Commit Graph

34634 Commits

Author SHA1 Message Date
gsathya
1f80f66de0 [promises] update deferred reactions symbol
The behavior was changed in https://codereview.chromium.org/2357423002

Review-Url: https://codereview.chromium.org/2403163002
Cr-Commit-Position: refs/heads/master@{#40142}
2016-10-10 22:59:48 +00:00
littledan
6e95a8f0a6 Enable previously DCHECK-failing test
R=adamk
BUG=v8:5337

Review-Url: https://codereview.chromium.org/2313873003
Cr-Commit-Position: refs/heads/master@{#40141}
2016-10-10 22:20:38 +00:00
adamk
c0550b4cf4 Remove now-unused string_iterator symbols
These were used by the JS implementation, but are now dead code.

R=caitp@igalia.com
BUG=v8:5388

Review-Url: https://codereview.chromium.org/2410533002
Cr-Commit-Position: refs/heads/master@{#40140}
2016-10-10 19:46:34 +00:00
kozyatinskiy
085a445775 [inspector] fix minor issue in test/inspector.gyp
* Inspector should depend on v8_libbase, v8 depedency is added in conditions section.
* Inlined sources since they aren't used outside of this gyp file.

BUG=chromium:635948
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2408833002
Cr-Commit-Position: refs/heads/master@{#40139}
2016-10-10 19:08:46 +00:00
heimbuef
a96c2129af Replaced different means of zone pooling/reusing by one zone segment pool
BUG=v8:5409

Committed: https://crrev.com/a124feb0760896c8be61de08004a08c3bc9b4b3f
Committed: https://crrev.com/fc840361e357a571c709e0239ae82cc089800b3f
Review-Url: https://codereview.chromium.org/2348303002
Cr-Original-Original-Commit-Position: refs/heads/master@{#39633}
Cr-Original-Commit-Position: refs/heads/master@{#40048}
Cr-Commit-Position: refs/heads/master@{#40138}
2016-10-10 19:00:55 +00:00
heimbuef
f29f3e3208 Pool implementation for zone segments
BUG=v8:5409

Committed: https://crrev.com/37c688a24578e787d3d8941093563ed049c3497e
Committed: https://crrev.com/316669f62ea3834395bf4caab7bc3d7c32f6bbc6
Review-Url: https://codereview.chromium.org/2335343007
Cr-Original-Original-Commit-Position: refs/heads/master@{#39631}
Cr-Original-Commit-Position: refs/heads/master@{#40044}
Cr-Commit-Position: refs/heads/master@{#40137}
2016-10-10 18:03:55 +00:00
bradnelson
b884a51ff2 Re-enable fasta on gc_stress.
BUG=v8:5053
TEST=None
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2395333003
Cr-Commit-Position: refs/heads/master@{#40136}
2016-10-10 17:59:32 +00:00
titzer
d46c790ef3 [asmjs] Move switch-logic.h to asmjs/ directory.
R=bradnelson@chromium.org,aseemgarg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2408823002
Cr-Commit-Position: refs/heads/master@{#40135}
2016-10-10 17:57:47 +00:00
neis
8c575ac64c [modules] Update test262 config and status file.
- Make testcfg.py ignore files ending in "_FIXTURE.js", which are not supposed
  to be tested standalone but only as imports to other modules.

- Refine test262.status to match where we are with the modules implementation.

BUG=v8:1569
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2400713004
Cr-Commit-Position: refs/heads/master@{#40134}
2016-10-10 17:38:56 +00:00
adamk
9cf8fce74c [modules] Store Module metadata in per-Context EmbedderData
Unifies the approaches used for storing the specifier -> module mapping
and the module -> directory mapping, using std::unordered_maps for both
and storing them per-Context.

This requires adding a method to the v8::Module API to get a hash code
for a Module, but allows slimming down the API in return: gone are
SetEmbedderData/GetEmbedderData, along with the fourth argument
to ResolveModuleCallback.

Besides a simpler API, this allows d8 to get closer to the HTML loader,
which requires each Realm to have a persistent module map (though this
capability is not yet exercised by any tests).

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2393303002
Cr-Commit-Position: refs/heads/master@{#40133}
2016-10-10 17:37:51 +00:00
mlippautz
e37fbcc3ea [heap] Remove dead write write barrier counter code
R=ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2409553003
Cr-Commit-Position: refs/heads/master@{#40132}
2016-10-10 17:02:23 +00:00
adamk
ed45f5903c Fix bad reinterpret_cast of StringFromCodePointOperator
StringFromCodePointOperator needed to derive from Operator1<UnicodeEncoding>
rather than plain old Operator. This was thankfully caught by the CFI build.

R=bmeurer@chromium.org, caitp@chromium.org
BUG=v8:5498

Review-Url: https://codereview.chromium.org/2398403003
Cr-Commit-Position: refs/heads/master@{#40131}
2016-10-10 16:59:03 +00:00
gsathya
7d336218bf [regexp] Remove unused InternalPackedArray
Review-Url: https://codereview.chromium.org/2397373004
Cr-Commit-Position: refs/heads/master@{#40130}
2016-10-10 16:57:57 +00:00
neis
9606a938a6 [modules] Extend a namespace test.
Extend a test of namespace imports such that it accesses the object inside a
with statement (inside a sloppy function).

Drive-by-fix: remove duplicate initialization of embedder data (probably due to
bad merge).

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2405603003
Cr-Commit-Position: refs/heads/master@{#40129}
2016-10-10 16:56:36 +00:00
mythria
853e176f29 Revert of [Interpreter] Collect feedback about Oddballs in Subtract Stub. (patchset #2 id:20001 of https://codereview.chromium.org/2406843002/ )
Reason for revert:
breaks win32-debug bot.

Original issue's description:
> [Interpreter] Collect feedback about Oddballs in Subtract Stub.
>
> BUG=v8:4280, v8:5400
> LOG=N
>
> Committed: https://crrev.com/d5d283b27d406486e2f8d7b44c6d2b3db4f98458
> Cr-Commit-Position: refs/heads/master@{#40124}

TBR=leszeks@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:5400

Review-Url: https://codereview.chromium.org/2407923002
Cr-Commit-Position: refs/heads/master@{#40128}
2016-10-10 16:39:16 +00:00
petermarshall
8b48aa1cda [builtins] Move StringIncludes to a builtin.
Also add a test for when the first argument is null or undefined, as there are no tests that cover this currently.

BUG=v8:5364

Review-Url: https://codereview.chromium.org/2399423003
Cr-Commit-Position: refs/heads/master@{#40127}
2016-10-10 15:01:32 +00:00
mtrofin
b75a0c4a55 [wasm] Fix wasm instantiation flakes
The spurious failures were caused by the compiled module
template and its corresponding owning object getting out of
sync due to memory allocations (which may trigger GC)
between the points each were fetched.

Specifically, the {original} was first obtained; then a GC
may happen when cloning the {code_table}. At this point,
the {original}'s owner may have been collected, getting us
down the path of not cloning. When time comes to patch up
globals, we incorrectly try to patch them assuming the
global start is at 0 (nullptr), which in fact it isn't.

This change roots early, in a GC-free area, both objects.
Additionally, it avoids publishing to the instances chain
the new instance until the very end. This way:
- the objects used to create the new instance offer a
consistent view
- the instances chain does not see the object we try to
form. If something fails, we can safely retry.
- since the owner is rooted, the state of the front of the
instances chain stays unchanged - with the same compiled
module we started from. So the early belief that we needed
to clone is not invalidated by any interspersed GC.

This situation suffers from a sub-optimality discussed in
the design document, in that, in a memory constrained
system, the following snippet may surprisingly fail:

var m = new WebAssembly.Module(...);
var i1 = new WebAssembly.Instance(m);
i1 = null;
var i2 = new WebAssembly.Instance(m); //may fail.

This will be addressed subsequently.

BUG=v8:5451

Review-Url: https://codereview.chromium.org/2395063002
Cr-Commit-Position: refs/heads/master@{#40126}
2016-10-10 14:53:58 +00:00
titzer
d20dabb090 [wasm] Base address for data segments can also be the value of a global variable.
R=rossberg@chromium.org
BUG=chromium:575167
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux64_msan_rel

Committed: https://crrev.com/640ae3f9d20dcae915dbfa978bf48944cd4d0dc3
Review-Url: https://codereview.chromium.org/2403823002
Cr-Original-Commit-Position: refs/heads/master@{#40121}
Cr-Commit-Position: refs/heads/master@{#40125}
2016-10-10 14:42:10 +00:00
mythria
d5d283b27d [Interpreter] Collect feedback about Oddballs in Subtract Stub.
BUG=v8:4280, v8:5400
LOG=N

Review-Url: https://codereview.chromium.org/2406843002
Cr-Commit-Position: refs/heads/master@{#40124}
2016-10-10 14:22:26 +00:00
machenbach
a6fb296a78 Revert of [wasm] Base address for data segments can also be the value of a global variable. (patchset #1 id:1 of https://codereview.chromium.org/2403823002/ )
Reason for revert:
msan not happy:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/11332

Original issue's description:
> [wasm] Base address for data segments can also be the value of a global variable.
>
> R=rossberg@chromium.org
> BUG=chromium:575167
>
> Committed: https://crrev.com/640ae3f9d20dcae915dbfa978bf48944cd4d0dc3
> Cr-Commit-Position: refs/heads/master@{#40121}

TBR=rossberg@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2402373002
Cr-Commit-Position: refs/heads/master@{#40123}
2016-10-10 14:12:52 +00:00
jgruber
80f3c6ce77 [regexp] Port test, match, and search
This CL ports RegExp.prototype.test, RegExp.prototype.match
and RegExp.prototype.search to C++.

Performance regressions are expected but should be improved
in an upcoming CL.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2394713003
Cr-Commit-Position: refs/heads/master@{#40122}
2016-10-10 13:57:20 +00:00
titzer
640ae3f9d2 [wasm] Base address for data segments can also be the value of a global variable.
R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2403823002
Cr-Commit-Position: refs/heads/master@{#40121}
2016-10-10 13:26:26 +00:00
jochen
879fac3b56 Always use FinalizeUnoptimizedCompilationJob
Before, some code paths just invoked job->FinalizeJob() and then
manually installed the compilation result. Unify these.

BUG=v8:5394
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2399203003
Cr-Commit-Position: refs/heads/master@{#40120}
2016-10-10 13:12:40 +00:00
jgruber
67bcc7f6dc [regexp] Port RegExpCompile and RegExpToString
Again, fast paths could be added for unmodified JSRegExp instances.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2392463005
Cr-Commit-Position: refs/heads/master@{#40119}
2016-10-10 13:06:39 +00:00
petermarshall
407b479d23 Revert of [builtins] Move StringIncludes to a builtin. (patchset #4 id:60001 of https://codereview.chromium.org/2399423003/ )
Reason for revert:
String.includes crashes when called with null or undefined as the first param

Original issue's description:
> [builtins] Move StringIncludes to a builtin.
>
> BUG=v8:5364
>
> Committed: https://crrev.com/b374d719e79a5b32168c25c0cda30056f5e6e36c
> Cr-Commit-Position: refs/heads/master@{#40110}

TBR=franzih@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5364

Review-Url: https://codereview.chromium.org/2407793002
Cr-Commit-Position: refs/heads/master@{#40118}
2016-10-10 11:27:30 +00:00
bbudge
5c4298a0ae [Turbofan] Allow FP operands and vregs in InstructionSequenceTest.
- Adds an optional representation field to VReg and TestOperand structs.
- Adds a simple FP allocation test to register-allocator-unittest.cc.
- Adds some simple FP tests to move-optimizer-unittest.cc.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2400513002
Cr-Commit-Position: refs/heads/master@{#40117}
2016-10-10 11:07:01 +00:00
zhengxing.li
749570ed71 X87: [heap] New heuristics for incremental marking step size.
port 1beb89f24c (r39827)

  original commit message:
  This patch simplifies code for speeding up marking and
  removes write barrier counter.

  The step size is now computed based in two parts:
  - bytes to mark in order to keep up with allocation,
  - bytes to mark in order to make progress.

BUG=

Review-Url: https://codereview.chromium.org/2407733003
Cr-Commit-Position: refs/heads/master@{#40116}
2016-10-10 09:54:38 +00:00
machenbach
1bcb42ae36 [build] Make Android builds depend on catapult for using the test runner.
Costs ~600MB, but only if target_os is android - and the
android_tools already require ~7.4GB.

BUG=chromium:654353
NOTRY=true

Review-Url: https://codereview.chromium.org/2408633002
Cr-Commit-Position: refs/heads/master@{#40115}
2016-10-10 09:48:03 +00:00
Michael Achenbach
a7837712c3 Whitespace change to trigger bots.
Cr-Commit-Position: refs/heads/master@{#40114}
2016-10-10 09:44:25 +00:00
zhengxing.li
b600ea0672 X87: Skip MultiReturnSelect_f32/MultiReturnSelect_f64 tests.
The CL #39795 (https://codereview.chromium.org/2345593003 ) added MultiReturnSelect_f32/MultiReturnSelect_f64 tests.
  Because those tests need 2 float point return registers and x87 only has 1 FP return register, Those tests failed at x87 port.

  This CL skips MultiReturnSelect_f32/MultiReturnSelect_f64 tests for x87.

BUG=

Review-Url: https://codereview.chromium.org/2405743002
Cr-Commit-Position: refs/heads/master@{#40113}
2016-10-10 09:30:51 +00:00
marja
e474e5ffc8 PreParsing inner functions: Fix declaration-only variables, part 2.
If an inner function only declares a variable but doesn't use it, Parser
and PreParser produced different unresolved variables, and that confused
the pessimistic context allocation.

This is continuation to https://codereview.chromium.org/2388183003/

This CL fixes more complicated declarations (which are not just one
identifier). For this, PreParser needs to accumulate identifiers used
in expressions.

In addition, this CL manifests FLAG_lazy_inner_functions in tests, so that
we get clusterfuzz coverage for it.

BUG=chromium:650969, v8:5501

Review-Url: https://codereview.chromium.org/2400613003
Cr-Commit-Position: refs/heads/master@{#40112}
2016-10-10 09:22:34 +00:00
jochen
c59cf8cd21 Turn libplatform into a component
BUG=v8:5412
R=jgruber@chromium.org,machenbach@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_compile_dbg_ng;master.tryserver.chromium.android:android_clang_dbg_recipe

Review-Url: https://codereview.chromium.org/2372983003
Cr-Commit-Position: refs/heads/master@{#40111}
2016-10-10 08:52:06 +00:00
petermarshall
b374d719e7 [builtins] Move StringIncludes to a builtin.
BUG=v8:5364

Review-Url: https://codereview.chromium.org/2399423003
Cr-Commit-Position: refs/heads/master@{#40110}
2016-10-10 08:31:43 +00:00
bmeurer
f6bd23f244 [turbofan] Enforce native context specialization.
There were once plans to generate cross-context code with TurboFan,
however that doesn't fit into the model anymore, and so all of this
is essentially dead untested code (and thus most likely already broken
in subtle ways). With this mode still in place it would also be a lot
harder to make inlining based on SharedFunctionInfo work.

BUG=v8:2206,v8:5499
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2406803002
Cr-Commit-Position: refs/heads/master@{#40109}
2016-10-10 05:53:51 +00:00
mtrofin
cc02e74320 [wasm] Avoid copying when deserializing wasm
Updated the deserialization API to avoid copying uncompiled
bytes.

BUG=

Review-Url: https://codereview.chromium.org/2404673002
Cr-Commit-Position: refs/heads/master@{#40108}
2016-10-10 04:12:45 +00:00
v8-autoroll
520d33d5c7 Update V8 DEPS.
Rolling v8/build: 472d19e..17093d4

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2401273002
Cr-Commit-Position: refs/heads/master@{#40107}
2016-10-09 03:36:09 +00:00
mvstanton
70bb93778d [turbofan] HeapConstant types should compare by handle address
And not by pointer address.

BUG=

Review-Url: https://codereview.chromium.org/2390823011
Cr-Commit-Position: refs/heads/master@{#40106}
2016-10-08 16:51:53 +00:00
Michael Achenbach
f12d66bf97 Whitespace change to trigger bots.
Cr-Commit-Position: refs/heads/master@{#40105}
2016-10-08 09:44:47 +00:00
v8-autoroll
9231faf497 Update V8 DEPS.
Rolling v8/base/trace_event/common: e0fa02a..b403fa6

Rolling v8/build: 792a87c..472d19e

Rolling v8/tools/clang: 30c5a8b..36879c7

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2405683002
Cr-Commit-Position: refs/heads/master@{#40104}
2016-10-08 03:37:32 +00:00
adamk
2c60ecf6e4 Skip some mozilla tests on turbofan_opt as they consistently timeout
These tests were marked as NO_VARIANTS under debug, but they were timing
out under turbofan_opt as well on the CFI bot (see, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20cfi/builds/6765).

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2400463003
Cr-Commit-Position: refs/heads/master@{#40103}
2016-10-07 22:41:42 +00:00
adamk
2d4871c143 [modules] Give Module an internal [hash] field
This allows us to stop using a Symbol, set as the name of the Module's
SharedFunctionInfo, as our storage for a hash.

As part of this, centralize the code for generating a random, non-zero
hash code in one place (there were previously two copies of this code,
and I needed to call it from a third file).

BUG=v8:5483
TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2395233003
Cr-Commit-Position: refs/heads/master@{#40102}
2016-10-07 22:29:20 +00:00
kozyatinskiy
3b6c7f04a9 [inspector] fixed one more size_t -> int conversion
This problem was detected only on linux64_gyp bot.
It's safe to convert length string into int from size_t.

R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2402583004
Cr-Commit-Position: refs/heads/master@{#40101}
2016-10-07 22:16:04 +00:00
hablich
f28e5dcbc4 Revert of Pool implementation for zone segments (patchset #13 id:520001 of https://codereview.chromium.org/2335343007/ )
Reason for revert:
blocks roll: https://build.chromium.org/p/tryserver.chromium.win/builders/win_chromium_x64_rel_ng/builds/294283/steps/compile%20%28with%20patch%29/logs/stdio

Original issue's description:
> Pool implementation for zone segments
>
> BUG=v8:5409
>
> Committed: https://crrev.com/37c688a24578e787d3d8941093563ed049c3497e
> Committed: https://crrev.com/316669f62ea3834395bf4caab7bc3d7c32f6bbc6
> Cr-Original-Commit-Position: refs/heads/master@{#39631}
> Cr-Commit-Position: refs/heads/master@{#40044}

TBR=jochen@chromium.org,jkummerow@chromium.org,verwaest@chromium.org,yangguo@chromium.org,heimbuef@google.com
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
BUG=v8:5409

Review-Url: https://codereview.chromium.org/2400343002
Cr-Commit-Position: refs/heads/master@{#40100}
2016-10-07 21:19:17 +00:00
hablich
25b4347507 Revert of Replaced different means of zone pooling/reusing by one zone segment pool (patchset #5 id:160001 of https://codereview.chromium.org/2348303002/ )
Reason for revert:
related to roll blocker: https://codereview.chromium.org/2400343002/

Original issue's description:
> Replaced different means of zone pooling/reusing by one zone segment pool
>
> BUG=v8:5409
>
> Committed: https://crrev.com/a124feb0760896c8be61de08004a08c3bc9b4b3f
> Committed: https://crrev.com/fc840361e357a571c709e0239ae82cc089800b3f
> Cr-Original-Commit-Position: refs/heads/master@{#39633}
> Cr-Commit-Position: refs/heads/master@{#40048}

TBR=mstarzinger@chromium.org,verwaest@chromium.org,heimbuef@google.com
NOTRY=true
NOPRESUBMIT=true
NOTREECHECKS=true
BUG=v8:5409

Review-Url: https://codereview.chromium.org/2401163002
Cr-Commit-Position: refs/heads/master@{#40099}
2016-10-07 21:18:13 +00:00
kozyatinskiy
2d5cc49b72 [inspector] don't use String16 in inspector test runner
String16 is not public part of src/inspector. All usage are replaced with vector of char/unit16_t to avoid potential linker problems.

BUG=chromium:635948
R=dgozman@chromium.org,machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2403493002
Cr-Commit-Position: refs/heads/master@{#40098}
2016-10-07 21:16:55 +00:00
hablich
234f1a84b7 Revert of [parser] Deprecate ParseInfo constructor taking closure. (patchset #2 id:20001 of https://codereview.chromium.org/2396963003/ )
Reason for revert:
Needed to revert https://codereview.chromium.org/2400343002/

Original issue's description:
> [parser] Deprecate ParseInfo constructor taking closure.
>
> This removes the {ParseInfo} constructor consuming a closure, replacing
> all uses to pass only the shared function info. The goal is to make the
> fact that parsing is independent of a concrete closure explicit.
>
> R=jochen@chromium.org
> BUG=v8:2206
>
> Committed: https://crrev.com/3de42b3f224217ec88e4c609d3cf23fe06806dca
> Cr-Commit-Position: refs/heads/master@{#40083}

TBR=jochen@chromium.org,bmeurer@chromium.org,marja@chromium.org,yangguo@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2206

Review-Url: https://codereview.chromium.org/2406623002
Cr-Commit-Position: refs/heads/master@{#40097}
2016-10-07 21:13:34 +00:00
neis
57ba0ae10e [modules] Implement namespace imports.
This implements namespace imports (import * as foo from "bar"), except for the
@@iterator property on namespace objects (to be done later).

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2388153003
Cr-Commit-Position: refs/heads/master@{#40096}
2016-10-07 19:37:28 +00:00
adamk
707934cf9e [cleanup] Remove dead code from Variable and simplify PatternRewriter slightly
Both bits of code were pointed out by our test coverage tools.

R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2394403002
Cr-Commit-Position: refs/heads/master@{#40095}
2016-10-07 18:53:19 +00:00
jbroman
0004733c08 ValueSerializer: Add more checks before trying to allocate memory for a dense array.
Found with libfuzzer. The length is automatically converted to int (thus
large sizes could become negative, even though they are legal "array sizes").
Besides that, the length is coerced to a SMI (which is an even tighter
constraint on 32-bit systems, where it limits the legal sizes to 2^30 - 1).

Add checks that the length of a dense array is below that threshold, and also
fail fast if a length that is provided obviously could not be the correct dense
length (because there isn't enough data left in the buffer to populate such an
array).

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2399873002
Cr-Commit-Position: refs/heads/master@{#40094}
2016-10-07 17:53:23 +00:00
petermarshall
58529ed3a0 [builtins] Move StringIndexOf to a C++ builtin.
BUG=v8:5364

Review-Url: https://codereview.chromium.org/2350963004
Cr-Commit-Position: refs/heads/master@{#40093}
2016-10-07 17:04:12 +00:00