Commit Graph

49598 Commits

Author SHA1 Message Date
Michael Achenbach
3c87d28b18 [CQ] Temporarily make node bot experimental
TBR=yangguo@chromium.org
NOTRY=true

Bug: v8:8027
Change-Id: I3d4383dc4e2c0af25d4e51aba4f4d6695030248c
Reviewed-on: https://chromium-review.googlesource.com/1166823
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54956}
2018-08-08 07:19:39 +00:00
Michael Achenbach
247e179ca7 Revert "[Interpreter] Do not use IC slots for property load/stores in an IIFE and top-level code"
This reverts commit 690bda84eb.

Reason for revert: Speculative revert for:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/25372

See more at:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original change's description:
> [Interpreter] Do not use IC slots for property load/stores in an IIFE and top-level code
> 
> An IIFE or top-level code is executed only once hence, there is no need to collect
> type feedback. We can save some memory by not using IC slots for property Loads/Stores
> within a IIFE/top-level code. This CL emits Runtime Get/Set property calls instead of LdaNamedProperty
> /StaNamedProperty for the property loads within a IIFE and top-level code.
> 
> Change-Id: I3e0ce26d05d82bb3648cb9262c4e112a2c4556c9
> Reviewed-on: https://chromium-review.googlesource.com/1146579
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Chandan Reddy <chandanreddy@google.com>
> Cr-Commit-Position: refs/heads/master@{#54949}

TBR=rmcilroy@chromium.org,adamk@chromium.org,marja@chromium.org,yangguo@chromium.org,cbruni@chromium.org,leszeks@chromium.org,verwaest@chromium.org,chandanreddy@google.com

Change-Id: I642164a72453189fd0fe92b69f199f958ce56bef
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/1166782
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54955}
2018-08-08 06:39:55 +00:00
Ulan Degenbaev
5b434929a3 Revert "Fix invalidation of old-to-old slots after object trimming."
This reverts commit 719d23c032.

Reason for revert: TSAN failures

Original change's description:
> Fix invalidation of old-to-old slots after object trimming.
> 
> A recorded old-to-old slot may be overwritten with a pointer to a new
> space object. If the object containing the slot is trimmed later on,
> then the mark-compactor may crash on a stale pointer to new space.
> 
> This patch ensures that:
> 1) On trimming of an object we add it to the invalidated_slots sets.
> 2) The InvalidatedSlotsFilter::IsValid returns false for slots outside
>    the invalidated object unless the page was already swept.
> 
> Array left-trimming is handled as a special case because object start
> moves and cannot be added to the invalidated set. Instead, we clear
> the freed memory so that the recorded slots contain Smi values.
> 
> Bug: chromium:870226,chromium:816426
> Change-Id: Iffc05a58fcf52ece45fdb085b5d1fd4b3acb5d53
> Reviewed-on: https://chromium-review.googlesource.com/1163784
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54953}

TBR=ulan@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: I2e1ff83c2db7902488951a8f597d38133aeb3b04
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:870226, chromium:816426
Reviewed-on: https://chromium-review.googlesource.com/1165862
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54954}
2018-08-07 19:15:58 +00:00
Ulan Degenbaev
719d23c032 Fix invalidation of old-to-old slots after object trimming.
A recorded old-to-old slot may be overwritten with a pointer to a new
space object. If the object containing the slot is trimmed later on,
then the mark-compactor may crash on a stale pointer to new space.

This patch ensures that:
1) On trimming of an object we add it to the invalidated_slots sets.
2) The InvalidatedSlotsFilter::IsValid returns false for slots outside
   the invalidated object unless the page was already swept.

Array left-trimming is handled as a special case because object start
moves and cannot be added to the invalidated set. Instead, we clear
the freed memory so that the recorded slots contain Smi values.

Bug: chromium:870226,chromium:816426
Change-Id: Iffc05a58fcf52ece45fdb085b5d1fd4b3acb5d53
Reviewed-on: https://chromium-review.googlesource.com/1163784
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54953}
2018-08-07 18:19:58 +00:00
Jakob Kummerow
bbe8db5948 [intl] Port CanonicalizeLocaleList to C++
This CL also contains some drive-by cleanup of related code.

Bug: v8:5751, v8:7987
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I6144d16c1d85922efc1dc419cce8a2eba2a60056
Reviewed-on: https://chromium-review.googlesource.com/1161545
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54952}
2018-08-07 18:02:23 +00:00
Mike Stanton
38c664fa9c [Torque] Turn Torque HasProperty usage into builtin calls
The CSA HasProperty has an inlining that makes it rather large.

Also, tighten up some type usage. ToObject() returns a JSReceiver
and we can do with less casting if we make use of this.

Change-Id: I56d2443b5d409314cc3c74a5a079810d857727ad
Reviewed-on: https://chromium-review.googlesource.com/1165241
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54951}
2018-08-07 16:33:51 +00:00
Tobias Tebbi
7957886b2f [torque] allow overloading generic macros
Previously, we requested instantiation of generics prior to selecting
a template overload, which resulted in unused templates being
instantiated, possibly triggering unnecessary compile errors.

Bug: v8:7793
Change-Id: I45f4bdbf8aa93749ece416c6c7458d64e6e051f5
Reviewed-on: https://chromium-review.googlesource.com/1154977
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54950}
2018-08-07 15:15:46 +00:00
Creddy
690bda84eb [Interpreter] Do not use IC slots for property load/stores in an IIFE and top-level code
An IIFE or top-level code is executed only once hence, there is no need to collect
type feedback. We can save some memory by not using IC slots for property Loads/Stores
within a IIFE/top-level code. This CL emits Runtime Get/Set property calls instead of LdaNamedProperty
/StaNamedProperty for the property loads within a IIFE and top-level code.

Change-Id: I3e0ce26d05d82bb3648cb9262c4e112a2c4556c9
Reviewed-on: https://chromium-review.googlesource.com/1146579
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Chandan Reddy <chandanreddy@google.com>
Cr-Commit-Position: refs/heads/master@{#54949}
2018-08-07 14:58:43 +00:00
Tobias Tebbi
469522160b [torque] generate implicit_cast according to VisitResult types
In the generated CSA, we called overloaded macros while relying on CSA
subtyping of TNodes. This doesn't work well with overloads, because
for C++ any TNode subtyping is treated as an implicit conversion, which
makes these calls ambiguous for C++.
As a solution, we insert implicit_cast conversions for arguments
according to the type predicted by Torque. This way, a CSA overload is always
called with exactly the signature declared in base.tq.
This has the additional benefit that it validates the signatures declared in
base.tq, which could previously be too permissive.
Also, this triggered a bug in structs, where VisitResult's were
carrying the wrong type.

Bug: v8:7793
TBR: danno@chromium.org
Change-Id: I8ed4bfd04793c8a8805a4a3dd5cf2a85c20ce786
Reviewed-on: https://chromium-review.googlesource.com/1165237
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54948}
2018-08-07 14:28:02 +00:00
Marja Hölttä
78c20334a4 [cleanup] Refactor SharedFunctionInfo::SetScript
The previous logic had 2 if-elses, but the branch taken in the first one
determines the branch taken in the second one too (so there are 2 possibilities,
not 4). Make the structure reflect this.

BUG=v8:8015

Change-Id: I75ce86aa9731c0cae21c82f9aad6c83cb950e0d6
Reviewed-on: https://chromium-review.googlesource.com/1163613
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54947}
2018-08-07 14:26:49 +00:00
Tobias Tebbi
36bb2e000b [csa] type and separate {Load,Store}{Fixed,Property}ArrayElement
This enables fast bounds checks on FixedArray's.

Change-Id: I0ae57b2c6981d8e1b2c7017ba658fd9c890d2bad
Reviewed-on: https://chromium-review.googlesource.com/1163614
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54946}
2018-08-07 14:15:51 +00:00
Georg Neis
c790b2790f [turbofan] Clarify a comment.
R=mvstanton@chromium.org

Change-Id: I4e717b0d608837cdde2bea2ebbcf83a2a5d6b749
Reviewed-on: https://chromium-review.googlesource.com/1165144
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54945}
2018-08-07 13:20:27 +00:00
Sigurd Schneider
7f99d292e2 [cleanup] Unify naming of instruction size constant
The instruction size in bytes is now kInstrSize on all platforms.

Bug: v8:6666
Change-Id: I2f9880a6a74199a439c8327a4117efb74240aa22
Reviewed-on: https://chromium-review.googlesource.com/1164955
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54944}
2018-08-07 12:18:13 +00:00
Yang Guo
ff7915421d Change test-log test to not use regex.
R=machenbach@chromium.org

Bug: v8:7855
Change-Id: Ifcd28d0aa24e07f0db70305d64b20361530069b0
Reviewed-on: https://chromium-review.googlesource.com/1163677
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54943}
2018-08-07 11:21:13 +00:00
Michael Starzinger
7579b1e3c8 [wasm] Support concurrent patching of jump table.
This adds initial support for concurrently patching jump table slots. It
is needed once different Isolates share code (for the --wasm-shared-code
feature). We need to ensure that instructions holding the target address
within a jump table slot do not cross cache-line boundaries. To do this,
the jump table has been split into consecutive pages.

Note that this also adds a stress test for multiple threads hammering at
a single slot concurrently. The test is currently limited to the ia32
and the x64 architecture, but will be extended to cover others. The test
reliably triggers tearing of the target address on almost every run of
the test and hence serves to prevent regressions.

R=clemensh@chromium.org
TEST=cctest/test-jump-table-assembler
BUG=v8:8018

Change-Id: Ife56bbb61ffcae5d8906ca7b8c604b195603707c
Reviewed-on: https://chromium-review.googlesource.com/1163664
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54942}
2018-08-07 11:20:09 +00:00
Georg Neis
125b8a454d Remove unnecessary conditions around Map::AsElementsKind calls.
Map::AsElementsKind returns the given map if it already has the desired
elements kind.

Change-Id: Ia9c92eabdb28c82da376eb87f0117dc76414240d
Reviewed-on: https://chromium-review.googlesource.com/1164368
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54941}
2018-08-07 11:07:12 +00:00
Andreas Haas
5f105141d5 [wasm] During instantiation, pending_exceptions dominate new exceptions
For async instantiation of WebAssembly code we had the assumption that
a pending exceptions (an exception which comes from
execution JS code) and an ErrorThrower error cannot occur at the same
time. This assumption turned out to be wrong. With this CL we handle
this case by prefering pending_exceptions over ErrorThrower errors.

In addition I extended the tests for failing instantiation to also
exercise async instantiation, and I added a regression test.

R=clemensh@chromium.org

Bug: chromium:870646
Change-Id: I4cb54ff8642ad4ea193b20f79905c9f6508c2b2e
Reviewed-on: https://chromium-review.googlesource.com/1163511
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54940}
2018-08-07 10:44:12 +00:00
Ivica Bogosavljevic
65624c9ec6 MIPS: Disable Word32SarWithWord32Shl on MIPSr1
MIPSr1 doesn't support SEB and SEH instructions and this
causes test InstructionSelectorTest.Word32SarWithWord32Shl to fail.

This CL disables this test on MIPSr1.

TEST=unittests/InstructionSelectorTest.Word32SarWithWord32Shl

Change-Id: I284a85210bd0d38374ca339671643560e8a305e2
Reviewed-on: https://chromium-review.googlesource.com/1164363
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ibogosavljevic@wavecomp.com>
Cr-Commit-Position: refs/heads/master@{#54939}
2018-08-07 09:27:17 +00:00
Ross McIlroy
a1986533fe [Comment] Add a comment to CompilationCacheTable::Lookup/PutScript.
Change-Id: Ia5fa003e8a3bc205ea0384bea9ebb3f6532a1771
Reviewed-on: https://chromium-review.googlesource.com/1163619
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54938}
2018-08-07 08:48:57 +00:00
Dan Elphick
a2679e527f Revert "[api] Remove deprecated functions"
This reverts commit 5414884aec.

Reason for revert: breaks the roll due to not testing CrOs

Original change's description:
> [api] Remove deprecated functions
> 
> Removes all V8_DEPRECATED functions that weren't recently marked as well
> any V8_DEPRECATE_SOON function that relied on using the address of
> an object to get hold of the Isolate.
> 
> Normally we would have advanced the V8_DEPRECATE_SOON methods to
> V8_DEPRECATE in this release and removed them in the follow release, but
> their continuing presence blocks the work on creating a shared
> Read-Only space where some objects would not belong to any single
> Isolate. In preparation chromium and node.js (via the v8/node github)
> have been modified in advance.
> 
> Bug: v8:7786
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I8b4b06189896d94aff908ebcd121b3b38f9b482a
> Reviewed-on: https://chromium-review.googlesource.com/1154915
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54915}

TBR=yangguo@chromium.org,delphick@chromium.org

Change-Id: Iaf23e04d55a95b01b0423effa6cde3c0be5e2ba8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1164902
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54937}
2018-08-07 08:09:31 +00:00
Camillo Bruni
e9bdcc0d22 [test] Improve test coverage for Object::GetPropertyNames
- Cover array-indices corner cases around 2**32

Bug: v8:8019
Change-Id: Ic5d81a6944b10067b64ffc596472c076adc49c75
Reviewed-on: https://chromium-review.googlesource.com/1163786
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54936}
2018-08-07 07:47:06 +00:00
Michael Starzinger
d28af94b0c [asm.js] Improve error reporting of internal failures.
R=sigurds@chromium.org

Change-Id: I54df6ab72a3d6836be15d4a26b8a1615628eb872
Reviewed-on: https://chromium-review.googlesource.com/1163703
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54935}
2018-08-07 07:46:02 +00:00
v8-ci-autoroll-builder
28a480e0be Update V8 DEPS.
Rolling v8/build: 7d6c957..60ce94a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/d2f6e76..e19516b

Rolling v8/third_party/depot_tools: 82bb756..2ebf9fd

Rolling v8/tools/clang: 657bfc2..42f0661

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I6673d2a7b45d1ffb4290e449eeb1c73921e5a1c6
Reviewed-on: https://chromium-review.googlesource.com/1164625
Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#54934}
2018-08-07 03:40:09 +00:00
Frank Tang
ec0a2097bc add comments to help people to find (Int|Uint)(32|Ptr)Equal
Change-Id: I4b7ea624fbf99f3d1fc67aa77b0c09a8aedde8c6
Reviewed-on: https://chromium-review.googlesource.com/1161704
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54933}
2018-08-07 01:05:27 +00:00
Jakob Kummerow
d7ad12dfdd [KeyedLoadIC] Fix negative index handling for TypedArrays
A recent refactoring accidentally disabled the code path that keeps
negative indices for TypedArrays on the fast path.

Change-Id: I89bbb414f54d04f85af77c6d205705906925c61e
Reviewed-on: https://chromium-review.googlesource.com/1164469
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54932}
2018-08-06 23:56:58 +00:00
Kyounga Ra
b7ef0e62ce MIPS: Fix DCHECK failure in v8::internal::Assembler::seb()
- DCHECK(IsMipsArchVariant(kMips32r2) || IsMipsArchVariant(kMips32r6)) is failed.
- I tried not to select instruction kMipsSeb in case of kMips32r1.

R=ivica.bogosavljevic@mips.com

Bug: v8:8006
Change-Id: If07450b1a35b4e9cb608344e137c032381da224d
Reviewed-on: https://chromium-review.googlesource.com/1160073
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ibogosavljevic@wavecomp.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54931}
2018-08-06 20:35:08 +00:00
Bill Budge
d0468dede0 [heap] Fix StoreBuffer setup.
- Solves a problem for PPC in a configuration where commit page size
  is 64K. https://chromium-review.googlesource.com/c/v8/v8/+/1149515
- Uses existing VM allocation code to get properly aligned memory.
- Makes sure the size for SetPermissions is a multiple of system page
  size.

Bug:chromium:756050

Change-Id: Ib3799ab7a3bb44b0091c234234c1cc47938379c2
Reviewed-on: https://chromium-review.googlesource.com/1161210
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54930}
2018-08-06 18:06:18 +00:00
Ross McIlroy
083c5a6cf7 [Compile] Track cases where a script is in the isolate cache but was streaming parse/compiled.
We want to limit these cases since they result in unecessary work on background threads
doing the streaming parse / compile, and delay the script execution unecessarily
while waiting for the streamer to complete.

BUG=chromium:865098

Change-Id: Ibb3346c2e644bb333521d876d00aeb9cc063b6aa
Reviewed-on: https://chromium-review.googlesource.com/1163669
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54929}
2018-08-06 15:10:21 +00:00
Marja Hölttä
c38f52f1a3 Reland [in-place weak refs] Use WeakArrayList in wasm
Now we can remove FixedArrayOfWeakCells (this was the last user).

Previous try: https://chromium-review.googlesource.com/1150170

BUG=v8:7308

Change-Id: Ie924e379ea8bbd797430e3ca591019fe001e78ad
Reviewed-on: https://chromium-review.googlesource.com/1154909
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54928}
2018-08-06 15:02:34 +00:00
Clemens Hammacher
897e17a255 [wasm][fuzzer] Generate more and longer sequences
In Liftoff, bugs often happen only if specific cache states are
constructed. For this, longer sequences of instructions are needed.
Thus, add a few rules to increase the chance of generating longer
sequences.

R=ahaas@chromium.org

Change-Id: I8f112edf0280282bf275585e8a15772013c25245
Reviewed-on: https://chromium-review.googlesource.com/1158695
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54927}
2018-08-06 14:58:05 +00:00
Simon Zünd
babc4422fd Add empty SetProperty stub
This CL is the first step towards a SetProperty stub, by adding a
stub that redirects to the runtime and replacing every runtime
call-site with a call to this stub.

A followup CL will then add an implementation to the stub similar
to KeyedStoreGenericAssembler::KeyedStoreGeneric().

R=cbruni@chromium.org, jgruber@chromium.org

Change-Id: Iff2f913988cada6220d54817d94d011ad6de2b77
Reviewed-on: https://chromium-review.googlesource.com/1163519
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54926}
2018-08-06 14:46:27 +00:00
Sigurd Schneider
1d9d1ee471 [regexp] Fix compilation for interpreted regexp
Change-Id: Icf0507c6e50533c64a42fcf934bb1472ff21f68a
Reviewed-on: https://chromium-review.googlesource.com/1163618
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54925}
2018-08-06 14:14:14 +00:00
Hai Dang
66ffd1babb Add benchmarks for comparing spread literal with copying schemes for arrays
Bug: v8:7973
Change-Id: I76308296dd45ef797d1eafd6e2736ccefb54302d
Reviewed-on: https://chromium-review.googlesource.com/1162222
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Hai Dang <dhai@google.com>
Cr-Commit-Position: refs/heads/master@{#54924}
2018-08-06 13:32:57 +00:00
Georg Neis
c55edb44ba [turbofan] Extend and streamline serialization.
- Trigger serialization for more objects, such as some root maps.
- Serialize more data for certain object kinds.
- Add macros for convenience.
- Mark a few functions as const.

R=jarin@chromium.org
Bug: v8:7790

Change-Id: Id39b97e93728c0b3d87d9546bdf68abd04496c05
Reviewed-on: https://chromium-review.googlesource.com/1158572
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54923}
2018-08-06 13:20:02 +00:00
Michael Starzinger
3b3f2bbd4f [wasm] Introduce jump table index calculation helpers.
This is in preparation of making sure that jump table slots don't cross
cache line boundaries. It is only introducing helper functions for back
and forth conversion between "index" and "offset", but should not make
any functional changes yet.

R=ahaas@chromium.org
BUG=v8:8018

Change-Id: I6ab525f9b89a6a15414c043a54c9fffb527a1ab6
Reviewed-on: https://chromium-review.googlesource.com/1163517
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54922}
2018-08-06 13:12:08 +00:00
Marja Hölttä
a12cbd3499 Revert "Revert (partially) "Reland [in-place weak refs] Use WeakArrayList in Heap::noscript_list.""
This reverts commit a5efd5076b.

Reason for revert: was a GC bug, unrelated to this CL.

Original change's description:
> Revert (partially) "Reland [in-place weak refs] Use WeakArrayList in Heap::noscript_list."
> 
> Reason: flaky wasm crashes.
> 
> This leaves WeakArrayList::RemoveOne (+ tests for it) in place.
> 
> BUG=v8:7308, v8:8014
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
> Change-Id: I1195d061ae7d3c82f921f94f50df3f09a55de5ca
> Reviewed-on: https://chromium-review.googlesource.com/1161904
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54891}

TBR=marja@chromium.org,mlippautz@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7308, v8:8014
Change-Id: Id8002e2178ac89378b047dd0acd1bf4e3c272918
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1162124
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54921}
2018-08-06 12:37:18 +00:00
Georg Neis
3fc300e195 [turbofan] Check validity of dependency right before its installation.
Check each dependency's validity again right before installing it,
because a GC during preceding installations can theoretically trigger
invalidation for some dependency kinds.

Also inline the IsSane checkers into the constructors.

R=jarin@chromium.org

Change-Id: I1331dee27f01e8fd07cb953dddfed72fd1841559
Reviewed-on: https://chromium-review.googlesource.com/1161933
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54920}
2018-08-06 12:22:51 +00:00
Rodrigo Bruno
9f3170dad5 [heap] Add external memory counter to HeapStatistics.
Node.js is using AdjustAmountOfExternalAllocatedMemory to get
external memory from V8 [1]. In addition, they have a unittest
that verifies that AdjustAmountOfExternalAllocatedMemory returns
the correct value [2]. This CL proposes a new way to report
external memory through HeapStatistics.

[1]07cb69720b/src/node_process.cc (L187)
[2]https://github.com/nodejs/node/blob/master/test/parallel/test-memory-usage.js

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ia58ed0bab1c1d4ee23672e1347b9a00b6705a43c
Reviewed-on: https://chromium-review.googlesource.com/1162156
Commit-Queue: Rodrigo Bruno <rfbpb@google.com>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54919}
2018-08-06 12:11:15 +00:00
jgruber
d084929da7 [regexp] Typify RegExpPrototypeExecBodyWithoutResult
And related call sites.

Drive-by: add IntPtrZero() and SmiZero() helpers.

Bug: v8:8015
Change-Id: I83195cf2da858f8d35f25c9a1aa5c40c81df78b9
Reviewed-on: https://chromium-review.googlesource.com/1162169
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54918}
2018-08-06 10:40:49 +00:00
Sathya Gunasekaran
cdb4d913f6 [Intl] Optimize Intl.PluralRules
Previously, Intl.PluralRules was mostly implemented in JavaScript. This
patch moves most of the constructor and parts of other methods to C++.

The size of the Intl.PluralRules object is reduced by not storing
MinimumIntegerDigits, MinimumFractionDigits, MaximumFractionDigits,
MinimumSignificantDigits, MaximumSignificantDigits. Instead these are
looked up from icu::DecimalFormat as required.

Another optimziation is that we don't create the result of
resolvedOptions when the Intl.PluralRules object is constructed, but
instead defer until this method is called. In the future, we may want
to cache the result.

This patch also cleans up several error handling paths that shouldn't
happen with ICU and instead just crashes should it ever happen.

Bug: v8:5751
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I84c5aa6c25c35fe2d336693dee1b36bf3dcd4a79
Reviewed-on: https://chromium-review.googlesource.com/1158701
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54917}
2018-08-06 10:33:59 +00:00
Sigurd Schneider
13ed3e38d1 [arm] Simplify constant pool implementation
Bug: v8:6666
Change-Id: I577c2ac89e8247d6fc90f1e9dbd0ef14a14fbddc
Reviewed-on: https://chromium-review.googlesource.com/1163246
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54916}
2018-08-06 09:52:36 +00:00
Dan Elphick
5414884aec [api] Remove deprecated functions
Removes all V8_DEPRECATED functions that weren't recently marked as well
any V8_DEPRECATE_SOON function that relied on using the address of
an object to get hold of the Isolate.

Normally we would have advanced the V8_DEPRECATE_SOON methods to
V8_DEPRECATE in this release and removed them in the follow release, but
their continuing presence blocks the work on creating a shared
Read-Only space where some objects would not belong to any single
Isolate. In preparation chromium and node.js (via the v8/node github)
have been modified in advance.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I8b4b06189896d94aff908ebcd121b3b38f9b482a
Reviewed-on: https://chromium-review.googlesource.com/1154915
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54915}
2018-08-06 09:49:56 +00:00
Sigurd Schneider
cd28595110 [arm] Use constant pool for off-heap targets
This CL puts off-heap targets (i.e. code addresses for embedded builtins)
in the constant pool on ARM.

We are landing this CL to evaluate impact on benchmarks and code size,
and expect to revert it once we have gathered that data.

Bug: v8:6666

Change-Id: If4935a6fb162cd1ffb34489c6fa9630f10ca2c9f
Reviewed-on: https://chromium-review.googlesource.com/1154924
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54914}
2018-08-06 09:08:17 +00:00
Anna Henningsen
497f5a710f [heap-profiler] Mark SetBuildEmbedderGraphCallback with V8_DEPRECATED
This is not used in Chrome or Node anymore.
(This could also potentially be just removed at this point.)

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I59ecc216faeb3d56d3a52c548a863544570b6173
Reviewed-on: https://chromium-review.googlesource.com/1161936
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54913}
2018-08-06 08:46:10 +00:00
Vlad Tsyrklevich
fa2dc8dbad Reland "Update GetCurrentStackPosition to use built-in"
By using a built-in this functions works with SafeStack and doesn't
require an attribute disabling ASan.

BUG=chromium:864705

Change-Id: I898d42c0b39b07300f1679eba11e7f50cad42120
Reviewed-on: https://chromium-review.googlesource.com/1162669
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54912}
2018-08-06 08:09:13 +00:00
Sigurd Schneider
15f8871c15 Revert "[tracing] allow dynamic control of tracing"
This reverts commit bf5ea8138c.

Reason for revert: Breaks Sanitizers
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20ASAN/26688

Original change's description:
> [tracing] allow dynamic control of tracing
> 
> If the trace_buffer_ was null, we were returning a pointer to a static
> flag back that permanently disabled that particular trace point.
> 
> This implied an assumption that tracing will be statically enabled at
> process startup, and once it is disabled, it will never be enabled
> again. On Node.js side we want to dynamically enable/disable tracing as per
> programmer intent.
> 
> Change-Id: Ic7a7839b8450ab5c356d85e8e0826f42824907f4
> Reviewed-on: https://chromium-review.googlesource.com/1161518
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
> Cr-Commit-Position: refs/heads/master@{#54903}

TBR=yangguo@chromium.org,ofrobots@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I9459992e8c2ee403b9ddc8f6b9582d204139f6e8
Reviewed-on: https://chromium-review.googlesource.com/1162122
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54911}
2018-08-06 07:41:35 +00:00
Sigurd Schneider
827e7bc4a0 Revert "[cpu-profiler] Turn on detailed line info for optimized code"
This reverts commit 898f880aa7.

Reason for revert: TSAN report memory leaks 
This is not related to this CL, but to behavior in tracing-controller.cc. Sorry!

https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8938962708686133568/+/steps/Check_-_slow_path__flakes_/0/logs/memory_grow/0

Original change's description:
> [cpu-profiler] Turn on detailed line info for optimized code
> 
> Cautiously turn on this flag by default to check the impact on
> performance bots. Could show minor regressions in old space and/or
> code_and_metadata memory buckets.
> 
> Bug: v8:7983
> Change-Id: Ic4369cdb0231f4f88eada699da948e8bb48a25fd
> Reviewed-on: https://chromium-review.googlesource.com/1162234
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54908}

TBR=yangguo@chromium.org,petermarshall@chromium.org

Change-Id: If17abee873cb589fc6450231149ccc82e7ca9f7b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7983
Reviewed-on: https://chromium-review.googlesource.com/1163441
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54910}
2018-08-06 07:21:21 +00:00
Jaroslav Sevcik
a56d7470e2 [heap] Relax NotifyObjectLayoutChange DCHECK to allow ByteArrays changes in LO space
Bug: chromium:869735
Change-Id: I65c4a1b92e1e0874eabff14e9cf6f5b56dc8d43a
Reviewed-on: https://chromium-review.googlesource.com/1158065
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54909}
2018-08-06 06:42:35 +00:00
Peter Marshall
898f880aa7 [cpu-profiler] Turn on detailed line info for optimized code
Cautiously turn on this flag by default to check the impact on
performance bots. Could show minor regressions in old space and/or
code_and_metadata memory buckets.

Bug: v8:7983
Change-Id: Ic4369cdb0231f4f88eada699da948e8bb48a25fd
Reviewed-on: https://chromium-review.googlesource.com/1162234
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54908}
2018-08-06 06:38:41 +00:00
v8-ci-autoroll-builder
d7ca375b6a Update V8 DEPS.
Rolling v8/build: e1167bf..7d6c957

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I135164556a3821e81177cae1cb6e3fadc1cac0ea
Reviewed-on: https://chromium-review.googlesource.com/1163290
Reviewed-by: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: V8 Autoroller <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#54907}
2018-08-06 03:34:47 +00:00