Commits · c32a3106b48c634744c9efdb766823d885da9e3d · Linshizhi / V8

12 Aug, 2020 4 commits

[wasm][fuzzer] Second instantiation cannot fail · c32a3106

Clemens Backes authored Aug 11, 2020

A minor fix to the {InterpretAndExecuteModule} function: We instantiate
the module twice. If the first instantiation worked, then also the
second instantiation must succeed.
Plus minor drive-by cleanup.

R=ahaas@chromium.org

Bug: chromium:1113681
Change-Id: Ib897cb1907152cdd9b0ed2b513a6c8217a3f400c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349288
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69352}

c32a3106

[heap] Remove ArrayBufferTracker · 3c0fb324

Dominik Inführ authored Aug 10, 2020

ArrayBufferTracker was superseded by ArrayBufferList and
ArrayBufferSweeper. Now that ArrayBufferSweeper is used in production,
we can remove the unused ArrayBufferTracker mechanism.

Bug: v8:10064
Change-Id: I479169c76b6c5c634672024f77e689bb64a36504
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339105Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69351}

3c0fb324

[csa][cleanup] Remove ParameterMode/TNodify StoreFixedDoubleArrayHole · 01a96a90

Santiago Aboy Solanes authored Aug 11, 2020

Also remove the unused StoreFixedDoubleArrayHoleSmi

Bug: v8:9708, v8:6949
Change-Id: I07b6e83520a6ac667a4bd08d90510931141719a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349303Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69350}

01a96a90

[csa][cleanup] Remove ParameterMode/TNodify StorePropertyArrayElement · 550d4a53

Santiago Aboy Solanes authored Aug 11, 2020

Bug: v8:9708, v8:6949
Change-Id: I3fa0b3d76fb6343eb986321e40cee673b6c30670
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349302Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69349}

550d4a53

11 Aug, 2020 31 commits

[ic] Add elements kind to handlers · 15ec32b4

Sathya Gunasekaran authored Aug 11, 2020

Bug: v8:10582, v8:9684
Change-Id: I4b53b161f9154212568856206ff011e61975e431
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2247652
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69348}

15ec32b4

Revert "[regalloc] Place spill instructions optimally" · e9245e46

Bill Budge authored Aug 11, 2020

This reverts commit f4548e75.

Reason for revert: Breaks some gap resolver tests:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim/24204

Original change's description:
> [regalloc] Place spill instructions optimally
> 
> Design doc:
> https://docs.google.com/document/d/1n9ADWnDI-sw0OvdSmrthf61prmDqbDmQq-NSrQw2MVI/edit?usp=sharing
> 
> Most of this change follows directly what is discussed in the design
> document. A few other things are also changed:
> 
> - PopulateReferenceMapsPhase is moved after ResolveControlFlowPhase so
>   that it can make use of the decision regarding whether a value is
>   spilled at its definition or later.
> - SpillSlotLocator is removed. It was already somewhat confusing,
>   because the responsibility for marking blocks as needing frames was
>   split: in some cases they were marked by SpillSlotLocator, and in
>   other cases they were marked by CommitSpillsInDeferredBlocks. With
>   this change, that split responsibility would become yet more
>   confusing if we kept SpillSlotLocator for the values that are spilled
>   at their definition, so I propose a simpler rule that whatever code
>   adds the spill move also marks the block.
> - A few class definitions (LiveRangeBound, FindResult,
>   LiveRangeBoundArray, and LiveRangeFinder) are moved without
>   modification from register-allocator.cc to register-allocator.h so
>   that we can refer to them from another cc file.
> 
> Bug: v8:10606
> Change-Id: I374a3219a5de477a53bc48117e230287eae89e72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2285390
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69345}

TBR=rmcilroy@chromium.org,seth.brenith@microsoft.com,thibaudm@chromium.org

Change-Id: Ie57109a009ee7ee541a6ff6f89901d1ac99027d2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10606
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2350440Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69347}

e9245e46

Reland "[wasm-simd][arm] Use vmov to move all ones to register" · 9b9c6b0e

Ng Zhi An authored Aug 10, 2020

This is a reland of 57242a05

no-sse4.1 builds were failing due to missing simd-scalar-lowering
for s128.const, this reland adds that implementation.

Original change's description:
> [wasm-simd][arm] Use vmov to move all ones to register
>
> vceq(dst, dst, dst) does not seem to always set the register to all
> ones. The right way should be be to use vmov (immediate) anyway. This
> was not supported in the assembler yet, so we need changes to the
> assembler, diassembler, and simulator.
>
> There is an unfortunate fork in logic in the simulator, due to the way
> the switches are set up, vmov (imm) logic is duplicated across two
> different cases, because the switch looks at the top bit of the
> immediate. Refactoring this will be a bigger change that is irrelevant
> for this bug, so I'm putting that off for now. Instead we extract the
> core of vmov (imm) into helpers and call it in the two cases.
>
> Bug: chromium:1112124
> Change-Id: I283dbcd86cb0572e5ee720835f897b51fae96701
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2337503
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69315}

Bug: chromium:1112124
Change-Id: Id450e5cea41f7a569e49be8386a7788ca8f00658
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346937Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69346}

9b9c6b0e

[regalloc] Place spill instructions optimally · f4548e75

Seth Brenith authored Aug 10, 2020

Design doc:
https://docs.google.com/document/d/1n9ADWnDI-sw0OvdSmrthf61prmDqbDmQq-NSrQw2MVI/edit?usp=sharing

Most of this change follows directly what is discussed in the design
document. A few other things are also changed:

- PopulateReferenceMapsPhase is moved after ResolveControlFlowPhase so
  that it can make use of the decision regarding whether a value is
  spilled at its definition or later.
- SpillSlotLocator is removed. It was already somewhat confusing,
  because the responsibility for marking blocks as needing frames was
  split: in some cases they were marked by SpillSlotLocator, and in
  other cases they were marked by CommitSpillsInDeferredBlocks. With
  this change, that split responsibility would become yet more
  confusing if we kept SpillSlotLocator for the values that are spilled
  at their definition, so I propose a simpler rule that whatever code
  adds the spill move also marks the block.
- A few class definitions (LiveRangeBound, FindResult,
  LiveRangeBoundArray, and LiveRangeFinder) are moved without
  modification from register-allocator.cc to register-allocator.h so
  that we can refer to them from another cc file.

Bug: v8:10606
Change-Id: I374a3219a5de477a53bc48117e230287eae89e72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2285390
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69345}

f4548e75

[turbofan][cleanup] Add helper function for effect level · 80ef93c8

Seth Brenith authored Aug 10, 2020

I noticed a pattern that has been copied around to various places and
thought a helper function might be appropriate.

Change-Id: I8944ac5166c649f15c09f587308406cab317b8d4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346766Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#69344}

80ef93c8

PPC: Optimize clearing higher bits of mulhw/mulhwu · 3f071e3e

Milad Farazmand authored Aug 11, 2020

Change-Id: Ie3e14a6ef4531349e81a8ae741bc7470c7e547ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349468Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69343}

3f071e3e

[csa][cleanup] TNodify LoadAndUntagToWord32(Fixed)ArrayElement · f6af044d

Santiago Aboy Solanes authored Aug 11, 2020

Also remove ParameterMode

Bug: v8:9708, v8:6949
Change-Id: Iaf51004472a4aef0acf29d01497b1047247dc83d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349301Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69342}

f6af044d

Revert "Reland^2 "[flags] warn about contradictory flags"" · 7e932233

Bill Budge authored Aug 11, 2020

This reverts commit 0ba115e6.

Reason for revert: Breaks test on TSAN - block-conflicts
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN%20-%20concurrent%20marking/14230

Original change's description:
> Reland^2 "[flags] warn about contradictory flags"
> 
> This is a reland of d8f8a7e2
> Change compared to last reland:
> - Do not check for d8 flag contradictions in the presence of --fuzzing
> - Allow identical re-declaration of --cache=*
> 
> Original change's description:
> > Reland "[flags] warn about contradictory flags"
> >
> > This is a reland of b8f91666
> > Difference to previous CL: Additional functionality to specify
> > incompatible flags based on GN variables and extra-flags, used
> > to fix the issues that came up on the waterfall.
> >
> > This also changes the rules regarding repeated flags: While
> > explicitly repeated flags are allowed for boolean values as long
> > as they are identical, repeated flags or explicit flags in the
> > presence of an active implication are disallowed for non-boolean
> > flags. The latter simplifies specifying conflict rules in
> > variants.py. Otherwise a rule like
> >
> > INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
> >   "--gc-interval=*": ["--gc-interval=*"],
> > }
> >
> > wouldn't work because specifying the same GC interval twice
> > wouldn't actually count as a conflict. This was an issue with
> > test/mjsunit/wasm/gc-buffer.js, which specifies
> > --gc-interval=500 exactly like the extra flag by the stress bot.
> >
> > Also, this now expands contradictory flags checking to d8 flags
> > for consistency.
> >
> > Original change's description:
> > > [flags] warn about contradictory flags
> > >
> > > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> > >
> > > Bug: v8:10577
> > > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > > Reviewed-by: Georg Neis <neis@chromium.org>
> > > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#68168}
> >
> > Bug: v8:10577
> > Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68989}
> 
> Bug: v8:10577
> Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69339}

TBR=machenbach@chromium.org,neis@chromium.org,clemensb@chromium.org,tebbi@chromium.org,tmrts@chromium.org

Change-Id: I1454a05e357ddd704db7fb79e51be65d45a9a16e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:10577
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2348365Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69341}

7e932233

[compiler][cleanup] Remove dead code · 69dd71b7

Andreas Haas authored Aug 11, 2020

R=neis@chromium.org

Bug: v8:10506
Change-Id: I4cffa301fd306acc4da4375bc6f0729d363cc659
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349307Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69340}

69dd71b7

Reland^2 "[flags] warn about contradictory flags" · 0ba115e6

Tobias Tebbi authored Aug 11, 2020

This is a reland of d8f8a7e2
Change compared to last reland:
- Do not check for d8 flag contradictions in the presence of --fuzzing
- Allow identical re-declaration of --cache=*

Original change's description:
> Reland "[flags] warn about contradictory flags"
>
> This is a reland of b8f91666
> Difference to previous CL: Additional functionality to specify
> incompatible flags based on GN variables and extra-flags, used
> to fix the issues that came up on the waterfall.
>
> This also changes the rules regarding repeated flags: While
> explicitly repeated flags are allowed for boolean values as long
> as they are identical, repeated flags or explicit flags in the
> presence of an active implication are disallowed for non-boolean
> flags. The latter simplifies specifying conflict rules in
> variants.py. Otherwise a rule like
>
> INCOMPATIBLE_FLAGS_PER_EXTRA_FLAG = {
>   "--gc-interval=*": ["--gc-interval=*"],
> }
>
> wouldn't work because specifying the same GC interval twice
> wouldn't actually count as a conflict. This was an issue with
> test/mjsunit/wasm/gc-buffer.js, which specifies
> --gc-interval=500 exactly like the extra flag by the stress bot.
>
> Also, this now expands contradictory flags checking to d8 flags
> for consistency.
>
> Original change's description:
> > [flags] warn about contradictory flags
> >
> > Design Doc: https://docs.google.com/document/d/1lkvu8crkK7Ei39qjkPCFijpNyxWXsOktG9GB-7K34jM/
> >
> > Bug: v8:10577
> > Change-Id: Ib9cfdffa401c48c895bf31caed5ee03545beddab
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2154792
> > Reviewed-by: Clemens Backes <clemensb@chromium.org>
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Reviewed-by: Tamer Tas <tmrts@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#68168}
>
> Bug: v8:10577
> Change-Id: I268e590ee18a535b13dee14eeb15ddd0a9ee8341
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2235115
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#68989}

Bug: v8:10577
Change-Id: I31d2794d4f9ff630f3444210100c64d67d881276
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339464
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69339}

0ba115e6

[turboprop] Don't use weak pointers across TryMigrateInstance calls · d88df03a

Mythri A authored Aug 11, 2020

We shouldn't spill weak pointers onto the stack when calling functions
that can trigger GC. DynamicMapChecks operator was using feedback loaded
from the feedback vector across the TryMigrateInstance function call.
The feedback can be a weak pointer to receiver map for monomorphic cases
and TryMigrateInstance can trigger a GC. This cl fixes it by holding
a holding a strong reference to the feedback.

Bug: v8:10774,v8:10582,v8:9684
Change-Id: Ia36f4d8ad46421ae570f41439bc1f0875081deee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336804Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69338}

d88df03a

[heap] Make PagedSpace::Available lock mutex · d84f900b

Dominik Inführ authored Aug 11, 2020

Isolate::GetHeapStatistics uses PagedSpace::Available, which races
with allocating background threads.

Bug: v8:10315
Change-Id: I6e0dc37d90e0c7a3e3dd2b8bdb77f2ea82372c13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349294Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69337}

d84f900b

[heap] EnsureSweepingCompleted needs to be run in safepoint · 44c6e9f6

Dominik Inführ authored Aug 11, 2020

SimulateIncrementalMarking needs to invoke EnsureSweepingCompleted in
a safepoint. Otherwise RefillFreeList in this method races with
concurrent allocation.

Bug: v8:10315
Change-Id: I9aa11d225a1c1844648788f956fd72988fe269fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349299Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69336}

44c6e9f6

Reland "[wasm] Ensure that only TurboFan code is serialized" · cdd984ef

Clemens Backes authored Aug 11, 2020

This is a reland of 60ee70bb.
The wasm c-api flakes were fixed in https://crrev.com/c/2349293.

Original change's description:
> [wasm] Ensure that only TurboFan code is serialized
>
> We have the implicit assumption that Liftoff code will never be
> serialized, and we start relying on that when implementing new features
> (debugging, dynamic tiering).
>
> This CL makes the serializer fail if the module contains any Liftoff
> code. Existing tests are changed to ensure that we fully tiered up
> before serializing a module (similar to the logic in Chromium).
> The "wasm-clone-module" test needs to serialize the module before
> enabling the debugger.
>
> Note that chrome currently only serializes a module after it fully
> tiered up, so that should be fine. If other embedders need the ability
> to serialize a module in an arbitrary state, we will have to fix this
> later. With this CL we will be on the safe side though and (gracefully)
> fail serialization instead of accidentally serializing Liftoff code.
>
> R=ahaas@chromium.org
>
> Bug: v8:10777
> Change-Id: I1245e5f7fda3447a544c1e3525e1239cde759174
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336799
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69276}

Bug: v8:10777
Change-Id: I2a7c1429812ca46d88a2902b8e0a7b7e3d638b56
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349290Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69335}

cdd984ef

[heap] Remove Heap::NotifyRefinedOldGenerationSize · b2faa84f

Dominik Inführ authored Aug 11, 2020

Now that background threads participate in sweeping, this method
races because multiple threads now want to update that counter. We could
either make this counter atomic or remove it entirely. This CL removes
this counter since it isn't strictly necessary, it is only used when
sweeper finds more garbage than markers. This happens e.g. with
right-trimming but should be rare and is eventually fixed in the next
GC.

Bug: v8:10315
Change-Id: Iebae8937860160a3b49bedd03c2e21e41f7dfe76
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349296Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69334}

b2faa84f

[tools][system-analyzer] Check file version · f8f7c8b1

Zeynep Cankara authored Aug 11, 2020

This CL checks the version of the log file
by checking the format of Map Objects processed
by the IC processor. The version check requirement
came from the modified IC event logging pipeline
of the V8.

Bug: v8:10644

Change-Id: Ic661a34cfaf15edfde5fa24588275ac055a5bb5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343067
Commit-Queue: Zeynep Cankara <zcankara@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69333}

f8f7c8b1

[wasm] Wait until top tier finished before serializing · 8d3ababb

Clemens Backes authored Aug 11, 2020

We only want to serialize TurboFan code, because Liftoff code could
contain breakpoints, and we start thinking about embedding other
non-relocatable constants.
Thus, wait until top-tier compilation finished before triggering
serialization.

A follow-up CL will make serialization fail if any Liftoff code is
encountered.

R=ahaas@chromium.org

Bug: v8:10777
Change-Id: I73d6c2d868545fcd4069a8cf9850ca7fca375ecb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349293Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69332}

8d3ababb

[wasm][fuzzer] Reuse more logic across fuzzers · 5ec483c3

Clemens Backes authored Aug 11, 2020

This removes the {InterpretWasmModuleForTesting} function in favor of
{InterpretWasmModule}, and uses that in {InterpretAndExecuteModule}.
The latter again is reused in {WasmExecutionFuzzer::FuzzWasmModule},
such that all fuzzers execute the same checks now.

R=ahaas@chromium.org

Bug: chromium:1112099, chromium:1113681
Change-Id: Ia8818b93e9274266a81573edd6852e4e4734b150
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346283
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69331}

5ec483c3

[heap] Split marking worklist into global worklist and local worklists · 28133adc

Ulan Degenbaev authored Aug 10, 2020

This is the first step in refactoring Worklist to allow arbitrary
number of local worklists with private segments:
- Introduce MarkingWorklistImpl<> which will eventually replace
  (and will be renamed to) Worklist.
- MarkingWorklistImpl<> owns the global pool of segments but does not
  keep track of private segments.
- MarkingWorklistImpl<>::Local owns private segments and can be
  constructed dynamically on background threads.
- Rename the existing MarkingWorklistsHolder to MarkingWorklists.
- Rename the existing MarkingWorklists to MarkingWorklists::Local.
- Rename the existing marking_workists_holder to marking_worklists.
- Rename the existing marking_worklists to local_marking_worklists.

Design doc: https://bit.ly/2XMtjLi
Bug: v8:10315

Change-Id: I9da34883ad34f4572fccd40c51e51eaf50c617bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2343330Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69330}

28133adc

[debug] Add support for skipping locations on stepping over · 45928320

Kim-Anh Tran authored Aug 11, 2020

This change adds support for skipping locations that are in a skipList
on step over. This feature is useful for when we are debugging
C++ applications that have DWARF information we only want to stop on
every breakable location in C++, not non every breakable location
on wasm level.

Bug: chromium:1105765
Change-Id: Ie835b011a00cf31e0c5b2df1ac96ebd89f53d23a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339458Reviewed-by: Eric Leese <leese@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69329}

45928320

[wasm] Delete unnecessary load and simplify the code · e8e8b0ee

evih authored Aug 11, 2020

Simplify by using assembler function.

Bug: v8:10701
Change-Id: I7d07a271369fcf8ad34652b6e94463b0468ee1c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346282
Commit-Queue: Eva Herencsárová <evih@google.com>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69328}

e8e8b0ee

[wasm][fuzzer] Merge redundant functions · 14e55ad4

Clemens Backes authored Aug 11, 2020

Remove the {ErrorThrower} parameter to {CallWasmFunctionForTesting} (it
was only populated in a subset of failures anyway), and merge it with
{RunWasmModuleForTesting}.

R=ahaas@chromium.org

Bug: chromium:1113681
Change-Id: I5391e2f911928641a907bc5dad5a54677c90acb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346279Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69327}

14e55ad4

[js-function] Remove deprecated predicates · b3a6b586

Jakob Gruber authored Aug 11, 2020

Updated:

IsOptimized -> HasAttachedOptimizedCode
HasOptimizedCode -> HasAvailableOptimizedCode
IsInterpreted -> ActiveTierIsIgnition

Bug: v8:8888
Change-Id: I96363622b67b53371a974f1c17cef387093f053c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346404
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69326}

b3a6b586

[js-function] Systematic predicates to reason about available code · ee9e9423

Jakob Gruber authored Aug 11, 2020

This CL adds more systematic predicates to JSFunction to reason about
available code kinds. Introduced terminology:

- Attached code kinds are accessible directly from the JSFunction
  itself.
- Available code kinds are either attached or accessible indirectly.
- The Active code kind is the one that would be executed on the next
  function execution.

Bug: v8:8888
Change-Id: I9468884dfe97a6cb73f8329b2b6cb62b622d3e7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2345966
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69325}

ee9e9423

[wasm][fuzzer] Check for nondeterminism in all fuzzers · 388a317c

Clemens Backes authored Aug 11, 2020

The "wasm fuzzer" and "wasm async fuzzer" use the
{InterpretAndExecuteModule} function, which did not check for possible
nondeterminism in the interpreter yet. This can lead to wrong reports
of mismatches, or in endless loops being executed in compiled code which
was not executed in the interpreter.

This CL adds the check for nondeterminism in that function, and adds a
TODO to merge the two very similar methods.

R=ahaas@chromium.org

Bug: chromium:1112099, chromium:1113681
Change-Id: I80b01d4c53d04f0632807fa852147dc9fb8075ca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346280
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69324}

388a317c

[wasm][interpreter] Print float in hex representation · 64dfb0b4

Clemens Backes authored Aug 10, 2020

The interpreter is used for testing (including fuzzing) only, and in
these cases it's often important to see the exact value of a float. Both
decimal and scientific notation does not show the full value though, and
decimal representation can also be really long for large values, making
it hard to compare values.
This CL switches this debug output to hexadecimal float values, which
always shows the float value in full precision and is also much shorter
than decimal notation in many cases.

R=ahaas@chromium.org

Bug: chromium:1112099
Change-Id: Ia84824227fcd2f1e763ab89280a202ed44930a71
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346646Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69323}

64dfb0b4

[Atomics.waitAsync] Stage Atomics.waitAsync · 3bd6d141

Marja Hölttä authored Aug 07, 2020

Bug: v8:10239
Change-Id: I5d8e9c85f97835bcabb0c42c7dc0db0fdb3f82fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2342851Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69322}

3bd6d141

Fix MSVC warning in IA32 LiftoffAssembler::Load(). · 2decee1b

Lei Zhang authored Aug 10, 2020

32-bit MSVC generates a C4018 warning for signed/unsigned mismatch.
Fix this by casting the std::numeric_limits<int32_t>::max() return
value.

Change-Id: Iaff6b81c797a88654a7d2fa6d910da105d824df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346934Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Lei Zhang <thestig@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69321}

2decee1b

[heap] Increase gc_count_ in safepoint · 1f330e39

Dominik Inführ authored Aug 10, 2020

Incrementing gc_count_ races with
Heap::IncrementalMarkingLimitReached(), which starts incremental marking
immediately on every second GC.

Bug: v8:10315
Change-Id: Ieb1126bb4ecc472afe5fdd023a601d753576752e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2346648Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69320}

1f330e39

[Atomics.waitAsync] Separate node lists per location · aa50e53b

Marja Hölttä authored Aug 11, 2020

The design included per-location lists, but they were left out in
Version 1 of the implementation.

In addition: drive-by style unification.

Bug: v8:10239
Change-Id: Ia4d69fdf4ce0c3aad2dae8082e00e9fa14c4170a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339620
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69319}

aa50e53b

PPC: clear high 32 bits from the result of mulhw. · 1a9c676a

Milad Farazmand authored Aug 10, 2020

The hight 32 bits of the result of mulhw are undefined and need
to be cleared manually.

Change-Id: I0e746898aa26a7970ab59b89c374afd1377028ea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2347208Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#69318}

1a9c676a

10 Aug, 2020 5 commits

[atomics] Remove the deprecated Atomics.wake · a36f40cb

Shu-yu Guo authored Jul 31, 2020

The Intent to Deprecate and Remove was sent in March 2019:
https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/_zPuM7ETNSE

Current use of Atomics.wake is at <0.0002% of page loads:
https://chromestatus.com/metrics/feature/timeline/popularity/2556

Bug: v8:7883
Change-Id: I4534df6cb88e0afbeae655254d6ce48ad7b462e7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333349
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69317}

a36f40cb

Revert "[wasm-simd][arm] Use vmov to move all ones to register" · ff503fd4

Bill Budge authored Aug 10, 2020

This reverts commit 57242a05.

Reason for revert: regression tests fails:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/31477

Original change's description:
> [wasm-simd][arm] Use vmov to move all ones to register
> 
> vceq(dst, dst, dst) does not seem to always set the register to all
> ones. The right way should be be to use vmov (immediate) anyway. This
> was not supported in the assembler yet, so we need changes to the
> assembler, diassembler, and simulator.
> 
> There is an unfortunate fork in logic in the simulator, due to the way
> the switches are set up, vmov (imm) logic is duplicated across two
> different cases, because the switch looks at the top bit of the
> immediate. Refactoring this will be a bigger change that is irrelevant
> for this bug, so I'm putting that off for now. Instead we extract the
> core of vmov (imm) into helpers and call it in the two cases.
> 
> Bug: chromium:1112124
> Change-Id: I283dbcd86cb0572e5ee720835f897b51fae96701
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2337503
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#69315}

TBR=bbudge@chromium.org,jkummerow@chromium.org,v8-arm-ports@googlegroups.com,zhin@chromium.org

Change-Id: I5d9d1dcb81771f71001d959ec5a03a43a11c4233
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1112124
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2347211Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69316}

ff503fd4

[wasm-simd][arm] Use vmov to move all ones to register · 57242a05

Ng Zhi An authored Aug 10, 2020

vceq(dst, dst, dst) does not seem to always set the register to all
ones. The right way should be be to use vmov (immediate) anyway. This
was not supported in the assembler yet, so we need changes to the
assembler, diassembler, and simulator.

There is an unfortunate fork in logic in the simulator, due to the way
the switches are set up, vmov (imm) logic is duplicated across two
different cases, because the switch looks at the top bit of the
immediate. Refactoring this will be a bigger change that is irrelevant
for this bug, so I'm putting that off for now. Instead we extract the
core of vmov (imm) into helpers and call it in the two cases.

Bug: chromium:1112124
Change-Id: I283dbcd86cb0572e5ee720835f897b51fae96701
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2337503
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69315}

57242a05

Roll test262 · 3f2dba84

Frank Tang authored Aug 08, 2020

https://chromium.googlesource.com/external/github.com/tc39/test262/+log/0f5a274aad..e73054f7

Bug: v8:7834
Change-Id: I1063b3e25ea957681a2f52c8d5b27970514d96d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2342290Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69314}

3f2dba84

[wasm-simd][liftoff][ia32] Optimize shuffles (swizzles) · 2f27fc51

Ng Zhi An authored Aug 04, 2020

Optimize shuffles which only use a single operand (called swizzles),
after canonicalization.

Bug: v8:10696
Change-Id: I2e5ffdb723123dffb0abcb6126345972ddc9f652
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2335735Reviewed-by: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69313}

2f27fc51