Commit Graph

38232 Commits

Author SHA1 Message Date
yangguo
07ee0b175c [debugger] correctly annotate scripts with debug id.
Previously, we would incorrectly not assign any debug id to scripts
deserialized from the code cache.

R=jgruber@chromium.org
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2742713003
Cr-Commit-Position: refs/heads/master@{#43740}
2017-03-13 09:13:43 +00:00
shiyu.zhang
78199ce5e0 [turbofan] Enable complex memory operands for binops on ia32/x64
With this change, on ia32 and x64, a load from memory into a register can be replaced by a memory operand for integer binops if it makes sense.

BUG=

Review-Url: https://codereview.chromium.org/2728533003
Cr-Commit-Position: refs/heads/master@{#43739}
2017-03-13 08:50:54 +00:00
cwhan.tunz
4aeb265799 Remove DCHECKs in TypedElementsAccessor
Since typedarrays are integer indexed exotic objects, we don't need to
check if prototypes of a typedarray have elements or not.

https://tc39.github.io/ecma262/#sec-integer-indexed-exotic-objects-get-p-receiver

BUG=699020

Review-Url: https://codereview.chromium.org/2744103002
Cr-Commit-Position: refs/heads/master@{#43738}
2017-03-13 08:37:54 +00:00
Michael Achenbach
384fe54e02 [test] Mark slow msan tests
TBR=mstarzinger@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: I355953b0b24a64e3c5e1a43cdeaa8ec2650b0988
Reviewed-on: https://chromium-review.googlesource.com/453459
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43737}
2017-03-13 08:17:54 +00:00
bmeurer
b8453628c9 [turbofan] Less aggressively insert SOFT deopts for property access.
Sometimes TurboFan is able to extract receiver maps from the surrounding
graph and thus is able to generate reasonable code for property accesses,
even if those haven't been executed in the baseline tier yet. So, only
stick in an SOFT deoptimization exit, if ExtractReceiverMaps failed to
infer proper receiver maps.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2746013002
Cr-Commit-Position: refs/heads/master@{#43736}
2017-03-13 07:23:44 +00:00
bmeurer
9bee8f1065 [turbofan] Fix lowering of Number.isNaN().
BUG=v8:6082
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2743183003
Cr-Commit-Position: refs/heads/master@{#43735}
2017-03-13 07:00:59 +00:00
yangguo
35b06c51a4 Alpha-sort .gitignore.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2747673003
Cr-Commit-Position: refs/heads/master@{#43734}
2017-03-13 06:44:25 +00:00
bmeurer
4da9b8afac [csa] Remove context inputs from StrictEqual, SameValue and Typeof.
These operations don't need the context, so no need to pass the context
to them. Also avoids the loading of context in the interpreter bytecode
handlers for StrictEqual and Typeof.

BUG=v8:5268,v8:5269
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2744173002
Cr-Commit-Position: refs/heads/master@{#43733}
2017-03-13 06:00:28 +00:00
jyan
55e3fb94ac s390: cleanup old instruction decode routines
R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2741053004
Cr-Commit-Position: refs/heads/master@{#43732}
2017-03-12 04:40:22 +00:00
v8-autoroll
857c62788d Update V8 DEPS.
Rolling v8/build: cc228ab..1748b43

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I03b8c1bc81ab91e6fc13acd13c88f63c1b7150b3
Reviewed-on: https://chromium-review.googlesource.com/453019
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43731}
2017-03-12 04:21:58 +00:00
littledan
7e87f44625 [date] Add a cache for timezone names to DateCache
To speed up Date.prototype.toString(), this patch adds a cache in
the DateCache for the string short name representing the time zone.
Because time zones in a particular location just have two short names
(for DST and standard time), and the DateCache already understands
whether a time is in DST or not, it is possible to keep the result
of OS::LocalTimezone around and select between the two based on
whether the time is DST or not.

In local microbenchmarks (calling Date.prototype.toString() in a
loop), I observed a 6-10% speedup with this patch. In the browser,
the speedup may be even greater as the system call needs to do
some extra work to break out of the sandbox. I don't think the
microbenchmark is extremely unrealistic; in any real program which
calls Date.prototype.toString() multiple times, the cache should
hit almost all of the time, as time zone changes are rare.

The proximate motivation for this patch was to enable ICU as a
backend for timezone information, which is drafted at
https://codereview.chromium.org/2724373002/
The ICU implementation of OS::LocalTimezone is even slower than
the system call one, but this patch makes their performance
indistinguishable on the microbenchmark.

In the tz database, many timezones actually do have a number of different
historical names. For example, America/Anchorage went through a number of
changes, from AST to AHST to YST to AKST. However, both ICU and the
Linux OS interfaces just report the modern timezone name in tests
for the appropriate timezone name, even for historical times. I can
see why this would be:
- For ICU, CLDR only has two short names in the data file: the one for
  dst and non-dst
- For Linux, the timezone names do seem to make it into the
  /etc/localtime file. However, glibc assumes there are only two relevant
  names and selects between them, as you can see in its implementation
  of localtime_r:
  http://bazaar.launchpad.net/~vcs-imports/glibc/master/view/head:/time/tzset.c#L573
So, this cache should be valid until we switch to a more accurate source
of short timezone names.

BUG=v8:6031

Review-Url: https://codereview.chromium.org/2726253002
Cr-Commit-Position: refs/heads/master@{#43730}
2017-03-11 22:49:36 +00:00
v8-autoroll
244d014f8a Update V8 DEPS.
Rolling v8/build: 957a0ba..cc228ab

Rolling v8/third_party/catapult: 2ae07fc..4550ebc

Rolling v8/tools/clang: 61f0bb2..49cece5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I6a50b1e956c7dc857729b570bbc0d29a4552f8a7
Reviewed-on: https://chromium-review.googlesource.com/453040
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43729}
2017-03-11 04:20:23 +00:00
jyan
9598bb9335 s390: implement atomic exchange on TF
R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2743803002
Cr-Commit-Position: refs/heads/master@{#43728}
2017-03-10 18:41:06 +00:00
jkummerow
e61add91c1 [turbofan] Fix ReduceNamedAccess for detached global proxies
There is no guarantee that Map::GetConstructor() returns a JSFunction.
Specifically, detached global proxies return the |null| sentinel. So
we have to check the object type before casting to JSFunction.

BUG=chromium:694141

Review-Url: https://codereview.chromium.org/2739303003
Cr-Commit-Position: refs/heads/master@{#43727}
2017-03-10 18:33:35 +00:00
Leszek Swirski
12ffd366fc [log] Add sampling interval flag for --prof
Note that this changes the sampling interval from milliseconds to
microseconds -- this shouldn't cause issues except for tools that use
'profiler,"begin",<interval>' somehow.

Change-Id: I20222de91f7820e26eb3fc505a4752b0bc7e1642
Reviewed-on: https://chromium-review.googlesource.com/451658
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43726}
2017-03-10 17:45:54 +00:00
Sathya Gunasekaran
36a22fe775 [debug] Add exception predictions to builtins where missing.
This fixes the catch predictions for the following builtins --
AsyncFunctionAwaitCaught
AsyncFunctionAwaitUncaught
PromiseResolveClosure
ResolvePromise
PromiseResolve

Added tests for each.

Added whitelist for builtins behind a flag.

BUG=chromium:691875

Change-Id: I816cafdb69f0c9f1eefc440a0a44c36713d0b7dc
Reviewed-on: https://chromium-review.googlesource.com/450894
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43725}
2017-03-10 17:44:51 +00:00
kozyatinskiy
fb147b0ef1 [inspector] merged IsSubjectToDebugging and IsBlackboxed and fixed issue
- additionally doesn't deoptimize function in HandleDebugBreak for debugger statements inside of blackboxed code.

BUG=none
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2742843003
Cr-Commit-Position: refs/heads/master@{#43724}
2017-03-10 17:44:35 +00:00
Toon Verwaest
6b15cdb200 [runtime] Check for named interceptors that can't deal with symbols in the lookup iterator
BUG=

Change-Id: I5a4d398283c6fbbbc778d6f6c4555763f8869249
Reviewed-on: https://chromium-review.googlesource.com/452581
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43723}
2017-03-10 13:36:06 +00:00
Peter Marshall
9aed0c4321 [csa] Remove double pointer load in Allocation with kDoubleAlignment.
AllocateRawAligned called into AllocateRawUnaligned, which expected
the address of the pointer to the top of the stack, not the pointer
itself. Instead, the pointer itself was passed, causing segfaults
if this code is actually run.

Also do some drive-by clean up of the branching/labels and unused
vars etc. in AllocateRawAligned.

BUG=v8:6075

Change-Id: If71db4b61d777b6543e5246e92bb5b9e6c02c81f
Reviewed-on: https://chromium-review.googlesource.com/452374
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43722}
2017-03-10 13:33:28 +00:00
Michael Achenbach
3d3de00717 [test] Drop testing ignition_staging
Removing it from default variants set which will substantially increase test speed for developers.

Pure ignition is intended to be tested only on bots unless opted in.

BUG=chromium:682617
R=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org

Change-Id: I98adb81951a0a2d16f52e6b34b98d3a90e178d8a
Reviewed-on: https://chromium-review.googlesource.com/452580
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43721}
2017-03-10 12:01:01 +00:00
Michael Starzinger
f2ad990f41 Fix bogus implication from --turbo to --crankshaft.
Now that the --turbo flag is on by default, this implication makes it
impossible to disable the runtime profiler to prevent functions from
being considered hot. Essentially the --nocrankshaft flag was borked.

R=machenbach@chromium.org

Change-Id: I698008b4b69038e8bfab6d8ec3ccf57e2fd71701
Reviewed-on: https://chromium-review.googlesource.com/452619
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43720}
2017-03-10 11:37:24 +00:00
Michael Achenbach
146c9e5406 [foozzie] Consistently drop validate-asm flag
Also format flags in single lines to make configs easier to read and modify.

BUG=chromium:673246
NOTRY=true
R=mstarzinger@chromium.org,titzer@chromium.org,rmcilroy@chromium.org

Change-Id: If37486c98af161467b639271b035207c3ae1077a
Reviewed-on: https://chromium-review.googlesource.com/452579
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43719}
2017-03-10 11:03:08 +00:00
Georg Neis
0b2bd664ef [mips*] Do not flush icache in RelocInfo::apply.
The callers of this function already do the flushing (as its comment demands).

BUG=

Change-Id: Iff6720f4ddecb1a4569b6cac66eba4b857c46b17
Reviewed-on: https://chromium-review.googlesource.com/452504
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43718}
2017-03-10 10:51:48 +00:00
Camillo Bruni
53d67fe45d [tools] Show more entries in the ticks-processor
- lower the cutoff-threshold for bottom up graphs to 1%
- show all builtins/stubs/ics by default

R=jkummerow@chromium.org

Change-Id: I522173155b817ae20a37c40ecf411f2b55d82105
Reviewed-on: https://chromium-review.googlesource.com/452482
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43717}
2017-03-10 10:34:11 +00:00
wiktorg
61a8954eae [parser] Make reusable_preparser really reusable
BUG=
R=marja@chromium.org

Review-Url: https://codereview.chromium.org/2738153003
Cr-Commit-Position: refs/heads/master@{#43716}
2017-03-10 09:16:55 +00:00
Michael Lippautz
38862054f3 [heap] Remove unused parameter from TransferColor
BUG=

Change-Id: Icfc5412316279bed6cc95107303fbee6be66ebb4
Reviewed-on: https://chromium-review.googlesource.com/452618
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43715}
2017-03-10 08:28:21 +00:00
yangguo
faf5f52627 [debugger,api] deprecate everything in v8-debug.h
R=clemensh@chromium.org, jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2727393003
Cr-Commit-Position: refs/heads/master@{#43714}
2017-03-10 07:06:25 +00:00
yangguo
a3a244cb87 Remove commented out code in GlobalHandles::Node.
This is clearly a case of "nuke later" where later means now.

R=mlippautz@chromium.org
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2741723002
Cr-Commit-Position: refs/heads/master@{#43713}
2017-03-10 07:04:45 +00:00
yangguo
62b0fa2ee9 Allow C++11 in unittests.
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2741573003
Cr-Commit-Position: refs/heads/master@{#43712}
2017-03-10 06:35:51 +00:00
bmeurer
f66d934bae [compiler] Log message when function is already in optimization queue.
Add log message when RuntimeProfiler checks whether to optimize a
function, but that function is already in the optimization queue
(with --trace-opt-verbose).

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2740103003
Cr-Commit-Position: refs/heads/master@{#43711}
2017-03-10 05:36:00 +00:00
yangguo
c827075993 [inspector] do not translate offset to line/column for coverage.
R=caseq@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2741653003
Cr-Commit-Position: refs/heads/master@{#43710}
2017-03-10 05:19:04 +00:00
v8-autoroll
0444a96214 Update V8 DEPS.
Rolling v8/build: 33b29e1..957a0ba

Rolling v8/third_party/catapult: 38ed490..2ae07fc

Rolling v8/tools/clang: e96a7b4..61f0bb2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I24ee3abd981a32f76a2eba47935e8ac0a5f9203e
Reviewed-on: https://chromium-review.googlesource.com/452322
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43709}
2017-03-10 04:31:13 +00:00
jing.bao
b9614d4bd1 Add several SIMD opcodes to IA32
CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
Int32x4Add, Int32x4Sub

Also add paddd, psubd, vpaddd, vpsubd, pinsrw to ia32-assembler

BUG=

Review-Url: https://codereview.chromium.org/2695613004
Cr-Original-Commit-Position: refs/heads/master@{#43483}
Committed: 4deb9ffdec
Review-Url: https://codereview.chromium.org/2695613004
Cr-Commit-Position: refs/heads/master@{#43708}
2017-03-10 02:40:06 +00:00
jshin
fd5b3e755d Prepare for ICU's switch to char16_t
ICU's UChar was uint16_t (non-Win) or wchar_t (Windows). It's switching
to char16_t in both C/C++ API. It needs some changes. Fortunately,
v8 needs only a couple of changes because v8 has been using
reinterpret_cast in many places calling ICU API.

This change was confirmed to work fine with ICU-59-to-be.

BUG=v8:6062
TEST=trybot

Review-Url: https://codereview.chromium.org/2738503008
Cr-Commit-Position: refs/heads/master@{#43707}
2017-03-09 20:01:15 +00:00
Camillo Bruni
9ac64ca191 [api] Add v8::Isolate::DumpAndResetStats
Chrome no longer calls v8::Isolate::Dispose on shutdown, essentially preventing
the use of V8 stats within chrome/content_shell. This CL adds a basic hook to
the api that is then used to only print the stats.

Chrome change: https://codereview.chromium.org/2693353002

Change-Id: I1481c14afe611e9c08ae67c815201a45940daa57
Reviewed-on: https://chromium-review.googlesource.com/452338
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43706}
2017-03-09 17:30:42 +00:00
Camillo Bruni
0fb37ad007 Revert "[tools] Show more entries in the ticks-processor"
This reverts commit 8cebe1cc71.

Reason for revert: Failing ticksprocessor tests

Original change's description:
> [tools] Show more entries in the ticks-processor
> 
> - lower the cutoff-threshold for bottom up graphs to 1%
> - show all builtins/stubs/ics by default
> 
> R=​jkummerow@chromium.org
> 
> Change-Id: I85f8c4f00c5f36407bc5d9f81bead8f39a5ef632
> 
> NOTRY=true
> 
> Change-Id: I85f8c4f00c5f36407bc5d9f81bead8f39a5ef632
> Reviewed-on: https://chromium-review.googlesource.com/452300
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43704}

TBR=jkummerow@chromium.org,cbruni@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I4e911778eebcaebaab6658f2956c9fb7c35d0ee3
Reviewed-on: https://chromium-review.googlesource.com/452339
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43705}
2017-03-09 16:59:10 +00:00
Camillo Bruni
8cebe1cc71 [tools] Show more entries in the ticks-processor
- lower the cutoff-threshold for bottom up graphs to 1%
- show all builtins/stubs/ics by default

R=jkummerow@chromium.org

Change-Id: I85f8c4f00c5f36407bc5d9f81bead8f39a5ef632

NOTRY=true

Change-Id: I85f8c4f00c5f36407bc5d9f81bead8f39a5ef632
Reviewed-on: https://chromium-review.googlesource.com/452300
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43704}
2017-03-09 15:59:36 +00:00
yangguo
1f2a31c863 Move CopyValuesTo to SeededNumberDictionary.
R=ishell@chromium.org
BUG=v8:6073

Review-Url: https://codereview.chromium.org/2737373003
Cr-Commit-Position: refs/heads/master@{#43703}
2017-03-09 15:42:45 +00:00
sreten.kovacevic
3fae880f9e MIPS64: Port "[turbofan] Do not use ubfx for shr+and combination for mask=0."
Port 040fa762df

TEST=cctest/test-run-machops/Regression6046b
BUG=

Review-Url: https://codereview.chromium.org/2742773002
Cr-Commit-Position: refs/heads/master@{#43702}
2017-03-09 15:32:36 +00:00
Michael Achenbach
abc055e7b2 [test] Enable test coverage for noturbo
BUG=chromium:682617
R=mstarzinger@chromium.org,bmeurer@chromium.org

Change-Id: I1dedc4e2a0cb6e5e42b734c7eb99a40164da4229
Reviewed-on: https://chromium-review.googlesource.com/452498
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43701}
2017-03-09 14:41:33 +00:00
danno
e466744da5 [interpreter] Create custom call opcodes for specific argument counts
Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
and CallProperty2. Also share the bytecode handler code between between
equivalent CallX and CallPropertyX handlers.

Review-Url: https://codereview.chromium.org/2684993002
Cr-Original-Commit-Position: refs/heads/master@{#43290}
Committed: 00d6f1f80a
Review-Url: https://codereview.chromium.org/2684993002
Cr-Commit-Position: refs/heads/master@{#43700}
2017-03-09 14:40:02 +00:00
bmeurer
18be5d7057 [turbofan] Revert invalid optimization of flooring division.
The optimization

  NumberFloor(NumberDivide(lhs, rhs))

to

  NumberToInt32(NumberDivide(lhs, rhs))

for potentially negative lhs is not valid, since Math.floor rounds
towards -infinity, whereas ToInt32 truncates.

BUG=chromium:699282
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2743673002
Cr-Commit-Position: refs/heads/master@{#43699}
2017-03-09 13:41:39 +00:00
yangguo
0ca72de24c [simulator] remove unused argument field for stop/breaks.
We used to embed a string address as description right after
a stop instruction, which the simulator would read and print.
We removed that a while ago to make the snapshot predictable.

R=petermarshall@chromium.org
BUG=v8:6071

Review-Url: https://codereview.chromium.org/2744503003
Cr-Commit-Position: refs/heads/master@{#43698}
2017-03-09 13:40:30 +00:00
yangguo
21880a5357 [serializer] check that deserializer read the entire blob.
R=vogelheim@chromium.org
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2738213002
Cr-Commit-Position: refs/heads/master@{#43697}
2017-03-09 13:39:19 +00:00
Michael Lippautz
99bdf971c8 [heap] Fix out-of-bounds read in LiveObjectIterator::Next
We need to check whether advancing the iterator moved us beyong the end
of the bitmap. This has not been flushed out as our inlined bitmap is
still in valid memory.

In practice this is not a problem because the value is never used as we
are at the end of the bitmap. Asan rightfully complains when using an
external bitmap though.

BUG=chromium:651354

Change-Id: I8b141a467e9552f8ac2287dd62a725a14a289a37
Reviewed-on: https://chromium-review.googlesource.com/452497
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43696}
2017-03-09 13:39:04 +00:00
jkummerow
3e363204fe [cleanup] Refactor remaining builtins-*.cc to use TF_BUILTIN macro
Review-Url: https://codereview.chromium.org/2734323004
Cr-Commit-Position: refs/heads/master@{#43695}
2017-03-09 13:38:08 +00:00
Michael Achenbach
f58177dd92 [test] Switch future/no-turbo perf configs for js-tests
BUG=chromium:682617
NOTRY=true
R=mvstanton@chromium.org,petermarshall@chromium.org

Change-Id: I5902c4ac3c8fb4230142896addbb75a9e7d28fbb
Reviewed-on: https://chromium-review.googlesource.com/451378
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43694}
2017-03-09 13:38:02 +00:00
Igor Sheludko
d849396e49 [ic] StoreOwnICs must unconditionally store even to kConst fields.
BUG=v8:5495

Change-Id: I731ddaa34169f6f57d3719e6170bfe00e6d66241
Reviewed-on: https://chromium-review.googlesource.com/451638
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43693}
2017-03-09 12:29:19 +00:00
yangguo
43095c8c6f [debugger] do not enable liveedit by default.
And a drive-by clean up of unused flag.

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2744553002
Cr-Commit-Position: refs/heads/master@{#43692}
2017-03-09 12:29:01 +00:00
Igor Sheludko
fa7b88fddd [json] Fix error reporting when parsing an internalized one-byte string.
BUG=chromium:686010

Change-Id: I7bd4ab48f90a1013132bf037fd352ab55747189c
Reviewed-on: https://chromium-review.googlesource.com/451377
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43691}
2017-03-09 12:28:17 +00:00