Commit Graph

30081 Commits

Author SHA1 Message Date
franzih
1d7122beac [fullcodegen] Remove deprecated support for computed property names.
This code is no longer used in full-codegen since all computed property
names in object literals go through Ignition first.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2543643002
Cr-Commit-Position: refs/heads/master@{#41405}
2016-12-01 05:52:05 +00:00
bradnelson
00ec48335e [wasm] [asm.js] Ignore unused function tables in AsmWasmBuilder.
Incremental parsing of asm.js means we can see function tables that
are unused in the AsmWasmBuilder before they've been initialized.

BUG=669899
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2546553002
Cr-Commit-Position: refs/heads/master@{#41403}
2016-12-01 02:27:30 +00:00
kozyatinskiy
891e31241c [inspector] fixed Debugger.getPossibleBreakpoints
If we just call CreateDebugInfo in GetPossibleBreakpoints then we won't call PrepareFunctionForBreakPoints and won't be able to step into this function or pause at breakpoint inside.

BUG=v8:5695
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2540943002
Cr-Commit-Position: refs/heads/master@{#41401}
2016-12-01 00:26:37 +00:00
eholk
bf35d15e52 [wasm] OOB traps: build protected instruction list during codegen
During codegen, we build a list mapping protected instructions to their
associated landing pads. This will ultimately by used by the signal handler to
recover from out of bounds faults and throw a JS exception.

This is mostly pulled from my larger in-progress CL at
https://codereview.chromium.org/2371833007/.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2500443004
Cr-Commit-Position: refs/heads/master@{#41400}
2016-11-30 22:32:03 +00:00
tebbi
9b20a7b7a3 [turbofan] fixed uninhabited type handling in ObjectState representation selection
R=jarin@chromium.org

BUG=v8:668517

Review-Url: https://codereview.chromium.org/2536353003
Cr-Commit-Position: refs/heads/master@{#41399}
2016-11-30 21:45:53 +00:00
eholk
4ab4bbe9b1 [wasm] Add ProtectedStore instruction
This is necessary for signal-based out of bounds handling in WebAssembly.

Adds a ProtectedStore instruction that is analogous to the previously added
ProtectedLoad instruction. Rather than using bounds checks, ProtectedStore emits
an out of line section of code that throws a JavaScript exception and provides
the necessary metadata for a signal handler to be able to find the out of line
code.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2516413003
Cr-Commit-Position: refs/heads/master@{#41398}
2016-11-30 19:51:53 +00:00
caitp
d4918463a9 [accessors] handle writable changing during ArrayLengthSetter
The "writable" property descriptor may legally change during the call to
AnythingToArrayLength(). This change needs to be honoured before calling
JSArray::SetLength(). The change is only honoured when the "length"
property was previously writable, so that changes during a call to
DefineOwnPropertyIgnoreAttributes() is ignored.

BUG=v8:5688
R=cbruni@chromium.org, verwaest@chromium.org, jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2543553002
Cr-Commit-Position: refs/heads/master@{#41396}
2016-11-30 19:13:51 +00:00
sampsong
a6b5abf854 S390: remove move before Mul32 for s390x
BUG=

R=jyan@ca.ibm.com,joransiu@ca.ibm.com,michael_dawson@ca.ibm.com,bjaideep@ca.ibm.com

Review-Url: https://codereview.chromium.org/2536203003
Cr-Commit-Position: refs/heads/master@{#41395}
2016-11-30 18:51:36 +00:00
caitp
77df8c67d9 [typedarrays] remove invalid optimization in NAMEConstructor()
Before, we were treating objects with the builtin ArrayValues iterator
method as array-like, where the iterator would iterate through to the
full length of the object.

This optimization was not sound, because it does not ensure that the
next method hasn't been modified. Even if it hasn't been modified,
it's entirely possible to be modified during iteration. Thus, this
optimization has been removed due to its observability.

BUG=v8:5699
R=littledan@chromium.org, cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2544503002
Cr-Commit-Position: refs/heads/master@{#41394}
2016-11-30 17:13:31 +00:00
leszeks
80b920124c Deprecate the BASE_EMBEDDED macro
This was causing more confusion than benefit, so we're removing it.

It's re-defined to empty for now, to avoid touching the ~100 files which
use it, we can remove it completely during a quiet period when it's less
likely to conflict with other work.

Review-Url: https://codereview.chromium.org/2535383005
Cr-Commit-Position: refs/heads/master@{#41393}
2016-11-30 16:31:05 +00:00
neis
9ef7ab1e2e [compiler] Remove context value input from JSLoadContext and JSStoreContext.
JS operators always have an implicit context input, so just use that instead.

BUG=

Review-Url: https://codereview.chromium.org/2541813002
Cr-Commit-Position: refs/heads/master@{#41392}
2016-11-30 15:46:08 +00:00
ulan
ec90ccb5ab [heap] Bump up old generation limit for huge memory devices.
This is an experiment to see the impact of the limit on OOM crashes.

BUG=chromium:667388

Review-Url: https://codereview.chromium.org/2514313004
Cr-Commit-Position: refs/heads/master@{#41391}
2016-11-30 15:25:26 +00:00
ishell
c819616376 [ic] Prevent KeyedStoreIC from being generic when storing doubles to integer typed arrays.
BUG=chromium:666947

Review-Url: https://codereview.chromium.org/2539013002
Cr-Commit-Position: refs/heads/master@{#41390}
2016-11-30 15:24:13 +00:00
jarin
e19f43df61 [crankshaft] Disable escape analysis of nested objects.
BUG=chromium:669024

Review-Url: https://codereview.chromium.org/2531163006
Cr-Commit-Position: refs/heads/master@{#41389}
2016-11-30 15:07:16 +00:00
clemensh
6572b5622e [wasm] Remove raw byte pointers from WasmModule
These byte pointers (module_start and module_end) were only valid
during decoding. During instantiation or execution, they can get
invalidated by garbage collection.
This CL removes them from the WasmModule struct, and introduces a new
ModuleStorage struct as interface to the wasm wire bytes.
Since the storage is often needed together with the ModuleEnv, a new
ModuleStorageEnv struct holds both a ModuleEnv and a ModuleStorage.
The pointers in the ModuleStorage should never escape the live range of
this struct, as they might point into a SeqOneByteString or ArrayBuffer.
Therefore, the WasmInterpreter needs to create its own copy of the
whole module.
Runtime functions that previously used the raw pointers in WasmModule
(leading to memory errors) now have to use the SeqOneByteString in the
WasmCompiledModule.

R=titzer@chromium.org
BUG=chromium:669518

Review-Url: https://codereview.chromium.org/2540133002
Cr-Commit-Position: refs/heads/master@{#41388}
2016-11-30 15:03:06 +00:00
rmcilroy
6d90507a7c [Turbofan] Disable JSFrameSpecialization for interpreted frames.
JSFrameSpecialization depends on the layout of the frame and doesn't work
with interpreted frames. Disable it since it is only used for OSR from asmjs code, which shouldn't go through the bytecode graph builder in many cases.

BUG=669517

Review-Url: https://codereview.chromium.org/2538823002
Cr-Commit-Position: refs/heads/master@{#41387}
2016-11-30 14:03:51 +00:00
jochen
a1473f5306 Split parsing of functions and top-level code into two separate methods
Also move them to a separate interface header to avoid having to include
parser.h so much

BUG=v8:5589
R=verwaest@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2534393002
Cr-Commit-Position: refs/heads/master@{#41386}
2016-11-30 13:21:37 +00:00
shiyu.zhang
86af70afb0 [turbofan] Remove redundant cmp operands swap.
Remove redundant operands swap for compare operation.

BUG=

Review-Url: https://codereview.chromium.org/2507683002
Cr-Commit-Position: refs/heads/master@{#41385}
2016-11-30 12:32:57 +00:00
hpayer
9d1488e4b0 [heap] Reduce store buffer size to increase chance to run concurrent store buffer processing thread more often.
BUG=

Review-Url: https://codereview.chromium.org/2529623002
Cr-Commit-Position: refs/heads/master@{#41383}
2016-11-30 12:17:28 +00:00
ahaas
4d75ea6082 [wasm] Move wasm runtime functions to runtime-wasm.cc
I removed {IsWasmInstance} because it is not used anywhere, and I moved
ThrowWasmError to runtime-wasm.cc

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2541633003
Cr-Commit-Position: refs/heads/master@{#41382}
2016-11-30 10:37:17 +00:00
titzer
a0c518627f [wasm] Add a flag --wasm-opt to test optimizations in the WASM pipeline.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2528033002
Cr-Commit-Position: refs/heads/master@{#41381}
2016-11-30 10:36:14 +00:00
neis
000dea2fa4 [compiler] Remove dead code from js-generic-lowering.
JSLoadContext and JSStoreContext are always reduced in js-typed-lowering.

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2535253002
Cr-Commit-Position: refs/heads/master@{#41380}
2016-11-30 10:14:17 +00:00
clemensh
5a6483ffda [inspector] Avoid unneeded heap allocations
v8::Global is movable, so no need to heap-allocate them.

R=yangguo@chromium.org, kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2537433002
Cr-Commit-Position: refs/heads/master@{#41379}
2016-11-30 09:23:34 +00:00
zhengxing.li
77a9da6b20 X87: [stubs] Port builtin for Array.push fast-case from Crankshaft to TF.
port df2578d2ec (r41368)

  original commit message:
  Improves performance in simple, single element case by 5% and in multiple
  elements cases by 2%.

BUG=

Review-Url: https://codereview.chromium.org/2540803004
Cr-Commit-Position: refs/heads/master@{#41377}
2016-11-30 09:07:15 +00:00
neis
ee8e1464d7 Check some more invariants on SFIs.
This adds consistency checks for function kind and scope type to
SharedFunctionInfoVerify.

It also fixes an inconsistency in the creation of a ScopeInfo.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2537093002
Cr-Commit-Position: refs/heads/master@{#41375}
2016-11-30 08:04:54 +00:00
neis
881bacffe3 [ast] Mark removed scopes as such.
When removing a scope (see FinalizeBlockScope), remember the removal by making
the scope its own sibling.  This avoid recalculating the information later on.

R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2536993003
Cr-Commit-Position: refs/heads/master@{#41374}
2016-11-30 07:59:56 +00:00
bradnelson
14e05c1046 [wasm] asm.js - Parse and convert asm.js to wasm a function at a time.
Make the AsmWasmBuilder drive the process of typing and potentially parsing
function bodies. This will allow us to keep only a single asm.js function's
AST in memory as we convert to WebAssembly.
This is needed to keep our memory footprint low.

Add some additional output to a few tests that's helpful to see which stage they fail at.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=marja@chromium.org,adamk@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2398023002
Cr-Commit-Position: refs/heads/master@{#41372}
2016-11-30 00:26:05 +00:00
kozyatinskiy
d385ed069b [inspector] removed old v8_inspector::Channel API
BUG=chromium:350797
R=dgozman@chromium.org
TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2527473004
Cr-Commit-Position: refs/heads/master@{#41371}
2016-11-29 19:31:23 +00:00
bjaideep
f80961a782 PPC/s390: [stubs] Port builtin for Array.push fast-case from Crankshaft to TF
Port df2578d2ec

Original Commit Message:

    Improves performance in simple, single element case by 5% and in multiple
    elements cases by 2%.

R=danno@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, bjaideep@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2537513005
Cr-Commit-Position: refs/heads/master@{#41370}
2016-11-29 18:48:20 +00:00
alph
9de556ecff [compiler] Bailout reason "Optimized too many times" -> "Deoptimized..."
Rename it to better represent the reason. Also makes the inspector sentence
"Not Optimized: Optimized too many times" look less confusing.

Review-Url: https://codereview.chromium.org/2530423003
Cr-Commit-Position: refs/heads/master@{#41369}
2016-11-29 17:18:44 +00:00
danno
df2578d2ec [stubs] Port builtin for Array.push fast-case from Crankshaft to TF
Improves performance in simple, single element case by 5% and in multiple
elements cases by 2%.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2497243002
Cr-Commit-Position: refs/heads/master@{#41368}
2016-11-29 16:58:30 +00:00
rmcilroy
f8b8983962 [Compiler] Don't mark asm-wasm functions for optimization in PostInstantiation.
Functions with asm-wasm data shouldn't be marked for optimization, since
they will be optimized using the asm-wasm data instead.

Review-Url: https://codereview.chromium.org/2537103002
Cr-Commit-Position: refs/heads/master@{#41367}
2016-11-29 16:42:02 +00:00
rmcilroy
5e8b2b8077 [Interpreter] Small cleanup on VisitClassLiteral
Review-Url: https://codereview.chromium.org/2534123003
Cr-Commit-Position: refs/heads/master@{#41366}
2016-11-29 16:09:38 +00:00
mstarzinger
957f3f10e5 [fullcodegen] Remove with-statement support.
This removes support for dynamic scoping via with-statement constructs
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=rmcilroy@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2533283002
Cr-Commit-Position: refs/heads/master@{#41365}
2016-11-29 15:29:07 +00:00
vogelheim
c44008b01f Ensure consistent error handling on 32b/64b platforms.
BUG=chromium:669017

Review-Url: https://codereview.chromium.org/2536783003
Cr-Commit-Position: refs/heads/master@{#41364}
2016-11-29 15:06:05 +00:00
clemensh
8fcfe66f94 [base] Pass scalar arguments by value in CHECK/DCHECK
This not only potentially improves performance, but also avoids weird
linker errors, like the one below, where I used Smi::kMinValue in a
DCHECK_LE.

> [421/649] LINK ./mksnapshot
> FAILED: mksnapshot
> src/base/logging.h|178| error: undefined reference to
  'v8::internal::Smi::kMinValue'

R=bmeurer@chromium.org, ishell@chromium.org

Committed: https://crrev.com/76723502528c5af003fdffc3520632ea2a13fef3
Review-Url: https://codereview.chromium.org/2524093002
Cr-Original-Commit-Position: refs/heads/master@{#41273}
Cr-Commit-Position: refs/heads/master@{#41363}
2016-11-29 15:02:26 +00:00
leszeks
9b5962720a [turbofan] Keep the next bytecode liveness when analysing
Since the majority of bytecodes have a next instruction, and we iterate
over the bytecodes backwards, we can keep the previous seen (i.e.
sequentially next) bytecode's liveness on a variable instead of looking
it up again.

Review-Url: https://codereview.chromium.org/2541463002
Cr-Commit-Position: refs/heads/master@{#41361}
2016-11-29 14:12:37 +00:00
bmeurer
4047361ab4 [turbofan] Disable loop peeling for asm.js.
BUG=chromium:669494
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2533303002
Cr-Commit-Position: refs/heads/master@{#41360}
2016-11-29 14:06:04 +00:00
bmeurer
d6752d94a8 [turbofan] Teach escape analysis about ConvertTaggedHoleToUndefined.
The EscapeStatusAnalysis didn't know anything about the simplified
operator ConvertTaggedHoleToUndefined, thus leading to a crash. We
now just handled it by pretending that any allocation that goes into
such a node escapes.

BUG=chromium:669451
R=tebbi@chromium.org

Review-Url: https://codereview.chromium.org/2533263002
Cr-Commit-Position: refs/heads/master@{#41359}
2016-11-29 13:13:55 +00:00
mstarzinger
d045f41c5c [ast] Remove unused BailoutIds for ClassLiteral.
This removes reservation of unused {BailoutId} numbers for all class
literals. These language constructs are by now solely funneled through
bytecode and specific ids for deoptimization are no longer needed.

R=rmcilroy@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2535223002
Cr-Commit-Position: refs/heads/master@{#41358}
2016-11-29 12:51:32 +00:00
mstarzinger
88320112d3 [fullcodegen] Remove for-of iteration support.
This removes support for iterator loops (i.e. for-of loop constructs)
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=bmeurer@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2534883004
Cr-Commit-Position: refs/heads/master@{#41357}
2016-11-29 12:37:14 +00:00
rmcilroy
067e9e295f [Interpreter] Add bytecode aging and use it enable CompilationCache for bytecode
Adds a bytecode_age field to BytecodeArray objects. This is incremented each
time the bytecode array is marked by GC, and reset to zero if the bytecode
is executed.

This is used to enable the CompilationCache for interpreted functions,
where Interpreted entries are evicted once the bytecode becomes old.

BUG=chromium:666275,v8:4680

Review-Url: https://codereview.chromium.org/2534763003
Cr-Commit-Position: refs/heads/master@{#41356}
2016-11-29 12:34:58 +00:00
leszeks
2bf71f888f [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41355}
2016-11-29 12:27:15 +00:00
rmcilroy
5fd2b71236 [Heap] Remove concept of MarkingParity.
MarkingParity was used to avoid performing an operation on an object if it was
marked multiple times. We no longer mark things multiple times, so this concept
is no longer required.

BUG=chromium:666275

Review-Url: https://codereview.chromium.org/2529173002
Cr-Commit-Position: refs/heads/master@{#41354}
2016-11-29 12:10:16 +00:00
verwaest
73a2d63df8 [scopes] Propagate inner-scope-calls-eval to make sure we context allocate in inserted scopes
BUG=v8:5664

Review-Url: https://codereview.chromium.org/2536153002
Cr-Commit-Position: refs/heads/master@{#41353}
2016-11-29 12:01:34 +00:00
bmeurer
719d6c1d58 [turbofan] Also optimize instanceof with bound functions.
For bound functions on the right-hand side of instanceof we can
constant-fold to the actual [[BoundTargetFunction]], actually
instance OrdinaryHasInstance. Move the Function.prototype[@@hasInstance]
reduction up to the JSCallReducer to allow this optimization to become
effective (and also enable other optimizations).

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2537763002
Cr-Commit-Position: refs/heads/master@{#41352}
2016-11-29 11:58:55 +00:00
cbruni
95c0ecee66 [counters] Avoid V8_EXPORT_PRIVATE to speed up compilation under windows
BUG=chromium:668748

Review-Url: https://codereview.chromium.org/2534123002
Cr-Commit-Position: refs/heads/master@{#41351}
2016-11-29 11:57:30 +00:00
hpayer
f3d119b9c5 [heap] Reland: Use store buffer for writes coming from mutator.
This reverts commit 810fcb2866.

BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2530383003
Cr-Commit-Position: refs/heads/master@{#41350}
2016-11-29 11:57:29 +00:00
mstarzinger
204babf5a0 [deoptimizer] Fix deoptimization in {TranslatedState}.
This ensures the deoptimization triggered due to materialization of
objects by the {TranslatedState} works in conjunction with OSR. The
optimized code used for OSR is not installed on the function, hence
needs to be specified explicitly when requesting deoptimization for
specific stack frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-668795
BUG=chromium:668795

Review-Url: https://codereview.chromium.org/2534143002
Cr-Commit-Position: refs/heads/master@{#41348}
2016-11-29 11:34:22 +00:00
leszeks
a2e2a39ff1 Revert of [ignition/turbo] Perform liveness analysis on the bytecodes (patchset id:320001 of https://codereview.chromium.org/2523893003/ )
Reason for revert:
Breaks the build:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14886

Original issue's description:
> [ignition/turbo] Perform liveness analysis on the bytecodes
>
> Replaces the graph-based liveness analyzer in the bytecode graph builder
> with an initial bytecode-based liveness analysis pass, which is added to
> the existing loop extent analysis.
>
> Now the StateValues in the graph have their inputs initialised to
> optimized_out, rather than being modified after the graph is built.
>
> Committed: https://crrev.com/1852300954c216c29cf93444430681d213e87925
> Cr-Commit-Position: refs/heads/master@{#41344}

TBR=jarin@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2541443002
Cr-Commit-Position: refs/heads/master@{#41346}
2016-11-29 10:51:45 +00:00
bmeurer
777e142ca1 [turbofan] Add appropriate types to express Callable.
This introduces three new types OtherCallable, CallableProxy (and OtherProxy),
and BoundFunction to make it possible to express Callable in the Type system.
It also forces all undetectable receivers to be Callable, which matches the
use case for undetectable, namely document.all (guarded by proper checks and
tests).

It also uses these new types to properly optimize instanceof (indirectly via
OrdinaryHasInstance) based on the type of the constructor and the object. So
we are able to constant-fold certain instanceof expressions based on types
and completely avoid the builtin call.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2535753004
Cr-Commit-Position: refs/heads/master@{#41345}
2016-11-29 10:48:13 +00:00
leszeks
1852300954 [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41344}
2016-11-29 10:46:20 +00:00
cbruni
85321456cd [api] Support sharing prototypes between FunctionTemplates
FunctionTemplateInfo::SetPrototypeProviderTemplate adds support for sharing
prototypes between several function templates. This is used to properly set up
Image.prototype and HTMLImageElement.protoype which should be equal according
to the spec.

BUG=chromium:2969

Review-Url: https://codereview.chromium.org/2531653002
Cr-Commit-Position: refs/heads/master@{#41343}
2016-11-29 10:14:18 +00:00
machenbach
810fcb2866 Revert of [heap] Reland: Use store buffer for writes coming from mutator. (patchset id:1 of https://codereview.chromium.org/2529293004/ )
Reason for revert:
Suspect for tsan failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/12915

Original issue's description:
> [heap] Reland: Use store buffer for writes coming from mutator.
>
> This reverts commit 061c2ab23a.
>
> BUG=chromium:648568, chromium:669270
>
> Committed: https://crrev.com/fa2fdf275197185d9bca9d5e72c16a60722c3893
> Cr-Commit-Position: refs/heads/master@{#41341}

TBR=mlippautz@chromium.org,hpayer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2534803004
Cr-Commit-Position: refs/heads/master@{#41342}
2016-11-29 10:02:59 +00:00
hpayer
fa2fdf2751 [heap] Reland: Use store buffer for writes coming from mutator.
This reverts commit 061c2ab23a.

BUG=chromium:648568, chromium:669270

Review-Url: https://codereview.chromium.org/2529293004
Cr-Commit-Position: refs/heads/master@{#41341}
2016-11-29 09:32:41 +00:00
mstarzinger
7a82d8e9e4 [runtime] Simplify handler table lookup semantics.
The range-based exception handler table is by now only used for bytecode
arrays. The semantics of the interpreter are that bytecode offsets point
to the beginning of the currently executing bytecode instruction. Uses
hence need to compensate for lookups based on a "retrun address". This
change removes the need for such off-by-one compensations by changing
lookup semantics to be based on "current instruction" offsets.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2534893002
Cr-Commit-Position: refs/heads/master@{#41339}
2016-11-29 09:17:09 +00:00
jgruber
4e7571a5a9 [regexp] Migrate @@match to TurboFan
Microbenchmarks show a 4x improvement on the fast path and 2.5x improvement on
the slow path when compared to the CPP builtin implementation.

Compared to the old JS implementation, the fast path is 20% faster and the slow
path 35% slower.

BUG=v8:5339,v8:5562

Review-Url: https://codereview.chromium.org/2527963002
Cr-Commit-Position: refs/heads/master@{#41338}
2016-11-29 09:03:18 +00:00
machenbach
9c0e2a6723 Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain modificati… (patchset id:40001 of https://codereview.chromium.org/2534613002/ )
Reason for revert:
Layout test crashes:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11691

Original issue's description:
> [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
>
> ... instead of clearing of all the KeyedStoreICs which didn't always work.
>
> BUG=chromium:662907, v8:5561
> TBR=verwaest@chromium.org, bmeurer@chromium.org
>
> Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
> Cr-Commit-Position: refs/heads/master@{#41332}

TBR=jkummerow@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:662907, v8:5561

Review-Url: https://codereview.chromium.org/2538693002
Cr-Commit-Position: refs/heads/master@{#41337}
2016-11-29 08:49:48 +00:00
jgruber
1e3c5c90cd [regexp] Cache the correct initial prototype map
If the prototype's map is not marked as fast, it is made fast after
setup, breaking current RegExp fast path checks.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2537483002
Cr-Commit-Position: refs/heads/master@{#41336}
2016-11-29 07:41:44 +00:00
eostroukhov
18eda7024b [inspector] Use relative path to the third_party
BUG=none

Review-Url: https://codereview.chromium.org/2540463003
Cr-Commit-Position: refs/heads/master@{#41335}
2016-11-29 01:15:51 +00:00
kozyatinskiy
89d050c066 [inspector] use OS independent number to string conversion
V8 internally uses conversions.h to convert number to string, we can use these methods too instead of slow std::stringstream with std::locale.

BUG=chromium:661497,v8:5551
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2534013002
Cr-Commit-Position: refs/heads/master@{#41334}
2016-11-29 00:34:35 +00:00
henrique.ferreiro
bc1a3820c2 Implement DefineOwnProperty for TypedArrays
TypedArrays need specific checks before calling OrdinaryDefineOwnProperty.

BUG=v8:5328

Review-Url: https://codereview.chromium.org/2431223005
Cr-Commit-Position: refs/heads/master@{#41333}
2016-11-29 00:07:58 +00:00
ishell
a39522f44f [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2534613002
Cr-Commit-Position: refs/heads/master@{#41332}
2016-11-28 22:56:52 +00:00
jshin
2f5da9a551 Fix the uppercasing of U+00E7(ç) and U+00F7(÷)
Due to a typo in runtime-i18n.js, 'ç'(U+00E7) was not uppercased while
'÷'(U+00F7) was incorrectly uppercased to '×'(U+00D7).

Add a comprehensive test for Latin-1 supplemental block (U+00A0 ~ U+00FF).
(they're special-cased for speed-up and needs to have a test for the range.).

TEST=intl/general/case-mapping
BUG=v8:5681

Review-Url: https://codereview.chromium.org/2533033003
Cr-Commit-Position: refs/heads/master@{#41331}
2016-11-28 22:55:49 +00:00
ishell
60f18c7918 [heap] Assert that there's no recodred slot corresponding to unboxed double field.
BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539503002
Cr-Commit-Position: refs/heads/master@{#41330}
2016-11-28 22:25:08 +00:00
hpayer
385e806646 Use NoBarrier getters and setters for FixedArray.
BUG=chromium:648568

Review-Url: https://codereview.chromium.org/2537533002
Cr-Commit-Position: refs/heads/master@{#41328}
2016-11-28 20:21:50 +00:00
ishell
a814b8aeaf [heap] Clear recorded slots for inobject properties when migrating fast object to slow mode.
BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539493002
Cr-Commit-Position: refs/heads/master@{#41327}
2016-11-28 20:11:30 +00:00
ishell
6fdd480ed4 [printing] Print properties backing store value and add a gdb macro for printing LayoutDescriptors.
BUG=

Review-Url: https://codereview.chromium.org/2537523002
Cr-Commit-Position: refs/heads/master@{#41326}
2016-11-28 19:28:09 +00:00
rodolph.perfetta
1c1122978f [arm][arm64] deal with holey array in the Apply builtin.
BUG=

Review-Url: https://codereview.chromium.org/2537453003
Cr-Commit-Position: refs/heads/master@{#41325}
2016-11-28 18:26:34 +00:00
rmcilroy
12d821dd68 Revert of [turbofan] Utilize String comparison feedback. (patchset id:1 of https://codereview.chromium.org/2523463002/ )
Reason for revert:
Seems to regress speedometer on Ignition and doesn't cause any improvements elsewhere.

BUG=chromium:668651

Original issue's description:
> [turbofan] Utilize String comparison feedback.
>
> Make use of the previously introduced String feedback for compare
> operations in TurboFan.
>
> R=jarin@chromium.org
> BUG=v8:5267,v8:5400
>
> Committed: https://crrev.com/5d4253ecfb6ddcbbd7eb5654e728efa9559284a2
> Cr-Commit-Position: refs/heads/master@{#41163}

TBR=jarin@chromium.org,bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5267,v8:5400

Review-Url: https://codereview.chromium.org/2531183003
Cr-Commit-Position: refs/heads/master@{#41324}
2016-11-28 17:15:24 +00:00
mstarzinger
ac88607375 [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
Review-Url: https://codereview.chromium.org/2529343003
Cr-Original-Commit-Position: refs/heads/master@{#41318}
Cr-Commit-Position: refs/heads/master@{#41323}
2016-11-28 15:58:36 +00:00
tebbi
08931d45ba [parser] removed redundant undefined check of for-of iterator
Removed a redundant check: If completion is not normal, then #iterator cannot be undefined.

Review-Url: https://codereview.chromium.org/2533803002
Cr-Commit-Position: refs/heads/master@{#41321}
2016-11-28 15:30:17 +00:00
vogelheim
e0d608a2b1 Fix 'combo breaker' in CreateDynamicFunction to handle template literals.
BUG=chromium:663410

Review-Url: https://codereview.chromium.org/2533463002
Cr-Commit-Position: refs/heads/master@{#41320}
2016-11-28 14:44:13 +00:00
mstarzinger
54aac1f778 Revert of [deoptimizer] Remove dead Code::LookupRangeInHandlerTable. (patchset id:20001 of https://codereview.chromium.org/2529343003/ )
Reason for revert:
Seems to break TSAN builds.

https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/12897/steps/Check/logs/stack-traces

Original issue's description:
> [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
>
> This removes the supporting function to perform a range-lookup in the
> exception handler table for unoptimized code. Such tables are by now
> guaranteed to be empty, the deoptimizer cannot encounter this case.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
> Cr-Commit-Position: refs/heads/master@{#41318}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2536673002
Cr-Commit-Position: refs/heads/master@{#41319}
2016-11-28 14:07:40 +00:00
mstarzinger
1f27ed9d7d [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2529343003
Cr-Commit-Position: refs/heads/master@{#41318}
2016-11-28 13:25:20 +00:00
clemensh
916a53376a [wasm] Move asm.js offset table to compiled module
Before, the encoded variant was stored in the compiled module, and the
decoded one in the debug info (per instance).
The decoded table was a FixedArray of ByteArrays.
Now, also the decoded table is a flat ByteArray, and it encodes whether
it is encoded or decoded. This saves memory and allows to store encoded
and decoded variant in the same field. The table is automatically
decoded on the first use.

This CL also removes some unused and unimplemented methods from
WasmDebugInfo (probably merge artifacts). That class is now pretty much
empty, but we might still need it for breakpoint support.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2522953002
Cr-Commit-Position: refs/heads/master@{#41316}
2016-11-28 13:05:30 +00:00
jkummerow
c491489693 Reland of [cleanup] Refactor builtins-number.cc
Introducing a TF_BUILTIN macro that wraps CodeStubAssembler usage
into a convenient interface (using a subclass under the hood).

No changes since previous attempt; this was only reverted because it blocked another revert.
Original review: https://codereview.chromium.org/2517833005/

TBR=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2529373002
Cr-Commit-Position: refs/heads/master@{#41315}
2016-11-28 12:46:29 +00:00
jarin
72b5a0d40e [deoptimizer] Use the correct function for handler lookup for bytecode.
BUG=chromium:668760

Review-Url: https://codereview.chromium.org/2530403002
Cr-Commit-Position: refs/heads/master@{#41314}
2016-11-28 12:45:29 +00:00
petermarshall
0a1dcadd05 [fullcodegen] Remove deprecated support for super constructor calls.
All super constructor calls go through the ignition + turbofan pipeline, so this is dead code.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2525233003
Cr-Commit-Position: refs/heads/master@{#41313}
2016-11-28 12:24:08 +00:00
Jochen Eisinger
6c057947de Fix compilation in parser.cc
R=verwaest@chromium.org
TBR=marja@chromium.org, verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/2531233002 .

Cr-Commit-Position: refs/heads/master@{#41310}
2016-11-28 11:47:50 +00:00
jochen
cfebe6034c Assign unique IDs to FunctionLiterals
They're supposed to be stable across several parse passes, so we'll also
store them in the associated SharedFunctionInfos

To achieve this, the PreParser and Parser need to generated the same number of
FunctionLiterals. To achieve this, we teach the PreParser about desuggaring of
class literals.

For regular functions, the function IDs are assigned in the order they occur in
the source. For arrow functions, however, we only know that it's an arrow function
after parsing the parameter list, and so the ID assigned to the arrow function is
larger than the IDs assigned to functions defined in the parameter list. This
implies that we have to reset the function ID counter to before the parameter list
when re-parsing an arrow function. To be able to do this, we store the number of
function literals found in the parameter list of arrow functions as well.

BUG=v8:5589

Review-Url: https://codereview.chromium.org/2481163002
Cr-Commit-Position: refs/heads/master@{#41309}
2016-11-28 11:40:53 +00:00
marja
b31cbbd443 Parser: store parameters in a ThreadedList instead of ZoneList.
ThreadedList is more memory-efficient than ZoneList. This also enables
us to use ThreadedList when making Preparser track parameters (upcoming
work).

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2531593002
Cr-Commit-Position: refs/heads/master@{#41307}
2016-11-28 11:24:10 +00:00
jkummerow
0f48dc7cce Reland of [cleanup] CodeStubAssembler: s/compiler::Node/Node/
Reducing visual clutter.

No changes since previous attempt; this was only reverted because it blocked another revert.
Original review: https://codereview.chromium.org/2519093002/

TBR=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2532063002
Cr-Commit-Position: refs/heads/master@{#41306}
2016-11-28 11:22:20 +00:00
rmcilroy
195754cf31 [TurboFan] Always enable deoptimization for BytecodeGraphBuilder.
The BytecodeGraphBuilder assumes that deoptimization is always enabled,
so always enable it when compiling from bytecode.

BUG=chromium:668654

Review-Url: https://codereview.chromium.org/2531683004
Cr-Commit-Position: refs/heads/master@{#41303}
2016-11-28 10:29:52 +00:00
cbruni
a09e5eda26 [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS
A missing @@IsConcatSpreadable check caused the fast path inside the slow path
to be incorrect and follow the default concat strategy when the arguments
arrays contain only doubles.

BUG=chromium:668414

Review-Url: https://codereview.chromium.org/2527173002
Cr-Commit-Position: refs/heads/master@{#41301}
2016-11-28 10:06:17 +00:00
bmeurer
65fd9c4306 [fullcodegen] Remove deprecated support for new.target and rest parameters.
This code is no longer used by full-codegen since all functions which
use new.target, rest parameters or the internal this function binding
now grow through Ignition first, and never tier up to fullcodegen.

BUG=v8:5657
R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2528293002
Cr-Commit-Position: refs/heads/master@{#41298}
2016-11-28 08:59:51 +00:00
bmeurer
ffdf474956 [turbofan] Add more typing rules for Array.prototype builtins.
For a couple of those Array builtins we can specify a useful type that
will help us to eliminate a couple of checks on their outputs.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2529233002
Cr-Commit-Position: refs/heads/master@{#41295}
2016-11-28 08:01:26 +00:00
bmeurer
ae14b6b721 [turbofan] Assign types to remaining builtins on String.prototype.
Assign types to the remaining builtins on the String.prototype where we
know a meaningful type, i.e. where the type is not dependent on some
callable function that is pass or loaded.

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2532463002
Cr-Commit-Position: refs/heads/master@{#41294}
2016-11-27 19:20:39 +00:00
rmcilroy
f666bff8d6 [asm] Don't try to always-opt code which has AsmWasm data.
If code has AsmWasm data we shouldn't try to optimize the JS as well, since
it will instead be optimized using the WASM data.

BUG=

Review-Url: https://codereview.chromium.org/2534463003
Cr-Commit-Position: refs/heads/master@{#41293}
2016-11-26 04:47:01 +00:00
bbudge
ef3f125d37 [Turbofan] Add ARM support for simd128 moves and swaps.
- Adds vmov, vswp instructions for QwNeonRegisters.
- Refactors existing vswp implementation, moves non-Neon adaption to
MacroAssembler.
- Adds simd128 support to CodeGenerator AssembleMove, AssembleSwap.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2523933002
Cr-Commit-Position: refs/heads/master@{#41291}
2016-11-25 19:37:04 +00:00
hpayer
2d3d66ab64 [heap] Use safe way to obtain page in PagedSpace::Contains(Address addr).
Review-Url: https://codereview.chromium.org/2531873003
Cr-Commit-Position: refs/heads/master@{#41290}
2016-11-25 17:08:14 +00:00
mlippautz
ecea1d1911 [heap] StaticNewSpaceVisitor: Add UNREACHABLE handlers for pre-tenured types
BUG=

Review-Url: https://codereview.chromium.org/2529113002
Cr-Commit-Position: refs/heads/master@{#41289}
2016-11-25 16:14:21 +00:00
mlippautz
0e74286133 [heap] Replace NewSpacePageRange with PageRange
Trivial parts of the reverted CL:
  https://codereview.chromium.org/2516303006/

BUG=

Review-Url: https://codereview.chromium.org/2531093002
Cr-Commit-Position: refs/heads/master@{#41288}
2016-11-25 15:44:32 +00:00
hpayer
618e8bef70 [heap] Remove unused PagedSpace::FindObject().
Review-Url: https://codereview.chromium.org/2531073002
Cr-Commit-Position: refs/heads/master@{#41287}
2016-11-25 15:18:00 +00:00
marija.antic
daedefd3fc MIPS64: Port "Reland of "MIPS: Optimize load/store with large offset"".
Port 961a45da69

BUG=

Review-Url: https://codereview.chromium.org/2505923002
Cr-Commit-Position: refs/heads/master@{#41284}
2016-11-25 09:12:29 +00:00
yangguo
d5ada19ce7 [debug] mark more unused debug API as deprecated.
R=jgruber@chromium.org
BUG=v8:5510

Review-Url: https://codereview.chromium.org/2531543002
Cr-Commit-Position: refs/heads/master@{#41283}
2016-11-25 09:11:04 +00:00
rmcilroy
abf4c01d43 [fullcodegen] Remove deprecated support for class literals.
This code is no longer used in full-codegen or ast-graph-builder since all
functions which have class literals go through Ignition first.

BUG=v8:5657

Review-Url: https://codereview.chromium.org/2534463002
Cr-Commit-Position: refs/heads/master@{#41282}
2016-11-25 08:50:18 +00:00
jgruber
485067c66b [regexp] Add file-level typedefs to builtins-regexp.cc
This removes lots of boilerplate typedefs, with the caveat of renaming
CSA::Label and Variable to CLabel and CVariable within builtins-regexp.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2524363002
Cr-Commit-Position: refs/heads/master@{#41281}
2016-11-25 08:31:17 +00:00
yangguo
b6d2bacd66 Fix Number.prototype.toString with non-default radix wrt modulo.
TBR=tebbi@chromium.org
BUG=chromium:668510

Review-Url: https://codereview.chromium.org/2526223003
Cr-Commit-Position: refs/heads/master@{#41280}
2016-11-25 07:46:40 +00:00
mstarzinger
309b77f00d [fullcodegen] Remove exception handling support.
This removes support for try-catch as well as try-finally constructs
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=jarin@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2521233002
Cr-Commit-Position: refs/heads/master@{#41279}
2016-11-25 07:26:20 +00:00