Commit Graph

13032 Commits

Author SHA1 Message Date
jgruber
64c518d06d Do not include Error.captureStackTrace in the trace
BUG=v8:5342

Review-Url: https://codereview.chromium.org/2307783002
Cr-Commit-Position: refs/heads/master@{#39124}
2016-09-02 09:51:42 +00:00
franzih
7c401bd84c [api] Add interceptor for defineProperty().
With the Indexed/GenericNamedPropertyDefinerCallback it is possible to intercept Object.defineProperty() calls.

Requests that call JSReceiver::OrdinaryDefineOwnProperty() internally, also trigger the interceptor. This includes Object.freeze(), Object.preventExtensions(), and Object.seal().

As without this patch, the query interceptor triggers on
defineProperty, unless the definer callback
intercepts the request.

As without this patch, the query interceptor triggers on defineProperty, unless the definer callback intercepts the request.

BUG=

Committed: https://crrev.com/b9d985975cf3bab0ded0cec9fafd3799f9bde29a
Review-Url: https://codereview.chromium.org/2272383002
Cr-Original-Commit-Position: refs/heads/master@{#39094}
Cr-Commit-Position: refs/heads/master@{#39122}
2016-09-02 09:09:08 +00:00
mythria
7e5b8feed3 [Interpreter] Collect type feedback for 'new' in the bytecode handler
Collect type feedback in the bytecode handler for 'new' bytecode. The
earlier cl (https://codereview.chromium.org/2153433002/) was reverted
because that implementation did not collect allocation site feedback.
This regressed delta blue by an order of magnitude. This implementation
includes collection of allocation site feedback.

Reland of https://codereview.chromium.org/2190293003/ with a bug fix.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2225923003
Cr-Commit-Position: refs/heads/master@{#39120}
2016-09-02 08:26:57 +00:00
nikolaos
628e9e3eb8 Fix bug with nested spreads as patterns
R=adamk@chromium.org, littledan@chromium.org
BUG=v8:5337
LOG=N

Review-Url: https://codereview.chromium.org/2297303003
Cr-Commit-Position: refs/heads/master@{#39118}
2016-09-02 07:53:00 +00:00
bmeurer
86af343749 [test] Add regression test for http://crbug.com/642056.
The bug itself was already fixed in ToT as part of
http://crrev.com/2263273003.

R=machenbach@chromium.org
BUG=chromium:642056

Review-Url: https://codereview.chromium.org/2306913002
Cr-Commit-Position: refs/heads/master@{#39117}
2016-09-02 07:08:29 +00:00
machenbach
d67fedb12c Revert of Allow lexically declared "arguments" in function scope in sloppy mode. (patchset id:100001 of https://codereview.chromium.org/2290753003/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/9470

Original issue's description:
> Allow lexically declared "arguments" in function scope in sloppy mode.
>
> Lexically declared "arguments" in sloppy mode will throw redeclaration error
> currently, this patch fixes it by delaying the declaration of arguments until we
> fully parse parameter list and function body.
>
> BUG=v8:4577
> LOG=N
>
> Committed: https://crrev.com/70a613dd0a5f5d205b46559b55702764464851fa
> Cr-Commit-Position: refs/heads/master@{#39109}

TBR=adamk@chromium.org,mythria@chromium.org,lpy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4577

Review-Url: https://codereview.chromium.org/2304853002
Cr-Commit-Position: refs/heads/master@{#39115}
2016-09-02 06:23:57 +00:00
gdeepti
53cb7e5ffc Populate relocation information correctly for RelocatableInt32Constants.
BUG=v8:5304
R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2277443009
Cr-Commit-Position: refs/heads/master@{#39112}
2016-09-02 01:39:21 +00:00
lpy
70a613dd0a Allow lexically declared "arguments" in function scope in sloppy mode.
Lexically declared "arguments" in sloppy mode will throw redeclaration error
currently, this patch fixes it by delaying the declaration of arguments until we
fully parse parameter list and function body.

BUG=v8:4577
LOG=N

Review-Url: https://codereview.chromium.org/2290753003
Cr-Commit-Position: refs/heads/master@{#39109}
2016-09-01 22:10:34 +00:00
Adam Klein
50b7a9ca24 Mark one more failing test262 test on the noi18n build
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/2302123002 .

Cr-Commit-Position: refs/heads/master@{#39108}
2016-09-01 20:59:02 +00:00
mlippautz
3b8ad45e0f [heap] Change LO space limit to 512k - page header
BUG=chromium:636331
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2289683002
Cr-Commit-Position: refs/heads/master@{#39106}
2016-09-01 20:10:57 +00:00
jarin
25504a220f [turbofan] Fix typing rule for Math.sign.
Review-Url: https://codereview.chromium.org/2306583002
Cr-Commit-Position: refs/heads/master@{#39103}
2016-09-01 20:06:27 +00:00
Adam Klein
3ecff04778 Skip new test262 toLocaleLowerCase test under noi18n build
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/2305793002 .

Cr-Commit-Position: refs/heads/master@{#39102}
2016-09-01 20:05:13 +00:00
littledan
af1d06a9bc This patch updates to the latest test262 version
A number of known failures are marked. To support test262's
new tests which simulate multiple script tags, this patch
calls out to the d8 realm API from the harness adaptation code.

Review-Url: https://codereview.chromium.org/2290023002
Cr-Commit-Position: refs/heads/master@{#39099}
2016-09-01 17:43:31 +00:00
mtrofin
5f8a6ec4b1 [wasm] consolidate wasm and asm.js module compilation sequence
This unblocks avoiding the separate code template.
In the upcoming CL doing away with code templates, We need to track instances
through the module object, which needs to be separate from the compiled module
data, which is then shared with the first instance.

This CL ensures we have the object available in the asm.js scenario, too.

Note that this CL also unifies the error messaging when module
decoding fails.

BUG=v8:5316

Review-Url: https://codereview.chromium.org/2299873002
Cr-Commit-Position: refs/heads/master@{#39097}
2016-09-01 16:47:39 +00:00
jkummerow
9fe4efe5b8 Revert of [api] Add interceptor for defineProperty(). (patchset id:160001 of https://codereview.chromium.org/2272383002/ )
Reason for revert:
Breaks cctest/test-api-interceptors/QueryInterceptor on the waterfall

Original issue's description:
> [api] Add interceptor for defineProperty().
>
> With the Indexed/GenericNamedPropertyDefinerCallback it is possible to intercept Object.defineProperty() calls.
>
> Requests that call JSReceiver::OrdinaryDefineOwnProperty() internally, also trigger the interceptor. This includes Object.freeze(), Object.preventExtensions(), and Object.seal().
>
> BUG=
>
> Committed: https://crrev.com/b9d985975cf3bab0ded0cec9fafd3799f9bde29a
> Cr-Commit-Position: refs/heads/master@{#39094}

TBR=jochen@chromium.org,franzih@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2303533004
Cr-Commit-Position: refs/heads/master@{#39095}
2016-09-01 16:04:00 +00:00
franzih
b9d985975c [api] Add interceptor for defineProperty().
With the Indexed/GenericNamedPropertyDefinerCallback it is possible to intercept Object.defineProperty() calls.

Requests that call JSReceiver::OrdinaryDefineOwnProperty() internally, also trigger the interceptor. This includes Object.freeze(), Object.preventExtensions(), and Object.seal().

BUG=

Review-Url: https://codereview.chromium.org/2272383002
Cr-Commit-Position: refs/heads/master@{#39094}
2016-09-01 15:18:30 +00:00
franzih
8acb7ab9f1 [api] Add PropertyDescriptor and DefineProperty().
BUG=

Review-Url: https://codereview.chromium.org/2244123005
Cr-Commit-Position: refs/heads/master@{#39093}
2016-09-01 15:09:59 +00:00
franzih
8225465b09 [api] Add documentation for PropertyQueryCallback.
Also add tests that document the behavior of the PropertyQueryCallback.

BUG=v8:5260

Review-Url: https://codereview.chromium.org/2286323002
Cr-Commit-Position: refs/heads/master@{#39090}
2016-09-01 14:41:56 +00:00
ahaas
79e685e277 [wasm] Validate the index of set local in AnalyzeLoopAssignment
BUG=chromium:642867
R=titzer@chromium.org
TEST=loop-assignment-analysis-unittest.cc:regress_642867

Review-Url: https://codereview.chromium.org/2290233008
Cr-Commit-Position: refs/heads/master@{#39089}
2016-09-01 14:05:50 +00:00
jgruber
7711b1a16f [regexp] Port RegExp getters and setters
BUG=v8:5339

Committed: https://crrev.com/ac0eb5e05af40e16ae9402bb8a62600b32cc2ec9
Review-Url: https://codereview.chromium.org/2305573002
Cr-Original-Commit-Position: refs/heads/master@{#39076}
Cr-Commit-Position: refs/heads/master@{#39088}
2016-09-01 13:41:28 +00:00
machenbach
6c25d789ba Revert of [regexp] Port RegExp getters and setters (patchset id:60001 of https://codereview.chromium.org/2305573002/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/9437

Original issue's description:
> [regexp] Port RegExp getters and setters
>
> BUG=v8:5339
>
> Committed: https://crrev.com/ac0eb5e05af40e16ae9402bb8a62600b32cc2ec9
> Cr-Commit-Position: refs/heads/master@{#39076}

TBR=bmeurer@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2301963002
Cr-Commit-Position: refs/heads/master@{#39085}
2016-09-01 12:50:40 +00:00
marja
8e7241fdde Include only stuff you need, part 6: Fix cctest.h.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control. Many of these files we need to rebuild are
cctests which pull in more includes than they need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2304553002
Cr-Commit-Position: refs/heads/master@{#39080}
2016-09-01 12:02:16 +00:00
jgruber
ac0eb5e05a [regexp] Port RegExp getters and setters
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2305573002
Cr-Commit-Position: refs/heads/master@{#39076}
2016-09-01 11:22:21 +00:00
bmeurer
9f37e303c3 [turbofan] Properly look through FinishRegion in alias analysis.
For two FinishRegion nodes, the alias analysis returned "may alias" even
without properly looking through them.

Drive-by-fix: Add meaningful output for --trace-turbo-load-elimination.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2301903002
Cr-Commit-Position: refs/heads/master@{#39075}
2016-09-01 10:50:27 +00:00
jarin
39d65198ed [turbofan] Fix Math.sign.
Review-Url: https://codereview.chromium.org/2294143004
Cr-Commit-Position: refs/heads/master@{#39073}
2016-09-01 10:26:12 +00:00
ahaas
5e7428b5b1 [wasm] Read global names only if their name length is valid.
BUG=chromium:642987
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:GlobalWithInvalidNameLength

Review-Url: https://codereview.chromium.org/2301873002
Cr-Commit-Position: refs/heads/master@{#39071}
2016-09-01 09:52:40 +00:00
bmeurer
432790c92c [turbofan] Only check semantic axis for Type::None.
R=jarin@chromium.org
BUG=chromium:643073

Review-Url: https://codereview.chromium.org/2299903002
Cr-Commit-Position: refs/heads/master@{#39065}
2016-09-01 07:11:21 +00:00
bmeurer
83e1410320 [turbofan] Float32Constant/Float64Constant cannot occur in JS level graph.
Now that the hole NaN is no longer represented as Float64Constant early
on, we should never see such a constant node in any JS-level graph, but
we will only see them after representation selection. Change Typer and
SimplifiedLowering appropriately (and fix the invalid tests).

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2299883003
Cr-Commit-Position: refs/heads/master@{#39063}
2016-09-01 06:27:06 +00:00
bmeurer
64a7bd3877 [turbofan] Don't treat the hole NaN as constant inside the compiler.
We use a signaling NaN to represent the hole in
FAST_HOLEY_DOUBLE_ELEMENTS backing stores, but on Intel processors, the
C++ compiler may decide to (or be forced to due to calling conventions)
use X87 registers for double values. However transfering to X87
registers automatically quietens the NaNs and there's no way to disable
this. Therefore we should just always load the hole NaN from the canonical
place identified by the address_of_hole_nan external reference instead,
which might even be more efficient in some cases.

R=jarin@chromium.org, jkummerow@chromium.org
BUG=v8:5332

Review-Url: https://codereview.chromium.org/2303643002
Cr-Commit-Position: refs/heads/master@{#39062}
2016-09-01 06:02:19 +00:00
bakkot
8d5a267b19 Refactor object/class literal property name parsing
This patch arranges that property names are parsed in a single pass,
reporting the name as well as the type of the property, instead of
parsing qualifiers like 'static' or 'get' initially as names and then
re-parsing. This change is easier to reason about, very slightly (4%)
faster in some cases (although slower in other, less common ones, though
this slowdown will be fixed in an upcoming patch), and is a prerequisite
for separating the parsing of object and class literal properties, which
will become increasingly important as ECMAScript adds more class features.

This is a reland of https://codereview.chromium.org/2278153004/,
which fixes the issue causing the revert and adds more tests.

Review-Url: https://codereview.chromium.org/2300503002
Cr-Commit-Position: refs/heads/master@{#39056}
2016-08-31 21:14:14 +00:00
jkummerow
e1cb562224 [elements] Fix GetEntryForIndexImpl to honor array length
Previously, fast holey elements accessors would detect element presence
by simply doing a hole check on any slot within the backing store's
capacity. This relied on the (mostly-true but brittle) assumption that
slots beyond the length are always correctly zapped with The Hole.

Review-Url: https://codereview.chromium.org/2297253002
Cr-Commit-Position: refs/heads/master@{#39051}
2016-08-31 17:46:34 +00:00
jochen
60a783c246 Make the condition for when this is predeclared easier to understand.
Just always predeclare it

R=marja@chromium.org,verwaest@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2298743002
Cr-Commit-Position: refs/heads/master@{#39048}
2016-08-31 13:33:46 +00:00
ahaas
dd9995c066 [wasm] Use the right control input for the diamond in GrowMemory.
The fuzzer found out that "start" is not always a good control input
for a diamond.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2295173002
Cr-Commit-Position: refs/heads/master@{#39046}
2016-08-31 12:32:34 +00:00
bmeurer
7b79224b21 [crankshaft] Disable further folding already folded allocations.
When we try to further fold previously folded allocations in Crankshaft
GVN we don't properly transform the allocations involved, which causes
the mechanism to leave holes in the new/old space (and thereby violate
the iterability property of the new/old space).

BUG=chromium:621868
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2297983003
Cr-Commit-Position: refs/heads/master@{#39040}
2016-08-31 09:48:45 +00:00
marja
0645135446 Separate CompilationInfo into its own file.
This way, many files which only need CompilationInfo but not compiler.h
and its dependencies can include just compilation-info.h.

BUG=

Review-Url: https://codereview.chromium.org/2284313003
Cr-Commit-Position: refs/heads/master@{#39038}
2016-08-31 08:49:59 +00:00
jochen
5b25cbb503 Unify DeclarationScope::Analyze
R=marja@chromium.org
TBR=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2294193003
Cr-Commit-Position: refs/heads/master@{#39037}
2016-08-31 08:47:19 +00:00
bmeurer
b98d64f909 [turbofan] Extend LoadElimination to introduce TypeGuards.
If the type of a tracked field or element value is less precise than the
advertised type of the field or element load, then we replace the load
operation with a TypeGuard that guards the advertised type.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295643002
Cr-Commit-Position: refs/heads/master@{#39032}
2016-08-31 05:48:28 +00:00
adamk
9c00c88902 Remove duplicated code from comma-separated Expression parsing
This removes two bits of duplication:
  - Parsing of each AssignmentExpression, which previously was called
    first outside the loop and then inside the loop.
  - Parsing of arrow rest parameters, which previously was handled
    separately for the one-arg and N-arg cases.

The only change in behavior is in a few error messages.

Review-Url: https://codereview.chromium.org/2279363002
Cr-Commit-Position: refs/heads/master@{#39030}
2016-08-31 01:24:19 +00:00
mtrofin
03f3da45e1 [wasm] mjsunit support for I32 globals and test
Test ensuring globals are isolated between instances. Also
added support for globals section to mjsunit's
WebModuleBuilder as a prerequisite.

BUG=

Review-Url: https://codereview.chromium.org/2296993002
Cr-Commit-Position: refs/heads/master@{#39028}
2016-08-31 00:36:18 +00:00
addaleax
8ed65b97a3 Make FieldType::None() non-nullptr value to avoid undefined behaviour
When FieldType::None() returns a cast Smi::FromInt(0), which translates
as nullptr, the FieldType::IsNone() check becomes equivalent to
`this == nullptr` which is not allowed by the standard and
therefore optimized away as a false constant by GCC 6.

This has lead to crashes when invoking methods on FieldType::None().

Using a different Smi constant for FieldType::None() makes the compiler
always include a comparison against that value. The choice of these
constants has no effect as they are effectively arbitrary.

BUG=https://github.com/nodejs/node/issues/8310

Review-Url: https://codereview.chromium.org/2292953002
Cr-Commit-Position: refs/heads/master@{#39023}
2016-08-30 17:56:05 +00:00
ahaas
9f747be5a7 [wasm] Check the input of grow-memory before calling the runtime.
If the input of grow-memory was not representable as a SMI, then the
input was not passed correctly to the runtime, which caused a crash.
With this CL the input of grow-memory is checked before the runtime is
called.

R=titzer@chromium.org, gdeepti@chromium.org
TEST=mjsunit/wasm/grow-memory.js:testGrowMemoryTrapsWithNonSmiInput()

Review-Url: https://codereview.chromium.org/2288773002
Cr-Commit-Position: refs/heads/master@{#39022}
2016-08-30 17:00:24 +00:00
epertoso
bdf5566281 [turbofan] Treat the INT32 state of a truncating binary op IC as number or oddball on 32-bit machines.
This was causing a few unexpected deopt loops.

BUG=v8:5320

Review-Url: https://codereview.chromium.org/2292873002
Cr-Commit-Position: refs/heads/master@{#39019}
2016-08-30 14:13:34 +00:00
jbroman
e2361954e5 Blink-compatible serialization of SharedArrayBuffer.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2290753002
Cr-Commit-Position: refs/heads/master@{#39017}
2016-08-30 14:05:49 +00:00
ahaas
510246f6e2 [wasm] Use the native_context for the TypeError in ToJS()
With this CL we use isolate->native_context() to provide a context for
the CEntryStub of the runtime call. The native_context() is sufficient
here because Runtime::kWasmThrowTypeError does not use the context.

R=titzer@chromium.org
TEST=mjsunit/wasm/ffi-error.js
BUG=chromium:639492

Review-Url: https://codereview.chromium.org/2291043002
Cr-Commit-Position: refs/heads/master@{#39014}
2016-08-30 12:46:02 +00:00
epertoso
708f80d243 [interpreter] Make the comparison bytecode handlers collect type feedback.
BUG=v8:5273

Review-Url: https://codereview.chromium.org/2286273002
Cr-Commit-Position: refs/heads/master@{#39006}
2016-08-30 10:21:39 +00:00
jochen
0c3789fb6a Create ScopeInfos while analyzing the Scope chain
Instead of creating them on demand all over the place.

I plan to link ScopeInfos together, and having one place where all
ScopeInfos are created will make this easier.

R=verwaest@chromium.org,adamk@chromium.org
TBR=mstarzinger@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2281073002
Cr-Commit-Position: refs/heads/master@{#39003}
2016-08-30 09:48:56 +00:00
bmeurer
864cdc124c [test] Speed-up regression test for growing stores.
TBR=machenbach@chromium.org
BUG=chromium:635798,chromium:638295

Review-Url: https://codereview.chromium.org/2288813003
Cr-Commit-Position: refs/heads/master@{#38991}
2016-08-30 04:04:32 +00:00
bradnelson
b42e12cd4a [wasm] Pull in fresher fuzzer binaries.
BUG=None
TEST=None
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2290803002
Cr-Commit-Position: refs/heads/master@{#38989}
2016-08-29 19:44:23 +00:00
bradnelson
08639b5b77 [WASM] Adding fuzzing binaries for wasm, and script to update them.
This adds:
* A script (tools/update-wasm-fuzzers.sh), which creates a new fuzzing seed
  corpus and uploads to google storage (you must have the right credentials).
* A new pair of DEPS entries to pull in the current version of the corpus
  based on a checked in pair of hash files.

BUG=None
TEST=None
R=ahaas@chromium.org,kcc@chromium.org,mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2273303002
Cr-Commit-Position: refs/heads/master@{#38987}
2016-08-29 19:01:48 +00:00
littledan
5af4cd9840 Disallow tail calls from async functions and generators
Tail calls don't make sense from async functions and generators, as
each activation of these functions needs to make a new, distnict,
non-reused generator object. These tail calls are not required per
spec. This patch disables both syntactic and implicit tail calls
in async functions and generators.

R=neis
BUG=v8:5301,chromium:639270

Review-Url: https://codereview.chromium.org/2278413003
Cr-Commit-Position: refs/heads/master@{#38986}
2016-08-29 18:31:35 +00:00
jbroman
248f3dafd0 Blink-compatible serialization of array buffer views.
The format of this is a little strange, and has to do with the previous
implementation maintaining a "stack" of objects as it works. As a result,
the format writes the array buffer before giving any hint that the reason
for doing so is to obtain a view wrapping it. Handling this without creating
an explicit on-heap stack requires checking whether the next tag is 'V'
after obtaining an array buffer.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2287653002
Cr-Commit-Position: refs/heads/master@{#38984}
2016-08-29 14:51:49 +00:00
ahaas
cb259fbd39 [wasm] Create a new fuzzer for wasm code.
The new fuzzer constructs a dummy module header and uses the fuzzer
data only as function code.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2280623002
Cr-Commit-Position: refs/heads/master@{#38983}
2016-08-29 13:56:00 +00:00
bgeron
791118fca5 [turbofan] Also inline into try blocks.
This removes test/webkit/fast/js/stack-overflow-arrity-catch.js, which tests that the stack overflows in a very particular way. It doesn't seem to test anything important, and only used to work because we didn't inline into try-blocks.

BUG=
R=jarin

Review-Url: https://codereview.chromium.org/2216353002
Cr-Commit-Position: refs/heads/master@{#38976}
2016-08-29 11:27:06 +00:00
bgeron
d90d76bdb5 [turbofan] Improve inline-exception tests.
- Make constants more interesting.
- Add an addition to be done after the inlined call in the try-block.
- On command line, have a bit more output.
- New alternative that deopts from unoptimized code.

BUG=
R=jarin

Review-Url: https://codereview.chromium.org/2285743002
Cr-Commit-Position: refs/heads/master@{#38974}
2016-08-29 11:17:16 +00:00
bmeurer
285e1e157a [turbofan] Remove invalid typing rules.
Drop the typing rules for the machine operators and replace them
with UNREACHABLE. These typing rules were never correct and there's
also no need to have those rules at all.

Drive-by-fix: Remove the extremely annoying test-simplified-lowering.cc
file, which is not very useful, but consumes a large amount of time to
keep it compiling and passing. Instead we should introduce appropriate
tests for the SimplifiedLowering that also test something meaningful
w/o just cementing the implementation.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2292463002
Cr-Commit-Position: refs/heads/master@{#38970}
2016-08-29 09:20:09 +00:00
bmeurer
1915762cc8 [turbofan] Remove special JSForInStep and JSForInDone.
These JavaScript operators were special hacks to ensure that we always
operate on Smis for the magic for-in index variable, but this never
really worked in the OSR case, because the OsrValue for the index
variable didn't have the proper information (that we have for the
JSForInPrepare in the non-OSR case).

Now that we have loop induction variable analysis and binary operation
hints, we can just use JSLessThan and JSAdd instead with appropriate
Smi hints, which handle the OSR case by inserting Smi checks (that are
always true). Thanks to OSR deconstruction and loop peeling these Smi
checks will be hoisted so they don't hurt the OSR case too much.

Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since
we have to lower it to JSLessThan to get the loop induction variable
goodness.

R=epertoso@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2289613002
Cr-Commit-Position: refs/heads/master@{#38968}
2016-08-29 08:47:33 +00:00
bmeurer
f676db4655 [turbofan] Lazy bailout for calls doesn't need callee.
There's no need to preserve the exact callee for lazy bailouts
from JSCallFunction in the AstGraphBuilder, as fullcodegen code
will never look at that value after the callee returns. So we
just push optimized_out instead.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2285183002
Cr-Commit-Position: refs/heads/master@{#38963}
2016-08-29 05:16:26 +00:00
mlippautz
933195a24c Revert of "[heap] Switch to 500k pages" (patchset id:1 of https://codereview.chromium.org/2278653003/ )
Reason for revert:
Tanks pretty much alle metrics across the board. Probably LO space limit too low but needs investigation.

Original issue's description:
> [heap] Switch to 500k pages
>
> Decrease regular heap object size to 400k. In a follow up, we can now get rid of
> the new space border page while keeping the 1M minimum new space size.
>
> This reverts commit 1617043c10.
>
> BUG=chromium:636331
>
> Committed: https://crrev.com/2101e691caeef656eb91f1c98620b3955d337c83
> Cr-Commit-Position: refs/heads/master@{#38916}

TBR=ulan@chromium.org,verwaest@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:636331
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2289493002
Cr-Commit-Position: refs/heads/master@{#38960}
2016-08-28 07:28:35 +00:00
jbroman
864728085d Blink-compatible serialization of ArrayBuffer transfer.
The embedder is expected to arrange for the array buffer contents to be
transferred into a v8::ArrayBuffer in the receiving context (generally by
assuming ownership of the externalized backing store).

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2275033003
Cr-Commit-Position: refs/heads/master@{#38948}
2016-08-26 15:47:41 +00:00
ivica.bogosavljevic
db56339952 MIPS: Fix crahses of tests unittests/AstDecoderTest.Float[32|64]Const
on architectures that do not support missaligned memory access

BUG=unittests/AstDecoderTest.Float64Const, unittests/AstDecoderTest.Float32Const

Review-Url: https://codereview.chromium.org/2275323002
Cr-Commit-Position: refs/heads/master@{#38941}
2016-08-26 12:29:54 +00:00
mstarzinger
80ae1b37b4 [test] Remove CompilationInfo from test-field-type-tracking.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2286593003
Cr-Commit-Position: refs/heads/master@{#38939}
2016-08-26 11:35:44 +00:00
ahaas
25cdfd79a4 [wasm] Remove the Float(32|64)SubMinusZero tests.
These tests became obsolete. They tested a requirement that has been
removed from the WebAssembly specification.

R=titzer@chromium.org, Balazs.Kilvady@imgtec.com

Review-Url: https://codereview.chromium.org/2284593002
Cr-Commit-Position: refs/heads/master@{#38938}
2016-08-26 10:04:03 +00:00
ahaas
71f93e6001 [wasm] Bound the allowed number of locals.
This CL fixes the first bug I found with the new fuzzing. The problem is
that the number of locals is unbounded. This CL bounds the number of
locals of one type with 8000000, an arbitrary number.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2271803004
Cr-Commit-Position: refs/heads/master@{#38936}
2016-08-26 09:13:22 +00:00
mstarzinger
e53d2acec1 [compiler] Remove default argument for code flags.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2281863002
Cr-Commit-Position: refs/heads/master@{#38935}
2016-08-26 09:04:23 +00:00
marja
fc6425c56a Include only stuff you need, part 5: make function-tester.h slimmer.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control. Many of these files we need to rebuild are
cctests which pull in more includes than they need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2278103002
Cr-Commit-Position: refs/heads/master@{#38933}
2016-08-26 08:41:38 +00:00
bmeurer
f154c75a39 [turbofan] Separate typed optimizations from JSTypedLowering.
Introduce a new TypedOptimization reducer that contains the type
based optimization reduction steps, which are not (directly)
related to lowering JavaScript operators based on types (which is
what JSTypedLowering is supposed to do).

This also addresses a chicken-and-egg problem that we see in the
Octane/Mandreel benchmark where type based constant folding isn't
applied to the numeric comparison operators introduced by the
JSTypedLowering itself, and thus gives up to 10% speedup for the
benchmark.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2280673003
Cr-Commit-Position: refs/heads/master@{#38928}
2016-08-26 07:58:30 +00:00
neis
a45d106db0 [modules] Rename ModuleDescriptor::ModuleEntry to ModuleDescriptor::Entry.
R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2278973002
Cr-Commit-Position: refs/heads/master@{#38924}
2016-08-26 07:04:21 +00:00
verwaest
5558a50878 Merge DeclarationScope::temps_ and Scope::ordered_variables_ into Scope::locals_
BUG=v8:5209

Review-Url: https://codereview.chromium.org/2272083003
Cr-Commit-Position: refs/heads/master@{#38920}
2016-08-25 19:12:00 +00:00
adamk
51c186dd98 Centralize and standardize logic for ExpressionClassifier accumulation
Previously the calls to ExpressionClassifier::Accumulate() each chose
slightly different sets of productions to accumulate, and it turned
out that these were in some cases broader than needed and in some
cases less broad.

The existence of some grab-bag production bitmasks like
ExpressionClassifier::ExpressionProductions made this situation more
error-prone (for example, that production was missing AsyncArrowFormalParametersProduction).

This patch removes all "grab-bags" besides AllProductions. In some of
the places where code was using those grab-bags for convenience, it
switches them to use negation of AllProductions. In other, specifically
those having to do with expressions that are disallowed anywhere in
a sub-expression of a parameter list, I've added a new method on
ExpressionClassifier to centralize the logic.

The aforementioned centralization/addition of
AsyncArrowFormalParametersProduction fixes several cases where we were
failing to report an error for 'await' in some contexts; I've added
those test cases.

The patch also narrows all cases to exactly the set or productions
necessary, with a comment on each explaining the choice.

BUG=v8:4483

Review-Url: https://codereview.chromium.org/2271063002
Cr-Commit-Position: refs/heads/master@{#38918}
2016-08-25 16:59:45 +00:00
jarin
2a97b1bcb1 Reland of [turbofan] Insert dummy values when changing from None type.
This reverts commit a55fdb1e7c, relands
https://codereview.chromium.org/2266823002/.

BUG=chromium:638132

Review-Url: https://codereview.chromium.org/2277283002
Cr-Commit-Position: refs/heads/master@{#38917}
2016-08-25 16:58:13 +00:00
mlippautz
2101e691ca [heap] Switch to 500k pages
Decrease regular heap object size to 400k. In a follow up, we can now get rid of
the new space border page while keeping the 1M minimum new space size.

This reverts commit 1617043c10.

BUG=chromium:636331

Review-Url: https://codereview.chromium.org/2278653003
Cr-Commit-Position: refs/heads/master@{#38916}
2016-08-25 16:26:32 +00:00
jbroman
58cac6501f Add an experimental public API for value serialization.
Suitably scary warnings attached, as this will yet evolve (notably to handle
host objects, which are not currently handled).

Unit tests adjusted to use the public version of ValueSerializer, eliminating
any need they have to access v8::internal.

With this, Blink can begin using this code experimentally behind a flag as it
develops.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2274693002
Cr-Commit-Position: refs/heads/master@{#38915}
2016-08-25 16:00:25 +00:00
jbroman
2646749cbc Blink-compatible serialization of ArrayBuffer.
Transferral is not included in this CL, nor is SharedArrayBuffer.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2264403004
Cr-Commit-Position: refs/heads/master@{#38913}
2016-08-25 14:43:54 +00:00
mlippautz
3866975f1b [heap] GCTracer: Record details for incremental marking
Record details, such as cumulative duration, number of steps, and longest steps
in IncrementalMarkingDetails which get populated at a single callsite
(AddScopeSample). Remove member fields that thus become obsolete (unfortunately
not all of them).

Additional remove some dead code and refactor printing. Printing in a single
statement allows for using logcat on Android.

This should also address the regression in chromium:640524.

BUG=chromium:639818,chromium:640524
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2269093002
Cr-Commit-Position: refs/heads/master@{#38912}
2016-08-25 14:22:42 +00:00
jyan
54f5558d52 Implement Big-Endian eqv test for DecodeDate and DecodeValueObjects
R=jkummerow@chromium.org, jbroman@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2274173003
Cr-Commit-Position: refs/heads/master@{#38910}
2016-08-25 14:11:31 +00:00
rmcilroy
677948255b Fix CompilerDispatcherJobTest::CompileFailureToFinalize on local runs.
BUG=

Review-Url: https://codereview.chromium.org/2276343003
Cr-Commit-Position: refs/heads/master@{#38909}
2016-08-25 13:57:56 +00:00
bgeron
244d9ccd40 [turbofan] Tests for inlining calls, constructors, property access inside try..catch..finally.
These tests were spliced out of changelist 2216353002 and extended.

BUG=

Review-Url: https://codereview.chromium.org/2245263003
Cr-Commit-Position: refs/heads/master@{#38906}
2016-08-25 12:50:48 +00:00
rmcilroy
b2734f6a1b [Test] Fix CompilerDispatcher test.
Review-Url: https://codereview.chromium.org/2281463002
Cr-Commit-Position: refs/heads/master@{#38900}
2016-08-25 11:29:43 +00:00
rmcilroy
c2d2d4d1ce [Compiler] Add compile operations to CompilerDispatcherJob.
Adds compile operations to the CompilerDispatcherJob interface. As such,
introduces Compiler::PrepareUnoptimizedCompilationJob and updates the
unoptimized compilation path to use CompilationJobs. Also unifies
FinalizeCompilationJob to deal with both optimized and unoptimized
compilation jobs.

A dummy FullCodegenCompilationJob is also introduced, where all the work
is done in the ExecuteJob phase, which cannot be run on a
background thread.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2251713002
Cr-Commit-Position: refs/heads/master@{#38897}
2016-08-25 10:25:12 +00:00
bmeurer
a55fdb1e7c Revert of [turbofan] Insert dummy values when changing from None type. (patchset id:80001 of https://codereview.chromium.org/2266823002/ )
Reason for revert:
Octane/Mandreel aborts with an exception now:

TypeError: __FUNCTION_TABLE__[(r2 >> 2)] is not a function

Original issue's description:
> [turbofan] Insert dummy values when changing from None type.
>
> Currently we choose the MachineRepresentation::kNone representation for
> values of Type::None, and when converting values from the kNone representation
> we use "impossible" conversions that will crash at runtime. This
> assumes that the impossible conversions should never be hit (the only
> way to produce the impossible values is to perform an always-failing
> runtime check on a value, such as Smi-checking a string). Note that
> this assumes that the runtime check is executed before the impossible
> convesrion.
>
> Introducing BitwiseOr type feedback broke this in two ways:
>
> - we always pick Word32 representation for bitwise-or, so the
>   impossible conversion does not trigger (it only triggers with
>   None representation), and we could end up with unsupported
>   conversions from Word32.
>
> - even if we inserted impossible conversions, they are pure conversions.
>   Since untagging, bitwise-or operations are also pure, we could hoist
>   all these before the smi check of the inputs and we could hit the
>   impossible conversions before we get to the smi check.
>
> This CL addresses this by just providing dummy values for conversions
> from the Type::None type. It also removes the impossible-to-* conversions.
>
> BUG=chromium:638132
>
> Committed: https://crrev.com/c83b21ab755f1420b6da85b3ff43d7e96ead9bbe
> Cr-Commit-Position: refs/heads/master@{#38883}

TBR=mstarzinger@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:638132

Review-Url: https://codereview.chromium.org/2280613002
Cr-Commit-Position: refs/heads/master@{#38893}
2016-08-25 08:50:23 +00:00
neis
6e67d04260 [modules] Split exports into regular and special, store regular ones in a multimap.
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2273013002
Cr-Commit-Position: refs/heads/master@{#38889}
2016-08-25 08:37:30 +00:00
baptiste.afsa
65ba1cdeb6 [turbofan] Allow tests to enable/disable instruction scheduling.
Some instruction selection tests rely on the instructions to be emitted
in a specific order.

R=jarin@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2276003002
Cr-Commit-Position: refs/heads/master@{#38886}
2016-08-25 08:05:15 +00:00
bmeurer
b471d4ab5c [turbofan] Disable LoadElimination completely for asm.js.
There's no point in running the LoadElimination on asm.js functions and
it would take serious amount of effort to actually make it correct for
the deprecated parts of the pipeline.

R=jarin@chromium.org
BUG=v8:5308

Review-Url: https://codereview.chromium.org/2276273002
Cr-Commit-Position: refs/heads/master@{#38884}
2016-08-25 06:14:59 +00:00
jarin
c83b21ab75 [turbofan] Insert dummy values when changing from None type.
Currently we choose the MachineRepresentation::kNone representation for
values of Type::None, and when converting values from the kNone representation
we use "impossible" conversions that will crash at runtime. This
assumes that the impossible conversions should never be hit (the only
way to produce the impossible values is to perform an always-failing
runtime check on a value, such as Smi-checking a string). Note that
this assumes that the runtime check is executed before the impossible
convesrion.

Introducing BitwiseOr type feedback broke this in two ways:

- we always pick Word32 representation for bitwise-or, so the
  impossible conversion does not trigger (it only triggers with
  None representation), and we could end up with unsupported
  conversions from Word32.

- even if we inserted impossible conversions, they are pure conversions.
  Since untagging, bitwise-or operations are also pure, we could hoist
  all these before the smi check of the inputs and we could hit the
  impossible conversions before we get to the smi check.

This CL addresses this by just providing dummy values for conversions
from the Type::None type. It also removes the impossible-to-* conversions.

BUG=chromium:638132

Review-Url: https://codereview.chromium.org/2266823002
Cr-Commit-Position: refs/heads/master@{#38883}
2016-08-25 06:06:58 +00:00
bmeurer
a124bf773f [turbofan] Add regression tests for LoadElement/Field in diamond.
This introduces appropriate unit tests to ensure that merging of
elements/fields information is correct for diamonds.

BUG=chromium:639210,v8:5266
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2278043002
Cr-Commit-Position: refs/heads/master@{#38881}
2016-08-25 05:09:21 +00:00
littledan
aae17eb31b Do not trigger ExceptionEvents for another forwarding case
This patch fixes up one last case of redundant ExceptionEvents being
triggered in the debugger for Promises--it makes the default reject
handler for Promises (e.g., if the second argument for
Promise.prototype.then is missing) appear to the debugger as a
rethrow.

R=adamk@chromium.org,jgruber@chromium.org
BUG=v8:5167

Review-Url: https://codereview.chromium.org/2278643002
Cr-Commit-Position: refs/heads/master@{#38876}
2016-08-24 20:38:13 +00:00
jarin
dc330f2bd3 [turbofan] Fix merging of empty and non-empty state in load elimination.
Unfortunately, I was unable to produce a repro without asm.js. In normal
JavaScript, the bounds check renaming saves us.

I have not done anything about the index variable aliasing and handling
of differently sized elements yet!

BUG=chromium:639210, v8:5266

Review-Url: https://codereview.chromium.org/2270793004
Cr-Commit-Position: refs/heads/master@{#38874}
2016-08-24 17:14:24 +00:00
jyan
abd32fb1c7 Fix FastAccessorToSmi CCTest to use ptr type
The generated FastAccessorAssembler uses IntPtr Load Op to load
from &flags. Therefore, flags should be a pointer type. This fixes
big endian issue.

R=peterssen@google.com, vogelheim@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2266403004
Cr-Commit-Position: refs/heads/master@{#38873}
2016-08-24 17:05:00 +00:00
jbroman
78131aa1d5 Blink-compatible serialization of Map and Set objects.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2269923004
Cr-Commit-Position: refs/heads/master@{#38871}
2016-08-24 15:58:55 +00:00
mstarzinger
b52aecac7e [compiler] Make Compiler::EnsureBytecode not switch tiers.
This preserves the original shared code of the underlying function when
bytecode is provided. The method in question should only ensure bytecode
is present, but should avoid switching compilation tiers of the given
function. It might be that the function was fast-tracked to baseline by
inlining without going through the interpreted tier first.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-635923
BUG=chromium:635923

Review-Url: https://codereview.chromium.org/2278543002
Cr-Commit-Position: refs/heads/master@{#38866}
2016-08-24 14:09:59 +00:00
bmeurer
6646d73b6f [turbofan] Use ObjectIsReceiver directly for inlining.
Don't bother using %_IsJSReceiver, which immediately gets lowered to
ObjectIsReceiver anyways (by the JSIntrinsicLowering), but requires
some complicated rewiring of effect/control chains.

R=mstarzinger@chromium.org
BUG=chromium:640369

Review-Url: https://codereview.chromium.org/2271973003
Cr-Commit-Position: refs/heads/master@{#38864}
2016-08-24 11:09:32 +00:00
bmeurer
b5629a108c [turbofan] Improve fast case of JSInstanceOf lowering.
For O instanceof C, we only need to check the instance type while
iterating the prototypes of O instead of checking both the instance
type and the access check bit of the map. This is because we have
the explicit range of "special object types", which include both
JSProxy as well as the global object and proxy and all API objects
that might have access checks or interceptors. Also restructure the
loop exits somewhat to ensure that the branch cloning gets a chance
to actually eliminate the bit materialization for the results.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2263273003
Cr-Commit-Position: refs/heads/master@{#38860}
2016-08-24 09:38:48 +00:00
littledan
013e49f73c Change which ExceptionEvents are triggered by Promises
To make async/await catch prediction work well, this patch regularizes
the exception events sent to DevTools from various places in the Promise
lifecycle. The core is that there should be an exception event when the
rejection first starts, rather than when it is propagated.

- Several cases within Promise code which propagate errors are
  modified to not trigger a new ExceptionEvent in that case, such
  as .then on a rejected Promise and returning a rejected Promise
  from .then, as well as Promise.race and Promise.all.
- Make Promise.reject() create an ExceptionEvent, subject to catch
  prediction based on the Promise stack. This is important
  so that, e.g., if "await Promise.reject()" will trigger a new
  throw (rather than a silent rethrow of something that never
  triggered an event in the first place).

BUG=v8:5167

Review-Url: https://codereview.chromium.org/2244003003
Cr-Commit-Position: refs/heads/master@{#38847}
2016-08-24 00:20:50 +00:00
adamk
9a558c5f4a Disallow 'yield' in async arrow parameter lists inside generators
R=littledan@chromium.org
BUG=v8:4483

Review-Url: https://codereview.chromium.org/2270223002
Cr-Commit-Position: refs/heads/master@{#38846}
2016-08-23 22:17:38 +00:00
jpp
cf5180c3ef [v8][wasm] Handles finally in try/finally blocks.
Introduces support for using

try {
} finally {
}

in wasm.

BUG=

Review-Url: https://codereview.chromium.org/2240743003
Cr-Commit-Position: refs/heads/master@{#38845}
2016-08-23 22:14:52 +00:00
gdeepti
6122465c88 [wasm] Add native x64 implementations for I32x4Splat, I32x4ExtractLane
- Instruction selection, code generation, test for Splat/Extract
 - Fixes for AstS128 Locals in wasm

R=bbudge@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2264533002
Cr-Commit-Position: refs/heads/master@{#38843}
2016-08-23 19:59:43 +00:00
adamk
ad07b49d7b Add a bit of test coverage for callers of destructuring assignment
In particular, this covers one caller of CheckDestructuringElement
that didn't have tests before.

R=caitp@igalia.com

Review-Url: https://codereview.chromium.org/2267153002
Cr-Commit-Position: refs/heads/master@{#38841}
2016-08-23 19:30:45 +00:00
jpp
a60e182250 [Asm.js] Prevents assignments to immutables.
Adds a check so that module validation fails if there are any
assignments to immutable identifiers (e.g., module name, module
parameters, stdlib imports.)

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=640194

Review-Url: https://codereview.chromium.org/2268363002
Cr-Commit-Position: refs/heads/master@{#38838}
2016-08-23 18:08:42 +00:00
jbroman
c4874b2fef Blink-compatible serialization of RegExp objects.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2262013002
Cr-Commit-Position: refs/heads/master@{#38835}
2016-08-23 15:16:29 +00:00
mlippautz
7695642e2c [heap] Tracer: Handle incremental marking scopes
Before this patch all tracing scopes in incremental marking would be reset
during a gc tracer start/stop cycle. This patch handles scopes the same way it
does other incremental marking metrics.

Also:
- Align finalization metric with regular marking metric.
- Smaller cleanups

BUG=chromium:639818

Review-Url: https://codereview.chromium.org/2273673002
Cr-Commit-Position: refs/heads/master@{#38834}
2016-08-23 15:13:50 +00:00