It doesn't test anything new, just as a minimal test case to debug if
all wasm deopts tests fail.
This might also be helpful for anybody (including me) having to port
the deoptimization entry to other platforms than the already
implemented x64 builtin.
Bug: 42204618
Change-Id: I97f1da3e6723c107579211921f9473a22c0cf3e4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5623151
Reviewed-by: Daniel Lehmann <dlehmann@chromium.org>
Commit-Queue: Daniel Lehmann <dlehmann@chromium.org>
Auto-Submit: Matthias Liedtke <mliedtke@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94392}
This is a reland of commit be4d52e12f
Original change's description:
> Retrieve native context from known fields
>
> When using `typeof %LeakHole()` in testing code we would try to
> generate a stack trace via `Runtime_Abort()` without setting the
> native context on the Isolate. However, all the places that need the
> native context have it already available in some form. Fix these
> callsites.
>
> Bug: 345970375
> Change-Id: Idab1ba5416cb8e931056cb3f7aded1c526096e91
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5617530
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#94370}
Bug: 345970375
Change-Id: I3d2b50f70307dadedda54a1fdfd0dada0b793250
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5623373
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94389}
GCs do not need to set up an AlwaysAllocateScope anymore to ignore
current allocation limits.
Heap::ShouldExpandOldGenerationOnSlowAllocation already always
allows GC allocations.
Bug: chromium:1480975
Change-Id: I49dc580ab8257f468c7af8ca337819e7d46a8315
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5611831
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94387}
A corrupted sandbox might confuse the type feedback processor
into inlining the wrong function, so the inlining mechanism
should check to make sure the inlining candidate's signature
is compatible with the call.
Bug: 336507783
Change-Id: I5fb99b7894f060a2bcc754349175e2570b5a6045
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621153
Commit-Queue: Matthias Liedtke <mliedtke@chromium.org>
Reviewed-by: Matthias Liedtke <mliedtke@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94386}
JS runtime calls are a vestige of the days when V8 had part
of its runtime implemented in JavaScript. This cleanup CL
removes parser/AST support JS runtime calls and removes the
special-casing for those slots in native contexts.
There are still two uses of CallJSRuntime in the interpreter, but
they hardcode their context indices. This CL updates the unittests
to hardcode the same indices for printing bytecode expectations.
Change-Id: I05756bf6575bcb93b0e9a89407a7239fb0f5b30d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5590413
Commit-Queue: Adam Klein <adamk@chromium.org>
Auto-Submit: Adam Klein <adamk@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94384}
If a block we'd be jumping to is uninteresting (empty + just an
unconditional jump to some other block + no phis or register
merges + ...), we replace the jump with a jump to its successor.
Bug: v8:7700
Change-Id: Idfcfd9c3f68f3219ca308683861d4fb984e69246
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5606424
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94383}
This ports the recently introduced signature verification from
call_ref to compiled (i.e. non-generic) js-to-wasm wrappers, to
prevent escaping from a corrupted sandbox by calling broken Wasm
functions from JS.
Bug: 336507783
Change-Id: I2946424b39ca345ab6f6d31ad8308327cd5be1e5
Fixed: 336009921
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5622490
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94382}
The signature-specific export wrappers load the target and ref from the
import dispatch table or from the function data depending on whether the
target is a re-exported import or an internal function. But the target
and ref from the function data is more generic and also works for
re-exported imports.
In fact wrapper tier-up may accidentally replace an export wrapper
compiled for an import with an export wrapper compiled for an internal
function, but we did not notice it because the latter still works.
However the other way around does not work. The wrapper compiled for a
re-exported import uses the dispatch table, which breaks if the target
is not an import. This happens if we try to enable the generic wrapper
for re-exported imports.
Remove the import-specific path entirely since the other one is more
generic, which allows us to use the generic wrapper for re-exported
imports and will reduce the number of wrappers that we need to compile.
R=jkummerow@chromium.org
Bug: 343772336
Change-Id: I54446f38971167a5128521027939707ac20d1a86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5604484
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94380}
This CL migrates a large number of handles to direct handles. The
changes are only relevant for builds with v8_enable_direct_handle=true.
Affected directories: test.
Bug: 42203211
Change-Id: Ie9fb3d5b3c66ea9ffa0092d928256aa3891c9a9a
Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5622011
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94378}
Allow configuring the number of embedder fields ArrayBuffer and
ArrayBufferView objects have. Blink doesn't need these extra fields
anymore and we can save some space and speed up GC processing. Retain
ability for embedders to use the fields though via gn arg.
Bug: 346350847
Change-Id: I48e56de316ae932a43012c0736fd36ea6e9c80ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621990
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94377}
This tier-up path assumed that we don't have an instance. However this
is only true when the WasmFuncRef was created for a WebAssembly.Function
object.
For call refs to an internal wasm function, we do have an instance, and
the signature may contain indexed ref types, which requires that we pass
the module to the wrapper graph builder.
This will also allow some simplifications when we enable the generic
wrapper for re-exported imports again.
R=ahaas@chromium.org
Bug: 343917751
Change-Id: I23d69f0db98edd43494bcd08763b4bef9c7f0e0c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621892
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94376}
Add a variadic templated C++ union type similar to torque's unions,
which encapsulates a value that is one of a limited set of V8 types.
Tagged pointers to a Union type can be cast (casted?) to one of the
types in the Union in order to access that value, or indeed to a
sub-Union if necessary.
Unions are connected to their types using the `is_subtype` type_trait,
which is substantially expanded to keep working (in trivial cases)
when its types are only forward declared. The sub-type relation for
a Union and another type defines a partial order, as one would expect,
where:
1. Union<T...> is a subtype of U if all T are subtypes of U
2. U is a subtype of Union<T...> if for any T, U is a subtype of T
This type is used, initially, as follows:
1. Torque union types now generate a Union<...> instead of deferring
to the parent class
2. C++ defines typedefs for Number, Numeric, JSPrimitive, JSAny, and
JSCallable. Notably, Object is not (yet?) a Union of Smi and
HeapObject, as we need to decide what to do with the static
methods on the Object class.
3. Union<...> subsumes the UnionT<T,U> types in TNodes and
Turboshaft.
The bulk of the changes in this patch are propagations of types
necessary to satisfy newly strict requirements of torque-generated
functions (in particular, setters). There is also a partial progress on
making Object::NumberValue take a Number rather than an Object, as a
proof-of-concept for Number.
Change-Id: I87868f65eba43a3b5cbda6c0bf5e16e62a8225c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5600543
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94373}
When using `typeof %LeakHole()` in testing code we would try to
generate a stack trace via `Runtime_Abort()` without setting the
native context on the Isolate. However, all the places that need the
native context have it already available in some form. Fix these
callsites.
Bug: 345970375
Change-Id: Idab1ba5416cb8e931056cb3f7aded1c526096e91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5617530
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94370}
flags2 can be set by the mainthread during a deopt request, while the
background thread tries to read it for the
function_context_independent_compiled bit.
This usually cannot happen because both Maglev and Turbofan read this
field on the main thread. However, in the Maglev->Turboshaft
translation, this is read in the background.
This CL fixes this by avoiding re-reading this field and instead using
the already computed specialize_to_function_context field of the
Turbofan OptimizedCompilationInfo.
Fixed: chromium:346358298
Change-Id: I13d80c30430e7953280a14b3a164879f92e919fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621030
Reviewed-by: Olivier Flückiger <olivf@chromium.org>
Auto-Submit: Darius Mercadier <dmercadier@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94369}
... and a notion of "special data property" which used to represent
JavaScript spec compliant native data properties. Now all data
properties in V8 are spec-compliant.
Drive-by:
- remove deprecated typedefs v8::AccessorGetterCallback and
v8::AccessorSetterCallback,
- start deprecation of v8::AccessControl enum.
Bug: 336325111
Change-Id: Ie31ac57b40a4fdd5277aaa6e0283a68fb4a0daac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5607994
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94367}
This is a reland of commit 86bc438834
Fix: we don't have a map for the rest parameter, so we only
allow to forward the arguments object if the map is a JSArray
and elements array is ArgumentsElements.
Original change's description:
> [maglev] Fix VirtualObject refactoring
>
> - VirtualObject::slot_count does not include the Map. We need to add +1
> when the map count should be included.
>
> - We forgot to patch the nested allocations back to the object
> graph.
>
> Fixed: 346042378
> Change-Id: I54e06a82a9324a55902b720e8188b6b8ec2c22bd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5614730
> Commit-Queue: Victor Gomes <victorgomes@chromium.org>
> Auto-Submit: Victor Gomes <victorgomes@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#94341}
Change-Id: Iaf6cd204c73ae6bd0b495af5196d1232b7d72ef9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5621050
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94366}
This CL migrates a large number of handles to direct handles. The
changes are only relevant for builds with v8_enable_direct_handle=true.
Affected source directories: ast, baseline, codegen, compiler, d8,
diagnostics, extensions, ic, init, interpreter, logging, maglev,
parsing, profiler.
Bug: 42203211
Change-Id: I3ca12892acfe45f8458d19aa4cbd56ad01842c0a
Cq-Include-Trybots: luci.v8.try:v8_linux64_css_dbg
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5615411
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Omer Katz <omerkatz@chromium.org>
Commit-Queue: Nikolaos Papaspyrou <nikolaos@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94363}
Due to a typo we would not pick the correct generalized FieldType in
UpdateField. Only when following side-step transitions it can happen
that a more generalized field type is needed.
Fixed: 346411877
Change-Id: I35d1073a253a1917a09aea0c3e62dc6e46036168
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5620971
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Olivier Flückiger <olivf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94362}
Simplification:
- a tighter intergration with the ApiCallbackExitFrame's layout,
where the v8::FunctionCallbackInfo<T> object and its fields have
dedicated locations addressable via fp,
- unification of the Generic and Optimized versions of the builtin,
- don't store the number of bytes to drop on the stack, use
FunctionCallbackInfo::length_ instead,
- cleaner code,
- it's no longer necessary to attach a frame state when inlining an
Api call into optimized code in order to support
--experimental-stack-trace-frames.
Optimization:
- avoid passing argc and v8::FunctionTemplateInfo twice to the Generic
version,
- less code for both generic and optimized versions.
Bug: 326505377
Change-Id: I426459f2784e42c0b1bfcb39259fd04e3512feea
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5587866
Reviewed-by: Patrick Thier <pthier@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94361}
This CL supports trusted-to-shared-trusted pointers by adding a
write barrier for such stores. The GC tracks such references in the
TRUSTED_TO_SHARED_TRUSTED remembered set.
Shared GCs will iterate those remembered sets for all client
isolates. This is not necessary for the main isolate because here we
anyways mark the whole heap. However, the main isolate still records
those slots in the same remembered set and the heap verifier also
checks that the slots are properly recorded. This should increase
test coverage for the write barrier.
In addition this CL also enables sweeping for the trusted space. So
far pages in the trusted space were never swept by accident.
Bug: 338342768
Change-Id: I1722e52a10806408b85f6eb12f92e1b668e1dfff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5599196
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94360}
This CL fixes the --gc-interval command line flag which was
supposed to trigger GCs more frequently. Since this was not really
happening, we might now trigger GCs in more locations and thus
might flush out some pre-existing issues.
In the linked bug --gc-interval was not triggering GCs because
AllocateRawWith() was invoking AllocateRaw() twice without performing
a GC in-between. Assuming allocation_timeout_ was 1 before the first
call to AllocateRaw(), the first call to AllocateRaw() decreased the
counter to 0. AllocateRawWith() then invokes AllocateRaw() again at
the beginning of AllocateRawWithLightRetrySlowPath(). In the second
call allocation_timeout_ is then 0, AllocateRaw() therefore assumes
the allocation timeout is disabled and the second allocation
subsequently succeeds.
This CL fixes this by turning allocation_timeout_ into
base::Optional<int>. With this change both invocations of
AllocateRaw() observe the allocation timeout as enabled and both
invocations let the allocation fail because of this.
Bug: 346197733
Change-Id: Ic5987a9fb83320a145b04271e5631e50410c3572
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5613990
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Reviewed-by: Darius Mercadier <dmercadier@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94357}
if possible."
This is a reland of commit aabb0de7fe
Original change's description:
> [maglev] Avoid call to ObjectPrototypeHasOwnProperty builtin if
> possible.
>
> If the input "key" of the "object.prototype.hasownproperty" JSCall
> comes from enum cache and the receiver is a heap constant, then we
> can replace the ObjectPrototypeHasOwnProperty builtin call with some
> compare and jump instructions.
>
> This CL can bring ~50% improvement on this micro case below:
> (just run maglev code with "--no-turbofan" flag)
> -----------------------------------
> const RESERVED_PROPS = {
> key: true,
> ref: true,
> __self: true,
> __source: true,
> };
>
> function foo(config) {
> let i = 0;
> let propName;
> const props = {};
> for (propName in config) {
> if (!RESERVED_PROPS.hasOwnProperty(propName)) {
> i = i + 1;
> }
> }
> return i;
> }
> -----------------------------------
Change-Id: I49329a1955c593e440da995ae17fe287b483e739
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5602113
Commit-Queue: Jialu Zhang <jialu.zhang@intel.com>
Reviewed-by: Victor Gomes <victorgomes@chromium.org>
Cr-Commit-Position: refs/heads/main@{#94351}
NotAlexNoyle
Matthias Liedtke
Hao Xu
Igor Sheludko
Michael Lippautz
Marja Hölttä
Dominik Inführ
Jakob Kummerow
Adam Klein
v8-ci-autoroll-builder
Thibaud Michaud
Leszek Swirski
Nikolaos Papaspyrou
Olivier Flückiger
Andreas Haas
Zhao Jiazhong
Darius Mercadier
Victor Gomes
Toon Verwaest
Lu Yahan
JialuZhang-intel
Levi Zim
Liviu Rau