Commit Graph

57128 Commits

Author SHA1 Message Date
Lei Zhang
27ed9b4382 Fix MSVC error in WasmModuleBuilder::AddExport().
In a DCHECK inside AddExport(), MSVC gives a C4018 signed/unsigned
mismatch warning. Use a cast to silence this.

Change-Id: Ie388b95b183d2ca3649475fe2206171800673f88
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697043
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Auto-Submit: Lei Zhang <thestig@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62636}
2019-07-11 11:16:12 +00:00
Darius Mercadier
032176246f [heap] Use generic FreeLists
Bug: v8:9329
Change-Id: I28619fef8f206fcb749b8974bb3e7547d6da402e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687423
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62635}
2019-07-11 11:01:03 +00:00
Peter Marshall
c28f7e14ad [cpu-profiler] Fix stack iterability during deopt
Add a bit on the isolate which indicates that the stack is currently
not iterable for the SafeStackFrameIterator.

This is needed during deoptimization, when we do a fast C call without
a return address on the stack, meaning we can't iterate the stack
frames.

Re-enable DeoptAtFirstLevelInlinedSource which is fixed by this CL.

Bug: v8:9057
Change-Id: I76379a2dd38023be7e6f5153edeb1f838e9ac4d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688049
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62634}
2019-07-11 09:23:34 +00:00
Clemens Hammacher
4a348ab5dd Remove AbortJS opcode and builtin
This removes the last remaining use of the AbortJS opcode. We now use
AbortCSAAssert instead, which is not influenced by the
--disable-abortjs flag. The AbortJS runtime function should only be
called from JS now.

R=mstarzinger@chromium.org

Bug: v8:9396
Change-Id: I791da99594f9e1e99991ac8b03e943297d7d41e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695476
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62633}
2019-07-11 09:15:09 +00:00
Michael Starzinger
f71ccd7a2b [wasm] Fix importing of re-exported JavaScript callable.
This fixes a corner-case where a {WasmExportedFunction} that represents
a re-export of a JavaScript callable from another module was identified
correctly, but not all corner-cases were correctly covered. Concretely
we failed to check for function signatures incompatible with JavaScript.

R=ahaas@chromium.org
TEST=mjsunit/regress/wasm/regress-9447
BUG=v8:9447

Change-Id: Ia6c73c82f4c1b9c357c08cde039be6af100727d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690941
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62632}
2019-07-11 09:12:54 +00:00
Jakob Gruber
fa2bed3f74 [regexp] Move the RegExpSpeciesProtector to the native context
Prior to this CL, it was possible to pollute another context's
fast/slow-path state for RegExp builtins due to the species protector
being per-isolate rather than per-context. Among other things, this
means that iframes can slow down the main site, and slowdowns persist
across page reloads and navigation within the same tab.

This CL thus moves the RegExpSpeciesProtector to the native context.

The same should be done for all other protectors in the future.

Bug: chromium:977382, v8:5577, v8:9463
Change-Id: I577f470229cb9dfcd4a88c20b1b9111c65a9b85f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695465
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62631}
2019-07-11 09:08:34 +00:00
Dan Elphick
a61ce8a0d0 Revert "[parsing] Improve elision of hole checks for default parameters"
This reverts commit e8d865973f.

Reason for revert: crbug.com/981701

Original change's description:
> [parsing] Improve elision of hole checks for default parameters
> 
> Use the position of the next parameter to be declared as the end of the
> initializer for default parameters, so that hole checks can be elided
> for initializers using previous parameters in arrow functions.
> 
> This fixes a source of bytecode mismatches when collecting source
> positions lazily.
> 
> Bug: chromium:980422, v8:8510
> Change-Id: I5ab074231248b661156e7d8e47c01685448b56d5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683267
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62525}

TBR=verwaest@chromium.org,delphick@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:980422, v8:8510
Change-Id: I3abd70a1fb00967e58b46177655a0078e24db720
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697242
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62630}
2019-07-11 09:07:29 +00:00
Jakob Kummerow
371dd417be [wasm-c-api] Add reflection test
Change-Id: I7bce20f1f8b0a2ca2fe86cd65905e9ea65134e27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691027
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62629}
2019-07-11 09:06:24 +00:00
Peter Marshall
9c6cb515b8 [cleanup] Remove unused own_buffer_ field in RegExpBytecodeGenerator
We don't use this anywhere, it's always true.

Change-Id: Iae16a108f036de5eddd1b9741e554ddd4eac8c83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692928
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62628}
2019-07-11 09:04:05 +00:00
Andreas Haas
cb024babdd [wasm] Cancel compilation only per context
At the moment we cancel all {AsyncCompileJobs} when a context of an
isolate gets disposed. However, there can be multiple contexts per
isolate, which meant that in some cases we canceled compilations even
though their context was still alive.

With this CL we only abort the compilations of the native context,
which is typically the context that is being disposed.

This is a small change that can be merged back. I plan to do a proper
change later which extends the V8 API so that the embedder provides
a handle to the context that is disposed.

R=clemensh@chromium.org

Bug: chromium:980876
Change-Id: I278bc30f084fe31fa409f1d4f913f1186b4809ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692939
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62627}
2019-07-11 09:03:04 +00:00
Clemens Hammacher
b6b96bf49c [compiler] Remove unneeded conditional
The {FrameScope} with {StackFrame::NONE} just sets the {has_frame_}
field in the {TurboAssembler}, so it's fine to just unconditionally do
that. The field will be reverted to the previous state when the
{FrameScope} dies.

R=mstarzinger@chromium.org

Bug: v8:9396
Change-Id: Iec56a9bd45d19eda689ff033df58928d6edbdcf0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692930
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62626}
2019-07-11 08:13:37 +00:00
Clemens Hammacher
3a8e6fb72f [wasm] Remove non-const arguments from interpreter
R=ahaas@chromium.org

Bug: v8:9429, v8:9396
Change-Id: If26b9a480261c1625b6844b05de5323648ab34b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687544
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62625}
2019-07-11 08:12:17 +00:00
Clemens Hammacher
f41d3a9b89 [CSA] Refactor the CSA_ASSERT macro
This refactors some CSA methods to receive an initializer list instead
of endless parameters, and simplifies the macros used to generate the
respecive calls.

R=tebbi@chromium.org

Bug: v8:9396, v8:7629
Change-Id: I318e785da62f139ed9e70df631c426fe1609a42a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693002
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62624}
2019-07-11 07:54:51 +00:00
Clemens Hammacher
0fd3766b62 [codegen] Remove dead argument to Assembler::stop
The {msg} argument to Assembler::stop is dead since
https://crrev.com/2178093003 (July 2016). This CL removes it.

R=mstarzinger@chromium.org

Bug: v8:9396
Change-Id: I1593361709ab4977760f1ea21e3008797ef99cab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692925
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62623}
2019-07-11 07:29:07 +00:00
Clemens Hammacher
63bcc12775 [compiler] Introduce AbortCSAAssert runtime function
The existing AbortJS runtime function can be disabled via
--disable-abortjs (which the fuzzers use), but we never want to disable
CSA assertions. Hence use a separate runtime function for those.
This will also reduce the size of generated strings, since the
"CSA_ASSERT failed: " prefix is not part of those strings any more.

As a drive-by, this renames all occurences of "DebugAbort" to "AbortJS"
to be consistent in that name.

R=mstarzinger@chromium.org, tebbi@chromium.org

Bug: v8:9453
Change-Id: I52e48032a1d58f296f0364fe8d917e45a2603a2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692921
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62622}
2019-07-11 07:00:51 +00:00
v8-ci-autoroll-builder
754afd63fb Update V8 DEPS.
Rolling v8/build: 6016ce5..40634f1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5cc5f6e..b79dda9

Rolling v8/third_party/depot_tools: 3b07526..d3f6994

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I4b4ce167e5d6cee8ea185c9c9bbdfe0bfa80cd1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1697082
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62621}
2019-07-11 03:59:17 +00:00
jing.bao
e19b3778f9 Fix vtune logging for WASM
Vtune logging for WASM can't work after
https://chromium-review.googlesource.com/c/v8/v8/+/1602700.
This CL adds detection for logger()->is_listening_to_code_events() which is true
with jit_logger_ set under ENABLE_VTUNE_JIT_INTERFACE, because
code_event_dispatcher()->IsListeningToCodeEvents() remains false with
jit_logger_.
Contributed by yolanda.chen@intel.com

Change-Id: I1e6e67345ffbbe30fbf5faa0e344c34e606ec81f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692484
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#62620}
2019-07-11 02:06:07 +00:00
Michael Achenbach
2269913232 [test] Bump shards on slow builder
TBR=tmrts@chromium.org
NOTRY=true

Change-Id: Ief480c6d9c2326a875a57d04bec5ec65f9ff0fe5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695479
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62619}
2019-07-10 14:24:26 +00:00
Mathias Bynens
0ff4b43ec4 Add mathias@chromium.org as DEPS owner for Test262 rolls
NOTRY=true

Bug: v8:7834
Change-Id: Ifc6c807d19d10b447aab6c4f21c1a640fe4f3a10
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695468
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62618}
2019-07-10 13:23:00 +00:00
Clemens Hammacher
5d1c9d5f71 [wasm][fuzzer] Detect stack overflow in interpreter
The {InterpretWasmModuleForTesting} is used to determine whether a
module is cheap enough to execute the compiled code (there is a cap on
the number of executed instructions). If the module executes too much
code, {InterpretWasmModuleForTesting} returns {false}.
The check for a stack overflow was missing though, so it would return
{true} in that case, and the compiled code would be executed. This can
lead to timeouts.

R=ahaas@chromium.org

Bug: chromium:947909
Change-Id: I0b003963d3ca548f388fdf4ec4995c4199656f91
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1693011
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62617}
2019-07-10 09:37:02 +00:00
Michael Starzinger
c0dbde3afd [wasm] Add test for "table.set" with incompatible sig.
This adds test coverage for calling "table.set" with a constructed
{WebAssembly.Function} object that uses a signature incompatible with
JavaScript.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I939d63db85b4eb9cffe5a901efe477397f20f925
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691917
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62616}
2019-07-10 08:41:40 +00:00
Mike Stanton
b1f408fba4 [turbofan] Serialize exception handler table
... for building the TurboFan graph from bytecode concurrently.

Bug: v8:7790
Change-Id: Iceb838990355ee76e2dabb8a00ed5464d41764c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1681120
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62615}
2019-07-10 08:22:00 +00:00
Clemens Hammacher
897b6ba083 Revert "Reland: Serialize native errors"
This reverts commit 8f8ae4f8c3.

Reason for revert: Still failing layout tests: https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Linux%2064/33036

Original change's description:
> Reland: Serialize native errors
> 
> This is a reland of https://crrev.com/c/v8/v8/+/1649257. The original
> change was reverted because it conflicted with a blink-side serialization
> tag.
> 
> Make native errors serializable.
> 
> The implementation is mostly straightforward, but there is one
> exception: the stack property. Although the property is not specified,
> the spec for error cloning asks us to preserve the property if
> possible. This implementation serializes the property only when it is
> a string, and otherwise ignores it.
> 
> Spec: https://github.com/whatwg/html/pull/4665
> Intent-to-Ship: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/f8JngIi8qYs
> 
> Bug: chromium:970079
> Change-Id: Ic1ff07be2c5be415bfb564fa3975bc1a55a06a72
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692366
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62607}

TBR=jbroman@chromium.org,yhirano@chromium.org,szuend@chromium.org

Change-Id: Ia52b3e3997663fc293e9d217e5a56544b28d050d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:970079
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695462
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62614}
2019-07-10 08:17:13 +00:00
Yang Guo
a4b41fd339 Fix build when ICU is not available.
Change-Id: Iabb9e75b62f13a3bd08114941880c1d4a7f74d8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687278
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62613}
2019-07-10 08:10:00 +00:00
Peter Marshall
6b2b60cb02 [cleanup] Rename RegExpMacroAssemblerIrregexp to RegExpBytecodeGenerator
This makes it clearer what this class does, and is more consistent with
the terminology used by ignition (BytecodeGenerator).

Change-Id: I9085f29f437cf15605a5ae971b1fc72d6c79feaa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692923
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62612}
2019-07-10 08:01:10 +00:00
v8-ci-autoroll-builder
909ab89956 Update V8 DEPS.
Rolling v8/build: bd69e87..6016ce5

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/dd686e3..5cc5f6e

Rolling v8/third_party/depot_tools: 92afaf5..3b07526

Rolling v8/third_party/googletest/src: d700357..437e100

Rolling v8/tools/clang: 686128d..7cefad2

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I9eae00dc1607c51f1a4231d5a59a42ced8eb6ed5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1694542
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62611}
2019-07-10 04:14:20 +00:00
Ng Zhi An
f0b9b77dd1 [wasm simd] Fix x64 and ia32 implementation of *.all_true
Bug: v8:9372
Change-Id: Ia25d6a5e1950a89e945cb4fdbdf166bdfb0d3c00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688429
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62610}
2019-07-10 01:35:09 +00:00
Seth Brenith
d2b3eee50e Skip a flaky test
Bug: v8:9337
Change-Id: Ib17a205d1f0d70c0d422dd6cd85239e71355da84
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692195
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62609}
2019-07-09 21:01:34 +00:00
Z Nguyen-Huu
bebca70960 TryPrototypeChainLookup: Bailout for Smi receiver
a77323416a missed a case when receiver is
Smi in TryPrototypeChainLookup.

Bug: chromium:980292, chromium:980226
Change-Id: Ife6be4541d6b280253a7e87cf6f57c96efe8300f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687283
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62608}
2019-07-09 20:12:24 +00:00
Yutaka Hirano
8f8ae4f8c3 Reland: Serialize native errors
This is a reland of https://crrev.com/c/v8/v8/+/1649257. The original
change was reverted because it conflicted with a blink-side serialization
tag.

Make native errors serializable.

The implementation is mostly straightforward, but there is one
exception: the stack property. Although the property is not specified,
the spec for error cloning asks us to preserve the property if
possible. This implementation serializes the property only when it is
a string, and otherwise ignores it.

Spec: https://github.com/whatwg/html/pull/4665
Intent-to-Ship: https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/f8JngIi8qYs

Bug: chromium:970079
Change-Id: Ic1ff07be2c5be415bfb564fa3975bc1a55a06a72
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692366
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62607}
2019-07-09 15:52:44 +00:00
Z Nguyen-Huu
bf1ab278e1 Remove unnecessary DCHECK
This DCHECK is unnecessary because the object can be sealed or frozen
before it is set as a prototype map.

The repro is
Object.seal(Object);// Object is HOLEY_FROZEN_ELEMENTS
const v3 = Object();
v3.__proto__ = Object; // Set prototype map bit and dictionary map bit
const v6 = Object.seal(Object); // Turn Object to DICTIONARY_ELEMENTS

Bug: chromium:980168
Change-Id: Iec50249d0ff0c5ed959201707b837871fcb88a02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687280
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62606}
2019-07-09 15:41:13 +00:00
Tobias Tebbi
7d3c9bce1f [csa][turbofan] Prevent large object allocations unless allowed
The slow-path emitted by the memory optimizer now checks if large
object allocations were allowed before going ahead and allocating
a large object. This is important because manual allocation folding
in CSA must not be performed on a large object.

Bug: v8:9388
Change-Id: I74b840c9c9276bd17611842e0eae7b0e58b142d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1675960
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62605}
2019-07-09 14:30:48 +00:00
Dominik Inführ
54a3636641 [heap] No more old-to-new slot deletion during GC pause
Right trimming of arrays was deleting old-to-new slots during a GC pause.
Disable slots removal for right trimming of arrays and ensure no more slots
are deleted during a GC pause.

Bug: v8:9454
Change-Id: I6268d63b82713d765247dca4aaadadfe275b7dcd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691915
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62604}
2019-07-09 14:22:58 +00:00
Pierre Langlois
f8c2b2101b [turbolizer] Fix keyboard shortcuts in info tab to reveal input/output nodes.
The info tab says that 'i' reveals outputs and 'o' reveals inputs, it should be
the opposite.

Bug: v8:7327
Change-Id: I1bf96653129e14ef315a01dc2c7a3083c9caa5bb
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692929
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Auto-Submit: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62603}
2019-07-09 14:15:52 +00:00
Santiago Aboy Solanes
d4ee39231c [ptr-compr][turbofan] Use Mach Rep information to choose the decompression
Decompressing with Any just chooses one of the decompressions (Signed or
Pointer). Since we already know which decompression it is going to choose,
we save ourselves a whole bunch of instructions by just skipping that.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I0173931536e7ba83fa3572ceb50b176409f0b6c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691916
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62602}
2019-07-09 13:54:38 +00:00
Ana Pesko
9f8463e081 [regexp] Faster duplicate checking for named captures/back references
This CL changes the use of a ZoneList for keeping track of named captures
in a regular expression to a ZoneMap, to optimize finding the named
capture in the structure.

Bug: v8:9423
Change-Id: Id952ac8f86c1dc5d69a3b0251ff724d1509879dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687413
Commit-Queue: Ana Pesko <anapesko@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62601}
2019-07-09 12:53:12 +00:00
Jakob Kummerow
a0da3d5465 [wasm-c-api] Add test for Memory
Change-Id: Ide762b9af9bd23d376025e9b3e6f5ccab7b0f1a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691026
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62600}
2019-07-09 12:49:18 +00:00
Andreas Haas
25e7c9192c [wasm] Implement table.grow and table.size in the interpreter
R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I958c622387e2e3520fae051ae893623238393550
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691021
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62599}
2019-07-09 12:21:08 +00:00
Nico Hartmann
b2a204c7f9 [turbofan] DCHECK use of TypeCheckKind
TypeCheckKind may be propagated only by operators that
can potentially deopt and sit in the effect chain.
This CL introduces a DCHECK to detect that it is not set
for other operators.

Change-Id: I002c7c36ab2d2612a41a2f280927cb85c112b9b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691912
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62598}
2019-07-09 12:16:48 +00:00
Igor Sheludko
b51cddc154 [ptr-compr] Isolatify LookupIterator implementation and friends
Tbr: verwaest@chromium.org
Bug: v8:9353
Change-Id: I8164e2235ca43e203410277b86e6f166010c11d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1687673
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62597}
2019-07-09 12:07:48 +00:00
Andreas Haas
ad9ead7644 [wasm][interpreter] Support indirect function calls through all tables
R=clemensh@chromium.org

Bug: v8:7581
Change-Id: I6fd538f2e90bf5a4addcfe7d8f4b427850ac6fca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690960
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62596}
2019-07-09 11:51:28 +00:00
Tamer Tas
c1c6e3edf7 Revert "[browser-stories] gate features behind {experimental} flag"
This reverts commit 1db33e5fff.

Reason for revert: {AttributeError} 'Namespace' object has no attribute 'experimental'

Original change's description:
> [browser-stories] gate features behind {experimental} flag
> 
> Performance infra recipes use callstats.py to run web page replays. Split (v8,
> infa, perf-infra) repositories make experimenting with callstats.py hard.
> 
> This CL creates feature gating for simplifying performance infra experiments.
> 
> R=​ulan@chromium.org
> 
> No-Try: true
> Bug: v8:9448
> Change-Id: I2c3e139f4b9d6bce1ea4fdda1a44960d74d7d414
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690950
> Auto-Submit: Tamer Tas <tmrts@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Tamer Tas <tmrts@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62565}

TBR=ulan@chromium.org,tmrts@chromium.org

Change-Id: If40be01a2edebf0538ad306fa5ded0dfa2aaf147
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9448
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692922
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62595}
2019-07-09 11:43:30 +00:00
Clemens Hammacher
c762f127bf [disasm] Clean up decoding of immediates
Instead of having hard to read reinterpret_casts all over the place,
extract this to separate methods.

R=mstarzinger@chromium.org

Bug: v8:9396
Change-Id: Id8d47b5dda8f5b32dedfe9f76c4f526ffcff0674
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691024
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62594}
2019-07-09 10:40:30 +00:00
Mike Stanton
4d40e867f0 [turbofan] Serialize source position table
... for concurrent graph building.

This is a reland of jarin@chromium.org's CL
https://chromium-review.googlesource.com/c/v8/v8/+/1682027

with support to access the source positions through a handle
when running without concurrent inlining, because the positions
may move due to GC allocation.

Bug: v8:7790
Change-Id: I1b2cc84c8cb801cb82f1a527fce736c74c156c1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683726
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62593}
2019-07-09 10:35:48 +00:00
Clemens Hammacher
c52eefe932 [d8] Remove non-const reference arguments
R=jgruber@chromium.org

Bug: v8:9429, v8:9396
Change-Id: I0e51e8478d7232bc51bed26bc26560c6e6450366
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690946
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62592}
2019-07-09 10:13:19 +00:00
Jakob Gruber
1b06c23b14 [regexp] Handle large named capture groups object
The name dictionary allocated to store named captures on the regexp
result object could be too large for regular heap spaces and
ConstructNewResultFromMatchInfo must thus also handle the large object
case.

Bug: chromium:980891
Change-Id: Ia1dbecd0a9d9d6b39f80e77680386c385d95c97c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1691907
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62591}
2019-07-09 09:28:46 +00:00
Mike Stanton
c134e421a2 [TurboFan] Don't cache tagged templates in the feedback vector
In the rare case that a tagged template is not initialized before
optimization time, we currently cache this created template in the
feedback vector. If we stop doing this, we simplify the interface
usefully for concurrent compilation and pay little for it.

Bug: v8:7790
Change-Id: Ifc82b0eb931a706767596febd4f4b312e167fd25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690837
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62590}
2019-07-09 08:56:40 +00:00
Yutaka Hirano
925b17ba2f Revert "Serialize native errors"
This reverts commit 85bc4ef6c2.

Reason for revert: The tag 'e' conflicts with a blink serialization tag: kFileIndexTag.

Original change's description:
> Serialize native errors
> 
> Make native errors serializable.
> 
> The implementation is mostly straightforward, but there is one
> exception: the stack property. Although the property is not specified,
> the spec for error cloning asks us to preserve the property if
> possible. This implementation serializes the property only when it is
> a string, and otherwise ignores it.
> 
> Spec: https://github.com/whatwg/html/pull/4665
> Intent-to-Ship: <TBD>
> 
> Bug: chromium:970079
> Change-Id: I7f36b8b4fc5dff22d726d849ccfb9748d0888365
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649257
> Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62584}

TBR=jbroman@chromium.org,yhirano@chromium.org,adamk@chromium.org,domenic@chromium.org,szuend@chromium.org

Change-Id: Ia0cc902eaa1419cdb0cfec377d8a40fa914612c9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:970079
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1692365
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62589}
2019-07-09 08:49:07 +00:00
Ulan Degenbaev
c8fbe8e837 [heap] Fix cpplint 'runtime/references' warnings
This replaces non-const reference arguments by pointers.

Bug: v8:9429
Change-Id: I5e5d94b020dedf3005f8d74202d31e3a50bdf754
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690943
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62588}
2019-07-09 08:48:02 +00:00
Patrick Thier
17b9d8728a [regexp] Add missing case for EscapeRegExpPattern
EscapeRegExpPattern should return a string representation of a
RegExp instance that in turn can be used to construct a new
RegExp instance with the same internal state as the original one.

Previous versions incorrectly escaped '/' also inside character classes
(e.g. /[/]/ returned "[\/]").

This patch properly escapes '/' when necessary and omits unnecessary
escapes.

Bug: v8:8615, v8:1982, v8:9446
Change-Id: I4ecb993dc69d6976f4637cedf43465cd0c32e427
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1688050
Commit-Queue: Patrick Thier <pthier@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62587}
2019-07-09 08:11:51 +00:00