529a3

Revert "[test] Avoid disabling of RCS during runtime" · 0feba98a

Dominik Inführ authored Sep 15, 2021

This reverts commit 11045926.

Reason for revert: Uncovered TSAN failure

Original change's description:
> [test] Avoid disabling of RCS during runtime
>
> Test was flaky since disabling of RCS at runtime is unsafe. Some code
> (e.g. TRACE_GC) is run only in case RCS is enabled and such code paths
> might also DCHECK that RCS is enabled.
> A background thread (sweeping in this case) could've already
> entered such a code path right before RCS is disabled. In this case the
> guard at the entry still saw that RCS is enabled but subsequent DCHECKs
> that ensure that RCS is enabled might fail.
>
> We could fix this by completing the sweeper tasks before disabling RCS
> but there might be other similar tasks which might be run at that point
> in the future (e.g. memory unmapper).
>
> Disabling the flag doesn't even seem to be needed for the initial
> regression test, so it seems simpler to just not disable RCS anymore.
>
> Bug: v8:12026
> Change-Id: I878f7dd9a7a4abb6a501f7a7651a1240ef2082a6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162043
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76845}

Bug: v8:12026
Change-Id: I154817fc5ddeab68c69c745d08f3d77c48896dc4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162049
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76848}

0feba98a

[arm64][wasm-simd] Use Cm(0) for integer comparison with 0 · 16df1dfa

Ilja Iskovs authored Sep 13, 2021

Use an immediate zero operand for integer comparison when possible. This
gives ~1% runtime performance improvement in some benchmarks on Neoverse
N1.

Change-Id: I727a8104f8e6ca3d122d6b5b8b3d38d7bdd76c47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158327Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/main@{#76847}

16df1dfa

[wasm][externref] Support default value for the table.set · 6b578980

Andreas Haas authored Sep 15, 2021

WebAssembly.Table.set allows a default value instead of the second
parameter, which was not supported by V8 so far.

R=thibaudm@chromium.org

Bug: v8:7581
Change-Id: I417790722b1cb4f854cd0056ecb8377c330c45fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3141574Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76846}

6b578980

[test] Avoid disabling of RCS during runtime · 11045926

Dominik Inführ authored Sep 15, 2021

Test was flaky since disabling of RCS at runtime is unsafe. Some code
(e.g. TRACE_GC) is run only in case RCS is enabled and such code paths
might also DCHECK that RCS is enabled.
A background thread (sweeping in this case) could've already
entered such a code path right before RCS is disabled. In this case the
guard at the entry still saw that RCS is enabled but subsequent DCHECKs
that ensure that RCS is enabled might fail.

We could fix this by completing the sweeper tasks before disabling RCS
but there might be other similar tasks which might be run at that point
in the future (e.g. memory unmapper).

Disabling the flag doesn't even seem to be needed for the initial
regression test, so it seems simpler to just not disable RCS anymore.

Bug: v8:12026
Change-Id: I878f7dd9a7a4abb6a501f7a7651a1240ef2082a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162043Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76845}

11045926

[wasm-gc] Implement nominal types · bc3b9332

Jakob Kummerow authored Sep 15, 2021

Per https://github.com/WebAssembly/gc/issues/234, this implements
"nominal" type definitions with explicit supertypes, and statically
typed RTT-less instructions for allocation and testing/casting.
This should be fully backwards compatible with existing Wasm modules.

Spec: https://bit.ly/3cWcm6Q ("version 4")

Bug: v8:7748
Change-Id: Id5a1399b368fdfad22036cfd66f1bef593e640f7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144916
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76844}

bc3b9332

[system-analyzer] Fix zoom · 62acef54

Sathya Gunasekaran authored Sep 15, 2021

Don't render if the timeline track doesn't have any data.

Change-Id: Ib0638ce18391f14212d3a5385d90877cf0392c5f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162042Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76843}

62acef54

[bigint] Max parts when parsing: fix off-by-one · 45fc1486

Jakob Kummerow authored Sep 14, 2021

The very last part skipped the max_digits check, and earlier parts
forgot to account for that in their check. The reason why the last
part originally got special treatment no longer applies, so we can
fix this bug by removing the special case, simplifying the overall
logic.

Fixed: chromium:1248972
Change-Id: I1857dd8b63c00f9bdfb9237f2ea3621ecc1339e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160522
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76842}

45fc1486

Reland^2 "[wasm][test] Fix test expectation" · 65998631

Clemens Backes authored Sep 15, 2021

This is a reland of a55c82d4, now also
fixed for UBSan.

Original change's description:
> Reland "[wasm][test] Fix test expectation"
>
> This is a reland of 6f9cde1e, with
> special handling for MSan as well.
>
> Original change's description:
> > [wasm][test] Fix test expectation
> >
> > In the mprotect case, there could be one or multiple succeeding writes
> > until we finally crash. Thus do not check that we never successfully
> > write, but just check that the last printed statement is *before* a
> > write.
> >
> > R=jkummerow@chromium.org
> >
> > Bug: v8:12226
> > Change-Id: I04209691a9320a9b29dd0ec364539e062ad2dc03
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160343
> > Commit-Queue: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#76829}
>
> Bug: v8:12226
> Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
> Change-Id: I85ca98be43fc1d933d39a4602194e1771c33007c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162037
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76839}

Bug: v8:12226
Change-Id: I911295b73a385c899a993a729db3a499e58b7cb6
Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162041Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76841}

65998631

Revert "Reland "[wasm][test] Fix test expectation"" · 2872775f

Clemens Backes authored Sep 15, 2021

This reverts commit a55c82d4.

Reason for revert: Fails on UBSan: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20cfi/31712/overview

Original change's description:
> Reland "[wasm][test] Fix test expectation"
>
> This is a reland of 6f9cde1e, with
> special handling for MSan as well.
>
> Original change's description:
> > [wasm][test] Fix test expectation
> >
> > In the mprotect case, there could be one or multiple succeeding writes
> > until we finally crash. Thus do not check that we never successfully
> > write, but just check that the last printed statement is *before* a
> > write.
> >
> > R=jkummerow@chromium.org
> >
> > Bug: v8:12226
> > Change-Id: I04209691a9320a9b29dd0ec364539e062ad2dc03
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160343
> > Commit-Queue: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#76829}
>
> Bug: v8:12226
> Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
> Change-Id: I85ca98be43fc1d933d39a4602194e1771c33007c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162037
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76839}

Bug: v8:12226
Change-Id: Ifb0f4b7e87c9c54271f7f3de29b1f1fc6e867f3f
Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162040
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76840}

2872775f

Reland "[wasm][test] Fix test expectation" · a55c82d4

Clemens Backes authored Sep 15, 2021

This is a reland of 6f9cde1e, with
special handling for MSan as well.

Original change's description:
> [wasm][test] Fix test expectation
>
> In the mprotect case, there could be one or multiple succeeding writes
> until we finally crash. Thus do not check that we never successfully
> write, but just check that the last printed statement is *before* a
> write.
>
> R=jkummerow@chromium.org
>
> Bug: v8:12226
> Change-Id: I04209691a9320a9b29dd0ec364539e062ad2dc03
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160343
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76829}

Bug: v8:12226
Cq-Include-Trybots: luci.v8.try:v8_linux64_msan_rel_ng
Change-Id: I85ca98be43fc1d933d39a4602194e1771c33007c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3162037Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76839}

a55c82d4

[x64][ia32] Activate Argument Count Consistency · b7355768

Patrick Thier authored Sep 15, 2021

Activate argument count consistency (receiver is always included in
JS argument count) for x64 and ia32.

Bug: v8:11112
Change-Id: If60000b6566846c84f1042473d25d79bf5c86a9d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160198
Auto-Submit: Patrick Thier <pthier@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76838}

b7355768

[string] Add PtrCage for ExternalString::GetChars · 012af69b

Leszek Swirski authored Sep 15, 2021

Change-Id: I14400c0efea88b4bbb40aa2fbe9527dc9c67d3fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160340
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76837}

012af69b

[torque] Fix argument count consistency for cross-compilation · d345b25a

Patrick Thier authored Sep 14, 2021

Don't evaluate the (currently) arch dependent constants
kJSArgcIncludesReceiver and kJSArgcReceiverSlots at Torque build time.

Bug: v8:11112
Change-Id: If955f7f2c02bfd88c791797a8ef3f94184d4a1fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160519Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Patrick Thier <pthier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76836}

d345b25a

[riscv64] Implement RVV float · 9d0b3cd8

Lu Yahan authored Sep 14, 2021

Bug: v8:11976
Change-Id: I19e1ef43f073c8155dbc2890de0f331782eb7aac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3156588
Commit-Queue: Ji Qiu <qiuji@iscas.ac.cn>
Reviewed-by: Ji Qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#76835}

9d0b3cd8

[compiler] Avoid raw pointers in JSFunctionData::Cache · 23b4cc8e

Georg Neis authored Sep 14, 2021

The function used raw pointers but also created Refs, which can cause
GC. Thus the code isn't safe (this has already lead to crashes in an
older version of the code).

Drive-by: Remove unnecessary native_context field (get the native
context from the context instead).

Bug: v8:12205, v8:7790
Change-Id: I4868323f48fc411e8462b7824fde3d8715b55abc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160520
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76834}

23b4cc8e

Update V8 DEPS. · e0c280f3

v8-ci-autoroll-builder authored Sep 15, 2021

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/f16814b..1384630

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/53aef64..6b072fa

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/984ce94..287ed7c

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/955c7f8..159c9ad

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/e74330f..83b09bd

Rolling v8/tools/luci-go: git_revision:4a0f3da2840eaa5341470174b57047313e074ecd..git_revision:dc21267f89df3981e809fe9566591d6916ae758b

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: I1a08e93ba5d136d01a02754ddf98f6d21f50d014
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3159555Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76833}

e0c280f3

14 Sep, 2021 12 commits

[x64][ia32] Share pextrd code · 4773be80

Ng Zhi An authored Sep 14, 2021

Share the AVX and SSE4_1 code for Pextrd but delegate to base class for
the pre-SSE4.1 code (via CRTP).

Bug: v8:11589
Change-Id: Ic7709ccf7d9029829583c9287c1b0842ff11b799
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160332Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76832}

4773be80

Revert "[wasm][test] Fix test expectation" · 99c17a8b

Zhi An Ng authored Sep 14, 2021

This reverts commit 6f9cde1e.

Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/40332/overview

Original change's description:
> [wasm][test] Fix test expectation
>
> In the mprotect case, there could be one or multiple succeeding writes
> until we finally crash. Thus do not check that we never successfully
> write, but just check that the last printed statement is *before* a
> write.
>
> R=jkummerow@chromium.org
>
> Bug: v8:12226
> Change-Id: I04209691a9320a9b29dd0ec364539e062ad2dc03
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160343
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76829}

Bug: v8:12226
Change-Id: I11ed00268db8dae5c773ed14fda9a343566f910a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3161333
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76831}

99c17a8b

PPC: Check if rb is valid when creating MemOperand · bd9762dd

Milad Fa authored Sep 14, 2021

r0 is used to indicate a value of "0" in which case
only the ra() value gets used.

Change-Id: I5ea5c51c1a652d042137c2d940818b93dac52492
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3159668Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#76830}

bd9762dd

[wasm][test] Fix test expectation · 6f9cde1e

Clemens Backes authored Sep 14, 2021

In the mprotect case, there could be one or multiple succeeding writes
until we finally crash. Thus do not check that we never successfully
write, but just check that the last printed statement is *before* a
write.

R=jkummerow@chromium.org

Bug: v8:12226
Change-Id: I04209691a9320a9b29dd0ec364539e062ad2dc03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160343
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76829}

6f9cde1e

[x64] Add new disassembly tests that verifies output · ca817b0b

Ng Zhi An authored Sep 09, 2021

Currently the main test for disassembly just checks that there is
disassembly support for a assembler function, it doesn't verify the
output is as expected.

Add a new test case that checks the disassembly output against an
expected string.

Right now we only check a single instruction, subsequent patches will
move more instructions into this test case.

Bug: v8:12207
Change-Id: Id183bb2fd625713d82239363ebce3f4c77155acd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3150145Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76828}

ca817b0b

[x64][ia32] Share Pinsrd code · fba61177

Ng Zhi An authored Sep 14, 2021

We need to support pre-SSE4.1 for Pinsrd. Share the AVX and SSE4_1 code,
but delegate to base class for the pre-SSE4.1 code (via CRTP).

Bug: v8:11589
Change-Id: I7563670174e44d8061182aefc311593d9578b0e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3159183Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76827}

fba61177

[compiler] Load ops should not increase effect level · 66cbbb7a

Ng Zhi An authored Sep 13, 2021

The idea of effect level was introduced in
https://codereview.chromium.org/1706763002. This change was trying to
optimize sequences like:

  x = load o, i
  cmp 1, x

to use a memory operand:

  cmp 1, [o+i]

However, the load can be invalidated, like so:

  x = load o, i
  store o, i, v
  cmp 1, x

Then, selecting a memory operand for cmp would be incorrect (it should
be using the loaded value x, not the store valued v:

  store o, i, v
  cmp 1, [o+i]  # uses v, which is wrong, should use x

Effect levels were introduced to mark where levels of potentially
invalidating instructions:

                  effect level
  x = load o, i      0
  store o, i, v      1
  cmp 1, x           1

Then when selecting instructions, CanCover will check to ensure that cmp
and load are on the same level.

ProtectedLoad, and LoadTransforms should not affect the effect levels in
this case, because they don't invalidate any prior loads:

  x = load o, i
  y = protected load o, i
  cmp 1, x

Becomes:

  y = protected load o, i
  cmp 1, [o+i]

Bug: v8:12189
Change-Id: I585b94320def4ba554ae955fa5f8fcc9efd6dafe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158551Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76826}

66cbbb7a

[ia32] Use AVX for f32/f64 min max mod · 8b8e61c0

Ng Zhi An authored Sep 13, 2021

Change them to use macro-assembler functions so they will emit AVX if
supported.

Rename the opcodes since they are no longer SSE specific.

Bug: v8:12148
Change-Id: Iaa2aa54dde9f9b41304394f98b8ed18dbb65715b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3158679Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76825}

8b8e61c0

[Temporal] Preparation Refactor 2 · 17330977

Frank Tang authored Sep 07, 2021

Refactor generic option reading facility also used
by Temporal from intl-objects.* to option-util.*


See
https://tc39.es/proposal-temporal/#sec-getoptionsobject
https://tc39.es/proposal-temporal/#sec-getoptionsobject-deleted
https://tc39.es/ecma402/#sec-getoptionsobject

Bug: v8:11544
Change-Id: I8b27e8fa3515c1287217c2fbe225172fb8f69210
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3122501Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76824}

17330977

[wasm] Add wasm wpt tests to the V8 tests · 3fb2ec7b

Andreas Haas authored Sep 14, 2021

WPT and WebAssembly spec tests are not 100% in sync, which means that
there are aspects of the WebAssembly spec that get only tested by WPT.
Up until now WPT was only executed on the blink side, and failing tests
were just ignored. With this CL we add WPT to the existing wasm spec
test setup, so that we run both the spec tests, and WPT.

Bug: v8:12227
Change-Id: Iccbe696a6d9dd01f8bab1990736f1ed16e0cdf7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160347Reviewed-by: Liviu Rau <liviurau@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76823}

3fb2ec7b

[wasm][test] Fix compile error on iOS · dc07ae76

Clemens Backes authored Sep 14, 2021

Avoid the usage of ASSERT_DEATH_IF_SUPPORTED with a matcher, as that's
not supported if death tests are not supported (e.g. on iOS).

R=jkummerow@chromium.org

Bug: v8:11974
Change-Id: Ieb33ac8605e82fde67bfcd0e81e85ac2d18e9b27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160341Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76822}

dc07ae76

Revert "[Temporal] Part 1 - Skeleton" · f1a5b680

Deepti Gandluri authored Sep 14, 2021

This reverts commit 0adc1410.

Reason for revert: Reverting due to fail on  V8 Linux - noi18n - debug https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket/8836095186331011153/+/u/Check_-_default/function-exist

Original change's description:
> [Temporal] Part 1 - Skeleton
>
> 1. Expose all the functions to empty buildins.
> 2. Wire up basic structure of classes and internal slots.
>
> Design Doc: https://docs.google.com/document/d/1Huu2OUlmveBh4wjgx0D7ouC9O9vSdiZWaRK3OwkQZU0/
>
> This is just a CL to establish a skeleton for Temporal.
> The Temporal is very big. The prototype CL is in
> https://chromium-review.googlesource.com/c/v8/v8/+/2967755
> but too big to be reviewed so I break up the basic structure here first.
>
> Cq-Include-Trybots: luci.v8.try:v8_linux64_bazel
> Bug: v8:11544
> Change-Id: I10d09e3c2530e5b1a6ba60014a2294e138879ff3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3092561
> Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
> Reviewed-by: Shu-yu Guo <syg@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Frank Tang <ftang@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76819}

Bug: v8:11544
Change-Id: I358f671452a986c8e87d1f831ab5eb1550a38441
Cq-Include-Trybots: luci.v8.try:v8_linux64_bazel
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3160467
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Auto-Submit: Deepti Gandluri <gdeepti@chromium.org>
Owners-Override: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76821}

f1a5b680