Commit Graph

18770 Commits

Author SHA1 Message Date
Eric Holk
07387b3d21 [liftoff] fix statically out of bounds memory access with trap handlers
Change-Id: Idbf76d4fed6d0fe21f4af3df455a2f667942643e
Reviewed-on: https://chromium-review.googlesource.com/976946
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52195}
2018-03-23 19:24:16 +00:00
Eric Holk
c660791186 [wasm] do not reuse externalized backing stores when growing
Bug: chromium:813876
Change-Id: Ib85d4759c4e1d1c6771edb26e56202dc559854ce
Reviewed-on: https://chromium-review.googlesource.com/974706
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52194}
2018-03-23 19:23:11 +00:00
Michael Achenbach
c2837f5be7 Revert "[heap] Ensure that OOM callback is called before OOM."
This reverts commit ed3636e21b.

Reason for revert: Seems to lead to several timeouts in debug mode:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/19780

And on windows.

Original change's description:
> [heap] Ensure that OOM callback is called before OOM.
> 
> This patch also fixes MaxReserved() to accound for page headers and
> adds two tests for heap size and memory allocator size near OOM.
> 
> Bug: chromium:824214
> Change-Id: I5bbe00a9d6a5798cdf4481861a10dca842244a63
> Reviewed-on: https://chromium-review.googlesource.com/973614
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52184}

TBR=ulan@chromium.org,hpayer@chromium.org

Change-Id: I1a98c070cee4039a1ef7851fcabd32d56d0629fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:824214
Reviewed-on: https://chromium-review.googlesource.com/977973
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52192}
2018-03-23 19:16:14 +00:00
Igor Sheludko
78c6bbd930 [ic] Use Map as transition handlers instead of StoreHandler objects.
This eases transition handlers caching and avoids memory overhead of
respective StoreHandler objects. In addition, it allows to use such
transition handlers on runtime side to make Object.assign implementation
a bit faster.

Bug: v8:5988
Change-Id: Iba660a11d4b300cd5f80615fb7e2608e53da8fee
Reviewed-on: https://chromium-review.googlesource.com/931701
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52187}
2018-03-23 15:37:40 +00:00
Ulan Degenbaev
ed3636e21b [heap] Ensure that OOM callback is called before OOM.
This patch also fixes MaxReserved() to accound for page headers and
adds two tests for heap size and memory allocator size near OOM.

Bug: chromium:824214
Change-Id: I5bbe00a9d6a5798cdf4481861a10dca842244a63
Reviewed-on: https://chromium-review.googlesource.com/973614
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52184}
2018-03-23 14:47:50 +00:00
Sigurd Schneider
b6ddadd042 [turbofan] Rename StringFromCodePoint to StringFromSingleCodePoint
Also add a new fast-path for String.fromCodePoint.

R=neis@chromium.org

Bug: v8:7570, v8:7340
Change-Id: I6cd6e6fc98943588ecd646f24fcda043d4033ab0
Reviewed-on: https://chromium-review.googlesource.com/978244
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52183}
2018-03-23 14:28:38 +00:00
Sigurd Schneider
3f7b6a0f7e [turbofan] Rename StringFromCharCode to StringFromSingleCharCode
This CL also cleans up some related naming in typed-optimization.

R=neis@chromium.org

Bug: v8:7531, v8:7570
Change-Id: If80e0e9642aaf6c58b164db2e1e0632cd5b0d051
Reviewed-on: https://chromium-review.googlesource.com/978066
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52182}
2018-03-23 13:56:58 +00:00
Benedikt Meurer
ee98ee583f [builtins] Limit slow Promise.all tests to x64.
Bug: v8:7253
Change-Id: I1724fdac3668bcc05ff581113ac843ab5ef1def2
Reviewed-on: https://chromium-review.googlesource.com/977971
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52179}
2018-03-23 13:15:38 +00:00
Michael Starzinger
e5e19bf764 [wasm] Move source position tables off-heap.
This moves source position tables associated with WasmCode objects to be
located outside the garbage-collected heap. There now is a clear link to
the source position table from code, making the one-to-one relationship
and its lifetime explicit.

R=ahaas@chromium.org
BUG=v8:7424

Change-Id: I9d0b332732508c302ba525059ef02559f45aa2f6
Reviewed-on: https://chromium-review.googlesource.com/975565
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52178}
2018-03-23 12:33:53 +00:00
Dan Elphick
32d0e02639 [heap] Move RO_SPACE to beginning of AllocationSpace
Moves RO_SPACE to the front of the AllocationSpace enum, so the space
pre-allocation iterations don't miss it. Being at the start of the enum
means that it continues to not be iterated over by any sweeper code,
which iterates from FIRST_GROWABLE_PAGED_SPACE to
LAST_GROWABLE_PAGED_SPACE (renamed from FIRST_PAGED_SPACE and
LAST_PAGED_SPACE).

Bug: v8:7464
Change-Id: I480ba784afbd878552d1cb7f9f5fa57c3b55e004
Reviewed-on: https://chromium-review.googlesource.com/973604
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52177}
2018-03-23 12:32:48 +00:00
Andreas Haas
68b4026c20 [wasm][anyref] Implement decoding of new instructions
R=titzer@chromium.org

Bug: v8:7581
Change-Id: I66bf50bc1243cb5e4b9f2693febf91f74077a2f4
Reviewed-on: https://chromium-review.googlesource.com/978002
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52176}
2018-03-23 12:21:58 +00:00
Kanghua Yu
342b5b7e60 [wasm][ia32] Add S8x16Shuffle
Change-Id: I9a78e0a8f673f311414f72055958c52d3c2cb0cd
Reviewed-on: https://chromium-review.googlesource.com/908256
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52166}
2018-03-23 02:20:03 +00:00
Eric Holk
d31dff841e [wasm] always allocate memory when guard regions are needed
When using trap handlers, memory references do not get any checks inserted. This
means there is no check for a null memory as happens when the memory size is
0. Normally this would be correctly caught as an out of bounds access, since the
low memory addresses are not normally mapped. However, if they were mapped for
some reason, we would not catch the out of bounds access.

The fix is to ensure WebAssembly instances always have a guard region even if
the memory is size 0.

This is a rewrite of 5e76ff5a4a

Note that this can lead to a large amount of unnecessary address space usage,
so we share a single reservation for empty array buffers.

Bug: chromium:769637

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia8e84be6d595e347d3d342959f2c374db1a3f683
Reviewed-on: https://chromium-review.googlesource.com/702657
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52163}
2018-03-22 19:44:17 +00:00
Clemens Hammacher
2589ea08e3 [Liftoff] Fix conditional spilling
On float comparisons, we need a scratch byte register for the setcc
instruction, and if none is available, we spill. But this spilling code
is skipped if one of the operands is NaN. The cache state is updated
however, so following code assumes that the spill happened.
This CL fixes this by spilling before checking for NaN, such that the
spilling code is always executed.

R=titzer@chromium.org

Bug: v8:7582, v8:6600
Change-Id: I768d8de14e494d3ebea181c1f9f3129a4b005396
Reviewed-on: https://chromium-review.googlesource.com/973961
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52162}
2018-03-22 18:45:17 +00:00
Michael Achenbach
85432a2381 Revert "Reland "[d8][wasm] Test wasm compilation completion""
This reverts commit 4d1c2907d3.

Reason for revert: Still often hangs:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/23898

Original change's description:
> Reland "[d8][wasm] Test wasm compilation completion"
> 
> This is a reland of ed2605f040
> 
> Original change's description:
> > [d8][wasm] Test wasm compilation completion
> > 
> > d8 was recently changed to keep running until wasm compilation has
> > completed. This adds a message test to test that.
> > 
> > R=ahaas@chromium.org
> > 
> > Change-Id: I73af53b6df4ee5f9a6afd26cf2d71a269140465f
> > Reviewed-on: https://chromium-review.googlesource.com/966184
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#52008}
> 
> Change-Id: Iadbd5056dfa58da454956c4e89369af8b0455b35
> Reviewed-on: https://chromium-review.googlesource.com/975242
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52154}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I4c2f3f69d6a2e749ce7c5379a3949d098c5946c4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/975835
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52160}
2018-03-22 17:43:29 +00:00
Leszek Swirski
51ded9d3c0 Reland^2: Remove SFI code field
This is a reland of d8f564eac6

TBR=mstarzinger@chromium.org,yangguo@chromium.org,jgruber@chromium.org

Original change's description:
> Reland: Remove SFI code field
>
> Remove the SharedFunctionInfo code field, inferring the code object
> from the function_data field instead. In some cases, the function_data
> field can now hold a Code object (e.g. some WASM cases).
>
> (Reland of https://chromium-review.googlesource.com/952452)
>
> TBR=mstarzinger@chromium.org
>
> Bug: chromium:783853
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I10ea5be7ceed1b51362a2fad9be7397624d69343
> Reviewed-on: https://chromium-review.googlesource.com/970649
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52136}

Bug: chromium:783853
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I5187851b923e9a92f43daf8cb99e662786cbb839
Reviewed-on: https://chromium-review.googlesource.com/975942
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52159}
2018-03-22 17:06:06 +00:00
Clemens Hammacher
4d1c2907d3 Reland "[d8][wasm] Test wasm compilation completion"
This is a reland of ed2605f040

Original change's description:
> [d8][wasm] Test wasm compilation completion
> 
> d8 was recently changed to keep running until wasm compilation has
> completed. This adds a message test to test that.
> 
> R=ahaas@chromium.org
> 
> Change-Id: I73af53b6df4ee5f9a6afd26cf2d71a269140465f
> Reviewed-on: https://chromium-review.googlesource.com/966184
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52008}

Change-Id: Iadbd5056dfa58da454956c4e89369af8b0455b35
Reviewed-on: https://chromium-review.googlesource.com/975242
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52154}
2018-03-22 15:54:06 +00:00
Sigurd Schneider
543c007ea6 [turbofan] Optimize string comparisons more
Bug: v8:7531, chromium:822170
Change-Id: Ida5b0714a584df3d830f95088db51c1841b63cc2
Reviewed-on: https://chromium-review.googlesource.com/966062
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52153}
2018-03-22 15:05:46 +00:00
Yang Guo
839f55f50b [inspector] expose breakpoints for builtins and API functions.
R=jgruber@chromium.org, kozyatinskiy@chromium.org

Bug: v8:178
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Idee461c6ff6c8a14b01229ea6448e437f3db6dab
Reviewed-on: https://chromium-review.googlesource.com/973202
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52151}
2018-03-22 14:48:35 +00:00
Ulan Degenbaev
28190980c1 [heap] Pass isolate to the OOM handler and add an OOM test.
This patch also moves Shell::Exit to base::OS::ExitProcess.

Bug: chromium:824214
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I6565eebe9332557bbfb8e67c88890b7099b1db98
Reviewed-on: https://chromium-review.googlesource.com/975403
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52150}
2018-03-22 14:44:50 +00:00
Leszek Swirski
52e939e9ee [turbofan] Fix accumulator liveness on suspends
SuspendGenerator needs the accumulator to be live so that it can return
it.

Bug: chromium:806723
Change-Id: Iaa88fce96c36876e3e4256324ca650d475480c10
Reviewed-on: https://chromium-review.googlesource.com/975404
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52147}
2018-03-22 13:46:04 +00:00
Stephan Herhut
34022a65b6 [wasm] Log wasm codes on module creation.
Delaying the logging until after module creating ensures that the
module has been fully parsed and hence that all names are available.

Also refactors the code to bring all code logging/disassembling into
one place.

Change-Id: I8219d70876d2ccd3a5ffb8250b46fdf60a46fe6c
Reviewed-on: https://chromium-review.googlesource.com/973443
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52146}
2018-03-22 13:17:39 +00:00
Leszek Swirski
48f89fbdc4 Revert "Reland: Remove SFI code field"
This reverts commit d8f564eac6.

Reason for revert: Breaks mac asan (https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/17067)

Original change's description:
> Reland: Remove SFI code field
> 
> Remove the SharedFunctionInfo code field, inferring the code object
> from the function_data field instead. In some cases, the function_data
> field can now hold a Code object (e.g. some WASM cases).
> 
> (Reland of https://chromium-review.googlesource.com/952452)
> 
> TBR=mstarzinger@chromium.org
> 
> Bug: chromium:783853
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I10ea5be7ceed1b51362a2fad9be7397624d69343
> Reviewed-on: https://chromium-review.googlesource.com/970649
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52136}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,leszeks@chromium.org

Change-Id: I348ec7a9d837a7b068fd08312b77e87abf21be7b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:783853
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/975305
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52143}
2018-03-22 12:56:54 +00:00
Clemens Hammacher
be1b2d66c0 [wasm] Fix deadlock on async compilation
See referenced bug: Async compilation can deadlock if a background task
queues the last compilation unit to be finished while the finisher
is already exiting because there was no more work.
This CL fixes this by making the finisher task check for new work after
setting the finisher_is_running_ flag to false.

R=ahaas@chromium.org
CC=kimanh@google.com

Bug: chromium:824681
Change-Id: If1f5700a9fdd5d150b36e37a5d14b692c2b0f3fb
Reviewed-on: https://chromium-review.googlesource.com/975301
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52139}
2018-03-22 11:57:21 +00:00
Clemens Hammacher
9beac3838d [fuzzer] Slightly improve generated test cases
Mostly cosmetic changes. The biggest change is to encode block result
types using symbolic names instead of hex numbers.

R=ahaas@chromium.org

Change-Id: Ic0e6eccf687338e68508094168ddd70734cef301
Reviewed-on: https://chromium-review.googlesource.com/973527
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52138}
2018-03-22 11:53:50 +00:00
Leszek Swirski
d8f564eac6 Reland: Remove SFI code field
Remove the SharedFunctionInfo code field, inferring the code object
from the function_data field instead. In some cases, the function_data
field can now hold a Code object (e.g. some WASM cases).

(Reland of https://chromium-review.googlesource.com/952452)

TBR=mstarzinger@chromium.org

Bug: chromium:783853
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I10ea5be7ceed1b51362a2fad9be7397624d69343
Reviewed-on: https://chromium-review.googlesource.com/970649
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52136}
2018-03-22 11:16:20 +00:00
Benedikt Meurer
d8658177ba [builtins] Reduce resolve element closure overhead in Promise.all.
In Promise.all we used to allocate a fresh closure plus a fresh context
for each individual element, which is quite a lot of overhead, especially
since this could be shared in a single context for all elements. The only
bit of information that is needed for each resolve element closure is the
index under which to store the resulting value. With this change we move
this index to the "identity hash" field of the JSFunction, which doesn't
care about the concrete value anyways, as long as it's not zero (the "no
hash" sentinel), and share the rest of the fields in a single outer
context for all resolve element closures.

This limits the maximum number of elements for Promise.all to 2^21 for
now, but that should be fine. Shall we ever see the need for more than
this, we can add machinery to overflow to separate context for indices
larger than 2^21.

This significantly reduces the overhead due to Promise.all on the
parallel-async-es2017-native test, with execution time dropping from
around 148ms to 133ms, so overall a steady 10% improvement on this
benchmark.

Bug: v8:7253
Change-Id: I1092da771c4919f3db7129d2b0a244fc26a7b144
Reviewed-on: https://chromium-review.googlesource.com/973283
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52134}
2018-03-22 10:55:20 +00:00
Andreas Haas
80df03e31f [wasm][anyref] Add support for AnyRef in signature decoding
R=titzer@chromium.org

Bug: v8:7581
Change-Id: I51c585aafa71cbc20565974929cba8327d7f8427
Reviewed-on: https://chromium-review.googlesource.com/973305
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52133}
2018-03-22 10:24:33 +00:00
Benedikt Meurer
6b72fe3b64 [js-perf-test] Don't run SixSpeed benchmarks with --future.
Change-Id: I187cf2f5cffa48ea4eb3d137260fd6dc555b1ed5
Reviewed-on: https://chromium-review.googlesource.com/974404
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52129}
2018-03-22 09:50:12 +00:00
Sigurd Schneider
c35eee3b56 [cleanup] Remove more OpParameter
Bug: v8:7570, v8:7517
Change-Id: Ia62a9afeec0d0df1596198deec6165a3f02edeaa
Reviewed-on: https://chromium-review.googlesource.com/973606
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52120}
2018-03-21 17:02:39 +00:00
Leszek Swirski
cbbdc6cb83 Use code tracer for code printing
Fix up disassembly triggered by --print-*-code to print to the trace
file specified by --redirect-code-traces-to rather than unconditionally
to stdout.

Change-Id: I80a8772361e8fb0550efcbbab6a7b7d822385303
Reviewed-on: https://chromium-review.googlesource.com/973167
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52119}
2018-03-21 16:58:49 +00:00
Clemens Hammacher
8bb41e8d94 [Liftoff] Fix stack slot overwrite
On ia32, the upper "half stack slot" must be located above the lower
half stack slot (in absolute address), hence the index is
"2 * index - 1" instead of "2 * index + 1". Note that the index
describes the negative offset from the stack pointer.

R=titzer@chromium.org

Bug: v8:7579
Change-Id: If207af405b126ab30043432d7934273e6e2a5330
Reviewed-on: https://chromium-review.googlesource.com/973301
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52116}
2018-03-21 15:38:39 +00:00
Michael Starzinger
ef00f27ef3 [wasm] Remove {NativeModule::LinkAll} test-only method.
R=clemensh@chromium.org

Change-Id: Iee10287cdd157d5a62d75624d5099919d8e0a55d
Reviewed-on: https://chromium-review.googlesource.com/973168
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52114}
2018-03-21 15:14:18 +00:00
Sigurd Schneider
b73cbb32c5 [turbofan] Move Number.isSafeInteger to JSCallReducer
This also introduces two new simplified operators, ObjectIsSafeInteger
and NumberIsSafeInteger.

Bug: v8:7340, v8:7250
Change-Id: I9a3028d844e6614ed248a03fe24b431fb54938f0
Reviewed-on: https://chromium-review.googlesource.com/973221
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52112}
2018-03-21 13:12:18 +00:00
Yang Guo
a3991ed451 [debug] correctly get arg count for optimized builtin frames.
R=jgruber@chromium.org

Bug: v8:178
Change-Id: Ie2279c8a1bb50d01186dbd9dd29145bca9aeaf6f
Reviewed-on: https://chromium-review.googlesource.com/972983
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52106}
2018-03-21 11:00:51 +00:00
jgruber
b8ae2249a4 [tests] Fix assertFalse(exception) anti-pattern
Some debugging tests relied on the following anti-pattern:

 let exception = false;

 try {
   /* ... some code that may throw on test failure ... */
 } catch (e) {
   exception = e;
 }

 assertFalse(exception);

This may be problematic if a falseish value is thrown.

Change-Id: I02eace4cc656fc9581928a90ac53cda4dc72b30c
Reviewed-on: https://chromium-review.googlesource.com/972822
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52105}
2018-03-21 10:59:46 +00:00
Andreas Haas
ba5409a6fd [wasm] Make multi-return tests wasm-specific
The multi-return tests and fuzzer used a custom call descriptor which
was based on the default RegisterConfiguration. This meant that for the
tests, all available registers could be used to pass parameters and to
return values. This caused a problem, because in some cases we need a
scratch register in the frame deconstruction.

With this CL I change both the tests and the fuzzer to use the
WebAssembly call descriptor. Thereby we only use 2 registers for
returns, and one of the other registers can be used as scratch
register.

WebAssembly is the only use case at the moment which wants to return
values not only through registers but also over the stack. Therefore
I think it's acceptable to only test the WebAssembly usecase.

R=mstarzinger@chromium.org

Bug: chromium:813288
Change-Id: I31bed757af5f3e8589d2b3dfb6f0112ddecd1a20
Reviewed-on: https://chromium-review.googlesource.com/970656
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52099}
2018-03-21 09:56:12 +00:00
Marja Hölttä
4f506dbeec [parser] Fix aborting preparsing of a function with a rest param.
BUG=chromium:813630

Change-Id: I9eeaeb8830533c178c8073f48f036f9af8887a55
Reviewed-on: https://chromium-review.googlesource.com/972901
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52095}
2018-03-21 09:04:07 +00:00
jgruber
68bdf6a75c [builtins] Remove --stress-off-heap-code flag
Embedded builtins are now based off the v8_enable_embedded_builtins
gn flag instead, which conditionally defines V8_EMBEDDED_BUILTINS.

Bug: v8:6666
Change-Id: I44d40d30fce3a3ed9bbf973d46c4990ba3fade40
Reviewed-on: https://chromium-review.googlesource.com/964361
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52092}
2018-03-21 08:52:17 +00:00
jing.bao
3512721c7f [wasm]implement simd lowering for F32x4RecipApprox/F32x4RecipSqrtApprox
Change-Id: I53136c1c296b112e9521fa21e85e945267e51059
Reviewed-on: https://chromium-review.googlesource.com/963702
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#52086}
2018-03-21 02:09:33 +00:00
Alexei Filippov
767b8edd9d [inspector] Add Runtime.getIsolateId & Runtime.getHeapUsage commands
BUG=chromium:823874

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I1df9347ead62dc84150f5549c29815600609c55b
Reviewed-on: https://chromium-review.googlesource.com/972181
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52085}
2018-03-20 23:33:53 +00:00
Eric Holk
7c61c3ce6e [wasm] Add new API for enabling trap handler
The new API supersedes the old `RegisterDefaultSignalHandler` and flag
combination. Now the embedder must explicitly call
`EnableWebAssemblyTrapHandler` to activate the trap handler and optionally
install the default signal handler. The old flag is now used only by D8 to
decide whether to call this function.

Bug: v8:5277

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I05fbb2138138bfc95b14361aabd712db84789b4a
Reviewed-on: https://chromium-review.googlesource.com/963179
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52081}
2018-03-20 18:06:38 +00:00
Eric Holk
f866af42ae [wasm] Track Wasm allocations in WasmMemoryTracker
This moves the Wasm-specific metadata from being fields on the
ArrayBuffer into a table managed by WasmMemoryTracker.

Bug: chromium:776273
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Id8b050bfdfe0fbe9436fb055e92c08d503d3c2ba
Reviewed-on: https://chromium-review.googlesource.com/850550
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52080}
2018-03-20 17:59:38 +00:00
Igor Sheludko
f52d005395 [iterpreter] Share feedback slots for global stores to the same variable.
Bug: v8:7206, chromium:576312
Change-Id: I1628e7966a40fa7d6f628bd972b0ad0142a5d349
Reviewed-on: https://chromium-review.googlesource.com/970825
Reviewed-by: Mythri Alle <mythria@google.com>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52075}
2018-03-20 17:05:38 +00:00
Vasili Skurydzin
6bc4bfea65 Fixes to V8 GN build process on aix platform
src/base/debug/stack_trace_posix.cc: suppressed unused function warnings
for functions DemangleSymbols, OutputPointer(in order to compile with
-Werror flag)

test/cctest/test-isolate-independent-builtins.cc: corrections to make
ByteInText test case compatible with aix. (affects aix only)

Change-Id: I49e45e63545404c77aaed3f51b26557f6f03455e
Reviewed-on: https://chromium-review.googlesource.com/927484
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52071}
2018-03-20 16:16:54 +00:00
Yang Guo
5b7854f008 [debug] Unskip tests for debug break in builtins.
Win64 MSVC build seems to be fixed.

Bug: v8:178
Change-Id: I6d3ec22511a7a3c25467c486d3d05df0939c7c87
Reviewed-on: https://chromium-review.googlesource.com/970469
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52068}
2018-03-20 14:00:13 +00:00
Ulan Degenbaev
23a593b9d8 [api] Deprecate HeapProfiler::SetWrapperClassInfoProvider.
The embedders should use the EmbedderGraph API. The similar structure
can be created with the following steps:
1) Create a root node for each retainer info group.
2) Iterate all handles using Isolate::VisitHandlesWithClassIds.
3) Add an edge from the retainer info node to the v8 wrapper node.
4) Add an edge from the v8 wrapper node to the retainer info node.

See how HeapSnapshotRetainedObjectInfo is converted to the new API.

Bug: chromium:749490
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I124ae3853354863b4f888e6aa2ea13777dcaa37d
Reviewed-on: https://chromium-review.googlesource.com/948842
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52067}
2018-03-20 13:53:43 +00:00
Leszek Swirski
9b4d8fe41f Revert "Remove SFI code field"
This reverts commit 520b025f72.

Reason for revert: Breaks internal-snapshot build: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20internal%20snapshot/builds/14603

Original change's description:
> Remove SFI code field
> 
> Remove the SharedFunctionInfo code field, inferring the code object
> from the function_data field instead. In some cases, the function_data
> field can now hold a Code object (e.g. some WASM cases).
> 
> Bug: chromium:783853
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I1219a4d6aa5abaa9fee54dda883da7a3186e347a
> Reviewed-on: https://chromium-review.googlesource.com/952452
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52064}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,leszeks@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

Change-Id: Iaf464ed29ba4317bbbb255c1aec76fb65cddba84
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:783853
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/970647
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52066}
2018-03-20 13:47:34 +00:00
Leszek Swirski
520b025f72 Remove SFI code field
Remove the SharedFunctionInfo code field, inferring the code object
from the function_data field instead. In some cases, the function_data
field can now hold a Code object (e.g. some WASM cases).

Bug: chromium:783853
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I1219a4d6aa5abaa9fee54dda883da7a3186e347a
Reviewed-on: https://chromium-review.googlesource.com/952452
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52064}
2018-03-20 13:14:53 +00:00
Yang Guo
ea2007d870 Fix register allocation in tail-call to TFJ builtin.
R=jgruber@chromium.org

Bug: v8:178
Change-Id: Id00ae14cb5a50e560f93249eed4e4b20aa0a6ce7
Reviewed-on: https://chromium-review.googlesource.com/970467
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52058}
2018-03-20 12:09:23 +00:00