1. 19 Aug, 2022 12 commits
    • Clemens Backes's avatar
      Revert "Reland "[wasm] Refactor compilation tier computations"" · 384598dc
      Clemens Backes authored
      This reverts commit b3a27f22.
      
      Reason for revert: Fails 'debug-enabled-tier-down-wasm' flakily (https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Win64/48026/overview)
      
      Original change's description:
      > Reland "[wasm] Refactor compilation tier computations"
      >
      > This is a reland of commit e50472d6.
      > In {ApplyCompilationHintToInitialProgress} we would reset the baseline
      > tier to {kNone} if the compilation strategy is {kDefault}, which is
      > wrong. We would not generate code but also not install the lazy stub,
      > so whenever we start executing the code before top-tier is ready we
      > would crash.
      >
      > Original change's description:
      > > [wasm] Refactor compilation tier computations
      > >
      > > The way we initialized the "compilation progress" was pretty convoluted,
      > > with multiple levels of functions being called for initializing every
      > > single slot.
      > >
      > > This CL refactors this to compute one default value for the whole
      > > module, and only modifies those slots that need special handling (e.g.
      > > because of compilation hints, or lazy/eager compilation after
      > > deserialization).
      > >
      > > We also rename "liftoff_functions" to "eager_functions" in the
      > > deserialization path; the idea is that those functions should get
      > > eagerly compiled because we expect them to be needed during execution.
      > > Usually they would be Liftoff-compiled, but it's more consistent to use
      > > the existing logic to choose the baseline tier. In the default
      > > configuration, this will still use Liftoff, but if Liftoff is disabled
      > > we will use TurboFan instead.
      > >
      > > R=jkummerow@chromium.org, ahaas@chromium.org
      > >
      > > Bug: v8:12425
      > > Change-Id: Ie58840b19efd0b1e98f1b02d5f1d4369410ed8e1
      > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829606
      > > Commit-Queue: Clemens Backes <clemensb@chromium.org>
      > > Reviewed-by: Andreas Haas <ahaas@chromium.org>
      > > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > > Cr-Commit-Position: refs/heads/main@{#82521}
      >
      > Bug: v8:12425
      > Change-Id: Ie41e63148bf6bd0e38fc07a3a514f1094d9d26cf
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3838409
      > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > Commit-Queue: Clemens Backes <clemensb@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#82585}
      
      Bug: v8:12425
      Change-Id: Ic86d3f5b0e0603dae62ccead3be052d928209506
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3842208
      Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Auto-Submit: Clemens Backes <clemensb@chromium.org>
      Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Cr-Commit-Position: refs/heads/main@{#82588}
      384598dc
    • Samuel Groß's avatar
      [sandbox] Merge V8_SANDBOXED_POINTERS into V8_ENABLE_SANDBOX · e2bfd44c
      Samuel Groß authored
      Now that V8_SANDBOXED_POINTERS is enabled by default on every platform
      if the sandbox is enabled, it is no longer necessary to have a separate
      option to enable/disable sandboxed pointers.
      
      Bug: chromium:1218005
      Change-Id: I2ab4c7c758010007765a3b0595357ddecfe9f258
      Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840937Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Commit-Queue: Samuel Groß <saelo@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82587}
      e2bfd44c
    • Anton Bikineev's avatar
      cppgc: Reenable pointer compression on M1 · f2f38dee
      Anton Bikineev authored
      Since the overall motionmark regression is minor (<0.5%), we decided to
      get benefits of pointer compression on M1. The CL can also slightly
      regress speedometer2 (~0.3%).
      
      Bug: chromium:1325007
      Change-Id: Ib278f0e82e0ebde563caac79b9f32edfe2d09a53
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840301
      Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
      Auto-Submit: Anton Bikineev <bikineev@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82586}
      f2f38dee
    • Clemens Backes's avatar
      Reland "[wasm] Refactor compilation tier computations" · b3a27f22
      Clemens Backes authored
      This is a reland of commit e50472d6.
      In {ApplyCompilationHintToInitialProgress} we would reset the baseline
      tier to {kNone} if the compilation strategy is {kDefault}, which is
      wrong. We would not generate code but also not install the lazy stub,
      so whenever we start executing the code before top-tier is ready we
      would crash.
      
      Original change's description:
      > [wasm] Refactor compilation tier computations
      >
      > The way we initialized the "compilation progress" was pretty convoluted,
      > with multiple levels of functions being called for initializing every
      > single slot.
      >
      > This CL refactors this to compute one default value for the whole
      > module, and only modifies those slots that need special handling (e.g.
      > because of compilation hints, or lazy/eager compilation after
      > deserialization).
      >
      > We also rename "liftoff_functions" to "eager_functions" in the
      > deserialization path; the idea is that those functions should get
      > eagerly compiled because we expect them to be needed during execution.
      > Usually they would be Liftoff-compiled, but it's more consistent to use
      > the existing logic to choose the baseline tier. In the default
      > configuration, this will still use Liftoff, but if Liftoff is disabled
      > we will use TurboFan instead.
      >
      > R=jkummerow@chromium.org, ahaas@chromium.org
      >
      > Bug: v8:12425
      > Change-Id: Ie58840b19efd0b1e98f1b02d5f1d4369410ed8e1
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3829606
      > Commit-Queue: Clemens Backes <clemensb@chromium.org>
      > Reviewed-by: Andreas Haas <ahaas@chromium.org>
      > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#82521}
      
      Bug: v8:12425
      Change-Id: Ie41e63148bf6bd0e38fc07a3a514f1094d9d26cf
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3838409Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Commit-Queue: Clemens Backes <clemensb@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82585}
      b3a27f22
    • Anton Bikineev's avatar
      cppgc: Avoid fragmentation in NormalPageMemoryRegion · 1d3a1c6f
      Anton Bikineev authored
      NormalPageMemoryRegion is a span of 10 pages, all of which must belong
      to the same space. This requirement imposes a fragmentation issue for virtual space, which is not ideal for the current 2GB cage
      configuration.
      
      The CL fixes this by mixing pages of different spaces inside the same
      NormalPageMemoryRegion. With cage it's actually not necessary anymore
      to have NormalPageMemoryRegion, but we keep it to allow the code to be
      uniform for cage/non-cage configurations.
      
      There is no type confusion across spaces, since pages (even empty) are
      never shared between spaces. In addition, the shared cage puts an
      additional memory constraint on the GC. So, there is no security benefit
      in having NormalPageMemoryRegion assigned to a single space.
      
      Savings in reserved address space:
      cnn:2021: 14%
      facebook_infinite_scroll:2018: 23%
      
      Bug: chromium:1325007, chromium:1352649
      Change-Id: I7b49032d581dd56feb8633734a1f37803e9526c6
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840749Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Commit-Queue: Anton Bikineev <bikineev@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82584}
      1d3a1c6f
    • Samuel Groß's avatar
      [sandbox] Remove V8::InitializeSandbox · 5e07ef10
      Samuel Groß authored
      The function is no longer used in Chromium or V8 and can therefore be
      deleted. This CL also simplifies V8::GetSandboxSizeInBytes, which now no
      longer needs to be able to deal with an uninitialized sandbox.
      
      Bug: v8:10391
      Change-Id: I22d6b0e03de1fd2ba3d38c4e476fca44068b62f9
      Cq-Include-Trybots: luci.v8.try:v8_linux64_heap_sandbox_dbg_ng,v8_linux_arm64_sim_heap_sandbox_dbg_ng
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3769690Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Commit-Queue: Samuel Groß <saelo@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82583}
      5e07ef10
    • Michael Lippautz's avatar
      cppgc: Remove deprecated Trace() method for raw pointers · 543ba554
      Michael Lippautz authored
      Bug: v8:13089
      Change-Id: Ic1c5a596adb822494aff490e04bd23cf84fb53f6
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3840295
      Commit-Queue: Anton Bikineev <bikineev@chromium.org>
      Reviewed-by: 's avatarAnton Bikineev <bikineev@chromium.org>
      Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82582}
      543ba554
    • Dominik Inführ's avatar
      [heap] Remove COMPLETE state from IncrementalMarking · 4e815bd6
      Dominik Inführ authored
      This CL removes the COMPLETE state from incremental marking. Since
      then the only states left were STOPPED and MARKING, we can replace
      the state with an is_running_ boolean field.
      
      The state could change back-and-forth between MARKING and COMPLETE.
      IsMarking() was already also checking for COMPLETE. So most code
      already treated both states the same. IsComplete() now checks whether
      marking is running and a transitive closure was reached already.
      
      IncrementalMarking::Step() didn't process the marking queue when in
      COMPLETE. This should be relatively rare though since it only
      transitioned into COMPLETE when the stack guard was armed and the
      allocation observer ran again before reaching a stack guard check.
      
      Bug: v8:12775
      Change-Id: Ied48d8c512ad3d1b3d2e29393d43b434b5fda8fe
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3835689Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82581}
      4e815bd6
    • Nico Hartmann's avatar
      Revert "[heap] Ensure all old-to-shared slots are recorded" · cb9bf85b
      Nico Hartmann authored
      This reverts commit c3a5c5b1.
      
      Reason for revert: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux64%20-%20shared/21941/overview
      
      Original change's description:
      > [heap] Ensure all old-to-shared slots are recorded
      >
      > This CL adds verification of the old-to-shared remembered set to
      > --verify-heap. During shared GCs client heaps will be scanned for
      > references into the shared heap, this CL will CHECK that every found
      > slot is contained in the old-to-shared remembered set. After this
      > gets a bit more stable, the full heap iteration can be dropped and we
      > can fully rely on the remembered set instead.
      >
      > Bug: v8:11708
      > Change-Id: I0b5c4edfe3271306e4e7af7394472534113e1953
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3792605
      > Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
      > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#82578}
      
      Bug: v8:11708
      Change-Id: I26553d3b06d0e257a3425eeb884ccce57f026bde
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3841567
      Owners-Override: Nico Hartmann <nicohartmann@chromium.org>
      Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
      Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
      Cr-Commit-Position: refs/heads/main@{#82580}
      cb9bf85b
    • Qifan Pan's avatar
      [turbofan] Optimize wasm calls with i64 return · 8624662c
      Qifan Pan authored
      `JSWasmCallData` is replaced with a flag `do_conversion` to indicate if conversions of arguments and returns are needed, which is set as false for inlined js-to-wasm call wrappers.
      
      Bug: v8:9407
      Change-Id: I35244c8fc13d464d48031fb9d7d04ab277646ec5
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3837858Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Commit-Queue: Qifan Pan <panq@google.com>
      Reviewed-by: 's avatarNico Hartmann <nicohartmann@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82579}
      8624662c
    • Dominik Inführ's avatar
      [heap] Ensure all old-to-shared slots are recorded · c3a5c5b1
      Dominik Inführ authored
      This CL adds verification of the old-to-shared remembered set to
      --verify-heap. During shared GCs client heaps will be scanned for
      references into the shared heap, this CL will CHECK that every found
      slot is contained in the old-to-shared remembered set. After this
      gets a bit more stable, the full heap iteration can be dropped and we
      can fully rely on the remembered set instead.
      
      Bug: v8:11708
      Change-Id: I0b5c4edfe3271306e4e7af7394472534113e1953
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3792605Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
      Cr-Commit-Position: refs/heads/main@{#82578}
      c3a5c5b1
    • Lu Yahan's avatar
      Reland "[WATCHLISTS] Add riscv watch" · 546c7b5f
      Lu Yahan authored
      This is a reland of commit 776b9eb9
      
      Original change's description:
      > [WATCHLISTS] Add riscv watch
      >
      > Change-Id: I6e4dc69d6f22d3108ae74552b72bcafc0be3db64
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3793476
      > Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
      > Reviewed-by: Victor Gomes <victorgomes@chromium.org>
      > Cr-Commit-Position: refs/heads/main@{#82092}
      
      Change-Id: I33ff1808de80f03fdfd7c977b29a895c8110bae0
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3835293Reviewed-by: 's avatarVictor Gomes <victorgomes@chromium.org>
      Commit-Queue: Yahan Lu <yahan@iscas.ac.cn>
      Cr-Commit-Position: refs/heads/main@{#82577}
      546c7b5f
  2. 18 Aug, 2022 28 commits