Commit Graph

39442 Commits

Author SHA1 Message Date
Dan Elphick
8751debc3f [cleanup] Remove unused parameters from heap/*
Removes lots of parameters that are never used (found using
-Wunused-parameter).

Also wires up the pretenure parameter for Factory::NewFrameArray so it's
actually used.

Change-Id: I486e22ac0683afb84bba6a286947674254f93832
Reviewed-on: https://chromium-review.googlesource.com/1041687
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53077}
2018-05-08 16:23:02 +00:00
Clemens Hammacher
35e3fda172 [Liftoff] Add masking for indirect calls
Next SSCA mitigation: Mask the function index on indirect calls. This
avoids speculative jumps to arbitrary memory.

R=titzer@chromium.org

Bug: v8:6600, chromium:798964
Change-Id: Id4a54fbb42096655d48965b63202bb58f98dc9aa
Reviewed-on: https://chromium-review.googlesource.com/1049627
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53076}
2018-05-08 15:47:39 +00:00
Leszek Swirski
b3f0cc098e [weakref] Fix another MaybeObject conversion in ObjectStats
Change-Id: I2afefab5bf43abee5e5dc66224cea1c68fb85179
Reviewed-on: https://chromium-review.googlesource.com/1049973
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53075}
2018-05-08 14:31:09 +00:00
Alexey Kozyatinskiy
4c5926d593 [debug] handle termination after break
If termination was requested on pause we should handle it properly as
soon as execution resumed.

R=yangguo@chromium.org

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ica50500094138097f115545db716264126fbe59e
Reviewed-on: https://chromium-review.googlesource.com/1049486
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53074}
2018-05-08 14:25:41 +00:00
Clemens Hammacher
8ae6bc6068 [asan] Move asan macros to asan.h
Similar to msan.h, asan should get its own header file such that the
functionality can be reused.

R=ahaas@chromium.org

Bug: v8:7570
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ib81e4ff4b1d08158df7730c32345d4facf9453b0
Reviewed-on: https://chromium-review.googlesource.com/1046656
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53073}
2018-05-08 14:14:34 +00:00
Andreas Haas
8aee014194 [wasm] Remove the wasm-stream-compilation flag
In addition to a git grep I ran the
virtual/enable_wasm_streaming/http/tests/wasm_streaming/wasm_response_apis.html
layout test locally to confirm that the flag is not used in Chrome.

R=titzer@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I00d013b85b585d26e50aacaeb82fb0b1ce1ff56c
Reviewed-on: https://chromium-review.googlesource.com/1049965
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53072}
2018-05-08 14:13:29 +00:00
Clemens Hammacher
f3745430f1 [msan] Add static type checks for non-msan builds
Currently, non-msan builds don't check the arguments for
MSAN_ALLOCATED_UNINITIALIZED_MEMORY and MSAN_MEMORY_IS_INITIALIZED
calls, so type errors will only be reported on the msan builder.
This CL adds static_asserts for non-msan builds.

Drive-by: Rename MEMORY_SANITIZER to V8_USE_MEMORY_SANITIZER and move
it to macros.h, where also other such macros (like
V8_USE_ADDRESS_SANITIZER) live.

R=ahaas@chromium.org

Bug: v8:7570
Change-Id: If6c3c6e0d1287b5f1e0c59828cd028d1beac933d
Reviewed-on: https://chromium-review.googlesource.com/1046655
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53071}
2018-05-08 14:08:29 +00:00
Leszek Swirski
fd9addd7e4 [weakref] Fix MaybeObject conversion in ObjectStats
Fixes the MaybeObject->Object conversion in ObjectStats to allow Smis,
rather than just HeapObjects.

Change-Id: I845613c47bb6ca696d444a025100b471fb385980
Reviewed-on: https://chromium-review.googlesource.com/1049925
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53070}
2018-05-08 13:25:49 +00:00
Tobias Tebbi
b1df16f832 [torque] refactor BUILD.gn to list torque sources in one place
Change-Id: Ibb6e10caaa4fcdb29c35baef71cf1b4faef45bc4
Reviewed-on: https://chromium-review.googlesource.com/1042389
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53069}
2018-05-08 12:48:49 +00:00
Camillo Bruni
61af2762ef [CSA] Temporarily disable bounds check in CSA::LoadArrayElement
Loading the length from a PropertyArray is currently broken.

Bug: v8:7732
Change-Id: Ia05f314f2f4822a8821801889b7a58f75b3f198c
Reviewed-on: https://chromium-review.googlesource.com/1049610
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53067}
2018-05-08 12:37:33 +00:00
Simon Zünd
369b447695 [array] Remove ShadowPrototypeElements post-processing from sort.
To stay compatible with JSC, Array.p.sort did a post-processing step
that shadowed elements from the prototype chain.

Some time ago, JSC changed and no longer exhibits this behavior. To
preserve comptibility and stay consistent with RemoveArrayHoles,
this CL removes this post-processing step altogether and adjusts
tests to expect the new behavior.

R=cbruni@chromium.org, jgruber@chromium.org

Bug: v8:7382
Change-Id: Iecedc37cea25001d3768b99a3a9de3a2db90ba82
Reviewed-on: https://chromium-review.googlesource.com/1047286
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53066}
2018-05-08 12:30:12 +00:00
Choongwoo Han
0b49d9f52a Remove unused functions
Remove InitialArrayPrototypeHasInitialArrayPrototypeMap and
HasInitialFastElementsKindMap introduced by
http://crrev.com/55efb6cc5dd0ae28b9cc41da31fe86069487c113,
but not used after
http://crrev.com/1525374ff5a564b55b748ad33e6cd0d0ea684006.

Change-Id: I1182221a95d5fc1ac953139e400533efe420bd19
Reviewed-on: https://chromium-review.googlesource.com/1045951
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53065}
2018-05-08 12:25:12 +00:00
Clemens Hammacher
9f5018c9b0 [Liftoff] Add code comments on debug builds
Code comments help a lot to understand the generated code. Add a
comment before each instruction, and some special comments for longer
instructions.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ic18974e5cc89e23533e3abc54b0389723b77ff73
Reviewed-on: https://chromium-review.googlesource.com/1049626
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53064}
2018-05-08 12:23:22 +00:00
Simon Zünd
855850eb7f [array] Move CopyFromPrototype to runtime
This CL re-implements CopyFromPrototype, that is used during sorting,
as a runtime function, in preparation to move Array.p.sort to CSA.

CopyFromPrototype is called for sparse non-arrays, where elements
might be available on the prototype chain. For compatibility with
JSC, we copy them to the object itself and sort only own properties.

Bug: v8:7382
Change-Id: I4f5c14995cf9769c4f9f1d62b3a5bfde6d386556
Reviewed-on: https://chromium-review.googlesource.com/1044205
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53061}
2018-05-08 11:07:01 +00:00
Simon Zünd
2793d72cd7 [array] Move SafeRemoveArrayHoles to runtime
This CL implements the functionality of SafeRemoveArrayHoles (JS),
which is used as a pre-processing step for sorting, in a runtime
function.

SafeRemoveArrayHoles is a generic fallback, when an existing runtime
function fails to remove holes/move undefineds to the end of an array.

This CL extends the existing runtime function to also support JSProxy
objects, and objects where indices have accessors.

R=cbruni@chromium.org, jgruber@chromium.org

Bug: v8:7382
Change-Id: I4881539cf2171caba08ff6e3e50320291f49839c
Reviewed-on: https://chromium-review.googlesource.com/1041950
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53060}
2018-05-08 11:05:56 +00:00
Clemens Hammacher
1871c8c52b [wasm] Allow use of full wasm code space
On system which required a contiguous code range, we currently limit
the committed wasm code space to the heap code space. Since
https://crrev.com/c/1044195, this was only 128MB, making bigger
benchmarks fail.
There is no need to link the two limits, thus just remove that logic.

R=titzer@chromium.org

Change-Id: Id61f5dd28c96c3d2b7fcd730751285c6fc144bc5
Reviewed-on: https://chromium-review.googlesource.com/1049648
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53059}
2018-05-08 11:04:52 +00:00
Michael Starzinger
fe91e0bd69 [wasm] Start sharing JS-to-Wasm wrappers.
This shares JS-to-Wasm wrapper code across instances belonging to the
same module object. We no longer need to copy the wrappers since they
are by now independent of the concrete instance.

R=titzer@chromium.org
BUG=v8:7424

Change-Id: I54188eae6378e53cc274cd19f8e652ffdba72ee5
Reviewed-on: https://chromium-review.googlesource.com/1049607
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53058}
2018-05-08 10:59:46 +00:00
Michael Starzinger
55b70e8686 [wasm] Load instances from {WasmExportedFunction} objects.
This changes JS-to-Wasm wrappers to no longer embed a WeakCell with the
associated instance into the code, but load the instance object from the
passed {WasmExportedFunction} object instead.

R=titzer@chromium.org
BUG=v8:7424

Change-Id: I5403f882912eb23e760fabe70207440648754a69
Reviewed-on: https://chromium-review.googlesource.com/1028053
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53057}
2018-05-08 10:31:56 +00:00
Dan Elphick
f5fda7c83a Revert "[heap] Move even more objects into RO_SPACE"
This reverts commit b19d123fce.

Reason for revert: It breaks the more important change: https://chromium-review.googlesource.com/c/v8/v8/+/1042145
(Because it adds mutable objects to RO_SPACE).

Original change's description:
> [heap] Move even more objects into RO_SPACE
> 
> Moves all Oddballs, empty_feedback_metadata, lots of symbols and
> immortal heap numbers and several other empty collection objects.
> 
>       RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
> old      31592          0     221160       33280        176         0
> new      35016          0     217736       33280        176         0
> diff     +3424                 -3424
> 
> Bug: v8:7464
> Change-Id: Ic99411bcbcb9c9a48b33c59dddb68359278fb0b3
> Reviewed-on: https://chromium-review.googlesource.com/1025996
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53053}

TBR=hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org

Change-Id: Ieb81f88fe348fcffb67c153c0b116670318814f5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Reviewed-on: https://chromium-review.googlesource.com/1049555
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53056}
2018-05-08 10:02:27 +00:00
Ivo Markovic
225d5ed190 Mips[64] Replace at register with kScratchReg where possible
at register is used a lot in macro-assembler-mips[64].cc and
we should not use it as temporary register in other parts of code

Change-Id: I7ef038cdf4f8c57aa76823e7ee0ffb40b62731cd
Reviewed-on: https://chromium-review.googlesource.com/1027816
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#53055}
2018-05-08 09:47:51 +00:00
Ben L. Titzer
e008ee7363 [turbofan] PipelineWasmCompileJob uses MachineGraph
R=mvstanton@chromium.org
CC=mstarzinger@chromium.org

Bug: v8:7721
Change-Id: I8baf4c8d52d0a5bd4a3b8d832624438f465f9390
Reviewed-on: https://chromium-review.googlesource.com/1047609
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53054}
2018-05-08 09:39:51 +00:00
Dan Elphick
b19d123fce [heap] Move even more objects into RO_SPACE
Moves all Oddballs, empty_feedback_metadata, lots of symbols and
immortal heap numbers and several other empty collection objects.

      RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
old      31592          0     221160       33280        176         0
new      35016          0     217736       33280        176         0
diff     +3424                 -3424

Bug: v8:7464
Change-Id: Ic99411bcbcb9c9a48b33c59dddb68359278fb0b3
Reviewed-on: https://chromium-review.googlesource.com/1025996
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53053}
2018-05-08 08:34:16 +00:00
jgruber
cc399a0dc4 Stage String.p.matchAll
Bug: v8:6890
Change-Id: I4002326cb79165ce6edb79a943d66de156b90116
Reviewed-on: https://chromium-review.googlesource.com/1046053
Reviewed-by: Peter Wong <peter.wm.wong@gmail.com>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53052}
2018-05-08 08:27:36 +00:00
Marja Hölttä
33157f3de7 [in-place weak refs] Replace the WeakCell(transition_map) in FeedbackVector.
- Make FeedbackVector backing store a WeakFixedArray.
- "feedback" is always strong but "extra" might be weak.
- Whenever the handler stored in FeedbackVector is a WeakCell to a transition
  Map, replace it with an in-place weak reference.
For a more detailed description of the changes, see the design doc

https://docs.google.com/document/d/1P8cIme2wKszdYt64ObAiuh6pXgLnrrn80Hpl1ejJbOU/edit#heading=h.ijx1oculrikp

BUG=v8:7308

Change-Id: I72c5cf6597ef24d4c22a1fe8e25b67ca196d4ec8
Reviewed-on: https://chromium-review.googlesource.com/1027855
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53051}
2018-05-08 08:08:26 +00:00
Tobias Tebbi
365e7d4b9e [torque] refactor Type to expose the implementation pointer directly
Change-Id: I61a594e194082577135dbc82b2673bf477105ef3
Reviewed-on: https://chromium-review.googlesource.com/1046949
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53050}
2018-05-08 07:54:26 +00:00
Clemens Hammacher
f33575be45 [wasm] Remove unneeded DeferredHandleScope
R=ahaas@chromium.org

Bug: v8:7733
Change-Id: Ib3133e882c0a798f76478492a6663356267a1578
Reviewed-on: https://chromium-review.googlesource.com/1049546
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53049}
2018-05-08 07:37:26 +00:00
Jaroslav Sevcik
3fe7d698b8 [turbofan] Optimize array destructuring
This CL introduces type narrowing and constant folding reducers
to constant fold code that comes out of inlined destructuring
of arrays. In particular, array iterator introduces code that
contains a phi of a temporary array that blocks escape analysis.
The phi comes from conditional that can be evaluated statically
(i.e., constant folded), so with better constant folding we
allow escape analysis to get rid of the temporary array.

On a quick micro-benchmark below, we see more than 6x improvement.
This is close to the hand-optimized version - if we replace
body of f with 'return b + a', we get 220ms (versus 218ms with
destructuring).

function f(a, b) {
  [b, a] = [a, b];
  return a + b;
}

function sum(count) {
  let s = 0;
  for (let i = 0; i < count; i++) {
    s += f(1, 2);
  }
  return s;
}

// Warm up
sum(1e5); sum(1e5);
console.time("destructure array");
sum(1e8);
console.timeEnd("destructure array");

console.timeEnd: destructure array, 213.526000

console.timeEnd: destructure array, 1503.537000

Bug: v8:7728
Change-Id: Ib7aec1d5897989e6adb1af1eddd516d8b3866db5
Reviewed-on: https://chromium-review.googlesource.com/1047672
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53048}
2018-05-08 06:21:37 +00:00
Hidy Han
9a49396c7c Provide API to expose non-empty top source url.
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I6390806935ada277db965718a804ab090b3be5dd
Reviewed-on: https://chromium-review.googlesource.com/1041157
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Hidy Han <hidyhan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53047}
2018-05-07 20:47:19 +00:00
Clemens Hammacher
bce97fd2ef Convert all CRLF to LF
We had four files in git which used CRLF. After adding a .gitattributes
file with "* text=auto", we should not get any new ones. This CL
converts the four existing files to LF.

R=mathias@chromium.org

Bug: v8:7570
Change-Id: Ia9c92f4bed14c6669de7d60390627a11de6450b8
Reviewed-on: https://chromium-review.googlesource.com/1047611
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53046}
2018-05-07 18:55:09 +00:00
Georg Neis
e91cd3c5aa [proxies] Add missing stack overflow check.
Bug: v8:7716
Change-Id: I9cf71c1e9431ee751db595b6c94c09dab5f1610b
Reviewed-on: https://chromium-review.googlesource.com/1047612
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53045}
2018-05-07 18:50:09 +00:00
Clemens Hammacher
ec1bf81bb9 [trap-handler] Add missing newlines
If trap handlers cannot be installed, we printed two lines to stdout
and stderr, both not terminated by a newline. This CL adds a newline to
one output and uses the FATAL macro for the other, highlighting the
error better and showing the location where it happens.

R=eholk@chromium.org

Bug: v8:7570
Change-Id: Ic24f48f92b87528e0fd5889badf2c90d765e451a
Reviewed-on: https://chromium-review.googlesource.com/1047606
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53043}
2018-05-07 17:18:09 +00:00
Ben L. Titzer
6e2f6a6c44 [turbofan] MachineOperatorReducer uses MachineGraph
R=mstarzinger@chromium.org

Bug: v8:7721
Change-Id: I8fd2c532c36bfd5faec2947d3154a2984c13ed46
Reviewed-on: https://chromium-review.googlesource.com/1047668
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53042}
2018-05-07 16:57:59 +00:00
Eugene Ostroukhov
23652c5f4c [tracing] Custom tag for the traceEvents array
This API will be used by Node.js to provide output compatible with
Chrome devtools.

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I265495f8af39bfc78d7fdbe43ac308f0920e817d
Reviewed-on: https://chromium-review.googlesource.com/1044491
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Eugene Ostroukhov <eostroukhov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53041}
2018-05-07 16:54:59 +00:00
Michael Starzinger
713e10c69e [wasm] Make {WasmExportedFunction} fields easier to reach.
This moves the internal fields on {WasmExportedFunction} objects from
being properties with private symbols to a separate structure instead.
The new {WasmExportedFunctionData} structure can hang off the underlying
shared function info which is created for each exported function. This
reduces the number of transitions, speeds up instantiation, and makes it
easier to reach them from generated code (in the future).

R=titzer@chromium.org
BUG=v8:7424

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Iaa733b6c9f7bea96246d6680756aa7101669a1a9
Reviewed-on: https://chromium-review.googlesource.com/1047025
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53040}
2018-05-07 16:53:09 +00:00
Alexei Filippov
fcc1ebb55a [cpu-profiler] Extract rare used fields of CodeEntry to an optional object.
The RareData objects contain fields that often absent in CodeEntry'es.
They are created as needed when a corresponding field is added.
This reduces CodeEntry size on x64 by 40% from 136 to 80 bytes.

BUG=v8:7719

Change-Id: I1f3c6255aa2f228895e835b536c743396131db31
Reviewed-on: https://chromium-review.googlesource.com/1045885
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53039}
2018-05-07 16:33:58 +00:00
Sigurd Schneider
ca1a502fe3 [turbolizer] Print schedule for stub code
We lost the print functionality for stub schedules somewhere on the
way. This re-adds the appropriate call to TraceSchedule to get it
going again.

Bug: v8:7327
Change-Id: I245823b440542708410d2253f9f4e78b2e22f3c9
Reviewed-on: https://chromium-review.googlesource.com/1047270
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53038}
2018-05-07 16:32:48 +00:00
Ben L. Titzer
d7f550688f [turbofan] Move Dead node up to MachineGraph
In preparation for cleaning up PipelineData to use a MachineGraph
where appropriate, move the dead node up to MachineGraph.

R=ahaas@chromium.org

Bug: v8:7721
Change-Id: I3f9d456aef7cf4d80adbc93ae938636ffcc3712d
Reviewed-on: https://chromium-review.googlesource.com/1046828
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53037}
2018-05-07 16:30:08 +00:00
Clemens Hammacher
79c7e1897a [wasm] Use retpoline for indirect calls
Retpolines were never used for off-heap wasm code. This CL adds them.

R=titzer@chromium.org

Bug: chromium:840376, chromium:798964
Change-Id: I9f1b2150cce484f831a83663d1fb06555e7eac82
Reviewed-on: https://chromium-review.googlesource.com/1047385
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53036}
2018-05-07 16:27:08 +00:00
Ben L. Titzer
e677d54a79 [wasm] Use inline field inits
R=clemensh@chromium.org

Change-Id: Ib1a0105e3347a5ccafdb72dadd9aa144ab77732c
Reviewed-on: https://chromium-review.googlesource.com/1046970
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53035}
2018-05-07 16:15:08 +00:00
Sathya Gunasekaran
386caa2e6b [ES6] Ship array.prototype.values
Bug: v8:4247
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibf5e7dd39cb81ac47af871edbe079d73839f9c1c
Reviewed-on: https://chromium-review.googlesource.com/1045184
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53034}
2018-05-07 15:49:58 +00:00
Peter Marshall
7c57434400 [cleanup] Change native_groups_ to use unordered map.
Trying to reduce use of our self-baked data structures.

Bug: v8:7570
Change-Id: I419a932b6b8904810844d40a5636e423df832197
Reviewed-on: https://chromium-review.googlesource.com/1032739
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53033}
2018-05-07 15:44:58 +00:00
Marja Hölttä
e01a83afc8 [reland] [in-place weak refs] Fix: allow weak array types in large object space.
BUG=v8:7308

Change-Id: Ic69665c8a2606ec40ab06881e0501e33ee0621a0
Reviewed-on: https://chromium-review.googlesource.com/1046653
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53031}
2018-05-07 15:41:13 +00:00
Erik Luo
a9b2373d30 [debug] fix NewInstanceWithSideEffectType dcheck for mode
The DCHECK was incorrect. This new API method can be called from any
debug mode since the embedder does not know which mode we are in.

It should only apply the side effect logic when the mode is
kSideEffects.

Bug: chromium:829571
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I11b0e5194b151a2b88171d6be21c3ccbba9cd408
Reviewed-on: https://chromium-review.googlesource.com/1046162
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Erik Luo <luoe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53030}
2018-05-07 15:40:08 +00:00
Peter Marshall
645efbfd1e [typedarrays] Throw on construction of a detached typed array.
Bug: chromium:840106
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I0090cdecaf9194f3ed2d716c6f5f698e33cbdf0d
Reviewed-on: https://chromium-review.googlesource.com/1046827
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53029}
2018-05-07 15:30:48 +00:00
Mike Stanton
5e22e397b1 [TurboFan] Initialize boolean types correctly for background compiles.
Change-Id: If1aefb00299ac0c88bdc84b5b77b58582dd8b9b4
Reviewed-on: https://chromium-review.googlesource.com/1047105
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53028}
2018-05-07 15:20:48 +00:00
jgruber
d8131cd63a [builtins] Convert CEntry/GetProperty/StringAdd stubs to builtins
Stubs and builtins are very similar. The main differences are that
stubs can be parameterized and may be generated at runtime, whereas
builtins are generated at mksnapshot-time and shipped with the snapshot
(or embedded into the binary).

My main motivation for these conversions is that we can generate
faster calls and jumps to (embedded) builtins callees from (embedded)
builtin callers. Instead of going through the builtins constants table
indirection, we can simply do a pc-relative call/jump.

This also unlocks other refactorings, e.g. removal of
CallRuntimeDelayed.

TBR=mlippautz@chromium.org

Bug: v8:6666
Change-Id: I4cd63477f19a330ec70bbf20e2af8a42fb05fabb
Reviewed-on: https://chromium-review.googlesource.com/1044245
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53027}
2018-05-07 15:02:42 +00:00
Daniel Clifford
dd5cdcee43 [torque] 'bool' is now 'true|false' not 'yes|no'
In the process, rename Boolean constants (i.e. JavaScript constants),
to 'True' and 'False'. This uncovered a bug in the internal handling
of True/False labels was fixed (they shouldn't be Values and Torque
shouldn't conflate Labels with other Declarables, throwing exceptions
when they're improperly used in the wrong context). Furthermore,
the internal labels used for True and False for if statements
have been renamed so that they can't be aliased from user Torque code.

Change-Id: I09dbd2241d2bc2f1daff53862dee1b601810060c
Reviewed-on: https://chromium-review.googlesource.com/1044370
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53026}
2018-05-07 14:57:58 +00:00
Hannes Payer
ea3e9de657 [heap] Introduce a CodeSpace class.
Bug: chromium:840329
Change-Id: If45a98c7f8a97f2482ac1bed7f7dda7d6e62b6b9
Reviewed-on: https://chromium-review.googlesource.com/1046658
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53025}
2018-05-07 14:55:08 +00:00
Clemens Hammacher
3708887893 [wasm] Clean up methods in NativeModule
Define simple accessors in the header and give them lower case names.

R=mstarzinger@chromium.org

Bug: v8:7570
Change-Id: I2914013fdea2218189275bbaa9f98ea5de0ccd7c
Reviewed-on: https://chromium-review.googlesource.com/1046546
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53024}
2018-05-07 14:29:19 +00:00
Peter Marshall
87d7dda296 [tests] Add unit tests for StringsStorage and document the API.
Change-Id: Iccc86d0116f5d23f523e25ff02696a9fb8312223
Reviewed-on: https://chromium-review.googlesource.com/1044545
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53022}
2018-05-07 14:02:48 +00:00
Kanghua Yu
aa6e58ce9d [x64] Replace movl_subl instruction with leal
This eliminates one instruction for following pattern:
  movl rX, rY       // TruncateInt64ToInt32
  subl rX, imm32
==>
  leal rX, [rY - imm32]

R=bmeurer@chromium.org

Change-Id: I4164e1407f5953302051e905555da14d3ca6680a
Reviewed-on: https://chromium-review.googlesource.com/1046381
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Kanghua Yu <kanghua.yu@intel.com>
Cr-Commit-Position: refs/heads/master@{#53021}
2018-05-07 12:25:26 +00:00
Andreas Haas
6380476c71 [wasm] Make wasm::ValueType independent of the MachineRepresentation
R=clemensh@chromium.org
CC=​titzer@chromium.org

Change-Id: I4951bf7ffc8baf51225e7bef60349186811b9f76
Reviewed-on: https://chromium-review.googlesource.com/1024037
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53020}
2018-05-07 11:54:56 +00:00
Michael Achenbach
08bfc14b68 Revert "[in-place weak refs] Fix: allow weak array types in large object space."
This reverts commit 96186c4f1a.

Reason for revert: All gc stress bots time out:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/16361

Original change's description:
> [in-place weak refs] Fix: allow weak array types in large object space.
> 
> BUG=v8:7308,chromium:839953
> 
> Change-Id: I3738dc8169730763a587a2452421a54aff11e38e
> Reviewed-on: https://chromium-review.googlesource.com/1046645
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53016}

TBR=ulan@chromium.org,marja@chromium.org

Change-Id: I030638c27fd8990b9dab3d25a582039fb893bf78
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7308, chromium:839953
Reviewed-on: https://chromium-review.googlesource.com/1046549
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53019}
2018-05-07 11:52:17 +00:00
Camillo Bruni
7235c8515a [CSA] Remove overzealous type check
Bug: chromium:840220
Change-Id: I37404902e99a83d029aab36411b199fad60497b0
Reviewed-on: https://chromium-review.googlesource.com/1046066
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53018}
2018-05-07 11:20:56 +00:00
Marja Hölttä
96186c4f1a [in-place weak refs] Fix: allow weak array types in large object space.
BUG=v8:7308,chromium:839953

Change-Id: I3738dc8169730763a587a2452421a54aff11e38e
Reviewed-on: https://chromium-review.googlesource.com/1046645
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53016}
2018-05-07 09:53:14 +00:00
Yang Guo
9fb02b526f Allow function callbacks to have Proxy as receiver.
R=verwaest@chromium.org

Bug: v8:5773
Change-Id: Ifd29a1116ee8c86b8d8d24485bbfd19e260ab66b
Reviewed-on: https://chromium-review.googlesource.com/1046088
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53015}
2018-05-07 09:09:42 +00:00
Peter Marshall
6f72af25fe [cpu-profiler] Remove name_prefix field from CodeEntry
We can save a pointer of space for each CodeEntry by removing this
field which we don't really need. Instead of concatenating the name
string on demand, concatenate the prefix eagerly.

Reduces sizeof(CodeEntry) from 136 to 128 on 64-bit.

Bug: v8:7719

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Id346a8f36794e337e8c886f8d1969431424539b0
Reviewed-on: https://chromium-review.googlesource.com/1039825
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53014}
2018-05-07 08:54:53 +00:00
Camillo Bruni
633910e6e5 [CSA] Add bounds check for indexed loads and stores
Change-Id: I9d8b13df0af987d9fcacdf57f2cfd71ec21b3ff9
Reviewed-on: https://chromium-review.googlesource.com/1042708
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53013}
2018-05-07 08:30:30 +00:00
Camillo Bruni
dcbd52341e [runtime] The return of the StringTable shrinking
This CL fixes a bug where we would accidentally shrink to the same size of
the StringTable causing repeated unecessary allocations.

Bug: v8:5443, chromium:818642
Change-Id: I353b179616d5293f6d7143e7381ae6711343a835
Reviewed-on: https://chromium-review.googlesource.com/1044207
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53012}
2018-05-07 07:46:40 +00:00
Sathya Gunasekaran
b934607d4c [iwyu] Split out ordered hash tables
TBR: hpayer@chromium.org
Bug: v8:6443
Change-Id: I1750475084cbcd783551d9b7c65c8ccca9b63ea3
Reviewed-on: https://chromium-review.googlesource.com/1045615
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53010}
2018-05-06 18:42:40 +00:00
Eric Holk
72f6a76dd1 [wasm] Correct guard region allocation behavior
Change-Id: I19106adfd5407cbef05142fde3b7eb00ecd8ff52
Reviewed-on: https://chromium-review.googlesource.com/1043256
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53007}
2018-05-04 23:42:47 +00:00
Eric Holk (eholk)
bb60967e36 [wasm] Refactor trap handlers to make way for Windows support
In preparing for adding trap-based bounds checking to Windows, this
change refactors the code to separate the platform-specific portions
from that which can be shared between platforms.

Internally, we've renamed `RegisterDefaultSignalHandler` to
`RegisterDefaultTrapHandler` to more accurately represent the
difference in terminology between Linux (signals) and Windows
(exceptions). The external API is left the same so as not to break
downstream clients.

This CL is primarily to make room for Windows support. Future CLs
will begin adding support for Windows.

This is a reincarnation of https://crrev.com/c/626558.

Bug: v8:6743
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Iaa8bfd68c14cd1d17933b12c24cb8dd5ee8a21d6
Reviewed-on: https://chromium-review.googlesource.com/998829
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53006}
2018-05-04 23:00:12 +00:00
Alexei Filippov
a31320f59c [profiler] Refactoring: decouple StringsStorage from Heap object.
Change-Id: I450efa4916bd774265991f987f4be618ba2eb1d2
Reviewed-on: https://chromium-review.googlesource.com/1045168
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53005}
2018-05-04 22:34:04 +00:00
Alexei Filippov
8ec48b2117 [cpu-profiler] Do not store CodeEntries between profiling sessions.
ProfilerListener which holds CodeEntries has been moved from Logger to
CpuProfiler. This way we can clear entries when all the profiles
produced by a particular CpuProfiler are deleted.

BUG=v8:7719

Change-Id: I31d47dc7da44648c8fb8e87b47e2e6260d3dc5c3
Reviewed-on: https://chromium-review.googlesource.com/1043050
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53004}
2018-05-04 20:58:44 +00:00
Erik Luo
4b52f96480 [debug] add ability to do side-effect-free call to NewInstance
Creating a new instance from a v8::Function will invoke its
constructor. If it is an API callback that has not been marked as
kHasNoSideEffect, this CL introduces a way to invoke it without
throwing.

Calls within the constructor are still checked for side effects.

Bug: chromium:829571
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia4e410d487e2847bc511cb96f0be30a3563991f6
Reviewed-on: https://chromium-review.googlesource.com/1034116
Commit-Queue: Erik Luo <luoe@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53003}
2018-05-04 16:47:24 +00:00
Michael Starzinger
133f752033 [wasm] Make WebAssembly scripts point to {WasmModuleObject}.
This makes {Script} objects created for WebAssembly no longer reference
a concrete instance object, but a module object instead. All uses of the
field in question only require module-wide information and the script is
meant to represent the set of all instances, not just one concrete
instance.

R=clemensh@chromium.org

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I751d4b75c8a970cffcb1a37b6c22ff69e9ee5489
Reviewed-on: https://chromium-review.googlesource.com/1043871
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53002}
2018-05-04 16:37:35 +00:00
Daniel Clifford
aeb86d57fd [torque]: Add constexpr keyword/types for compile-time evaluation
Torque expressions of type constexpr are evaluated at compile-time
rather than runtime. They are backed by C++ types rather than
TNode<X> types, so the macro functions that are called by generated
C++ code expect values to be computed when the snapshot is generated
rather than by TurboFan-generated code.

Specifically, "if" statements can have a constexpr modifier. With this
modifier, a type of "constexpr bool" is expected rather than "bool",
and in that case instead of generating a CSA BranchIf, it generates
a C++ "if (<bool expression>)" that generates code for only the true or
false path based on the bool value at torque-execution (compile time)
rather than generating both paths (including inserting phi nodes
for variables modified on either branch at the re-merge at the end
of the if) and dynamically dispatching to the true or false path
during d8/Chrome/node.js execution (runtime) using a CSA BranchIf.

Change-Id: I8238e25aaadbfc618847e04556e96a3949ea5a8d
Reviewed-on: https://chromium-review.googlesource.com/1042085
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53001}
2018-05-04 15:48:54 +00:00
Clemens Hammacher
40a95443c9 [Liftoff] Add memory masking
First untrusted code mitigation in Liftoff: Mask memory accesses (loads
and stores) by the mask stored in the WasmInstanceObject.

R=titzer@chromium.org

Bug: v8:6600, chromium:798964
Change-Id: Iddf577977451444b51c42fbc2ad34430832a9e71
Reviewed-on: https://chromium-review.googlesource.com/1044215
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53000}
2018-05-04 15:32:49 +00:00
Vincent Belliard
ba8c6a6f0c [arm64][Liftoff] implement integer division
Bug: v8:6600
Change-Id: I1bd2db402d6e97ab468dc24cd4d12bef6523d784
Reviewed-on: https://chromium-review.googlesource.com/1043091
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52999}
2018-05-04 15:05:19 +00:00
jgruber
2d3f6f9103 [api] Add Module::GetUnboundScript()
This method is intended for use by code caching as follows:

1. The module is compiled (and perhaps instantiated).
2. The embedder fetches and stores the module's unbound script (i.e.
   the shared function info).
3. Module evaluation, maybe triggering lazy compilation.
4. Generated code for the module (which hangs off the shared function
   info) is inserted into the code cache.

Subsequent module loads can load from the code cache prior to
evaluation.

Bug: v8:7685
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I80018cd921ab1a18323906a548b249e19d9f9509
Reviewed-on: https://chromium-review.googlesource.com/1041745
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52998}
2018-05-04 14:52:29 +00:00
Daniel Clifford
be9b5f4c10 [torque]: Fix bugs reported by Peter Wong
* Empty string literals (e.g. "" and '') were not recognized a strings. This is
  now fixed.
* return statements without expressions (e.g. for functions with void return
  types) caused crashes.

Change-Id: Ied60f9abffca457a0d85c9e01e3795839fe777c9
Reviewed-on: https://chromium-review.googlesource.com/1042310
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52997}
2018-05-04 14:32:29 +00:00
Hannes Payer
6b1457cfd6 Reduce maximal code range size to 128M on Linux, Windows, and OSX for x64 and ia32.
Bug: chromium:800348, chromium:827627, chromium:839750
Change-Id: I112e20b83eb1937476ebb4f30cf5679113759c0c
Reviewed-on: https://chromium-review.googlesource.com/1044195
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52996}
2018-05-04 13:47:09 +00:00
Clemens Hammacher
c20d7f6605 [Liftoff] Fix conditional spilling on div and rem
On div and rem on ia32 and x64, we sometimes need to spill. If this
spilling code happens inside of a branch, the cache state will reflect
that the value was spilled, even though the actual spilling code might
not have executed.

R=titzer@chromium.org

Bug: v8:6600, chromium:839800
Change-Id: I93b681a23119f903feb54235d6d44a7cbd5815fe
Reviewed-on: https://chromium-review.googlesource.com/1044185
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52995}
2018-05-04 13:36:39 +00:00
Clemens Hammacher
2b4c8496d5 [wasm] Fix data race in CompilationState
The {baseline_compilation_units_} and {tiering_compilation_units_}
fields should only be accessed if the {mutex_} is held.
Also, the number of compilation units is already taken care of inside
of {RestartBackgroundTasks}, so no need to explicitly pass it.

R=ahaas@chromium.org

Change-Id: I8f36ed141b587ee1bea41291545f39546d8cf24e
Reviewed-on: https://chromium-review.googlesource.com/1044213
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52994}
2018-05-04 13:35:29 +00:00
Clemens Hammacher
55d6721d98 [wasm][cleanup] Remove obsolete AddressHasher
Since address is a uintptr_t, there is no need to implement a specific
hasher.

R=mstarzinger@chromium.org

Bug: v8:7570
Change-Id: I47e652929ef201e742224541d9df4360444e3ba8
Reviewed-on: https://chromium-review.googlesource.com/1044209
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52993}
2018-05-04 13:23:54 +00:00
Benoît Lizé
e0c31d63dd Fix ExternalString::ExternalPayloadSize().
ExternalString::kShortSize is not the same as i::kShortSize, caused
incorrect reporting for code stats for two byte strings.

Bug: chromium:837659
Change-Id: Icbb39f2103aa4fa72bd5b1258cb8e1d4aee10441
Reviewed-on: https://chromium-review.googlesource.com/1044212
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Benoit L <lizeb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52992}
2018-05-04 13:22:49 +00:00
Clemens Hammacher
1a6cf58bbc [base] Move implicit_cast to macros.h
macros.h already not only defines macros, but also templatized helpers
like {bit_cast} and {arraysize}. Thus {implicit_cast} also belongs
there.

R=tebbi@chromium.org

Bug: v8:7570
Change-Id: Iaea6075dad359d62498453575f22d73ca84e2323
Reviewed-on: https://chromium-review.googlesource.com/1042401
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52991}
2018-05-04 12:46:09 +00:00
Ben L. Titzer
bc218a2ecd [compiler] Factor MachineGraph out from JSGraph
This CL factors the parts of the JSGraph that only depend on the
machine part of JSGraph into a separate base class, MachineGraph.
This helps separate the two layers and also allows the MachineGraph
to be constructed without an Isolate, which is needed for fully
asynchronous compilation, a goal for WASM.

R=mstarzinger@chromium.org
CC=jarin@chromium.org, mvstanton@chromium.org

BUG=v8:7721

Change-Id: Ie8bc3de40159332645dcb3cadcee581e1bf9830a
Reviewed-on: https://chromium-review.googlesource.com/1043746
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52990}
2018-05-04 12:37:39 +00:00
Clemens Hammacher
5d11921320 [Liftoff] Stage Liftoff and tier up behind --future
In order to get more test coverage (also on ClusterFuzz), stage Liftoff
and tier up behind --future.

R=hablich@chromium.org
CC=​​titzer@chromium.org

Bug: v8:6600
Change-Id: I718e17957b26f60aa4c002333035f693344806e0
Reviewed-on: https://chromium-review.googlesource.com/1042385
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52987}
2018-05-04 11:48:18 +00:00
Wez
ca3e146ecb Rename PromotedSpaceSizeOfObjects() to OldGenerationSizeOfObjects().
The Promoted* prefix was used to refer both to the total number of old
generation objects, and to the delta of objects moved from the new to
old generations.

PromotedTotalSize() is also renamed, to reflect the actual calculation
it performs

Bug: chromium:837583
Change-Id: Id27a0661618257ef64eb469a83bb49c0e8ce6923
Reviewed-on: https://chromium-review.googlesource.com/1042314
Commit-Queue: Wez <wez@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52986}
2018-05-04 11:15:18 +00:00
Michael Starzinger
56e8b09936 Reland "[wasm] Maintain link from Instance to Module."
This is a reland of a0c57368a9

Original change's description:
> [wasm] Maintain link from Instance to Module.
> 
> This moves the link from a {WasmInstanceObject} to its corresponding
> {WasmModuleObject} into the right place and also makes it strong. This
> ensures that an instance always keeps the underlying module alive and
> hence removes the situation of an "orphaned instance".
> 
> R=clemensh@chromium.org
> 
> Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
> Reviewed-on: https://chromium-review.googlesource.com/1041691
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52942}

Change-Id: I9854400bfc1d22bd258f17118fcb7460cdc3acd5
Reviewed-on: https://chromium-review.googlesource.com/1043786
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52985}
2018-05-04 10:16:58 +00:00
Daniel Clifford
9cd8995fa3 [Torque]: add assert(), unreachable and debug statements
- In debug builds, 'assert(<expr>)' evaluates and aborts execution
  if the provided Torque expression is false at runtime.
  assert(<expr>) supports the same set of expressions protocols
  as Toruqe's if statement, i.e. both bool values and BranchIf-
  style tests. Upon failure, the assertion prints the Torque
  source code of the failed expression, not the generated CSA
  code.
- 'unreachable' calls CSA's Unreachable() and signals to Torque
  that code execution cannot continue (i.e. its statement
  returns the 'never' type). In debug builds, the line number
  and position of the statement are printed before breaking.
- 'debug' calls CSA's DebugBreak(). In debug builds, the line
  number and position of the 'debug' are printed before breaking.

Change-Id: I4efd052536bb402c097a0d5f7be56e154b5b3676
Reviewed-on: https://chromium-review.googlesource.com/1042570
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52984}
2018-05-04 10:13:18 +00:00
Toon Verwaest
0f7721719d Remove the catch variable name from the extension field of catch contexts
Instead rely on the scope info containing the name as well.

Change-Id: Ie1f96ea023a793b11209510566f6831b1dfd40ab
Reviewed-on: https://chromium-review.googlesource.com/1042567
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52983}
2018-05-04 10:12:08 +00:00
Miran.Karic
a1892ff9c4 MIPS[64]: Fix mips port.
The CL fixes the mips port in the CL [debug] introduced runtime side
effect check (7a2c371383), that caused
several test failures.

BUG=

Change-Id: Ia1b45fd57d7b77c912562c97f7fc6bf2aa378fe2
Reviewed-on: https://chromium-review.googlesource.com/1030193
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Miran Karić <miran.karic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52982}
2018-05-04 09:30:07 +00:00
Toon Verwaest
4c972d669a Cleanup: Remove unnecessary ContextExtension wrapper
Bug: v8:7066
Change-Id: Icfcb40b2048997c158fba5f3e250145bed4ca1e3
Reviewed-on: https://chromium-review.googlesource.com/1042386
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52981}
2018-05-04 09:24:17 +00:00
Wez
b9c81f51d4 Remove unused StackGuard::HandleGCInterrupt API.
Change-Id: I58f3eb9259822650a3b31010213e3df030821be2
Reviewed-on: https://chromium-review.googlesource.com/1042187
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Wez <wez@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52980}
2018-05-04 08:48:57 +00:00
Michael Starzinger
91d9b4eee9 [wasm] Fix HeapNumber allocation effect dependency.
This makes sure that allocations of {HeapNumber} objects happening in
the JS-to-Wasm and Wasm-to-JS wrappers are ordered with respect to
changes of the {trap_handler::IsThreadInWasm} predicate. Otherwise the
compiler can (and will) move the allocations across changes of this
predicate and cause safety checks to fire.

R=clemensh@chromium.org

Change-Id: I5366ec0c184929fbd5b60c827d9908fb6ca1d91a
Reviewed-on: https://chromium-review.googlesource.com/1042399
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52979}
2018-05-04 08:33:27 +00:00
Clemens Hammacher
310f37e414 [Liftoff] Implement grow_memory
The grow_memory opcode basically just executes a runtime call, but
needs to check a condition first, and convert to and from Smi.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: If7d62a8bb0ca6d02bd47ef6048cc65da502b002b
Reviewed-on: https://chromium-review.googlesource.com/1042185
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52978}
2018-05-04 08:07:37 +00:00
Clemens Hammacher
a5551d924a [assembler] Avoid hiding of Register::bit method on arm64
On arm64, we had {RegisterBase::bit} (defined in assembler.h) and
{CPURegister::bit} (defined in assembler-arm.h). {CPURegister} inherits
from {RegisterBase}. The two methods methods have different
behaviour on the special {no_reg}, which is only relied on in very few
places.
This CL fixes these places to avoid the use of {no_reg}, and removes
the overwritten method.

R=mstarzinger@chromium.org
CC=​rodolph.perfetta@arm.com

Change-Id: I859cc0d4ffc48fae018ee262f3e5403774db87a8
Reviewed-on: https://chromium-review.googlesource.com/1042188
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Rodolph Perfetta <rodolph.perfetta%arm.com@gtempaccount.com>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52977}
2018-05-04 06:53:37 +00:00
Erik Luo
405c1dc7d4 [debug] whitelist Array.p.splice, typeof methods
Side effect free whitelist now
- supports 'typeof' when it performs Load operations
- runtime checks for Array.p.splice

Bug: v8:7588
Change-Id: I45bcd705f8d3f2d2ee61f018566439bf56d1bcbc
Reviewed-on: https://chromium-review.googlesource.com/1037926
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Erik Luo <luoe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52976}
2018-05-04 06:25:37 +00:00
Jakob Kummerow
45a2d9c518 Fix "x is not iterable" error message consistency
Since 94ce16b704, when loading an iterator from null or undefined, we
generate the error message "x is not iterable" instead of the unwieldy
"Cannot read property 'Symbol(Symbol.iterator)' of undefined". However
Runtime::GetObjectProperty, which is used as slow path by LoadICs, did
not check for this case, leading to different messages being generated
depending on IC state.

Bug: chromium:823130
Change-Id: Ie98500b97efef401aac9880b9af47d58c3c2825d
Reviewed-on: https://chromium-review.googlesource.com/1042951
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52974}
2018-05-03 23:13:21 +00:00
Junliang Yan
2489567d6a PPC/s390: [builtins] Update isolate-independent list & related fixups
Port 519bd47f6c

Original Commit Message:

    With the exception of the InterpreterEntryTrampoline, all builtins are
    now isolate-independent and can be embedded into the binary.

    This CL updates the corresponding list and also contains a few smallish
    tweaks to support having these builtins off the heap:

    * wasm: copy the off-heap builtin, not its trampoline.
    * Code::contains: support off-heap builtins.
    * JSFunction::is_compiled: compare builtin index instead of identity
      (this is relevant during mksnapshot when we transition from the
      on-heap builtin to its off-heap representation + the trampoline).
    * Remove old DCHECKs.
    * A few tweaks in macro-assembler ports that have snuck in recently.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ib16ce35f5ebdade42720f536ac521c79e7c46778
Reviewed-on: https://chromium-review.googlesource.com/1042927
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52973}
2018-05-03 22:20:10 +00:00
Junliang Yan
7b046d047a Reland "PPC/s390: [interpreter] correctly advance over debug scaling prefixes."
This is a reland of dfdc31355d

Original change's description:
> PPC/s390: [interpreter] correctly advance over debug scaling prefixes.
> 
> Port 7a07d74b09
> 
> R=yangguo@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=
> LOG=N
> 
> Change-Id: I99553fde819cbdc8a12df5b82d9d7230ba4ef8b3
> Reviewed-on: https://chromium-review.googlesource.com/1042355
> Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
> Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
> Cr-Commit-Position: refs/heads/master@{#52970}

Change-Id: I012e79ef5fbff37a8ded8c8cf5d4aaf324cd6ccb
Reviewed-on: https://chromium-review.googlesource.com/1043026
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52972}
2018-05-03 20:49:29 +00:00
Junliang Yan
5919d34e90 Revert "PPC/s390: [interpreter] correctly advance over debug scaling prefixes."
This reverts commit dfdc31355d.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> PPC/s390: [interpreter] correctly advance over debug scaling prefixes.
> 
> Port 7a07d74b09
> 
> R=​yangguo@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
> BUG=
> LOG=N
> 
> Change-Id: I99553fde819cbdc8a12df5b82d9d7230ba4ef8b3
> Reviewed-on: https://chromium-review.googlesource.com/1042355
> Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
> Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
> Cr-Commit-Position: refs/heads/master@{#52970}

TBR=yangguo@chromium.org,michael_dawson@ca.ibm.com,jyan@ca.ibm.com,joransiu@ca.ibm.com

Change-Id: I04fadaa81a6dd124811c002ab4ffa61e3785b717
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1043025
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52971}
2018-05-03 20:15:08 +00:00
Junliang Yan
dfdc31355d PPC/s390: [interpreter] correctly advance over debug scaling prefixes.
Port 7a07d74b09

R=yangguo@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I99553fde819cbdc8a12df5b82d9d7230ba4ef8b3
Reviewed-on: https://chromium-review.googlesource.com/1042355
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52970}
2018-05-03 19:37:07 +00:00
Junliang Yan
e0d2c6c2b3 PPC/s390: Reland: [builtins] Patch self-references in constants table
Port ab9e012426

Original Commit Message:

    Original CL: https://crrev.com/c/1018468

    During code generation, we generate self-references (i.e. references to
    the Code object currently being generated) as references to a temporary
    handle. When the final Code object has been allocated, the handle's
    location is fixed up and RelocInfo iteration fixes up all references
    embedded in the generated code.

    This adds support for this mechanism to the builtins constants table
    builder. CodeObject() is now a new handle pointing to a dedicated
    self-reference marker in order to distinguish between self-references
    and references to undefined. In Factory::NewCode, we patch up
    the constants table.

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Iba0f4435125b9d6c3fda7fc3e9836494b6eb6f45
Reviewed-on: https://chromium-review.googlesource.com/1042216
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52969}
2018-05-03 18:42:02 +00:00
Junliang Yan
efc92f0d4a PPC/s390: [objects.h splitting] Move classes related to api callbacks.
Port a9db2c74b5

R=marja@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=v8:5402,v8:7570
LOG=N

Change-Id: Ife3c7463066eb747c27c1479c76106b51e568f92
Reviewed-on: https://chromium-review.googlesource.com/1042451
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52968}
2018-05-03 18:40:57 +00:00
Camillo Bruni
c0035a4f30 [verify-heap] Improve elements verification
This is a preparatory CL to find a potential regression on x86.

Bug: chromium:835558
Change-Id: I3859b59d1497d4b7447ad38ee352cf4bbdeb4502
Reviewed-on: https://chromium-review.googlesource.com/1027842
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52967}
2018-05-03 18:08:42 +00:00
Bill Budge
0a1b8f9692 [wasm] Avoid extra copies when serializing the native module
- Separates measuring from wasm::SerializeNativeModule so caller
  can allocate or reserve the buffer memory. Call site thus avoid
  one unnecessary copy.

Bug: chromium:719007
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I50412c0c0279114dcdc1aead810ad39e7c4e2a6e
Reviewed-on: https://chromium-review.googlesource.com/1039183
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52965}
2018-05-03 15:32:14 +00:00
Vincent Belliard
72f9d38072 [arm64][Liftoff] implement stack slot allocation
Bug: v8:6600
Change-Id: I1d8447349f73985653d3124c2b76d8756b0bf30a
Reviewed-on: https://chromium-review.googlesource.com/1040673
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52964}
2018-05-03 15:09:57 +00:00
Vincent Belliard
5841a47ee4 [arm64][Liftoff] implement trap instructions
Define and use TurboAssembler::AssertUnreachable

Bug: v8:6600
Change-Id: I6901896ea4fd7e0fe24dd76a1afbb409a24a2994
Reviewed-on: https://chromium-review.googlesource.com/1040766
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52963}
2018-05-03 15:07:57 +00:00
Vincent Belliard
7208d6459d [arm64][Liftoff] implement jumps
Bug: v8:6600
Change-Id: I9e4b4770286cb08e83dd5dbf9b5ae5cfd7d4d411
Reviewed-on: https://chromium-review.googlesource.com/1040649
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52962}
2018-05-03 15:05:56 +00:00
Vincent Belliard
ddc1bb0631 [arm64][Liftoff] implement conditional set instructions
Bug: v8:6600
Change-Id: If52fd4600c178354cb0631d062be71d19cc10a89
Reviewed-on: https://chromium-review.googlesource.com/1040669
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52961}
2018-05-03 15:03:47 +00:00
Vincent Belliard
c42c53068c [arm64][Liftoff] implement integer unary operators
Bug: v8:6600
Change-Id: Ia494d7fefee2dc6ae6f31ea73e35c0921953c2c0
Reviewed-on: https://chromium-review.googlesource.com/1040666
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52959}
2018-05-03 14:43:28 +00:00
Camillo Bruni
edec62077e [logging] Reduce FailureMessage buffer size
This should reduce the probability of running out of stack space while logging
a fatal error message.
Additionally this CL distinguishes the error OOM error message when there is no
isolate available on the background thread.

Bug: chromium:839166
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I17e929f322dda20127fbf86a6154af5460e53490
Reviewed-on: https://chromium-review.googlesource.com/1041964
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52958}
2018-05-03 14:34:47 +00:00
Hannes Payer
494068c1c2 [heap] Clear from space after garbage collection.
Bug: chromium:829771
Change-Id: I9e71e6cbba347dd6951e5415332e5178df9b5122
Reviewed-on: https://chromium-review.googlesource.com/1041685
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52957}
2018-05-03 13:46:25 +00:00
Clemens Hammacher
d78d026d08 [wasm] Remove dead code kind
{kCopiedStub} is not used any more since https://crrev.com/c/1012024.

R=mstarzinger@chromium.org

Change-Id: Idb0049f7d0bb0215cef902daba49591596f93668
Reviewed-on: https://chromium-review.googlesource.com/1042225
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52956}
2018-05-03 13:45:17 +00:00
Benoît Lizé
1a0efd803a Report the per-isolate total size of scripts source.
As with other code size stats, this doesn't distinguish between live and
dead objects, and doesn't scan the young generation.

Also make ExternalString::is_short() const.

Bug: chromium:837659
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I72815edb719ba61d9727e226ff1da0fc4af22a24
Reviewed-on: https://chromium-review.googlesource.com/1032994
Commit-Queue: Benoit L <lizeb@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52955}
2018-05-03 13:43:55 +00:00
Bill Budge
5db17032a1 [ia32] Fix problem with ambiguous constructor (on OSX)
Change-Id: I6bc23527f63e86ecde228c85d499c55278ff555e
Reviewed-on: https://chromium-review.googlesource.com/1041949
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52954}
2018-05-03 13:26:04 +00:00
Ben L. Titzer
2c0edb48cd [wasm] Rename XXXOperand to XXXImmediate
R=clemensh@chromium.org
CC=ahaas@chromium.org

Change-Id: Ibcbc5e43e7095d9783f49ad2c3f27338100c4fdf
Reviewed-on: https://chromium-review.googlesource.com/1039489
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52953}
2018-05-03 12:41:54 +00:00
Toon Verwaest
39496a95c5 Replace Context::closure with Context::scope_info, allowing closure to die.
There are likely cleanups that can be done after this CL:
- context-related functions in the interpreter and compiler take ScopeInfo as
well as ScopeType and slot-count as input. The latter 2 should be directly
derived from the former. We should be able to drop FunctionContextParameters.
- ContextExtension is probably not needed anymore, since we now always have the
correct scope_info directly in the SCOPE_INFO_INDEX slot.

Bug: v8:7066
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ie1f6134c686a9f2183e54730d9cdd598a9e5ab67
Reviewed-on: https://chromium-review.googlesource.com/785151
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52952}
2018-05-03 12:34:17 +00:00
Marja Hölttä
7ed2e31bd9 [wasm] iwyu part 3
BUG=v8:7490

Change-Id: I10f5339f3d7e634934d59d744334a045276fbed6
Reviewed-on: https://chromium-review.googlesource.com/1041906
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52951}
2018-05-03 12:19:25 +00:00
Michael Achenbach
ab814fb833 Revert "[logging] Remove unused code"
This reverts commit c32f661486.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/20563

Original change's description:
> [logging] Remove unused code
> 
> This removes unused mutex, headers from log.(h|cc).
> 
> Change-Id: Ie4dc69a7efa9494b21ff6e2b19828bd740e3a47c
> Reviewed-on: https://chromium-review.googlesource.com/1041967
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52946}

TBR=jarin@chromium.org,cbruni@chromium.org

Change-Id: I48b63c7fc6a10e118b735f708db37d353ba6c0f7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1041969
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52950}
2018-05-03 12:11:15 +00:00
Michael Achenbach
79a99dfc10 Revert "[wasm] Maintain link from Instance to Module."
This reverts commit a0c57368a9.

Reason for revert: Speculative revert due to failures with custom
snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/19061

Local bisect also points to this change:
http://shortn/_IhVxU2FKLu

Original change's description:
> [wasm] Maintain link from Instance to Module.
> 
> This moves the link from a {WasmInstanceObject} to its corresponding
> {WasmModuleObject} into the right place and also makes it strong. This
> ensures that an instance always keeps the underlying module alive and
> hence removes the situation of an "orphaned instance".
> 
> R=​clemensh@chromium.org
> 
> Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
> Reviewed-on: https://chromium-review.googlesource.com/1041691
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52942}

TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I1830e6ce14314f06f918a0c428182bfd68354ad9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1041968
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52949}
2018-05-03 11:56:25 +00:00
Hannes Payer
c280e7d4f4 [heap] Clear the memory of pooled pages when allocating from the pool.
Bug: chromium:999634
Change-Id: Ia7a0dd6ddc2477a7656a26548e9a247470d9143f
Reviewed-on: https://chromium-review.googlesource.com/1041688
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52948}
2018-05-03 11:43:12 +00:00
Daniel Clifford
90415437fb Refactor/cleanup various Torque classes, inclduing making Type a Declarable
This is a preparatory step for implementing generics. Along the way, clean up
and encapsulate a bunch of code, including:

* Fully encapsulate Scope by adding the new class ScopeChain that provide an
  abstraction for creating and activating scopes.
* Untangle Modules and Scopes.
* Unify scope activation so that it is always associated with an AST node
  and triggered by a RAII helper class.
* Unify (somewhat) how builtins and macros are created, fixing a few
  inconsistencies with when and how parameters and their types are declared.
* Create a new Declarations class that brokers between the visitor classes and
  the ScopeChain. This moves handling of declaration-related errors out of the
  visitors but also makes it possible to do so without polluting Scope and
  ScopeChain with details about resolving SourcePositions in error cases.

Change-Id: I180017d4cf39ccf5ef1d20b84f53284c252f8d87
Reviewed-on: https://chromium-review.googlesource.com/1038504
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52947}
2018-05-03 11:38:52 +00:00
Jaroslav Sevcik
c32f661486 [logging] Remove unused code
This removes unused mutex, headers from log.(h|cc).

Change-Id: Ie4dc69a7efa9494b21ff6e2b19828bd740e3a47c
Reviewed-on: https://chromium-review.googlesource.com/1041967
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52946}
2018-05-03 11:12:18 +00:00
Michael Achenbach
d14bca61b3 Revert "[heap] Mark RO_SPACE as read-only after deserialization"
This reverts commit 40f1aaf330.

Reason for revert:
https://luci-milo.appspot.com/buildbot/client.v8/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/21000

Original change's description:
> [heap] Mark RO_SPACE as read-only after deserialization
> 
> Adds MarkAsReadOnly and MarkAsReadWrite to ReadOnlySpace. The latter
> is only usable with ReadOnlySpace::WritableScope to avoid the space
> being left writable). MarkAsReadOnly updates the high water mark and
> makes several previously mutating methods into no-ops.
> 
> Moves some writes to immutable objects out of the bootstrapper to
> setup-heap-internal so they don't write to a read-only page.
> 
> Also avoid writing hashes to strings that already have the value set as
> that invariably means writing to the "0" and "1" constant strings in
> RO_SPACE.
> 
> Before serialization, it makes RO_SPACE writable again so that any
> padding can be cleared before writing it.
> 
> Bug: v8:7464
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I22edc20dba7dde8943991a8fcaf87244af4490a3
> Reviewed-on: https://chromium-review.googlesource.com/1014128
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52943}

TBR=yangguo@chromium.org,hpayer@chromium.org,mlippautz@chromium.org,delphick@chromium.org

Change-Id: Id4770c0fdb21cd9eea2f62a019f44a6bdea8f0a7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1041948
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52944}
2018-05-03 10:17:19 +00:00
Dan Elphick
40f1aaf330 [heap] Mark RO_SPACE as read-only after deserialization
Adds MarkAsReadOnly and MarkAsReadWrite to ReadOnlySpace. The latter
is only usable with ReadOnlySpace::WritableScope to avoid the space
being left writable). MarkAsReadOnly updates the high water mark and
makes several previously mutating methods into no-ops.

Moves some writes to immutable objects out of the bootstrapper to
setup-heap-internal so they don't write to a read-only page.

Also avoid writing hashes to strings that already have the value set as
that invariably means writing to the "0" and "1" constant strings in
RO_SPACE.

Before serialization, it makes RO_SPACE writable again so that any
padding can be cleared before writing it.

Bug: v8:7464
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I22edc20dba7dde8943991a8fcaf87244af4490a3
Reviewed-on: https://chromium-review.googlesource.com/1014128
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52943}
2018-05-03 09:46:28 +00:00
Michael Starzinger
a0c57368a9 [wasm] Maintain link from Instance to Module.
This moves the link from a {WasmInstanceObject} to its corresponding
{WasmModuleObject} into the right place and also makes it strong. This
ensures that an instance always keeps the underlying module alive and
hence removes the situation of an "orphaned instance".

R=clemensh@chromium.org

Change-Id: Id59f6a49740af8ef0248679c3d2c696bb9776944
Reviewed-on: https://chromium-review.googlesource.com/1041691
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52942}
2018-05-03 09:36:38 +00:00
Marja Hölttä
687795e3b2 [iwyu] Fixes related to src/machine-type.h
Restores some sensemaking properties, such as making src/machine-type.h (lower
level header) independent of src/zone/zone.h (higher level header).

BUG=v8:7490

Change-Id: Ibc6e5c7a75e4aaf917d086cf70267abc7ee9a9b0
Reviewed-on: https://chromium-review.googlesource.com/1039586
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52941}
2018-05-03 09:29:08 +00:00
Ben L. Titzer
2461fdfda8 [wasm] Remove some redundant/unnecessary DisallowHeapAllocation scopes
R=mstarzinger@chromium.org

Change-Id: I57ff09601a9e84cc5b53ff06a446b7dfc3c026b2
Reviewed-on: https://chromium-review.googlesource.com/1032742
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52940}
2018-05-03 09:25:28 +00:00
Clemens Hammacher
741166f6f9 [Liftoff] Implement {MoveToReturnRegister} platform independent
Now that wasm-linkage.h is split off, we can easily implement
{MoveToReturnRegister} in platform independent code.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I072a0ee48d58ed29e0df489016f838915c3f2cb2
Reviewed-on: https://chromium-review.googlesource.com/1041690
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52939}
2018-05-03 09:15:38 +00:00
Simon Zünd
d0ecfe25d6 [typedarray] Change Torque sort implementation
This CL changes how TypedArray.p.sort is implemented in Torque, mainly
to address the binary memory size of the builtin.

With this CL the memory comes down from 53611 to 4215 (as reported
by --print-builtin-size on a x64.release build).
With the following performance impact
on the relevant benchmarks:

Benchmark  Original (JS)   Torque (initial)    This CL

IntTypes            83.9              263.7      202.3
BigIntTypes         32.1               54.6       47.2
FloatTypes          99.3              138.7      109.3

This is achieved by pushing the Load/Store dispatch based on
the elements kind into separate builtins that are executed
for each load/store. This results in only one version of the
sorting algorithm instead of one version per elements kind.

R=jgruber@chromium.org

Bug: chromium:837282
Change-Id: I7fe2da3cbfd01531d070128126a0d56d3dd6bdcc
Reviewed-on: https://chromium-review.googlesource.com/1033744
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52937}
2018-05-03 08:18:28 +00:00
Dan Elphick
28279bd8f5 [cleanup] Remove unused Executability parameter
Removes unused parameter from CommitBlock and CommitMemory functions.

Change-Id: I4b79c1802060f1f70e06fd39532758fcdae2bead
Reviewed-on: https://chromium-review.googlesource.com/1039830
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52936}
2018-05-03 07:56:37 +00:00
jgruber
519bd47f6c [builtins] Update isolate-independent list & related fixups
With the exception of the InterpreterEntryTrampoline, all builtins are
now isolate-independent and can be embedded into the binary.

This CL updates the corresponding list and also contains a few smallish
tweaks to support having these builtins off the heap:

* wasm: copy the off-heap builtin, not its trampoline.
* Code::contains: support off-heap builtins.
* JSFunction::is_compiled: compare builtin index instead of identity
  (this is relevant during mksnapshot when we transition from the
  on-heap builtin to its off-heap representation + the trampoline).
* Remove old DCHECKs.
* A few tweaks in macro-assembler ports that have snuck in recently.

Bug: v8:6666
Change-Id: Iabf5b47ade3826a4da35b6b75a4e61614f0158b0
Reviewed-on: https://chromium-review.googlesource.com/1032777
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52935}
2018-05-03 07:48:07 +00:00
Yang Guo
7a07d74b09 [interpreter] correctly advance over debug scaling prefixes.
R=leszeks@chromium.org, ulan@chromium.org

Bug: chromium:835973
Change-Id: I35600e1da60bb6cd3b87cd1573791355e310aa9c
Reviewed-on: https://chromium-review.googlesource.com/1032430
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52933}
2018-05-03 07:02:57 +00:00
Alexey Kozyatinskiy
67bb22e319 [inspector] do not resume on agent disable if there is other agents
If there is more then one agent accepts current pause, we should resume
only when last agent is disabled.

R=dgozman@chromium.org

Bug: chromium:834056
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2904b3f4ab76117511e16450dd575ebf3e20a068
Reviewed-on: https://chromium-review.googlesource.com/1041207
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52931}
2018-05-03 06:23:12 +00:00
Sathya Gunasekaran
cfc79faa93 [hashtable] Move data table to the beginning
TBR: hpayer@chromium.org
Bug: v8:6443, v8:7569
Change-Id: Idd952ed0a832c469b76f1cbc919f700e09dc975d
Reviewed-on: https://chromium-review.googlesource.com/1031559
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52930}
2018-05-03 06:22:07 +00:00
Jungshik Shin
a9e2b2ce20 Move DateTimeFormat.formatToParts to CPP from JS
Bug: None
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ie8a0db70a2f29567718fbacfd33fcd412109d069
Reviewed-on: https://chromium-review.googlesource.com/1034282
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52929}
2018-05-03 01:12:49 +00:00
Eric Holk
37693e0ad6 [wasm] Use V8::FatalProcessOutOfMemory when SetPermissions fails
SetPermissions causes memory that was previously reserved but uncommitted to be
committed. This could put us over the committed memory limit for the process,
causing SetPermissions to fail. In this case, we should report this as an out of
memory error rather than a crash.

Bug: chromium:838880
Change-Id: I2785aa9f5608fa04196fee2b280e0c6df2f56ca8
Reviewed-on: https://chromium-review.googlesource.com/1040657
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52928}
2018-05-03 01:09:29 +00:00
Sathya Gunasekaran
11f576d1cd Revert "[heap] Verify that newly allocated MemoryChunks are pre-initialzed with 0."
This reverts commit 77aba17a40.

Reason for revert: broke gc stress bot
https://ci.chromium.org/buildbot/client.v8/V8%20Mac64%20GC%20Stress/743

Original change's description:
> [heap] Verify that newly allocated MemoryChunks are pre-initialzed with 0.
> 
> Bug: chromium:829771
> Change-Id: I78eab59fded3f41c93ecb3d5d8a30e1bddc4576e
> Reviewed-on: https://chromium-review.googlesource.com/1039747
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52925}

TBR=hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I3053cb9d052e520dd6a41f54a6c7e1654fa4d1f3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:829771
Reviewed-on: https://chromium-review.googlesource.com/1041245
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52927}
2018-05-03 01:03:00 +00:00
Deepti Gandluri
4e668f8e2f Clean up visitors for Atomic operations
Bug: v8:6532, v8:7570
Change-Id: Ieca502a6a13449ea65e47fb43f0e3d7cb5a09a7d
Reviewed-on: https://chromium-review.googlesource.com/1031176
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52926}
2018-05-02 19:22:02 +00:00
Hannes Payer
77aba17a40 [heap] Verify that newly allocated MemoryChunks are pre-initialzed with 0.
Bug: chromium:829771
Change-Id: I78eab59fded3f41c93ecb3d5d8a30e1bddc4576e
Reviewed-on: https://chromium-review.googlesource.com/1039747
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52925}
2018-05-02 19:15:52 +00:00
Deepti Gandluri
996fe2d24c [int64-lowering] Remove unused functions
Bug:v8:7510

R=ahaas@chromium.org

Change-Id: Id3c6b4ebcb89300c4b886c79f4c688bc18648b06
Reviewed-on: https://chromium-review.googlesource.com/1036650
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52924}
2018-05-02 19:00:02 +00:00
Michael Lippautz
55d00c95b0 [heap] Fix ArrayBufferTracker accessing already swept byte length
The tracker needs to maintain the byte length as there is no order guarantee
when sweeping pages and the byte length may be a HeapNumber that is stored on a
different page.

The abstraction for ArrayBuffers is left untouched. We distinguish between the
following cases:
1. Regular AB (backing_store and bye_length should be used)
2. AB allocated using kReservation but not part of wasm
3. AB allocated using kReservation and part of wasm

In practice, 2. does not exist, but we still maintain "allocation_base" and
"allocation_length" which fall back to backing_store and byte_length in this
case. The problematic part is that they look like innocent getters on the
object but actually refer to different data structures or on-heap objects.

Since 2. does not exist, and 3. looks up the bounds in its own tracker, it is
fine for ArrayBufferTracker to pass backing_store and tracked byte_length.

Bug: v8:7701
Change-Id: Ib89d5fe94fce5cef8e5d8343a5415a3b9ad0deba
Reviewed-on: https://chromium-review.googlesource.com/1039385
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52923}
2018-05-02 18:16:18 +00:00
Ali Ijaz Sheikh
a3770c731e [tracing] add INTERNAL_TRACE_EVENT_ADD_WITH_ID_TID_AND_TIMESTAMP
Change-Id: I3cc0dd01d5e33ca7579a4c0dc8f5e65e6b7c76f4
Reviewed-on: https://chromium-review.googlesource.com/924507
Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#52922}
2018-05-02 17:44:54 +00:00
Eric Holk
19617ec0c3 Reland "[wasm] Always enable guard regions on 64-bit platforms"
This is a reland of ad221d144a

Original change's description:
> [wasm] Always enable guard regions on 64-bit platforms
> 
> This change makes full 8 GiB guard regions always enabled on 64-bit
> platforms.
> 
> Additionally, since all Wasm memory allocation paths have some form of
> guard regions, this removes and simplifies most of the logic around
> whether to enable guard regions.
> 
> This is a reland of https://crrev.com/c/985142.
> 
> Bug: v8:7619
> Change-Id: I8bf1f86d6f89fd0bb2144431c7628f15a6b00ba0
> Reviewed-on: https://chromium-review.googlesource.com/996466
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Eric Holk <eholk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52412}

Bug: v8:7619
Change-Id: I0f311305472ca2305ad2fa9163560ff54c1422c2
Reviewed-on: https://chromium-review.googlesource.com/999872
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52921}
2018-05-02 16:44:38 +00:00
Eric Holk
07ef612fbf [wasm] Remove racy DCHECKs
These DCHECKs involve reading and comparing two variables that may be modified
on a separate thread. Thus, there is no way to ensure these comparisons happen
atomically. This leads to runtime failures that are otherwise benign.

The other option would be to take the memory tracker mutex, but this seems
unnecessary given that two atomic counters is sufficient and these checks are
only used during debug builds.

Bug: chromium:838043
Change-Id: I1b87698c46c550bd2d58bfef956b5a07cb2ec52c
Reviewed-on: https://chromium-review.googlesource.com/1038886
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52920}
2018-05-02 16:05:28 +00:00
Leszek Swirski
18bc285621 Revert "[parser] Slice the source string where possible"
This reverts commit 2df5e7a7b6.

Reason for revert: Mystery crashes https://bugs.chromium.org/p/chromium/issues/detail?id=838805

Original change's description:
> [parser] Slice the source string where possible
> 
> When internalizing string literals (for quoted strings or property names),
> try to create a sliced string of the source string rather than allocating
> a copy of the bytes.
> 
> This will not work for string literals that contain escapes (e.g. unicode
> escapes), and currently does not support two-byte strings.
> 
> Bug: chromium:818642
> Change-Id: I686e5ad36baecd1a84ce5e124118431249b6c980
> Reviewed-on: https://chromium-review.googlesource.com/1010282
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52898}

TBR=marja@chromium.org,yangguo@chromium.org,jarin@chromium.org,mlippautz@chromium.org,leszeks@chromium.org,verwaest@chromium.org

Change-Id: I598b6668c43a3e843e2dd8e60852b2b2f3461954
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:818642
Reviewed-on: https://chromium-review.googlesource.com/1039885
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52919}
2018-05-02 15:32:13 +00:00
Choongwoo Han
aa15b7dc98 [map] Normalize hole for formatting an exception
The first element of a given iterable argument can be a hole. Thus,
normalize the first element so that we can correctly format the
exception message with "undefined" for a hole element, instead of "NaN".

Bug: v8:7715
Change-Id: I62edd09e361ebeebab642bb82db29b73a2c7b193
Reviewed-on: https://chromium-review.googlesource.com/1038951
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52917}
2018-05-02 12:55:47 +00:00
jgruber
ab9e012426 Reland: [builtins] Patch self-references in constants table
Original CL: https://crrev.com/c/1018468

During code generation, we generate self-references (i.e. references to
the Code object currently being generated) as references to a temporary
handle. When the final Code object has been allocated, the handle's
location is fixed up and RelocInfo iteration fixes up all references
embedded in the generated code.

This adds support for this mechanism to the builtins constants table
builder. CodeObject() is now a new handle pointing to a dedicated
self-reference marker in order to distinguish between self-references
and references to undefined. In Factory::NewCode, we patch up
the constants table.

TBR=yangguo@chromium.org,mlippautz@chromium.org

Bug: v8:6666
Change-Id: I3fa422c57de99c9851dc7a86394a8387c7c2b397
Reviewed-on: https://chromium-review.googlesource.com/1039366
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52916}
2018-05-02 12:33:06 +00:00
Sigurd Schneider
d9c9b00353 [turbofan] Fix wrong optimization of Number.parseInt
We incorrectly used a TurboFan typer check for {0,10,undefined} on the
radix argument on Number.parseInt, which was internally widened to the
checking whether radix is in range 0-10 or undefined. This CL introduces
two separate checks.

Bug: chromium:838766
Change-Id: I5ebfc1c82bad5b9794b4f844e79e4df01f541a83
Reviewed-on: https://chromium-review.googlesource.com/1039197
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52914}
2018-05-02 12:24:07 +00:00
Choongwoo Han
c77c869cd1 Do not throw if the array is empty in Map constructor
Bug: chromium:837939
Change-Id: Iaca2bc5b52f47d8add13ed9b82497a53cb522933
Reviewed-on: https://chromium-review.googlesource.com/1034043
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52913}
2018-05-02 12:03:26 +00:00
Clemens Hammacher
a05dc3652d [Liftoff] Implement current_memory
R=titzer@chromium.org

Bug: v8:6600
Change-Id: I2eb914e7558c01d924cb9d39f18e1c3a5f5c72e5
Reviewed-on: https://chromium-review.googlesource.com/1035123
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52912}
2018-05-02 11:43:06 +00:00
Marja Hölttä
c56cabb5ea [wasm] iwyu part 2
BUG=v8:7490

Change-Id: I2a597eda708b2ea34c9e32e39556159b48591b61
Reviewed-on: https://chromium-review.googlesource.com/1039196
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52911}
2018-05-02 11:22:56 +00:00
Benedikt Meurer
ca7639239f [promises] Correctly run before/after hooks for await.
This fixes a bug where we didn't run before/after hooks for await when
the debugger is not active, as reported downstream in
https://github.com/nodejs/node/issues/20274

Change-Id: I1948d1884c591418d87ffd1d0ccb2bebf4e908f1
Reviewed-on: https://chromium-review.googlesource.com/1039386
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52909}
2018-05-02 10:51:34 +00:00
Marja Hölttä
a9db2c74b5 [objects.h splitting] Move classes related to api callbacks.
BUG=v8:5402,v8:7570

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I56beb15109a3557ba514e8d17880b1a37a109031
Reviewed-on: https://chromium-review.googlesource.com/1032552
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52908}
2018-05-02 10:24:44 +00:00
Choongwoo Han
23d38099da Make a transition for too many JSFunction properties
If we add new properties by assigning JSFunction values, properties
array was not changed into a dictionary map.

Bug: v8:7461
Change-Id: Ie16f974502d0ba362e3650a409c27cdc5856a373
Reviewed-on: https://chromium-review.googlesource.com/1028110
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52907}
2018-05-02 09:05:24 +00:00
Pierre Langlois
34fc7f621c [perf-prof] Let UnwindingInfoWriter know about throw and debug abort.
In order to keep track of where the return address is stored in each block, the
UnwindingInfoWriter needs to know if a block exits the current function.
However, we would only mark returns and tail-calls as exists, while we also have
kArchDebugAbort, kArchThrowTerminator and kArchDeoptimize. This would lead to
assertions when generating the snapshot in debug mode with
`v8_perf_prof_unwinding_info = true`.

Bug: v8:7660
Change-Id: Iee2ab222251f6922dd21442e12cbb6b56534bf54
Reviewed-on: https://chromium-review.googlesource.com/1019504
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#52906}
2018-05-02 08:41:54 +00:00
Clemens Hammacher
c63c5c22c1 [wasm] Remove unneeded i64 to i32 truncation
This is a leftover of the time where the memory size was stored as
64 bit value. Now it is stored as 32 bit value, so no need to truncate.

R=ahaas@chromium.org

Change-Id: I44a1505ebd564aee53e4c9a7168738fcb855264b
Reviewed-on: https://chromium-review.googlesource.com/1034883
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52905}
2018-05-02 07:48:45 +00:00
Simon Zünd
af177a0ca0 [refactoring] Add types to CreateArrayIterator.
This CL also adds types to a user and three builtins that make use
of CreateArrayIterator.

R=petermarshall@chromium.org

Bug: v8:7570
Change-Id: I96b647a9a57e825db717b40ecec2340b0a3d367d
Reviewed-on: https://chromium-review.googlesource.com/1032779
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52904}
2018-05-02 06:40:23 +00:00
Kenton Varda
5a9b1d5bc8 Cleanup: Move thread_data_table_ to end of Isolate class.
In b49206ded9 I changed thread_data_table_ and thread_data_table_mutex_ from
static members to regular class member variables. To do this, I only deleted
the `static` keyword and left the declarations where they were. This was a
little odd in that all of the dynamic class members are declared together in
one place, but now these two new members weren't next to the rest. Making it
a little bit weirder is the fact that these two new members actually ended up
being the first members of the class, since the exsiting dynamic members were
declared later.

This change merely moves these two members down to the end of the dynamic
member variable list, where they probably should have gone.

Bug: chromium:837477

Change-Id: If993935cc56c8026bb7331493ed657c42ba06ac7
Reviewed-on: https://chromium-review.googlesource.com/1036478
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52902}
2018-05-01 18:53:00 +00:00
Vincent Belliard
d9bb26522f [arm64][Liftoff] implement stack operations
Bug: v8:6600
Change-Id: Icdb53714f50add1a9e25025c5b7d52b90d071aa5
Reviewed-on: https://chromium-review.googlesource.com/1036939
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Cr-Commit-Position: refs/heads/master@{#52901}
2018-05-01 17:53:21 +00:00
Junliang Yan
48e9f76f3f Fix type mismatch error on s390
On s390, size_t is defined to be long unsigned int, while Address is unsigned
int. Therefore, GCC is complaining conflicting types for parameter 'T'
('long unsigned int' and 'unsigned int') for the Min function.

R=ofrobots@google.com, hpayer@chromium.org, mstarzinger@chromium.org, mlippautz@chromium.org

Change-Id: Ib04edebad24da694ccd06ff572ee50d3db7f87ff
Reviewed-on: https://chromium-review.googlesource.com/1035542
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52900}
2018-05-01 16:28:09 +00:00
Vincent Belliard
306b40c7a0 [arm64][Liftoff] implement floating point operations
Bug: v8:6600
Change-Id: I442a76ffc3bcb5e93a7865eb30740556b18cbd79
Reviewed-on: https://chromium-review.googlesource.com/1033731
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52899}
2018-05-01 15:46:29 +00:00
Leszek Swirski
2df5e7a7b6 [parser] Slice the source string where possible
When internalizing string literals (for quoted strings or property names),
try to create a sliced string of the source string rather than allocating
a copy of the bytes.

This will not work for string literals that contain escapes (e.g. unicode
escapes), and currently does not support two-byte strings.

Bug: chromium:818642
Change-Id: I686e5ad36baecd1a84ce5e124118431249b6c980
Reviewed-on: https://chromium-review.googlesource.com/1010282
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52898}
2018-05-01 15:38:19 +00:00
Gabriel Charette
4ac96190f7 [V8 Platform] Better WorkerThreads APIs.
As discussed @ https://chromium-review.googlesource.com/c/chromium/src/+/957761#message-4ba6c1bf637f91507544efc89a31e3e4dd407715
and again @ https://chromium-review.googlesource.com/c/chromium/src/+/957761#message-6d0430e640c82f2d5463259fecdc7fabf945b958

Get rid of task runners for WorkerThreads API (use case is always a
one-off task in which case a static call is fine -- just like in
Chromium's base/task_scheduler/post_task.h)

Calling into V8Platform* from any worker thread is safe, what was previously
unsafe was using an Isolate* from worker threads but Isolate* was dropped
from the new worker threads APIs so this is now irrelevant.

Bug: chromium:817421
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Idd2dbc081edfbcb8985eeb45eb64ffb2555fcf7c
Reviewed-on: https://chromium-review.googlesource.com/978443
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52893}
2018-04-30 19:05:40 +00:00
Gabriel Charette
4b13a22ff4 [V8 Platform] Introduce CallDelayedOnWorkerThread()
GetWorkerThreadsTaskRunner() was about to be phased out [1] but v8
r52818 landed ahead  of it.

Add CallDelayedOnWorkerThread() to the new worker thread API to support
this use case before phasing out GetWorkerThreadsTaskRunner()

[1] https://chromium-review.googlesource.com/c/v8/v8/+/978443

Implemented it in d8+cctest+default-platform right away to avoid
requiring a non-null Isolate* (and yet another transitional API).

R=ahaas@chromium.org, kozyatinskiy@chromium.org

Bug: chromium:817421
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2bee08fee08cf15a664d31cc6817e21cebe1d140
Reviewed-on: https://chromium-review.googlesource.com/1033584
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52892}
2018-04-30 18:39:51 +00:00
Eric Holk
9286358071 [wasm][interpreter] Clear thread in wasm flag on exceptional return
A stack overflow can be thrown by JSEntryStub, which means the
thread-in-wasm flag will not have the expected value. To accommodate
this, we now clear the flag during exceptional returns if it is set.

Bug: chromium:834624
Change-Id: I8359af79886ab98dfecc2fb39ca19118b7fa38eb
Reviewed-on: https://chromium-review.googlesource.com/1019570
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52891}
2018-04-30 17:13:19 +00:00
Michael Starzinger
39f5f79e3c [wasm] Move native context field into {WasmInstanceObject}.
R=clemensh@chromium.org
BUG=v8:7424

Change-Id: I334d0521982e173650da7dd5da0627197dff171b
Reviewed-on: https://chromium-review.googlesource.com/1035124
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52890}
2018-04-30 17:07:59 +00:00
Michael Starzinger
67f451aa40 [wasm] Remove some dead and obsolete fields.
R=ahaas@chromium.org

Change-Id: I8db129e18dff445a3650a0d5c14da835aaa262d9
Reviewed-on: https://chromium-review.googlesource.com/1033742
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52889}
2018-04-30 16:11:58 +00:00
Clemens Hammacher
b2f1d583d0 [Liftoff] Implement the unreachable opcode
R=ahaas@chromium.org

Bug: v8:6600
Change-Id: Id2fd843aa15f7a414205ac413432bd8cfec6e88b
Reviewed-on: https://chromium-review.googlesource.com/1034862
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52888}
2018-04-30 16:05:18 +00:00
Simon Zünd
9035ca190a [refactoring] Return TNode in AllocateFixedArray.
R=petermarshall@chromium.org

Bug: v8:7570
Change-Id: I0418ea6d2eb114ddac4d7be1251f429596464b79
Reviewed-on: https://chromium-review.googlesource.com/1032438
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52887}
2018-04-30 15:54:36 +00:00
Michael Starzinger
c224c67a1a [wasm] Move {use_trap_handler} field into {NativeModule}.
The predicate in question is specific to the code generated for a given
module, hence specific to the {NativeModule} and independent of the
instance.

R=ahaas@chromium.org

Change-Id: I108ee8126897ed732e8c52b549de170339a125a8
Reviewed-on: https://chromium-review.googlesource.com/1033741
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52886}
2018-04-30 15:32:07 +00:00
Georgia Kouveli
0600afddd3 [arm64] Use direct calls where possible.
This includes the following changes:
- Limit code space to 128 MB.
- Use direct branches wherever possible.
- Where not possible, continue using load literal followed by an indirect
  branch.
- Sort RelocInfo by target_address_address for the serializer, since mixing
  load literal instructions and branch instructions messes up that order.
- Ensure we always wipe out targets in the serializer (not just for the
  snapshot) in order to be able to distinguish between constant pool entries
  and branch instructions.

Change-Id: I1a1029ce2a5f72a3a94802daf267d14a42c7c790
Reviewed-on: https://chromium-review.googlesource.com/939175
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#52885}
2018-04-30 15:02:27 +00:00
Ivica Bogosavljevic
735875f82c MIPS64: Fix Reland "[builtins] Introduce further constant & external reference indirections"
Fix 3f99a376dd

A typo in the port caused failuire of about 300 tests. This CL
fixes it.

TEST=cctest/test-api/CatchExceptionFromWith,cctest/test-api/MessageHandler1

Change-Id: Ia2f4c9502d00fe1a6ee581f8a9b41a574b688dab
Reviewed-on: https://chromium-review.googlesource.com/1033735
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52884}
2018-04-30 13:32:14 +00:00
Jaroslav Sevcik
f53dfd934d Replace array index masking with the poisoning approach.
The idea is to mark all the branches and loads participating in array
bounds checks, and let them contribute-to/use the poisoning register.
In the code, the marks for array indexing operations now contain
"Critical" in their name. By default (--untrusted-code-mitigations),
we only instrument the "critical" operations with poisoning.

With that in place, we also remove the array masking approach based
on arithmetic.

Since we do not propagate the poison through function calls,
we introduce a node for poisoning an index that is passed through
function call - the typical example is the bounds-checked index
that is passed to the CharCodeAt builtin.

Most of the code in this CL is threads through the three levels of
protection (safe, critical, unsafe) for loads, branches and flags.

Bug: chromium:798964

Change-Id: Ief68e2329528277b3ba9156115b2a6dcc540d52b
Reviewed-on: https://chromium-review.googlesource.com/995413
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52883}
2018-04-30 13:22:44 +00:00
Michael Starzinger
9011927acd [wasm] Make {ProtectedInstructions} unique per module.
Now that we no longer clone {WasmCode} objects, the referenced protected
instructions became unique to each such object. We no longer need to
maintain a reference count on the protected instructions.

R=clemensh@chromium.org

Change-Id: Iaa5b9cd4b56cc06d75f7d0b71429b6147378c2ca
Reviewed-on: https://chromium-review.googlesource.com/1034061
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52881}
2018-04-30 11:47:24 +00:00
Marja Hölttä
833c3dbf97 [in-place weak refs prework] Remove dead FeedbackVector::copy.
BUG=v8:7308

Change-Id: I55400096095619e2995a50adadf93253fc95d34c
Reviewed-on: https://chromium-review.googlesource.com/1034057
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52880}
2018-04-30 11:21:09 +00:00
Clemens Hammacher
33dadf962b [objects] Remove redundant FIELD_ADDR_CONST
Since the switch of Address from byte* to uintptr_t, we technically
cannot differentiate between constant field addresses and non-constant
ones.
Thus remove the FIELD_ADDR_CONST macro, and use the identical
FIELD_ADDR instead.

R=jkummerow@chromium.org

Bug: v8:7570
Change-Id: Iea4dde36b42c6d0f0ea80a965806f1dbd7adcd39
Reviewed-on: https://chromium-review.googlesource.com/1032746
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52879}
2018-04-30 11:19:54 +00:00
Jaroslav Sevcik
ba616de103 [turbofan] Remove the hacky Type::operator-> overload
This removes Type::operator-> which was used to split the change that
removed undefined misuse of Type* to represent integers.

Bug: v8:3770
Change-Id: I9a5bce5ccdc75461a7b939b4070cb58fe6040d99
Reviewed-on: https://chromium-review.googlesource.com/1033736
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52878}
2018-04-30 09:39:12 +00:00
Michael Starzinger
42392e8317 [wasm] Allow sharing of WasmCode across instances.
This shares {NativeModule} and associated {WasmCode} objects across
multiple WebAssembly instances in the same Isolate. It also removes
support for cloning the aforementioned objects.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: I35334bd68f87e5871c244ee33dfcecb9da326b9f
Reviewed-on: https://chromium-review.googlesource.com/1032780
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52877}
2018-04-30 09:22:11 +00:00
Marja Hölttä
98eebe1c8d [iwyu] Wasm iwyu.
BUG=v8:7490,v8:7570

Change-Id: I74fa43a747b0d399c700acc43eb82e15ea90ba16
Reviewed-on: https://chromium-review.googlesource.com/1032736
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52876}
2018-04-30 08:13:51 +00:00
Predrag Rudic
4d71565a2b [parser] Skipping inner funcs: Fix debug mode check for big endian
Fix failing test mjsunit/skipping-inner-functions on big endian
platforms.

Change-Id: If35c5a663a296fab6ad6011cf0a101133ec6a237
Reviewed-on: https://chromium-review.googlesource.com/1029954
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52875}
2018-04-30 08:09:31 +00:00
Caitlin Potter
a7e6b0ee42 [objects] fix forced slow path in MigrateSlowToFast
Without this change, we could disable slow paths required when symbols
such as toStringTag are present on a receiver, but accessors or
interceptors are not (added in 31800120cc)

This change modifies this behaviour to not unset the previously set bit
if these forced slow path conditions are not met.

BUG=v8:7706
R=bmeurer@chromium.org

Change-Id: Id7bceb0e749da52e2dbcde0a310a865a89f24066
Reviewed-on: https://chromium-review.googlesource.com/1034210
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#52874}
2018-04-29 11:59:57 +00:00
Jaroslav Sevcik
e2ab7dae47 [turbofan] Stop mis-using Type* to represent integers.
This is part of the effort to decrease the amount of undefined behavior.
that v8 relies on.

The main change here is to represent types with class Type rather than
with pointer Type*. To make the CL smaller, I used an operator overload
hack to separate the change from `->` to `.`. I am working on a CL that
will remove the operator and change all those arrows to dots.

Bug: v8:3770
Change-Id: I71a197cb739a1467937bc95c2a757fab0469aa22
Reviewed-on: https://chromium-review.googlesource.com/1032551
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52872}
2018-04-28 06:38:46 +00:00
jing.bao
d997955cf7 [ia32][wasm] Add packing integer conversions
I16x8SConvertI32x4, I16x8UConvertI32x4,
I8x16SConvertI16x8, I8x16UConvertI16x8

Add packsswb/packssdw/packuswb/packusdw

Change-Id: Ibb661a20fa032d732fec20b3d48190f44d2d4bd4
Reviewed-on: https://chromium-review.googlesource.com/1027123
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#52870}
2018-04-28 02:01:46 +00:00
Jungshik Shin
ea9e2c6400 Remove flags for plural rules and number formatToParts
Intl.PluralRules and Intl.NumberFormat.prototype.formatToParts
were shipped in 6.3 and 6.4, respectively.

Remove harmony_plural_rules and harmony_number_format_to_parts.

Bug: v8:5601, v8:5244
Test: mjsunit/intl-pluralrules-select
Test: mjsunit/intl-numberformat-formattoparts
Test: test262/intl402/PluralRules/unit/harmony/intl-numberformat-formattoparts
Test: test262/intl402/NumberFormat/prototype/formatToParts/*
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I1752622484bf9a0a8b9d810db54fc238f4caf3f3
Reviewed-on: https://chromium-review.googlesource.com/1032260
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52866}
2018-04-27 20:02:48 +00:00
Ben Smith
2747d0e6da [wasm] Fix some bugs in mut global implementation
* If the mutability of the global object doesn't match the module, then
  it should throw a LinkError.
* There was a missing `return` when importing a Number as a mutable
  global.
* All globals were being exported as immutable.
* Attempting to set the value of an immutable global should throw a
  TypeError.
* The length of the setter function should be 1.

Bug: v8:7625
Change-Id: I08d6a428506a18db15eecadf4cbcee89e0658924
Reviewed-on: https://chromium-review.googlesource.com/1031626
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52865}
2018-04-27 19:14:36 +00:00
Vincent Belliard
2a7b2d6f93 [arm64][Liftoff] implement Load and Store
Bug: v8:6600

Change-Id: I3aa174e28db83ca9e9f7a7b65c8007af8227908a
Reviewed-on: https://chromium-review.googlesource.com/1028764
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52864}
2018-04-27 18:55:36 +00:00
Eric Holk
f083d35327 [wasm][cleanup] Fix typo
Bug: v8:7570
Change-Id: I90d9cb6c22c34017df2fd1613f3c94bb6a9afb52
Reviewed-on: https://chromium-review.googlesource.com/1033452
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52863}
2018-04-27 18:42:16 +00:00
Vincent Belliard
c6efd71495 [arm64][Liftoff] implement LoadConstant, LoadFromInstance and FillInstanceInto
Bug: v8:6600

Change-Id: Iec1804b89ed853833596a498bb1dfc15bb16c4ce
Reviewed-on: https://chromium-review.googlesource.com/1028763
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52861}
2018-04-27 18:14:45 +00:00
Bill Budge
28e015dbaf [wasm] Refactor wasm-serialization to fix alignment
- Alignment of code sections is only relative to start of header. Code
  should be aligned in the buffer.
- Rewrites Reader/Writer classes to make global alignment easier.
- Rewrites the native serialization to simplify things in preparation
  for switch to streaming serialization APIs.

Bug: chromium:719007
Change-Id: I0397bc84a8d009b4fd7f5286bb5abc527bb0db95
Reviewed-on: https://chromium-review.googlesource.com/1027433
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52860}
2018-04-27 17:40:07 +00:00
Andreas Haas
441e6d4a3c [wasm] Do an additional IsWasmModuleObject check during instantiation
When WebAssembly.instantiate or WebAssembly.instantiateStreaming is
called in JavaScript, internally we transfrom it into
WebAssembly.compile(buffer).then(WebAssembly.instantiate). However,
modifying the prototype of WebAssembly.Module can change the result of
WebAssembly.compile(buffer). With this CL we make sure that even if the
result of WebAssembly.compile is modified, there is still no type
confusion. In the long term we have to do a refactoring and remove
this internal transformation.

R=mstarzinger@chromium.org

Bug: chromium:837417
Change-Id: I376068b8b8b01b991ec450162da6a62ae7030c62
Reviewed-on: https://chromium-review.googlesource.com/1032392
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52859}
2018-04-27 17:34:05 +00:00
Vincent Belliard
8e102e049c [arm64][Liftoff] implement integer binary operations
Bug: v8:6600

Change-Id: I2e18700344ce57c78c096fba1956d82f9e29ffa6
Reviewed-on: https://chromium-review.googlesource.com/1026469
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52858}
2018-04-27 17:06:07 +00:00
Camillo Bruni
a3c48cf2c9 Reland "[elements] Improve Array.prototype.splice speed"
This reverts commit 9a7c4bfe1e.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Revert "[elements] Improve Array.prototype.splice speed"
> 
> This reverts commit dcdabdc86a.
> 
> Reason for revert: broke tsan.
> 
> Original change's description:
> > [elements] Improve Array.prototype.splice speed
> > 
> > By using memmove for SMI elements we get a roughly 3x speedup over the slower
> > iterative copying with write barriers.
> > 
> > Bug: chromium:835558
> > Change-Id: I73da07a1648a3495ff78212ffa1ed949d205a7d2
> > Reviewed-on: https://chromium-review.googlesource.com/1028236
> > Reviewed-by: Igor Sheludko <ishell@chromium.org>
> > Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#52792}
> 
> TBR=cbruni@chromium.org,ishell@chromium.org
> 
> Change-Id: I77c46fe3d47d651de3c39df9fbf5f30c340188e2
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:835558
> Reviewed-on: https://chromium-review.googlesource.com/1028337
> Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52795}

TBR=kozyatinskiy@chromium.org,cbruni@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:835558
Change-Id: I57aedb3536b81c97cf4e7ab6d863aa1dc24c20b4
Reviewed-on: https://chromium-review.googlesource.com/1032743
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52857}
2018-04-27 17:04:26 +00:00
Michael Achenbach
77d9089042 Revert "[builtins] Patch self-references in constants table"
This reverts commit 6379e2a464.

Reason for revert:
https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Win64%2F23855%2F%2B%2Frecipes%2Fsteps%2FCheck%2F0%2Flogs%2Fmkgrokdump%2F0

Original change's description:
> [builtins] Patch self-references in constants table
> 
> During code generation, we generate self-references (i.e. references to
> the Code object currently being generated) as references to a temporary
> handle. When the final Code object has been allocated, the handle's
> location is fixed up and RelocInfo iteration fixes up all references
> embedded in the generated code.
> 
> This adds support for this mechanism to the builtins constants table
> builder. CodeObject() is now a new handle pointing to a dedicated
> self-reference marker in order to distinguish between self-references
> and references to undefined. In Factory::NewCode, we patch up
> the constants table.
> 
> Bug: v8:6666
> Change-Id: If74ed91bb1c3b8abb20ff2f0a87d1bcd9a1b0511
> Reviewed-on: https://chromium-review.googlesource.com/1018468
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52854}

TBR=yangguo@chromium.org,mlippautz@chromium.org,jgruber@chromium.org

Change-Id: I8cf8c4b43f51285ea913c6c8fdd339bd9ea645df
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Reviewed-on: https://chromium-review.googlesource.com/1033092
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52856}
2018-04-27 16:00:42 +00:00
Junliang Yan
e5f1b968b8 PPC/s390: Reland "[builtins] Introduce further constant & external reference indirections"
Port 3f99a376dd

Original Commit Message:

    This is a reland of f5d308510a

    Original change's description:
    > [builtins] Introduce further constant & external reference indirections
    >
    > This introduces further indirections for embedded constants and
    > external references for builtins generated by the macro-assembler.
    > The used mechanisms (LookupConstant and LookupExternalReference) are
    > identical to what we already use in CSA.
    >
    > Almost all builtins are now isolate-independent in both release and
    > debug modes. snapshot_blob.bin is roughly 670K smaller in embedded
    > builds vs. non-embedded builds, while libv8.so is roughly 280K larger.
    >
    > Bug: v8:6666
    > Change-Id: I7a6c2193ef5a763e6cf7543dd51597d6fff6c110
    > Reviewed-on: https://chromium-review.googlesource.com/1006581
    > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
    > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
    > Cr-Commit-Position: refs/heads/master@{#52810}

R=jgruber@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I037faebce37a866091dc35e04500790591292622
Reviewed-on: https://chromium-review.googlesource.com/1031397
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#52855}
2018-04-27 15:58:10 +00:00
jgruber
6379e2a464 [builtins] Patch self-references in constants table
During code generation, we generate self-references (i.e. references to
the Code object currently being generated) as references to a temporary
handle. When the final Code object has been allocated, the handle's
location is fixed up and RelocInfo iteration fixes up all references
embedded in the generated code.

This adds support for this mechanism to the builtins constants table
builder. CodeObject() is now a new handle pointing to a dedicated
self-reference marker in order to distinguish between self-references
and references to undefined. In Factory::NewCode, we patch up
the constants table.

Bug: v8:6666
Change-Id: If74ed91bb1c3b8abb20ff2f0a87d1bcd9a1b0511
Reviewed-on: https://chromium-review.googlesource.com/1018468
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52854}
2018-04-27 15:38:10 +00:00
Michael Starzinger
d71bcfcb54 [wasm] Make {NativeModule} independent of instance.
This removes the last reference from {NativeModule} that made it
specific to a concrete WebAssembly instance, by only referencing the
{WasmSharedModuleData} instead of a {WasmCompiledModule}. Note that
eventually we want to remove this reference completely to become even
independent of the underlying Isolate soon.

R=clemensh@chromium.org
BUG=v8:7424

Change-Id: I29b8cde8beadeef75c90e90fbff1830f2bf4e636
Reviewed-on: https://chromium-review.googlesource.com/1032433
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52853}
2018-04-27 14:22:35 +00:00
Ben L. Titzer
8ba3f1366d [wasm] Handlify table entry helpers
R=clemensh@chromium.org

Change-Id: Iade16b07a24dca8ac542e68becad734d977b673a
Reviewed-on: https://chromium-review.googlesource.com/1032778
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52852}
2018-04-27 14:11:34 +00:00
Georg Neis
61c9503965 [torque] Minor cleanups.
- Refine the type of 'hole'.
- Remove the mysterious 'receiver' definition.
- Remove the declaration of a non-existing Print function.

Bug: v8:7570
Change-Id: If093b456a9bc31c5673ada87f262c0cfcadf11ad
Reviewed-on: https://chromium-review.googlesource.com/1032737
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52851}
2018-04-27 13:59:49 +00:00
Simon Zünd
9f01281656 [refactoring] Remove unused CSA methods.
Bug: v8:7570
Change-Id: I2c6551fdd1a53323065f9c23e5bee793e9f561cf
Reviewed-on: https://chromium-review.googlesource.com/1032774
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#52850}
2018-04-27 13:49:39 +00:00
Clemens Hammacher
8466b71ad8 [wasm] Split off wasm-linkage.h
Linkage-related methods were declared in wasm-compiler.h and
implemented in wasm-linkage.cc. This required all users of e.g. wasm
call descriptors to include the whole wasm compiler header. Also, some
wasm linkage information is independent of turbofan and also used
outside of the compiler directory.

This CL splits off wasm-linkage.h (with minimal includes) and puts it
in src/wasm. This allows to use that information without including
compiler headers (will clean up several uses in follow-up CLs).

R=mstarzinger@chromium.org, titzer@chromium.org

Bug: v8:7570
Change-Id: Ifcae70b4ea7932cda30953b325c2b87c4176c598
Reviewed-on: https://chromium-review.googlesource.com/1013701
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52849}
2018-04-27 13:43:49 +00:00
Dan Elphick
4655c9d369 [heap] Move all Maps into RO_SPACE
Allocates almost all maps found in the start up snapshot into RO_SPACE.
There are 2 JSObject maps that are excluded as they contain a mutable cell.

Also updates VerifyReadOnlyPointers to check that RO_SPACE objects' maps are
also in RO_SPACE. Previously the invariant did not hold for Strings which still
had their maps in MAP_SPACE.

Also moves invalid_prototype_validity_cell to RO_SPACE.

    RO_SPACE  NEW_SPACE  OLD_SPACE  CODE_SPACE  MAP_SPACE  LO_SPACE
old    22024          0     229184       32928       8184         0
new    31488          0     229184       32928        176         0

Bug: v8:7464
Change-Id: I870d22cc5234ba60b3ef8a2ada590ee6ae426c9f
Reviewed-on: https://chromium-review.googlesource.com/1013494
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52848}
2018-04-27 13:33:29 +00:00
sreten.kovacevic
e4df13984c [Liftoff][mips] Implement div and rem instructions
Bug: v8:6600
Change-Id: I49b3180603651609ce575e540169f995587f9d88
Reviewed-on: https://chromium-review.googlesource.com/1032615
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52847}
2018-04-27 13:29:39 +00:00
Camillo Bruni
37b8684ec3 [CSA] Type CodeStubAssembler::Is* methods
Bug: v8:7570
Change-Id: I74b482b670ce0e78dca012cbe8d9c2f65fdae5b9
Reviewed-on: https://chromium-review.googlesource.com/1030554
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52846}
2018-04-27 12:45:21 +00:00
Dan Elphick
440533d5d4 [builtins] Remove new_target from ArrayBuiltinsAssembler
Removes new_target member and getter since none of the Array builtins in
builtins-array-gen.* use it (since none of them are constructors).

delete new_target getter and member variable

Bug: v8:7570
Change-Id: Ia23af014750278d64447bb58171955d909fdb5a8
Reviewed-on: https://chromium-review.googlesource.com/1032556
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52845}
2018-04-27 12:26:41 +00:00
sreten.kovacevic
c0c073e65c [Liftoff][mips64] Implement f32/f64 conversion to i64/u64
Bug: v8:6600
Change-Id: Ieefbd4530f068b41895a8eb608a480b563968d63
Reviewed-on: https://chromium-review.googlesource.com/1030331
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52844}
2018-04-27 12:05:30 +00:00
Ivica Bogosavljevic
443b9de184 MIPS: Fix [builtins] Introduce further constant & external reference indirections
Temporary register at was rewritten. We use different register.

Change-Id: If3a162765ee29eb1d03d3f29345328cf79244e41
Reviewed-on: https://chromium-review.googlesource.com/1032616
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52843}
2018-04-27 12:03:09 +00:00
Peter Marshall
f8597b25c1 [cleanup] Change objects_by_info_ to use unordered map.
Trying to reduce use of our self-baked data structures.

Bug: v8:7570
Change-Id: I3c8598ece74b6434c8baa69810a384b5209dd107
Reviewed-on: https://chromium-review.googlesource.com/1032442
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52842}
2018-04-27 11:56:57 +00:00
Marja Hölttä
0a01b62022 [objects.h splitting] Move TemplateInfo + related classes.
BUG=v8:5402,v8:7570

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia97efa31495b371805eb469be8395aaa19c7628d
Reviewed-on: https://chromium-review.googlesource.com/1032431
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52841}
2018-04-27 11:15:44 +00:00
Peter Marshall
1961008a03 [cleanup] Change CounterMap to use unordered map.
Trying to reduce use of our self-baked data structures.

Bug: v8:7570
Change-Id: Ie4257911b388d320e4c5da5108cd763d3ab9299f
Reviewed-on: https://chromium-review.googlesource.com/1032555
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52840}
2018-04-27 11:01:18 +00:00
Clemens Hammacher
feada70894 [Liftoff] Implement f64.min and f64.max
This adds support for f64.min and f64.max, implemented on ia32, x64,
mips and mips64.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: Ib4383df08692c76df5861fe71a96c4354fdf10c1
Reviewed-on: https://chromium-review.googlesource.com/1028235
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52838}
2018-04-27 10:36:58 +00:00
Georg Neis
649c25263b [cleanup] Remove some obsolete TODOs.
R=sigurds@chromium.org

Bug: v8:7570
Change-Id: I3f077940117467be98fbb3c2a30684af8eaaf801
Reviewed-on: https://chromium-review.googlesource.com/1032432
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52837}
2018-04-27 10:27:27 +00:00
sreten.kovacevic
600033e65c [Liftoff][mips] Implement f32 min/max
Fix initial implementation of min/max f32 instructions.

Bug: v8:6600
Change-Id: Icb30515b692caef2c33bd85f468e83c17cdef2a3
Reviewed-on: https://chromium-review.googlesource.com/1030493
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52836}
2018-04-27 09:57:17 +00:00
Ben L. Titzer
a17083ee3a [wasm] Rename WasmModuleWrapper to Managed<WasmModule>
R=ahaas@chromium.org

Bug: v8:7570
Change-Id: I5327d1b8e2f2bf4c1538f565442305a0e1f05b65
Reviewed-on: https://chromium-review.googlesource.com/1032550
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52835}
2018-04-27 09:41:17 +00:00
Ben L. Titzer
903d87312e [wasm] Fix target instance for indirect calls to imports
In the case of an indirect call to an imported function, the target
instance stored in the IFT was actually wrong.

Bug: chromium:834619
Change-Id: Id2ac4158335ecf2b58e1983ce37df852a9ebd1b2
Reviewed-on: https://chromium-review.googlesource.com/1030174
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52831}
2018-04-27 08:27:56 +00:00
Marja Hölttä
a6c44361c8 [iwyu, objects.h splitting] Outline MarkCompactCollector::MarkingWorklist::PrintWorklist.
Calls a function defined in map-inl.h which mark-compact.h is not allowed to
include.

BUG=v8:7490,v8:5402,v8:7570

Change-Id: I51cef646fc2b650208d4e59b92bcd1e406ddd7fd
Reviewed-on: https://chromium-review.googlesource.com/1032332
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52829}
2018-04-27 08:02:05 +00:00
Jakob Kummerow
32b5cad1da [elements.cc] Specialize CollectValuesOrEntriesImpl
When collecting the values of an object with Smi or Object elements
kind, there are no allocations, so we don't need to create a short-
lived handle for each value. This gives a small performance benefit
in general, and in particular on ia32 by reducing register pressure
causes clang to spill less, which fixes the regression in the issue
mentioned below.

Bug: chromium:833591
Change-Id: I5eb0c6164b2972306ce965ec101687cab486bf0d
Reviewed-on: https://chromium-review.googlesource.com/1029417
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52825}
2018-04-27 06:19:34 +00:00
Jakob Kummerow
8d236192a1 [heap] Fine-tune write barrier for strong references
There is no need to remove an object pointer's heap object
tag when all we want is the Page that it's on. Also, apply
to IncrementalMarking's writebarrier the optimization that
crrev.com/e570e67383577c7f5ab6da7beb68631bab4ba75d brought
to the old-to-new barrier.

Change-Id: Ic9328d7d6f5c01073288a3e87931ea6095750740
Reviewed-on: https://chromium-review.googlesource.com/1029413
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52824}
2018-04-27 06:18:25 +00:00
Jungshik Shin
919270e024 Fix the fast path for locale canonicalization
Not all 2 or 3 letter language codes are canonical. Some of them need
to be canonicalized.

Specifically, exclude {jw,ji,iw,in} and all three-letter codes from the
fast path except for 'fil'.

{jw,ji,iw,in} are deprecated ISO 639 codes for
{Javanese, Yiddish, Hebrew, Indonesian}. They should be
canonicalized to {jv,yi,he,id}. So, do not return early
in the fast path, but pass it down to the full canonicalization.

In addition, there are 70+ deprecated 3-letter codes that need to be
replaced by their modern equivalents. Instead of checking and replacing
in v8, just pass them to ICU to handle.

Along with the following ICU change, two more tests will pass.

  https://chromium-review.googlesource.com/c/chromium/deps/icu/+/1026797

These two tests still fail because of the disagreement between ICU and the test
expectations about 5 grandfathered tags with no preferred value (e.g.
i-default, zh-min, cel-gaulish).

  'intl402/Intl/getCanonicalLocales/canonicalized-tags'
  'intl402/Intl/getCanonicalLocales/preferred-grandfathered'

Bug: v8:5693, v8:7669
Test: test262/intl402/language-tags-canonicalized.js
Test: test262/intl402/Intl/preferred-variants.js
Test: intl/general/language_tags_with_preferred_values.js
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ide7e9c90ac046859604c7b71c641f84ce9c64be5
Reviewed-on: https://chromium-review.googlesource.com/1023379
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52823}
2018-04-26 18:10:04 +00:00
Ben Smith
e3c9f26626 [wasm] Update WebAssembly.Global constructor
The new spec has two arguments, the first is the global descriptor, and
the second is the initial value:

    new WebAssembly.Global({type: i32}, 42);

If the initial value argument is omitted, the value is set to 0.

Bug: v8:7625
Change-Id: I679d4b7c49c69ec7ffcdfeb8ae506fa7ab9bba95
Reviewed-on: https://chromium-review.googlesource.com/1028847
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52822}
2018-04-26 18:01:53 +00:00
Kim-Anh Tran
b3ff8eb9cf [wasm] Log top-tier code
Top-tier code needs to be explicitly logged after
compilation.

Change-Id: Ic3c54ff4b7bddd44516a611398b7373fe0acc8d4
Reviewed-on: https://chromium-review.googlesource.com/1030391
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@google.com>
Cr-Commit-Position: refs/heads/master@{#52821}
2018-04-26 16:30:22 +00:00
Ben L. Titzer
b66226828f [wasm] Implement Managed<T> with std::shared_ptr<T>
This CL simplifies and extends the implementation of Managed<T>
and now uses a std::shared_ptr<T> underneath in order to offer
cross-isolate management of C++ allocated memory.

R=mstarzinger@chromium.org
CC=ulan@chromium.org

Bug: v8:7424
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Id43a26f565677e8c9cdfd73810568d4f2b1871fe
Reviewed-on: https://chromium-review.googlesource.com/1028190
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52820}
2018-04-26 15:53:42 +00:00
jgruber
3f99a376dd Reland "[builtins] Introduce further constant & external reference indirections"
This is a reland of f5d308510a

Original change's description:
> [builtins] Introduce further constant & external reference indirections
>
> This introduces further indirections for embedded constants and
> external references for builtins generated by the macro-assembler.
> The used mechanisms (LookupConstant and LookupExternalReference) are
> identical to what we already use in CSA.
>
> Almost all builtins are now isolate-independent in both release and
> debug modes. snapshot_blob.bin is roughly 670K smaller in embedded
> builds vs. non-embedded builds, while libv8.so is roughly 280K larger.
>
> Bug: v8:6666
> Change-Id: I7a6c2193ef5a763e6cf7543dd51597d6fff6c110
> Reviewed-on: https://chromium-review.googlesource.com/1006581
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52810}

TBR=mstarzinger@chromium.org

Bug: v8:6666
Change-Id: I73dfe207f2c5f79a9a06c165c75f5619e88a5a17
Reviewed-on: https://chromium-review.googlesource.com/1030550
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52819}
2018-04-26 15:27:22 +00:00
Alexey Kozyatinskiy
c1e4885f7d Reland "[inspector] added timeout for Debugger.evaluateOnCallFrame method"
This is a reland of 436faae044

Original change's description:
> [inspector] added timeout for Debugger.evaluateOnCallFrame method
> 
> R=dgozman@chromium.org,yangguo@chromium.org
> 
> Bug: none
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I569899f245190ca2fa720bdb837db1263e8058d5
> Reviewed-on: https://chromium-review.googlesource.com/1023035
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52798}

Bug: none
Change-Id: I91219382b5dc45b54dd8e5c64d9f0d11c849b9c8
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1030510
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52818}
2018-04-26 15:08:52 +00:00
sreten.kovacevic
bb965ff7fb [Liftoff][mips] Implement jump on target
Implement emit_jump when target is in register.

Bug: v8:6600
Change-Id: Idd8fc739ac9997cad53feffdfcee5ae25d9ad6ee
Reviewed-on: https://chromium-review.googlesource.com/1030453
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52816}
2018-04-26 14:44:42 +00:00
Vincent Belliard
076ff421e5 [arm64][Liftoff] add AbortCompilation
When a liftoff function bails out after generating some constant pool,
this avoids to trigger a check in the Assembler destructor.

Bug: v8:6600

Change-Id: I79c595605bc0add1f3f5617ac7feedf162081d8a
Reviewed-on: https://chromium-review.googlesource.com/1026647
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Vincent Belliard <vincent.belliard@arm.com>
Cr-Commit-Position: refs/heads/master@{#52815}
2018-04-26 14:35:30 +00:00
Ivica Bogosavljevic
b8166b34fd MIPS[64]: Fix call to PrepareCallCFunction in liftoff
In liftoff, call to PrepareCallCFunction was using at as scratch
register. This is a very bad idea, since at is later used in
underlying macro assembler

TEST=cctest/test-run-wasm-64/RunWasmLiftoff_Regression_6858

Change-Id: Ifbc43678731d2833d2faa2f20fe79ea9e3089002
Reviewed-on: https://chromium-review.googlesource.com/1030430
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52814}
2018-04-26 13:50:42 +00:00
jgruber
a9da85e7c8 Revert "[builtins] Introduce further constant & external reference indirections"
This reverts commit f5d308510a.

Breakages:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/20370
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/21174

TBR=yangguo@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Change-Id: Ic4d28fccf647aadcac0a60430b7fb66d22ce4577
Reviewed-on: https://chromium-review.googlesource.com/1030431
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52813}
2018-04-26 13:42:53 +00:00
jgruber
5958788c1a Fix intl builtins in IsIsolateIndependent predicate
Intl builtins must stay behind V8_INTL_SUPPORT.

This fixes:
ci.chromium.org/buildbot/client.v8.ports/V8%20Mips%20-%20builder/16733

TBR=yangguo@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Change-Id: I001df26585e376c6e242ece88612e10417529037
Reviewed-on: https://chromium-review.googlesource.com/1030272
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52811}
2018-04-26 13:15:33 +00:00
jgruber
f5d308510a [builtins] Introduce further constant & external reference indirections
This introduces further indirections for embedded constants and
external references for builtins generated by the macro-assembler.
The used mechanisms (LookupConstant and LookupExternalReference) are
identical to what we already use in CSA.

Almost all builtins are now isolate-independent in both release and
debug modes. snapshot_blob.bin is roughly 670K smaller in embedded
builds vs. non-embedded builds, while libv8.so is roughly 280K larger.

Bug: v8:6666
Change-Id: I7a6c2193ef5a763e6cf7543dd51597d6fff6c110
Reviewed-on: https://chromium-review.googlesource.com/1006581
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52810}
2018-04-26 13:01:41 +00:00
jgruber
27ed807156 Open a HandleScope before NearHeapLimitCallback
This should fix the recent frequent pause-on-oom failures.
The callback attempted to create a handle without a HandleScope.

Bug: v8:7631
Change-Id: Id15ba287896d62d3205585d14204f0c92a8823f8
Reviewed-on: https://chromium-review.googlesource.com/1030211
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52809}
2018-04-26 12:37:11 +00:00
Stephan Herhut
48d508cb45 [wasm] Add I32AtomicCompareExchange to interpreter
This adds support for the I32AtomicCompareExchange operations in the
interpreter. Also, the interpreter will now fail if it encounters
an unknown opcode from the atomic prefix.

Bug: chromium:826069
Change-Id: Iec1742271f4fdd83fcaa09ca72c24d1cf8c58835
Reviewed-on: https://chromium-review.googlesource.com/1029867
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52807}
2018-04-26 12:02:11 +00:00
sreten.kovacevic
19896840c7 [Liftoff][mips] Implement f32/f64 to i32/u32 conversion
Implement float to i32/u32 conversion on mips. Also, fix order
of arguments in some macro-assembler instructions used for these
conversions.

Bug: v8:6600
Change-Id: I94c91f8ac7796ac66fb3cf0129a2a27c1a6ec336
Reviewed-on: https://chromium-review.googlesource.com/1028232
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52806}
2018-04-26 10:10:51 +00:00
Camillo Bruni
46e0a8bf0a [printing] Improve DescriptorArray printing
- display enum cache
- display capacity

Change-Id: I79eed54af36b1fbb5435d96b650c0823be380e20
Reviewed-on: https://chromium-review.googlesource.com/1027874
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52804}
2018-04-26 09:06:58 +00:00
Clemens Hammacher
bff2672a53 [Liftoff] Implement f32.min and f32.max
This adds support for f32.min and f32.max, implemented on ia32, x64,
mips and mips64.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: If73abf3cf46011ba84158ed2ec02d074adcf4ba2
Reviewed-on: https://chromium-review.googlesource.com/1027841
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52803}
2018-04-26 09:05:18 +00:00
Stephan Herhut
0380b69af5 Allow use of ordinary shared array buffer in wasm threads
For wasm memory buffers, we normally require the memory to be allocated
via WebAssembly.Memory, which will set a is_wasm_memory flag and
register the memory with the wasm allocation tracker. This CL weakens
that requirement in a DCHECK to allow for running experimental threaded
applications even though the is_wasm_memory flag is not currently
propagated via postMessage.

Bug: chromium:836800
Change-Id: I4613b8651423307ce4cd466c0df28fc43244ec4f
Reviewed-on: https://chromium-review.googlesource.com/1027813
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52801}
2018-04-26 07:36:56 +00:00
Michael Achenbach
694a61fa5f Revert "[inspector] added timeout for Debugger.evaluateOnCallFrame method"
This reverts commit 436faae044.

Reason for revert: Introduces flakes:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/24482
https://build.chromium.org/p/client.v8/builders/V8%20Win32/builds/13557
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/25210

Original change's description:
> [inspector] added timeout for Debugger.evaluateOnCallFrame method
> 
> R=​dgozman@chromium.org,yangguo@chromium.org
> 
> Bug: none
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: I569899f245190ca2fa720bdb837db1263e8058d5
> Reviewed-on: https://chromium-review.googlesource.com/1023035
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52798}

TBR=dgozman@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org

Change-Id: I63ee0d19642856a7c0c2128bfa4c4620974d1919
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: none
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/1029910
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52800}
2018-04-26 07:22:45 +00:00
Sigurd Schneider
63b46569b8 [turbofan] Move Number.parseInt to JSCallReducer
This CL also removes the JSBuiltinReducer, which is no longer needed.

Bug: v8:7340, v8:7250
Change-Id: I28896f6ce0d352047ea1cb7ea6de490818840faf
Reviewed-on: https://chromium-review.googlesource.com/1027853
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52799}
2018-04-26 07:06:24 +00:00
Alexey Kozyatinskiy
436faae044 [inspector] added timeout for Debugger.evaluateOnCallFrame method
R=dgozman@chromium.org,yangguo@chromium.org

Bug: none
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I569899f245190ca2fa720bdb837db1263e8058d5
Reviewed-on: https://chromium-review.googlesource.com/1023035
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52798}
2018-04-25 21:33:51 +00:00
Jungshik Shin
f2974002ec TimeClip before formatting in Intl.DateTimeFormat
https://github.com/tc39/ecma402/pull/194 requires that
TimeClip be called before formatting in Intl.DateTimeFormat.

Bug: v8:7471
Test: test262/intl402/DateTimeFormat/prototype/format/time-clip*
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Iad80376ae7598aab3e4df84a6cbbcd8691e16e09
Reviewed-on: https://chromium-review.googlesource.com/1027442
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52796}
2018-04-25 20:17:29 +00:00
Aleksey Kozyatinskiy
9a7c4bfe1e Revert "[elements] Improve Array.prototype.splice speed"
This reverts commit dcdabdc86a.

Reason for revert: broke tsan.

Original change's description:
> [elements] Improve Array.prototype.splice speed
> 
> By using memmove for SMI elements we get a roughly 3x speedup over the slower
> iterative copying with write barriers.
> 
> Bug: chromium:835558
> Change-Id: I73da07a1648a3495ff78212ffa1ed949d205a7d2
> Reviewed-on: https://chromium-review.googlesource.com/1028236
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52792}

TBR=cbruni@chromium.org,ishell@chromium.org

Change-Id: I77c46fe3d47d651de3c39df9fbf5f30c340188e2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:835558
Reviewed-on: https://chromium-review.googlesource.com/1028337
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52795}
2018-04-25 19:46:50 +00:00
Ben Smith
9166affb29 [wasm] Implement importing mutable globals
The WasmInstanceObject stores two new arrays:

- imported_mutable_globals_buffers_: a FixedArray of all the imported
  globals' array buffers.
- imported_mutable_globals: a calloc'd array of Addresses pointing to
  the mutable global in its array buffer.

When accessing the global, the generated code looks up the address in
imported_mutable_globals to find where to load/store.

Bug: v8:7625
Change-Id: I60844c21a788fce28f346455f10f2283d1c152e9
Reviewed-on: https://chromium-review.googlesource.com/1020602
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52794}
2018-04-25 18:57:48 +00:00
Alexey Kozyatinskiy
e81b0db787 [runtime] added v8::Isolate::SafeForTerminationScope and isolate flag
When only_terminate_in_safe_scope flag is passed as CreateParams for
v8::Isolate, V8 does not trigger intrruption for termination if there
is no explicit SafeForTerminationeScope.
Scope enables termination only in direct v8 calls, any recursive calls
require explicit SafeForTerminationScope.

R=yangguo@chromium.org

Bug: chromium:820640
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Iac17e30a4b47aa84e70e9218ca0adca9d07f726e
Reviewed-on: https://chromium-review.googlesource.com/1025390
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52793}
2018-04-25 18:11:58 +00:00
Camillo Bruni
dcdabdc86a [elements] Improve Array.prototype.splice speed
By using memmove for SMI elements we get a roughly 3x speedup over the slower
iterative copying with write barriers.

Bug: chromium:835558
Change-Id: I73da07a1648a3495ff78212ffa1ed949d205a7d2
Reviewed-on: https://chromium-review.googlesource.com/1028236
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52792}
2018-04-25 17:41:31 +00:00
Camillo Bruni
a3142476ba [runtime] Do not refer directly to the closure stored in the context
This is is a preparatory CL to detach the JSFunction from the Context.
We mainly rewrite the DebugScopeInterator to no longer rely on the a
JSFunction to be around. Additionally the empty_function needs to have
a proper ScopeInfo now.

Drive-by-fix: Improve ScopeInfo debug printing

Bug: v8:7066
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I2f2fa0e78914a12e076384e0e1234c2322ad1ee8
Reviewed-on: https://chromium-review.googlesource.com/918721
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52791}
2018-04-25 17:24:02 +00:00
Camillo Bruni
e570e67383 [heap][elements] Improve Array.prototype.splice speed
- 30% speedup by adding HeapObject shortcut for Heap::InNewSpace

Bug: chromium:835558
Change-Id: I48b5ec43a5ecdd7d82827c955ab418fdeff449d8
Reviewed-on: https://chromium-review.googlesource.com/1027471
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52790}
2018-04-25 17:00:46 +00:00
Ben Smith
6a50560650 [wasm] Implement WebAssembly.Global import/export
The mutable-globals proposal spec allows importing as Numbers or
WebAssembly.Global values, but always exports as WebAssembly.Global.

Since the value is always boxed, we can also import/export i64 values.

This CL also includes support for export of mutable globals. Since the
underlying ArrayBuffer that stores the global's value is shared between
the module and the WebAssembly.Global object, all that needs to be done
is remove the validation check.

Bug: v8:7625
Change-Id: I24d763e3bc193d229a7cc33b2f2690a473c6f2bc
Reviewed-on: https://chromium-review.googlesource.com/1018406
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52789}
2018-04-25 16:54:06 +00:00
Kim-Anh Tran
5ef33ea5a2 [wasm] Update counters after tier-up
Statistics need to be updated after top-tier code is added to
the native module.

Change-Id: Ie3a76caf233a2c3929b40fd0371c3069724b5289
Reviewed-on: https://chromium-review.googlesource.com/1027854
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@google.com>
Cr-Commit-Position: refs/heads/master@{#52787}
2018-04-25 15:30:02 +00:00
Camillo Bruni
76cab5ff78 Fix Object.entries/.values with non-enumerable properties
Iterate over all descriptors instead of bailing out early and missing
enumerable properties later.

Bug: chromium:836145
Change-Id: I104f7ea89480383b6b4b9204942a166bdf8e0597
Reviewed-on: https://chromium-review.googlesource.com/1027832
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52786}
2018-04-25 13:44:32 +00:00
Clemens Hammacher
52f07582e0 [Liftoff] Implement i64 division and remainder
This adds support for i64.div_s, i64.div_u, i64.rem_s, and i64.rem_u.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I37e564684b278c8d2f664a859851c67f4bd83190
Reviewed-on: https://chromium-review.googlesource.com/1027612
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52785}
2018-04-25 12:59:11 +00:00
Clemens Hammacher
7f78e75a72 [Liftoff] Implement the select opcode
R=ahaas@chromium.org

Bug: v8:6600
Change-Id: Iaa46324dfcf3b20f42d6a7448fca9ef2bbf241e9
Reviewed-on: https://chromium-review.googlesource.com/1027851
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52784}
2018-04-25 12:41:06 +00:00
Predrag Rudic
8a712b007c MIPS [Liftoff] Add missing case for Load
Change-Id: Ide0b3cab6c1cdb6cbb1b189852b309e08c1c504f
Reviewed-on: https://chromium-review.googlesource.com/1028010
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52783}
2018-04-25 12:31:31 +00:00
Sigurd Schneider
6435107583 [turbofan] Move Date.now/Date.p.getTime to JSCallReducer
This CL also introduces an effect dependent simplified operator
DateNow and associated lowerings.

Bug: v8:7340, v8:7250
Change-Id: Icd4a8c3c45a8dbe7ef490fc3ee68c0c68bbed011
Reviewed-on: https://chromium-review.googlesource.com/1024836
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52782}
2018-04-25 12:06:01 +00:00
Kim-Anh Tran
074429a429 [wasm] Create runtime objects directly after compilation finishes
We want to ensure that all runtime objects are created as soon as
compilation finishes. Instead of scheduling another foreground thread
to create these runtime objects, we now call it directly from the already
executing foreground thread.

Change-Id: I9e8f47dba237de16e0bac119f1649496c8525b37
Reviewed-on: https://chromium-review.googlesource.com/1027712
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Kim-Anh Tran <kimanh@google.com>
Cr-Commit-Position: refs/heads/master@{#52779}
2018-04-25 11:48:51 +00:00
Andreas Haas
2a3c2c73d5 Reland: [refactoring] Remove the isolate from signatures of ExternalReferences
I missed one required change which was hidden behind an #if. The fix is in
the diff between Patch 1 and Patch 3.

Original message:
In this CL I remove the isolate from signatures of ExternalReference
accessor functions where the isolate is not used. The uses of the
isolate were already removed in previous CLs.

Changes:
* I split the ExternalReference list in external-reference.h into
those which need the isolate for initialization and those which do not.

* I removed the public constructors and replaced them by
  ExternalReference::Create(). The reason is to separate external
  creation more clearly from internal creation, because externally
  created ExternalReferences sometimes need redirection, whereas
  internally created ExternalReferences are just stored as they are.
  In addition, by removing the isolate from the signature of the
  public constructors, they suddenly exactly matched the interal
  constructor.

* Replace all uses of the public constructors with
  ExternalReference::Create().

* Remove the isolate from all call sites where necessary.


This is a step towards making WebAssembly compilation independent of
the isolate.

R=mstarzinger@chromium.org

Bug: v8:7570
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I750c162f5d58ed32e866722b0db920f8b9bd8057
Reviewed-on: https://chromium-review.googlesource.com/1026673
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52777}
2018-04-25 09:47:30 +00:00
Simon Zünd
3ea1ad234c [typedarray] Implement TypedArray.p.sort using Torque.
This CL implements TypedArray.p.sort in Torque. The Torque
version works basically the same as the existing JS builtin:

When no comparison function is provided, the C++ fast path builtin
is used. Otherwise a quicksort written in Torque is used, with
a InsertionSort fallback for smaller arrays.

The JS quicksort implementation also containes a more elaborate
third pivot calculation for larger arrays. This is currently not done.

Reported benchmark results are only for those, where a custom
comparison function is provided. The numbers for the C++ path stayed
the same.

Benchmark   Current (JS)       Torque    Speedup

IntTypes            83.9        263.7        3.1
BigIntTypes         32.1         54.6        1.7
FloatTypes          99.3        138.7        1.4

R=danno@chromium.org, jgruber@chromium.org

Bug: v8:7382
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I7abe7ceff525bab24f302d2f06b5961cca770d24
Reviewed-on: https://chromium-review.googlesource.com/1021691
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52776}
2018-04-25 09:03:40 +00:00