- 24 Apr, 2020 5 commits
-
-
Ng Zhi An authored
If module bytes end in a prefix like 0xfc (numeric prefix), we read out of bounds (pc + 1). So, if validate flag is set, check the length. Bug: chromium:1073553 Change-Id: Ia9771419d01f2315723d19dd96630172b5a7a1f5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161404Reviewed-by:
Clemens Backes <clemensb@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#67370}
-
Milad Farazmand authored
Port c47d1631 R=zhiguo.zhou@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I126b610d69234c0eaa5599978a5fd25223b657c5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2164945Reviewed-by:
Junliang Yan <jyan@ca.ibm.com> Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com> Cr-Commit-Position: refs/heads/master@{#67369}
-
Clemens Backes authored
The cctests for breakpoints were still executing in the interpreter. This CL moves them over to Liftoff. Note that the additional methods on {DebugInfo} will be reused for other purposes, see https://crrev.com/c/1941139. R=jkummerow@chromium.org Bug: v8:10389 Change-Id: Ia88150612377d6e7db0514af1efe091124b3ddce Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162852Reviewed-by:Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#67360}
-
Zhao Jiazhong authored
Port c47d1631 https://crrev.com/c/2158925 Change-Id: Ib1c494c93acfb5d19890427e6ea73202915675df Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2162415Reviewed-by:
-
Kong, Fanchen authored
movsx_b needs a byte register on ia32, but is using arbitrary gp register. Bug: v8:9909 Change-Id: I5f31733ccf4ca3b04a3564a9133aec496653079e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158928Reviewed-by:
Zhi An Ng <zhin@chromium.org> Commit-Queue: Fanchen Kong <fanchen.kong@intel.com> Cr-Commit-Position: refs/heads/master@{#67351}
-
- 23 Apr, 2020 6 commits
-
-
Zhou, Zhiguo authored
Bug: v8:9909 Change-Id: Id0fcf8ff2575858dd3977795aa03df95b65b5720 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158925Reviewed-by:
-
Bill Budge authored
- Use a builtin for the fast path of Wasm RefFunc. - Simplify the runtime function by passing instance as first argument. Change-Id: I5f6993cae21a878cee21a391a25c4d574243058b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144533 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
Andreas Haas <ahaas@chromium.org> Cr-Commit-Position: refs/heads/master@{#67346}
-
Bill Budge authored
- Use the new builtin to convert f32 to Number, rather than changing to f64, then calling f64 to Number. Bug: v8:10070 Change-Id: I9a0660af8f5e517c2c6691d57d665b7e6316a51b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2111714 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
-
Ng Zhi An authored
In the reland, https://crrev.com/c/2157799, I accidentally left out the arm64 implementation. This adds it. R=clemensb@chromium.org Bug: v8:9909 Change-Id: I0e36f85402cd86ed7adaace43e7ec88f9aaad659 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161566Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9909 Change-Id: I22351c7532e58ccd085f5934d1c59e0108c97cea Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161390Reviewed-by:
-
Andreas Haas authored
R=clemensb@chromium.org Bug: v8:10108 Change-Id: Ibb7e7e14e86957c6bf302fcfd3e1099d4f00c414 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154646 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
- 22 Apr, 2020 13 commits
-
-
Ng Zhi An authored
Load splat opcodes are currently multi-byte, but were not passing the right lengths for decoding of immediates. Bug: v8:10258 Change-Id: I2c93c3f915eaa43a74722cf0285f161d16ef0ff6 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154769Reviewed-by:
Deepti Gandluri <gdeepti@chromium.org> Commit-Queue: Zhi An Ng <zhin@chromium.org> Cr-Commit-Position: refs/heads/master@{#67326}
-
Zhao Jiazhong authored
Port 9f41a584 https://crrev.com/c/2151999 Change-Id: I58b02bebe3802a4c4a66df331913a742a083de9f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2160688Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9909 Change-Id: I67f7ace62b6c257f4f3ad76fb22eff99e4988e2d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158918 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9909 Change-Id: I787c9bc9c998c873bf431df13eb3b92044cbc1e4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157647Reviewed-by:
-
Jakob Kummerow authored
read_prefixed_opcode() can fail; we must check for that case before using the value it returned. Bug: chromium:1073356 Change-Id: Ic213bd296e9c50dbffd5df8bc94ef0e7695d75a2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2161068 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Commit-Queue: Clemens Backes <clemensb@chromium.org> Auto-Submit: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Milad Farazmand authored
Port 9f41a584 R=fanchen.kong@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: I1f2acddd880daa392a686b3ebcdb3804114245ee Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2160088Reviewed-by:
-
Clemens Backes authored
If multiple compilation threads want to publish their generated code, they currently block on each other. This can cause multiple background threads to be blocked for several hundred milliseconds in the worst case. This CL changes this such that instead of blocking, the threads just put the code in a queue from where it is picked up by the thread that is currently publishing. Instead of blocking, the threads can then continue compiling more code already. This change might produce regressions, because there is now more TurboFan tier-up compilation happening while Liftoff code is being published. This might delay the completion of baseline compilation. It can also happen that we publish (more) TurboFan code before finishing baseline compilation, which would also regress compile scores. Let's see what the perf bots have to say about this CL. We might need to adapt certain things (like delaying TurboFan compilation until all Liftoff code finished), or we might just accept slight delays in Liftoff compilation, because tier-up will finish sooner after this CL, giving us peak performance earlier. R=ahaas@chromium.org Bug: v8:10330 Change-Id: I2f5c15810a0a9fc18461f9cbf4e436ab36aa559d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154200 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by:
-
Andreas Haas authored
The existing code supports overlapping LiftoffRegisters in I64Binops by allocating a scratch register. Overlapping LiftoffRegisters means that the low register of one LiftoffRegister is the high register of another LiftoffRegister. When I64Binop is used in the implementation of atomic instructions, no scratch register is available, so overlapping LiftoffRegisters cannot be supported. As LiftoffRegisters are not supposed to overlap anyways, this CL removes this special handling. R=clemensb@chromium.org Bug: v8:10108 Change-Id: I9ce2143b0930688bc2e6dd56e151f47fba00ec87 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151351 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Clemens Backes authored
When compiling modules with many functions, the list of regions in the {DisjointAllocationPool} can become quite large if the functions die in a random order (which they typically do, since the order of Liftoff compilation is different than the order to TurboFan compilation; which work stealing, both are nondeterministic). Iterating the list of regions in the {DisjointAllocationPool} was thus linear in the number of regions, which is linear in the number of functions of the module. Since we insert new regions one by one, overall runtime was quadratic. This CL fixes this by switching from a linked list to a std::set. Merging a new region is thus logarithmic instead of linear, and overall we are {n*log(n)} instead of {n^2}. Note: For {AllocateInRegion} we still need to linearly iterate all regions that overlap the requested region, but this has not shown to be a problem so far. R=ahaas@chromium.org Bug: v8:10432 Change-Id: I193e56c2abab782e386194fbe64dadfa250916f7 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154797 Commit-Queue: Clemens Backes <clemensb@chromium.org> Reviewed-by: -
Andreas Haas authored
With this CL we reuse the implementation of AtomicStore to implement AtomicBinops. The implementation is parametrised by an optional result Liftoff register, and by an operation that is applied on the value stored in the memory location. R=clemensb@chromium.org, v8-arm-ports@googlegroups.com Bug: v8:10108 Change-Id: I71ff5bf1632d860462d66b43c34515400eae2979 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151349 Commit-Queue: Andreas Haas <ahaas@chromium.org> Reviewed-by:
-
Kong, Fanchen authored
Bug: v8:9909 Change-Id: Ib97bcc7afe516a014cd91128aa3c59f1b8b0b0af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151999 Commit-Queue: Fanchen Kong <fanchen.kong@intel.com> Reviewed-by:
-
Kim-Anh Tran authored
Bug: v8:1071760 Change-Id: Id2f75aef039574b918768fb323e1a8dbc999606f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2159491Reviewed-by:
-
Jakob Gruber authored
This is a reland of 5c4b8056 Original change's description: > [snapshot] Extract more files > > This moves: > > - ExternalReferenceEncoder to codegen/external-reference-encoder.h > - SerializerDeserializer to snapshot/serializer-deserializer.h > - Checksum() to snapshot/snapshot-utils.h > > serializer-common.h and .cc are removed. > > Tbr: clemensb@chromium.org,ulan@chromium.org > Bug: v8:10416 > Change-Id: I36a242dcc1ad8833374aa567f73e0d4a75632c58 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144118 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Dan Elphick <delphick@chromium.org> > Cr-Commit-Position: refs/heads/master@{#67281} Tbr: delphick@chromium.org,clemensb@chromium.org,ulan@chromium.org Bug: v8:10416 Change-Id: I6f6a1017435db185778ed931e1ddb13d8d5e920e Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157384Reviewed-by:
Dan Elphick <delphick@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#67298}
-
- 21 Apr, 2020 12 commits
-
-
Bill Budge authored
- Adds builtins to convert between Int32/Float64 and JS Number. - WasmInt32ToHeapNumber (bypass SMI test) - WasmFloat64ToNumber - Adds builtins to convert between Tagged and Int32/Float64. - WasmTaggedNonSmiToInt32 (bypass SMI test) - WasmTaggedToFloat64 - Uses these builtins in Wasm import and export wrappers instead of generating the equivalent code inline. Results of running Wasm/import-export-wrappers.js Benchmark: https://docs.google.com/document/d/1QIB0xnqdJFRsOJKQYZ8DZgzWn4WysybgugbcO0sYcQA/edit?usp=sharing NOTE: CL will need to be rebased after linkage fix lands. Bug: v8:10070 Change-Id: Ib34507fcd18bdf80938b5707310a5a4f76cdec72 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2099445Reviewed-by:
-
Jakob Kummerow authored
Bug: v8:7748 Change-Id: I80265c7070dc7ec421bf53aa717a727c144b0699 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152844 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
-
Ng Zhi An authored
This relands commit 387d85ad. This was passing in the simulator because of the typo in simulator-arm.cc. The instr->Bit(7,6) call is incorrect, it should be Bit (no s). I don't really know what it resolves to, but the effect is that we get src_unsigned is false when we expect it to be true. With the simulator fix, we get the same error as non-simulator runs. The fix is in liftoff-assembler-arm.h, we need to be passing both source and dst data types to vmovqn. This was already done correctly in code-generator-arm, but I was careless in copying the logic... Bug: v8:9909 Original change's description: > [wasm-simd][liftoff][arm][arm64] Implement integer narrowing > > Bug: v8:9909 > Change-Id: I0664df45fe399bfa018ff8bcacdbdae66944ed29 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154834 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Zhi An Ng <zhin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#67254} Change-Id: If17f13aae40569174635283abec5ea1358286f55 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157799Reviewed-by:
-
Milad Farazmand authored
Port 6f7b4c7f R=jing.bao@intel.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com BUG= LOG=N Change-Id: Id707ca1de4c4ef71d46192e97ea82453fbf45482 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158843Reviewed-by:
-
Sathya Gunasekaran authored
This reverts commit 5c4b8056. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Clusterfuzz%20Linux%20MSAN%20no%20origins/14661 Original change's description: > [snapshot] Extract more files > > This moves: > > - ExternalReferenceEncoder to codegen/external-reference-encoder.h > - SerializerDeserializer to snapshot/serializer-deserializer.h > - Checksum() to snapshot/snapshot-utils.h > > serializer-common.h and .cc are removed. > > Tbr: clemensb@chromium.org,ulan@chromium.org > Bug: v8:10416 > Change-Id: I36a242dcc1ad8833374aa567f73e0d4a75632c58 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144118 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Reviewed-by: Dan Elphick <delphick@chromium.org> > Cr-Commit-Position: refs/heads/master@{#67281} TBR=ulan@chromium.org,jgruber@chromium.org,clemensb@chromium.org,delphick@chromium.org Change-Id: I718ca43a31d3ca937d700eab9bacc163e4598283 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:10416 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2157383Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#67282}
-
Jakob Gruber authored
This moves: - ExternalReferenceEncoder to codegen/external-reference-encoder.h - SerializerDeserializer to snapshot/serializer-deserializer.h - Checksum() to snapshot/snapshot-utils.h serializer-common.h and .cc are removed. Tbr: clemensb@chromium.org,ulan@chromium.org Bug: v8:10416 Change-Id: I36a242dcc1ad8833374aa567f73e0d4a75632c58 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2144118 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
-
Jakob Kummerow authored
The former is backed by a runtime function for now. No Liftoff or interpreter implementation yet. Bug: v8:7748 Change-Id: If2e1bf6e7a5267c5e64529bb5a686e548682e80a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154199Reviewed-by:
-
Jakob Kummerow authored
Unused so far. Bug: v8:7748 Change-Id: I8ee905614227c5517fa19088f76f947d2caadc3b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2152843 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
-
Zhao Jiazhong authored
Port 6f7b4c7f https://crrev.com/c/2154330 Change-Id: I1788a3f6ca30bb684efa182f5e4e40bb3052c052 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2156711Reviewed-by:
-
Thibaud Michaud authored
Destroy the weak script handle from a custom finalizer, to ensure that this is done from the main thread. R=clemensb@chromium.org Bug: v8:10417 Change-Id: I76a27c4a6db5ef4d189febcf9d0f81f9fd6c220d Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2151347Reviewed-by:
-
Yu Yin authored
Port several CLs recorded in bug 9909. We test this on 3A4000, and find many issues in MSA implement, but they are not related with this patch, will fix in another CL. Looks like there is no 32-bit os for 3a4000, so we do not implements s128 for mips32. Bug: v8:9909 Change-Id: Iad7569ebb92904bae66d420c8306cde24afb034a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2147575 Commit-Queue: Yu Yin <xwafish@gmail.com> Reviewed-by:
-
jing.bao authored
Bug: v8:9909 Change-Id: I11a07dcfe3362e8476ecf361f7de1c5047a34d7c Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154330Reviewed-by:
-
- 20 Apr, 2020 4 commits
-
-
Ng Zhi An authored
With https://crrev.com/c/2118476, we can decode multi byte opcodes. So the module builder should be emitting the correct LEB encoded bytes for SIMD opcodes. This also fixes an error discovered by the fuzzer: I added f64x2.add to the fuzzer, but that's actually a multi-byte opcode, so it resulted in incorrect bytes generated. This should fix it. Bug: chromium:1072090 Bug: v8:10258 Change-Id: I0b32ac27aa24d25ee8694dacb12d3d8339d9f839 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158005Reviewed-by:
-
Zhi An Ng authored
This reverts commit 387d85ad. Reason for revert: Broke ARM tree https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/13926? Original change's description: > [wasm-simd][liftoff][arm][arm64] Implement integer narrowing > > Bug: v8:9909 > Change-Id: I0664df45fe399bfa018ff8bcacdbdae66944ed29 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154834 > Reviewed-by: Clemens Backes <clemensb@chromium.org> > Commit-Queue: Zhi An Ng <zhin@chromium.org> > Cr-Commit-Position: refs/heads/master@{#67254} TBR=clemensb@chromium.org,zhin@chromium.org Change-Id: I6e5cac9cf9e6070b4819edbde6cd2ada2d0b476a No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9909 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2158010Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9909 Change-Id: Id7f3c438493d3a41eb36660c69bdea6bfa978c89 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154766 Commit-Queue: Zhi An Ng <zhin@chromium.org> Reviewed-by:
-
Ng Zhi An authored
Bug: v8:9909 Change-Id: I0664df45fe399bfa018ff8bcacdbdae66944ed29 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154834Reviewed-by:
-
