Commit Graph

59587 Commits

Author SHA1 Message Date
Jakob Gruber
002d5be898 [gasm] Implement parts of js call reducer using the graph assembler
An initial investigation of using GraphAssembler in JSCallReducer.

This CL ports two simple reductions (ReduceMathUnary,
ReduceMathBinary) as well as a slightly more involved reduction with
branching control flow (ReduceStringPrototypeSubstring). The graph
assembler abstracts away the details of maintaining effect and control
edges. Resulting code ends up looking very similar to CSA.

Newly introduced:
- Typing through TNode.
- IfBuilder1 for nicer if-then-else sequences that return exactly 1
  value. Future CLs will add more convenience builders that follow this
  pattern.
- Many small readability improvements through helper functions.

Bug: v8:9972
Change-Id: Iaa186b76c006e07c8d69a74f340a4912577a32a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1914204
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65095}
2019-11-21 13:00:44 +00:00
Georg Neis
438f72f406 [turbofan] Don't expect framestate input to be a Framestate
It could also be a DeadValue.

A regression test will take a while but the fix is straightforward.

Bug: chromium:1027045
Change-Id: I49a66668b7189b7ea7d6d79d514b9e0de3edc966
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928853
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65094}
2019-11-21 12:41:33 +00:00
Clemens Backes
5cf61684fb Reland "[wasm] Prevent breakpoints on nonbreakable positions"
This is an unmodified reland of 3c98a2a36a.
The actual issue was fixed in https://crrev.com/c/1926769.

Original change's description:
> [wasm] Prevent breakpoints on nonbreakable positions
>
> If a breakpoint is set on a non-breakable position, the wasm interpreter
> just stores the value 0xFF (kInternalBreakpoint) in the function body
> (actually, a copy of the function body). This might overwrite immediates
> and cause subsequent failures in the wasm interpreter.
>
> In JavaScript, breakpoints are just forwarded to the next breakable
> position. This CL implements the same for WebAssembly.
> A cctest tests this behavior, and the existing
> wasm-stepping-byte-offsets.js inspector test is extended to also set the
> breakpoint within an i32 constant immediate.
>
> R=leese@chromium.org, mstarzinger@chromium.org
> CC=​bmeurer@chromium.org
>
> Bug: chromium:1025184
> Change-Id: Ia2706f8f1c3d686cbbe8e1e7339d9ee86247bb4a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925152
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65070}

Bug: chromium:1025184
Change-Id: I5e16df645bbacf039b7a5e55a0c2a64cdb4c6a32
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926152
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65093}
2019-11-21 12:33:43 +00:00
Jakob Kummerow
dbfb14bf52 Fix roll-blocking issue
Follow-up to c968607e12 to make
LayoutTests happy.

Tbr: verwaest@chromium.org
Change-Id: I02758faa8ed1f06f1faf615047a40ec115887a4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1928856
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65092}
2019-11-21 12:26:03 +00:00
David Benjamin
9ef4e8f18c Fix some issues caught by _LIBCPP_DEBUG=0
&vector[i] is invalid unless 0 <= i < vector.size(). This means:

- &vector[0] is invalid if the vector is empty.

- &vector[vector.size()] is not a valid way to point past the end of the
  vector.

Fix these to use vector.data() + vector.size() which is the defined to
get begin and end pointers for a vector.

Bug: chromium:1027059
Change-Id: Ife1f0e64807b32ebdca66dba8ffc206d90a0de75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1929071
Auto-Submit: David Benjamin <davidben@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65091}
2019-11-21 12:17:03 +00:00
Clemens Backes
25a4f4d997 Hash all strings as signed values
Hashing should ignore the signedness of the type, since different
platforms might define standard types like {char} as either signed or
unsigned. This leads to problems if hashes are included in test
expectations, see https://crrev.com/c/1926032 and
https://crbug.com/1025184#c26.

This CL avoid such problems by always treating the input as signed
values. This also reduces binary size, since the instantiations for
int8_t and uint8_t are identical now and are folded together by the
compiler / linker.

R=jkummerow@chromium.org

Bug: chromium:1025184
Change-Id: I3fee4d8662dd1c31cd6483639fe4edd4511662c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926769
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65090}
2019-11-21 10:03:32 +00:00
Tobias Tebbi
dddc6a90f1 [torque] add %SizeOf intrinsic
This replaces the fragile hand-coded SizeOf function.

Bug: v8:7793
Change-Id: I6bd84f367182b947486192f8968c56723f29efaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924265
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65089}
2019-11-21 09:47:42 +00:00
Ng Zhi An
ea06b01e52 [wasm-simd] Implement i64x2 add sub for arm
Also some cleanup reordering of instruction codes.

Bug: v8:9813
Change-Id: I35caad0b84dd5824090046cba964454eac45d5d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925613
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65088}
2019-11-21 00:18:31 +00:00
Ng Zhi An
aafbc13834 [wasm-simd] Implement i64x2 shifts for arm
Bug: v8:9813
Change-Id: Ibfac9453a035bb00020b4d062e1445410644f16a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900662
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65087}
2019-11-20 23:18:17 +00:00
Suraj Sharma
46759fb37e Reland "[ic] Migrate Code-based handlers to use data driven handler."
This is a reland of d46bd852ad

Original change's description:
> [ic] Migrate Code-based handlers to use data driven handler.
> 
> All usage of KeyedLoadIC_Slow, HasIC_Slow, StoreInArrayLiteralIC_Slow
> and KeyedStoreIC_Slow now use data driven handlers
> 
> Bug: v8:9779
> Change-Id: Idd888c5c10b462a5fe155ba0add36f95169bd76d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895988
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Suraj Sharma <surshar@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#64918}

Bug: v8:9779
Change-Id: I8fb9359752d6b8e8211c37e15e8f1bf61dd6532a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916684
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65086}
2019-11-20 22:31:38 +00:00
Santiago Aboy Solanes
2187575733 [turbolizer] Toggling maximize keeps the side panels size consistent
We now keep the same percentage of the window occupied by the panel
when toggling Maximize (both maximizing, or un-maximizing). This
also means that it no longer forces the side panels open when
toggling maximizing.

Also took the opportunity and cleaned up names and resizer.ts.

Bug: v8:7327
Change-Id: I60b574a833f3059e447aa17fae8a687d32ac29d5
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903970
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65085}
2019-11-20 19:08:57 +00:00
Santiago Aboy Solanes
14190afd11 [turbolizer] Focus on the svg after searching
After searching now we are focused on the svg, which allows using
the keyboard shortcuts after searching.

Bug: v8:7327
Change-Id: I57f5490ecb9858971aefae66b9808460108dc936
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925147
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65084}
2019-11-20 17:57:20 +00:00
Santiago Aboy Solanes
7d470998d2 [turbolizer][cleanup] Remove focusable attribute. It doesn't exist
Source: https://developer.mozilla.org/en-US/docs/Web/HTML/Attributes

Bug: v8:7327
Change-Id: I2f91b7dc619d70ae29600ae7f304d9944994c863
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925151
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65083}
2019-11-20 17:56:15 +00:00
Georg Neis
9da8b1aa88 [runtime] Fix an object reference in WriteJSRegExp
... by handlifying its argument.

Bug: v8:9989
Change-Id: Ie56a8beb52372c6f77aa855319c3af5e429bfd04
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926149
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65082}
2019-11-20 17:51:05 +00:00
Georg Neis
3dbc1a8e41 [runtime] Avoid a gcmole warning in AddToDictionaryTemplate
... by making explicit that the value is a Smi.

Bug: v8:9989
Change-Id: I9f65030cf665e16c2fb22f5f77e25daf3cfb1cf1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924260
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65081}
2019-11-20 17:44:45 +00:00
Zhi An Ng
960badd140 Revert "[liftoff] Use stack slot offsets instead of indices"
This reverts commit 2072772592.

Reason for revert: Many bugs/crashes, https://crbug.com/v8/9999 https://crbug.com/1026500 https://crbug.com/1026514

Original change's description:
> [liftoff] Use stack slot offsets instead of indices
> 
> Spill/fill now take offsets instead of indices. We provide a
> helper, GetStackOffsetFromIndex, for callers. This is currently only
> useful while slot sizes are still fixed to 8 bytes.
> 
> StackTransferRecipe's RegisterLoad now works in terms of offset.
> 
> LiftoffStackSlots work in terms of offset as well.
> 
> TransferStackSlot currently still works in terms of indicies, but can be
> converted to use offsets in a subsequent change.
> 
> Bug: v8:9909
> Change-Id: If54fb844309bdfd641720d063135dd59551813e0
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1922489
> Reviewed-by: Clemens Backes <clemensb@chromium.org>
> Commit-Queue: Zhi An Ng <zhin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65049}

TBR=clemensb@chromium.org,zhin@chromium.org

Change-Id: I972b72346c87d1d55488911938e3f3cdbe69abe5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9909
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925560
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65080}
2019-11-20 17:25:58 +00:00
Seth Brenith
6b11b700d7 [torque][tools] Define layout of DescriptorArray for postmortem tools
This change defines a way that v8_debug_helper can describe object
fields which are packed structs, and uses it for the "descriptors" field
in DescriptorArray.

In more detail:
- debug-helper.h (the public interface for v8_debug_helper) adds a size
  and an optional list of struct properties to ObjectProperty.
- debug-helper-internal.h mirrors those changes to the internal class
  hierarchy which maintains proper unique_ptr ownership.
- In src/torque/class-debug-reader-generator.cc,
  - Some existing logic is moved into smaller functions.
  - New logic is added to generate the field list for structs. Example
    output is included in a comment above the function
    GenerateGetPropsChunkForField.

Bug: v8:9376
Change-Id: I531acac039ccb42050641448a4cbaec26186a7bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1894362
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65079}
2019-11-20 16:56:39 +00:00
Jakob Kummerow
c968607e12 Update LookupIterator and ICs for size_t indices
They have to be in sync, so this patch updates both systems.

Bug: v8:4153
Change-Id: I09252e41a710e79f823fe6818c1c6c0038faeb31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903434
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65078}
2019-11-20 16:47:39 +00:00
Clemens Backes
c4cf2ea4fd [codegen] Remove redundant xorpd instructions
It seems like they were originally added in https://crrev.com/23654026
(Sep 2013) to break dependences in the OOO pipeline. This code pattern
was then later copied for other instructions too
(https://crrev.com/1424333002).
The reason for the xorpd is not mentioned in the code though, and I
found no other compiler doing this. So maybe it's obsolete by now, and
only increases code size.

Let's remove them and see if we get any performance regressions.

R=ahaas@chromium.org
CC=yangguo@chromium.org

Change-Id: I0e6d65afa67f0ee286e5b0ba95c91092c5261c8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926427
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65077}
2019-11-20 16:22:54 +00:00
Leszek Swirski
149f7f4d96 [objects] Make UncompiledData::Init a member function
Since it doesn't allocate, make UncompiledData::Init a member function,
consistent with SharedFunctionInfo::Init.

Bug: chromium:1011762
Change-Id: I984adf9004193eb9da504ddd39dd95345eccaf82
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926031
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65076}
2019-11-20 16:21:49 +00:00
Leszek Swirski
7a0ae73b76 [ast] Add a Flatten method for AstConsString
This allows off-thread flattening.

Bug: chromium:1011762
Change-Id: If83f7bbcbf74165987a4c157184f5b92dc554971
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924437
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65075}
2019-11-20 16:02:49 +00:00
Clemens Backes
d1462a56ec Revert "[wasm] Prevent breakpoints on nonbreakable positions"
This reverts commit 3c98a2a36a.

Reason for revert: Fails on arm: https://ci.chromium.org/p/v8/builders/ci/V8%20Arm%20-%20debug/12134

Original change's description:
> [wasm] Prevent breakpoints on nonbreakable positions
> 
> If a breakpoint is set on a non-breakable position, the wasm interpreter
> just stores the value 0xFF (kInternalBreakpoint) in the function body
> (actually, a copy of the function body). This might overwrite immediates
> and cause subsequent failures in the wasm interpreter.
> 
> In JavaScript, breakpoints are just forwarded to the next breakable
> position. This CL implements the same for WebAssembly.
> A cctest tests this behavior, and the existing
> wasm-stepping-byte-offsets.js inspector test is extended to also set the
> breakpoint within an i32 constant immediate.
> 
> R=​leese@chromium.org, mstarzinger@chromium.org
> CC=​​bmeurer@chromium.org
> 
> Bug: chromium:1025184
> Change-Id: Ia2706f8f1c3d686cbbe8e1e7339d9ee86247bb4a
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925152
> Commit-Queue: Clemens Backes <clemensb@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65070}

TBR=mstarzinger@chromium.org,clemensb@chromium.org,bmeurer@chromium.org,leese@chromium.org

Change-Id: I7468ea3b15fecccdea521308325cf4851e0a0396
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:1025184
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926032
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65074}
2019-11-20 15:51:41 +00:00
Milad Farazmand
8c4fc5c22e PPC/s390: [cleanup][ptr-compr] Remove Decompressed Signed/Any register to register
Port 3b0329abb1

Original Commit Message:

    Since the old pipeline has been removed
    (https://chromium-review.googlesource.com/c/v8/v8/+/1903435), these
    opcodes and methods are unused.

R=solanes@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I68b1dcc54c6bbaf873f277d4a1620eee6d96864c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925555
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65073}
2019-11-20 15:08:28 +00:00
Andreas Haas
9e8cd78d69 [wasm][bulk-memory] Change bounds checks behavior
This is necessary because the spec changed.

R=mstarzinger@chromium.org

Bug: v8:9865
Change-Id: Id8b4d85eafcf368d591666907036e6aa54664e63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921794
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65072}
2019-11-20 15:07:17 +00:00
Jakob Gruber
b5bdf0a8f4 [regexp] Stricter asserts in RegExpPrototypeExecBodyWithoutResult
Previously the fast path only asserted the correct instance types; but
when reading lastIndex we additionally rely on a specific object
shape.  This is checked by HasInitialRegExpMap().

Bug: chromium:1024758
Change-Id: I0b401ffb246dd47153caf798446d8d41bc84bc8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924354
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65071}
2019-11-20 14:40:07 +00:00
Clemens Backes
3c98a2a36a [wasm] Prevent breakpoints on nonbreakable positions
If a breakpoint is set on a non-breakable position, the wasm interpreter
just stores the value 0xFF (kInternalBreakpoint) in the function body
(actually, a copy of the function body). This might overwrite immediates
and cause subsequent failures in the wasm interpreter.

In JavaScript, breakpoints are just forwarded to the next breakable
position. This CL implements the same for WebAssembly.
A cctest tests this behavior, and the existing
wasm-stepping-byte-offsets.js inspector test is extended to also set the
breakpoint within an i32 constant immediate.

R=leese@chromium.org, mstarzinger@chromium.org
CC=​bmeurer@chromium.org

Bug: chromium:1025184
Change-Id: Ia2706f8f1c3d686cbbe8e1e7339d9ee86247bb4a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925152
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65070}
2019-11-20 14:27:22 +00:00
Zhao Jiazhong
e614ca2c5d [mips] Adjust some functions and macro's position.
Macro 'USE_SIMULATOR' should wrap the whole v8::internal namespace.

Change-Id: I2b0102e563b6cb976e5a450363bc770f8d5628e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1916439
Auto-Submit: Zhao Jiazhong <zhaojiazhong-hf@loongson.cn>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65069}
2019-11-20 14:26:17 +00:00
Tobias Tebbi
e34c42db27 [torque] type context of JS builtins as NativeContext
That's possible because JS builtins are JSFunctions that embed a
NativeContext.

Bug: v8:7793
Change-Id: Id2bf7844fcfb53df733100f1e3e554f25a78482a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926150
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65068}
2019-11-20 14:14:27 +00:00
Andreas Haas
ec46cef0ee [arraybuffer] Flag EmptyBackingStore as free_on_destruct
In {EmptyBackingStore}, the {free_on_destruct} flag was not set as an
optimization: Since there is no memory, it also does not have to be
freed. However, this flag has a side-effect: any backing store where
this flag is not set is considered {external}. The {external} flag is
mis-used by blink to indicate if ArrayBuffers need to be wrapped or not.

With this CL we set the {free_on_destruct} flag in {EmptyBackingStore},
but we change the ArrayBufferTracker to just ignore empty backing
stores.

R=ulan@chromium.org

Bug: chromium:1008840
Change-Id: I1552a6e013c8b23f39fba1c2d9d9c61dc30c0c74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924263
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65067}
2019-11-20 13:47:57 +00:00
Santiago Aboy Solanes
3b0329abb1 [cleanup][ptr-compr] Remove Decompressed Signed/Any register to register
Since the old pipeline has been removed
(https://chromium-review.googlesource.com/c/v8/v8/+/1903435), these
opcodes and methods are unused.

Bug: v8:7703
Change-Id: I626645a1405c79c6a202da6075fb64f0a2a41d25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921799
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65066}
2019-11-20 13:38:47 +00:00
Georg Neis
7b3b82f04f [ic] Handlify an object reference in ConfigureCloneObject
Bug: v8:9989
Change-Id: I6923f99398c0a1c8b447e18e0416a2630a09ee5d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924259
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65065}
2019-11-20 13:19:37 +00:00
Emanuel Ziegler
7d74acdfeb [wasm] Determine receiver at runtime to avoid re-creation of wrapper
When importing a JS function, Wasm tries to guess the type of function
(parameters & strict/sloppy mode). This can sometimes fail which leads
to re-creation of the wrapper. With this change, the same wrapper can
be used for strict and sloppy mode requiring the re-creation only on
arity mismatch.

R=mstarzinger@chromium.org

Change-Id: I77ec2b853153dec0772873cfb60c064a74065732
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1921793
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Emanuel Ziegler <ecmziegler@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65064}
2019-11-20 12:30:20 +00:00
Dan Elphick
fffffd5d10 Fix WATCHLISTS being reverted in rolls
Don't overwrite WATCHLISTS each time with a checkout from the latest
release branch as that means it will never pick up changes from
master.

No-Try: true
Bug: chromium:832032
Change-Id: I3a9231369caa9a6591acb9b7f0c76dc031ab9178
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926029
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65063}
2019-11-20 12:23:47 +00:00
Tamer Tas
ea63ba98f2 [preparser] remove the test suite configuration
https://chromium-review.googlesource.com/c/v8/v8/+/1926027 deprecated the
"preparser" test suite.

This CL removes the remaining test suite configuration.

R=machenbach@chromium.org

Bug: v8:10001
Change-Id: I45afb709ddad5be1ec6072a42567e669f900095e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926147
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65062}
2019-11-20 11:52:37 +00:00
Jakob Gruber
ffdf8a9507 [gasm] Rename current_{effect_,control_} to {effect_,control_}
Bug: v8:9972
Change-Id: Ia85520eea8d3bcadc2573c16bf2778b1c3ff0c5a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926028
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65061}
2019-11-20 10:32:00 +00:00
Deepti Gandluri
9cbdca5a4e [wasm] Atomic Wait/Notify should pass in the correct context value
Bug: chromium:1010272
Change-Id: Ifc7ed5ff66b84e889668fd0820cea1d5b6af328f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925809
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65060}
2019-11-20 09:31:50 +00:00
Tamer Tas
233e3c184c [preparser] deprecate stand-alone "preparser" test-suite
"preparser" is a legacy test-suite written in Python. "cctest/test-parsing"
provides the same coverage and more for the preparser.

This CL removes "preparser" stand-alone test-suite

R=verwaest@chromium.org
CC=​machenbach@chromium.org

Bug: v8:10001
Change-Id: I1823967e654e8d6d9e42eadfd667f90074d57ba9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1926027
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65059}
2019-11-20 08:52:59 +00:00
v8-ci-autoroll-builder
4e19e38b24 Update V8 DEPS.
Rolling v8/build: 456253c..9f9c46f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f7d5f0c..4c9781e

Rolling v8/third_party/depot_tools: 35a67a5..639872c

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I34208500b48e4d745ae0aa83d6667c35ed8800cb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924898
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#65058}
2019-11-20 03:52:39 +00:00
Joshua Litt
fa88b378a4 Revert "[regexp] Re-execute regexp when '.indices' is accessed."
This reverts commit f2a74165bf.

Reason for revert: Clusterfuzz
Bug: chromium:1026479

Original change's description:
> [regexp] Re-execute regexp when '.indices' is accessed.
> 
> Instead of storing a pointer to the last_match_info, which may
> change, this cl modifies JSRegExpResult to store a pointer to
> the original JSRegExp which generated it, as well as additional
> data needed to re-execute the match.
> 
> Basically a straight copy and tidy off jgruber@'s prototype:
> https://chromium-review.googlesource.com/c/v8/v8/+/1876810
> 
> Bug: v8:9548
> Change-Id: I11b7deae681b8287e41e8d0e342291ff484751fb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910129
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65053}

TBR=jgruber@chromium.org,joshualitt@chromium.org

Change-Id: I6294e3d7ac0b3e2bd9404697823b8d3cc2545c16
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9548
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925651
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65057}
2019-11-20 02:10:11 +00:00
Ng Zhi An
c954e694b9 [wasm-simd] Implement load_extend in interpreter
Bug: v8:9886
Change-Id: I5ed8ad13a4c92b61cddb8d86ec97e242252a556e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1922231
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65056}
2019-11-19 22:21:08 +00:00
Z Nguyen-Huu
03d23c4811 [builtins] Port RegexpPrototypeMatchBody to Torque
Bug: v8:8976
Change-Id: Ifa9b874b5b75b51046ba611db2b9fad3cbd33905
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1920066
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65055}
2019-11-19 20:35:48 +00:00
Seth Brenith
c5f1012322 [torque] Don't generate field lists for classes with undefined layout
Minor cleanup: some classes in Torque don't yet have any definitions for
their fields, so it doesn't make sense to emit field layout macros for
those classes.

Bug: v8:7793
Change-Id: Iee38aa3cbe684f4a63329a676e2e94944dc05de1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925010
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#65054}
2019-11-19 20:10:28 +00:00
Joshua Litt
f2a74165bf [regexp] Re-execute regexp when '.indices' is accessed.
Instead of storing a pointer to the last_match_info, which may
change, this cl modifies JSRegExpResult to store a pointer to
the original JSRegExp which generated it, as well as additional
data needed to re-execute the match.

Basically a straight copy and tidy off jgruber@'s prototype:
https://chromium-review.googlesource.com/c/v8/v8/+/1876810

Bug: v8:9548
Change-Id: I11b7deae681b8287e41e8d0e342291ff484751fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910129
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65053}
2019-11-19 19:35:48 +00:00
Milad Farazmand
c940bd89af PPC: Fix offset calculation on AIX when not using a
function descriptor

Change-Id: I439bac759cb363f35f6aa23a699b6ef1d9079684
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925027
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65052}
2019-11-19 19:11:58 +00:00
Ng Zhi An
e927764216 [wasm-simd] Fix unsigned narrow instructions
These instructions should always treat inputs as signed, and saturate to
unsigned min/max values.

E.g. given -1, it should saturate to 0.

The spec text,
https://github.com/WebAssembly/simd/blob/master/proposals/simd/SIMD.md#integer-to-integer-narrowing,
has been updated to describe this.

The changes here include codegen changes to ia32, x64, arm, and arm64,
changes to arm simulator, assembler, and disassembler to handle the case
of treating input as signed and narrowing to unsigned. The vqmovn
instruction can handle this case, our assembler wasn't allowing callers
to specify this.

The interpreter and scalar lowering are also fixed with this change.

Bug: v8:9729
Change-Id: I6f72baa825f59037f7754485df6a2964af59fe31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879423
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65051}
2019-11-19 18:51:09 +00:00
Ng Zhi An
d30ec8566b [wasm-simd] Implement load_splat in interpreter
Bug: v8:9886
Change-Id: I860bea0c317e9666662329e9b36598952c8ecfad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1919697
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65050}
2019-11-19 18:46:18 +00:00
Ng Zhi An
2072772592 [liftoff] Use stack slot offsets instead of indices
Spill/fill now take offsets instead of indices. We provide a
helper, GetStackOffsetFromIndex, for callers. This is currently only
useful while slot sizes are still fixed to 8 bytes.

StackTransferRecipe's RegisterLoad now works in terms of offset.

LiftoffStackSlots work in terms of offset as well.

TransferStackSlot currently still works in terms of indicies, but can be
converted to use offsets in a subsequent change.

Bug: v8:9909
Change-Id: If54fb844309bdfd641720d063135dd59551813e0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1922489
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65049}
2019-11-19 18:23:28 +00:00
Igor Sheludko
e099994e60 Revert "[ptr-compr][x64] Temporarily enable pointer compression on x64"
This reverts commit 386e7dd2c5.

Reason for revert: blocking the V8 roll on linux_chromium_asan_rel_ng

Original change's description:
> [ptr-compr][x64] Temporarily enable pointer compression on x64
>
> Bug: v8:7703
> Change-Id: Iaa7a35a2438dc1181f60289190191b519e45bed0
> Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_tsan_rel
> Cq-Include-Trybots: luci.v8.try:v8_linux64_cfi_rel_ng
> Cq-Include-Trybots: luci.chromium.try:fuchsia_x64,linux-rel,mac-rel
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924347
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#65033}

TBR=machenbach@chromium.org,ishell@chromium.org,verwaest@chromium.org

Change-Id: I6dd5c0c80c9d5b4a786c9b42a60a5b850c9168ac
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7703
Cq-Include-Trybots: luci.v8.try:v8_linux64_ubsan_rel_ng,v8_linux64_tsan_rel
Cq-Include-Trybots: luci.v8.try:v8_linux64_cfi_rel_ng
Cq-Include-Trybots: luci.chromium.try:fuchsia_x64,linux-rel,mac-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1925148
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65048}
2019-11-19 18:17:50 +00:00
Milad Farazmand
1e0275a24d PPC/s390: [wasm-simd] Implement i64x2 neg for arm
Port a7b9e58810

R=zhin@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I3406f424dcf918edd8cc51f7fe94dc28c2b4ed85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1924867
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#65047}
2019-11-19 17:31:58 +00:00
Seth Brenith
9ddb8d9c03 [torque] Allow referring to structs within class fields
This is part 3 of Torquifying DescriptorArray: making it possible to use
the "descriptors" indexed field from code written in Torque. A small
macro EnsureArrayLengthWritable is converted to demonstrate the new
functionality.

This CL also introduces the arrow token `->` and desugars a->b to (*a).b
so that the new builtin looks a little cleaner.

Bug: v8:7793
Change-Id: I84eaa97f664aa67273866760e6ede4346a3ee2f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900332
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#65046}
2019-11-19 16:46:48 +00:00