Commits · ad4b160eaff6ebb41814fd89300a34afd43d12ce · Linshizhi / V8

12 Nov, 2021 17 commits

[runtime] Ensure JSMessageObject has source positions · ad4b160e

Igor Sheludko authored Nov 12, 2021

Under certain conditions GC could flush bytecode array from
SharedFunctionInfos. This CL ensures that the bytecode array is always
available for reconstructing source positions.

Bug: chromium:1265570
Change-Id: I2ce7eb04201f69121687ab0aaa2af42adb2caae0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275569Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77877}

ad4b160e

[wasm] Make ActiveContinuation a root · f4d265b0

Thibaud Michaud authored Nov 12, 2021

Switching stack affects all instances, therefore make the active
continuation a root object instead of an instance field.

Bug: v8:12191
Change-Id: Ia521bf4e7c3cbca035f916e47804c2f75bbd8f18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3268296Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77876}

f4d265b0

[codegen][compiler] Rename ATOM to INTEL_ATOM to avoid shadow · 18311df3

Ng Zhi An authored Nov 11, 2021

This shadows ATOM used in js-regxp.

Making this an enum class requires changing a lot of different places.

Atom is an Intel brand name, so INTEL_ATOM kinda make sense.

Bug: v8:12244,v8:12245
Change-Id: I80be342488328cde5aaca36f900375d2fb381253
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3276926Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77875}

18311df3

PPC: Optimize count of trailing zeros on P8 and below · 0bb40066

Milad Fa authored Nov 11, 2021

Change-Id: Iff669f6272e2a95d5150108d5a3a77e903afbeb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275568Reviewed-by: Junliang Yan <junyan@redhat.com>
Commit-Queue: Milad Fa <mfarazma@redhat.com>
Cr-Commit-Position: refs/heads/main@{#77874}

0bb40066

[heap] Adds DCHECK in UnprotectAndRegisterMemoryChunk · 42036e7e

Victor Gomes authored Nov 12, 2021

UnprotectAndRegisterMemoryChunk should only be called if we have
CodePageCollectionMemoryModificationScope or
CodeSpaceMemoryModificationScope open.

This also fixes cctests that create code objects without a
code modification scope.

Bug: v8:12054
Change-Id: Id931f1f8120050b2bb76ef3d5701b9a32e52ff37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277882
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77873}

42036e7e

[parser] Pass LocalIsolate to ParseOnBackground · 8685bd0c

Leszek Swirski authored Nov 12, 2021

Unify parse post-processing between main-thread and background-thread
parsing, now that we have LocalIsolate and can Internalize on background
threads.

As part of this, simplify the LocalIsolate parking pattern to explicitly
park during ParseOnBackground, rather than being implicitly parked when
ParseOnBackground is called. This reduces the amound of scoping needed
in the BackgroundCompileTask::Run method.

Change-Id: Ifdb128b763129bda78bd1bae89dac1c62f872350
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277876
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77872}

8685bd0c

[heap] Unprotect code space lab before MakeIterable · 47afc6fd

Victor Gomes authored Nov 12, 2021

When closing a concurrent allocator, for instance when closing a
LocalHeap, we need to make the LAB of the code space iterable.
We add then a CodePageMemoryModificationScope to allow
code space modification.

Bug: v8:12054
Change-Id: I438d7c1a50694930b7558dec2dd552bec22b7552
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277887
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77871}

47afc6fd

[objects] Use atomic for JSGlobalObject::native_context_unchecked · 9e9c61b6

Dominik Inführ authored Nov 12, 2021

Speculative fix for a data race involving memory measurement. For memory
measurement we use JSGlobalObject::native_context_unchecked in
NativeContextInferrer::InferForJSObject when trying to infer the
NativeContext for a JS object from a concurrent marking thread. This
load can race e.g. with the context deserializer running on the main
thread. Fix this race by making the load relaxed atomic.

Bug: chromium:1269681
Change-Id: Id04a92572d7d722594b2f8465e579b7231e54e29
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277885
Auto-Submit: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77870}

9e9c61b6

[compiler-dispatcher] Add locking around SFI->Job map · 8e98695c

Leszek Swirski authored Nov 12, 2021

Due to streaming, the SFI enqueueing can happen concurrently with with
main-thread finalising, so we need to add locks around accesses to the
SFI->Job map.

Bug: v8:12370
Change-Id: I60281a954ef10f7fcde559b9529077a6b9a82c31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277874
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77869}

8e98695c

[Intl] Update ICU to 70-1 on v8 · b9a48232

Frank Tang authored Nov 11, 2021

Diary https://docs.google.com/document/d/1NqMw7DAVFCZRx67auC7sgOvrikHvCYuaB87JUf21yG8/edit#
https://chromium.googlesource.com/chromium/deps/icu.git/+log/eedbaf76..3e05d9da

chromium roll in https://chromium-review.googlesource.com/c/chromium/src/+/3224333

Bug: chromium:1260116
Change-Id: Ie1922a129310106985f3bf1bffd9101fce6bb73a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3237532Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77868}

b9a48232

cppgc: Fix DCHECK on destroying a large page · a57311ca

Michael Lippautz authored Nov 12, 2021

The DCHECK ensures that a page that is going to be destroyed is not
anymore part of the vector of pages of a space. This DCHECK runs while
a potential concurrent sweeper task may add a page for a live object
to the vector, resulting in a broken iteration. Use the pages lock to
fix this.

Bug: chromium:1268969
Change-Id: Ice87026957b3e6b5d36cf28293f7aa6901e96ba2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277132
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Anton Bikineev <bikineev@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77867}

a57311ca

[foozzie] Ensure sparkplug is off for baseline comparison · 67cdb376

Michael Achenbach authored Nov 12, 2021

No-Try: true
Bug: v8:12054
Change-Id: I118d1680939d1282c580530f8aa12a4cf72e54d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3277875Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77866}

67cdb376

[riscv64] Add packing and unpacking instructions for WebAssembly SIMD · fa76b5c9

Yujie Wang authored Nov 11, 2021

- Add Wasm SIMD packing instruction:
  `LiftoffAssembler::emit_i8x16_{s,u}convert_i16x8`

- Add Wasm SIMD unpacking instructions:
  `LiftoffAssembler::emit_i64x2_{s,u}convert_i32x4_{low,high}`
  `LiftoffAssembler::emit_i32x4_{s,u}convert_i16x8_{low,high}`
  `LiftoffAssembler::emit_i64x2_{s,u}convert_i32x4_{low,high}`

- Add RVV instrucions: `vzext_vf{2,4,8}` and `vsext_vf{2,4,8}`

- Fixed simulator for `vslidedown_vi`

Bug: v8:11976
Change-Id: Idd383bc566589ce183f4fcef2201d2ccfe03519f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3273812Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77865}

fa76b5c9

Update google_benchmark · 3adc14cf

v8-ci-autoroll-builder authored Nov 12, 2021

Rolling v8/third_party/google_benchmark/src: https://chromium.googlesource.com/external/github.com/google/benchmark/+log/b3c08f6..a17480d

Fix dependency typo and unpin cibuildwheel version in wheel building … (#1263) (Nicholas Junge)
https://chromium.googlesource.com/external/github.com/google/benchmark/+/a17480d

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com,mlippautz@chromium.org

Change-Id: Iee5b0189f850eba665fe60670b0bdaa7e5a3f779
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275844Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77864}

3adc14cf

Update V8 DEPS. · 96122583

v8-ci-autoroll-builder authored Nov 12, 2021

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/2f14357..f38f611

Rolling v8/third_party/aemu-linux-x64: j1lOwTKOsgGUj2jDFDa6IhTVhwEoPPzmdxFksCvz278C..eWKIKAWWZAJd3aNVfwGevVWupHnf0a31BNfVmvJfkucC

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/0dab16a..279fe4e

Rolling v8/third_party/depot_tools: https://chromium.googlesource.com/chromium/tools/depot_tools/+log/2df8443..0b187dc

Rolling v8/third_party/googletest/src: https://chromium.googlesource.com/external/github.com/google/googletest/+log/79efd96..9ca071b

Rolling v8/third_party/instrumented_libraries: https://chromium.googlesource.com/chromium/src/third_party/instrumented_libraries/+log/286f857..380f371

Rolling v8/tools/luci-go: git_revision:d17c642c8c3c6d9e37bd9c25535c4c5b66b99781..git_revision:bf56a119c5f056a1f7a04c8dbe19cdd86728b540

TBR=v8-waterfall-sheriff@grotations.appspotmail.com,mtv-sf-v8-sheriff@grotations.appspotmail.com

Change-Id: If831f3ede3b0e01ad34b4901448b7482f6c64d33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275842Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#77863}

96122583

[riscv64] Fix a Int64Mul error in instruction selection. · 87d302e1

Lu Yahan authored Nov 11, 2021

Port 9a900169

The second parameter of Int64Mul may be a 64-bit immediate value,
treating it as a 32-bit value will lose the upper 32 bits.

Bug: v8:12373

Change-Id: Ib824db839219307ba390a6dc3c697bedb792046f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275135
Auto-Submit: Yahan Lu <yahan@iscas.ac.cn>
Commit-Queue: ji qiu <qiuji@iscas.ac.cn>
Reviewed-by: ji qiu <qiuji@iscas.ac.cn>
Cr-Commit-Position: refs/heads/main@{#77862}

87d302e1

[x64] Implement 256-bit assembly for SSSE3 UNOP instructions · 7095cf14

Yolanda Chen authored Nov 11, 2021

Bug: v8:12228
Change-Id: I9312716f78e79fd0759c2f7adfef065b5df5cfda
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275566Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Yolanda Chen <yolanda.chen@intel.com>
Cr-Commit-Position: refs/heads/main@{#77861}

7095cf14

11 Nov, 2021 23 commits

[numbers] Rename ConversionFlags:NO_FLAG to NO_CONVERSION_FLAGS · 4edbdee1

Ng Zhi An authored Nov 11, 2021

This fixes a -Wshadow warning for NO_FLAG. The other option is to
make it an enum class, which makes test-conversions.cc a bit verbose.

Bug: v8:12244,v8:12245
Change-Id: I3ea429eb45e31b25d4c6658ceb86c33ba280ae51
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274015Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77860}

4edbdee1

[heap] Convert GCRequestType to enum class · fd8d03e8

Ng Zhi An authored Nov 11, 2021

Bug: v8:12244,v8:12245
Change-Id: I1f0c7fa26e6db208f621470d4bcbea904909a799
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3274014
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77859}

fd8d03e8

Revert "Reland "[baseline] Enable concurrent sparkplug on future"" · fbc7f3ed

Zhi An Ng authored Nov 11, 2021

This reverts commit 72e01a06.

Reason for revert: Failing on Linux 64, local bisect to this change, run with --random-seed-stress-count=1000

Original change's description:
> Reland "[baseline] Enable concurrent sparkplug on future"
>
> This is a reland of 0e4554b4
>
> Original change's description:
> > [baseline] Enable concurrent sparkplug on future
> >
> > Bug: v8:12054
> > Change-Id: I9d5040c806232ecbe71c26b7d65acbc8005bbd00
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3233139
> > Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> > Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#77842}
>
> Bug: v8:12054
> Change-Id: I60849c6c9c7c7e6687422669e5636b2a283cc6ff
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3275560
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#77850}

TBR=leszeks@chromium.org,v8-scoped@luci-project-accounts.iam.gserviceaccount.com,victorgomes@chromium.org

Change-Id: I26b75edb26bd81128a2a266461e7a917dff3b176
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:12054
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3276912Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77858}

fbc7f3ed

Fix crashes introduced by "Fix leaks due to deoptimization literals" · 6e9f5de2

Seth Brenith authored Nov 11, 2021

My previous change https://crrev.com/c/3160299 introduced a runtime
CHECK that crashes the process if V8 attempts to read a deoptimization
literal which has been cleared. That CHECK is indeed crashing the
process.

It appears that the trouble arises in cases where the deoptimization
data indicates that an object should be materialized as needed. In those
cases, one of the deoptimization literals is the Map to use when
materializing the object. It is possible to reach a part of the code
that requires the materialized object, and therefore the Map, without
there being any other owner of that Map. This is in contrast to most
other deoptimization literals, which are logically equivalent to omitted
values from the stack frame and therefore can't be reached without a
real owner somewhere to keep them alive.

To fix, I propose referring to Maps strongly from the deoptimization
literals. The cases I investigated in v8:4578 didn't involve Maps, so I
believe that the observed memory leaks are still fixed with this change.

Bug: chromium:1268681, chromium:1268683, chromium:1268825, v8:12300
Change-Id: Ifd32a7f9cc29e0384650013ab16e05646bf57895
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3272880
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77857}