Commit Graph

10871 Commits

Author SHA1 Message Date
bradnelson
46728d4d95 Enable asm-wasm mjsunit tests.
BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1687813003

Cr-Commit-Position: refs/heads/master@{#33883}
2016-02-11 08:25:56 +00:00
bmeurer
4ff159bd28 [compiler] Sanitize entry points to LookupSlot access.
Add dedicated %LoadLookupSlot, %LoadLookupSlotInsideTypeof,
%LoadLookupSlotForCall, %StoreLookupSlot_Sloppy and
%StoreLookupSlot_Strict runtime entry points and use them
appropriately in the various compilers. This way we can
finally drop the machine operators from the JS graph level
completely in TurboFan.

Also drop the funky JSLoadDynamic operator from TurboFan,
which was by now just a small wrapper around the runtime
call to %LoadLookupSlot.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1683103002

Cr-Commit-Position: refs/heads/master@{#33880}
2016-02-11 06:24:28 +00:00
ssanfilippo
8bfd4a5ac9 [Interpreter] Handle negative ints in generate-bytecode-expectations.
The previous implementation used GetRawOperand(), which allows a nicely
unified handling of all scalar types, but returns an unsigned type.
Because of this, generate-bytecode-expectations couldn't properly handle
negative numbers.

This commit differentiate between different types of scalar operands and
uses the appropriate getter from i::interpreter::BytecodeArrayIterator,
thus correctly handling signed types where needed.

Two new helpers have been added to i::interpreter::Bytecodes:

 * IsImmediateOperandType()
 * IsIndexOperandType()

with the intuitive semantic.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1684113002

Cr-Commit-Position: refs/heads/master@{#33874}
2016-02-10 18:35:56 +00:00
rmcilroy
d1c28849c7 [Interpreter] Make InterpreterAssembler a subclass of CodeStubAssembler.
Moves InterpreterAssembler out of the compiler directory and into the
interpreter directory. Makes InterpreterAssembler as subclass of
CodeStubAssembler.

As part of this change, the special bytecode dispatch linkage type
is removed and instead we use a InterfaceDispatchDescriptor and
a normal CodeStub linkage type.

Removes a bunch of duplicated logic in InterpreterAssembler and
instead uses the CodeStubAssembler logic. Refactors Interpreter
with these changes.

Modifies CodeStubAssembler to add the extra operations required
by the Interpreter (extra call types, raw memory access and some extra
binary ops). Also adds the ability for subclasses to add extra
prologue and epilogue operations around calls, which is required
for the Interpreter.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1673333004

Cr-Commit-Position: refs/heads/master@{#33873}
2016-02-10 16:39:32 +00:00
yangguo
e0d0c96a53 [regexp] experimental implementation for \p property class.
Currently we only support general categories for property classes.

R=erik.corry@gmail.com, erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1685593002

Cr-Commit-Position: refs/heads/master@{#33872}
2016-02-10 16:24:05 +00:00
machenbach
99a58d30d2 Revert of Implement symbol @@hasInstance for ES6 instanceof support. (patchset #2 id:20001 of https://codereview.chromium.org/1683043003/ )
Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/1382/

Original issue's description:
> Implement symbol @@hasInstance for ES6 instanceof support.
>
> BUG=
>
> Committed: https://crrev.com/5833e8e8a437cd66405784263ccc45e73470fd42
> Cr-Commit-Position: refs/heads/master@{#33870}

TBR=bmeurer@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1686123002

Cr-Commit-Position: refs/heads/master@{#33871}
2016-02-10 16:22:01 +00:00
mvstanton
5833e8e8a4 Implement symbol @@hasInstance for ES6 instanceof support.
BUG=

Review URL: https://codereview.chromium.org/1683043003

Cr-Commit-Position: refs/heads/master@{#33870}
2016-02-10 14:34:51 +00:00
yangguo
35b6ca2528 [json parser] add position to error message.
R=jochen@chromium.org, verwaest@chromium.org
BUG=chromium:585724
LOG=N

Review URL: https://codereview.chromium.org/1681513002

Cr-Commit-Position: refs/heads/master@{#33864}
2016-02-10 11:28:53 +00:00
ssanfilippo
d3604cdb68 [Interpreter] Initial generate-bytecode-expectations implementation.
generate-bytecode-expectations is a tool intended to work together
with test/cctest/test-bytecode-generator.cc in order to produce a
meaningful diff between testcases and the actual bytecode being emitted.

It does so by parsing and compiling Javascript to bytecode,
constructing the same data structure in the testcase and then running a
textual diff between the expected (i.e. the one encoded in the unit test)
and actual (i.e. the one built from the compiler output) representation.

This commit is a first step in this direction, achieving just the first
half of what we desire. At the moment, bytecodechecker can:

* take a code snippet from the command line and emit the expected structure.
* adhere to the same formatting rules of the test cases
  (this one is important for text diff and for copy and pasting too)

Still to do:

* parse unit tests:
    + extract code snippets
    + indent the code to match the input test case
    + allow flexibility in the input format
    + try to recognize and work around some macro magic (i.e. REPEAT_127)
* emit the representation of the constant pool and handlers vector
* run a textual diff

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1671863002

Cr-Commit-Position: refs/heads/master@{#33863}
2016-02-10 11:26:34 +00:00
yangguo
1d5a50d35d [regexp] implement RegExp.prototype.toString for non-RegExp receiver.
R=littledan@chromium.org, verwaest@chromium.org
BUG=v8:4524
LOG=N

Review URL: https://codereview.chromium.org/1679123007

Cr-Commit-Position: refs/heads/master@{#33862}
2016-02-10 10:53:32 +00:00
mstarzinger
1986a486bf [interpreter] CompilationInfo::unoptimized_code only for OSR.
The field in question is only needed when the optimizing compiler is
triggered via OSR. All other paths (e.g. from bytecode stream) should
not rely on the unoptimized code being present.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1685633002

Cr-Commit-Position: refs/heads/master@{#33860}
2016-02-10 10:28:12 +00:00
verwaest
3ce9e808c5 Mark null and undefined as undetectable, and use it to handle abstract equality comparison in the generic compare ic
Marking as undetectable makes abstract equality of null, undefined, and
other undetectable objects easier. Supporting it in the generic compare
IC significantly speeds up dynamic comparison between those values and
JSReceivers by not falling back to the runtime.

MIPS port contributed by Balazs Kilvady <balazs.kilvady@imgtec.com>

Review URL: https://codereview.chromium.org/1683643002

Cr-Commit-Position: refs/heads/master@{#33858}
2016-02-10 09:56:26 +00:00
mlippautz
cfbd25617c [heap] Move to page lookups for SemiSpace, NewSpace, and Heap containment methods
Preparing the young generation for (real) non-contiguous backing memory, this
change removes object masks that are used to compute containment in semi and new
space. The masks are replaced by lookups for object tags and page headers, where
possible.

Details:
- Use the fast checks (page header lookups) for containment in regular code.
- Use the slow version that masks out the page start adress and iterates all
  pages of a space for debugging/verification.
- The slow version works for off-heap/unmapped memory.
- Encapsulate all checks for the old->new barrier in Heap::RecordWrite().

BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1632913003

Cr-Commit-Position: refs/heads/master@{#33857}
2016-02-10 09:47:16 +00:00
mstarzinger
582be2ba09 [interpreter] Make it possible to optimize without parse.
This makes sure we can run through the TurboFan pipeline without having
to parse the source when using the bytecode stream as input. This path
is now being tested by the BytecodeGraphTester helper.

R=titzer@chromium.org,rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1679313002

Cr-Commit-Position: refs/heads/master@{#33856}
2016-02-10 09:16:38 +00:00
neis
ff97dc820d [proxies] Implement spec change to consistency check in [[SetPrototypeOf]].
See https://github.com/tc39/ecma262/pull/331.

R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1680133002

Cr-Commit-Position: refs/heads/master@{#33855}
2016-02-10 08:07:40 +00:00
martyn.capewell
5ac796b553 Revert of [turbofan] ARM: Improve AND instruction selection (patchset #1 id:1 of https://codereview.chromium.org/1677023002/ )
Reason for revert:
Possibly causing Mozilla test failures - will investigate.

Original issue's description:
> [turbofan] ARM: Improve AND instruction selection
>
> Improve instruction selector for mask and shift operations by using cheaper
> instructions where possible, in preference to UBFX.
>
> BUG=
>
> Committed: https://crrev.com/53d9c12977f07f55b6f2a72128b8d02c4c857845
> Cr-Commit-Position: refs/heads/master@{#33843}

TBR=bmeurer@chromium.org,jarin@chromium.org,danno@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1681953003

Cr-Commit-Position: refs/heads/master@{#33850}
2016-02-09 15:12:00 +00:00
mstarzinger
e932c0e788 [interpreter] Enable exception tests that no longer fail.
R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1686533002

Cr-Commit-Position: refs/heads/master@{#33846}
2016-02-09 13:09:02 +00:00
mstarzinger
d60c6bdf2e Add test for exception handler context switch.
This adds test cases for exception handlers that require a context
switch when entering the catch-block or the finally-block, triggered
through nested contexts within the try-block.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1681933002

Cr-Commit-Position: refs/heads/master@{#33845}
2016-02-09 12:31:45 +00:00
Orion Hodson
8e362a2096 [interpreter] Re-enable test-interpreter/ClassDeclarations.
BUG=v8:4280,v8:4682
LOG=N
R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1678903003 .

Cr-Commit-Position: refs/heads/master@{#33844}
2016-02-09 11:44:04 +00:00
martyn.capewell
53d9c12977 [turbofan] ARM: Improve AND instruction selection
Improve instruction selector for mask and shift operations by using cheaper
instructions where possible, in preference to UBFX.

BUG=

Review URL: https://codereview.chromium.org/1677023002

Cr-Commit-Position: refs/heads/master@{#33843}
2016-02-09 11:14:24 +00:00
ulan
edde7b28f6 Filter out invalid slots in store buffer eagerly during object transition.
BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1675163003

Cr-Commit-Position: refs/heads/master@{#33841}
2016-02-09 10:48:23 +00:00
yangguo
33c78c39d7 [regexp] simplify unanchored advance for unicode regexps.
When doing advance at the start of an unanchored unicode regexp,
we do not have to care about surrogate pairs. If we actually advance
into the middle of a surrogate pair, the only choice is to also
consume trail surrogate as nothing else can match from there.

This reduces the emitted code slightly. By not having choice in the
loop, we do not have to push backtrack onto the stack, preventing
stack overflow.

R=erik.corry@gmail.com, erikcorry@chromium.org

Review URL: https://codereview.chromium.org/1676293003

Cr-Commit-Position: refs/heads/master@{#33838}
2016-02-09 09:11:24 +00:00
yangguo
5082eaee5f [regexp] fix off-by-one in UnicodeRangeSplitter.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1681873002

Cr-Commit-Position: refs/heads/master@{#33837}
2016-02-09 09:10:31 +00:00
bmeurer
00f7d1f5f8 [intrinsics] Kill the %_IsMinusZero intrinsic.
By now only the default %TypedArray%.prototype.sort compare function
and the JS implementation of SameValueZero were still using the odd
%_IsMinusZero intrinsic, whose semantics both included a number check
(actually HeapNumber test) plus testing if the heap number stores the
special -0 value. In both cases we already know that we deal with
number so we can reduce it to a simple number test for -0, which can
be expressed via dividing 1 by that value and checking the sign of
the result. In case of the compare function, we can be even smarter
and work with the reciprocal values in case x and y are equal to 0
(although long term we should probably rewrite the fast case for
the typed array sorting function in C++ anyway, which will be way,
way faster than our handwritten callback-style, type-feedback
polluted JS implementation).

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1680783002

Cr-Commit-Position: refs/heads/master@{#33833}
2016-02-09 06:28:53 +00:00
binji
7a004a02da [wasm] Put the condition last in kExprBrIf.
To bring V8 into line with the proposed design changes in:

 https://github.com/WebAssembly/design/pull/489

(This CL is forked from https://codereview.chromium.org/1634673002/.
That CL doesn't merge cleanly, and I can't update it.)

TBR=titzer@chromium.org
LOG=Y
BUG=chromium:575167

Review URL: https://codereview.chromium.org/1682443002

Cr-Commit-Position: refs/heads/master@{#33828}
2016-02-08 21:19:26 +00:00
littledan
43cd128eff Stage --harmony-species flag, enabling Symbol.species
This patch moves Symbol.species support to the "experimental JavaScript
features" flag. While @@species is still a performance hit, it doesn't seem
like it would make the web unusably slow; shipping would still have to
wait on fixing the performance regression, but staging this version should
yield valuable web compatibility information.

R=cbruni
BUG=v8:4093
LOG=Y

Review URL: https://codereview.chromium.org/1678143002

Cr-Commit-Position: refs/heads/master@{#33827}
2016-02-08 21:18:17 +00:00
littledan
e1de522afa Extend subarray web compatibility fix to --harmony-species
ES2016 TypedArray subclassing semantics break the Node.js Buffer module,
also used on the web. I wrote a pull request against the web and Node
versions to fix the issue, but the pull request has not yet been granted,
and this is blocking shipping the change. For now, this patch extends the
web compatibility workaround to the --harmony-species flag, so that
Symbol.species and associated subclassing semantics can ship independently.

R=cbruni
BUG=v8:4665
LOG=Y

Review URL: https://codereview.chromium.org/1678123002

Cr-Commit-Position: refs/heads/master@{#33826}
2016-02-08 21:16:49 +00:00
alph
1b6265eff7 Unflake CPU profiler tests.
Do not rely on elapsed time to collect enough samples.
Use CollectSample API function instead.

Remove checks for extra functions present in a profile, as
there in fact can be lots of native support functions.

BUG=v8:2999
LOG=N

Review URL: https://codereview.chromium.org/1665303004

Cr-Commit-Position: refs/heads/master@{#33822}
2016-02-08 18:12:20 +00:00
rmcilroy
fe58118597 [Interpreter] Group Ignition mjsunit test failures by error.
Also replace SKIPS by FAIL to ensure tests are reenabled once they work.

BUG=v8:4680
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_arm64_dbg,v8_linux_arm_dbg

Review URL: https://codereview.chromium.org/1667323002

Cr-Commit-Position: refs/heads/master@{#33821}
2016-02-08 15:49:51 +00:00
mstarzinger
5fdf5c1e4d [interpreter] Remove special "prototype" load in class literals.
This allows us to remove the somewhat awkward BuildLoadObjectField
from the BytecodeGraphBuilder and also allows us to simplify the
bytecode stream for class literals.

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1678103002

Cr-Commit-Position: refs/heads/master@{#33820}
2016-02-08 15:20:32 +00:00
mythria
90721a51a3 [Interpreter] Adds support for const/let variables to interpreter.
Adds implementation and tests to support const/let variables in the
interpreter.

BUG=v8:4280,v8:4679
LOG=N

Review URL: https://codereview.chromium.org/1634153002

Cr-Commit-Position: refs/heads/master@{#33819}
2016-02-08 14:14:57 +00:00
caitpotter88
e708dd54b9 reland [es7] refactor and fix Object.values() / Object.entries()
Previously, Object.values() and Object.entries() were piggy-backing on
Object.keys(). This meant that they would pre-filter non-enumerable properties,
violating the runtime behaviour of the methods. Unfortunately, this does not
match the current proposal text.

Also incorporates several tests verifying this behaviour based on tests included
in the ChakraCore implementation.

In this reland, the new patch fills up the longer-lasting FixedArray with
`undefined` to avoid the crash in Heap::Verify().

Originally reviewed at https://codereview.chromium.org/1637753004

BUG=v8:4663
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1673673002

Cr-Commit-Position: refs/heads/master@{#33818}
2016-02-08 14:11:05 +00:00
mstarzinger
664110f882 Remove --stop-at flag from several backends.
The flag in question is a debug-only flag supported by full-codegen and
Crankshaft only. In it's current form there are some unresolved issues:
- The flag is defeated by inlining in Crankshaft.
- The flag is not supported by TurboFan.
- The flag is not supported by Ignition.

Instead of addressing the above issues and increasing maintenance cost
for all backends and also given the "slim" test coverage, this CL fully
removes the support from all backends.

R=bmeurer@chromium.org,jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1676263002

Cr-Commit-Position: refs/heads/master@{#33817}
2016-02-08 13:57:39 +00:00
bmeurer
07e9921f5a [turbofan] Introduce JSCreateLowering for optimizing JSCreate nodes.
This moves the JSCreate related functionality from JSTypedLowering into
a dedicated JSCreateLowering reducer. This is in preparation of landing
the support for optimized literals in TurboFan, which would blow up
JSTypedLowering quite seriously otherwise.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1678833002

Cr-Commit-Position: refs/heads/master@{#33813}
2016-02-08 12:33:59 +00:00
jacob.bramley
4d1f84921b [arm] Add several missing vcvt disassembly tests.
BUG=

Review URL: https://codereview.chromium.org/1678043002

Cr-Commit-Position: refs/heads/master@{#33811}
2016-02-08 11:45:37 +00:00
bmeurer
3ef573e9f1 [runtime] Optimize and unify rest parameters.
Replace the somewhat awkward RestParamAccessStub, which would always
call into the runtime anyway with a proper FastNewRestParameterStub,
which is basically based on the code that was already there for strict
arguments object materialization. But for rest parameters we could
optimize even further (leading to 8-10x improvements for functions with
rest parameters), by fixing the internal formal parameter count:

Every SharedFunctionInfo has a formal_parameter_count field, which
specifies the number of formal parameters, and is used to decide whether
we need to create an arguments adaptor frame when calling a function
(i.e. if there's a mismatch between the actual and expected parameters).
Previously the formal_parameter_count included the rest parameter, which
was sort of unfortunate, as that meant that calling a function with only
the non-rest parameters still required an arguments adaptor (plus some
other oddities). Now with this CL we fix, so that we do no longer
include the rest parameter in that count. Thereby checking for rest
parameters is very efficient, as we only need to check whether there is
an arguments adaptor frame, and if not create an empty array, otherwise
check whether the arguments adaptor frame has more parameters than
specified by the formal_parameter_count.

The FastNewRestParameterStub is written in a way that it can be directly
used by Ignition as well, and with some tweaks to the TurboFan backends
and the CodeStubAssembler, we should be able to rewrite it as
TurboFanCodeStub in the near future.

Drive-by-fix: Refactor and unify the CreateArgumentsType which was
different in TurboFan and Ignition; now we have a single enum class
which is used in both TurboFan and Ignition.

R=jarin@chromium.org, rmcilroy@chromium.org
TBR=rossberg@chromium.org
BUG=v8:2159
LOG=n

Review URL: https://codereview.chromium.org/1676883002

Cr-Commit-Position: refs/heads/master@{#33809}
2016-02-08 10:08:50 +00:00
ivica.bogosavljevic
b23d5389e0 Reland of MIPS: Add FPXX support to MIPS32R2
Fix failures on MIPS simulator because incomplete
handling of MTHC1 and MFHC1 in Fp32 mode
Fix failures on older kernels that have problems with
MTHC1 and MFHC1 in kernel FPU emulation

Original issue's description:
> Revert of MIPS: Add FPXX support to MIPS32R2 (patchset #3
> id:40001 of https://codereview.chromium.org/1586223004/ )
>
> Reason for revert:
> Revert patch due to a number of failures appearing on the > MIPS v8 simulator
>
> Original issue's description:
>> MIPS: Add FPXX support to MIPS32R2
>>
>> The JIT code generated by V8 is FPXX compliant
>> when v8 compiled with FPXX flag. This allows the code to
>> run in both FP=1 and FP=0 mode. It also alows v8 to be used
>> as a library by both FP32 and FP64 binaries.
>>
>> BUG=
>>
>> Committed: https://crrev.com/95110dde666158a230a823fd50a68558ad772320
>> Cr-Commit-Position: refs/heads/master@{#33576}

BUG=

Review URL: https://codereview.chromium.org/1659883002

Cr-Commit-Position: refs/heads/master@{#33808}
2016-02-08 09:44:19 +00:00
ulan
bb883395a8 New page local store buffer.
This replaces the global remembered set with per-page remembered sets.

Each page in the old space, map space, and large object space keeps track of
the set of slots in the page pointing to the new space.

The data structure for storing slot sets is a two-level bitmap, which allows
us to remove the store buffer overflow and SCAN_ON_SCAVENGE logic.

Design doc: https://goo.gl/sMKCf7

BUG=chromium:578883
LOG=NO

Review URL: https://codereview.chromium.org/1608583002

Cr-Commit-Position: refs/heads/master@{#33806}
2016-02-08 08:51:38 +00:00
ishell
da213b6e37 [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.
Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.

The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.

BUG=chromium:579009
LOG=Y

Committed: https://crrev.com/6a118774244d087b5979e9291d628a994f21d59d
Cr-Commit-Position: refs/heads/master@{#33674}

Review URL: https://codereview.chromium.org/1642223003

Cr-Commit-Position: refs/heads/master@{#33798}
2016-02-06 18:10:36 +00:00
jing.bao
2166bd8ce5 [turbofan] Add TruncateFloat32ToUint32 operator to Turbofan.
BUG=

Review URL: https://codereview.chromium.org/1627263002

Cr-Commit-Position: refs/heads/master@{#33797}
2016-02-06 18:09:35 +00:00
jing.bao
187b3f2845 [turbofan] Add RoundUint32ToFloat32 operator to Turbofan.
BUG=

Review URL: https://codereview.chromium.org/1628133002

Cr-Commit-Position: refs/heads/master@{#33796}
2016-02-06 18:08:09 +00:00
aseemgarg
0e22baac12 fix int type coercion in asm to wasm
R=bradnelson@chromium.org
BUG=https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=asm-wasm.js
LOG=N

Review URL: https://codereview.chromium.org/1675903002

Cr-Commit-Position: refs/heads/master@{#33793}
2016-02-06 00:57:02 +00:00
balazs.kilvady
a58c750ccc MIPS: Fix FPU min, max, mina, maxa in simulator.
BUG=
TEST=cctest/test-assembler-mips/min_max, cctest/test-assembler-mips/mina_maxa, cctest/test-assembler-mips64/min_max, cctest/test-assembler-mips64/mina_maxa

Review URL: https://codereview.chromium.org/1668143002

Cr-Commit-Position: refs/heads/master@{#33790}
2016-02-05 17:59:05 +00:00
machenbach
bdfcc61325 Revert of [es7] refactor and fix Object.values() / Object.entries() (patchset #6 id:100001 of https://codereview.chromium.org/1637753004/ )
Reason for revert:
[Sheriff] Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/1642

Original issue's description:
> [es7] refactor and fix Object.values() / Object.entries()
>
> Previously, Object.values() and Object.entries() were piggy-backing on
> Object.keys(). This meant that they would pre-filter non-enumerable properties,
> violating the runtime behaviour of the methods. Unfortunately, this does not
> match the current proposal text.
>
> Also incorporates several tests verifying this behaviour based on tests included
> in the ChakraCore implementation.
>
> BUG=v8:4663
> LOG=N
> R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org
>
> Committed: https://crrev.com/5c5ccd9d7f8693990d1a9eb26ba3a94f376dcf0b
> Cr-Commit-Position: refs/heads/master@{#33782}

TBR=littledan@chromium.org,adamk@chromium.org,cbruni@chromium.org,rossberg@chromium.org,caitpotter88@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4663

Review URL: https://codereview.chromium.org/1675663002

Cr-Commit-Position: refs/heads/master@{#33787}
2016-02-05 15:36:02 +00:00
mstarzinger
8b4e1042ae [turbofan] Deprecate --turbo-try-finally flag.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1671623005

Cr-Commit-Position: refs/heads/master@{#33786}
2016-02-05 15:20:44 +00:00
ahaas
563539a3d6 [wasm] min/max does not return signaling NaNs anymore.
To avoid returning a signaling NaN the result is multiplied by 1.0.

R=titzer@chromium.org, binji@chromium.org

BUG=4733
LOG=Y

Review URL: https://codereview.chromium.org/1673583002

Cr-Commit-Position: refs/heads/master@{#33783}
2016-02-05 15:00:24 +00:00
caitpotter88
5c5ccd9d7f [es7] refactor and fix Object.values() / Object.entries()
Previously, Object.values() and Object.entries() were piggy-backing on
Object.keys(). This meant that they would pre-filter non-enumerable properties,
violating the runtime behaviour of the methods. Unfortunately, this does not
match the current proposal text.

Also incorporates several tests verifying this behaviour based on tests included
in the ChakraCore implementation.

BUG=v8:4663
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1637753004

Cr-Commit-Position: refs/heads/master@{#33782}
2016-02-05 14:38:34 +00:00
jkummerow
5d2c09a829 Fix Array.prototype.sort for *_STRING_WRAPPER_ELEMENTS
Trying to sort a string should throw a TypeError, proper handling
of elements just needs to get out of the way.

BUG=chromium:584188
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1670153002

Cr-Commit-Position: refs/heads/master@{#33777}
2016-02-05 13:36:51 +00:00
titzer
59b922fb4e [wasm] Put the condition last in kExprSelect.
To bring V8 into line with the proposed design changes in:

 https://github.com/WebAssembly/design/pull/489

R=ahaas@chromium.org,bradnelson@chromium.org
LOG=Y
BUG=chromium:575167
BUG=v8:4735

Review URL: https://codereview.chromium.org/1624323003

Cr-Commit-Position: refs/heads/master@{#33776}
2016-02-05 13:34:53 +00:00
yangguo
85eff14c37 [interpreter] source positions should not be emitted for dead code.
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1668863002

Cr-Commit-Position: refs/heads/master@{#33775}
2016-02-05 13:29:45 +00:00
yangguo
c844c036f2 Fix debug-script test expectation for no-snap build.
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1668393004

Cr-Commit-Position: refs/heads/master@{#33772}
2016-02-05 13:04:51 +00:00
jochen
14e8ee0763 Always load data for access check callbacks
R=verwaest@chromium.org
BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1677483002

Cr-Commit-Position: refs/heads/master@{#33771}
2016-02-05 12:56:18 +00:00
yangguo
8a2d571734 [bootstrapper] extra natives must not use natives syntax.
R=bmeurer@chromium.org, domenic@chromium.org

Review URL: https://codereview.chromium.org/1670923003

Cr-Commit-Position: refs/heads/master@{#33770}
2016-02-05 12:33:55 +00:00
jarin
52f2dbcac1 [turbofan] Reducers should revisit end after merging to it.
Review URL: https://codereview.chromium.org/1675433003

Cr-Commit-Position: refs/heads/master@{#33767}
2016-02-05 11:01:44 +00:00
mvstanton
3f36e658c8 Revert of Type Feedback Vector lives in the closure (patchset #2 id:40001 of https://codereview.chromium.org/1668103002/ )
Reason for revert:
Must revert for now due to chromium api natives issues.

Original issue's description:
> Type Feedback Vector lives in the closure
>
> (RELAND: the problem before was a missing write barrier for adding the code
> entry to the new closure. It's been addressed with a new macro instruction
> and test. The only change to this CL is the addition of two calls to
> __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
> Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
> And Benedikt reviewed it as well.
>
> TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org
>
> BUG=
>
> Committed: https://crrev.com/bb31db3ad6de16f86a61f6c7bbfd3274e3d957b5
> Cr-Commit-Position: refs/heads/master@{#33741}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1670813005

Cr-Commit-Position: refs/heads/master@{#33766}
2016-02-05 10:48:35 +00:00
aseemgarg
f060922369 Add Foreign Functions to asm to wasm
R=bradnelson@chromium.org
BUG=https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=asm-wasm.js
LOG=N

Review URL: https://codereview.chromium.org/1667253003

Cr-Commit-Position: refs/heads/master@{#33757}
2016-02-05 02:07:58 +00:00
adamk
21c045a2fa Support computed properties for ES2015 Function.name
Adds a new runtime function, %DefineDataPropertyInLiteral, which
takes a fifth argument specifying whether the property and value
are syntactically such that the value is a function (or class)
literal that should have its name set at runtime.

The new runtime call also allows us to eliminate the now-redundant
%DefineClassMethod runtime function.

This should get much less ugly once we can desugar the "dynamic"
part of object literals in the parser (but that work is currently
blocked on having a performant way of desugaring literals).

BUG=v8:3699, v8:3761
LOG=n

Review URL: https://codereview.chromium.org/1626423003

Cr-Commit-Position: refs/heads/master@{#33756}
2016-02-04 22:36:48 +00:00
caitpotter88
ee10b595f9 [esnext] implement Object.getOwnPropertyDescriptors() proposal
BUG=v8:4725
LOG=N
R=adamk@chromium.org, cbruni@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1658773003

Cr-Commit-Position: refs/heads/master@{#33752}
2016-02-04 21:56:24 +00:00
alph
271f68ba02 Fix crash in SafeStackFrameIterator related to native frames entry/exit
There might be several ExternalCallbackScope's created
during the native callback. Remove the assert that is not
aligned with that.

Moreover this iterator must work for any kind of
stacks including corrupted ones.

BUG=v8:4705
LOG=N

Review URL: https://codereview.chromium.org/1663193003

Cr-Commit-Position: refs/heads/master@{#33751}
2016-02-04 20:00:48 +00:00
cbruni
07d05dddce [proxies] allow duplicate keys for [[OwnPropertyKeys]] trap.
BUG=v8:4724, v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1668853002

Cr-Commit-Position: refs/heads/master@{#33747}
2016-02-04 17:55:35 +00:00
oth
1b436ae168 [interpreter] Support for ES6 class literals.
Port of class literal support from the
ast-graph-builder implementation.

R=rmcilroy@chromium.org,mstarzinger@chromium.org
BUG=v8:4280,v8:4682
LOG=N

Review URL: https://codereview.chromium.org/1666943003

Cr-Commit-Position: refs/heads/master@{#33746}
2016-02-04 17:47:38 +00:00
mstarzinger
d3ac2450ab [interpreter] Enable exception test that no longer fails.
R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1662293002

Cr-Commit-Position: refs/heads/master@{#33745}
2016-02-04 17:32:04 +00:00
neis
dbd8640813 [generators] Implement Generator.prototype.return.
Note: This is currently only used by yield*, we still need to support it in
other places (such as for-of loops).  It can be used manually of course.

(This CL does not touch the full-codegen implementation of yield* because that
code is already dead.  The yield* desugaring already supports return and doesn't
need to be touched.)

BUG=v8:3566
LOG=y

Review URL: https://codereview.chromium.org/1639343005

Cr-Commit-Position: refs/heads/master@{#33744}
2016-02-04 17:14:15 +00:00
jfb
ad6b8542a8 WebAssembly: add stack trace test
The test currently only shows the JavaScript stack frames, I'll then add
support for interleaved WebAssembly stack frames and update the test.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1661383002

Cr-Commit-Position: refs/heads/master@{#33742}
2016-02-04 16:25:22 +00:00
mvstanton
bb31db3ad6 Type Feedback Vector lives in the closure
(RELAND: the problem before was a missing write barrier for adding the code
entry to the new closure. It's been addressed with a new macro instruction
and test. The only change to this CL is the addition of two calls to
__ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)

We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...
Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
And Benedikt reviewed it as well.

TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1668103002

Cr-Commit-Position: refs/heads/master@{#33741}
2016-02-04 15:41:23 +00:00
littledan
7232c9f267 Mark an invalid test262 test as allowed to fail
R=neis

Review URL: https://codereview.chromium.org/1667103002

Cr-Commit-Position: refs/heads/master@{#33740}
2016-02-04 15:36:21 +00:00
yangguo
86164a2573 [interpreter, debugger] implement debugger statement.
R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1667073002

Cr-Commit-Position: refs/heads/master@{#33739}
2016-02-04 15:07:06 +00:00
neis
5269944a18 [generators] Desugar yield*.
This CL deals with yield* by desugaring it in the parser.  Hence the
full-codegen implementation of it becomes obsolete and can be removed in a
future CL.

The only change in semantics should be that the results of the iterator's next
and throw methods are checked to be objects, which didn't happen before but is
required by the spec.

BUG=

Review URL: https://codereview.chromium.org/1643903003

Cr-Commit-Position: refs/heads/master@{#33735}
2016-02-04 14:13:03 +00:00
mstarzinger
76bfc16bea [interpreter] Switch context during stack unwinding.
This implements proper context switching while unwinding the stack due
to an exception being handled in interpreted code. The context under
which the handler is scoped is being preserved in a dedicated register
while the try-block is running. Both, the stack unwinding machinery as
well as the graph builder, restore the context from that register.

R=rmcilroy@chromium.org,bmeurer@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1665833002

Cr-Commit-Position: refs/heads/master@{#33733}
2016-02-04 13:43:55 +00:00
mythria
a318cb2f5d [Interpreter] Removes skips for tests that are no longer crashing with ignition.
Removes skips for two tests in cctest that are no longer crashing with ignition.

BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1668843003

Cr-Commit-Position: refs/heads/master@{#33732}
2016-02-04 13:36:05 +00:00
machenbach
8b6c01432b [test] Slim down mjsunit/apply.
BUG=

Review URL: https://codereview.chromium.org/1668833002

Cr-Commit-Position: refs/heads/master@{#33731}
2016-02-04 13:19:19 +00:00
rmcilroy
1ce720f2a4 [Interpreter] Add explicit StackCheck bytecodes on function entry and back branches.
Moves the stack check from the function entry trampoline to instead be
after function activation using an explicit StackCheck bytecode. Also
add stack checks on back edges of loops.

BUG=v8:4280,v8:4678
LOG=N

Review URL: https://codereview.chromium.org/1665853002

Cr-Commit-Position: refs/heads/master@{#33730}
2016-02-04 12:33:48 +00:00
yangguo
0f075613e7 [interpreter] temporarily remove --ignition from test.
This is to avoid polluting fuzzer seeds with the --ignition flag
until we figure out something better.

TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1661333002

Cr-Commit-Position: refs/heads/master@{#33729}
2016-02-04 11:47:00 +00:00
machenbach
1b369e9607 [Ignition] Skip crashing test on arm64.
Crashes after https://codereview.chromium.org/1667673003

BUG=v8:4280
LOG=N
NOTRY=true
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1669783002

Cr-Commit-Position: refs/heads/master@{#33727}
2016-02-04 11:04:44 +00:00
yangguo
876d35e228 [interpreter] add source positions for call and call-new.
This change adds the basic infrastructure to record source
positions for bytecode.

R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4960
LOG=N

Review URL: https://codereview.chromium.org/1662983002

Cr-Commit-Position: refs/heads/master@{#33726}
2016-02-04 10:50:18 +00:00
titzer
9c006b724e [wasm] Refactor handling of operands to bytecodes.
This cleans up and simplifyies handling the bytes followin an opcode
with little helper structs that will be useful in the interpreter and
already have been in keeping OpcodeArity and OpcodeLength up to date
with the decoder.

R=bradnelson@chromium.org, ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1664883002

Cr-Commit-Position: refs/heads/master@{#33723}
2016-02-04 10:16:47 +00:00
mythria
9aa612cb2c [Interpreter] Adds support for rest parameters to interpreter.
Adds implementation and tests for rest parameters to interpreter.

BUG=v8:4280,v8:4683
LOG=N

Review URL: https://codereview.chromium.org/1664593003

Cr-Commit-Position: refs/heads/master@{#33722}
2016-02-04 10:03:17 +00:00
ahaas
1101739898 [wasm] Initial commit for the Int64Reducer.
The goal of the Int64Reducer is to replace all int64 nodes in a tf graph
with a set of int32 nodes such that 64 bit tf functions can be executed
on 32 bit platforms. At the moment the Int64Reducer only replaces
Int64Constants, TruncateInt64ToInt32, and Word64And.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1655883002

Cr-Commit-Position: refs/heads/master@{#33721}
2016-02-04 09:41:23 +00:00
mvstanton
477e133698 Write barrier for storing a code entry, and usage in CompileLazy builtin.
BUG=

Review URL: https://codereview.chromium.org/1647123002

Cr-Commit-Position: refs/heads/master@{#33718}
2016-02-04 08:16:11 +00:00
bmeurer
264fa75e52 [math] Fix Math.hypot to properly call ToNumber on all arguments.
The spec requires all Math functions to first call ToNumber on all
arguments before doing any other observable operation.  So early
return in case of Infinity is not valid.

Drive-by-fix: Remove the use of %_Arguments / %_ArgumentsLength and
use (strict) arguments instead of allocating a temporary InternalArray
explicitly.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1669773002

Cr-Commit-Position: refs/heads/master@{#33717}
2016-02-04 07:23:27 +00:00
mtrofin
1ecf58f409 [turbofan] fine grained in-block move optimization
So far, we've been moving down gaps wholesale. This change moves
individual move operations instead. This improves some benchmarks,
and should overall reduce code size, because it improves the chance of
reducing the number of moves.

For example, there are improvements on x64 in Emscripten (Bullet, in
particular) , JetStream geomean, Embenchen (zlib).

In the process of making this change, I noticed we can separate the
tasks performed by the move optimizer, as follows:

- group gaps into 1
- push gaps down, jumping instructions (these 2 were together before)
- merge blocks (and then push gaps down)
- finalize

We can do without a finalization list. This avoids duplicating storage -
we already have the list of instructions; it also simplifies the logic, since,
with this change, we may process an instruction's gap twice.

Compile time doesn't regress much (see pathological cases), but we
may want to avoid the allocations of the few sets used in the new code.
I'll do that in a subsequent change.

BUG=

Review URL: https://codereview.chromium.org/1634093002

Cr-Commit-Position: refs/heads/master@{#33715}
2016-02-04 06:30:34 +00:00
aseemgarg
66018a0ea8 Fix asm-wasm.js test.
R=bradnelson@chromium.org
BUG=https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=asm-wasm.js
LOG=N

Review URL: https://codereview.chromium.org/1664993002

Cr-Commit-Position: refs/heads/master@{#33713}
2016-02-03 22:40:31 +00:00
adamk
8a4a5bf9e0 Remove flags for ES2015 features shipped in M48
This removes --harmony-completion, --harmony-concat-spreadable, and
--harmony-tolength and moves the appropriate tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1667453002

Cr-Commit-Position: refs/heads/master@{#33712}
2016-02-03 20:51:46 +00:00
kozyatinskiy
3c3d7e7be8 Revert "Removed support deprecated (//@|/*@) source(URL|MappingURL)="
A lot of deverlopers use deprecated sourceURL syntax. We should add console warning message before removing this.
Original CL: https://codereview.chromium.org/1495633002/

BUG=chromium:558998
LOG=Y
R=yangguo@chromium.org,hablich@chromium.org,adamk@chromium.org

Review URL: https://codereview.chromium.org/1654223003

Cr-Commit-Position: refs/heads/master@{#33709}
2016-02-03 18:45:36 +00:00
mythria
ee4efed740 [Interpreter] Skips a failing test on arm64.
Skips cctest/test-heap/NoWeakHashTableLeakWithIncrementalMarking
that is crashing on arm64.

BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1660613005

Cr-Commit-Position: refs/heads/master@{#33708}
2016-02-03 15:31:32 +00:00
oth
3c64400f19 [interpreter] Unify meaning of register count operands.
Unifies the meaning of kRegCount8 and kRegCount16 across bytecodes.
Call and CallJSRuntime had a slightly different use of the register
count operand. From this change forth, register count operands are
always based off of the previous register operand.

BUG=v8:4280,v8:4675
LOG=N

Review URL: https://codereview.chromium.org/1659023002

Cr-Commit-Position: refs/heads/master@{#33707}
2016-02-03 15:22:46 +00:00
yangguo
aff7bd54be [regexp] fix zero-length matches for RegExp.prototype.@@split.
BUG=v8:4717
LOG=N

Review URL: https://codereview.chromium.org/1663543003

Cr-Commit-Position: refs/heads/master@{#33706}
2016-02-03 14:49:07 +00:00
mythria
8d3e1ca357 [Interpreter] Adds support for with statement to interpreter.
Adds implementation and tests for with statement to interprter.

BUG=v8:4280,v8:4684
LOG=N

Review URL: https://codereview.chromium.org/1656863002

Cr-Commit-Position: refs/heads/master@{#33705}
2016-02-03 14:41:37 +00:00
mstarzinger
e814457675 [interpreter] Clear pending message object on handler entry.
This clears the currently pending message object whenever a try-block or
a finally-block is being entered in interpreted code. The intention is
to avoid memory leaks introduced by the message object. Also the message
object is being restored when a finally-block exits.

R=rmcilroy@chromium.org
TEST=cctest/test-heap/MessageObjectLeak
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1651993002

Cr-Commit-Position: refs/heads/master@{#33704}
2016-02-03 13:52:46 +00:00
balazs.kilvady
ebac85c0a4 MIPS: Use PC relative instructions on r6.
BUG=

Review URL: https://codereview.chromium.org/1628453002

Cr-Commit-Position: refs/heads/master@{#33703}
2016-02-03 13:31:30 +00:00
titzer
007e14ce4b [wasm] Rename local_int32_count to local_i32_count and similar textual replacements.
R=ahaas@chromium.org,jfb@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1661713003

Cr-Commit-Position: refs/heads/master@{#33702}
2016-02-03 11:06:45 +00:00
verwaest
158cd5cb5e [runtime] Remove receiver==holder check in IntegerIndexedExotic lookup
This was inconsistent in the spec in case of has vs get, set. Removing
receiver==holder simplifies the lookup; so tentatively removing this
additional check which was broken until yesterday anyway. See
https://github.com/tc39/ecma262/issues/347 for more information.

Review URL: https://codereview.chromium.org/1660903002

Cr-Commit-Position: refs/heads/master@{#33701}
2016-02-03 10:30:40 +00:00
bradnelson
255f4507ec Drop the compileRun + asmCompileRun methods from wasm.
Now that we have full fledged module instantiation,
keeping alive a second interface seems clunky.

Droping it and switching the tests.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm,other wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1660083002

Cr-Commit-Position: refs/heads/master@{#33700}
2016-02-03 10:16:22 +00:00
jochen
a75b2c8f69 Add the data parameter back to the access check callback
BUG=none
R=verwaest@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1653423002

Cr-Commit-Position: refs/heads/master@{#33699}
2016-02-03 10:02:35 +00:00
hablich
db47a31fb9 Revert of [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a … (patchset #3 id:80001 of https://codereview.chromium.org/1642223003/ )
Reason for revert:
Fails a lot of layout tests and blocks the roll. Can be easily reproduced with a local Chromium checkout.

Reference: https://codereview.chromium.org/1652413003/

Original issue's description:
> [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.
>
> Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
> When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
> ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.
>
> The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.
>
> This CL also prohibits non-primitive properties in ObjectTemplate to avoid potential cross-context leaks.
>
> BUG=chromium:579009
> LOG=Y
>
> Committed: https://crrev.com/6a118774244d087b5979e9291d628a994f21d59d
> Cr-Commit-Position: refs/heads/master@{#33674}

TBR=verwaest@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:579009

Review URL: https://codereview.chromium.org/1660263003

Cr-Commit-Position: refs/heads/master@{#33698}
2016-02-03 09:53:18 +00:00
neis
a973f73465 Expect JSReceiver in Runtime_DeleteLookupSlot, not just JSObject.
BUG=chromium:583260
LOG=n

Review URL: https://codereview.chromium.org/1664683002

Cr-Commit-Position: refs/heads/master@{#33697}
2016-02-03 09:49:22 +00:00
hablich
86dd673c2c Reland of [heap] Simplify distribution of remaining memory during sweeping & compaction (patchset #1 id:1 of https://codereview.chromium.org/1661723003/ )
Reason for revert:
Bisection results show that this was not the culprit.

Original issue's description:
> Revert of [heap] Simplify distribution of remaining memory during sweeping & compaction (patchset #2 id:80001 of https://codereview.chromium.org/1653973003/ )
>
> Reason for revert:
> Very likely blocking roll: https://codereview.chromium.org/1652413003/
>
> Original issue's description:
> > [heap] Simplify distribution of remaining memory during sweeping & compaction
> >
> > BUG=chromium:524425
> > LOG=N
> >
> > Committed: https://crrev.com/f72923526ccaa8faef5c977267b0c074c4a44dfa
> > Cr-Commit-Position: refs/heads/master@{#33668}
>
> TBR=hpayer@chromium.org,mlippautz@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:524425
>
> Committed: https://crrev.com/a9441b0e7a2a56c2047482a3cc66e3ca2255444b
> Cr-Commit-Position: refs/heads/master@{#33695}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1663013002

Cr-Commit-Position: refs/heads/master@{#33696}
2016-02-03 09:44:23 +00:00
hablich
a9441b0e7a Revert of [heap] Simplify distribution of remaining memory during sweeping & compaction (patchset #2 id:80001 of https://codereview.chromium.org/1653973003/ )
Reason for revert:
Very likely blocking roll: https://codereview.chromium.org/1652413003/

Original issue's description:
> [heap] Simplify distribution of remaining memory during sweeping & compaction
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/f72923526ccaa8faef5c977267b0c074c4a44dfa
> Cr-Commit-Position: refs/heads/master@{#33668}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1661723003

Cr-Commit-Position: refs/heads/master@{#33695}
2016-02-03 08:50:06 +00:00
bmeurer
e4e418f3ef [runtime] Make %FunctionGetScript and %FunctionGetSourceCode robust.
R=jarin@chromium.org
BUG=chromium:582703
LOG=n

Review URL: https://codereview.chromium.org/1664483003

Cr-Commit-Position: refs/heads/master@{#33693}
2016-02-03 06:01:19 +00:00
bradnelson
da632baac7 Switch to using Function(Any) for foreign functions, label declarations.
As it turns out checking for bare Type::Function is problematic,
switching to use Type::Function(Type::Any())).

Also labeling the type on foreign function declarations.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1652963004

Cr-Commit-Position: refs/heads/master@{#33691}
2016-02-03 01:21:02 +00:00
verwaest
621bdd642c [runtime] Fix integer indexed property handling
This includes 2 fixes:
1) We didn't properly advance the holder when checking whether
Receiver==Holder, so we'd inadvertently block loading the property if
the first property we find is on the typed array.
2) Reflect.get may cause any object on the prototype chain of the holder
to be the receiver; so we need to recheck for this special state for
each object we perform lookup on.

Review URL: https://codereview.chromium.org/1651913005

Cr-Commit-Position: refs/heads/master@{#33689}
2016-02-02 17:02:23 +00:00
oth
ef93854ab9 [interpreter] Move temporary register allocator into own file.
Moves the temporary register allocator out of the bytecode array
builder into TemporaryRegisterAllocator class and adds unittests.
Particular must be taken around the translation window boundary
motivating the addition of tests.

Also adds a Clear() method to IdentityMap() which is called by
the destructor. This allows classes to hold an IdentityMap if
they are zone allocated. Classes must call Clear() before the zone
is re-cycled or face v8 heap corruption.

BUG=v8:4280,v8:4675
LOG=N

Review URL: https://codereview.chromium.org/1651133002

Cr-Commit-Position: refs/heads/master@{#33686}
2016-02-02 14:32:27 +00:00
jkummerow
d582d2bb2a More *_STRING_WRAPPER_ELEMENTS fixes
BUG=chromium:583257
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1651253003

Cr-Commit-Position: refs/heads/master@{#33683}
2016-02-02 13:51:00 +00:00
bmeurer
7be5829971 [turbofan] Move creation stub fallbacks to JSGenericLowering.
Move all the code that deals with falling back to object creation via
stubs to JSGenericLowering, where we can already deal well with stub
calls. This includes JSCreateLiteralArray, JSCreateLiteralObject,
JSCreateClosure, JSCreateFunctionContext and JSCreateArray.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1653353002

Cr-Commit-Position: refs/heads/master@{#33682}
2016-02-02 13:34:02 +00:00
akos.palfi
7991c22695 Add wasm module tests to skip for big-endian.
NOTRY=true

Review URL: https://codereview.chromium.org/1658193002

Cr-Commit-Position: refs/heads/master@{#33679}
2016-02-02 12:48:36 +00:00
akos.palfi
1f5c91e4d8 MIPS: Fix unaligned read/write operations in wasm.
TEST=cctest/test-run-wasm/*, cctest/test-run-wasm-module/*, unittests
BUG=

Review URL: https://codereview.chromium.org/1581223002

Cr-Commit-Position: refs/heads/master@{#33678}
2016-02-02 12:45:31 +00:00
ahaas
23943d0e00 [wasm] Provide backoff implementations for the Fxx rounding instructions
If the architecture does not provide rounding instructions, then C
implementations of these rounding instructions are called. The C
implementations from math.h are used, function pointers are registered
as external references so that they can be call from the simulator.

R=titzer@chromium.org

BUG=575379

LOG=Y

Review URL: https://codereview.chromium.org/1661463002

Cr-Commit-Position: refs/heads/master@{#33677}
2016-02-02 12:26:58 +00:00
yangguo
d77d657731 Revert of [regexp] implement /ui to mirror the implementation for /i. (patchset #2 id:20001 of https://codereview.chromium.org/1641613002/ )
Reason for revert:
This test fails:

assertEquals(["as"], /^a[\u017F]/ui.exec("as"));

The reason is that we end up with a character class that is not stand alone, so we do not perform case folding on it correctly (with unicode flag).

Original issue's description:
> [regexp] implement /ui to mirror the implementation for /i.
>
> R=erik.corry@gmail.com, erikcorry@chromium.org
>
> Committed: https://crrev.com/eea1a4c003c559c99bcc9f08aa7eadf931975aad
> Cr-Commit-Position: refs/heads/master@{#33655}

TBR=erik.corry@gmail.com,erikcorry@chromium.org,erikcorry@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1661483002

Cr-Commit-Position: refs/heads/master@{#33676}
2016-02-02 11:44:45 +00:00
bmeurer
6b2001b6b7 [turbofan] Introduce proper ObjectIsReceiver operator.
Avoid the hacking in JSIntrinsicLowering and provide a proper simplified
operator ObjectIsReceiver instead that is used to implement %_IsJSReceiver
which is used by our JavaScript builtins and the JSInliner.

R=jarin@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1657863004

Cr-Commit-Position: refs/heads/master@{#33675}
2016-02-02 11:43:02 +00:00
ishell
6a11877424 [api] Make ObjectTemplate::SetNativeDataProperty() work even if the ObjectTemplate does not have a constructor.
Previously ObjectTemplate::New() logic relied on the fact that all the accessor properties are already installed in the initial map of the function object of the constructor FunctionTemplate.
When the FunctionTemplate were instantiated the accessors of the instance templates from the whole inheritance chain were accumulated and added to the initial map.
ObjectTemplate::SetSetAccessor() used to explicitly ensure that the ObjectTemplate has a constructor and therefore an initial map to add all accessors to.

The new approach is to add all the accessors and data properties to the object exactly when the ObjectTemplate is instantiated. In order to keep it fast we now cache the object boilerplates in the Isolate::template_instantiations_cache (the former function_cache), so the object creation turns to be a deep copying of the boilerplate object.

This CL also prohibits non-primitive properties in ObjectTemplate to avoid potential cross-context leaks.

BUG=chromium:579009
LOG=Y

Review URL: https://codereview.chromium.org/1642223003

Cr-Commit-Position: refs/heads/master@{#33674}
2016-02-02 11:42:01 +00:00
jochen
52f6c85468 Add json fuzzer
BUG=chromium:577261
R=machenbach@chromium.org,yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1652963002

Cr-Commit-Position: refs/heads/master@{#33673}
2016-02-02 11:29:01 +00:00
rmcilroy
e66ef888aa [Interpreter] Mark flaky Ignition tests as PASS, FAIL.
Fixes issues with linux64_debug and arm64_sim bots.

BUG=v8:4280,v8:4680
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1654953003

Cr-Commit-Position: refs/heads/master@{#33672}
2016-02-02 11:20:31 +00:00
vogelheim
d472cf4484 Add native callbacks to FastAccessorAssembler.
(Trying to finish FastAccessorAssembler this week. This should make it easier to pick up the Blink side of this work later on.)

BUG=chromium:508898
SOUNDTRACK=http://youtu.be/i1EG-MKy4so
LOG=Y

Review URL: https://codereview.chromium.org/1620293002

Cr-Commit-Position: refs/heads/master@{#33671}
2016-02-02 11:03:57 +00:00
ahaas
3f4163cd24 [wasm] Backoff implementation for F64Trunc using std::trunc.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1638283004

Cr-Commit-Position: refs/heads/master@{#33670}
2016-02-02 11:03:56 +00:00
mlippautz
f72923526c [heap] Simplify distribution of remaining memory during sweeping & compaction
BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1653973003

Cr-Commit-Position: refs/heads/master@{#33668}
2016-02-02 10:39:15 +00:00
rmcilroy
a37158393e [Interpreter] Group ignition cctest failures by error.
Also changes SKIP to FAIL to ensure we know when we have fixed a test.

BUG=v8:4280,v8:4680
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_arm64_dbg,v8_linux_arm_dbg

Review URL: https://codereview.chromium.org/1656803002

Cr-Commit-Position: refs/heads/master@{#33665}
2016-02-02 09:58:38 +00:00
danno
1f28904b24 [compiler] Extend the functionality of CodeStubAssembler
After this change, the functionality of the CodeStubAssembler should be
sufficient to generate non-trivial stubs (e.g. the KeyedLoadIC) with control
flow, variables and probing of internal meta data structures.

Specifically this patch:

* introduces a Label class, which allows stubs to construct graphs that don't
  have linear control graphs.
* introduces a Variable class. Variables can be bound to Node* values at
  different points in a non-linear control flow graph. In conjunction with the
  Label machinery, the CodeStubAssembler ensures that Phi nodes are inserted at
  the "minimal" set of merge points.
* adds Tail calling support to other Stubs and to any arbitrary code whose
  interface can be described by a CallInterfaceDescriptor.
* provides new macros for accessing FixedArray elements that are optimized for
  use with Smi values.

Review URL: https://codereview.chromium.org/1649723002

Cr-Commit-Position: refs/heads/master@{#33664}
2016-02-02 09:42:54 +00:00
yangguo
4da26845d0 [regexp, fuzzer] improve regexp fuzzer coverage.
R=jochen@chromium.org, machenbach@chromium.org
BUG=chromium:577261
LOG=N

Review URL: https://codereview.chromium.org/1660463002

Cr-Commit-Position: refs/heads/master@{#33661}
2016-02-02 09:23:42 +00:00
bmeurer
8c04a35c83 [intrinsics] Remove %_IsFunction inline intrinsic.
There's no point in having %_IsFunction as inline intrinsic, as it
is only used in non performance critical code, which is already full
of runtime calls anyway, so %IsFunction will do the trick as well.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1658123002

Cr-Commit-Position: refs/heads/master@{#33660}
2016-02-02 09:14:07 +00:00
jarin
ef35f11c43 Remove the template magic from types.(h|cc), remove types-inl.h.
This CL removes the Config templatization from the types. It is not
necessary anymore, after the HeapTypes have been removed.

The CL also changes the type hierarchy - the specific type kinds are
not inner classes of the Type class and they do not inherit from Type.
This is partly because it seems impossible to make this work without
templates. Instead, a new TypeBase class is introduced and all the
structural (i.e., non-bitset) types inherit from it.

The bitset type still requires the bit-munging hack and some nasty
reinterpret-casts to pretend bitsets are of type Type*. Additionally,
there is now the same hack for TypeBase - all pointers to the sub-types
of TypeBase are reinterpret-casted to Type*. This is to keep the type
constructors in inline method definitions (although it is unclear how
much that actually buys us).

In future, we would like to move to a model where we encapsulate Type*
into a class (or possibly use Type where we used to use Type*). This
would loosen the coupling between bitset size and pointer size, and
eventually we would be able to have more bits.

TBR=bradnelson@chromium.org

Review URL: https://codereview.chromium.org/1655833002

Cr-Commit-Position: refs/heads/master@{#33656}
2016-02-02 07:26:06 +00:00
yangguo
eea1a4c003 [regexp] implement /ui to mirror the implementation for /i.
R=erik.corry@gmail.com, erikcorry@chromium.org

Review URL: https://codereview.chromium.org/1641613002

Cr-Commit-Position: refs/heads/master@{#33655}
2016-02-02 07:09:36 +00:00
caitpotter88
15da984326 [parser] report invalid rest parameter errors in Arrow functions
Based on vogelheim's CL at https://codereview.chromium.org/1657783002/

BUG=chromium:582626, v8:2700
LOG=N
R=adamk@chromium.org, rossberg@chromium.org, vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1656993002

Cr-Commit-Position: refs/heads/master@{#33651}
2016-02-02 00:33:07 +00:00
littledan
11e8c03f94 Add UseCounters for some nonstandard JavaScript features
This patch adds a UseCounter for each of the following:
- Allowing duplicate sloppy-mode block-scoped function declarations
  in the exact same scope
- for-in loops with an initializer

The patch also refactors some of the declaration code to clean it up and
enable the first counter, and adds additional unit tests to nail down
the semantics of edge cases of sloppy-mode block-scoped function declarations.

BUG=v8:4693,chromium:579395
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1633743003

Cr-Commit-Position: refs/heads/master@{#33650}
2016-02-01 23:01:59 +00:00
Adam Klein
2f813aa669 Also skip allocation-limit test on tsan builders
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1654973002 .

Cr-Commit-Position: refs/heads/master@{#33647}
2016-02-01 19:58:22 +00:00
Adam Klein
37e2bb0109 Skip test262/built-ins/ArrayBuffer/allocation-limit under msan
BUG=v8:4639
LOG=n
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/1653103002 .

Cr-Commit-Position: refs/heads/master@{#33646}
2016-02-01 19:52:17 +00:00
littledan
bce83db2e2 Test262 roll to the state as of 2016-19-1
R=adamk

Review URL: https://codereview.chromium.org/1637103002

Cr-Commit-Position: refs/heads/master@{#33645}
2016-02-01 19:03:32 +00:00
mstarzinger
8420d57524 [interpreter] Fix re-throw to not have frame-state.
The runtime call to Runtime::kReThrow does not need a frame-state node
attached, the frame-state input count is zero. This restructures the
graph builder to not instantiate a FrameStateBeforeAndAfter for it.

R=jarin@chromium.org
TEST=cctest/test-run-bytecode-graph-builder
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1654833002

Cr-Commit-Position: refs/heads/master@{#33641}
2016-02-01 14:02:02 +00:00
yangguo
9f5dca8faa [regexp] add fuzzer support for regexp parser and compiler.
R=jochen@chromium.org
BUG=chromium:577261
LOG=N

Review URL: https://codereview.chromium.org/1655853002

Cr-Commit-Position: refs/heads/master@{#33640}
2016-02-01 14:00:38 +00:00
rmcilroy
d81edba721 [Interpreter] Set bytecode array in Runtime_SetCode.
Set the bytecode array correctly in Runtime_SetCode.
This fixes issues with building the snapshot with ignition enabled.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1647913002

Cr-Commit-Position: refs/heads/master@{#33638}
2016-02-01 12:13:21 +00:00
zhengxing.li
a1a8dd141e X87: Change num_double_registers() to num_allocatable_double_registers() for TestStackSlot.
Although x87 has 8 registers, it use only 1 double register in TurboFan code generation for some limitations.

  So for TestStackSlot() function, use the num_allocatable_double_registers() to check the avaliable double registers
  of TurboFan is more suitable than num_double_registers().

BUG=

Review URL: https://codereview.chromium.org/1653913002

Cr-Commit-Position: refs/heads/master@{#33636}
2016-02-01 10:54:33 +00:00
mstarzinger
83a2c8ed7f [interpreter] Reachability is implied by live environment.
The reachability of a bytecode is implied by a live environment reaching
the bytecode during the abstract control flow simulation of the bytecode
iteration perfromed by the graph builder. There is no need to compute it
upfront anymore.

Also, the upfront computation was only an approximation when it came to
the reachability of an exception handler. This is why several tests for
translation of exception handlers can now be enabled.

R=oth@chromium.org

Review URL: https://codereview.chromium.org/1645293003

Cr-Commit-Position: refs/heads/master@{#33634}
2016-02-01 10:19:13 +00:00
ahaas
a17bd3f3bc [wasm] Initialize the root register for WASM tests.
The root register is needed (at least on x64) to access
ExternalReferences.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1641153003

Cr-Commit-Position: refs/heads/master@{#33631}
2016-02-01 09:17:20 +00:00
zhengxing.li
587ad6fcc0 X87: Change the test case for X87 RunRoundInt32ToFloat32.
The CL #33347 (https://codereview.chromium.org/1589363002) added the RunRoundInt32ToFloat32 test case and X87 failed at it.

 The reason is same as the CL #31808 (issue 1430943002, X87: Change the test case for X87 float operations), please refer: https://codereview.chromium.org/1430943002/.

 Here is the key comments from CL #31808
 Some new test cases use CheckFloatEq(...) and CheckDoubleEq(...) function for result check. When GCC compiling the CheckFloatEq() and CheckDoubleEq() function,
 those inlined functions has different behavior comparing with GCC ia32 build and x87 build.
 The major difference is sse float register still has single precision rounding semantic. While X87 register has no such rounding precsion semantic when directly use register value.
 The V8 turbofan JITTed has exactly same result in both X87 and IA32 port.

 For CHECK_EQ(a, b) function, if a and b are doubles, it will has similar behaviors like CheckFloatEq(...) and CheckDoubleEq(...) function when compiled by GCC and causes the test case
 fail.

 So we add the following sentence to do type case to keep the same precision for RunRoundInt32ToFloat32. Such as: volatile double expect = static_cast<float>(*i).

BUG=

Review URL: https://codereview.chromium.org/1649323002

Cr-Commit-Position: refs/heads/master@{#33630}
2016-02-01 08:27:56 +00:00
yangguo
835b038331 [debugger] correctly find function context.
In the debugger we are interested in getting the context for the
current frame, which is usually a function context. To do that,
we used to call Context::declaration_context, which may also
return a block context. This is wrong and can lead to crashes.
Instead, we now use a newly introduced Context::closure_context,
which skips block contexts. This works fine for the debugger,
since we have other means to find and materialize block contexts.

R=rossberg@chromium.org
BUG=chromium:582051
LOG=N

Review URL: https://codereview.chromium.org/1648263002

Cr-Commit-Position: refs/heads/master@{#33627}
2016-02-01 07:03:44 +00:00
bradnelson
83744a4bee Switching foreign function to be marked as functions at call sites.
On further reflection, marking the variable proxy at call sites
for foreign functions as a function is ok. Switching this.

Fixed a few IntersectResults that probably should be an explicit set_bounds.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1656493002

Cr-Commit-Position: refs/heads/master@{#33623}
2016-01-30 02:38:38 +00:00
bradnelson
43be96989f Accurately type foreign functions, and variables (attempt 2).
Associate a type with foreign functions at their callsite.
Associate a type with foreign variables.
More pervasively forbid computation in the module body.
Confirm foreign call arguments are exports.

Pass zone to more Type constructors, for consistency.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1643003004

Cr-Commit-Position: refs/heads/master@{#33622}
2016-01-29 22:33:04 +00:00
jkummerow
f4872f7477 Introduce {FAST,SLOW}_STRING_WRAPPER_ELEMENTS
String wrappers (new String("foo")) are special objects: their string
characters are accessed like elements, and they also have an elements
backing store. This used to require a bunch of explicit checks like:

if (obj->IsJSValue() && JSValue::cast(obj)->value()->IsString()) {
  /* Handle string characters */
}
// Handle regular elements (for string wrappers and other objects)
obj->GetElementsAccessor()->Whatever(...);

This CL introduces new ElementsKinds for string wrapper objects (one for
fast elements, one for dictionary elements), which allow folding the
special-casing into new StringWrapperElementsAccessors.

No observable change in behavior is intended.

Review URL: https://codereview.chromium.org/1612323003

Cr-Commit-Position: refs/heads/master@{#33616}
2016-01-29 18:58:04 +00:00
littledan
f3e41d96dd Fix Unicode string normalization with null bytes
Previously, String.prototype.normalize constructed its ICU input
string as a null-terminated string. This creates a bug for strings
which contain a null byte, which is allowed in ECMAScript. This
patch constructs the ICU string based on its length so that the
entire string is normalized.

R=jshin@chromium.org
BUG=v8:4654
LOG=Y

Review URL: https://codereview.chromium.org/1645223003

Cr-Commit-Position: refs/heads/master@{#33614}
2016-01-29 17:00:46 +00:00
bmeurer
5a7bb33e3f [crankshaft] Fix another deopt loop in slow mode for-in.
The for-in slow mode implementation in Crankshaft unconditionally
deoptimizes when %ForInFilter returns undefined instead of just
skipping the item. Even worse, there's nothing we can learn from
that deopt, so we will eventually optimize again and hit exactly
the same problem again once we get back to optimized code.

R=mvstanton@chromium.org
BUG=v8:3650
LOG=n

Review URL: https://codereview.chromium.org/1647093002

Cr-Commit-Position: refs/heads/master@{#33609}
2016-01-29 11:00:05 +00:00
yangguo
33d2338515 [regexp] Change test262 expectation for noi18n build.
TBR=machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1648243003

Cr-Commit-Position: refs/heads/master@{#33608}
2016-01-29 10:39:32 +00:00
ahaas
645880373b [turbofan] Add the StackSlot operator to turbofan.
The StackSlot operator allows to allocate a spill slot on the stack. We
are going to use this operator to pass floats through pointers to c
functions, which we need for floating point rounding in the case where
the architecture does not provide rounding instructions.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-ppc-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Committed: https://crrev.com/7a693437787090d62d937b862e29521debcc5223
Cr-Commit-Position: refs/heads/master@{#33600}

Review URL: https://codereview.chromium.org/1645653002

Cr-Commit-Position: refs/heads/master@{#33606}
2016-01-29 09:43:54 +00:00
yangguo
54d9d19855 [regexp] stage unicode regexps.
R=littledan@chromium.org, rossberg@chromium.org
BUG=v8:2952
LOG=Y

Review URL: https://codereview.chromium.org/1647773003

Cr-Commit-Position: refs/heads/master@{#33604}
2016-01-29 09:24:00 +00:00
yangguo
bb6a53573c [regexp] restrict pattern syntax for unicode mode.
ES2015 Annex B.1.4 specifies a restricted pattern language for unicode
mode. This change reflects that, based on some test262 test cases.

R=littledan@chromium.org
BUG=v8:2952
LOG=N

Committed: https://crrev.com/e918c4ec464456a374098049ca22eac2107f6223
Cr-Commit-Position: refs/heads/master@{#33584}

Review URL: https://codereview.chromium.org/1645573002

Cr-Commit-Position: refs/heads/master@{#33603}
2016-01-29 09:21:16 +00:00
ahaas
11f7c2e63c Revert of [turbofan] Add the StackSlot operator to turbofan. (patchset #4 id:60001 of https://codereview.chromium.org/1645653002/ )
Reason for revert:
problems on Mac64

Original issue's description:
> [turbofan] Add the StackSlot operator to turbofan.
>
> The StackSlot operator allows to allocate a spill slot on the stack. We
> are going to use this operator to pass floats through pointers to c
> functions, which we need for floating point rounding in the case where
> the architecture does not provide rounding instructions.
>
> R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-ppc-ports@googlegroups.com, v8-mips-ports@googlegroups.com
>
> Committed: https://crrev.com/7a693437787090d62d937b862e29521debcc5223
> Cr-Commit-Position: refs/heads/master@{#33600}

TBR=titzer@chromium.org,v8-arm-ports@googlegroups.com,v8-mips-ports@googlegroups.com,v8-ppc-ports@googlegroups.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1644283002

Cr-Commit-Position: refs/heads/master@{#33601}
2016-01-29 08:19:06 +00:00
ahaas
7a69343778 [turbofan] Add the StackSlot operator to turbofan.
The StackSlot operator allows to allocate a spill slot on the stack. We
are going to use this operator to pass floats through pointers to c
functions, which we need for floating point rounding in the case where
the architecture does not provide rounding instructions.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-ppc-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1645653002

Cr-Commit-Position: refs/heads/master@{#33600}
2016-01-29 08:08:22 +00:00
bmeurer
3251a03e81 [crankshaft] Make the for-in slow path compatible with the other compilers.
So far the for-in slow path in Crankshaft unconditionally called
%ForInFilter for every iteration of the for-in loop, without paying
attention to the possible enum cache equipped receiver map. So even
though we iterate the enum cache FixedArray associated with the map
we don't check the map, but always go to %ForInFilter. This would be
perfectly fine if the enum cache FixedArray would be immutable, but
due to some funny GC/runtime interaction kicking in, the enum cache
can be right trimmed while we are iterating it, and the only way to
detect this is to ensure that we check the map when accessing the
enum cache.

BUG=v8:3650,v8:4715
LOG=n

Review URL: https://codereview.chromium.org/1650493002

Cr-Commit-Position: refs/heads/master@{#33599}
2016-01-29 07:50:51 +00:00
machenbach
1a43ebbefd Revert of Accurately type foreign functions, and variables. (patchset #2 id:20001 of https://codereview.chromium.org/1642993002/ )
Reason for revert:
[Sheriff] Breaks arm x-compile:
https://build.chromium.org/p/client.v8/builders/V8%20Arm%20-%20debug%20builder/builds/7484/steps/compile/logs/stdio

Original issue's description:
> Accurately type foreign functions, and variables.
>
> Associate a type with foreign functions at their callsite.
> Associate a type with foreign variables.
> More pervasively forbid computation in the module body.
> Confirm foreign call arguments are exports.
>
> BUG= https://code.google.com/p/v8/issues/detail?id=4203
> TEST=test-asm-validator
> R=aseemgarg@chromium.org,titzer@chromium.org
> LOG=N
>
> Committed: https://crrev.com/b1d43d0b31e8aea7b31261764fef5bee4ad13903
> Cr-Commit-Position: refs/heads/master@{#33596}

TBR=aseemgarg@chromium.org,titzer@chromium.org,bradnelson@google.com,bradnelson@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://code.google.com/p/v8/issues/detail?id=4203

Review URL: https://codereview.chromium.org/1648063003

Cr-Commit-Position: refs/heads/master@{#33597}
2016-01-29 07:38:05 +00:00
bradnelson
b1d43d0b31 Accurately type foreign functions, and variables.
Associate a type with foreign functions at their callsite.
Associate a type with foreign variables.
More pervasively forbid computation in the module body.
Confirm foreign call arguments are exports.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=test-asm-validator
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1642993002

Cr-Commit-Position: refs/heads/master@{#33596}
2016-01-29 01:05:48 +00:00
titzer
716bc803a3 [wasm] Fix misaligned accesses and endianness issues in decoders.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1644023002

Cr-Commit-Position: refs/heads/master@{#33595}
2016-01-28 19:24:39 +00:00
titzer
3668b2c0b3 [wasm] Fix CallIndirect with the case of no indirect function table.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1648503003

Cr-Commit-Position: refs/heads/master@{#33592}
2016-01-28 16:57:40 +00:00