Commit Graph

44000 Commits

Author SHA1 Message Date
Clemens Hammacher
3380e9a4d9 Reland "[wasm] Unify deoptimization data"
This is a reland of 236298acbf.

Original change's description:
> [wasm] Unify deoptimization data
>
> Add methods to add deoptimization data and use them from all the places
> where we currently add them manually. Also add them to wasm-to-wasm
> wrappers compiled on table set, which was missing before, leading to
> the referenced bug.
>
> R=ahaas@chromium.org
>
> Bug: chromium:779292
> Change-Id: Ib9132d9faeb1092c46e22dd8196d201ce5c0942f
> Reviewed-on: https://chromium-review.googlesource.com/774838
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49452}

Bug: chromium:779292
Change-Id: I8219305fc894c50904db57e51245733f6613dcd3
Reviewed-on: https://chromium-review.googlesource.com/778159
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49508}
2017-11-20 17:37:01 +00:00
Michael Achenbach
b5bdb762ac Revert "[test] Add Liftoff variant"
This reverts commit 712fa67554.

Reason for revert: Infra side change was reverted. Please reland
after it stays in for a bot cycle...

Original change's description:
> [test] Add Liftoff variant
> 
> Add a variant for testing the current state of the Liftoff
> implementation.
> This variant will only run on a subset of the bots, just like the
> --future variant.
> 
> R=​machenbach@chromium.org, hablich@chromium.org
> 
> Bug: v8:7088, v8:6600
> Change-Id: If49fad3a8ed579356504b821a787326754f24e78
> Reviewed-on: https://chromium-review.googlesource.com/779420
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49504}

TBR=machenbach@chromium.org,hablich@chromium.org,clemensh@chromium.org

Change-Id: Ib6b2e79cea5d9f99f8933c72bbb9d9dddbd6ae07
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7088, v8:6600
Reviewed-on: https://chromium-review.googlesource.com/779719
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49507}
2017-11-20 17:35:58 +00:00
Brad Nelson
fa268032fc [wasm] Disallow calling wasm constructors without new.
BUG=chromium:786021
R=titzer@chromium.org

Change-Id: I188ea4d639ef9d5ceeab5052e043ec1c9150bd77
Reviewed-on: https://chromium-review.googlesource.com/778282
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49506}
2017-11-20 17:34:51 +00:00
Peter Marshall
d8981833eb reland: [heap] Concurrently free ArrayBuffer allocations.
Free ArrayBuffer backing stores on a background thread, rather than
blocking the main thread after processing. Could potentially cause
contention with the array buffer allocator once JS execution resumes.

The new ArrayBufferCollector class tracks these dead allocations.

Later, the processing of array buffers can happen in parallel.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux64_tsan_rel;master.tryserver.v8:v8_linux64_tsan_concurrent_marking_rel_ng;master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Bug: v8:6992
Change-Id: I2b74f008f79521414374f607ed510f66508af160
Reviewed-on: https://chromium-review.googlesource.com/779182
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49505}
2017-11-20 17:31:56 +00:00
Clemens Hammacher
712fa67554 [test] Add Liftoff variant
Add a variant for testing the current state of the Liftoff
implementation.
This variant will only run on a subset of the bots, just like the
--future variant.

R=machenbach@chromium.org, hablich@chromium.org

Bug: v8:7088, v8:6600
Change-Id: If49fad3a8ed579356504b821a787326754f24e78
Reviewed-on: https://chromium-review.googlesource.com/779420
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49504}
2017-11-20 17:30:51 +00:00
Mircea Trofin
9e45be0933 Revert "[wasm] Data structures for JIT-ing wasm to native memory."
This reverts commit c71fd20cf9.

Reason for revert: msvc is unhappy (https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/208)

Original change's description:
> [wasm] Data structures for JIT-ing wasm to native memory.
> 
> This CL introduces the structures for JIT-ing wasm on the native heap.
> They are described in detail at go/wasm-on-native-heap-stage-1
> 
> Briefly:
> - WasmCodeManager manages memory for modules and offers an interior
> pointer lookup (i.e. PC -> WasmCode)
> - WasmCode represents code, including reloc info. It holds wasm
> specific data, like function index, and runtime information, like trap
> handler info.
> - NativeModule manages memory for one module.
> 
> Tests cover the allocation and lookup aspects, following that current
> regression tests cover the JITed code. A separate CL will enable JITing
> using the new data structures.
> 
> Bug: v8:6876
> Change-Id: I1731238409001fe97c97eafb7a12fd3922da6a42
> Reviewed-on: https://chromium-review.googlesource.com/767581
> Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49501}

TBR=bradnelson@chromium.org,ulan@chromium.org,mstarzinger@chromium.org,titzer@chromium.org,mtrofin@chromium.org,mlippautz@chromium.org

Change-Id: Id54deb74782c6f0fd06c61ddcabb727eb7010333
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6876
Reviewed-on: https://chromium-review.googlesource.com/779679
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49503}
2017-11-20 17:29:44 +00:00
Toon Verwaest
8077ec87f6 [json] Simplify JSValue serialization
Bug: v8:7067
Change-Id: Ie9c0a84492965d08f67c910c489e59cbc50a5918
Reviewed-on: https://chromium-review.googlesource.com/778819
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49502}
2017-11-20 16:53:51 +00:00
Mircea Trofin
c71fd20cf9 [wasm] Data structures for JIT-ing wasm to native memory.
This CL introduces the structures for JIT-ing wasm on the native heap.
They are described in detail at go/wasm-on-native-heap-stage-1

Briefly:
- WasmCodeManager manages memory for modules and offers an interior
pointer lookup (i.e. PC -> WasmCode)
- WasmCode represents code, including reloc info. It holds wasm
specific data, like function index, and runtime information, like trap
handler info.
- NativeModule manages memory for one module.

Tests cover the allocation and lookup aspects, following that current
regression tests cover the JITed code. A separate CL will enable JITing
using the new data structures.

Bug: v8:6876
Change-Id: I1731238409001fe97c97eafb7a12fd3922da6a42
Reviewed-on: https://chromium-review.googlesource.com/767581
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49501}
2017-11-20 16:41:51 +00:00
Andreas Haas
8c68bc83fa [wasm] Rename bytes_needed to bytes_consumed in streaming-decoder.cc
R=clemensh@chromium.org

Change-Id: Ie66315bc3fdb44387f4dc8e4dd6e1058c173b786
Reviewed-on: https://chromium-review.googlesource.com/779123
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49500}
2017-11-20 16:40:21 +00:00
Sergiy Byelozyorov
28980b997c Whitespace CL to test CQ
TBR=machenbach@chromium.org

Bug: 
Change-Id: Ic95d5fc96fd6546709c024f6f772fb3308e93887
Reviewed-on: https://chromium-review.googlesource.com/779459
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49499}
2017-11-20 16:28:00 +00:00
Andreas Haas
3896e61775 [test] Add TaskRunners to the platform in the compiler dispatcher tests
I just pass a pointer of the platform to the task runner so that the
task runners can put tasks directly into the platform data structures.

R=rmcilroy@chromium.org

Change-Id: I7c1c56c3b9f550c0fe80012abcd31011e69f3d5d
Reviewed-on: https://chromium-review.googlesource.com/771751
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49498}
2017-11-20 15:54:11 +00:00
Michael Lippautz
5cf75a1ad3 Global handles: More test coverage
Bug: 
Change-Id: Ia3e42c8bfc8773fbd160f4200337617afd54d445
Reviewed-on: https://chromium-review.googlesource.com/779196
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49497}
2017-11-20 14:48:04 +00:00
Michal Majewski
5bd4e2d893 [test] Change wildcards to prefix rules.
Test suite contract changes:
- support * only at the end of the rule.
- loading status file is mandatory before filtering by status file.

Bug: v8:6917
Change-Id: Ia345ebfa7827c50f13f20e5cb7489e62c53f3357
Reviewed-on: https://chromium-review.googlesource.com/779185
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49496}
2017-11-20 14:25:04 +00:00
Michal Majewski
657e726a0d [test] Common statusfile flag format for mozilla and test262.
Bug: v8:6917
Change-Id: Ida8594caead9119b7b5dad6209017e2eae9cd3aa
Reviewed-on: https://chromium-review.googlesource.com/776799
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49495}
2017-11-20 14:20:24 +00:00
Andreas Haas
d9b42b7b34 [wasm] Handle modules without code in streaming compilation
Streaming compilation started the compilation of a module at the
beginning of the code section. However, there exist valid modules which
do not contain a code section. In this CL we check for the existence of
a code section when we finish the stream. We do this by checking if the
module compiler in the AsyncCompileJob exists, because the module
compiler gets initialized at the beginning of the code section.

If we detect that compilation has not been started because there was no
code section, then we start compilation when the stream finishes.

R=clemensh@chromium.org

Bug: chromium:771973
Change-Id: I7c95a7a791d02254f086961e7cd81885eec27382
Reviewed-on: https://chromium-review.googlesource.com/778541
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49494}
2017-11-20 13:58:04 +00:00
Michael Achenbach
209d379083 [test] Enable future variant as part of the extra suite set
Bug: chromium:786938
Change-Id: Ib8041c3cfe2237922824d783ebf8f0bb4d967a53
Reviewed-on: https://chromium-review.googlesource.com/779259
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49493}
2017-11-20 13:43:34 +00:00
Georg Neis
c57c529f87 [code-assembler] Check that a variable's value is never accessed outside a block.
We should only ever call value() on a variable while we are inside a block.
This CL adds a DEBUG check to this effect.

Bug: 
Change-Id: Ic85fae70e2c3543ff79e3234ba26e1daa234f7e3
Reviewed-on: https://chromium-review.googlesource.com/772233
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49492}
2017-11-20 13:24:04 +00:00
Michael Lippautz
a9cab08e6c [heap] Re-enable parallel marking
Bug: chromium:750084
Change-Id: I3d449ab76101100866b18db776b9f282154a77d9
Reviewed-on: https://chromium-review.googlesource.com/768679
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49491}
2017-11-20 13:03:03 +00:00
Mike Stanton
83319454c5 [TurboFan] Verify the graph against floating effectful control
Bug: v8:7002
Change-Id: Id8a7362f199ee776c0eade4cdbb9d3e413c17ead
Reviewed-on: https://chromium-review.googlesource.com/778164
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49490}
2017-11-20 12:51:13 +00:00
Michael Achenbach
0efc615c4a Revert "[heap] Concurrently free ArrayBuffer allocations."
This reverts commit b6658adee0.

Reason for revert: TSAN detects data race when running mksnapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/18354

Original change's description:
> [heap] Concurrently free ArrayBuffer allocations.
> 
> Free ArrayBuffer backing stores on a background thread, rather than
> blocking the main thread after processing. Could potentially cause
> contention with the array buffer allocator once JS execution resumes.
> 
> The new ArrayBufferCollector class tracks these dead allocations.
> 
> Later, the processing of array buffers can happen in parallel.
> 
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> 
> Bug: v8:6992
> Change-Id: I49ae4db12ed62d8400ba2bbafeda05a11479d904
> Reviewed-on: https://chromium-review.googlesource.com/739829
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49485}

TBR=hpayer@chromium.org,mlippautz@chromium.org,petermarshall@chromium.org

Change-Id: I293440b5f2602ca1c8ad120003f551bc8db6b75f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6992
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/779199
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49489}
2017-11-20 12:31:07 +00:00
Peter Marshall
3b31e5beef Revert "[heap] Concurrently free ArrayBuffer allocations."
This reverts commit b6658adee0.

Reason for revert: Breaks TSAN :(

Original change's description:
> [heap] Concurrently free ArrayBuffer allocations.
> 
> Free ArrayBuffer backing stores on a background thread, rather than
> blocking the main thread after processing. Could potentially cause
> contention with the array buffer allocator once JS execution resumes.
> 
> The new ArrayBufferCollector class tracks these dead allocations.
> 
> Later, the processing of array buffers can happen in parallel.
> 
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> 
> Bug: v8:6992
> Change-Id: I49ae4db12ed62d8400ba2bbafeda05a11479d904
> Reviewed-on: https://chromium-review.googlesource.com/739829
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49485}

TBR=hpayer@chromium.org,mlippautz@chromium.org,petermarshall@chromium.org

Change-Id: If6743b83f871c0fd0d6e83a3083dce0eecd99021
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6992
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/779159
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49488}
2017-11-20 12:29:48 +00:00
Michael Achenbach
41d9e85714 [build] Update MB fork with upstream changes
This updates the V8 side MB fork with all upstream changes until:
https://chromium.googlesource.com/chromium/src/+/f4d92a15f/tools/mb/mb.py

This includes a required feature for mapping isolate targets to
runtime deps.

Bug: chromium:669910
Change-Id: I22244455b22737cfbfc45adef93581ef44cf4151
Reviewed-on: https://chromium-review.googlesource.com/778879
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49487}
2017-11-20 12:29:12 +00:00
Benedikt Meurer
842303a637 [turbofan] Fix printing of FieldAccess.
Avoid the stupid newline when the name is a String, which is
automatically appended by the Object::Print() method. Just use
the Name::NamePrint() method instead.

Bug: v8:5267
Change-Id: I12ec878325b6f6ecdd8633a5ac8129b2398ddf9a
Reviewed-on: https://chromium-review.googlesource.com/778823
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49486}
2017-11-20 12:11:55 +00:00
Peter Marshall
b6658adee0 [heap] Concurrently free ArrayBuffer allocations.
Free ArrayBuffer backing stores on a background thread, rather than
blocking the main thread after processing. Could potentially cause
contention with the array buffer allocator once JS execution resumes.

The new ArrayBufferCollector class tracks these dead allocations.

Later, the processing of array buffers can happen in parallel.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng

Bug: v8:6992
Change-Id: I49ae4db12ed62d8400ba2bbafeda05a11479d904
Reviewed-on: https://chromium-review.googlesource.com/739829
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49485}
2017-11-20 12:10:34 +00:00
jgruber
2291ab8fb9 [coverage] Include operators in Conditional ranges
When collecting source ranges for conditionals (`a ? b : c`), include
the '?' and ':' tokens in the then- and else ranges, respectively.

Bug: v8:7098
Change-Id: I22315e2040c96c977e0b49e1fafe4228a6558471
Reviewed-on: https://chromium-review.googlesource.com/778321
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49484}
2017-11-20 12:09:30 +00:00
Ross McIlroy
6ef1551e16 [Parser] Move background parsing runtime-call-stack logging.
This moves the logging of the RCS event for background parsing tasks out
of the parser and performs it at the end of the background parsing task.
This is necessary in order to log background compile RCS events which happen
after parsing.

BUG=v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ie216eeade0279d8243818a8eb59309969775823c
Reviewed-on: https://chromium-review.googlesource.com/776669
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49483}
2017-11-20 12:08:24 +00:00
Benedikt Meurer
a76fe16828 [csa] Improve IteratorBuiltinsAssembler::IteratorStep a bit.
For the fast case we can avoid the instance type check, since the map
check covers that. We also don't need to call out to the ToBoolean
builtin in general, but just use the BranchIfToBooleanIsTrue logic.

Plus in the fast case, we don't know that the JSIteratorResult::done is
a boolean, since the map doesn't guard this assumption, so we also need
to do a proper BranchIfToBooleanIsTrue in that case.

Bug: v8:5269
Change-Id: I36f0d0841472c02f8030f9ce067d20326c9388bd
Reviewed-on: https://chromium-review.googlesource.com/778882
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49482}
2017-11-20 12:01:11 +00:00
Daniel Clifford
f0ceb9f277 Fix bug in length handling of Array.prototype.slice fast-path
Bug: chromium:785804
Change-Id: I1a65e2007438ac009d961e0e2c0425212216fcf1
Reviewed-on: https://chromium-review.googlesource.com/776696
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49481}
2017-11-20 11:53:13 +00:00
Benedikt Meurer
f787bee6b6 [cleanup] Simplify CodeStubAssembler::FillFixedArrayWithValue.
We can just use the same trick here that we use with TurboFan and load
the (signaling) NaN value out of the canonical tagged root. This
improves the loop for initializing double backing stores by hoisting the
load of the constant value out of the loop.

Bug: v8:5267
Change-Id: Idcf07c0e910ecc085a8b89225613f0a8fb50a414
Reviewed-on: https://chromium-review.googlesource.com/778979
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49480}
2017-11-20 11:27:04 +00:00
Sergiy Byelozyorov
e2403e6166 [tools] whitespace CL to test CQ
TBR=machenbach@chromium.org

Bug: chromium:748000
Change-Id: I383a1203b094d1e17453ee5aabca3267132df363
Reviewed-on: https://chromium-review.googlesource.com/778540
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49479}
2017-11-20 10:54:01 +00:00
Benedikt Meurer
89658816b1 [cleanup] Migrate the NumberToStringStub to a builtin.
Bug: v8:5267
Change-Id: I2338702ef69298bc95c47dcfedf7ef7632a2bf7f
Reviewed-on: https://chromium-review.googlesource.com/778842
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49478}
2017-11-20 10:48:23 +00:00
Michael Achenbach
3bedee6895 [build] Exclude nosnap targets on nosnap builds
When using ninja to build without specifying explicit targets,
all existing targets in any BUILD.gn file are built/executed.

We now hide the snapshot targets behind the snapshot condition
to prevent them from being built and executed in nosnap builds.

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_nosnap_rel

Bug: v8:7089
Change-Id: I4cd8ebadc377fd20b3887e9628990a75732ab74c
Reviewed-on: https://chromium-review.googlesource.com/778320
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49477}
2017-11-20 10:46:21 +00:00
Sylvestre Ledru
e9d602250f Remove a useless declaration: preload_characters cannot be > 4 as we have a Min() above
Bug: 
Change-Id: I553d6481a485a87c0246424270d63297400ceabe
Reviewed-on: https://chromium-review.googlesource.com/579909
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49476}
2017-11-20 10:37:40 +00:00
jgruber
e755191397 [debug] Bail out for non-JSFunctions passed to ScopeIterator
Bug: v8:7040
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I537b5d96e8d9275b695a3c56c57899e88b8b199d
Reviewed-on: https://chromium-review.googlesource.com/776654
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49475}
2017-11-20 10:37:09 +00:00
Benedikt Meurer
11c55d9c52 [cleanup] Properly tail call from GrowArrayElementsStub.
Now that Crankshaft is gone we no longer need to worry about parameter
mismatch for safepoints and we can just tail-call to %GrowArrayElements
from the GrowArrayElementsStub.

Bug: chromium:608675, v8:5269, v8:6408
Change-Id: I1b11d7d00cad02749a0ebc0a7de5e608de6d91c9
Reviewed-on: https://chromium-review.googlesource.com/778861
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49474}
2017-11-20 10:34:41 +00:00
Benedikt Meurer
f24a7e758a [cleanup] Remove stale TODO.
The StringEqual builtin handles two byte strings already.

Bug: v8:4913, v8:6365, v8:6371, v8:6936, v8:7022
Change-Id: I6f5a3999ccdce8e9bfcece6e94362c15183bbd8c
Reviewed-on: https://chromium-review.googlesource.com/778883
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49473}
2017-11-20 10:03:11 +00:00
Peter Marshall
365bb5bb4a [regexp] Add a CSA fast path for replace with global regexp.
For simple replacement strings without $ characters, we can do the
replacement in CSA for a global regexp. This is a common case because
this is currently the most widely used way to 'replaceAll' in a string.

This CL speeds up the test case in the linked bug by 13%.

Bug: v8:7053
Change-Id: I0d1d7c25fed07dfd7927191a3ef3138302e10c8f
Reviewed-on: https://chromium-review.googlesource.com/774440
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49472}
2017-11-20 09:50:01 +00:00
Benedikt Meurer
a9a1671345 [cleanup] Rename "array protector" to "no elements protector".
The "array protector" now guards the Object.prototype, the
Array.prototype and the String.prototype, so the name was a
bit misleading nowadays. So the new name "no elements protector"
was chosen.

Bug: v8:6936, v8:7014, v8:7027
Change-Id: I9a9d7caa2caf0ac9e78cc6658de2f0506970dfa2
Reviewed-on: https://chromium-review.googlesource.com/778162
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49471}
2017-11-20 09:43:35 +00:00
Benedikt Meurer
8a91be5b05 [turbofan] Remove the unused ToBooleanHints.
The ToBooleanHints were used to represent the ToBoolean feedback
collected by Fullcodegen. But Ignition doesn't collect this feedback
and also TurboFan doesn't make use of the hints, so we should remove
this for now.

Bug: v8:7101
Change-Id: Ifc97d3ebb7494029b33ad79fc8bafdf3c08fb871
Reviewed-on: https://chromium-review.googlesource.com/778163
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49470}
2017-11-20 09:42:38 +00:00
Yang Guo
aae52f6b0f [snapshot] introduce more maps for rehashing.
R=mstarzinger@chromium.org

Bug: v8:6593
Change-Id: Ica794c7b0d779f04647d2b2c5ce7762a537620ae
Reviewed-on: https://chromium-review.googlesource.com/759793
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49469}
2017-11-19 10:39:16 +00:00
Yang Guo
678f910375 [snapshot] no longer iterate strong roots twice.
Previously, in order to get immortal immovable objects onto
the first page, the serializer would iterate the root list
twice. The first time it would prioritize immortal immovables.
The second time it would serialize the rest.

This does not guarantee that immortal immovable objects
actually end up on the first page, and by now this is not
necessary anymore, since we mark all pages created during
heap init as immortal immovable pages.

R=mlippautz@chromium.org

Change-Id: Ie95fcd779377a75337621ba862bc1a745ed5cbaa
Reviewed-on: https://chromium-review.googlesource.com/768731
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49468}
2017-11-19 08:39:16 +00:00
v8-autoroll
ec1ad5f337 Update V8 DEPS.
Rolling v8/tools/clang: f2ca3e0..509676b

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I5d6e78e23d83234c8c80eaef4a7c8a51c7575e6a
Reviewed-on: https://chromium-review.googlesource.com/777929
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49467}
2017-11-19 07:59:12 +00:00
Anna Henningsen
09b53eef4c [api] Make running scripts in AddMessageListener callback work in debug mode
The existance of an `AllowJavascriptExecutionDebugOnly` scope in
`Isolate::ReportPendingMessages()` indicates that the API supports
running arbitrary JS code in a `AddMessageListener` callback.

Currently, this can fail in debug mode: The
`!isolate->external_caught_exception()` condition is checked when
entering API methods inside such a handler. However, if there is
a verbose `TryCatch` active when the exception occurs, this
check fails, and when calling `ToString()` on the exception object
leaves a pending exception itself, the flag is re-set to `true`.

Fix this problem by clearing the flag and the pending exception if
there was one during `ToString()`. This matches the code a few lines
up in `messages.cc`, so the exception state is now consistent
during the callback.

This currently makes a Node.js test fail in debug mode
(`parallel/test-error-reporting`).

Bug: node:7144
Bug: node:17016
Change-Id: I060d00fea3e9a497f4df34c6ff8d6e29ebe96321
Reviewed-on: https://chromium-review.googlesource.com/718096
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49466}
2017-11-18 23:39:29 +00:00
v8-autoroll
87d7722be4 Update V8 DEPS.
Rolling v8/build: 5698e23..5718716

Rolling v8/buildtools: 3196d83..461b345

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fd88dfb..37921f1

Rolling v8/third_party/instrumented_libraries: e07d437..ebf8d92

Rolling v8/tools/clang: e70074d..f2ca3e0

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ib22ef3b367d667199b3c3b12c892a1f7b476d7a7
Reviewed-on: https://chromium-review.googlesource.com/777595
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49465}
2017-11-18 04:53:08 +00:00
Camillo Bruni
a4af0ce633 [ic] Track the IC state change in FeedbackNexus::ConfigureMegamorphic
- This precents us from logging two ICEvents for a megamorphic miss that adds
  a new property
- We don't have to reset the profiler ticks anymore for this miss

The particular case for missing to add a new property happens ~1700 times in
the Speedometer Angular benchmark where we get an already internalized key
as property name.

Change-Id: I2362c3b7a66d9def1bc4295f6f1e64c96b25fe8a
Reviewed-on: https://chromium-review.googlesource.com/777259
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49464}
2017-11-18 00:52:12 +00:00
Adam Klein
00772e4d37 [grokdump] Fix --web instruction output for ARM disassembly
Fixes instruction names to be all in one <td>, rather than being
split between two due to miscalculation of op_offset.

Change-Id: Ieef5d20c238c8e0a5b2316239324d375090006a1
Reviewed-on: https://chromium-review.googlesource.com/777761
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49463}
2017-11-18 00:45:37 +00:00
Jakob Kummerow
977da55033 [bigint] Encapsulate internals in MutableBigInt
This CL creates the invariant that the BigInt class treats
BigInt objects as immutable. Writing to new BigInt objects
as part of their construction is done by the MutableBigInt
helper class, which in turn is hidden as an implementation
detail in bigint.cc.
As a side effect, this refactoring enforces right-trimming
checks for all newly created BigInts, and ensures that all
BigInt allocations possibly exceeding kMaxLength check for
this case and throw a RangeError instead of crashing.

Bug: v8:6791
Tbr: mlippautz@chromium.org
Change-Id: Id239746108e6b076b47a03ba37462001eb501507
Reviewed-on: https://chromium-review.googlesource.com/742329
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49462}
2017-11-17 23:06:52 +00:00
Ulan Degenbaev
61bf2cc692 [runtime] Make layout descriptor helper safe for concurrent marking.
The layout descriptor helper computes the object header size using
map->instance_size() and map->GetInObjectProperties().

It races with finalization of slack tracking, which changes both
the instance size and the in-object properties count.

This patch replaces the in-object properties count byte in the map
with the byte that stores the start offset of in-object properties.

The new byte can be used in the layout descriptor to compute the
object header size and it is immutable.

This patch also renames InstanceSize to InstanceSizeInWords where
the instance size is represented in words.

Bug: chromium:786069, chromium:694255
Change-Id: I4b48c6944d3fe8a950bd7b0ba43d75216b177a78
Reviewed-on: https://chromium-review.googlesource.com/776720
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49461}
2017-11-17 21:57:23 +00:00
Igor Sheludko
ed53f05c83 [runtime] Fix class literal instantiation.
Class' prototype temporarily got properies backing store inconsistent with
the map which obviously confused heap verifier.

Bug: v8:5799
Change-Id: Ie28b0418daa657763d07c8a928851111680718ed
Reviewed-on: https://chromium-review.googlesource.com/777560
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49460}
2017-11-17 20:36:52 +00:00
Pierre Langlois
027cecdb21 [perf-prof] Do not crash on BytecodeArray move events
The logger for perf does not support relocating code objects so as a result we
disable code space compacting to make sure code does not move. However, a
a CodeMove event may still happen if a BytecodeArray object moves, which isn't
relevant to the perf jit support so we can ignore it.

Bug: 
Change-Id: Ie6acf58fe6adfb5cec2f8756f457134cf3b13c2a
Reviewed-on: https://chromium-review.googlesource.com/759795
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#49459}
2017-11-17 20:22:42 +00:00