- 26 Aug, 2020 1 commit
-
-
Victor Gomes authored
Change-Id: I31e205b696627913584016bb9197e1e719ca0237 Bug: chromium:1120905, v8:10201 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2375191 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#69565}
-
- 20 Aug, 2020 1 commit
-
-
Dominik Inführ authored
Heap::UnregisterStrongRoots needs to iterate the list of all strong roots to delete the given slot. This CL changes Heap::RegisterStrongRoots to return the pointer to the linked list node. Heap::UnregisterStrongRoots gets the node as argument and can directly delete it in constant time. The CL also introduces Heap::UpdateStrongRoots which can update a node without locking the mutex. Bug: v8:10315 Change-Id: I2c021517c010a659821f8c10de758bb49b28449f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2364511Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#69499}
-
- 19 Aug, 2020 1 commit
-
-
Salome Thirot authored
When CFI is enabled this adds a check against this list whenever a new return address must be set in a deoptimized frame, as a mitigation for ROP attacks. The list is known at linking time so that its content and the pointer to it can be stored in a read-only memory section. The check is performed in the signing function, which is no longer generic, as well as when setting the current pc of the frame. Since the pc is now only signed when setting the caller's pc, there is no need for ReplaceContext anymore. Bug: v8:10026 Change-Id: I5e85a62b94722051716fdeba476db383c702a318 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2287490Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Rodolph Perfetta <rodolph.perfetta@arm.com> Cr-Commit-Position: refs/heads/master@{#69478}
-
- 06 Aug, 2020 1 commit
-
-
Leszek Swirski authored
Changes the isolate's string table into an off-heap structure. This allows the string table to be resized without allocating on the V8 heap, and potentially triggering a GC. This allows existing strings to be inserted into the string table without requiring allocation. This has two important benefits: 1) It allows the deserializer to insert strings directly into the string table, rather than having to defer string insertion until deserialization completes. 2) It simplifies the concurrent string table lookup to allow resizing the table inside the write lock, therefore eliminating the race where two concurrent lookups could both resize the table. The off-heap string table has the following properties: 1) The general hashmap behaviour matches the HashTable, i.e. open addressing, power-of-two sized, quadratic probing. This could, of course, now be changed. 2) The empty and deleted sentinels are changed to Smi 0 and 1, respectively, to make those comparisons a bit cheaper and not require roots access. 3) When the HashTable is resized, the old elements array is kept alive in a linked list of previous arrays, so that concurrent lookups don't lose the data they're accessing. This linked list is cleared by the GC, as then we know that all threads are in a safepoint. 4) The GC treats the hash table entries as weak roots, and only walks them for non-live reference clearing and for evacuation. 5) Since there is no longer a FixedArray to serialize for the startup snapshot, there is now a custom serialization of the string table, and the string table root is considered unserializable during weak root iteration. As a bonus, the custom serialization is more efficient, as it skips non-string entries. As a drive-by, rename LookupStringExists_NoAllocate to TryStringToIndexOrLookupExisting, to make it clearer that it returns a non-string for the case when the string is an array index. As another drive-by, extract StringSet into a separate header. Bug: v8:10729 Change-Id: I9c990fb2d74d1fe222920408670974a70e969bca Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2339104 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Cr-Commit-Position: refs/heads/master@{#69270}
-
- 05 Aug, 2020 1 commit
-
-
Jakob Gruber authored
With the new Turbofan variants (NCI and Turboprop), we need a way to distinguish between them both during and after compilation. We initially introduced CompilationTarget to track the variant during compilation, but decided to reuse the code kind as the canonical spot to store this information instead. Why? Because it is an established mechanism, already available in most of the necessary spots (inside the pipeline, on Code objects, in profiling traces). This CL removes CompilationTarget and adds a new NATIVE_CONTEXT_INDEPENDENT kind, plus helper functions to determine various things about a given code kind (e.g.: does this code kind deopt?). As a (very large) drive-by, refactor both Code::Kind and AbstractCode::Kind into a new CodeKind enum class. Bug: v8:8888 Change-Id: Ie858b9a53311b0731630be35cf5cd108dee95b39 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2336793 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#69244}
-
- 29 Jul, 2020 1 commit
-
-
Victor Gomes authored
Change-Id: I41be2c5b0867739dbbe3667144bf6b479c609e53 Bug: chromium:1107221 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2322628 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#69122}
-
- 28 Jul, 2020 1 commit
-
-
Mythri A authored
This cl also 1. Fixes a bug in effect-control-linearizer where we should have converted fixed array length from Smi to integer 2. Also prints deopt location for the new "bailout" deopt type on --trace-deopt. Bug: v8:10582, v8:9684 Change-Id: Iafc5e8abbca5252a8783a5a1184a1667a7f708a4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297460 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Sathya Gunasekaran <gsathya@chromium.org> Cr-Commit-Position: refs/heads/master@{#69115}
-
- 22 Jul, 2020 1 commit
-
-
Sathya Gunasekaran authored
This is used by the DynamicCheckMaps operator to indicate that the optimized code should not be thrown away, but instead should be re-run again, after healing the feedback. Bug: v8:10582, v8:9684 Change-Id: Ib2408ba0d1d1a6bf50b2031a5312c7a8cca08730 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2308334 Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68997}
-
- 20 Jul, 2020 1 commit
-
-
Victor Gomes authored
This adapts the deoptimizer to create a correct stack frame when the JS arguments are reversed. Change-Id: Ifc216116ce1e5e469316a22deb8679347e847f4f Bug: v8:10201 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2297382 Commit-Queue: Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#68940}
-
- 07 Jul, 2020 1 commit
-
-
Mythri A authored
In turboprop, we reuse the code on a soft deopt. It will be good to differentiate between a deopt that reuses the optimized code on the next run and the deopt that discards the code. The deopt that reuses the code is called a "bailout" because it is just bails out for one execution to the unoptimized code. Change-Id: I9a300201e9b327415e94c2817065d6a561f8ece5 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277807 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Cr-Commit-Position: refs/heads/master@{#68722}
-
- 01 Jul, 2020 2 commits
-
-
Georg Neis authored
Also fix a typo in a log message. Change-Id: I247e5347b7f7d71b08630489896da463dd76b8a3 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2277885 Auto-Submit: Georg Neis <neis@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#68635}
-
Salome Thirot authored
Modify the output of --trace-deopt to specify which version of the caller's pc (signed with PAC or unsigned) is shown when CFI is enabled. Change-Id: I77006839997a5f50d37d65facbba24d8a86a1509 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2274867 Commit-Queue: Martyn Capewell <martyn.capewell@arm.com> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68629}
-
- 12 Jun, 2020 1 commit
-
-
Georg Neis authored
The condition was too strong since we never store Smis into {previously_materialized_objects}. Bug: chromium:1094132 Change-Id: I680eb7f175f12d3c44882fd8a9eff0d062eda55f Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2241517 Commit-Queue: Georg Neis <neis@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Auto-Submit: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68317}
-
- 09 Jun, 2020 1 commit
-
-
Georg Neis authored
This caused a CHECK failure after my recent CL. Bug: chromium:1084820, chromium:1092650 Change-Id: Icdc2a755c6b30ad01dccc908e0e5e137fedf8918 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2237145Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#68263}
-
- 08 Jun, 2020 1 commit
-
-
Georg Neis authored
Object materialization did not correctly deal with a mismatch between current representation of a field value and expected representation. This is an attempt to repair the situation. Bug: chromium:1084820 Change-Id: Ib337cbaf5e36a5a616b6a6cb0ddf51018d49b96a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2228330 Commit-Queue: Georg Neis <neis@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#68231}
-
- 04 Jun, 2020 1 commit
-
-
Victor Gomes authored
Change-Id: I14632106886f78286034a2624f77cab9dac14b41 Bug: v8:10201 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2219927Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#68179}
-
- 25 May, 2020 1 commit
-
-
Daniel Clifford authored
Change-Id: I092c0d70bf517b4c714f5958b188d54030dd9774 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1932838 Commit-Queue: Daniel Clifford <danno@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#67954}
-
- 17 Mar, 2020 1 commit
-
-
Georgia Kouveli authored
Generate a BTI instruction at each target of an indirect branch (BR/BLR). An indirect branch that doesn't jump to a BTI instruction will generate an exception on a BTI-enabled core. On cores that do not support the BTI extension, the BTI instruction is a NOP. Targets of indirect branch instructions include, among other things, function entrypoints, exception handlers and jump tables. Lazy deopt exits can potentially be reached through an indirect branch when an exception is thrown, so they also get an additional BTI instruction. Bug: v8:10026 Change-Id: I0ebf51071f1b604f60f524096e013dfd64fcd7ff Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1967315 Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Cr-Commit-Position: refs/heads/master@{#66751}
-
- 16 Mar, 2020 1 commit
-
-
Mythri A authored
With the current flow, it is difficult to easily get the output of --trace-opt, --trace-deopt and --trace-osr from Android devices. These flags log to stdout and on Android it is difficult to get this output that preserves the formatting. This cl redirects them to a file when --redirect-code-traces is specified. Change-Id: I8ea1f083d0ee4577f9d70cfd2d7cb2823fd1a6c4 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2089931 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#66722}
-
- 25 Feb, 2020 1 commit
-
-
Victor Gomes authored
Context: This is part of a bigger CL: https://chromium-review.googlesource.com/c/v8/v8/+/2043840 In order to get rid of the arguments adaptor frame, we will reverse the JS arguments in the stack. Some macros will need to reverse its arguments as well, we will do that using helper macros in another CL (see src/builtins/builtins-descriptors.h in 2043840). For that we need to stringify the name kDontAdaptArgumentsSentinel, which cannot be done if '::' is in its name. This CL should not have any impact performace/memory on V8. Bug: v8:10201 Change-Id: If76b7f457c179fbddddfe1a0ae038d2f1210ad2b Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2066969Reviewed-by:
Victor Gomes <victorgomes@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Reviewed-by:
Igor Sheludko <ishell@chromium.org> Auto-Submit: Victor Gomes <victorgomes@chromium.org> Commit-Queue: Tobias Tebbi <tebbi@chromium.org> Cr-Commit-Position: refs/heads/master@{#66432}
-
- 13 Feb, 2020 1 commit
-
-
Georgia Kouveli authored
This is a reland of 137bfe47 Original change's description: > [arm64] Protect return addresses stored on stack > > This change uses the Arm v8.3 pointer authentication instructions in > order to protect return addresses stored on the stack. The generated > code signs the return address before storing on the stack and > authenticates it after loading it. This also changes the stack frame > iterator in order to authenticate stored return addresses and re-sign > them when needed, as well as the deoptimizer in order to sign saved > return addresses when creating new frames. This offers a level of > protection against ROP attacks. > > This functionality is enabled with the v8_control_flow_integrity flag > that this CL introduces. > > The code size effect of this change is small for Octane (up to 2% in > some cases but mostly much lower) and negligible for larger benchmarks, > however code size measurements are rather noisy. The performance impact > on current cores (where the instructions are NOPs) is single digit, > around 1-2% for ARES-6 and Octane, and tends to be smaller for big > cores than for little cores. > > Bug: v8:10026 > Change-Id: I0081f3938c56e2f24d8227e4640032749f4f8368 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1373782 > Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66239} Bug: v8:10026 Change-Id: Id1adfa2e6c713f6977d69aa467986e48fe67b3c2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051958Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> Cr-Commit-Position: refs/heads/master@{#66254}
-
- 12 Feb, 2020 2 commits
-
-
Nico Hartmann authored
This reverts commit 137bfe47. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/13072 Original change's description: > [arm64] Protect return addresses stored on stack > > This change uses the Arm v8.3 pointer authentication instructions in > order to protect return addresses stored on the stack. The generated > code signs the return address before storing on the stack and > authenticates it after loading it. This also changes the stack frame > iterator in order to authenticate stored return addresses and re-sign > them when needed, as well as the deoptimizer in order to sign saved > return addresses when creating new frames. This offers a level of > protection against ROP attacks. > > This functionality is enabled with the v8_control_flow_integrity flag > that this CL introduces. > > The code size effect of this change is small for Octane (up to 2% in > some cases but mostly much lower) and negligible for larger benchmarks, > however code size measurements are rather noisy. The performance impact > on current cores (where the instructions are NOPs) is single digit, > around 1-2% for ARES-6 and Octane, and tends to be smaller for big > cores than for little cores. > > Bug: v8:10026 > Change-Id: I0081f3938c56e2f24d8227e4640032749f4f8368 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1373782 > Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#66239} TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,neis@chromium.org,georgia.kouveli@arm.com Change-Id: I57d5928949b0d403774550b9bf7dc0b08ce4e703 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:10026 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2051952Reviewed-by:
Nico Hartmann <nicohartmann@chromium.org> Commit-Queue: Nico Hartmann <nicohartmann@chromium.org> Cr-Commit-Position: refs/heads/master@{#66242}
-
Georgia Kouveli authored
This change uses the Arm v8.3 pointer authentication instructions in order to protect return addresses stored on the stack. The generated code signs the return address before storing on the stack and authenticates it after loading it. This also changes the stack frame iterator in order to authenticate stored return addresses and re-sign them when needed, as well as the deoptimizer in order to sign saved return addresses when creating new frames. This offers a level of protection against ROP attacks. This functionality is enabled with the v8_control_flow_integrity flag that this CL introduces. The code size effect of this change is small for Octane (up to 2% in some cases but mostly much lower) and negligible for larger benchmarks, however code size measurements are rather noisy. The performance impact on current cores (where the instructions are NOPs) is single digit, around 1-2% for ARES-6 and Octane, and tends to be smaller for big cores than for little cores. Bug: v8:10026 Change-Id: I0081f3938c56e2f24d8227e4640032749f4f8368 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1373782 Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#66239}
-
- 02 Jan, 2020 1 commit
-
-
Peter Marshall authored
Just a cleanup, should not change behavior, although we will allocate more handles in some cases. Also re-orders some of the implementations of the interface to try and keep things consistent. Included cleanup: Change CodeEventDispatcher so that it now implements CodeEventListener, given that it had that exact interface already. Also remove the macro dispatch to try and make things a bit easier to read. Bug: chromium:1033407 Change-Id: Id943b10c49f102d9783d8f4cf3a8c43e04364c77 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1976390Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Clemens Backes <clemensb@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Peter Marshall <petermarshall@chromium.org> Cr-Commit-Position: refs/heads/master@{#65571}
-
- 19 Nov, 2019 1 commit
-
-
Jakob Gruber authored
We recently extended function-entry stack checks by an offset representing the difference in optimized and unoptimized frame sizes, with the intent of avoiding stack overflows during deopts. Although the generated code is very efficient (just a single additional register subtraction, executed exactly once per call), perf impact is measurable. To avoid the overhead in most cases, this CL adds a stack slack, currently set to 256 bytes, by which deopts are allowed to exceed the real V8 stack limit. For function-entry stack checks with an offset less than stack slack, the offset is not applied and the more efficient version of the stack check is emitted. The V8 limit is chosen to be smaller than OS stack size (assumed to be at least 1 MB). This guarantee is upheld even with slack. Bug: chromium:1020989,v8:9534 Change-Id: Idee2e7ad1fa7810bf086a9f72ce00a9717010310 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910099Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Tobias Tebbi <tebbi@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#65025}
-
- 30 Oct, 2019 1 commit
-
-
Jakob Gruber authored
This is a reland of 4a16305b The original CL adjust only one part of the stack check, namely the comparison of the stack pointer against the stack limit in generated code. There is a second part: Runtime::kStackGuard repeats this check to distinguish between a stack overflow and an interrupt request. This second part in runtime must apply the offset just like in generated code. It is implemented in this reland by the StackCheckOffset operator and a new StackGuardWithGap runtime function. Original change's description: > [compiler] Optionally apply an offset to stack checks > > The motivation behind this change is that the frame size of an optimized > function and its unoptimized version may differ, and deoptimization > may thus trigger a stack overflow. The solution implemented in this CL > is to optionally apply an offset to the stack check s.t. the check > becomes 'sp - offset > limit'. The offset is applied to stack checks at > function-entry, and is set to the difference between the optimized and > unoptimized frame size. > > A caveat: OSR may not be fully handled by this fix since we've already > passed the function-entry stack check. A possible solution would be to > *not* skip creation of function-entry stack checks for inlinees. > > This CL: 1. annotates stack check nodes with the stack check kind, where > kind is one of {function-entry,iteration-body,unknown}. 2. potentially > allocates a temporary register to store the result of the 'sp - offset' > in instruction selection (and switches input registers to 'unique' > mode). 3. Applies the offset in code generation. > > Drive-by: Add src/compiler/globals.h for compiler-specific globals. > > Bug: v8:9534,chromium:1000887 > Change-Id: I257191c4a4978ccb60cfa5805ef421f30f0e9826 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762521 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63701} Bug: v8:9534, chromium:1000887 Change-Id: I71771c281afd7d57c09aa48ea1b182d01e6dee2a Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1822037Reviewed-by:
Georg Neis <neis@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#64634}
-
- 11 Oct, 2019 1 commit
-
-
Jakob Kummerow authored
This is for consistency and compiler-enforced type safety. No change in behavior intended. Change-Id: I31467832ba6c63fd5f97df9fee6221559b283d67 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1852766 Commit-Queue: Jakob Kummerow <jkummerow@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Reviewed-by:
Yang Guo <yangguo@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Cr-Commit-Position: refs/heads/master@{#64244}
-
- 27 Sep, 2019 3 commits
-
-
Mythri A authored
This is a reland of cfb10028 with a fix for failures in lite mode. Original change's description: > [compiler] Cache OSR optimized code > > With lazy feedback allocation, for functions that get OSRed we may > not have feedback for the initial part of the functions since feedback > vectors might be allocated after the function started executing. Hence > we would not be able to optimize the function on the next call. This > means we may have to OSR twice before we actually optimize function. > This cl introduces OSR cache, so we could reuse the optimized code. One > side effect of this cl is that the OSRed code won't be function context > specialized anymore. > > Bug: chromium:987523 > Change-Id: Ic1e2abca85ccfa0a66a0fa83f7247392cc1e7cb2 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1796329 > Commit-Queue: Mythri Alle <mythria@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#64014} Bug: chromium:987523 Change-Id: I9c782242b07b24d15247533ab4ee044334b429ff TBR: rmcilroy@chromium.org Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1826898 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#64023}
-
Michael Achenbach authored
This reverts commit cfb10028. Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/6483 Original change's description: > [compiler] Cache OSR optimized code > > With lazy feedback allocation, for functions that get OSRed we may > not have feedback for the initial part of the functions since feedback > vectors might be allocated after the function started executing. Hence > we would not be able to optimize the function on the next call. This > means we may have to OSR twice before we actually optimize function. > This cl introduces OSR cache, so we could reuse the optimized code. One > side effect of this cl is that the OSRed code won't be function context > specialized anymore. > > Bug: chromium:987523 > Change-Id: Ic1e2abca85ccfa0a66a0fa83f7247392cc1e7cb2 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1796329 > Commit-Queue: Mythri Alle <mythria@chromium.org> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#64014} TBR=rmcilroy@chromium.org,neis@chromium.org,mythria@chromium.org Change-Id: Ib3692e7570bed5d3e88ca8a0247b185d70497a04 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: chromium:987523 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1826668Reviewed-by:
Michael Achenbach <machenbach@chromium.org> Commit-Queue: Michael Achenbach <machenbach@chromium.org> Cr-Commit-Position: refs/heads/master@{#64015}
-
Mythri A authored
With lazy feedback allocation, for functions that get OSRed we may not have feedback for the initial part of the functions since feedback vectors might be allocated after the function started executing. Hence we would not be able to optimize the function on the next call. This means we may have to OSR twice before we actually optimize function. This cl introduces OSR cache, so we could reuse the optimized code. One side effect of this cl is that the OSRed code won't be function context specialized anymore. Bug: chromium:987523 Change-Id: Ic1e2abca85ccfa0a66a0fa83f7247392cc1e7cb2 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1796329 Commit-Queue: Mythri Alle <mythria@chromium.org> Reviewed-by:
Ross McIlroy <rmcilroy@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#64014}
-
- 12 Sep, 2019 2 commits
-
-
Jakob Gruber authored
This reverts commit 4a16305b. Reason for revert: Need to revalidate assumptions behind the CHECK. Original change's description: > [compiler] Optionally apply an offset to stack checks > > The motivation behind this change is that the frame size of an optimized > function and its unoptimized version may differ, and deoptimization > may thus trigger a stack overflow. The solution implemented in this CL > is to optionally apply an offset to the stack check s.t. the check > becomes 'sp - offset > limit'. The offset is applied to stack checks at > function-entry, and is set to the difference between the optimized and > unoptimized frame size. > > A caveat: OSR may not be fully handled by this fix since we've already > passed the function-entry stack check. A possible solution would be to > *not* skip creation of function-entry stack checks for inlinees. > > This CL: 1. annotates stack check nodes with the stack check kind, where > kind is one of {function-entry,iteration-body,unknown}. 2. potentially > allocates a temporary register to store the result of the 'sp - offset' > in instruction selection (and switches input registers to 'unique' > mode). 3. Applies the offset in code generation. > > Drive-by: Add src/compiler/globals.h for compiler-specific globals. > > Bug: v8:9534,chromium:1000887 > Change-Id: I257191c4a4978ccb60cfa5805ef421f30f0e9826 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762521 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63701} TBR=neis@chromium.org,sigurds@chromium.org,jgruber@chromium.org Change-Id: Iebf46d5256b6dee13451741781ef85a5fe9b1628 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9534, chromium:1000887 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1800565Reviewed-by:
Jakob Gruber <jgruber@chromium.org> Commit-Queue: Jakob Gruber <jgruber@chromium.org> Cr-Commit-Position: refs/heads/master@{#63706}
-
Jakob Gruber authored
The motivation behind this change is that the frame size of an optimized function and its unoptimized version may differ, and deoptimization may thus trigger a stack overflow. The solution implemented in this CL is to optionally apply an offset to the stack check s.t. the check becomes 'sp - offset > limit'. The offset is applied to stack checks at function-entry, and is set to the difference between the optimized and unoptimized frame size. A caveat: OSR may not be fully handled by this fix since we've already passed the function-entry stack check. A possible solution would be to *not* skip creation of function-entry stack checks for inlinees. This CL: 1. annotates stack check nodes with the stack check kind, where kind is one of {function-entry,iteration-body,unknown}. 2. potentially allocates a temporary register to store the result of the 'sp - offset' in instruction selection (and switches input registers to 'unique' mode). 3. Applies the offset in code generation. Drive-by: Add src/compiler/globals.h for compiler-specific globals. Bug: v8:9534,chromium:1000887 Change-Id: I257191c4a4978ccb60cfa5805ef421f30f0e9826 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762521 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63701}
-
- 09 Sep, 2019 1 commit
-
-
Dominik Inführ authored
Slots are always valid inside an invalidated area when outside the respective object's current size. This allows us to remove the size from the InvalidatedSlots data structure. This change was enabled by https://crrev.com/c/1771793. Reland after revert in https://crrev.com/c/1783106, this CL was not the culprit of the issue (chromium:1000404). Bug: v8:9454 Change-Id: I823d34670515924bf74200daa21a834044087310 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1787431Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#63607}
-
- 03 Sep, 2019 1 commit
-
-
Dominik Inführ authored
This reverts commit 93063ade. Reason for revert: Clusterfuzz found issue. Original change's description: > [heap] Remove size from invalidated slots > > Slots are always valid inside an invalidated area when outside the > respective object's current size. This allows us to remove the size > from the InvalidatedSlots data structure. > > This change was enabled by https://crrev.com/c/1771793. > > Bug: v8:9454 > Change-Id: I2b5a7234d47227cb6ad8d67de20e9b5a2028ae83 > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773242 > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Ulan Degenbaev <ulan@chromium.org> > Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63510} TBR=ulan@chromium.org,sigurds@chromium.org,tebbi@chromium.org,dinfuehr@chromium.org # Not skipping CQ checks because original CL landed > 1 day ago. Bug: v8:9454 Change-Id: I7daf96cf50aaedd4dbdab48fd550182df94e54bf Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1783106Reviewed-by:
Dominik Inführ <dinfuehr@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#63535}
-
- 02 Sep, 2019 1 commit
-
-
Dominik Inführ authored
Slots are always valid inside an invalidated area when outside the respective object's current size. This allows us to remove the size from the InvalidatedSlots data structure. This change was enabled by https://crrev.com/c/1771793. Bug: v8:9454 Change-Id: I2b5a7234d47227cb6ad8d67de20e9b5a2028ae83 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773242Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Commit-Queue: Dominik Inführ <dinfuehr@chromium.org> Cr-Commit-Position: refs/heads/master@{#63510}
-
- 22 Aug, 2019 3 commits
-
-
Jakob Gruber authored
This is a reland of 1e472c42 No change, this was a speculative revert to unblock the roll. TBR=jgruber Original change's description: > [compiler] Track the maximal unoptimized frame size > > This is another step towards considering the unoptimized frame size in > stack checks within optimized code. > > With the changes in this CL, we now keep track of the maximal > unoptimized frame size of the function that is currently being > compiled. An optimized function may inline multiple unoptimized > functions, so a single optimized frame can deopt to multiple > frames. The real frame size thus differs in different parts of the > optimized function. > > We only care about the maximal frame size, which we calculate > conservatively as an over-approximation, and track in > InstructionSelector::max_unoptimized_frame_height_ for now. In future > work, this value will be passed on to codegen, where it will be > applied as an offset to the stack pointer during the stack check. > > (The motivation behind this is to avoid stack overflows through deopts, > caused by size differences between optimized and unoptimized frames.) > > Note that this offset only ensure that the topmost optimized frame can > deopt without overflowing the stack limit. That's fine, because we only > deopt optimized frames one at a time. Other (non-topmost) frames are > only deoptimized once they are returned to. > > Drive-by: Print variable and total frame height in --trace-deopt. > > Bug: v8:9534 > Change-Id: I821684a9da93bff59c20c8ab226105e7e12d93eb > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762024 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Auto-Submit: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63330} Bug: v8:9534 Change-Id: I686f200e7be1f419e23e50789e11607a0b2886d9 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1766645 Commit-Queue: Bill Budge <bbudge@chromium.org> Reviewed-by:
Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#63356}
-
Bill Budge authored
This reverts commit 1e472c42. Reason for revert: Speculative revert, to attempt to fix crashes that block the V8 roll. Example failure run: https://ci.chromium.org/p/chromium/builders/try/linux-rel/173465 Original change's description: > [compiler] Track the maximal unoptimized frame size > > This is another step towards considering the unoptimized frame size in > stack checks within optimized code. > > With the changes in this CL, we now keep track of the maximal > unoptimized frame size of the function that is currently being > compiled. An optimized function may inline multiple unoptimized > functions, so a single optimized frame can deopt to multiple > frames. The real frame size thus differs in different parts of the > optimized function. > > We only care about the maximal frame size, which we calculate > conservatively as an over-approximation, and track in > InstructionSelector::max_unoptimized_frame_height_ for now. In future > work, this value will be passed on to codegen, where it will be > applied as an offset to the stack pointer during the stack check. > > (The motivation behind this is to avoid stack overflows through deopts, > caused by size differences between optimized and unoptimized frames.) > > Note that this offset only ensure that the topmost optimized frame can > deopt without overflowing the stack limit. That's fine, because we only > deopt optimized frames one at a time. Other (non-topmost) frames are > only deoptimized once they are returned to. > > Drive-by: Print variable and total frame height in --trace-deopt. > > Bug: v8:9534 > Change-Id: I821684a9da93bff59c20c8ab226105e7e12d93eb > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762024 > Commit-Queue: Jakob Gruber <jgruber@chromium.org> > Auto-Submit: Jakob Gruber <jgruber@chromium.org> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org> > Reviewed-by: Georg Neis <neis@chromium.org> > Cr-Commit-Position: refs/heads/master@{#63330} TBR=neis@chromium.org,sigurds@chromium.org,jgruber@chromium.org Change-Id: I7b225c30bfc4e1d958276583f512a1ec5fa2b458 No-Presubmit: true No-Tree-Checks: true No-Try: true Bug: v8:9534 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1764626Reviewed-by:
Bill Budge <bbudge@chromium.org> Commit-Queue: Bill Budge <bbudge@chromium.org> Cr-Commit-Position: refs/heads/master@{#63350}
-
Jakob Gruber authored
This is another step towards considering the unoptimized frame size in stack checks within optimized code. With the changes in this CL, we now keep track of the maximal unoptimized frame size of the function that is currently being compiled. An optimized function may inline multiple unoptimized functions, so a single optimized frame can deopt to multiple frames. The real frame size thus differs in different parts of the optimized function. We only care about the maximal frame size, which we calculate conservatively as an over-approximation, and track in InstructionSelector::max_unoptimized_frame_height_ for now. In future work, this value will be passed on to codegen, where it will be applied as an offset to the stack pointer during the stack check. (The motivation behind this is to avoid stack overflows through deopts, caused by size differences between optimized and unoptimized frames.) Note that this offset only ensure that the topmost optimized frame can deopt without overflowing the stack limit. That's fine, because we only deopt optimized frames one at a time. Other (non-topmost) frames are only deoptimized once they are returned to. Drive-by: Print variable and total frame height in --trace-deopt. Bug: v8:9534 Change-Id: I821684a9da93bff59c20c8ab226105e7e12d93eb Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762024 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Auto-Submit: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Reviewed-by:
Georg Neis <neis@chromium.org> Cr-Commit-Position: refs/heads/master@{#63330}
-
- 20 Aug, 2019 2 commits
-
-
Leszek Swirski authored
Since the mutability of HeapNumbers is determined by their owning object's descriptor array, we can remove the MutableHeapNumber type entirely, at the cost of a few fewer DCHECKs and a couple of TODOs to use the descriptor array information. This is a necessary step towards a follow-up which allows in-place Double -> Tagged transitions Design doc: https://docs.google.com/document/d/1VeKIskAakxQFnUBNkhBmVswgR7Vk6T1kAyKRLhqerb4/ Bug: v8:9606 Change-Id: I13209f9c86f1f204088f6fd80089e17d956b4a50 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743972 Commit-Queue: Leszek Swirski <leszeks@chromium.org> Reviewed-by:
Ulan Degenbaev <ulan@chromium.org> Reviewed-by:
Michael Starzinger <mstarzinger@chromium.org> Reviewed-by:
Toon Verwaest <verwaest@chromium.org> Cr-Commit-Position: refs/heads/master@{#63294}
-
Jakob Gruber authored
The deoptimizer calculates frame layout based on the translation's `height` field, together with additional data (e.g.: are we looking at the topmost frame? what kind of deopt are we in?). The result is the final deoptimized frame size in bytes, together with a bunch of intermediate results such as the variable frame size (= without the fixed-size portion). In order to consider the deoptimized frame size in optimized stack checks, we will need to calculate the frame layout during compilation in addition to what we currently do during deoptimization. This CL moves in that direction by extracting relevant parts of frame layout calculation into classes that can be reused by both compiler and deoptimizer. These helpers will support both precise and conservative modes; the deoptimizer will use the precise mode (since it has full information), while the instruction selector will use the conservative mode. Bug: v8:9534 Change-Id: I93d6c39f10d251733f4625d3cc161b2010652d02 Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760825 Commit-Queue: Jakob Gruber <jgruber@chromium.org> Reviewed-by:
Sigurd Schneider <sigurds@chromium.org> Cr-Commit-Position: refs/heads/master@{#63279}
-