Commits · a4449f261ad2b198617995470913b15bdbe82d49 · Linshizhi / V8

26 Oct, 2020 3 commits

Reland "[code] Separate instruction and metadata areas" · a4449f26

Jakob Gruber authored Oct 22, 2020

This is a reland of b66993bc

Nothing changed in the reland, the original CL was not the
culprit for win32 failures. They started earlier, at
https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/29444

Original change's description:
> [code] Separate instruction and metadata areas
>
> In this CL, Code object layout changes s.t. the instruction
> area is distinct / non-overlapping from the metadata area.
>
> On-heap Code objects now have a variable-size `body` area,
> containing distinct-but-adjacent `instruction` and `metadata`
> areas.
>
> Off-heap code (= embedded builtins) currently have the same,
> but in the future the metadata area will move elsewhere and
> no longer be adjacent to instructions.
>
> To implement this, the main changes are:
>
>  - The Code object header now contains instruction and metadata
>    sizes, and no longer contains the safepoint table offset
>    (it's implicitly the first table of the metadata section).
>  - The embedded metadata table contains information about both
>    instruction and metadata areas.
>
> I've also added assertions in spots that currently rely on a
> contiguous body area.
>
> Bug: v8:11036
> Change-Id: I940f0c70c07ad511dafd2d2c3e337de8c92cd4b9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491025
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70743}

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Tbr: leszeks@chromium.org, clemensb@chromium.org, dinfuehr@chromium.org
Bug: v8:11036
Change-Id: I238562d7e25cf28cc689856ee8b17f25627aaee7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497162
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70747}

a4449f26

Update V8 DEPS. · bc0d7e6c

v8-ci-autoroll-builder authored Oct 26, 2020

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/66f5e37..6da208e

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I0b0b54597043268c51703021cb25fd65c46ee5b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497287Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70746}

bc0d7e6c

Pull safe_conversions from chromium · cd2c8601

Ng Zhi An authored Oct 22, 2020

Change-Id: I3d62b93d5a643c06626b34a8d69b09a7d50ec439
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491382Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70745}

cd2c8601

25 Oct, 2020 3 commits

Revert "[code] Separate instruction and metadata areas" · 9a02964a

Zhi An Ng authored Oct 25, 2020

This reverts commit b66993bc.

Reason for revert: Broke v8 win32 https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/29454?

Original change's description:
> [code] Separate instruction and metadata areas
>
> In this CL, Code object layout changes s.t. the instruction
> area is distinct / non-overlapping from the metadata area.
>
> On-heap Code objects now have a variable-size `body` area,
> containing distinct-but-adjacent `instruction` and `metadata`
> areas.
>
> Off-heap code (= embedded builtins) currently have the same,
> but in the future the metadata area will move elsewhere and
> no longer be adjacent to instructions.
>
> To implement this, the main changes are:
>
>  - The Code object header now contains instruction and metadata
>    sizes, and no longer contains the safepoint table offset
>    (it's implicitly the first table of the metadata section).
>  - The embedded metadata table contains information about both
>    instruction and metadata areas.
>
> I've also added assertions in spots that currently rely on a
> contiguous body area.
>
> Bug: v8:11036
> Change-Id: I940f0c70c07ad511dafd2d2c3e337de8c92cd4b9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491025
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70743}

TBR=jgruber@chromium.org,leszeks@chromium.org,clemensb@chromium.org,dinfuehr@chromium.org

Change-Id: Ia52ac609a47b8a2038a2511f0af8526ebdfe4719
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:11036
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2497381Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70744}

9a02964a

[code] Separate instruction and metadata areas · b66993bc

Jakob Gruber authored Oct 22, 2020

In this CL, Code object layout changes s.t. the instruction
area is distinct / non-overlapping from the metadata area.

On-heap Code objects now have a variable-size `body` area,
containing distinct-but-adjacent `instruction` and `metadata`
areas.

Off-heap code (= embedded builtins) currently have the same,
but in the future the metadata area will move elsewhere and
no longer be adjacent to instructions.

To implement this, the main changes are:

 - The Code object header now contains instruction and metadata
   sizes, and no longer contains the safepoint table offset
   (it's implicitly the first table of the metadata section).
 - The embedded metadata table contains information about both
   instruction and metadata areas.

I've also added assertions in spots that currently rely on a
contiguous body area.

Bug: v8:11036
Change-Id: I940f0c70c07ad511dafd2d2c3e337de8c92cd4b9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491025Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70743}

b66993bc

Update V8 DEPS. · 4b14a492

v8-ci-autoroll-builder authored Oct 25, 2020

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/27ce505..66f5e37

Rolling v8/third_party/aemu-linux-x64: dfMpR8E7Ie1gS4Mf_DWloGOmZIegnZWNA0kcMr7jPlkC..KsPqcAfQNpcMneTUR-X2XLHNoNCcTLmqK-CIvqJ9zSMC

Rolling v8/third_party/android_platform: https://chromium.googlesource.com/chromium/src/third_party/android_platform/+log/fc6c684..ef64306

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/982bf51..7874beb

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b3a1dba..6f9b1bf

Rolling v8/third_party/markupsafe: https://chromium.googlesource.com/chromium/src/third_party/markupsafe/+log/f2fb0f2..0944e71

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/df55bc4..7371bff

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: I3c46706e042fcfe80aaee5ac6298e93c09dce8e6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2496578Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70742}

4b14a492

24 Oct, 2020 1 commit

Reland "[runtime] Use Isolate::ThrowAt with MessageLocation" · 447915ef

Camillo Bruni authored Oct 20, 2020

This is a reland of eb6b4ce1

Skip test that serializes Error which references a Script. All errors
created by ThrowAt store the current Script under the
error_script_symbol.

Original change's description:
> [runtime] Use Isolate::ThrowAt with MessageLocation
>
> Fix various missing source positions when reporting parse and compile
> errors. Namely this fixes missing source positions when having invalid
> module imports.
>
> - Use Isolate::ThrowAt with valid MessageLocation objects
> - Change public Isolate::Throw to no longer accept MessageLocation to
>   avoid misues
> - Introduce private Isolate::ThrowInternal that accepts MessageLocation
>
> Bug: v8:6513
> Change-Id: I3ee633c9fff8c9d361bddb37f56e28a50c280ec1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2467839
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70623}

Bug: v8:6513
Change-Id: Icba74f74178e28fbda0fd0c237eeb7bacbc33570
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487123Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70741}

447915ef

23 Oct, 2020 18 commits

[d8] Print referrer for failing module imports · dc712da5

Camillo Bruni authored Oct 21, 2020

Improve debugging failing module imports by also printing the module
file where the import originated.

Bug: v8:10668
Change-Id: I519b15d5da635a15eb2c0f23f18a6c53e358eabd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489680Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70740}

dc712da5

[tools] Handle string literal export names in testcase.py · 3d1d61d6

Shu-yu Guo authored Oct 23, 2020

JS now allows string literals as export names, which the current regexp
used to discover module files to push to Android for running tests does
not account for.

Bug: v8:10964
Bug: v8:11049
Change-Id: I6f26f44a98f1d2c91ad69b171faa3f201f8f1e7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492055
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70739}

3d1d61d6

[heap] Split ConcurrentMarking::Stop and update priority · 9b1f9e5d

Etienne Pierre-doray authored Oct 22, 2020

This CL refactors ConcurrentMarking::Stop to have explicit Join and Pause.
MarkCompact updates job priority to UserBlocking before joining.

Change-Id: I71cb469e35cc4df7fdb0dbd8c0cf9c1642e8f5fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491109Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70738}

9b1f9e5d

[Turboprop] Only enable dynamic map checks for TurboProp. · 545e9dc5

Ross McIlroy authored Oct 23, 2020

The dynamic map check builtin loads the feedback vector from the
function's frame, therefore it doesn't work if we inline the
function. We don't do inlining on TurboProp so this is fine, but
it was possible to enable dynamic map checks on TurboFan which does.

This change prevents that, and also makes the dynamic map checks flag
specific to TurboProp and no longer an implication, which also allos
it to be switched on the command line independenly of --turboprop.

BUG=chromium:1141502,v8:9684

Change-Id: I365de461a6373335a45a7a154af7d4cf1c13dc2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494928
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70737}

545e9dc5

Reland "cppgc: Port backing store compaction." · b5979eaa

Omer Katz authored Oct 23, 2020

This is a reland of 90ea9b35

Original change's description:
> cppgc: Port backing store compaction.
>
> This CL ports the existing backing store compaction algorithm from
> blink. It does not attempt to improve on the existing algorithm.
>
> Currently only unified heap uses the compaction implementation. It is
> never triggered through standalone GCs.
>
> The compaction implementation resides within an internal "subtle" namespace.
>
> Bug: v8:10990
> Change-Id: I4aa781db1b711e7aafc34234c4fb142de84394d7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485228
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70714}

Bug: v8:10990
Change-Id: I527c2042a26648d058bfe4d355527cce9a3eeadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492331
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70736}

b5979eaa

cppgc, heap: snapshot: Add support for C++->JS references · 35382590

Michael Lippautz authored Oct 22, 2020

Enables following JS references for unified heap snapshots. Any object
that's referencing a JS objects is marked as visible.

Followup:
- Handling (merging) of wrapper/wrappable pairs.

Change-Id: I02d41a3224265f38d934dcb2686ac24b49c1dbd7
Bug: chromium:1056170
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489698Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70735}

35382590

[wasm][cleanup] Minor cleanups in backing store allocation · 719d0c32

Clemens Backes authored Oct 22, 2020

1. Remove {kOneGiB}, use the global {GB} instead.
2. Inline {GetGuardedRegion} into the single caller {GetRegion}, to
   remove another "#if V8_TARGET_ARCH_64_BIT".
3. Rename {GetRegion} to {GetReservedRegion}.

R=ahaas@chromium.org

Bug: v8:10933
Change-Id: I3b26ae0036db0d910165ed4d993d27262f2cb5ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491035Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70734}

719d0c32

[offthread] Enable off-thread finalization in stress variant · 243e589c

Leszek Swirski authored Oct 23, 2020

Increase --finalize-streaming-on-background test coverage by enabling it
on the stress_js_bg_compile_wasm_code_gc variant.

Bug: chromium:1011762
Change-Id: I0df1ae9a1e73a9ce26f84c87136da1f89e9b18b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494929
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70733}

243e589c

[wasm] Reduce memory reservation without trap handlers · d5720c74

Clemens Backes authored Oct 22, 2020

If trap handlers are disabled, we don't need guard regions around wasm
memories. Hence use the dynamic {trap_handler::IsTrapHandlerEnabled()}
check, instead of always reserving guard regions on all 64-bit
platforms.
This will allow to reserve pretty much arbitrarily many wasm memories if
trap handlers are disabled.

Two tests are added to test the number of memories that can be
allocated: With trap handlers, at least 50 memories should always be
possible. Without trap handlers, 10000 small memories should not be a
problem (each one is taking 64kB, so it's 640MB overall).

Drive-by: Improve tracing.

R=ahaas@chromium.org

Bug: v8:11017
Change-Id: Ic4c620f63dfbef571e64df0b3372b83a1db566ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491034Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70732}

d5720c74

[Turboprop] Fix deprecated map migration in dynamic map check builtin. · 0b355643

Ross McIlroy authored Oct 23, 2020

The TryMigrateInstance should be passed the instance object to migrate,
not the map of the object. Also make the runtime function explicitly
check for JSObjects.

BUG=v8:9684

Change-Id: I03605d9f3103b618243c12ad0b63035484ef4134
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487270
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70731}

0b355643

[tools] Improve system-analyzer startup and loader · eb6b3b49

Camillo Bruni authored Oct 23, 2020

- Display spinner properly again
- Defer loadding additional App and subsequent modules
- Preload file reader module and template

Change-Id: Ifc81a93864d61c282db90df25f93dc0eefef4373
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494925
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70730}

eb6b3b49

cppgc: Don't override stack_state in unified heap GC finalization. · 80ec52ea

Omer Katz authored Oct 23, 2020

CppHeap is currently set up to always finalize with no stack.
Finalizing with actual current stack state breaks our unified heap
unittests. This is fixed by having test specify which stack state
to pass CppHeap.

Bug: chromium:1056170
Change-Id: I1a6c3870abbdf56917c20c6a75580b6c516d828c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494924
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70729}

80ec52ea

[wasm] Remove dead branch from PrepareForLoop · 1debc0ca

Manos Koukoutos authored Oct 22, 2020

The code already checks wether decoder.failed(), so checking whether
AnalyzeLoopAssignment returned null is redundant.

Change-Id: Ia6e8b22011b28c76974aca8a6119466fe343079e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492329Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70728}

1debc0ca

[Compiler] Add Santiago to compiler OWNERS · 9586aa1f

Ross McIlroy authored Oct 20, 2020

Change-Id: I8ae417b5f3bd2e19bbddc841bcd99044b8d14467
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485090Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70727}

9586aa1f

Revert "Update V8 DEPS." · 9f445de4

Michael Achenbach authored Oct 23, 2020

This reverts commit a0a569e8.

Reason for revert: https://crbug.com/1141795

Original change's description:
> Update V8 DEPS.
>
> Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/27ce505..a941569
>
> Rolling v8/third_party/aemu-linux-x64: dfMpR8E7Ie1gS4Mf_DWloGOmZIegnZWNA0kcMr7jPlkC..qUVP_lovvTAIvdwUUdt2FBZQjKisQycbEzp2A67oxskC
>
> Rolling v8/third_party/android_platform: https://chromium.googlesource.com/chromium/src/third_party/android_platform/+log/fc6c684..ef64306
>
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/982bf51..ef69704
>
> Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b3a1dba..bf66f2d
>
> Rolling v8/third_party/markupsafe: https://chromium.googlesource.com/chromium/src/third_party/markupsafe/+log/f2fb0f2..0944e71
>
> Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/df55bc4..151bbd6
>
> TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com
>
> Change-Id: Id79c6cf673f56c3da93967abff836c041794cddc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493351
> Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/master@{#70724}

TBR=machenbach@chromium.org,v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Ia69dd87d442b547850d5764cc21690e4e0967f07
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1141795
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494921Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70726}

9f445de4

Revert "[wasm] Enable --wasm-opt" · e88d164e

Maya Lekova authored Oct 23, 2020

This reverts commit 757f0431.

Reason for revert: Suspected for a roll failure at https://chromium-review.googlesource.com/c/chromium/src/+/2490026

Original change's description:
> [wasm] Enable --wasm-opt
>
> This CL enables basic optimizations in TurboFan for WebAssembly code,
> like dead code elimination (DeadCodeElimination), constant folding
> (MachineOperatorReducer), and control flow optimizations
> (CommonOperatorReducer).
>
> These optimizations were disabled originally to improve startup time,
> at the expense of slower generated code. However, with Liftoff as the
> baseline compiler, startup time is not so important anymore for
> TurboFan.
>
> R=clemensb@chromium.org
> CC=manoskouk@chromium.org
>
> Change-Id: I2a81f66929c43fbbdfc3625359772c8ea0f2235f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2488684
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70691}

TBR=ahaas@chromium.org,clemensb@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: If4cc504cec6bdc4a4cc1d7178003199e99bb66c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2494700Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70725}

e88d164e

Update V8 DEPS. · a0a569e8

v8-ci-autoroll-builder authored Oct 23, 2020

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/27ce505..a941569

Rolling v8/third_party/aemu-linux-x64: dfMpR8E7Ie1gS4Mf_DWloGOmZIegnZWNA0kcMr7jPlkC..qUVP_lovvTAIvdwUUdt2FBZQjKisQycbEzp2A67oxskC

Rolling v8/third_party/android_platform: https://chromium.googlesource.com/chromium/src/third_party/android_platform/+log/fc6c684..ef64306

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/982bf51..ef69704

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/b3a1dba..bf66f2d

Rolling v8/third_party/markupsafe: https://chromium.googlesource.com/chromium/src/third_party/markupsafe/+log/f2fb0f2..0944e71

Rolling v8/tools/clang: https://chromium.googlesource.com/chromium/src/tools/clang/+log/df55bc4..151bbd6

TBR=machenbach@chromium.org,tmrts@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com

Change-Id: Id79c6cf673f56c3da93967abff836c041794cddc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493351Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#70724}

a0a569e8

[serializer] Fix judgement of map changed · 297ad1ec

Pan, Tao authored Oct 21, 2020

This CL can improve the performance of below microbench by ~40%.

// touch worker.js in shell is needed
let json_obj = ${content of v8_trace.json};
let worker = new Worker("worker.js");
let start = performance.now();
for (let i = 0; i < 1e5; i++) {
  worker.postMessage(json_obj);
}
console.log(performance.now() - start;

Change-Id: I69b40e4d7e0b49ab90c01c21c5d03b02e292d246
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489329Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Tao Pan <tao.pan@intel.com>
Cr-Commit-Position: refs/heads/master@{#70723}

297ad1ec

22 Oct, 2020 15 commits

cppgc: Fix and re-enable weak container test · 62af317d

Omer Katz authored Oct 22, 2020

The test was not flaky. Instead it seems compiiler optimizations discarded
of the test-allocated object such that stack scanning could no longer find it.

Bug: v8:11052
Change-Id: Ie8018ccecb03b22e6c4f2dada3e6663b04c551fd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2493160
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70722}

62af317d

[wasm][liftoff][ia32] Fix register allocation of CompareExchange · 70a389ac

Andreas Haas authored Oct 22, 2020

The register that holds the {new_value} for the AtomicCompareExchange8U
has to be a byte register on ia32. There was code to guarantee that, but
after that code there was code that frees the {eax} register, and that
code moved the {new_value} to a different register again. With this CL
we first free {eax}, and then find a byte register for the {new_value}.

R=clemensb@chromium.org

Bug: chromium:1140549
Change-Id: I1679f3f9ab26c5416ea251c7925366ff43336d85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491031Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70721}

70a389ac

PPC/s390: [wasm] Use int type for small offsets · d9829b92

Milad Fa authored Oct 22, 2020

Port ba564604

Original Commit Message:

    The uint32_t type can easily be confused with the memory offsets that
    are currently 32 bit and will become 64 bit with the memory64 proposal.
    Since the offsets into the instance are always small anyway, the type of
    the integer does not really matter, and we should stick to the default
    'int'.

R=clemensb@chromium.org, joransiu@ca.ibm.com, junyan@redhat.com, midawson@redhat.com
BUG=
LOG=N

Change-Id: Icfc3b4172984c81355ca4b69b67433892cca7408
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491107Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/master@{#70720}

d9829b92

Reland "[wasm-gc] Implement call_ref on WasmJSFunction" · 40ad9116

Manos Koukoutos authored Oct 22, 2020

This is a reland of 6227c95e

Fixes compared to original landing:
- Decode a WASM_TO_JS_FUNCTION Code object as a WASM_TO_JS frame.
- Enable call_ref on WasmJSFunctions with arity mismatch.
- Use builtin pointer in BuildWasmToJSWrapper, to avoid having to
  resolve the relocatable constant.

Original change's description:
> [wasm-gc] Implement call_ref on WasmJSFunction
>
> Changes:
> - Introduce turbofan builtin WasmAllocatePair.
> - Implement call_ref for WasmJSFunction in wasm-compiler.cc.
> - Remove WasmJSFunction trap.
> - Improve and extend call-ref.js test.
>
> Bug: v8:9495
> Change-Id: I8b4d1ab70cbbe9ae37887a6241d409eec638fd28
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2463226
> Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70535}

Bug: v8:9495
Cq-Include-Trybots: luci.v8.try:v8_mac64_gc_stress_dbg_ng
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg_ng
Change-Id: I294947059e612d417d92614a43cb7383cd5f3b92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2476314
Commit-Queue: Manos Koukoutos <manoskouk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70719}

40ad9116

Revert "[ia32,x64] Make more use of the 'leave' instruction" · e02a625a

Georg Neis authored Oct 22, 2020

This reverts half of commit 8f0ab471.

Reason for revert: some performance regressions, possibly due
to 'leave' needing MSROM on some microarchitectures.

The half that is not reverted is the removal of 'enter'.


Original change's description:
> [ia32,x64] Make more use of the 'leave' instruction
>
> It is a little shorter and cheaper[1] than the equivalent
> "mov sp,bp; pop bp".
>
> Also remove support for the 'enter' instruction, since
> - it is unused,
> - it is neither shorter nor cheaper than the corresponding
>   push and mov (in fact more expensive[1]), and
> - our disassembler doesn't support it.
>
> [1] See https://www.agner.org/optimize/instruction_tables.pdf
>
> Change-Id: I6c99c2f3e53081aea55445a54e18eaf45baa79c2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2482822
> Commit-Queue: Georg Neis <neis@chromium.org>
> Reviewed-by: Victor Gomes <victorgomes@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70660}

TBR=neis@chromium.org,victorgomes@chromium.org
Bug: chromium:1141069
# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I5c9ad64ee06b71c93eff256044ce49d1523737fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492327
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70718}

e02a625a

[tools] Improve system-analyzer · 7149623d

Camillo Bruni authored Oct 19, 2020

- Move map stats into a separate panel
- Don't handle selection events twice
- Simplify map-stats panel html

Change-Id: I0cd135727e69c8e42d34af3b75d42861ce06f8e4
Bug: v8:10644
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485075Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70717}

7149623d

Revert "cppgc: Port backing store compaction." · 252d7b4b

Omer Katz authored Oct 22, 2020

This reverts commit 90ea9b35.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20-%20debug/31274?

Original change's description:
> cppgc: Port backing store compaction.
>
> This CL ports the existing backing store compaction algorithm from
> blink. It does not attempt to improve on the existing algorithm.
>
> Currently only unified heap uses the compaction implementation. It is
> never triggered through standalone GCs.
>
> The compaction implementation resides within an internal "subtle" namespace.
>
> Bug: v8:10990
> Change-Id: I4aa781db1b711e7aafc34234c4fb142de84394d7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485228
> Commit-Queue: Omer Katz <omerkatz@chromium.org>
> Reviewed-by: Anton Bikineev <bikineev@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70714}

TBR=mlippautz@chromium.org,bikineev@chromium.org,omerkatz@chromium.org

Change-Id: Iadae1ee0c6c0400f0e1a0a3805be5316a1d4b979
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10990
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492330Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70716}

252d7b4b

cppgc: Disable flaky weak container test · 6080b05a

Omer Katz authored Oct 22, 2020

The test WeakContainerTest.ConservativeGCTracesWeakContainer failed on
one of the bots:
https://ci.chromium.org/p/v8/builders/ci/V8%20Mac64%20ASAN/29755?

This seems like flakiness related to stack scanning.

Bug: v8:11052
Change-Id: Ia60d64e63a071335c4c3f648a4ba0c1823841617
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2492324
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Auto-Submit: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70715}

6080b05a

cppgc: Port backing store compaction. · 90ea9b35

Omer Katz authored Oct 22, 2020

This CL ports the existing backing store compaction algorithm from
blink. It does not attempt to improve on the existing algorithm.

Currently only unified heap uses the compaction implementation. It is
never triggered through standalone GCs.

The compaction implementation resides within an internal "subtle" namespace.

Bug: v8:10990
Change-Id: I4aa781db1b711e7aafc34234c4fb142de84394d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485228
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70714}

90ea9b35

[runtime] Don't normalize JSGlobalProxy · 46be10d1

Camillo Bruni authored Oct 21, 2020

Object.assign should not normalize JSGlobalProxy objects.

Bug: chromium:1139769
Change-Id: Ie7e24f6498267966b7553b0c5994307f5b632b0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485505Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70713}

46be10d1

[wasm] Use int type for small offsets · ba564604

Clemens Backes authored Oct 21, 2020

The uint32_t type can easily be confused with the memory offsets that
are currently 32 bit and will become 64 bit with the memory64 proposal.
Since the offsets into the instance are always small anyway, the type of
the integer does not really matter, and we should stick to the default
'int'.

R=manoskouk@chromium.org

Bug: v8:10949
Change-Id: I742334483bbc80c4cc03f40f046b5d2d3b17d1d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2489691
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Manos Koukoutos <manoskouk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70712}

ba564604

[Heap]: Convert MemoryAllocator::Unmapper to using Jobs · 6f73c6c8

Etienne Pierre-doray authored Oct 22, 2020

GetMaxConcurrency() uses queue size to ensure enough threads.

Change-Id: I1f091da91928c196813630fbabf54f7e68f87ead
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2480942
Commit-Queue: Etienne Pierre-Doray <etiennep@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70711}

6f73c6c8

Add trace events for stack trace capturing and symbolization · ba2d0019

Simon Zünd authored Oct 22, 2020

R=petermarshall@chromium.org, yangguo@chromium.org

Change-Id: I3d1cb354f6aeae10fda56f4c51bcb43c9fa5462c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491028Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70710}

ba2d0019

cppgc: Move AccessMode to globals.h · bc0bfbe8

Omer Katz authored Oct 22, 2020

Bug: chromium:1056170
Change-Id: I697a33f51618c0b7b3b60a9a2abcb7bf4ab1d033
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491032
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70709}

bc0bfbe8

cppgc: Support weak containers · 0353c0af

Omer Katz authored Oct 22, 2020

This CL adds TraceWeakContainer and VisitWeakContainer to the Visitor
api. It also introduces the weak_container_worklist_ used to force
re-tracing of weak containers that are reachable from stack.

Bug: chromium:1056170
Change-Id: I4ba75bd64939b8df9ece7422828a5ac647b03fd1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2491022
Commit-Queue: Omer Katz <omerkatz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70708}

0353c0af