Skip to content

Commit 9ebca66

Browse files
marjaholttaV8 LUCI CQ
marjaholtta
authored and
V8 LUCI CQ
committed
[rab/gsab] Remove --harmony-rab-gsab (has been on by default for a while)
Bug: v8:11111 Change-Id: Ie74e7737f3e2e8730820cf00f1cbc7ae02b515af Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5516580 Commit-Queue: Marja Hölttä <[email protected]> Reviewed-by: Camillo Bruni <[email protected]> Reviewed-by: Shu-yu Guo <[email protected]> Reviewed-by: Nico Hartmann <[email protected]> Cr-Commit-Position: refs/heads/main@{#93848}
1 parent 8a69c78 commit 9ebca66

57 files changed

Lines changed: 70 additions & 203 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/api/api.cc‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9023,9 +9023,6 @@ std::unique_ptr<v8::BackingStore> v8::ArrayBuffer::NewBackingStore(
90239023
// static
90249024
std::unique_ptr<BackingStore> v8::ArrayBuffer::NewResizableBackingStore(
90259025
size_t byte_length, size_t max_byte_length) {
9026-
Utils::ApiCheck(i::v8_flags.harmony_rab_gsab,
9027-
"v8::ArrayBuffer::NewResizableBackingStore",
9028-
"Constructing resizable ArrayBuffers is not supported");
90299026
Utils::ApiCheck(byte_length <= max_byte_length,
90309027
"v8::ArrayBuffer::NewResizableBackingStore",
90319028
"Cannot construct resizable ArrayBuffer, byte_length must be "

‎src/builtins/builtins-arraybuffer.cc‎

Lines changed: 9 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -135,18 +135,16 @@ BUILTIN(ArrayBufferConstructor) {
135135
}
136136

137137
Handle<Object> number_max_length;
138-
if (v8_flags.harmony_rab_gsab) {
139-
Handle<Object> max_length;
140-
Handle<Object> options = args.atOrUndefined(isolate, 2);
141-
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
142-
isolate, max_length,
143-
JSObject::ReadFromOptionsBag(
144-
options, isolate->factory()->max_byte_length_string(), isolate));
138+
Handle<Object> max_length;
139+
Handle<Object> options = args.atOrUndefined(isolate, 2);
140+
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
141+
isolate, max_length,
142+
JSObject::ReadFromOptionsBag(
143+
options, isolate->factory()->max_byte_length_string(), isolate));
145144

146-
if (!IsUndefined(*max_length, isolate)) {
147-
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
148-
isolate, number_max_length, Object::ToInteger(isolate, max_length));
149-
}
145+
if (!IsUndefined(*max_length, isolate)) {
146+
ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, number_max_length,
147+
Object::ToInteger(isolate, max_length));
150148
}
151149
return ConstructBuffer(isolate, target, new_target, number_length,
152150
number_max_length, InitializedFlag::kZeroInitialized);

‎src/compiler/heap-refs.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1127,7 +1127,7 @@ bool MapRef::CanInlineElementAccess() const {
11271127
(Is64() || (kind != BIGINT64_ELEMENTS && kind != BIGUINT64_ELEMENTS))) {
11281128
return true;
11291129
}
1130-
if (v8_flags.turbo_rab_gsab && IsRabGsabTypedArrayElementsKind(kind) &&
1130+
if (IsRabGsabTypedArrayElementsKind(kind) &&
11311131
kind != RAB_GSAB_BIGUINT64_ELEMENTS &&
11321132
kind != RAB_GSAB_BIGINT64_ELEMENTS) {
11331133
return true;

‎src/compiler/js-call-reducer.cc‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7617,7 +7617,7 @@ Reduction JSCallReducer::ReduceArrayBufferViewByteLengthAccessor(
76177617
}
76187618
}
76197619

7620-
if (!v8_flags.harmony_rab_gsab || !maybe_rab_gsab) {
7620+
if (!maybe_rab_gsab) {
76217621
// We do not perform any change depending on this inference.
76227622
Reduction unused_reduction = inference.NoChange();
76237623
USE(unused_reduction);
@@ -7626,8 +7626,6 @@ Reduction JSCallReducer::ReduceArrayBufferViewByteLengthAccessor(
76267626
node, JS_TYPED_ARRAY_TYPE,
76277627
AccessBuilder::ForJSArrayBufferViewByteLength(),
76287628
Builtin::kTypedArrayPrototypeByteLength);
7629-
} else if (!v8_flags.turbo_rab_gsab) {
7630-
return inference.NoChange();
76317629
}
76327630

76337631
const CallParameters& p = CallParametersOf(node->op());
@@ -7678,16 +7676,14 @@ Reduction JSCallReducer::ReduceTypedArrayPrototypeLength(Node* node) {
76787676
if (IsRabGsabTypedArrayElementsKind(kind)) maybe_rab_gsab = true;
76797677
}
76807678

7681-
if (!v8_flags.harmony_rab_gsab || !maybe_rab_gsab) {
7679+
if (!maybe_rab_gsab) {
76827680
// We do not perform any change depending on this inference.
76837681
Reduction unused_reduction = inference.NoChange();
76847682
USE(unused_reduction);
76857683
// Call default implementation for non-rab/gsab TAs.
76867684
return ReduceArrayBufferViewAccessor(node, JS_TYPED_ARRAY_TYPE,
76877685
AccessBuilder::ForJSTypedArrayLength(),
76887686
Builtin::kTypedArrayPrototypeLength);
7689-
} else if (!v8_flags.turbo_rab_gsab) {
7690-
return inference.NoChange();
76917687
}
76927688

76937689
if (!inference.RelyOnMapsViaStability(dependencies())) {

‎src/compiler/js-native-context-specialization.cc‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3194,8 +3194,6 @@ JSNativeContextSpecialization::BuildElementAccess(
31943194
// TODO(bmeurer): We currently specialize based on elements kind. We should
31953195
// also be able to properly support strings and other JSObjects here.
31963196
ElementsKind elements_kind = access_info.elements_kind();
3197-
DCHECK_IMPLIES(IsRabGsabTypedArrayElementsKind(elements_kind),
3198-
v8_flags.turbo_rab_gsab);
31993197
ZoneVector<MapRef> const& receiver_maps =
32003198
access_info.lookup_start_object_maps();
32013199

@@ -3581,8 +3579,6 @@ JSNativeContextSpecialization::
35813579
KeyedAccessMode const& keyed_mode) {
35823580
DCHECK(IsTypedArrayElementsKind(elements_kind) ||
35833581
IsRabGsabTypedArrayElementsKind(elements_kind));
3584-
DCHECK_IMPLIES(IsRabGsabTypedArrayElementsKind(elements_kind),
3585-
v8_flags.turbo_rab_gsab);
35863582
// AccessMode::kDefine is not handled here. Optimization should be skipped by
35873583
// caller.
35883584
DCHECK(keyed_mode.access_mode() != AccessMode::kDefine);

‎src/flags/flag-definitions.h‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -283,8 +283,6 @@ DEFINE_BOOL(js_shipping, true, "enable all shipped JavaScript features")
283283

284284
#define JAVASCRIPT_STAGED_FEATURES_BASE(V)
285285

286-
DEFINE_WEAK_IMPLICATION(harmony_rab_gsab_transfer, harmony_rab_gsab)
287-
288286
#ifdef V8_INTL_SUPPORT
289287
#define HARMONY_STAGED(V) HARMONY_STAGED_BASE(V)
290288
#define JAVASCRIPT_STAGED_FEATURES(V) JAVASCRIPT_STAGED_FEATURES_BASE(V)
@@ -295,9 +293,6 @@ DEFINE_WEAK_IMPLICATION(harmony_rab_gsab_transfer, harmony_rab_gsab)
295293

296294
// Features that are shipping (turned on by default, but internal flag remains).
297295
#define HARMONY_SHIPPING_BASE(V) \
298-
V(harmony_rab_gsab, \
299-
"harmony ResizableArrayBuffer / GrowableSharedArrayBuffer") \
300-
V(harmony_rab_gsab_transfer, "harmony ArrayBuffer.transfer") \
301296
V(harmony_array_grouping, "harmony array grouping") \
302297
V(harmony_array_from_async, "harmony Array.fromAsync") \
303298
V(harmony_iterator_helpers, "JavaScript iterator helpers") \
@@ -1292,9 +1287,6 @@ DEFINE_BOOL_READONLY(turbo_rewrite_far_jumps, false,
12921287
"rewrite far to near jumps (ia32,x64)")
12931288
#endif
12941289

1295-
DEFINE_BOOL(
1296-
turbo_rab_gsab, true,
1297-
"optimize ResizableArrayBuffer / GrowableSharedArrayBuffer in TurboFan")
12981290
DEFINE_BOOL(
12991291
stress_gc_during_compilation, false,
13001292
"simulate GC/compiler thread race related to https://crbug.com/v8/8520")

‎src/heap/factory.cc‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3282,7 +3282,7 @@ Handle<JSArrayBuffer> Factory::NewJSArrayBuffer(
32823282
isolate()->native_context()->array_buffer_fun()->initial_map(),
32833283
isolate());
32843284
ResizableFlag resizable_by_js = ResizableFlag::kNotResizable;
3285-
if (v8_flags.harmony_rab_gsab && backing_store->is_resizable_by_js()) {
3285+
if (backing_store->is_resizable_by_js()) {
32863286
resizable_by_js = ResizableFlag::kResizable;
32873287
}
32883288
auto result = Handle<JSArrayBuffer>::cast(
@@ -3340,8 +3340,6 @@ MaybeHandle<JSArrayBuffer> Factory::NewJSArrayBufferAndBackingStore(
33403340

33413341
Handle<JSArrayBuffer> Factory::NewJSSharedArrayBuffer(
33423342
std::shared_ptr<BackingStore> backing_store) {
3343-
DCHECK_IMPLIES(backing_store->is_resizable_by_js(),
3344-
v8_flags.harmony_rab_gsab);
33453343
Handle<Map> map(
33463344
isolate()->native_context()->shared_array_buffer_fun()->initial_map(),
33473345
isolate());
@@ -3450,7 +3448,6 @@ Handle<JSTypedArray> Factory::NewJSTypedArray(
34503448
ElementsKind elements_kind;
34513449
JSTypedArray::ForFixedTypedArray(type, &element_size, &elements_kind);
34523450

3453-
CHECK_IMPLIES(is_length_tracking, v8_flags.harmony_rab_gsab);
34543451
const bool is_backed_by_rab =
34553452
buffer->is_resizable_by_js() && !buffer->is_shared();
34563453

@@ -3492,7 +3489,6 @@ Handle<JSTypedArray> Factory::NewJSTypedArray(
34923489
Handle<JSDataViewOrRabGsabDataView> Factory::NewJSDataViewOrRabGsabDataView(
34933490
DirectHandle<JSArrayBuffer> buffer, size_t byte_offset, size_t byte_length,
34943491
bool is_length_tracking) {
3495-
CHECK_IMPLIES(is_length_tracking, v8_flags.harmony_rab_gsab);
34963492
if (is_length_tracking) {
34973493
// Security: enforce the invariant that length-tracking DataViews have their
34983494
// byte_length set to 0.

‎src/init/bootstrapper.cc‎

Lines changed: 32 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -4144,6 +4144,25 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
41444144
"arrayBufferConstructor_DoNotInitialize"),
41454145
Builtin::kArrayBufferConstructor_DoNotInitialize, 1, false);
41464146
native_context()->set_array_buffer_noinit_fun(*array_buffer_noinit_fun);
4147+
4148+
Handle<JSObject> array_buffer_prototype(
4149+
JSObject::cast(array_buffer_fun->instance_prototype()), isolate_);
4150+
SimpleInstallGetter(isolate_, array_buffer_prototype,
4151+
factory->max_byte_length_string(),
4152+
Builtin::kArrayBufferPrototypeGetMaxByteLength, false);
4153+
SimpleInstallGetter(isolate_, array_buffer_prototype,
4154+
factory->resizable_string(),
4155+
Builtin::kArrayBufferPrototypeGetResizable, false);
4156+
SimpleInstallFunction(isolate_, array_buffer_prototype, "resize",
4157+
Builtin::kArrayBufferPrototypeResize, 1, true);
4158+
SimpleInstallFunction(isolate_, array_buffer_prototype, "transfer",
4159+
Builtin::kArrayBufferPrototypeTransfer, 0, false);
4160+
SimpleInstallFunction(
4161+
isolate_, array_buffer_prototype, "transferToFixedLength",
4162+
Builtin::kArrayBufferPrototypeTransferToFixedLength, 0, false);
4163+
SimpleInstallGetter(isolate_, array_buffer_prototype,
4164+
factory->detached_string(),
4165+
Builtin::kArrayBufferPrototypeGetDetached, false);
41474166
}
41484167

41494168
{ // -- S h a r e d A r r a y B u f f e r
@@ -4153,6 +4172,19 @@ void Genesis::InitializeGlobal(Handle<JSGlobalObject> global_object,
41534172
InstallWithIntrinsicDefaultProto(isolate_, shared_array_buffer_fun,
41544173
Context::SHARED_ARRAY_BUFFER_FUN_INDEX);
41554174
InstallSpeciesGetter(isolate_, shared_array_buffer_fun);
4175+
4176+
Handle<JSObject> shared_array_buffer_prototype(
4177+
JSObject::cast(shared_array_buffer_fun->instance_prototype()),
4178+
isolate_);
4179+
SimpleInstallGetter(isolate_, shared_array_buffer_prototype,
4180+
factory->max_byte_length_string(),
4181+
Builtin::kSharedArrayBufferPrototypeGetMaxByteLength,
4182+
false);
4183+
SimpleInstallGetter(isolate_, shared_array_buffer_prototype,
4184+
factory->growable_string(),
4185+
Builtin::kSharedArrayBufferPrototypeGetGrowable, false);
4186+
SimpleInstallFunction(isolate_, shared_array_buffer_prototype, "grow",
4187+
Builtin::kSharedArrayBufferPrototypeGrow, 1, true);
41564188
}
41574189

41584190
{ // -- A t o m i c s
@@ -5393,7 +5425,6 @@ void Genesis::InitializeConsole(Handle<JSObject> extras_binding) {
53935425

53945426
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_assertions)
53955427
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_import_attributes)
5396-
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(harmony_rab_gsab_transfer)
53975428
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(js_regexp_modifiers)
53985429
EMPTY_INITIALIZE_GLOBAL_FOR_FEATURE(js_regexp_duplicate_named_groups)
53995430

@@ -5851,46 +5882,6 @@ void Genesis::InitializeGlobal_regexp_linear_flag() {
58515882
native_context()->set_regexp_prototype_map(regexp_prototype->map());
58525883
}
58535884

5854-
void Genesis::InitializeGlobal_harmony_rab_gsab() {
5855-
if (!v8_flags.harmony_rab_gsab) return;
5856-
Handle<JSObject> array_buffer_prototype(
5857-
JSObject::cast(
5858-
native_context()->array_buffer_fun()->instance_prototype()),
5859-
isolate());
5860-
SimpleInstallGetter(isolate(), array_buffer_prototype,
5861-
factory()->max_byte_length_string(),
5862-
Builtin::kArrayBufferPrototypeGetMaxByteLength, false);
5863-
SimpleInstallGetter(isolate(), array_buffer_prototype,
5864-
factory()->resizable_string(),
5865-
Builtin::kArrayBufferPrototypeGetResizable, false);
5866-
SimpleInstallFunction(isolate(), array_buffer_prototype, "resize",
5867-
Builtin::kArrayBufferPrototypeResize, 1, true);
5868-
if (v8_flags.harmony_rab_gsab_transfer) {
5869-
SimpleInstallFunction(isolate(), array_buffer_prototype, "transfer",
5870-
Builtin::kArrayBufferPrototypeTransfer, 0, false);
5871-
SimpleInstallFunction(
5872-
isolate(), array_buffer_prototype, "transferToFixedLength",
5873-
Builtin::kArrayBufferPrototypeTransferToFixedLength, 0, false);
5874-
SimpleInstallGetter(isolate(), array_buffer_prototype,
5875-
factory()->detached_string(),
5876-
Builtin::kArrayBufferPrototypeGetDetached, false);
5877-
}
5878-
5879-
Handle<JSObject> shared_array_buffer_prototype(
5880-
JSObject::cast(
5881-
native_context()->shared_array_buffer_fun()->instance_prototype()),
5882-
isolate());
5883-
SimpleInstallGetter(isolate(), shared_array_buffer_prototype,
5884-
factory()->max_byte_length_string(),
5885-
Builtin::kSharedArrayBufferPrototypeGetMaxByteLength,
5886-
false);
5887-
SimpleInstallGetter(isolate(), shared_array_buffer_prototype,
5888-
factory()->growable_string(),
5889-
Builtin::kSharedArrayBufferPrototypeGetGrowable, false);
5890-
SimpleInstallFunction(isolate(), shared_array_buffer_prototype, "grow",
5891-
Builtin::kSharedArrayBufferPrototypeGrow, 1, true);
5892-
}
5893-
58945885
void Genesis::InitializeGlobal_harmony_temporal() {
58955886
if (!v8_flags.harmony_temporal) return;
58965887

‎src/objects/js-array-buffer.cc‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,6 @@ size_t JSArrayBuffer::GsabByteLength(Isolate* isolate,
179179
Address raw_array_buffer) {
180180
// TODO(v8:11111): Cache the last seen length in JSArrayBuffer and use it
181181
// in bounds checks to minimize the need for calling this function.
182-
DCHECK(v8_flags.harmony_rab_gsab);
183182
DisallowGarbageCollection no_gc;
184183
DisallowJavascriptExecution no_js(isolate);
185184
Tagged<JSArrayBuffer> buffer =
@@ -407,7 +406,6 @@ size_t JSTypedArray::LengthTrackingGsabBackedTypedArrayLength(
407406
Isolate* isolate, Address raw_array) {
408407
// TODO(v8:11111): Cache the last seen length in JSArrayBuffer and use it
409408
// in bounds checks to minimize the need for calling this function.
410-
DCHECK(v8_flags.harmony_rab_gsab);
411409
DisallowGarbageCollection no_gc;
412410
DisallowJavascriptExecution no_js(isolate);
413411
Tagged<JSTypedArray> array = JSTypedArray::cast(Tagged<Object>(raw_array));

‎src/objects/value-serializer.cc‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1008,7 +1008,6 @@ Maybe<bool> ValueSerializer::WriteJSArrayBufferView(
10081008
ArrayBufferViewTag tag = ArrayBufferViewTag::kInt8Array;
10091009
if (IsJSTypedArray(view)) {
10101010
if (JSTypedArray::cast(view)->IsOutOfBounds()) {
1011-
DCHECK(v8_flags.harmony_rab_gsab);
10121011
return ThrowDataCloneError(MessageTemplate::kDataCloneError,
10131012
handle(view, isolate_));
10141013
}
@@ -1024,7 +1023,6 @@ Maybe<bool> ValueSerializer::WriteJSArrayBufferView(
10241023
DCHECK(IsJSDataViewOrRabGsabDataView(view));
10251024
if (IsJSRabGsabDataView(view) &&
10261025
JSRabGsabDataView::cast(view)->IsOutOfBounds()) {
1027-
DCHECK(v8_flags.harmony_rab_gsab);
10281026
return ThrowDataCloneError(MessageTemplate::kDataCloneError,
10291027
handle(view, isolate_));
10301028
}
@@ -2101,13 +2099,6 @@ MaybeHandle<JSArrayBuffer> ValueDeserializer::ReadJSArrayBuffer(
21012099
if (byte_length > max_byte_length) {
21022100
return MaybeHandle<JSArrayBuffer>();
21032101
}
2104-
if (!v8_flags.harmony_rab_gsab) {
2105-
// Disable resizability. This ensures that no resizable buffers are
2106-
// created in a version which has the harmony_rab_gsab turned off, even if
2107-
// such a version is reading data containing resizable buffers from disk.
2108-
is_resizable = false;
2109-
max_byte_length = byte_length;
2110-
}
21112102
}
21122103
if (byte_length > static_cast<size_t>(end_ - position_)) {
21132104
return MaybeHandle<JSArrayBuffer>();
@@ -2229,16 +2220,6 @@ bool ValueDeserializer::ValidateJSArrayBufferViewFlags(
22292220
// TODO(marja): When the version number is bumped the next time, check that
22302221
// serialized_flags doesn't contain spurious 1-bits.
22312222

2232-
if (!v8_flags.harmony_rab_gsab) {
2233-
// Disable resizability. This ensures that no resizable buffers are
2234-
// created in a version which has the harmony_rab_gsab turned off, even if
2235-
// such a version is reading data containing resizable buffers from disk.
2236-
is_length_tracking = false;
2237-
is_backed_by_rab = false;
2238-
// The resizability of the buffer was already disabled.
2239-
CHECK(!buffer->is_resizable_by_js());
2240-
}
2241-
22422223
if (is_backed_by_rab || is_length_tracking) {
22432224
if (!buffer->is_resizable_by_js()) {
22442225
return false;

0 commit comments

Comments
 (0)