Commit Graph

8956 Commits

Author SHA1 Message Date
martyn.capewell
7374e6dc89 [turbofan] Move MulHigh asr onto add on ARM64
Move the arithmetic shift from Int32MulHigh to a following Int32Add on ARM64.
This graph is commonly generated on reduction of signed integer division.

Review URL: https://codereview.chromium.org/1209413008

Cr-Commit-Position: refs/heads/master@{#29380}
2015-06-30 13:40:06 +00:00
hpayer
80b3f16951 Directly remove slot buffer entries in deoptimized code objects.
BUG=

Review URL: https://codereview.chromium.org/1221643004

Cr-Commit-Position: refs/heads/master@{#29379}
2015-06-30 13:32:13 +00:00
akos.palfi
b4275a70eb [turbofan] Add CalleeSavedFPRegisters to CallDescriptor.
This change makes possible to save and restore the FP registers
in the Prologue and Return parts for the CallAddress kind functions.

TEST=test-simplified-lowering/RunNumberDivide_2_TruncatingToUint32,
     test-simplified-lowering/RunNumberMultiply_TruncatingToUint32

Review URL: https://codereview.chromium.org/1191513003

Cr-Commit-Position: refs/heads/master@{#29378}
2015-06-30 13:22:50 +00:00
bmeurer
9dccfea020 [turbofan] Disable recursive inlining for now.
The deoptimizer (and probably various other places) cannot deal properly
with recursive function inlining, so we disallow it in TurboFan as well.
We might want to reconsider that decision at some point in the future.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1211243007

Cr-Commit-Position: refs/heads/master@{#29374}
2015-06-30 11:05:16 +00:00
mstarzinger
a7697bdcc7 Fix clobbered register when setting this_function variable.
Reland of https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1214483008

Cr-Commit-Position: refs/heads/master@{#29372}
2015-06-30 10:39:16 +00:00
ishell
b8cce79f41 A couple of other "stack overflow" vs. "has_pending_exception()" issues in debugger fixed.
BUG=chromium:505007
LOG=N

Review URL: https://codereview.chromium.org/1219693003

Cr-Commit-Position: refs/heads/master@{#29369}
2015-06-30 08:30:18 +00:00
yangguo
d7f8e611a5 Increase code space allowance for first page size.
This has become necessary as we have more experimental natives
that run after deserializing from the snapshot.

R=hpayer@chromium.org
BUG=v8:4200
LOG=N

Review URL: https://codereview.chromium.org/1218973002

Cr-Commit-Position: refs/heads/master@{#29367}
2015-06-30 07:48:34 +00:00
bmeurer
722e2e2b36 [turbofan] Remove unused constructor function matching from typer.
This optimization never triggers currently, and is inherently native
context dependent for no real reason (for example it will not properly
detect those constructors in the case of cross native context inlining),
plus it is slow and awkward.  In case we really need this functionality
at some point, we should find a way to make it work with the builtin
function id mechanism that is already in place to match other builtins.

R=jarin@chromium.org,rossberg@chromium.org

Review URL: https://codereview.chromium.org/1221683006

Cr-Commit-Position: refs/heads/master@{#29365}
2015-06-30 07:36:28 +00:00
mstarzinger
df06f1c715 [turbofan] Fix exit control flow in TryCatchBuilder.
This makes sure that the exit control flow that merges the try-block
with the catch-block after a try-catch-statement creates a new merge
node in cases where it has to. Otherwise dangling phi nodes might have
the wrong number of value inputs.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-505354
BUG=chromium:505354
LOG=N

Review URL: https://codereview.chromium.org/1213183003

Cr-Commit-Position: refs/heads/master@{#29362}
2015-06-30 03:23:41 +00:00
littledan
40d01b57d9 Mark SizeOfFirstPageIsLargeEnough failing on mips64
The failure was been triggered by turning on --harmony-arrays,
maybe because code size was increased or code was added later
in the bootstrap process. Because it doesn't look like a bug
in anything guarded by --harmony-arrays directly, I'd suggest
shipping the flag and disabling the test on the architectures
where it's been observed to fail. It's already disabled on arm64
and this patch disables it on mips64 as well.

BUG=v8:4200
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1212963004

Cr-Commit-Position: refs/heads/master@{#29361}
2015-06-30 00:44:52 +00:00
arv
b87cef133f [es6] Reenable new.target + Reflect.construct tests
BUG=v8:3887
LOG=N
R=caitpotter88@gmail.com, adamk@chromium.org

Review URL: https://codereview.chromium.org/1215973005

Cr-Commit-Position: refs/heads/master@{#29359}
2015-06-29 19:12:15 +00:00
arv
7a63bf77eb [es6] Make new.target work in functions
This makes new.target work in [[Call]] and [[Construct]] of ordinary
functions.

We achieve this by introducing a new construct stub for functions that
uses the new.target variable. The construct stub pushes the original
constructor just above the receiver in the construct frame.

BUG=v8:3887
LOG=N
R=adamk@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1203813002

Cr-Commit-Position: refs/heads/master@{#29358}
2015-06-29 18:29:34 +00:00
arv
473badf5fa [es6] Make sure we do not invoke setter when calling Promise.all
We were calling the setter for Object.prototype.promise if it existed
when calling PromiseAll.

BUG=v9:4232
LOG=N
R=rossberg@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1219623005

Cr-Commit-Position: refs/heads/master@{#29357}
2015-06-29 18:14:37 +00:00
paul.lind
ba08cc8c15 MIPS: skip embenchen/zlib test.
zlib is broken for mips after 35eb3a0260.

We're still working on a fix. Skip test for now, so the bots cycle green.

BUG=

Review URL: https://codereview.chromium.org/1209253005

Cr-Commit-Position: refs/heads/master@{#29356}
2015-06-29 17:25:12 +00:00
oth
cff8c9b933 Ensure mjsunit tests use dashes not underscores in flags directives.
BUG=chromium:505228
LOG=Y

Review URL: https://codereview.chromium.org/1219723002

Cr-Commit-Position: refs/heads/master@{#29355}
2015-06-29 17:08:18 +00:00
yangguo
972beef14c Parse eagerly inside block scopes.
Only this way we can precisely determine how to allocate let variables
inside the scope.

R=rossberg@chromium.org
BUG=v8:4255
LOG=N

Review URL: https://codereview.chromium.org/1216013002

Cr-Commit-Position: refs/heads/master@{#29354}
2015-06-29 16:16:21 +00:00
dusan.milosavljevic
0ca811f3dd MIPS: Update cctest status file for mips[be].
Enable skipped test-api/RequestInterruptTestWith* after:
https://codereview.chromium.org/1220443002/

TEST=
BUG=

Review URL: https://codereview.chromium.org/1219683004

Cr-Commit-Position: refs/heads/master@{#29353}
2015-06-29 16:11:17 +00:00
binji
e291b78a8e Fix cluster-fuzz found regression in d8 Workers.
This one occurs when Function.prototype.toString is overridden to return a
non-string.

BUG=chromium:504729
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1214803004

Cr-Commit-Position: refs/heads/master@{#29351}
2015-06-29 15:53:22 +00:00
binji
93c43523ea Fix cluster-fuzz found regression in d8 Workers.
Dumb typo introduced in refs/heads/master@{#29306}. I thought I was turning on
report_exceptions in Shell::ExecuteString, but instead I turned on print_result
(which assumes an interactive debugger and a HandleScope for the
utility_context_).

BUG=chromium:504727,chromium:504728
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1219563002

Cr-Commit-Position: refs/heads/master@{#29350}
2015-06-29 15:48:39 +00:00
oth
2b87cf56b4 Fix flag convention in handle count tests and comment.
BUG=505228
LOG=Y

Review URL: https://codereview.chromium.org/1210153003

Cr-Commit-Position: refs/heads/master@{#29346}
2015-06-29 13:40:48 +00:00
dslomov
b4f49586ab [destructuring] Re-index materialized literals in arrow function parameters.
R=wingo@igalia.com
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1212473002

Cr-Commit-Position: refs/heads/master@{#29337}
2015-06-26 21:39:53 +00:00
arv
353b40e980 [es6] Remove harmony-classes flag
Move class tests to es6 directory

BUG=v8:3330
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1213813003

Cr-Commit-Position: refs/heads/master@{#29336}
2015-06-26 21:16:58 +00:00
arv
47dd45c0ab [es6] Remove harmony-object-literal flag
And move tests to es6 directory

BUG=v8:3516
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1218473003

Cr-Commit-Position: refs/heads/master@{#29334}
2015-06-26 19:49:53 +00:00
Erik Arvidsson
3bdbb843b6 test262-es6: Add entry for asi test
The test language/asi/S7.9_A5.7_T1 is failing intermittently.

BUG=v8:4253
LOG=N
TBR=adamk

Review URL: https://codereview.chromium.org/1215813002.

Cr-Commit-Position: refs/heads/master@{#29332}
2015-06-26 19:33:24 +00:00
dusan.milosavljevic
448ec36491 MIPS: Fix unpredictable random failures after direct api function call.
The use of jalr ra is unpredictable if instruction in branch delay slot
is in next page.

This finally fixes random failures in JS debugger and InteruptRequest tests.

TEST=mjsunit/debug-*,
     cctest/test-api/RequestInterruptTestWithNativeAccessor
BUG=

Review URL: https://codereview.chromium.org/1220443002

Cr-Commit-Position: refs/heads/master@{#29331}
2015-06-26 16:54:12 +00:00
erikcorry
6ba8455e63 Put getter functions on Script line-endings objects
This is a step towards having Blink no longer look directly at the
line endings array.  That prevented https://codereview.chromium.org/1137683003/
from landing.  Next step, after the roll, will be using these
functions in Blink.
R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1213783002

Cr-Commit-Position: refs/heads/master@{#29330}
2015-06-26 14:59:07 +00:00
arv
240ea08905 Classify all test262-es6 failures
File bugs for all failing tests in test262-es6.

There are still some old "needs investigation" failures that I didn't
investigate.

BUG=N
LOG=N
R=littledan@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1209163002

Cr-Commit-Position: refs/heads/master@{#29329}
2015-06-26 14:39:36 +00:00
yangguo
8c72792b6d Mark function info as compiled after EnsureDeoptimizationSupport.
Note that prior to having canonical shared function infos, this has
been a source of duplicate shared function infos.

R=bmeurer@chromium.org
BUG=chromium:504787
LOG=N

Review URL: https://codereview.chromium.org/1209383002

Cr-Commit-Position: refs/heads/master@{#29326}
2015-06-26 13:17:05 +00:00
bmeurer
ce0431d665 [turbofan] Also update the BranchHint when merging a BooleanNot.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1218443002

Cr-Commit-Position: refs/heads/master@{#29324}
2015-06-26 12:08:26 +00:00
oth
af4c4b0427 Reland 'Additional HandleScopes to limit Handle consumption.'
v8 builds with --no-snap were hitting handle limits compiling natives for handle count unit tests that run with --check_handle_count. Patch now has higher handle limits (~4k more than required for failing natives compilation).

Original issue: https://codereview.chromium.org/1185633002/

Original issue's description:
    > Additional HandleScopes to limit Handle consumption.
    >
    > erikcorry@chromium.org suggested digging into v8 handle usage. Found potential scopes in ast.cc and runtime-literals.cc and added tests.
    >
    > The runtime-literals.cc change reduces peak handles in imaging-darkroom.js from 1,282,610 to 428,218. The ast.cc change reduces the peak handles in string-t
agcloud.js from 80,738 to 8,176.
    >
    > No significant handle count issues found with major websites, but substantial savings on some benchmarks and demos:
    >
    > Kraken's imaging-darkroom.js down from 1,282,610 to 428,218 due to runtime-literals.cc scope.
    > SunSpider's string-tagcloud.js down from 80,738 to 8.176 due to ast.cc
    >
    > http://www.flohofwoe.net/demos/dragons_asmjs.html (738,906 -> 478,296)
    > http://www.flohofwoe.net/demos/instancing_asmjs.html (737,884 -> 477,274)
    > https://dl.dropboxusercontent.com/u/16662598/Ports/DOSBox-web/doom.html?engine=dosbox-growth.js (1,724,114 -> 1,087,408)
    > https://kripken.github.io/ammo.js/examples/new/ammo.html (175,784 -> 142,058)
    >
    > BUG=
    >
    > Committed: https://crrev.com/3a4c7538839186aa38910c66c986abb563f4ccd2
    > Cr-Commit-Position: refs/heads/master@{#29155}

BUG=

Review URL: https://codereview.chromium.org/1192743005

Cr-Commit-Position: refs/heads/master@{#29322}
2015-06-26 10:58:23 +00:00
mstarzinger
317cb6538c [turbofan] Implement sharing of context-independent code.
This allows context-independent code generated by TurboFan to be cached
in the optimized code map and reused across native contexts. Note that
currently this cache is still flushed at GC time.

R=bmeurer@chromium.org,mvstanton@chromium.org
TEST=cctest/test-compiler/OptimizedCodeSharing

Review URL: https://codereview.chromium.org/1208013002

Cr-Commit-Position: refs/heads/master@{#29313}
2015-06-26 09:07:45 +00:00
bmeurer
7337021e54 [turbofan] Add support for pushing returns into merges.
This will enable tail call optimization even across inlining. Plus it
might enable some other interesting optimizations as well. In order to
avoid blowing up the generated code, we can still canonicalize the
epilogue in the CodeGenerator, similar to what fullcodegen does.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1215623002

Cr-Commit-Position: refs/heads/master@{#29311}
2015-06-26 08:21:01 +00:00
binji
28b0129b03 Fix cluster-fuzz regression when getting message from Worker
The issue is that Worker.prototype.terminate was deleting the C++ Worker
object, and then Worker.prototype.getMessage was trying to read messages from
the queue.

The simplest solution is to keep workers in a zombie state when they have been
terminated. They won't be reaped until Shell::CleanupWorkers is called.

I've also fixed some threading issues with Workers:

* Workers can be created by another Worker, so the Shell::workers_ variable
must be protected by a mutex.

* An individual Worker can typically only be accessed by the isolate that
created it, but the main thread can always terminate it, so the Worker::state_
must be accessed in a thread-safe way.

BUG=chromium:504136
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1208733002

Cr-Commit-Position: refs/heads/master@{#29306}
2015-06-25 18:01:22 +00:00
wingo
87fd436670 Better error message for eval=>42 in strict mode
BUG=v8:4213
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1210003003

Cr-Commit-Position: refs/heads/master@{#29299}
2015-06-25 16:17:21 +00:00
vogelheim
1d73a81ae0 Remove obsolete options in ScriptCompiler::CompileOptions.
This is a follow-on to https://code.google.com/p/v8/source/detail?r=22431
This will remove the compatibility logic, so that the API as described
in r22431 is the only API.

I'll let this CL will sit around for a while to give embedders a chance
to update their code.

R=yangguo@chromium.org, ulan@chromium.org
BUG=chromium:399580
LOG=Y

Review URL: https://codereview.chromium.org/392263002

Cr-Commit-Position: refs/heads/master@{#29294}
2015-06-25 14:03:56 +00:00
wingo
40b7d874b2 Reapply "Fix receiver when calling eval() bound by with scope"
Originally applied in https://codereview.chromium.org/1202963005

BUG=v8:4214
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
LOG=N
R=arv@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1208873002

Cr-Commit-Position: refs/heads/master@{#29293}
2015-06-25 13:46:46 +00:00
yangguo
6434ec3087 Reland 2 "Keep a canonical list of shared function infos."
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1211803002

Cr-Commit-Position: refs/heads/master@{#29291}
2015-06-25 12:20:06 +00:00
erikcorry
daef0ec5f4 Reland Extend big-disjunction optimization to case-independent regexps
Previous code review https://codereview.chromium.org/1182783009/
R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1204123003

Cr-Commit-Position: refs/heads/master@{#29290}
2015-06-25 11:42:20 +00:00
bmeurer
35eb3a0260 [turbofan] Optimize BooleanNot conditions to Branch nodes.
Also remove the weird work-around for this missing optimization in
CHECK_DATE in macros.py.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1205353002

Cr-Commit-Position: refs/heads/master@{#29288}
2015-06-25 11:07:09 +00:00
verwaest
210be5215d Let AddDictionaryElement / AddFastElement purely add, move transition heuristics to AddDataElement
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1194023004

Cr-Commit-Position: refs/heads/master@{#29287}
2015-06-25 10:49:02 +00:00
yangguo
f7ef0c9921 Revert of Reland "Keep a canonical list of shared function infos." (patchset #3 id:40001 of https://codereview.chromium.org/1211453002/)
Reason for revert:
proxies test failing https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/903/steps/Mjsunit/logs/proxies

Original issue's description:
> Reland "Keep a canonical list of shared function infos."
>
> This reverts commit 3164aa7483.
>
> Committed: https://crrev.com/cacb646d80daa429f6915824a741f595db7d5044
> Cr-Commit-Position: refs/heads/master@{#29282}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1206263002

Cr-Commit-Position: refs/heads/master@{#29285}
2015-06-25 10:35:12 +00:00
mstarzinger
8f6bca542f Remove overzealous checking of --cache-optimized-code flag.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1206803003

Cr-Commit-Position: refs/heads/master@{#29284}
2015-06-25 09:45:11 +00:00
yangguo
cacb646d80 Reland "Keep a canonical list of shared function infos."
This reverts commit 3164aa7483.

Review URL: https://codereview.chromium.org/1211453002

Cr-Commit-Position: refs/heads/master@{#29282}
2015-06-25 09:09:44 +00:00
Michael Stanton
c1a4f7477f [ic] Record call counts for monomorphic calls made with an IC.
The idea is that TurboFan can use this information for more intelligent
inlining.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1201193003

Cr-Commit-Position: refs/heads/master@{#29281}
2015-06-25 08:43:53 +00:00
Benedikt Meurer
a58ba8d801 [turbofan] Add basic support for calling to (a subset of) C functions.
This introduces some initial building blocks for calling out to
C/C++ functions directly from TurboFan generated code objects.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1205023002.

Cr-Commit-Position: refs/heads/master@{#29279}
2015-06-25 08:32:32 +00:00
bmeurer
5056c8219a [turbofan] Revive the useful parts of the SimplifiedOperatorReducer.
This partially reverts https://codereview.chromium.org/1162563002
because we might actually be able to optimize certain combinations
now due to dead code elimination.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1202263006

Cr-Commit-Position: refs/heads/master@{#29277}
2015-06-25 04:47:16 +00:00
arv
206cd93b5a JSON.stringify should handle the replacer before the space
BUG=v8:4227
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200373003

Cr-Commit-Position: refs/heads/master@{#29273}
2015-06-25 00:04:35 +00:00
arv
f4e39a8c1f Fix evaluation order of Object.prototype.hasOwnProperty
We need to do the ToName before the ToObject.

BUG=v8:4229
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1211663002

Cr-Commit-Position: refs/heads/master@{#29272}
2015-06-24 22:30:52 +00:00
arv
6e6a1c8aee JSON.stringify should use toString of replacer and not valueOf
If the replacer array contains a number wrapper we should use the
toString result and not valueOf.

BUG=v8:4228
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1207013002

Cr-Commit-Position: refs/heads/master@{#29270}
2015-06-24 22:18:08 +00:00
arv
51073d5f40 i18n.js was not using original functions
The i18n.js code was calling a lot of methods, which might have been
removed or replaced by user code.

Make sure we use the original functions.

BUG=v8:4220
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199813004

Cr-Commit-Position: refs/heads/master@{#29268}
2015-06-24 20:54:22 +00:00
machenbach
93d130ce70 Revert of Fix receiver when calling eval() bound by with scope (patchset #3 id:40001 of https://codereview.chromium.org/1202963005/)
Reason for revert:
[Sheriff] Breaks layout tests. Please fix upstream blink first.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/574

Please consider extra blink trybots on a reland.

Original issue's description:
> Fix receiver when calling eval() bound by with scope
>
> Thanks to André Bargull for the report.
>
> BUG=v8:4214
> LOG=N
> R=arv@chromium.org, mstarzinger@chromium.org
>
> Committed: https://crrev.com/3c5f0db3a1768ade68108bf003676ce378d1cbdc
> Cr-Commit-Position: refs/heads/master@{#29259}

TBR=arv@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4214

Review URL: https://codereview.chromium.org/1201273004

Cr-Commit-Position: refs/heads/master@{#29267}
2015-06-24 19:08:35 +00:00
machenbach
3eae40d7a4 Revert of Extend big-disjunction optimization to case-independent regexps (patchset #5 id:80001 of https://codereview.chromium.org/1182783009/)
Reason for revert:
[Sheriff] Test times out now on msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2947

Original issue's description:
> Extend big-disjunction optimization to case-independent regexps
>
> R=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/d2135603bcf462e15a1284d8ed969f6692610dda
> Cr-Commit-Position: refs/heads/master@{#29264}

TBR=yangguo@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1204013003

Cr-Commit-Position: refs/heads/master@{#29266}
2015-06-24 19:04:15 +00:00
binji
5023335b4d Fix cluster-fuzz regression with Workers and recursive serialization
Shell::SerializeValue was using a HandleScope, but was also storing Handles in
an ObjectList. The ObjectList handles would persist after the function had
returned, but will have already been destroyed by the HandleScope, so there is
a use-after-free.

This change removes the HandleScope in Shell::SerializeValue and relies on the
caller's HandleScope.

BUG=chromium:503968
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1211433003

Cr-Commit-Position: refs/heads/master@{#29265}
2015-06-24 18:31:50 +00:00
erikcorry
d2135603bc Extend big-disjunction optimization to case-independent regexps
R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1182783009

Cr-Commit-Position: refs/heads/master@{#29264}
2015-06-24 18:17:41 +00:00
binji
b3bd7289f7 Fix cluster-fuzz regression with Workers when serializing empty string
BUG=chromium:503991
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1210623002

Cr-Commit-Position: refs/heads/master@{#29263}
2015-06-24 17:47:23 +00:00
wingo
edcc242a44 Fix unexpected token messages in expression classifier
Some tokens need special messages because their token corresponds to
many names.

R=arv@chromium.org
BUG=v8:4213
LOG=N

Review URL: https://codereview.chromium.org/1207743004

Cr-Commit-Position: refs/heads/master@{#29262}
2015-06-24 17:25:25 +00:00
binji
627627b327 Fix cluster-fuzz regression with Workers on mips.debug
BUG=chromium:503698
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1208573003

Cr-Commit-Position: refs/heads/master@{#29261}
2015-06-24 17:09:59 +00:00
wingo
3c5f0db3a1 Fix receiver when calling eval() bound by with scope
Thanks to André Bargull for the report.

BUG=v8:4214
LOG=N
R=arv@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1202963005

Cr-Commit-Position: refs/heads/master@{#29259}
2015-06-24 16:47:58 +00:00
yangguo
f1982eb490 Serializer: clear next link in weak cells.
If we do not clear next links during serialization, the
serializer would simply follow those links and serialize
arbitrary objects held by weak cells. This breaks the
invariant in the code serializer, which crashes if it
sees context-dependent objects.

R=ulan@chromium.org
BUG=chromium:503552
LOG=Y

Review URL: https://codereview.chromium.org/1203973002

Cr-Commit-Position: refs/heads/master@{#29255}
2015-06-24 14:26:42 +00:00
bmeurer
7a675e0e3b [x64] Fix instruction selection for Word64Equal(Word64And, 0).
This fixes a slight inconsistency in the InstructionSelector that
basically disabled the optimization for things like ObjectIsSmi.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1206773002

Cr-Commit-Position: refs/heads/master@{#29250}
2015-06-24 09:15:31 +00:00
danno
c019d7f498 Use big-boy Types to annotate interface descriptor parameters
- Thread Type::FunctionType through stubs and the TF pipeline.
- Augment Typer to decorate parameter nodes with types from
  a Type::FunctionType associated with interface descriptors.
- Factor interface descriptors into platform-specific and
  platform-independent components so that all descriptors share
  a common Type::FunctionType for all platforms.

Review URL: https://codereview.chromium.org/1197703002

Cr-Commit-Position: refs/heads/master@{#29248}
2015-06-24 06:22:04 +00:00
binji
3e2c6a2eb7 Fix ReferenceError of Worker in regress-crbug-503578
Worker is not defined on the V8 Shared bots.

BUG=chromium:503578
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1202763004

Cr-Commit-Position: refs/heads/master@{#29246}
2015-06-24 05:36:20 +00:00
binji
10b6af71b8 Fix cluster-fuzz found regression in d8 when deserializing ArrayBuffer
BUG=503578
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1204753002

Cr-Commit-Position: refs/heads/master@{#29244}
2015-06-24 04:23:58 +00:00
arv
6181ec9c28 Date() should not depend on Date.prototype.toString
We used to call toString as a method which is not safe.

BUG=v8:4225
LOG=Y
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200033003

Cr-Commit-Position: refs/heads/master@{#29242}
2015-06-23 23:18:40 +00:00
adamk
3164aa7483 Revert "Keep a canonical list of shared function infos."
Speculative revert in the hopes of fixing serializer crashes seen in canary.

This reverts commit c166945083, as well as
followup change "Do not look for existing shared function info when compiling a new script."
(commit 7c43967bb7).

BUG=chromium:503552,v8:4132
TBR=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1207583002

Cr-Commit-Position: refs/heads/master@{#29241}
2015-06-23 22:59:30 +00:00
mathias
57306b59e8 Avoid built-ins in Date.prototype.toISOString
TEST=mjsunit/date
BUG=v8:4226
LOG=N

Review URL: https://codereview.chromium.org/1203733002

Cr-Commit-Position: refs/heads/master@{#29240}
2015-06-23 18:43:08 +00:00
titzer
2c979b96f1 Add mjsunit tests for optimization of float min/max.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1199053011

Cr-Commit-Position: refs/heads/master@{#29239}
2015-06-23 17:26:25 +00:00
adamk
df47224028 Expose Map/Set methods through the API
Map: get, set, has, delete, clear
Set: add, has, delete, clear

All except clear are implemented as calls into collection.js.

Note that some of these shadow methods of v8::Object. It's unclear
how confusing that's going to be: on the one hand, it seems likely
that most operations you would want to do on a Map or Set are these.
On the other, generic code could get confused if it somehow gets
ahold of a variable that happens to be C++-typed as a v8::Map or v8::Set.

BUG=v8:3340
LOG=y

Review URL: https://codereview.chromium.org/1204623002

Cr-Commit-Position: refs/heads/master@{#29237}
2015-06-23 15:14:17 +00:00
ishell
bcb276c6f7 Fixed exception handling in Realm.create().
BUG=chromium:501711
LOG=N

Review URL: https://codereview.chromium.org/1207453002

Cr-Commit-Position: refs/heads/master@{#29236}
2015-06-23 15:08:50 +00:00
verwaest
c49659b008 Don't insert elements transitions into normalized maps
BUG=chromium:499790
LOG=n

Review URL: https://codereview.chromium.org/1203653003

Cr-Commit-Position: refs/heads/master@{#29233}
2015-06-23 14:33:11 +00:00
mstarzinger
7f5a2d9ed5 [turbofan] Make global variable loads and stores explicit.
This is a precursor to using specialized LoadIC and StoreIC stubs for
global variable access. It also removes the need to keep track of the
global object in the type system, hence freeing up one bit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1205473004

Cr-Commit-Position: refs/heads/master@{#29231}
2015-06-23 13:34:06 +00:00
bmeurer
78e9a2dff2 [turbofan] NaN is never truish.
BUG=v8:4207
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1198993009

Cr-Commit-Position: refs/heads/master@{#29230}
2015-06-23 12:24:54 +00:00
jacob.bramley
d783b76362 [arm64][turbofan] Fix implementation of Float64Min.
ARM64's `fmin` and `fmax` instructions don't have the same behaviour as
TurboFan's Float(32|64)(Min|Max) functions.

BUG=4206
LOG=N

Review URL: https://codereview.chromium.org/1200123004

Cr-Commit-Position: refs/heads/master@{#29229}
2015-06-23 11:58:58 +00:00
ishell
47421760f4 Map::ReconfigureProperty() should mark map as unstable when it returns a different map.
BUG=chromium:502930
LOG=N

Review URL: https://codereview.chromium.org/1200003002

Cr-Commit-Position: refs/heads/master@{#29226}
2015-06-23 11:30:58 +00:00
Benedikt Meurer
64d6ab455d [turbofan] Run DeadCodeElimination together with the advanced reducers.
This will immediately remove dead code from the graph once any of
the advanced reducers inserts it. Also changes the GraphReducer to
use the canonical Dead node for ReplaceWithValue.

R=jarin@chromium.org

Committed: https://crrev.com/88a40c5fb381924b1c0b2403dc582bceb2abe5da
Cr-Commit-Position: refs/heads/master@{#29217}

Review URL: https://codereview.chromium.org/1206533002.

Cr-Commit-Position: refs/heads/master@{#29225}
2015-06-23 11:22:12 +00:00
ishell
5c4aae390f Global handle leak in Realm.create() fixed.
BUG=chromium:501808
LOG=N

Review URL: https://codereview.chromium.org/1197403002

Cr-Commit-Position: refs/heads/master@{#29224}
2015-06-23 11:04:21 +00:00
titzer
deb5dcea5c [turbofan] Make an OptionalOperator for MachineOperatorBuilder.
This makes usage of the MachineOperatorBuilder more robust, as it will be
an error to request an unsupported operator.

Along the way, I noticed that all 7 platforms support Float32Abs and
Float64Abs. Should make them non-optional in another CL?

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1128133003

Cr-Commit-Position: refs/heads/master@{#29223}
2015-06-23 10:35:43 +00:00
jochen
22b691ba0e [test] Teach test runner about whether novfp3 is on or off
BUG=none
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1204643003

Cr-Commit-Position: refs/heads/master@{#29221}
2015-06-23 09:43:21 +00:00
bmeurer
a5af5127ec Revert of [turbofan] Run DeadCodeElimination together with the advanced reducers. (patchset #1 id:1 of https://codereview.chromium.org/1206533002/)
Reason for revert:
Looks like this breaks Tests262.

Original issue's description:
> [turbofan] Run DeadCodeElimination together with the advanced reducers.
>
> This will immediately remove dead code from the graph once any of
> the advanced reducers inserts it. Also changes the GraphReducer to
> use the canonical Dead node for ReplaceWithValue.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/88a40c5fb381924b1c0b2403dc582bceb2abe5da
> Cr-Commit-Position: refs/heads/master@{#29217}

TBR=jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1200983004

Cr-Commit-Position: refs/heads/master@{#29220}
2015-06-23 09:39:23 +00:00
mvstanton
e9445d7d48 Vector ICs: Additional Turbofan support
Lowering of stores need the vector and slot if --vector-stores is true.

BUG=

Review URL: https://codereview.chromium.org/1193313002

Cr-Commit-Position: refs/heads/master@{#29219}
2015-06-23 09:09:19 +00:00
bmeurer
88a40c5fb3 [turbofan] Run DeadCodeElimination together with the advanced reducers.
This will immediately remove dead code from the graph once any of
the advanced reducers inserts it. Also changes the GraphReducer to
use the canonical Dead node for ReplaceWithValue.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1206533002

Cr-Commit-Position: refs/heads/master@{#29217}
2015-06-23 08:48:37 +00:00
mstarzinger
4ab2a18094 [turbofan] Avoid embedding type feedback vector into code.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1198263004

Cr-Commit-Position: refs/heads/master@{#29216}
2015-06-23 08:27:33 +00:00
jarin
de62b486e3 [turbofan] Factor out the function specific part from the frame state operator.
This also threads through the parameter count and local count to the instruction selector. This will be later used to allow merging of various StateValues vector (and prepare for differential encoding which will not distinguish between parameters, locals and expression stack).

BUG=

Review URL: https://codereview.chromium.org/1191243003

Cr-Commit-Position: refs/heads/master@{#29214}
2015-06-23 07:17:25 +00:00
bmeurer
f2ac852015 [date] Use explicit control flow to replace %_ThrowIfNotADate.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1191283003

Cr-Commit-Position: refs/heads/master@{#29211}
2015-06-23 06:43:40 +00:00
littledan
325fbd0e24 Re-ship Harmony Array/TypedArray methods
Turning the --harmony-array flag on has been delayed behind
unrelated test failures. Now that those tests are disabled,
land the changes.

This patch fixes WebKit tests based on the new change.

R=adamk
LOG=Y
BUG=v8:3578
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199113003

Cr-Commit-Position: refs/heads/master@{#29209}
2015-06-23 00:41:58 +00:00
arv
b5adc2f6b4 Remove usage of S.p.charCodeAt from uri.js
We were using both String.prototype.charCodeAt and
String.prototype.charAt.

BUG=v8:4224
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1204483003

Cr-Commit-Position: refs/heads/master@{#29208}
2015-06-22 23:43:24 +00:00
littledan
29c4904c0a Disable a flaky test
This test starts failing when the --harmony-array flag is turned on,
but the failure does not directly have to do with that flag. Disabling
the test in debug mode to unblock the release.

BUG=v8:4237
LOG=n
R=adamk,erikcorry

Review URL: https://codereview.chromium.org/1202523005

Cr-Commit-Position: refs/heads/master@{#29207}
2015-06-22 22:37:49 +00:00
arv
81f2c44047 Fix HTML string methods to not depend on replace method
Before this we were using String.prototype.replace. Now
we call the internal StringReplace instead.

BUG=v8:4221
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199933005

Cr-Commit-Position: refs/heads/master@{#29206}
2015-06-22 21:55:56 +00:00
Adam Klein
1c575e917a Add an informative comment on regress-1132 ASAN suppression
TBR=arv@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1199053002.

Cr-Commit-Position: refs/heads/master@{#29205}
2015-06-22 21:06:11 +00:00
arv
6b268bce6a Fix string HTML methods to call ToString
Before this we were using + which calls valueOf which is not correct
for these methods.

BUG=v8:4222
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1194173004

Cr-Commit-Position: refs/heads/master@{#29202}
2015-06-22 19:07:24 +00:00
littledan
7ebf6fc965 Disable regress-1132 on ASAN runs
This test appears to trigger some bug in either ASAN or V8 when
accompanied by an increase in JS code size. Disabling the test
on ASAN runs to unblock adding new JS code.

BUG=v8:4236
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1203523002

Cr-Commit-Position: refs/heads/master@{#29201}
2015-06-22 18:57:06 +00:00
arv
7539f322ee [Test262-es6] Update to use FAIL_SLOPPY everywhere
Also reordered related test

BUG=N
LOG=N
R=adamk, littledan

Review URL: https://codereview.chromium.org/1199013002

Cr-Commit-Position: refs/heads/master@{#29200}
2015-06-22 18:53:39 +00:00
binji
5b3700a49a Atomic operations on Uint8ClampedArray
BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1201543002

Cr-Commit-Position: refs/heads/master@{#29199}
2015-06-22 18:51:25 +00:00
binji
001ee86e32 Add d8 API for spawning function on a new thread (Third try)
This API closely matches the Worker API. The differences:

1) The argument to the Worker constructor is a function to run, not a script.
2) Receiving a message from a worker is a synchronous API (as there is no event
loop).

The serialization done here is not robust as the real DOM implementation. For
example, recursive data structures or otherwise duplicated objects are not
allowed.

BUG=chromium:497295
LOG=n

Review URL: https://codereview.chromium.org/1192923002

Cr-Commit-Position: refs/heads/master@{#29195}
2015-06-22 17:12:43 +00:00
arv
9f550240b0 Test262-es6 test runner should handle sloppy fail better
This adds a new FAIL_SLOPPY expected output. It then uses this to
determine if the test case has unexpected output.

BUG=v8:4164
LOG=N
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1197913002

Cr-Commit-Position: refs/heads/master@{#29194}
2015-06-22 15:08:50 +00:00
arv
b6d950c979 [es6] Bound function names
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind

Bound functions should have a name based on the function that was
bound.

This reverts the revert f2747ed9b4. The original
CL was reverted because the Blink layout test broke. I have a CL that disables
these tests at: https://codereview.chromium.org/1196753003/

BUG=N
LOG=N
R=adamk
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1195983002

Cr-Commit-Position: refs/heads/master@{#29193}
2015-06-22 14:30:01 +00:00
dslomov
e7cdb615ae [destructuring] Implement parameter pattern matching.
Scoping for initializers is yet incorrect. Defaults are not supported.

R=arv@chromium.org,rossberg@chromium.org
BUG=v8:811
LOG=N

Committed: https://crrev.com/42f30f4ded2b1ca0c4caa7639e6206e93c78ee70
Cr-Commit-Position: refs/heads/master@{#29184}

Review URL: https://codereview.chromium.org/1189743003

Cr-Commit-Position: refs/heads/master@{#29192}
2015-06-22 14:16:02 +00:00
caitpotter88
5337508fe3 [es6] ship Rest Parameters
BUG=v8:2159
LOG=N
R=arv@chromium.org, dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1191653008

Cr-Commit-Position: refs/heads/master@{#29191}
2015-06-22 13:43:26 +00:00
machenbach
82e8060515 Revert of [destructuring] Implement parameter pattern matching. (patchset #7 id:120001 of https://codereview.chromium.org/1189743003/)
Reason for revert:
[Sheriff] Breaks tsan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4392

Original issue's description:
> [destructuring] Implement parameter pattern matching.
>
> Scoping for initializers is yet incorrect. Defaults are not supported.
>
> R=arv@chromium.org,rossberg@chromium.org
> BUG=v8:811
> LOG=N
>
> Committed: https://crrev.com/42f30f4ded2b1ca0c4caa7639e6206e93c78ee70
> Cr-Commit-Position: refs/heads/master@{#29184}

TBR=arv@chromium.org,rossberg@chromium.org,caitpotter88@gmail.com,wingo@igalia.com,dslomov@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811

Review URL: https://codereview.chromium.org/1195163007

Cr-Commit-Position: refs/heads/master@{#29188}
2015-06-22 13:14:24 +00:00
bmeurer
d4f70f8ce8 [turbofan] Revive the VectorSlotPair and also put feedback on JSCallFunction.
We resurrect the VectorSlotPair in order to be able to separate the
feedback input for the compiler from the actual type feedback vector
that is required to meet the IC requirements at runtime. This will allow
us to for example use feedback from a different context or divide the
type feedback vector into two separate vectors, without having to touch
the compiler. It'll allow use to load the vector from the shared
function info at runtime, while still consuming feedback in the
compiler (i.e. we don't rely on the feedback vector node to be a heap
constant).

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1198983002

Cr-Commit-Position: refs/heads/master@{#29185}
2015-06-22 12:08:20 +00:00
dslomov
42f30f4ded [destructuring] Implement parameter pattern matching.
Scoping for initializers is yet incorrect. Defaults are not supported.

R=arv@chromium.org,rossberg@chromium.org
BUG=v8:811
LOG=N

Review URL: https://codereview.chromium.org/1189743003

Cr-Commit-Position: refs/heads/master@{#29184}
2015-06-22 12:07:13 +00:00
verwaest
d195c6f9bd Remove broken optimization unwrapping number wrappers on setting array.length
Can't imagine it's very useful; lets restore/fix once it becomes relevant

BUG=

Review URL: https://codereview.chromium.org/1198253002

Cr-Commit-Position: refs/heads/master@{#29181}
2015-06-22 10:49:02 +00:00
mstarzinger
816abc5e86 Fix terrible interaction with code flushing.
This fixes a terrible interaction of code flushing and the clearing of
optimized code maps hanging off a SharedFunctionInfo. The following is
what happened:
1) Incremental marking cleared map in SharedFunctionInfo s, however it
   was not enqueued as a flushing candidate because one JSFunction f1
   still had optimized code.
2) Deoptimization of f1 made s eligible for code flushing.
3) Optimization of f2 added new entry to optimized code map of s.
4) The JSFunction f2 became unreachable and hence is never marked.
5) Incremental marking now visits f1, finds it eligible for flushing,
   also s is eligible for flushing, both are enqueued.
6) Marking finishes, code flusher clears f1 and s, but the optimized
   code map of s still contains an entry.
7) Boom!

R=ulan@chromium.org,hpayer@chromium.org
TEST=mjsunit/es6/generators-iteration
BUG=v8:3803
LOG=N

Review URL: https://codereview.chromium.org/1197713004

Cr-Commit-Position: refs/heads/master@{#29177}
2015-06-22 08:25:45 +00:00
mvstanton
17c8ffeaa3 Vector ICs: Turbofan vector store ic support
Turbofan needs to pass vector slots around for named and keyed stores.
Also, the CL addresses a missing slot for ClassLiterals.

BUG=

Review URL: https://codereview.chromium.org/1178363002

Cr-Commit-Position: refs/heads/master@{#29173}
2015-06-21 13:55:30 +00:00
machenbach
a002cbd743 Revert of Ship Harmony Array/TypedArray methods (patchset #6 id:100001 of https://codereview.chromium.org/1187543003/)
Reason for revert:
[Sheriff] Breaks gcstress and mac asan:
http://build.chromium.org/p/client.v8/builders/V8%20GC%20Stress%20-%203/builds/3896
http://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/1774

Original issue's description:
> Ship Harmony Array/TypedArray methods
>
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> BUG=v8:3578
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/7142b0d211b732e1c119fded80f43fbbd9cea0f8
> Cr-Commit-Position: refs/heads/master@{#29170}

TBR=adamk@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3578

Review URL: https://codereview.chromium.org/1195163002

Cr-Commit-Position: refs/heads/master@{#29171}
2015-06-20 07:25:27 +00:00
littledan
7142b0d211 Ship Harmony Array/TypedArray methods
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
BUG=v8:3578
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1187543003

Cr-Commit-Position: refs/heads/master@{#29170}
2015-06-20 00:02:02 +00:00
caitpotter88
1765866b0b [es6] throw TypeError when setting cyclic prototype value
Object.setPrototypeOf() throws a TypeError if value would create a
cycle. Previously a plain Error was thrown rather than a TypeError.

BUG=v8:4197
R=mike@bocoup.com
LOG=N

Review URL: https://codereview.chromium.org/1198523002

Cr-Commit-Position: refs/heads/master@{#29169}
2015-06-19 22:18:36 +00:00
conradw
4ac7be5656 Revert relanded strong property access CL
Reason:
Regressions in various benchmarks.

Revert "Revert of Revert of [strong] Implement strong mode restrictions on property access (patchset #1 id:1 of https://codereview.chromium.org/1189153002/)"

This reverts commit 41405c0470.

Revert "X87: Revert of Revert of [strong] Implement strong mode restrictions on property access."

This reverts commit 48de5f4d6b.

Revert "Fix overlapping KeyedLoadIC bitfield."

This reverts commit 4e6c956abf.

Revert "MIPS64: Fix 'Revert of Revert of [strong] Implement strong mode restrictions on property access'."

This reverts commit 74f97b0d2a.

BUG=

Review URL: https://codereview.chromium.org/1199493002

Cr-Commit-Position: refs/heads/master@{#29166}
2015-06-19 19:00:53 +00:00
arv
0f502f679e Test262 update 2015-06-11 (Take 3)
This reverts commit 72bb369d08.

Always skip slow tests.

Also, some eval tests are failing in strict mode with nosnap

BUG=N
LOG=N
R=adamk@chromium.org, littledan@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/1190063002

Cr-Commit-Position: refs/heads/master@{#29164}
2015-06-19 18:58:19 +00:00
binji
4f8761ca4e Revert of Add d8 API for spawning function on a new thread (Second try) (patchset #3 id:60001 of https://codereview.chromium.org/1195613003/)
Reason for revert:
Fails on V8 Linux - isolates (http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20isolates/builds/4128)

Original issue's description:
> Add d8 API for spawning function on a new thread (Second try)
>
> This API closely matches the Worker API. The differences:
>
> 1) The argument to the Worker constructor is a function to run, not a script.
> 2) Receiving a message from a worker is a synchronous API (as there is no event
> loop).
>
> The serialization done here is not robust as the real DOM implementation. For
> example, recursive data structures or otherwise duplicated objects are not
> allowed.
>
> BUG=chromium:497295
> R=jochen@chromium.org
> LOG=n
>
> Review URL: https://codereview.chromium.org/1185643004
>
> Cr-Commit-Position: refs/heads/master@{#29126}
>
> Committed: https://crrev.com/ec2eaf712ecee6b4891c0458f2397e04a1f9b339
> Cr-Commit-Position: refs/heads/master@{#29158}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:497295

Review URL: https://codereview.chromium.org/1191373005

Cr-Commit-Position: refs/heads/master@{#29161}
2015-06-19 18:34:04 +00:00
arv
87afca31ad Revert of Additional HandleScopes to limit Handle consumption. (patchset #4 id:50001 of https://codereview.chromium.org/1185633002/)
Reason for revert:
Fails the following test

handle-count-ast
handle-count-runtime-...

on V8 Linux - nosnap - debug - 1

http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%201/builds/851/steps/Check/logs/stdio

Original issue's description:
> Additional HandleScopes to limit Handle consumption.
>
> erikcorry@chromium.org suggested digging into v8 handle usage. Found potential scopes in ast.cc and runtime-literals.cc and added tests.
>
> The runtime-literals.cc change reduces peak handles in imaging-darkroom.js from 1,282,610 to 428,218. The ast.cc change reduces the peak handles in string-tagcloud.js from 80,738 to 8,176.
>
> No significant handle count issues found with major websites, but substantial savings on some benchmarks and demos:
>
> Kraken's imaging-darkroom.js down from 1,282,610 to 428,218 due to runtime-literals.cc scope.
> SunSpider's string-tagcloud.js down from 80,738 to 8.176 due to ast.cc
>
> http://www.flohofwoe.net/demos/dragons_asmjs.html (738,906 -> 478,296)
> http://www.flohofwoe.net/demos/instancing_asmjs.html (737,884 -> 477,274)
> https://dl.dropboxusercontent.com/u/16662598/Ports/DOSBox-web/doom.html?engine=dosbox-growth.js (1,724,114 -> 1,087,408)
> https://kripken.github.io/ammo.js/examples/new/ammo.html (175,784 -> 142,058)
>
> BUG=
>
> Committed: https://crrev.com/3a4c7538839186aa38910c66c986abb563f4ccd2
> Cr-Commit-Position: refs/heads/master@{#29155}

TBR=yangguo@chromium.org,erikcorry@chromium.org,oth@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1194873004

Cr-Commit-Position: refs/heads/master@{#29160}
2015-06-19 18:25:31 +00:00
binji
e6fed5e895 Fix cluster-fuzz bug introduced in refs/heads/master@{#28796}
Don't DCHECK in the atomic runtime functions.

BUG=chromium:501809,chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1189223003

Cr-Commit-Position: refs/heads/master@{#29159}
2015-06-19 16:14:15 +00:00
binji
ec2eaf712e Add d8 API for spawning function on a new thread (Second try)
This API closely matches the Worker API. The differences:

1) The argument to the Worker constructor is a function to run, not a script.
2) Receiving a message from a worker is a synchronous API (as there is no event
loop).

The serialization done here is not robust as the real DOM implementation. For
example, recursive data structures or otherwise duplicated objects are not
allowed.

BUG=chromium:497295
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1185643004

Cr-Commit-Position: refs/heads/master@{#29126}

Review URL: https://codereview.chromium.org/1195613003

Cr-Commit-Position: refs/heads/master@{#29158}
2015-06-19 16:13:11 +00:00
dusan.milosavljevic
e8173e4ea2 MIPS64: Fix random failures of fannkuch.js.
TEST=mjsunit/asm/embenchen/fannkuch,
     mjsunit/math-abs
BUG=

Review URL: https://codereview.chromium.org/1192413002

Cr-Commit-Position: refs/heads/master@{#29157}
2015-06-19 16:11:55 +00:00
oth
3a4c753883 Additional HandleScopes to limit Handle consumption.
erikcorry@chromium.org suggested digging into v8 handle usage. Found potential scopes in ast.cc and runtime-literals.cc and added tests.

The runtime-literals.cc change reduces peak handles in imaging-darkroom.js from 1,282,610 to 428,218. The ast.cc change reduces the peak handles in string-tagcloud.js from 80,738 to 8,176.

No significant handle count issues found with major websites, but substantial savings on some benchmarks and demos:

Kraken's imaging-darkroom.js down from 1,282,610 to 428,218 due to runtime-literals.cc scope.
SunSpider's string-tagcloud.js down from 80,738 to 8.176 due to ast.cc

http://www.flohofwoe.net/demos/dragons_asmjs.html (738,906 -> 478,296)
http://www.flohofwoe.net/demos/instancing_asmjs.html (737,884 -> 477,274)
https://dl.dropboxusercontent.com/u/16662598/Ports/DOSBox-web/doom.html?engine=dosbox-growth.js (1,724,114 -> 1,087,408)
https://kripken.github.io/ammo.js/examples/new/ammo.html (175,784 -> 142,058)

BUG=

Review URL: https://codereview.chromium.org/1185633002

Cr-Commit-Position: refs/heads/master@{#29155}
2015-06-19 16:04:22 +00:00
wingo
d940c02724 Better error reporting for "return();"
R=rossberg@chromium.org
BUG=v8:4194
LOG=N

Review URL: https://codereview.chromium.org/1191303002

Cr-Commit-Position: refs/heads/master@{#29153}
2015-06-19 15:10:10 +00:00
verwaest
8076d6ee2d More cleanup related to setting array.length
BUG=

Review URL: https://codereview.chromium.org/1191313003

Cr-Commit-Position: refs/heads/master@{#29152}
2015-06-19 14:57:11 +00:00
yangguo
c166945083 Keep a canonical list of shared function infos.
Each Script object now keeps a WeakFixedArray of SharedFunctionInfo
objects created from this script.

This way, when compiling a function, we do not create duplicate shared
function info objects when recompiling with either compiler.

This fixes a class of issues in the debugger, where we set break points
on one shared function info, but functions from duplicate shared function
infos are not affected.

LOG=N
BUG=v8:4132

Review URL: https://codereview.chromium.org/1183733006

Cr-Commit-Position: refs/heads/master@{#29151}
2015-06-19 14:40:32 +00:00
caitpotter88
b61e9812c3 [es6] ship Object.assign
BUG=v8:4007
LOG=N
R=rossberg@chromium.org, arv@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Committed: https://crrev.com/12e194860a56d47a10d89ae34761a4af6b6166bb
Cr-Commit-Position: refs/heads/master@{#29118}

Review URL: https://codereview.chromium.org/1191003003

Cr-Commit-Position: refs/heads/master@{#29150}
2015-06-19 14:39:13 +00:00
bmeurer
1021ed85cb [ubsan] Fix HeapObjectMatcher to avoid invalid casts.
BUG=v8:3809
LOG=n
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1196623002

Cr-Commit-Position: refs/heads/master@{#29147}
2015-06-19 12:49:13 +00:00
bmeurer
733a246386 [turbofan] Proper dead code elimination as regular reducer.
The three different concerns that the ControlReducer used to deal with
are now properly separated into

  a.) DeadCodeElimination, which is a regular AdvancedReducer, that
      propagates Dead via control edges,
  b.) CommonOperatorReducer, which does strength reduction on common
      operators (i.e. Branch, Phi, and friends), and
  c.) GraphTrimming, which removes dead->live edges from the graph.

This will make it possible to run the DeadCodeElimination together with
other passes that actually introduce Dead nodes, i.e. typed lowering;
and it opens the door for general inlining without two stage fix point
iteration.

To make the DeadCodeElimination easier and more uniform, we basically
reverted the introduction of DeadValue and DeadEffect, and changed the
Dead operator to produce control, value and effect. Note however that
this is not a requirement, but merely a way to make dead propagation
easier and more uniform. We could always go back and decide to have
different Dead operators if some other change requires that.

Note that there are several additional opportunities for cleanup now,
i.e. OSR deconstruction could be a regular reducer now, and we don't
need to use TheHole as dead value marker in the GraphReducer. And we can
actually run the dead code elimination together with the other passes
instead of using separate passes over the graph.  We will do this in
follow up CLs.

R=jarin@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1193833002

Cr-Commit-Position: refs/heads/master@{#29146}
2015-06-19 12:07:26 +00:00
mstarzinger
f82ccff5a2 [turbofan] Disable failing DeoptExceptionHandlerFinally test.
R=jarin@chromium.org
TEST=cctest/test-run-deopt/DeoptExceptionHandlerFinally
BUG=v8:4195
LOG=N

Review URL: https://codereview.chromium.org/1189373003

Cr-Commit-Position: refs/heads/master@{#29145}
2015-06-19 11:41:12 +00:00
Ilija.Pavlovic
f0c4edfdc5 MIPS: Implemented PC-relative instructions for R6.
Added: JIC, BEQZC, JIALC, LDPC, LWPC, ALUIPC, ADDIUPC, ALIGN/DAILGN, LWUPC,
AUIPC, BC, BALC. Additional fixed compact branch offset.

TEST=test-assembler-mips[64]/r6_align, r6_dalign, r6_aluipc, r6_lwpc, r6_jic,
                             r6_beqzc, r6_jialc, r6_addiupc, r6_ldpc, r6_lwupc,
                             r6_auipc, r6_bc, r6_balc
BUG=

Review URL: https://codereview.chromium.org/1195793002

Cr-Commit-Position: refs/heads/master@{#29143}
2015-06-19 11:06:14 +00:00
yangguo
f6b71512ea Serializer: do not miss outdated contexts if they are serialized deferred.
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1189183002

Cr-Commit-Position: refs/heads/master@{#29136}
2015-06-19 09:07:31 +00:00
yangguo
4b7d5dc4bb Protect error message formatter against invalid string length.
R=mstarzinger@chromium.org
BUG=chromium:500980
LOG=N

Review URL: https://codereview.chromium.org/1191263002

Cr-Commit-Position: refs/heads/master@{#29135}
2015-06-19 08:31:31 +00:00
ulan
fda60dc214 ARM: make predictable code size scope more precise in DoDeferredInstanceOfKnownGlobal.
We block constant pool up to the call stub instruction, but the check for code size
includes the next instruction after the call instruction. That instruction can
emit constant pool.

BUG=chromium:500831
LOG=NO
TEST=mjsunit/regress/regress-500831

Review URL: https://codereview.chromium.org/1189123003

Cr-Commit-Position: refs/heads/master@{#29132}
2015-06-19 04:54:51 +00:00
binji
602aa068bd Revert of Add d8 API for spawning function on a new thread. (patchset #6 id:100001 of https://codereview.chromium.org/1185643004/)
Reason for revert:
Fails on V8 Win32 - nosnap - shared (http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/7427)

Fails on V8 Arm - debug builder (http://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/4361)

Fails on V8 Linux - shared (http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4430)

Original issue's description:
> Add d8 API for spawning function on a new thread.
>
> This API closely matches the Worker API. The differences:
>
> 1) The argument to the Worker constructor is a function to run, not a script.
> 2) Receiving a message from a worker is a synchronous API (as there is no event
> loop).
>
> The serialization done here is not robust as the real DOM implementation. For
> example, recursive data structures or otherwise duplicated objects are not
> allowed.
>
> BUG=none
> R=jochen@chromium.org
> LOG=n
>
> Committed: https://crrev.com/3d98b956b56fa283b40913788ff760022d478812
> Cr-Commit-Position: refs/heads/master@{#29126}

TBR=jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=none

Review URL: https://codereview.chromium.org/1192193002

Cr-Commit-Position: refs/heads/master@{#29130}
2015-06-18 20:50:37 +00:00
balazs.kilvady
ed01b6b0df MIPS: Fix unaligned double access in cctest/test-simplified-lowering/RunAccessTests_float64.
TEST=cctest/test-simplified-lowering/RunAccessTests_float64
BUG=

Review URL: https://codereview.chromium.org/1182713004

Cr-Commit-Position: refs/heads/master@{#29128}
2015-06-18 19:48:33 +00:00
caitpotter88
e7d4bf87ad [es6] fix IsConcatSpreadable() algorithm in runtime-array.cc
The ordering of the "IsArray()" check for IsConcatSpreadable() was incorrect previously --- IsArray() is only used if Get(O, @@isConcatSpreadable) is undefined. Without this fix, it's not possible for Array subclasses to opt out of spreading

22.1.3.1.1 http://www.ecma-international.org/ecma-262/6.0/#sec-isconcatspreadable

BUG=v8:3764
LOG=N
R=arv@chromium.org, dslomov@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1192153002

Cr-Commit-Position: refs/heads/master@{#29127}
2015-06-18 19:47:29 +00:00
binji
3d98b956b5 Add d8 API for spawning function on a new thread.
This API closely matches the Worker API. The differences:

1) The argument to the Worker constructor is a function to run, not a script.
2) Receiving a message from a worker is a synchronous API (as there is no event
loop).

The serialization done here is not robust as the real DOM implementation. For
example, recursive data structures or otherwise duplicated objects are not
allowed.

BUG=none
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1185643004

Cr-Commit-Position: refs/heads/master@{#29126}
2015-06-18 19:46:20 +00:00
caitpotter88
95a3bc965e Revert of [es6] ship Object.assign (patchset #2 id:20001 of https://codereview.chromium.org/1191003003/)
Reason for revert:
Seems to break asan somehow

Original issue's description:
> [es6] ship Object.assign
>
> BUG=v8:4007
> LOG=N
> R=rossberg@chromium.org, arv@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/12e194860a56d47a10d89ae34761a4af6b6166bb
> Cr-Commit-Position: refs/heads/master@{#29118}

TBR=arv@chromium.org,dslomov@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4007

Review URL: https://codereview.chromium.org/1191593005

Cr-Commit-Position: refs/heads/master@{#29124}
2015-06-18 19:15:36 +00:00
conradw
41405c0470 Revert of Revert of [strong] Implement strong mode restrictions on property access (patchset #1 id:1 of https://codereview.chromium.org/1189153002/)
Reason for revert:
Issue was ultimately caused/fixed by https://codereview.chromium.org/1194673002/

Original issue's description:
> Revert of [strong] Implement strong mode restrictions on property access (patchset #23 id:460001 of https://codereview.chromium.org/1168093002/)
>
> Reason for revert:
> Speculative revert, maybe breaks GC-stress
>
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/808
>
> Original issue's description:
> > [strong] Implement strong mode restrictions on property access
> >
> > Implements the strong mode proposal's restrictions on property access.
> >
> > To be fully explored in a followup: proxies, interceptors, access checks, load from super
> >
> > BUG=v8:3956
> > LOG=N
> >
> > Committed: https://crrev.com/85dbfb9a389e7b21bd2a63862202ee97fc5d7982
> > Cr-Commit-Position: refs/heads/master@{#29109}
>
> TBR=rossberg@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3956
>
> Committed: https://crrev.com/407657b706711fd5f8d417841e24b284886f3776
> Cr-Commit-Position: refs/heads/master@{#29115}

TBR=rossberg@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1185343005

Cr-Commit-Position: refs/heads/master@{#29122}
2015-06-18 17:17:07 +00:00
ulan
19cdd00d09 ARM64: remove stack pushes without frame in RegExpExecStub.
RegExpExecStub pushes callee-saved registers without setting up a frame. This confuses the stack iterator.

Other architectures do not save these registers.

BUG=chromium:487981
LOG=NO
TEST=mjsunit/regress/regress-487981

Review URL: https://codereview.chromium.org/1183593005

Cr-Commit-Position: refs/heads/master@{#29120}
2015-06-18 15:45:32 +00:00
caitpotter88
12e194860a [es6] ship Object.assign
BUG=v8:4007
LOG=N
R=rossberg@chromium.org, arv@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1191003003

Cr-Commit-Position: refs/heads/master@{#29118}
2015-06-18 14:56:14 +00:00
verwaest
49495ace70 Cleanup INTEGER_INDEXED_EXOTIC handling a bit
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1191813003

Cr-Commit-Position: refs/heads/master@{#29116}
2015-06-18 14:39:11 +00:00
conradw
407657b706 Revert of [strong] Implement strong mode restrictions on property access (patchset #23 id:460001 of https://codereview.chromium.org/1168093002/)
Reason for revert:
Speculative revert, maybe breaks GC-stress

http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/808

Original issue's description:
> [strong] Implement strong mode restrictions on property access
>
> Implements the strong mode proposal's restrictions on property access.
>
> To be fully explored in a followup: proxies, interceptors, access checks, load from super
>
> BUG=v8:3956
> LOG=N
>
> Committed: https://crrev.com/85dbfb9a389e7b21bd2a63862202ee97fc5d7982
> Cr-Commit-Position: refs/heads/master@{#29109}

TBR=rossberg@chromium.org,mvstanton@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3956

Review URL: https://codereview.chromium.org/1189153002

Cr-Commit-Position: refs/heads/master@{#29115}
2015-06-18 13:40:20 +00:00
conradw
85dbfb9a38 [strong] Implement strong mode restrictions on property access
Implements the strong mode proposal's restrictions on property access.

To be fully explored in a followup: proxies, interceptors, access checks, load from super

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1168093002

Cr-Commit-Position: refs/heads/master@{#29109}
2015-06-18 11:55:45 +00:00
conradw
1bb051b8a4 [es6] Fix completion values of for loops with lexical variables
Currently, the desugaring of for loops of the form for
(let/const ...; bla; bla) causes them to always have a
completion value of 1, regardless of whether the loop body
is executed or not. This CL fixes this, realigning
initializer blocks as a more general purpose way to avoid
the completion value rewriter (since that's all they really
do anyway).

BUG=

Review URL: https://codereview.chromium.org/1177053006

Cr-Commit-Position: refs/heads/master@{#29108}
2015-06-18 11:54:16 +00:00
bmeurer
92e6bcf13c [turbofan] Improve interplay of ControlReducer and CommonOperatorReducer.
This turns the CommonOperatorReducer into an AdvancedReducer and makes
it independent of JSGraph (which was used only because it was convienent),
and let's the CommonOperatorReducer run together with the ControlReducer.

The ControlReducer is still not able to run together with other reducers,
but we're getting closer. The plan is to split the ControlReducer into
two parts: The dead code elimination part and the common operator
reduction part. This separation will help to avoid tricky bugs in the
future and should make testing a *lot* easier.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1192063002

Cr-Commit-Position: refs/heads/master@{#29105}
2015-06-18 09:15:42 +00:00
mstarzinger
eb0e7437d3 [turbofan] Introduce DeadValue and DeadEffect operators.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1186033006

Cr-Commit-Position: refs/heads/master@{#29104}
2015-06-18 08:17:17 +00:00
bmeurer
a3106d228e [turbofan] Remove another premature optimization from ControlReducer.
We never hit the phi case for DecideCondition in practice, since a more
general optimization is already performed by typing and constant
propagation.

R=jarin@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186973005

Cr-Commit-Position: refs/heads/master@{#29102}
2015-06-18 07:13:47 +00:00
mstarzinger
10d47da61c [turbofan] Add test to keep generic pipeline on life support.
R=bmeurer@chromium.org
TEST=cctest/test-pipeline

Review URL: https://codereview.chromium.org/1193543002

Cr-Commit-Position: refs/heads/master@{#29098}
2015-06-18 04:52:44 +00:00
mstarzinger
9e7732c517 Reenable some cctest tests that no longer fail.
R=jochen@chromium.org,jarin@chromium.org
TEST=cctest

Review URL: https://codereview.chromium.org/1176423007

Cr-Commit-Position: refs/heads/master@{#29092}
2015-06-17 14:56:03 +00:00
jkummerow
5de595a603 [test] Fix gc-stress failures of regress-crbug-500497.js
R=machenbach@chromium.org
NOTRY=y

Review URL: https://codereview.chromium.org/1175123003

Cr-Commit-Position: refs/heads/master@{#29091}
2015-06-17 14:24:36 +00:00
bmeurer
afc2fb26a1 [turbofan] Remove another ineffective optimization from the ControlReducer.
The condition of a Branch or Select can never be a NumberConstant,
because the resulting graph would be invalid, so we don't need to
optimize this case. It can only ever be a tagged boolean or an untagged
bit.

Drive-by-fix: Test the interesting cases in the unit tests instead.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1195443004

Cr-Commit-Position: refs/heads/master@{#29089}
2015-06-17 12:50:45 +00:00
ulan
31e3177bb0 Add V8 platform API to call delayed task.
Delayed tasks can be used to perform non-urgent clean up work.

BUG=chromium:490559
LOG=NO

Review URL: https://codereview.chromium.org/1179153002

Cr-Commit-Position: refs/heads/master@{#29084}
2015-06-17 12:09:40 +00:00
jkummerow
5fca3947cf Hydrogen object literals: always initialize in-object properties
This fixes a bug where new-space GC could be triggered by non-folded allocations for some of the in-object properties, while the object was only partially initialized.

BUG=chromium:500497
LOG=y
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1182113007

Cr-Commit-Position: refs/heads/master@{#29079}
2015-06-17 11:24:24 +00:00
bmeurer
80a6e53935 [turbofan] Move graph trimming functionality to dedicated GraphTrimmer.
Up until now that was still mixed with control reduction in the
ControlReducer. This separation allows us to remove the horrible
Reducer::Finish hack and also do graph trimming at more appropriate
places in the pipeline (i.e. trim dead nodes after generic lowering,
which can also make nodes dead).

R=jarin@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1188433010

Cr-Commit-Position: refs/heads/master@{#29077}
2015-06-17 10:56:37 +00:00
verwaest
bb1b54a776 Only walk the hidden prototype chain for private nonexistent symbols
BUG=chromium:479528
LOG=n

Review URL: https://codereview.chromium.org/1185373004

Cr-Commit-Position: refs/heads/master@{#29075}
2015-06-17 10:20:52 +00:00
verwaest
72cdb99346 Rely on the map being a dictionary map rather than not having a backpointer
BUG=chromium:500173
LOG=n

Review URL: https://codereview.chromium.org/1194513003

Cr-Commit-Position: refs/heads/master@{#29074}
2015-06-17 10:14:01 +00:00
svenpanne
d4f7bff1ea Replace OFFSET_OF with offsetof as far as possible.
The remaining uses need some non-mechanical work:

  * non-standard-layout type, probably due to mixed access control

  * extended field designators

Review URL: https://codereview.chromium.org/1173343006

Cr-Commit-Position: refs/heads/master@{#29071}
2015-06-17 09:06:56 +00:00
machenbach
b4d3e1ceba Revert of Add %TypedArray% to proto chain (patchset #6 id:100001 of https://codereview.chromium.org/1186733002/)
Reason for revert:
[Sheriff] Changes layout tests:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/429

See e.g.:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/429/layout-test-results/inspector/console/console-big-array-pretty-diff.html

Please upload a blink side needsmanualrebaseline change first for these tests if the change is intended. Please also add a blink trybot on a reland of this CL.

Original issue's description:
> Add %TypedArray% to proto chain
>
> According to the ES6 spec, the main methods and getters shouldn't
> be properties of the individual TypedArray objects and prototypes
> but instead on %TypedArray% and %TypedArray%.prototype. This
> difference is observable through introspection. This patch moves
> some methods and getters to the proper place, with the exception
> of %TypedArray%.prototype.subarray and harmony methods. These will
> be moved in follow-on patches.
>
> BUG=v8:4085
> LOG=Y
> R=adamk
>
> Committed: https://crrev.com/a10590158260737b256fac3254b4939f48f90095
> Cr-Commit-Position: refs/heads/master@{#29057}

TBR=adamk@chromium.org,arv@chromium.org,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4085

Review URL: https://codereview.chromium.org/1192433003

Cr-Commit-Position: refs/heads/master@{#29070}
2015-06-17 09:05:51 +00:00
machenbach
72bb369d08 Revert of Update test262-es6 to 6/11 (patchset #2 id:40001 of https://codereview.chromium.org/1175313003/)
Reason for revert:
[Sheriff] Please fix test expectations for nosnap before reland. There are 54 tests failing:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/3422

Original issue's description:
> Update test262-es6 to 6/11
>
> This reverts commit 67b169199e and picks
> up the fixes to the yaml parser upstream.
>
> BUG=N
> LOG=N
> R=adamk@chromium.org, machenbach@chromium.org
>
> Committed: https://crrev.com/bc847230610d0518a700a69546d23784e6ce3479
> Cr-Commit-Position: refs/heads/master@{#29056}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1186093005

Cr-Commit-Position: refs/heads/master@{#29067}
2015-06-17 06:53:04 +00:00
machenbach
f064b68cf4 Revert of Skip slow tests in non debug too (patchset #1 id:1 of https://codereview.chromium.org/1184923003/)
Reason for revert:
[Sheriff] Needed for reverting:
https://codereview.chromium.org/1175313003

Original issue's description:
> Skip slow tests in non debug too
>
> BUG=N
> LOG=N
> TBR=adamk
>
> Committed: https://crrev.com/17b0f16c760e5b0d51ae87742a864de93b6f4c0b
> Cr-Commit-Position: refs/heads/master@{#29058}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1177223004

Cr-Commit-Position: refs/heads/master@{#29066}
2015-06-17 06:51:50 +00:00
bmeurer
ad6e739165 [turbofan] Remove ineffective optimization from ControlReducer.
This optimization just duplicates part of the ToBoolean rule in the
Typer, and it doesn't make sense to have adhoc partial typing rules in
the ControlReducer anyway.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1189963002

Cr-Commit-Position: refs/heads/master@{#29064}
2015-06-17 06:11:55 +00:00
mstarzinger
3161cb550c [turbofan] Ensure lazy bailout point in exception handler.
This ensures there is a lazy bailout point at the entry of every
exception handler so that deoptimized code is not re-entered through
caught exceptions.

R=jarin@chromium.org
TEST=cctest/test-run-deopt/DeoptExceptionHandler

Review URL: https://codereview.chromium.org/1173253004

Cr-Commit-Position: refs/heads/master@{#29061}
2015-06-17 05:40:42 +00:00
arv
17b0f16c76 Skip slow tests in non debug too
BUG=N
LOG=N
TBR=adamk

Review URL: https://codereview.chromium.org/1184923003

Cr-Commit-Position: refs/heads/master@{#29058}
2015-06-17 00:03:09 +00:00
littledan
a105901582 Add %TypedArray% to proto chain
According to the ES6 spec, the main methods and getters shouldn't
be properties of the individual TypedArray objects and prototypes
but instead on %TypedArray% and %TypedArray%.prototype. This
difference is observable through introspection. This patch moves
some methods and getters to the proper place, with the exception
of %TypedArray%.prototype.subarray and harmony methods. These will
be moved in follow-on patches.

BUG=v8:4085
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1186733002

Cr-Commit-Position: refs/heads/master@{#29057}
2015-06-16 23:39:10 +00:00
arv
bc84723061 Update test262-es6 to 6/11
This reverts commit 67b169199e and picks
up the fixes to the yaml parser upstream.

BUG=N
LOG=N
R=adamk@chromium.org, machenbach@chromium.org

Review URL: https://codereview.chromium.org/1175313003

Cr-Commit-Position: refs/heads/master@{#29056}
2015-06-16 22:16:08 +00:00
caitpotter88
6d22f7a794 [parser] parse CalllExpression TemplateLiteral production
BUG=v8:4183
R=arv@chromium.org, rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1184373002

Cr-Commit-Position: refs/heads/master@{#29055}
2015-06-16 18:08:28 +00:00
hablich
e35ff8cd03 Updates to the license information of third party components.
LOG=n

Review URL: https://codereview.chromium.org/1183743003

Cr-Commit-Position: refs/heads/master@{#29051}
2015-06-16 12:37:50 +00:00
chunyang.dai
ebb0f9e52e X87: enable the X87 turbofan support.
This patch includes the following changes.
     1, Enable the turbofan backend support for X87 platform. It depends on previous CL: 3fdfebd26.
     2, Enable the test cases which are disabled because turbofan for X87 was not enabled.

BUG=v8:4135
LOG=N

Review URL: https://codereview.chromium.org/1179763004

Cr-Commit-Position: refs/heads/master@{#29049}
2015-06-16 11:23:19 +00:00
kozyatinskiy
8e1c3a75b0 [V8] Fixed infinite loop in Debug::PrepareStep
frame->GetExpression always returns the same function. We should iterate through expression stack when we use Function.call.apply for finding actual target.

LOG=N
BUG=chromium:499479
R=yurys@chromium.org,yangguo@chromium.org

Review URL: https://codereview.chromium.org/1182703003

Cr-Commit-Position: refs/heads/master@{#29048}
2015-06-16 11:10:04 +00:00
bmeurer
21a1975542 [turbofan] Work around negative parameter count.
BUG=chromium:500824
LOG=n
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1186333002

Cr-Commit-Position: refs/heads/master@{#29043}
2015-06-16 09:44:28 +00:00
wingo
a1a7cfd6ba All private symbols are own symbols
R=rossberg@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1182303004

Cr-Commit-Position: refs/heads/master@{#29041}
2015-06-16 08:13:42 +00:00
bmeurer
45439b92e7 [crankshaft] Fix wrong bailout points in for-in loop body.
R=jochen@chromium.org
BUG=chromium:500435
LOG=y

Review URL: https://codereview.chromium.org/1183683004

Cr-Commit-Position: refs/heads/master@{#29040}
2015-06-16 08:08:42 +00:00
yangguo
75350f1ef0 Debugger: require debugger to be active when dealing with breaks.
This invariant will save us some head ache.
The changes to test-debug/DebugStub is due to the fact that it abuses
the ability to set break points in code that has no debug break slots.
This is now no longer possible.

R=ulan@chromium.org
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1181013007

Cr-Commit-Position: refs/heads/master@{#29038}
2015-06-16 07:11:21 +00:00
littledan
350a70e5ef Inline code generation for %_IsTypedArray
This patch implements %_IsTypedArray in fullcodegen, Hydrogen and
Turbofan in order to implement fast type checks to enable ES6
TypedArray features and semantics efficiently.

R=adamk,titzer
LOG=Y
BUG=v8:4085

Review URL: https://codereview.chromium.org/1183213002

Cr-Commit-Position: refs/heads/master@{#29033}
2015-06-15 22:16:43 +00:00
littledan
40420f67e7 Allow TypedArrays to be initialized with iterables
In ES6, the TypedArray constructor can be called either with an
array-like object or an iterable. The code previously handled
only array-like objects. This patch switches to supporting
iterables while throwing in an optimization to make Arrays
get allocated the old way, without an extra copy.

BUG=v8:4090
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1181903003

Cr-Commit-Position: refs/heads/master@{#29031}
2015-06-15 18:54:42 +00:00
dusan.milosavljevic
b7d8cb4a51 MIPS: Remove unsafe EmitLoadRegister usage in AddI/SubI for constant right operand.
TEST=test/mjsunit/regress/regress-500176
BUG=chromium:500176
LOG=N

Review URL: https://codereview.chromium.org/1185143002

Cr-Commit-Position: refs/heads/master@{#29030}
2015-06-15 17:58:43 +00:00
dslomov
a7fce18647 [destructuring] Parse binding patterns in formal parameters.
R=arv@chromium.org,wingo@igalia.com,caitpotter88@gmail.com
LOG=N
BUG=v8:811

Review URL: https://codereview.chromium.org/1167393005

Cr-Commit-Position: refs/heads/master@{#29029}
2015-06-15 17:06:47 +00:00
ulan
3938956bdc Remove the --collect-maps flag. Maps should be always collected.
Reasons:
- It is not used.
- It complicates code in GC.

BUG=chromium:499713
LOG=NO

Review URL: https://codereview.chromium.org/1184723002

Cr-Commit-Position: refs/heads/master@{#29027}
2015-06-15 12:28:43 +00:00
balazs.kilvady
a12f119112 MIPS64: Reland 'Enable shorten-64-to-32 warning.'
Port cdc43bc5fd

Original review: https://codereview.chromium.org/1133163005/

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1182193004

Cr-Commit-Position: refs/heads/master@{#29024}
2015-06-15 12:05:19 +00:00
wingo
9efb230d36 Fix -Wsign-compare errors in TF tests under GCC 4.9.2
R=jkummerow@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1191433003

Cr-Commit-Position: refs/heads/master@{#29023}
2015-06-15 12:03:45 +00:00
machenbach
06ac599d1e Revert of Fix clobbered register when setting this_function variable. (patchset #2 id:20001 of https://codereview.chromium.org/1185703002/)
Reason for revert:
[Sheriff] Makes mjsunit/es6/block-const-assign flaky, e.g.:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/4082

Original issue's description:
> Fix clobbered register when setting this_function variable.
>
> R=arv@chromium.org
> TEST=mjsunit/regress/regress-crbug-498022
> BUG=chromium:498022
> LOG=N
>
> Committed: https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91
> Cr-Commit-Position: refs/heads/master@{#29020}

TBR=arv@chromium.org,rossberg@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:498022

Review URL: https://codereview.chromium.org/1184093003

Cr-Commit-Position: refs/heads/master@{#29022}
2015-06-15 11:56:25 +00:00
bmeurer
2cde7dc82e [mjsunit] regress/regress-crbug-491062 takes too long with --always-opt.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1183133002

Cr-Commit-Position: refs/heads/master@{#29021}
2015-06-15 10:27:32 +00:00
mstarzinger
bf2bbc8ba5 Fix clobbered register when setting this_function variable.
R=arv@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1185703002

Cr-Commit-Position: refs/heads/master@{#29020}
2015-06-15 10:18:57 +00:00
bmeurer
d19410f8e7 [mjsunit] Remove unsupported flag --turbo-deoptimization from tests.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1183123002

Cr-Commit-Position: refs/heads/master@{#29018}
2015-06-15 09:43:11 +00:00
bmeurer
e30b351d7b [mjsunit] Remove obsolete nosse2 tests.
R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1186713003

Cr-Commit-Position: refs/heads/master@{#29017}
2015-06-15 09:32:01 +00:00
ulan
143a9e0431 Compute the heap growing factor based on mutator utilization and allocation throughput.
Doc: https://goo.gl/LLGvBs

BUG=

Review URL: https://codereview.chromium.org/1163143009

Cr-Commit-Position: refs/heads/master@{#29015}
2015-06-15 08:32:59 +00:00
yangguo
50be442515 Add test for code caching API.
R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1180113002

Cr-Commit-Position: refs/heads/master@{#29012}
2015-06-15 06:37:02 +00:00
chunyang.dai
8c57b2e16d X87: Disable the test case for X87 since ea2cb139d.
The strong-object-set-proto test cases will throw one expected exception
      and the exception message should include the source position in the JS
      file. But crankshaft compiler does not generate the source position for
      it when creating the flow graph by default. The source position information
      is always zero. So it failed when comparing with the reference file.

      If we use crankshaft compiler on IA32 platform to run this test case, it
      has the same failure.

      we will open these test case for x87 once turbofan for X87 is enabled.

BUG=

Review URL: https://codereview.chromium.org/1179763003

Cr-Commit-Position: refs/heads/master@{#29003}
2015-06-12 15:22:44 +00:00
verwaest
a066202b17 Reland of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1180943002

Cr-Commit-Position: refs/heads/master@{#29000}
2015-06-12 12:39:44 +00:00
ishell
4cc4bc591c Map::TryUpdate() must be in sync with Map::Update().
This CL fixes elements kind transitions handling in Map::TryUpdate().

BUG=v8:4121
LOG=Y

Review URL: https://codereview.chromium.org/1181163002

Cr-Commit-Position: refs/heads/master@{#28999}
2015-06-12 12:36:40 +00:00
wingo
103fcfaa40 Add script context with context-allocated "const this"
This is a reapplication of https://codereview.chromium.org/1173333004.

R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1178903003

Cr-Commit-Position: refs/heads/master@{#28998}
2015-06-12 12:34:24 +00:00
bmeurer
c487aba74c [turbofan] Use appropriate type for NodeId.
Up until now we used int32_t for NodeId, but that was not ideal because
negative values are invalid for NodeId and we use it as an array index
for example in the NodeMarker class, where C++ compilers on x64 have to
generate code that does proper sign extension for the indices, which is
completely unnecessary.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1178403004

Cr-Commit-Position: refs/heads/master@{#28997}
2015-06-12 12:03:19 +00:00
wingo
7063ed2de6 Revert of Add script context with context-allocated "const this" (patchset #2 id:20001 of https://codereview.chromium.org/1173333004/)
Reason for revert:
nosnap failure

Original issue's description:
> Add script context with context-allocated "const this"
>
> This is a reapplication of https://codereview.chromium.org/1179893002/.
>
> R=rossberg@chromium.org,mstarzinger@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/cfc764f4050edc74aef92daa4c39ccc113893968
> Cr-Commit-Position: refs/heads/master@{#28994}

TBR=mstarzinger@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1177903004

Cr-Commit-Position: refs/heads/master@{#28996}
2015-06-12 11:53:11 +00:00
wingo
cfc764f405 Add script context with context-allocated "const this"
This is a reapplication of https://codereview.chromium.org/1179893002/.

R=rossberg@chromium.org,mstarzinger@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1173333004

Cr-Commit-Position: refs/heads/master@{#28994}
2015-06-12 11:11:28 +00:00
bmeurer
b5b00cc031 [turbofan] Move RawMachineAssembler to unittests.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1177353003

Cr-Commit-Position: refs/heads/master@{#28993}
2015-06-12 10:33:19 +00:00
machenbach
32e6455c1a Revert of Add script context with context-allocated "const this" (patchset #7 id:120001 of https://codereview.chromium.org/1179893002/)
Reason for revert:
[Sheriff] Breaks gc mole:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gcmole/builds/2435

Original issue's description:
> Add script context with context-allocated "const this"
>
> R=rossberg@chromium.org
> LOG=N
> BUG=498811
>
> Committed: https://crrev.com/fa32d461c16a053cc6d48d3fb326016bc2765765
> Cr-Commit-Position: refs/heads/master@{#28988}

TBR=rossberg@chromium.org,mstarzinger@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=498811

Review URL: https://codereview.chromium.org/1180043004

Cr-Commit-Position: refs/heads/master@{#28992}
2015-06-12 10:07:34 +00:00
yangguo
74534bb8be Revert of MIPS64: Enable shorten-64-to-32 warning. (patchset #12 id:240001 of https://codereview.chromium.org/1133163005/)
Reason for revert:
Compile failure: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Mac64%20-%20debug/builds/3070/steps/compile/logs/stdio

Original issue's description:
> MIPS64: Enable shorten-64-to-32 warning.
>
> Port cdc43bc5fd
>
> Original commit message:
> Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
> that arise.
>
> BUG=
>
> Committed: https://crrev.com/9af578a7c83b58a0ce25345998d9287cbf2030cb
> Cr-Commit-Position: refs/heads/master@{#28990}

TBR=danno@chromium.org,martyn.capewell@arm.com,paul.lind@imgtec.com,akos.palfi@imgtec.com,dusan.milosavljevic@imgtec.com,jkummerow@chromium.org,machenbach@chromium.org,svenpanne@chromium.org,balazs.kilvady@imgtec.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1182493007

Cr-Commit-Position: refs/heads/master@{#28991}
2015-06-12 09:58:34 +00:00
balazs.kilvady
9af578a7c8 MIPS64: Enable shorten-64-to-32 warning.
Port cdc43bc5fd

Original commit message:
Enable clang's shorten-64-to-32 warning flag on ARM64, and fix the warnings
that arise.

BUG=

Review URL: https://codereview.chromium.org/1133163005

Cr-Commit-Position: refs/heads/master@{#28990}
2015-06-12 09:40:06 +00:00
wingo
fa32d461c1 Add script context with context-allocated "const this"
R=rossberg@chromium.org
LOG=N
BUG=498811

Review URL: https://codereview.chromium.org/1179893002

Cr-Commit-Position: refs/heads/master@{#28988}
2015-06-12 09:35:57 +00:00
machenbach
f2747ed9b4 Revert of [es6] Bound function names (patchset #1 id:1 of https://codereview.chromium.org/1182513002/)
Reason for revert:
[Sheriff] Speculative revert for changing layout tests:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_32/379/layout-test-results/results.html

Exact blame assignment is not possible as our blink bots were in a bad state for a few builds.

Original issue's description:
> [es6] Bound function names
>
> https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind
>
> Bound functions should have a name based on the function that was
> bound.
>
> BUG=N
> LOG=N
> R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/4e2a673881c55a13124dd62f2d05c8d9fe233cd3
> Cr-Commit-Position: refs/heads/master@{#28968}

TBR=adamk@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1186463002

Cr-Commit-Position: refs/heads/master@{#28981}
2015-06-12 06:49:45 +00:00
jacob.bramley
065b2374aa Reland [arm64][turbofan]: Handle any immediate shift.
With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179893003

Cr-Commit-Position: refs/heads/master@{#28977}
2015-06-12 05:03:18 +00:00
martyn.capewell
b702cd97d4 [turbofan] Prefer add/shift over madd on ARM64
Before selecting multiply-accumulate for a multiplication with add operation,
check that the multiply can't be reduced to add-with-shift. This prevents
simple multiplications by 3, 5, etc turning into register moves and madd
instructions.

Review URL: https://codereview.chromium.org/1180863002

Cr-Commit-Position: refs/heads/master@{#28976}
2015-06-12 05:01:07 +00:00
mstarzinger
063079976c [turbofan] Fix throwing conversion inserted by JSTypedLowering.
This fixes the graph wiring of implicit JSToNumber nodes inserted by
JSTypedLowering, to be correctly hooked into a surrounding exceptional
continuation.

R=bmeurer@chromium.org
TEST=mjsunit/compiler/try-binop,test262

Review URL: https://codereview.chromium.org/1178153004

Cr-Commit-Position: refs/heads/master@{#28975}
2015-06-12 04:42:14 +00:00
dehrenberg
cbf9137707 Add ToObject call in Array.prototype.sort
The spec says ToObject is called on the receiver, and this is
observable if you call sort on a primitive. This patch trivially
adds the call and a test.

BUG=v8:4125
R=adamk
LOG=Y

Review URL: https://codereview.chromium.org/1178193004

Cr-Commit-Position: refs/heads/master@{#28972}
2015-06-11 21:43:21 +00:00
arv
5f72593d16 [es6] Make sure we call add property when adding a new property
When setting a property using `super.prop = val` we need to use
add property if we are adding a new property and not set property.

BUG=493566
LOG=N
R=verwaest@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1161073002

Cr-Commit-Position: refs/heads/master@{#28971}
2015-06-11 21:24:41 +00:00
dehrenberg
b23c328f53 In Array.of and Array.from, fall back to DefineOwnProperty
%AddElement is not intended for objects which are not arrays, and
its behavior may go away with future refactorings. This patch gets
rid of it if the receiver of from or of is not the intrinsic Array
object.

Array.of and Array.from previously papered over failures in calling
[[DefineOwnProperty]] when setting array elements. This patch
makes them lead to exceptions, and adds tests to assert that
the appropriate exceptions are thrown.

BUG=v8:4168
R=adamk
CC=rossberg,verwaest
LOG=Y

Review URL: https://codereview.chromium.org/1181623003

Cr-Commit-Position: refs/heads/master@{#28969}
2015-06-11 20:41:04 +00:00
arv
4e2a673881 [es6] Bound function names
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-function.prototype.bind

Bound functions should have a name based on the function that was
bound.

BUG=N
LOG=N
R=adamk   CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1182513002

Cr-Commit-Position: refs/heads/master@{#28968}
2015-06-11 20:36:45 +00:00
verwaest
848b620beb Reland of Use the LookupIterator in SetAccessor (patchset #1 id:1 of https://codereview.chromium.org/1175323004/)
Reason: Didn't break anything

Original issue's description:
> Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)
>
> Reason for revert:
> Blocks reverting of https://codereview.chromium.org/1175973002
>
> Original issue's description:
> > Use the LookupIterator in SetAccessor
> >
> > BUG=v8:4137
> > LOG=n
> >
> > Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> > Cr-Commit-Position: refs/heads/master@{#28955}
>
> TBR=jkummerow@chromium.org,verwaest@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4137
>
> Committed: https://crrev.com/11dbd29de57b290ee8dac2a782a53f879beb416f
> Cr-Commit-Position: refs/heads/master@{#28956}

TBR=jkummerow@chromium.org,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181813002

Cr-Commit-Position: refs/heads/master@{#28967}
2015-06-11 20:20:57 +00:00
Toon Verwaest
91de375868 Restore ExecutableAccessorInfoHandling for now
BUG=v8:4137
LOG=n
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1173283004.

Cr-Commit-Position: refs/heads/master@{#28965}
2015-06-11 20:15:02 +00:00
arv
37e268732d Bound functions should also have configurable length
BUG=v8:4116
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1180873002

Cr-Commit-Position: refs/heads/master@{#28961}
2015-06-11 20:07:15 +00:00
ishell
62d65a347f Revert of Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant. (patchset #3 id:40001 of https://codereview.chromium.org/1178503004/)
Reason for revert:
Blocks revert of https://codereview.chromium.org/1175973002

Original issue's description:
> Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
>
> @yangguo: please look at the debugger part of the CL.
> @ishell: please look at the rest.
>
> Additionally:
> - Ensure the LookupIterator for named properties does not accidentally get indexes in.
> - Fix the return value for typed array assignments to be the incoming value.
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/15aa811f8fe2708a757c3b53ca89db736aa8b222
> Cr-Commit-Position: refs/heads/master@{#28954}

TBR=yangguo@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1181733002

Cr-Commit-Position: refs/heads/master@{#28957}
2015-06-11 17:21:19 +00:00
ishell
11dbd29de5 Revert of Use the LookupIterator in SetAccessor (patchset #2 id:20001 of https://codereview.chromium.org/1178673003/)
Reason for revert:
Blocks reverting of https://codereview.chromium.org/1175973002

Original issue's description:
> Use the LookupIterator in SetAccessor
>
> BUG=v8:4137
> LOG=n
>
> Committed: https://crrev.com/f93276bfe093f576595c5dcac69cf8f9163915d9
> Cr-Commit-Position: refs/heads/master@{#28955}

TBR=jkummerow@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4137

Review URL: https://codereview.chromium.org/1175323004

Cr-Commit-Position: refs/heads/master@{#28956}
2015-06-11 17:20:05 +00:00
verwaest
f93276bfe0 Use the LookupIterator in SetAccessor
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178673003

Cr-Commit-Position: refs/heads/master@{#28955}
2015-06-11 17:04:00 +00:00
verwaest
15aa811f8f Replace SetObjectProperty / DefineObjectProperty with less powerful alternatives where relevant.
@yangguo: please look at the debugger part of the CL.
@ishell: please look at the rest.

Additionally:
- Ensure the LookupIterator for named properties does not accidentally get indexes in.
- Fix the return value for typed array assignments to be the incoming value.

BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1178503004

Cr-Commit-Position: refs/heads/master@{#28954}
2015-06-11 16:37:48 +00:00
verwaest
52f44a8353 Use the LookupIterator for SetElement and friends
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1172683003

Cr-Commit-Position: refs/heads/master@{#28946}
2015-06-11 15:07:16 +00:00
martyn.capewell
1f876f245a [turbofan] Merge sar/shr into MulHigh on ARM64
Merge a following arithmetic or logical right shift into the existing shift
of ARM64's Int32MulHigh or Uint32MulHigh code.

BUG=

Review URL: https://codereview.chromium.org/1179503003

Cr-Commit-Position: refs/heads/master@{#28945}
2015-06-11 14:50:13 +00:00
jacob.bramley
14755c0a2d Revert of [arm64][turbofan]: Handle any immediate shift. (patchset #1 id:1 of https://codereview.chromium.org/1179733004/)
Reason for revert:
Breaks InstructionSelectorTest.Word64ShrWithWord64AndWithImmediate on debug builds (but not optdebug builds). I'll investigate.

Original issue's description:
> [arm64][turbofan]: Handle any immediate shift.
>
> With this patch, we can generate simple immediate-shift instructions for
> immediates outside the range "0 <= imm < width". Several related
> instruction selectors have also been updated accordingly.
>
> Example of generated code:
>
>     ---- Before ---         ---- After ----
>     movz w0, #33            lsr w0, w1, #1
>     lsr  w0, w1, w0
>
> BUG=
>
> Committed: https://crrev.com/36d771bbfa4af5efcc1c1dcf5b234445cb7ee722
> Cr-Commit-Position: refs/heads/master@{#28943}

TBR=bmeurer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1176393002

Cr-Commit-Position: refs/heads/master@{#28944}
2015-06-11 14:46:42 +00:00
jacob.bramley
36d771bbfa [arm64][turbofan]: Handle any immediate shift.
With this patch, we can generate simple immediate-shift instructions for
immediates outside the range "0 <= imm < width". Several related
instruction selectors have also been updated accordingly.

Example of generated code:

    ---- Before ---         ---- After ----
    movz w0, #33            lsr w0, w1, #1
    lsr  w0, w1, w0

BUG=

Review URL: https://codereview.chromium.org/1179733004

Cr-Commit-Position: refs/heads/master@{#28943}
2015-06-11 13:51:03 +00:00
machenbach
896b7d7ee5 [test] Skip slow test.
NOTRY=true

Review URL: https://codereview.chromium.org/1179693005

Cr-Commit-Position: refs/heads/master@{#28941}
2015-06-11 12:26:01 +00:00
yangguo
bd219a7601 Add extras test for calling into runtime.
The alternative of passing an object template at context creation is
unfeasible because we need a context to instantiate the template.
At the time we create the context from snapshot or bootstrap from
scratch, we would already need that template instance, leading to a
chicken-and-egg problem.

This is an alternative that is simpler and less intrusive.

R=domenic@chromium.org, jochen@chromium.org

Review URL: https://codereview.chromium.org/1182443002

Cr-Commit-Position: refs/heads/master@{#28938}
2015-06-11 12:19:50 +00:00
mstarzinger
135f5e68fc [turbofan] Disable failing test262 tests after 84f208949b.
TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1178123002

Cr-Commit-Position: refs/heads/master@{#28937}
2015-06-11 12:18:05 +00:00
mstarzinger
84f208949b [turbofan] Enable support for try-catch statements.
R=bmeurer@chromium.org
BUG=v8:4131
LOG=N

Review URL: https://codereview.chromium.org/1177743002

Cr-Commit-Position: refs/heads/master@{#28935}
2015-06-11 10:50:55 +00:00
machenbach
4e7990d394 Revert of Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1181533006/)
Reason for revert:
[Sheriff] Changes/breaks layout tests. Please land upstream needsmanualrebaseline requests first or fix the tests.

E.g.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/400
One test fails, one times out. See e.g. expectations changes:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Win/400/layout-test-results/inspector/sources/debugger-async/async-callstack-promises-diff.txt

On linux debug theses tests crash:
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/346
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/346/layout-test-results/results.html

Original issue's description:
> Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)
>
> Reason for revert:
> Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.
>
> Original issue's description:
> > Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
> >
> > Reason for revert:
> > Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
> >
> > Original issue's description:
> > > Promise assimilation fix.
> > >
> > > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > > should call |y.then|, but the current implementation calls PromiseChain.
> > > We can see the difference when we set a custom function to |y.then|.
> > >
> > > This CL fixes the spec violation, but as a result |then| is no longer
> > > a wrapper of |chain| and in some cases it does not work well with
> > > |accept| or |chain|. That is not a problem for ES6 promise users because
> > > ES6 promise doesn't have them.
> > >
> > > LOG=N
> > > BUG=477921
> > >
> > > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > > Cr-Commit-Position: refs/heads/master@{#28926}
> >
> > TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=477921
> >
> > Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> > Cr-Commit-Position: refs/heads/master@{#28927}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/6f214bdd8bcdc76d48bd85c3bd897f0e2427ff95
> Cr-Commit-Position: refs/heads/master@{#28928}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181603003

Cr-Commit-Position: refs/heads/master@{#28931}
2015-06-11 09:09:18 +00:00
yangguo
6f214bdd8b Revert of Revert of Promise assimilation fix. (patchset #1 id:1 of https://codereview.chromium.org/1176163004/)
Reason for revert:
Test failures are bogus. Snapshot blob and natives blob are out of sync due to build being weird.

Original issue's description:
> Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
>
> Reason for revert:
> Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829
>
> Original issue's description:
> > Promise assimilation fix.
> >
> > Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> > should call |y.then|, but the current implementation calls PromiseChain.
> > We can see the difference when we set a custom function to |y.then|.
> >
> > This CL fixes the spec violation, but as a result |then| is no longer
> > a wrapper of |chain| and in some cases it does not work well with
> > |accept| or |chain|. That is not a problem for ES6 promise users because
> > ES6 promise doesn't have them.
> >
> > LOG=N
> > BUG=477921
> >
> > Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> > Cr-Commit-Position: refs/heads/master@{#28926}
>
> TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=477921
>
> Committed: https://crrev.com/5bb75f514027f79303396dba823c2d78c6add83b
> Cr-Commit-Position: refs/heads/master@{#28927}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1181533006

Cr-Commit-Position: refs/heads/master@{#28928}
2015-06-11 08:15:32 +00:00
yangguo
5bb75f5140 Revert of Promise assimilation fix. (patchset #8 id:160001 of https://codereview.chromium.org/1098663002/)
Reason for revert:
Test failures: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64/builds/3829

Original issue's description:
> Promise assimilation fix.
>
> Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
> should call |y.then|, but the current implementation calls PromiseChain.
> We can see the difference when we set a custom function to |y.then|.
>
> This CL fixes the spec violation, but as a result |then| is no longer
> a wrapper of |chain| and in some cases it does not work well with
> |accept| or |chain|. That is not a problem for ES6 promise users because
> ES6 promise doesn't have them.
>
> LOG=N
> BUG=477921
>
> Committed: https://crrev.com/2f57dff3ea0c45e1a61b334fda962460f89d71bc
> Cr-Commit-Position: refs/heads/master@{#28926}

TBR=arv@chromium.org,caitpotter88@gmail.com,rossberg@chromium.org,yhirano@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=477921

Review URL: https://codereview.chromium.org/1176163004

Cr-Commit-Position: refs/heads/master@{#28927}
2015-06-11 08:01:15 +00:00
yhirano
2f57dff3ea Promise assimilation fix.
Let x be a fulfilled promise and y be another promise. |x.then(() => y)|
should call |y.then|, but the current implementation calls PromiseChain.
We can see the difference when we set a custom function to |y.then|.

This CL fixes the spec violation, but as a result |then| is no longer
a wrapper of |chain| and in some cases it does not work well with
|accept| or |chain|. That is not a problem for ES6 promise users because
ES6 promise doesn't have them.

LOG=N
BUG=477921

Review URL: https://codereview.chromium.org/1098663002

Cr-Commit-Position: refs/heads/master@{#28926}
2015-06-11 07:42:42 +00:00
mstarzinger
3548c5c6f1 [turbofan] Make IfException projections consume effects.
This is needed in order to allow expansion of a throwing node into a
set of nodes that produce different effects for the successful and the
exceptional continuation.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1179543002

Cr-Commit-Position: refs/heads/master@{#28918}
2015-06-11 04:22:11 +00:00
paul.lind
18f4203577 MIPS: Skip test-heap/TestSizeOfRegExpCode
After https://codereview.chromium.org/1180433003 the code-size exceeeds
the limit for MIPS. We have some optimizations in place for MIPS64 that
will be ported back to MIPS, and will investigate other code-size
improvements so we can re-enable this test.

BUG=

Review URL: https://codereview.chromium.org/1166353005

Cr-Commit-Position: refs/heads/master@{#28913}
2015-06-10 17:47:31 +00:00
weiliang.lin
fa041c90df Make RawMachineAssemblerTest emitting CFG always have a dummy End block
Frame Elider requires a sane CFG which should have such dummy end block.

BUG=

Review URL: https://codereview.chromium.org/1166293004

Cr-Commit-Position: refs/heads/master@{#28911}
2015-06-10 17:37:44 +00:00
wingo
e7a62c2485 Support rest parameters in arrow functions
R=dslomov@chromium.org, rossberg@chromium.org
LOG=Y
BUG=v8:2700

Review URL: https://codereview.chromium.org/1178523002

Cr-Commit-Position: refs/heads/master@{#28908}
2015-06-10 16:11:31 +00:00
balazs.kilvady
f51e507264 MIPS: Replace numeric_limits<>::lowest() in cctest-assembler*.cc
On Mac for the requested minimal version (10.5) only old stl (from gcc 4.2.1) can be used so unfortunately we can't use numeric_limits<>::lowest() which were added in 874c54e05e

BUG=
TEST=cctest/test-assembler-mips64, cctest/test-assembler-mips

Review URL: https://codereview.chromium.org/1175463003

Cr-Commit-Position: refs/heads/master@{#28907}
2015-06-10 15:45:22 +00:00
bmeurer
cf21da7e48 [deoptimizer] Basic support inlining based on SharedFunctionInfo.
Up until now we can only inline based on JSFunction, because of the way
the deoptimization works.  With this change we will be able to inline
based on the SharedFunctionInfo and materialize the JSFunction from a
literal or a stack slot when necessary.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1169103004

Cr-Commit-Position: refs/heads/master@{#28906}
2015-06-10 11:52:49 +00:00
erikcorry
05507cc3ea Reland II of 'Optimize trivial regexp disjunctions' CL 1176453002
This change rewrites regexps like (ab|ac|z|ad|ae|af) into (a[b-f]|z).  We can only reorder disjunctions like this for case-dependent regexps.  For case-independent regexps, the disjunctions should be pre-sorted for best results.

R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1180433003

Cr-Commit-Position: refs/heads/master@{#28902}
2015-06-10 09:55:31 +00:00
mstarzinger
23d7123cff [turbofan] Deprecate NodeProperties::ReplaceWithValue.
This deprecates the aforementioned mutator in favor of a simpler
NodeProperties::ReplaceUses that doesn't perform any relaxation.
Preparation for enabling support for try-catch statements.

R=bmeurer@chromium.org
TEST=unittests/NodePropertiesTest

Review URL: https://codereview.chromium.org/1172773003

Cr-Commit-Position: refs/heads/master@{#28897}
2015-06-10 09:14:03 +00:00
machenbach
71bc7f8793 [test] Fix test archive clobber.
The old version would always clobber.

NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1177503005

Cr-Commit-Position: refs/heads/master@{#28895}
2015-06-10 09:09:04 +00:00
machenbach
8f4cd90e8f [test] Clobber unclean test262-es6 checkouts.
Review URL: https://codereview.chromium.org/1173753004

Cr-Commit-Position: refs/heads/master@{#28894}
2015-06-10 08:31:31 +00:00
binji
4d6c309777 Fix cluster-fuzz bug introduced in refs/heads/master@{#28796}.
Don't DCHECK when neutering that the buffer is not a SharedArrayBuffer;
instead, just return early.

BUG=chromium:498142,chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1174753002

Cr-Commit-Position: refs/heads/master@{#28892}
2015-06-10 07:33:55 +00:00
machenbach
67b169199e Revert of Update Test262 to 5/30 (patchset #4 id:60001 of https://codereview.chromium.org/1136553008/)
Reason for revert:
[Sheriff] Still lots of breakages on some builders. E.g. http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/3313

Original issue's description:
> Update Test262 to 5/30
>
> This updates the test runner to run all tests in both sloppy
> and strict mode.
>
> It also marks the test in the status file as failing in
> sloppy mode even if all it does is marking the test as
> [PASS, FAIL]. A future CL will have to validate that the
> tests pass and fail in the correct mode.
>
> Committed: https://crrev.com/d869f4a4801d4ef6868c266c07f9e29d2e29cba5
> Cr-Commit-Position: refs/heads/master@{#28879}

TBR=rossberg@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1173933002

Cr-Commit-Position: refs/heads/master@{#28890}
2015-06-10 06:36:55 +00:00
machenbach
d3b42573d1 Revert of [test262-es6] Temporary disable some tests (patchset #1 id:1 of https://codereview.chromium.org/1176573002/)
Reason for revert:
[Sheriff] Prepares revert of https://codereview.chromium.org/1136553008

Original issue's description:
> [test262-es6] Temporary disable some tests
>
> These tests have issues with our harness.
>
> Upstream fix: https://github.com/tc39/test262/pull/309
>
> BUG=N
> LOG=N
> TBR=machenbach@chromium.org
>
> Committed: https://crrev.com/eed7363a0da0f21c3eee6c052507299d9b707462
> Cr-Commit-Position: refs/heads/master@{#28881}

TBR=arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=N

Review URL: https://codereview.chromium.org/1169903006

Cr-Commit-Position: refs/heads/master@{#28889}
2015-06-10 06:35:42 +00:00
mstarzinger
eb0593e137 [turbofan] Fix context chain extension for top-level code.
For top-level code the closure passed into context allocation methods
needs to be replaced with a sentinel to canonicalize is to the empty
function object.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4169
BUG=v8:4169
LOG=N

Review URL: https://codereview.chromium.org/1172013002

Cr-Commit-Position: refs/heads/master@{#28888}
2015-06-10 06:03:14 +00:00
erikcorry
9b8a56d433 Revert of Reland of 'Optimize trivial regexp disjunctions' CL 1176453002 (patchset #2 id:20001 of https://codereview.chromium.org/1174713002/)
Reason for revert:
Tree looks like a Christmas tree and this isn't helping

Original issue's description:
> Reland of 'Optimize trivial regexp disjunctions' CL 1176453002
>
> Original code review: https://codereview.chromium.org/1176453002/
>
> TBR=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/85fab0fa092e8d979413f6a61baec3abe26e568d
> Cr-Commit-Position: refs/heads/master@{#28884}

TBR=yangguo@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1172893002

Cr-Commit-Position: refs/heads/master@{#28885}
2015-06-09 23:10:20 +00:00
erikcorry
85fab0fa09 Reland of 'Optimize trivial regexp disjunctions' CL 1176453002
Original code review: https://codereview.chromium.org/1176453002/

TBR=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1174713002

Cr-Commit-Position: refs/heads/master@{#28884}
2015-06-09 21:57:24 +00:00
dehrenberg
51df8df9be Implement %TypedArray%.prototype.slice
The initial implementation of this method takes a couple shortcuts:
- At some points in the spec, we should be making a reference to
  "Table 49" and instead do property lookup on the constructor.
  This is an issue with some other TypedArray methods too.
- The spec indicates that, if constructor and @@species haven't been
  messed with in particular ways, then there should be a memcpy
  from the old to the new. That fast path is not implemented here
  in this patch, but because V8 doesn't canonicalize NaN, the result
  isn't observably different.

BUG=v8:3578
LOG=Y
R=arv

Review URL: https://codereview.chromium.org/1170023002

Cr-Commit-Position: refs/heads/master@{#28882}
2015-06-09 19:40:56 +00:00
Erik Arvidsson
eed7363a0d [test262-es6] Temporary disable some tests
These tests have issues with our harness.

Upstream fix: https://github.com/tc39/test262/pull/309

BUG=N
LOG=N
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1176573002

Cr-Commit-Position: refs/heads/master@{#28881}
2015-06-09 19:10:24 +00:00
ulan
7e53749df0 Make old generation allocation throughput stats independent from the new space allocation throughput.
BUG=

Review URL: https://codereview.chromium.org/1167563005

Cr-Commit-Position: refs/heads/master@{#28880}
2015-06-09 17:49:58 +00:00
arv
d869f4a480 Update Test262 to 5/30
This updates the test runner to run all tests in both sloppy
and strict mode.

It also marks the test in the status file as failing in
sloppy mode even if all it does is marking the test as
[PASS, FAIL]. A future CL will have to validate that the
tests pass and fail in the correct mode.

Review URL: https://codereview.chromium.org/1136553008

Cr-Commit-Position: refs/heads/master@{#28879}
2015-06-09 17:27:27 +00:00
erikcorry
b75bf6cd7e Revert of Optimize trivial regexp disjunctions (patchset #10 id:180001 of https://codereview.chromium.org/1176453002/)
Reason for revert:
ASAN failure

Original issue's description:
> Optimize trivial regexp disjunctions
>
> R=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/5f1f7c15b3207f6c51d187692690aeb09d3e36b5
> Cr-Commit-Position: refs/heads/master@{#28871}

TBR=yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1174603002

Cr-Commit-Position: refs/heads/master@{#28878}
2015-06-09 17:16:01 +00:00
mstarzinger
f45f24d259 [turbofan] Fix one mean typo in kResolvePossiblyDirectEval.
R=titzer@chromium.org
TEST=mjsunit/regress/regress-eval-context

Review URL: https://codereview.chromium.org/1169853006

Cr-Commit-Position: refs/heads/master@{#28877}
2015-06-09 17:14:52 +00:00
mvstanton
662a5585ee Turbofan: Make type feedback vector a Node.
This improves code generation. Before, it was a constant loaded in a register
every time.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1175503002

Cr-Commit-Position: refs/heads/master@{#28874}
2015-06-09 16:02:33 +00:00
erikcorry
5f1f7c15b3 Optimize trivial regexp disjunctions
R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1176453002

Cr-Commit-Position: refs/heads/master@{#28871}
2015-06-09 15:58:00 +00:00
arv
b1c7340275 Revert of Revert of [es6] Parsing of new.target (patchset #1 id:1 of https://codereview.chromium.org/1170263002/)
Reason for revert:
The bot needs to be clobbered.

Original issue's description:
> Revert of [es6] Parsing of new.target (patchset #2 id:20001 of https://codereview.chromium.org/1169853002/)
>
> Reason for revert:
> [Sheriff] fails messages:
> http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/1703
>
> Original issue's description:
> > [es6] Parsing of new.target
> >
> > BUG=v8:3887
> > LOG=N
> > R=adamk@chromium.org, dslomov@chromium.org
> >
> > Committed: https://crrev.com/ae06bdde7763d673b39948b710df414217265cce
> > Cr-Commit-Position: refs/heads/master@{#28865}
>
> TBR=adamk@chromium.org,dslomov@chromium.org,arv@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3887
>
> Committed: https://crrev.com/fe97cfccf3faabbeff87b9b5fbacd7ceb8219304
> Cr-Commit-Position: refs/heads/master@{#28868}

TBR=adamk@chromium.org,dslomov@chromium.org,machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3887

Review URL: https://codereview.chromium.org/1168393008

Cr-Commit-Position: refs/heads/master@{#28870}
2015-06-09 15:43:15 +00:00
machenbach
fe97cfccf3 Revert of [es6] Parsing of new.target (patchset #2 id:20001 of https://codereview.chromium.org/1169853002/)
Reason for revert:
[Sheriff] fails messages:
http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/1703

Original issue's description:
> [es6] Parsing of new.target
>
> BUG=v8:3887
> LOG=N
> R=adamk@chromium.org, dslomov@chromium.org
>
> Committed: https://crrev.com/ae06bdde7763d673b39948b710df414217265cce
> Cr-Commit-Position: refs/heads/master@{#28865}

TBR=adamk@chromium.org,dslomov@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3887

Review URL: https://codereview.chromium.org/1170263002

Cr-Commit-Position: refs/heads/master@{#28868}
2015-06-09 15:12:18 +00:00
arv
ae06bdde77 [es6] Parsing of new.target
BUG=v8:3887
LOG=N
R=adamk@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/1169853002

Cr-Commit-Position: refs/heads/master@{#28865}
2015-06-09 14:28:05 +00:00
wingo
0046ad7997 Stage ES6 arrow functions
R=rossberg@chromium.org
BUG=v8:2700
LOG=Y

Review URL: https://codereview.chromium.org/1166303004

Cr-Commit-Position: refs/heads/master@{#28863}
2015-06-09 13:36:44 +00:00
bmeurer
319667bfbd [frames] Remove obsolete JavaScriptFrame::GetInlineCount() method.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1176473002

Cr-Commit-Position: refs/heads/master@{#28860}
2015-06-09 11:28:22 +00:00
mstarzinger
ce0922bc00 [turbofan] Make Runtime::kSetProperty have a frame state.
R=jarin@chromium.org
TEST=cctest/test-api/AccessCheckThrows

Review URL: https://codereview.chromium.org/1171943003

Cr-Commit-Position: refs/heads/master@{#28859}
2015-06-09 11:11:40 +00:00