1. 07 Oct, 2020 18 commits
    • Camillo Bruni's avatar
      [mjsunit][tools] Sync module files for tests · f3c77929
      Camillo Bruni authored
      - Update file list in andrdoid-sync.sh
      - Update testcase.py module resources regexp to handle more import cases
      
      Bug: v8:10668
      Change-Id: I801464336b9a149ca1393d120c3332e5dc1f6345
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2442612Reviewed-by: 's avatarMichael Achenbach <machenbach@chromium.org>
      Commit-Queue: Michael Achenbach <machenbach@chromium.org>
      Auto-Submit: Camillo Bruni <cbruni@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70380}
      f3c77929
    • Jakob Kummerow's avatar
      [mac] Set MAP_JIT only when necessary · 4e077ff0
      Jakob Kummerow authored
      This is a "minimal" change to achieve the required goal: seeing that
      there is only one place where we need to indicate that memory should
      be reserved with MAP_JIT, we can add a value to the Permissions enum
      instead of adding a second, orthogonal parameter.
      That way we avoid changing public API functions, which makes this CL
      easier to undo once we have platform-independent w^x in Wasm.
      
      Bug: chromium:1117591
      Change-Id: I6333d69ab29d5900c689f08dcc892a5f1c1159b8
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2435365
      Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Reviewed-by: 's avatarClemens Backes <clemensb@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70379}
      4e077ff0
    • Victor Gomes's avatar
      [compiler,x64] Fix AssembleReturn for multiple returns · 9d3c26f4
      Victor Gomes authored
      Change-Id: I9d226483a7f8cd82ef42eba56d9a069b16d622fc
      Bug: chromium:1133701
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2449978
      Commit-Queue: Victor Gomes <victorgomes@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70378}
      9d3c26f4
    • Santiago Aboy Solanes's avatar
      [compiler] Move instance_descriptors synchronized setter to private · 111cbd98
      Santiago Aboy Solanes authored
      In a previous CL (crrev.com/c/v8/v8/+/2424130/17/src/objects/map.h) I
      moved it to public to use the parent macro. Move it back to private
      since it does not need to be public.
      
      Bug: v8:7790
      Change-Id: I5fd78a8fcef2bd454585b6dc428c1b1d2bb62422
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454715
      Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
      Reviewed-by: 's avatarGeorg Neis <neis@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70377}
      111cbd98
    • Jakob Gruber's avatar
      Revert "[nci] Prepare JSForInPrepare and JSForInNext for feedback input" · 7c4cc5ed
      Jakob Gruber authored
      This reverts commit 16cd5995.
      
      Reason for revert: Can't be landed without also implementing generic lowering, see https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20fyi/18261.
      
      Original change's description:
      > [nci] Prepare JSForInPrepare and JSForInNext for feedback input
      >
      > These two operators are still missing feedback collection in generic
      > lowering (reminder: all operations that collect FB in the interpreter
      > must also collect FB in generic lowering).
      >
      > This CL prepares for that by adding the feedback vector as an input,
      > and additionally adds node wrappers to improve useability.
      >
      > The actual collection logic will be added in a following CL.
      >
      > Bug: v8:8888
      > Change-Id: I04627eedb2dc237dc4e417091c44d2a95bd98f5f
      > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454712
      > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
      > Cr-Commit-Position: refs/heads/master@{#70372}
      
      TBR=jgruber@chromium.org,leszeks@chromium.org,tebbi@chromium.org
      
      Change-Id: Ibff2bf44eb04bebd982b019b4539275db75c611a
      No-Presubmit: true
      No-Tree-Checks: true
      No-Try: true
      Bug: v8:8888
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454078Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70376}
      7c4cc5ed
    • Omer Katz's avatar
      cppgc, jobs: Update job priority · 4cb4a229
      Omer Katz authored
      This CL aligns the library implementation with the blink implementation:
      (*) Concurrent marking increases job priority if no concurrent progress
          is made in the last 50% of the expected marking duration.
      (*) Concurrent sweeping increases job priority when calling
          FinishIfRunning (the library equivalent of blink's CompleteSweep).
      
      Bug: chromium:1056170
      Change-Id: Ice275cb90a7dd76bf4125f4338d9d80e5f576c58
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2431572
      Commit-Queue: Omer Katz <omerkatz@chromium.org>
      Reviewed-by: 's avatarMichael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70375}
      4cb4a229
    • Ross McIlroy's avatar
      [TurboProp] Add support for deferred block spills in fast reg alloc · 4a601911
      Ross McIlroy authored
      Adds support for avoiding spills in non-deferred blocks by instead
      restricting the spill ranges to deferred blocks if the virtual
      register is only spilled in deferred blocks.
      
      It does this by tracking registers that reach the exit point of deferred
      blocks and spilling them them pre-emptively in the deferred block while
      treating them as committed from the point of view of the non-deferred
      blocks. We also now track whether virtual registers need to be spilled
      at their SSA definition point (where they are output by an instruction),
      or can instead be spilled at the entry to deferred blocks for use as
      spill slots within those deferred blocks. In both cases, the tracking
      of these deferred spills is kept as a pending operation until the
      allocator confirms that adding these spills will avoid spills in the
      non-deferred pathways, to avoid adding unnecessary extra spills in
      deferred blocks.
      
      BUG=v8:9684
      
      Change-Id: Ib151e795567f0e4e7f95538415a8cc117d235b64
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440603
      Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70374}
      4a601911
    • Jakob Gruber's avatar
      [nci] Fix a DCHECK failure related to OSR · a19cf8e2
      Jakob Gruber authored
      This removes a DCHECK that is no longer valid now that NCI jobs can
      also be spawned by OSR requests.
      
      Bug: v8:8888
      Change-Id: I84eed41b510cc9c3ab1b35abfda0b6bec88752dd
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454714
      Auto-Submit: Jakob Gruber <jgruber@chromium.org>
      Commit-Queue: Mythri Alle <mythria@chromium.org>
      Reviewed-by: 's avatarMythri Alle <mythria@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70373}
      a19cf8e2
    • Jakob Gruber's avatar
      [nci] Prepare JSForInPrepare and JSForInNext for feedback input · 16cd5995
      Jakob Gruber authored
      These two operators are still missing feedback collection in generic
      lowering (reminder: all operations that collect FB in the interpreter
      must also collect FB in generic lowering).
      
      This CL prepares for that by adding the feedback vector as an input,
      and additionally adds node wrappers to improve useability.
      
      The actual collection logic will be added in a following CL.
      
      Bug: v8:8888
      Change-Id: I04627eedb2dc237dc4e417091c44d2a95bd98f5f
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454712
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70372}
      16cd5995
    • Michael Lippautz's avatar
      heap: Fix metric around corner case of fast marking · 12776afc
      Michael Lippautz authored
      Bug: v8:10956
      Change-Id: Iab17e3f0163aa81cfb978d72e0f0cd9b15c14743
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2454716Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70371}
      12776afc
    • Martin Bidlingmaier's avatar
      [regexp] Handle interrupts in experimental interpreter · f3a666d6
      Martin Bidlingmaier authored
      No surprises; very much based on interrupt handling in the irregexp
      interpreter.
      
      Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
      Bug: v8:10765
      Change-Id: I2353cac4639a494362b8dfdf9507985fb6298c0e
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2452710Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Commit-Queue: Martin Bidlingmaier <mbid@google.com>
      Cr-Commit-Position: refs/heads/master@{#70370}
      f3a666d6
    • Camillo Bruni's avatar
      [runtime][module] Change Module::Reset order · 7be8692e
      Camillo Bruni authored
      Allocating in the right spot leaves the Module in an invalid state.
      Do allocations before resetting a module.
      
      Drive-by-fix: make module verification check failures easier to debug.
      
      Bug: v8:10985
      Change-Id: I6fc32c96441958755bfb32b3004e1bb616dc7d98
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2452533Reviewed-by: 's avatarVictor Gomes <victorgomes@chromium.org>
      Commit-Queue: Camillo Bruni <cbruni@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70369}
      7be8692e
    • Clemens Backes's avatar
      [wasm][cleanup] Remove redundant inline annotations · 2547edd6
      Clemens Backes authored
      Methods defined within a class declaration are always inline by default,
      hence remove the redundant annotations.
      
      R=thibaudm@chromium.org
      
      Change-Id: I08e86996bad9596936220da849cdfaec5fffe1f9
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2449970Reviewed-by: 's avatarThibaud Michaud <thibaudm@chromium.org>
      Commit-Queue: Clemens Backes <clemensb@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70368}
      2547edd6
    • Frank Emrich's avatar
      [dict-proto] Add v8_dict_mode_prototypes build flag · 31d52a7e
      Frank Emrich authored
      This adds a flag behind which we want to do the work towards allowing
      prototype objects to stay in dict/"slow" mode rather than switching
      them back to fast mode
      
      Bug: v8:7569
      
      Change-Id: I3c963dea5d01be3c348810f40f8610fc2a488819
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2450015Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Commit-Queue: Frank Emrich <emrich@google.com>
      Cr-Commit-Position: refs/heads/master@{#70367}
      31d52a7e
    • Leszek Swirski's avatar
      Reland^4 "[serializer] Allocate during deserialization" · 3c508b38
      Leszek Swirski authored
      This relands commit 3f4e9bbe.
      which was a reland of c4a062a9
      which was a reland of 28a30c57
      which was a reland of 5d7a29c9
      
      The change had an issue that embedders implementing heap tracing (e.g.
      Unified Heap with Blink) could be passed an uninitialized pointer if
      marking happened during deserialization of an object containing such a
      pointer. Because of the 0xdeadbed0 uninitialized filler value, these
      embedders would then receive the value 0xdeadbed0deadbed0 as the
      'pointer', and crash on dereference.
      
      There is, however, special handling already for null pointers in heap
      tracing, also for dealing with not-yet initialized values. So, we can
      make the uninitialized Smi filler be 0x00000000, and that will make such
      embedded fields have a nullptr representation, making them follow the
      normal uninitialized value bailouts.
      
      In addition, it relands the following dependent changes, which are
      relanding unchanged and are followup performance improvements.
      Relanding them in the same change should allow for cleaner reverts
      should they be needed.
      
      This relands commit 76ad3ab5
      [identity-map] Change resize heuristic
      
      This relands commit 77cc96aa
      [identity-map] Cache the calculated Hash
      
      This relands commit bee5b996
      [serializer] Remove Deserializer::Initialize
      
      This relands commit c8f73f22
      [serializer] Cache instance type in PostProcessNewObject
      
      This relands commit 4e7c99ab
      [identity-map] Remove double-lookups in IdentityMap
      
      Original change's description:
      > Reland^3 "[serializer] Allocate during deserialization"
      >
      > This is a reland of c4a062a9
      > which was a reland of 28a30c57
      > which was a reland of 5d7a29c9
      >
      > Fixes TSAN errors from non-atomic writes in the deserializer. Now all
      > writes are (relaxed) atomic.
      >
      > Original change's description:
      > > Reland^2 "[serializer] Allocate during deserialization"
      > >
      > > This is a reland of 28a30c57
      > > which was a reland of 5d7a29c9
      > >
      > > The crashes were from calling RegisterDeserializerFinished on a null
      > > Isolate pointer, for a deserializer that was never initialised
      > > (specifically, ReadOnlyDeserializer when ROHeap is shared).
      > >
      > > Original change's description:
      > > > Reland "[serializer] Allocate during deserialization"
      > > >
      > > > This is a reland of 5d7a29c9
      > > >
      > > > This reland shuffles around the order of checks in Heap::AllocateRawWith
      > > > to not check the new space addresses until it's known that this is a new
      > > > space allocation. This fixes an UBSan failure during read-only space
      > > > deserialization, which happens before the new space is initialized.
      > > >
      > > > It also fixes some issues discovered by --stress-snapshot, around
      > > > serializing ThinStrings (which are now elided as part of serialization),
      > > > handle counts (I bumped the maximum handle count in that check), and
      > > > clearing map transitions (the map backpointer field needed a Smi
      > > > uninitialized value check).
      > > >
      > > > Original change's description:
      > > > > [serializer] Allocate during deserialization
      > > > >
      > > > > This patch removes the concept of reservations and a specialized
      > > > > deserializer allocator, and instead makes the deserializer allocate
      > > > > directly with the Heap's Allocate method.
      > > > >
      > > > > The major consequence of this is that the GC can now run during
      > > > > deserialization, which means that:
      > > > >
      > > > >   a) Deserialized objects are visible to the GC, and
      > > > >   b) Objects that the deserializer/deserialized objects point to can
      > > > >      move.
      > > > >
      > > > > Point a) is mostly not a problem due to previous work in making
      > > > > deserialized objects "GC valid", i.e. making sure that they have a valid
      > > > > size before any subsequent allocation/safepoint. We now additionally
      > > > > have to initialize the allocated space with a valid tagged value -- this
      > > > > is a magic Smi value to keep "uninitialized" checks simple.
      > > > >
      > > > > Point b) is solved by Handlifying the deserializer. This involves
      > > > > changing any vectors of objects into vectors of Handles, and any object
      > > > > keyed map into an IdentityMap (we can't use Handles as keys because
      > > > > the object's address is no longer a stable hash).
      > > > >
      > > > > Back-references can no longer be direct chunk offsets, so instead the
      > > > > deserializer stores a Handle to each deserialized object, and the
      > > > > backreference is an index into this handle array. This encoding could
      > > > > be optimized in the future with e.g. a second pass over the serialized
      > > > > array which emits a different bytecode for objects that are and aren't
      > > > > back-referenced.
      > > > >
      > > > > Additionally, the slot-walk over objects to initialize them can no
      > > > > longer use absolute slot offsets, as again an object may move and its
      > > > > slot address would become invalid. Now, slots are walked as relative
      > > > > offsets to a Handle to the object, or as absolute slots for the case of
      > > > > root pointers. A concept of "slot accessor" is introduced to share the
      > > > > code between these two modes, and writing the slot (including write
      > > > > barriers) is abstracted into this accessor.
      > > > >
      > > > > Finally, the Code body walk is modified to deserialize all objects
      > > > > referred to by RelocInfos before doing the RelocInfo walk itself. This
      > > > > is because RelocInfoIterator uses raw pointers, so we cannot allocate
      > > > > during a RelocInfo walk.
      > > > >
      > > > > As a drive-by, the VariableRawData bytecode is tweaked to use tagged
      > > > > size rather than byte size -- the size is expected to be tagged-aligned
      > > > > anyway, so now we get an extra few bits in the size encoding.
      > > > >
      > > > > Bug: chromium:1075999
      > > > > Change-Id: I672c42f553f2669888cc5e35d692c1b8ece1845e
      > > > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2404451
      > > > > Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      > > > > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
      > > > > Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
      > > > > Cr-Commit-Position: refs/heads/master@{#70229}
      
      Bug: chromium:1075999
      Change-Id: Ib514a4ef16bd02bfb60d046ecbf8fae1ead64a98
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2452689
      Commit-Queue: Leszek Swirski <leszeks@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarJakob Gruber <jgruber@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70366}
      3c508b38
    • Leszek Swirski's avatar
      [ptr-cmpr] Change `const Isolate*` to `IsolateRoot` · 9e26f705
      Leszek Swirski authored
      Introduce an IsolateRoot class, which encapsulates the root address
      needed for pointer decompression. This class is implicitly constructible
      from both Isolate* and LocalIsolate*, allowing us to avoid templating
      methods that can take both, or awkwardly creating a `const Isolate*`
      from a `LocalIsolate*` just for getters.
      
      Change-Id: I6d4b9492409fc7d5b375162e381192cb48c8ba01
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2440605
      Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarUlan Degenbaev <ulan@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Reviewed-by: 's avatarIgor Sheludko <ishell@chromium.org>
      Auto-Submit: Leszek Swirski <leszeks@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70365}
      9e26f705
    • Jakob Gruber's avatar
      [nci] Also spawn NCI tasks for OSR requests · ec76fb0f
      Jakob Gruber authored
      In addition to normal optimization requests, it also makes sense to
      consider OSR requests. In that case, the function is definitely hot,
      and since we've seen it OSR (i.e. we spend a long time inside a loop
      in the interpreted function), immediately jumping into NCI code in
      future contexts would be great.
      
      Future work: support OSR from NCI to TF.
      
      Bug: v8:8888
      Change-Id: Iaa4c60bc0c2e1bf3dc067053bb7b50e9af51c0d1
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2448462
      Commit-Queue: Jakob Gruber <jgruber@chromium.org>
      Reviewed-by: 's avatarTobias Tebbi <tebbi@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70364}
      ec76fb0f
    • Michael Achenbach's avatar
      [test] Overhaul mode processing in test runner · 608b732d
      Michael Achenbach authored
      This simplifies mode processing as follows:
      - Passing the --mode parameter is deprecated.
      - The build output is now only searched in the --outdir parameter
      that was passed (previously some combinations of mode and outdir
      were possible).
      - The mode is deduced from the build artifacts based on the gn
      arguments "is_debug" and "dcheck_always_on".
      - Timeouts and status file entries in release mode with dchecks are
      treated like in debug mode.
      
      This change was prepared on the infrastructure side by deprecating
      the --mode flag and passing --outdir=out/build:
      https://crrev.com/c/2426643
      
      Bug: chromium:1132088, v8:10893
      Change-Id: I0f34ebc003b220f07df4ecdbf69ea6c06ac1f66a
      Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2450016Reviewed-by: 's avatarJakob Kummerow <jkummerow@chromium.org>
      Commit-Queue: Michael Achenbach <machenbach@chromium.org>
      Cr-Commit-Position: refs/heads/master@{#70363}
      608b732d
  2. 06 Oct, 2020 22 commits