Commit Graph

21394 Commits

Author SHA1 Message Date
Leszek Swirski
b4a3af9157 [ignition] Move for-of desugaring to bytecode
This removes the iteration protocol from the parser entirely, and opens
up future possibilities for more bytecodes implementing the various
functions of the protocol.

Change-Id: I316b8a92434d3b5f47927408a235ddaecd65d5bb
Reviewed-on: https://chromium-review.googlesource.com/c/1403125
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58795}
2019-01-14 16:37:41 +00:00
Ross McIlroy
09576a81b1 [Test] Unskip array-multiple-receiver-maps with added tracing.
BUG=v8:8653

Change-Id: I7cb6ef7046ca37474f46a04ae75110f0fa998d8a
Reviewed-on: https://chromium-review.googlesource.com/c/1409425
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58794}
2019-01-14 16:08:45 +00:00
Clemens Hammacher
94958319d9 [wasm] Store enabled features in compilation env
The background compile tasks should not access the NativeModule during
the main compile phase.
This CL moves on of the accessed fields into the {CompilationEnv}. It
is initialized from the existing field on the {NativeModule}.

R=titzer@chromium.org

Bug: v8:8689
Change-Id: I9738e2fb4681a035cbacf3c9e00b9e5cc9419416
Reviewed-on: https://chromium-review.googlesource.com/c/1409423
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58793}
2019-01-14 15:57:41 +00:00
Ben L. Titzer
f726d7f0c4 [mjsunit] Dont generate dumps from regression test
The --perf-prof flag generates unwanted .dump files, while the
--perf-prof-unwinding-info flag enables the functionality under test here.

R=jgruber@chromium.org
BUG=chromium:913844

Change-Id: Ie5ee374977d6105854f42065600dac1bc5ba6df7
Reviewed-on: https://chromium-review.googlesource.com/c/1409363
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58791}
2019-01-14 15:26:16 +00:00
Ulan Degenbaev
13e07389ff Revert "[heap] Remove bailout marking worklist."
This reverts commit 68a8bdd829.

Reason for revert: memory regression: crbug.com/921239

Original change's description:
> [heap] Remove bailout marking worklist.
> 
> The concurrent marker can now process all objects.
> This patch also eagerly visits the objects that undergo layout
> changes. This is because previously such objects were pushed
> onto the bailout worklist, which is gone now.
> To preserve the incremental step accounting, the patch introduces
> a new GC tracer scope called MC_INCREMENTAL_LAYOUT_CHANGE.
> 
> Bug: v8:8486
> Change-Id: Ic1c2f0d4e2ac0602fc945f3258af9624247bd65f
> Reviewed-on: https://chromium-review.googlesource.com/c/1386486
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58712}

TBR=ulan@chromium.org,mlippautz@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8486, chromium:921239
Change-Id: I1f851b948f4ce403316e469999f0b16e8dfdb62d
Reviewed-on: https://chromium-review.googlesource.com/c/1408990
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58787}
2019-01-14 15:00:11 +00:00
Ben L. Titzer
6d3d8f7be6 [wasm] Add runtime call plumbing for Table operations.
This CL adds two new runtime calls for table operations:
  - Runtime_WasmTableInit
  - Runtime_WasmTableCopy

These runtime calls (will) implement the semantics for the corresponding
bytecodes from the bulk memory proposal. The actual implementation
of these runtime calls will be done in further CLs.

The third table operation, table.drop, will be implemented with inline
code, similar to memory.drop. This is also be done in a further CL.

R=mstarzinger@chromium.org
CC=​binji@chromium.org
BUG=v8:7747

Change-Id: I498aa054329baf9f72ae55d245b12c3ccd4157b7
Reviewed-on: https://chromium-review.googlesource.com/c/1408994
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58786}
2019-01-14 14:33:08 +00:00
Camillo Bruni
a6f4462987 Reland "[parser] Inline byte scope data into PreparseData object"
This is a reland of e2d44ede95

Original change's description:
> [parser] Inline byte scope data into PreparseData object
> 
> Each PreparseData object had at least one pointer to a PodArray for its
> serialized scope data. These objects usually have only tens of bytes of
> payload. By inlining the byte data we save 3 words per PreparseData object.
> This optimization saves 140KB of data on cnn.com.
> 
> 
> - Store data_length and inner_length as int32 saving a words on 64bit
> - Inline store byte data into PreparseData
> - OnHeapConsumedPreparseData directly uses the PreparseData object
> - get_inner, set_inner no longer allow Null sentinels
> 
> Change-Id: I1f62154d05ea2f98a6574efa738b32a8a84319d5
> Reviewed-on: https://chromium-review.googlesource.com/c/1406673
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58751}

Change-Id: I1f0a22c641d0d67f435b01c82daf8da7f144bff4
Reviewed-on: https://chromium-review.googlesource.com/c/1407066
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58785}
2019-01-14 14:17:05 +00:00
Yang Guo
c8567109f5 [bootstrapper] consistently skip transferring existing property.
R=jgruber@chromium.org

Bug: v8:8669
Change-Id: I3c3995fa2e5661fa267a11649bdef1991b87c722
Reviewed-on: https://chromium-review.googlesource.com/c/1407064
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58784}
2019-01-14 14:03:32 +00:00
Clemens Hammacher
bd502b2bdd [wasm] Do not store the NativeModule in compilation units
Instead, pass it as a parameter to the compilation.
This makes compilation units slimmer with the end goal of them being
just the function index and execution tier.
It also makes ownership handling of the NativeModule easier.

R=titzer@chromium.org

Bug: v8:8343, v8:7921
Change-Id: I0522c894569c71d8b7245f5ed5612ab2a249e1ad
Reviewed-on: https://chromium-review.googlesource.com/c/1406668
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58776}
2019-01-14 12:28:38 +00:00
Ben L. Titzer
ca4c236fd3 [wasm] Rename WasmTableInit to WasmElemSegment
This matches the terminology that is used throughout the spec.

R=clemensh@chromium.org

Change-Id: I62445e750415e6048b805110c7306f3bdbf9da60
Reviewed-on: https://chromium-review.googlesource.com/c/1408988
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58774}
2019-01-14 12:01:18 +00:00
Sven Sauleau
ae5c2ea8f9 [wasm] support calling an imported func that returns a i64
It removes the assertion that caused the bug report by introducing a new
trampoline (WasmBigIntToI64) for the conversion code stub between a Bigint
object and a Wasm i64 BigIntToI64).

The tests were updated to cover calling the stub from a Wasm callsite.

Bug: v8:8625
Change-Id: I55891001cfa72f6f2849792293b43bbb54147f1a
Reviewed-on: https://chromium-review.googlesource.com/c/1405028
Commit-Queue: Sven Sauleau <ssauleau@igalia.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58767}
2019-01-14 10:28:45 +00:00
Benedikt Meurer
55decb637e [dx] Turn on zero cost async stack traces by default.
Bug: v8:7522, v8:8673
Change-Id: Iee2d6fda9291fbdd346d25d2c535874dba13fdc9
Ref: nodejs/node#11865
Design-Document: http://bit.ly/v8-zero-cost-async-stack-traces
Reviewed-on: https://chromium-review.googlesource.com/c/1396425
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58765}
2019-01-14 09:06:46 +00:00
Adam Klein
469754d01c [parser] Allow same-named labelled blocks in if/else statements
Bug: chromium:917215
Change-Id: Ie2127953a8ce3d6da4feb3478039ba318774e21d
Reviewed-on: https://chromium-review.googlesource.com/c/1404176
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58755}
2019-01-11 17:40:18 +00:00
Maya Lekova
7ebbe03e08 [test] Update inspector test expectations for await optimization
Bug: v8:8672
Change-Id: I3cd7319f81280447486b713b1b321f6e8ee099f6
Reviewed-on: https://chromium-review.googlesource.com/c/1405855
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58754}
2019-01-11 16:04:42 +00:00
Maya Lekova
1ec1712c5b Revert "[parser] Inline byte scope data into PreparseData object"
This reverts commit e2d44ede95.

Reason for revert: Breaks GC stress tests - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/23527

Original change's description:
> [parser] Inline byte scope data into PreparseData object
> 
> Each PreparseData object had at least one pointer to a PodArray for its
> serialized scope data. These objects usually have only tens of bytes of
> payload. By inlining the byte data we save 3 words per PreparseData object.
> This optimization saves 140KB of data on cnn.com.
> 
> 
> - Store data_length and inner_length as int32 saving a words on 64bit
> - Inline store byte data into PreparseData
> - OnHeapConsumedPreparseData directly uses the PreparseData object
> - get_inner, set_inner no longer allow Null sentinels
> 
> Change-Id: I1f62154d05ea2f98a6574efa738b32a8a84319d5
> Reviewed-on: https://chromium-review.googlesource.com/c/1406673
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58751}

TBR=ulan@chromium.org,cbruni@chromium.org,leszeks@chromium.org

Change-Id: I39d92ee7bd2864e1b0c3a8fed4a11b68b3e14d58
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1407073
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58753}
2019-01-11 16:02:05 +00:00
Camillo Bruni
e2d44ede95 [parser] Inline byte scope data into PreparseData object
Each PreparseData object had at least one pointer to a PodArray for its
serialized scope data. These objects usually have only tens of bytes of
payload. By inlining the byte data we save 3 words per PreparseData object.
This optimization saves 140KB of data on cnn.com.


- Store data_length and inner_length as int32 saving a words on 64bit
- Inline store byte data into PreparseData
- OnHeapConsumedPreparseData directly uses the PreparseData object
- get_inner, set_inner no longer allow Null sentinels

Change-Id: I1f62154d05ea2f98a6574efa738b32a8a84319d5
Reviewed-on: https://chromium-review.googlesource.com/c/1406673
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58751}
2019-01-11 15:20:37 +00:00
Andreas Haas
b9854da1ec [fuzzer] Remove the wasm section fuzzers
The fuzzers were already removed on the chrome side and therefore
inactive, see https://crrev.com/c/1194228.

R=machenbach@chromium.org

Bug: v8:8562
Change-Id: I0cf5ec6d07e07452c5168ea952f45028bcea1c85
Reviewed-on: https://chromium-review.googlesource.com/c/1406678
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58750}
2019-01-11 15:18:47 +00:00
Leszek Swirski
df6f5f6b69 [parser] Check assignment LHS for paren errors
It is not legal for destructuring patterns and identifiers in declarations
to be in parentheses. This includes nested patterns/identifiers inside
another pattern.

We were checking sub-patterns for parentheses when parsing possible
sub-patterns, but this check missed sub-patterns with a default
initialiser (e.g. [({x:y})=1] = {}), as the AssignmentExpression hid
the pattern.

So, we now additionally record declaration/pattern errors of an assignment
LHS when parsing the assignment cover grammar.

Bug: v8:8630
Change-Id: Ia5a97003671fc1da7f68d7fb15943928ce9496e3
Reviewed-on: https://chromium-review.googlesource.com/c/1404452
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58743}
2019-01-11 12:56:38 +00:00
Jakob Gruber
3c24404675 [regexp] Fix oob read in JSRegExp::HasCompiledCode
The JSRegExp's data fixed array is variable size depending on the
regexp kind.

Bug: v8:8572
Change-Id: I8f07b8e8d2a9a81e0905563fb701e1e3687cafb5
Reviewed-on: https://chromium-review.googlesource.com/c/1405034
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58741}
2019-01-11 12:46:45 +00:00
Jakob Gruber
f3a23accad Remove fast_sqrt generated code
As far as I can tell these were unused; their only callers were arm
and ppc simulators, but codegen explicitly returned nullptr if in a
simulator build, falling back to std::sqrt.

There's more potential cleanup to be done here for other functions
defined in codegen-*.cc files.

Tbr: clemensh@chromium.org
Bug: v8:7777, v8:8675
Change-Id: I4b9d6062c6724a810ab094d09e3cd04a0b733d9b
Reviewed-on: https://chromium-review.googlesource.com/c/1405851
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58740}
2019-01-11 12:45:38 +00:00
Yang Guo
f451d6ce77 [logging] correctly log code events from deserialization.
R=jarin@chromium.org

Bug: v8:8671, v8:8674
Change-Id: I5cdcd49d05f08206aa32426f2fe0560568291f2e
Reviewed-on: https://chromium-review.googlesource.com/c/1405852
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58739}
2019-01-11 12:44:29 +00:00
Michael Achenbach
1efb130a8e [test] Remove leftovers of the interrupt-budget fuzzer
TBR=sergiyb@chromium.org

Bug: v8:8174, v8:8457
Change-Id: Ie87eddcc6986e1c724040b11b036b502e399dd05
Reviewed-on: https://chromium-review.googlesource.com/c/1404437
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58735}
2019-01-11 11:21:01 +00:00
Clemens Hammacher
8518d12200 [Liftoff] Fix sub of the same register
In the degenerate case where we wanted to emit {x = x - x} (where {x}
is any register), ia32 and x64 generated wrong code (producing {-x + -x}
instead). Fix this by special casing this case.

R=ahaas@chromium.org

Bug: chromium:919308
Change-Id: I9cd9818d2a678450ac6530107e7a5cbb625ddb8d
Reviewed-on: https://chromium-review.googlesource.com/c/1405029
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58731}
2019-01-11 10:57:09 +00:00
Michael Starzinger
1583e86d56 [wasm] Remove Isolate from WasmImportWrapperCache.
R=clemensh@chromium.org

Change-Id: I48bfae1dbbfaafb1cadad8d3cbbc921c53801f8c
Reviewed-on: https://chromium-review.googlesource.com/c/1405857
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58727}
2019-01-11 10:24:45 +00:00
Clemens Hammacher
92843517b3 [wasm][fuzzer] Automatically compute year for test generation
This avoids having to update either the source code or the generated
test cases each year.

R=ahaas@chromium.org

Change-Id: I33fb85dc4ae7d45f8d05d982e0285d6fd3008a26
Reviewed-on: https://chromium-review.googlesource.com/c/1405032
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58725}
2019-01-11 09:55:25 +00:00
Clemens Hammacher
1740bc7bf6 [wasm] Fix maximum value length in scope info
i64 values can be up to 20 characters long (19 + sign), plus we need
one character for the terminating null character. Thus the previous 18
needs to be increased to 21.
Also extend the test to check the longest possible i64 values.

R=ahaas@chromium.org
CC=kozyatinskiy@chromium.org

Bug: v8:8644
Change-Id: Ia9458db162a55dd57b5e8bc7cf7db73c3bab4734
Reviewed-on: https://chromium-review.googlesource.com/c/1404443
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58724}
2019-01-11 09:37:59 +00:00
Clemens Hammacher
f59d6d96e1 [Liftoff][arm] Leave scratch register to the assembler
In {Assembler::and_} we might need to use the scratch register. Thus use
a free LiftoffRegister instead to emit i32 popcnt.

R=ahaas@chromium.org
CC=george.wort@arm.com

Bug: chromium:918284
Change-Id: Ia814899bf6e33dd4989fd09329542b4bc09b48df
Reviewed-on: https://chromium-review.googlesource.com/c/1405036
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58723}
2019-01-11 08:27:16 +00:00
Deepti Gandluri
8468150d35 Reland "[wasm] Fix SIMD boolean reductions on Intel"
This is a reland of 8f83fd0a55

Original change's description:
> [wasm] Fix SIMD boolean reductions on Intel
> 
>  - Both AllTrue/AnyTrue values should return boolean 0/1
>    instead of 0xffffffff to match Spec/Toolchain
>  - Fix AllTrue implementation to be correct
>  - Add unit tests to spot check return values as the
>    cumulative test can coerce some return values to True/False
> 
> Change-Id: I84eb73c915414c9ec290e73f1306404ceff729f0
> Bug: v8:8636
> Reviewed-on: https://chromium-review.googlesource.com/c/1404197
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58715}

Bug: v8:8636
Change-Id: Ifc438d7b64bf5d461cc848851165665104fe57d0
Reviewed-on: https://chromium-review.googlesource.com/c/1405909
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58719}
2019-01-11 01:21:27 +00:00
Frank Tang
c17d21a0fa [Intl] Not harden the array return by supportedLocalesOf
see spec change in
https://github.com/tc39/ecma402/pull/278/

Bug: v8:8398
Change-Id: If5582f96d6dc3debdccb466d3d239efa52bbbf06
Reviewed-on: https://chromium-review.googlesource.com/c/1404436
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58717}
2019-01-10 21:39:47 +00:00
Michael Achenbach
82e58aaa80 Revert "[wasm] Fix SIMD boolean reductions on Intel"
This reverts commit 8f83fd0a55.

Reason for revert: Seems to break older intel chips:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20debug/23954

Original change's description:
> [wasm] Fix SIMD boolean reductions on Intel
> 
>  - Both AllTrue/AnyTrue values should return boolean 0/1
>    instead of 0xffffffff to match Spec/Toolchain
>  - Fix AllTrue implementation to be correct
>  - Add unit tests to spot check return values as the
>    cumulative test can coerce some return values to True/False
> 
> Change-Id: I84eb73c915414c9ec290e73f1306404ceff729f0
> Bug: v8:8636
> Reviewed-on: https://chromium-review.googlesource.com/c/1404197
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58715}

TBR=bbudge@chromium.org,gdeepti@chromium.org

Change-Id: I0eba24e0fe5215c1f8f377776692db245239e134
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8636
Reviewed-on: https://chromium-review.googlesource.com/c/1405321
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58716}
2019-01-10 20:18:12 +00:00
Deepti Gandluri
8f83fd0a55 [wasm] Fix SIMD boolean reductions on Intel
- Both AllTrue/AnyTrue values should return boolean 0/1
   instead of 0xffffffff to match Spec/Toolchain
 - Fix AllTrue implementation to be correct
 - Add unit tests to spot check return values as the
   cumulative test can coerce some return values to True/False

Change-Id: I84eb73c915414c9ec290e73f1306404ceff729f0
Bug: v8:8636
Reviewed-on: https://chromium-review.googlesource.com/c/1404197
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58715}
2019-01-10 19:11:35 +00:00
Jaroslav Sevcik
ef12b47b59 [turbofan] Fix invocation frequency computation with NaN.
If feedback for call site frequency is 0, then the combined frequency
is still 0, even if the current function invocation count is infinity.

Bug: chromium:919754
Change-Id: I97be096b6b38f934fb13f01b2b22e148c539e1c0
Reviewed-on: https://chromium-review.googlesource.com/c/1404445
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58714}
2019-01-10 19:04:05 +00:00
Mike Stanton
72d8307f78 [Builtins] Array.prototype.filter species creation error
If a species constructor is installed, filter() needs to loop over
the elements of the array in the "slow" way, because it doesn't
know the ElementsKind of the output array. The code failed to
bail out to the slow case for the loop right away on discovering this.

Bug: chromium:920184, chromium:920491
Change-Id: I74496db20a90807b631c1bebe7604d85b199df67
Reviewed-on: https://chromium-review.googlesource.com/c/1405035
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58713}
2019-01-10 18:09:36 +00:00
Ulan Degenbaev
68a8bdd829 [heap] Remove bailout marking worklist.
The concurrent marker can now process all objects.
This patch also eagerly visits the objects that undergo layout
changes. This is because previously such objects were pushed
onto the bailout worklist, which is gone now.
To preserve the incremental step accounting, the patch introduces
a new GC tracer scope called MC_INCREMENTAL_LAYOUT_CHANGE.

Bug: v8:8486
Change-Id: Ic1c2f0d4e2ac0602fc945f3258af9624247bd65f
Reviewed-on: https://chromium-review.googlesource.com/c/1386486
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58712}
2019-01-10 17:39:45 +00:00
Clemens Hammacher
e8316b64b2 [Liftoff][arm] Fix stack moves
Use the right register type for the temporary register.

R=titzer@chromium.org

Bug: v8:6600, chromium:917588
Change-Id: Ia2617f6b406924ca7f496608fd495faf04dff25b
Reviewed-on: https://chromium-review.googlesource.com/c/1403127
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58711}
2019-01-10 17:21:47 +00:00
Toon Verwaest
6c2cc582e5 [parser] Change and fix how we MarkLoopVariableAsAssigned
Keep track of loop nesting depth on FunctionState and use that to decide
whether to mark var as assigned. That also fixes the weird cornercase where a
loop body can have multiple expressions due to multiple declarations with
independent initializers in a single var-statement.

Change-Id: Ia24affde29e22e9464448fd390062f6dd983faf2
Reviewed-on: https://chromium-review.googlesource.com/c/1405037
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58707}
2019-01-10 15:56:49 +00:00
Leszek Swirski
5e2c23e2d3 [destructuring] Get non-coercible message contents in runtime
For desrtucturing assignments from null/undefined, we throw an error
that references the destructuring object literal's property name, e.g.
for
  var { x } = null;
we report that we cannot destructure 'x' from null.

Rather than calculating this property during bytecode generation (and
including it in the bytecode as an argument to the type error
constructor), we can calculate it at exception throwing time, by
re-parsing the source in a similar way to the existing call site
rendering.

This slightly decreases bytecode size and slightly decreases the amount
of work the bytecode compiler needs to do. In the future, it could also
allow us to give more detailed error messages, as we now have access to
the entire AST and are on the slow path anyway.

Bug: v8:6499
Change-Id: Icdbd4667db548b4e5e62ef97797a3771b5c1bf72
Reviewed-on: https://chromium-review.googlesource.com/c/1396080
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58706}
2019-01-10 15:23:05 +00:00
Jakob Kummerow
fc329ce22a [ubsan] Fix various cases of undefined behavior
Mostly signed integer overflows, and a few cases of double
division by zero (which is defined by IEEE-754 to return
Infinity (or NaN for 0/0) but is UB in C++).
In base/ieee754.cc, use constants for NaN and Infinity instead
of computing these values.
In spaces-unittest.cc, ensure that a large enough allocation
is used.

Bug: v8:3770
Change-Id: I50d9a77dc860ef9993b7b269a5f8c117b0f62f9d
Reviewed-on: https://chromium-review.googlesource.com/c/1403454
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58701}
2019-01-10 13:52:04 +00:00
Jakob Gruber
8ea94bb3eb Revert "[test] add perf tests for String.p.startsWith"
This reverts commit 5dee355fe6.

Reason for revert: https://ci.chromium.org/p/v8-internal/builders/luci.v8-internal.ci/v8_linux64_perf_1/4282

Original change's description:
> [test] add perf tests for String.p.startsWith
> 
> Add performance tests for String.prototype.startsWith ahead of port to
> torque in order to keep track of how performance is affected.
> 
> Bug: v8:8400
> Change-Id: Ifc753a6f13da20c1760e545a99fd693717e3acc6
> Reviewed-on: https://chromium-review.googlesource.com/c/1402934
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#58685}

TBR=jgruber@chromium.org,usharma1998@gmail.com

Change-Id: I5855b08fa5e55ab8594185a0a84a26f567e2b9d3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8400
Reviewed-on: https://chromium-review.googlesource.com/c/1404446
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58697}
2019-01-10 12:34:51 +00:00
Jakob Kummerow
40ac5a39fc [ubsan] Fix numerical overflows in wasm
Mostly signed integer overflows, and a few cases of double
division by zero (which is defined by IEEE-754 to return
Infinity (or NaN for 0/0) but is UB in C++).

Bug: v8:3770
Change-Id: Id92725b0ac57cb357978124a3dc6f477430bc97d
Reviewed-on: https://chromium-review.googlesource.com/c/1403133
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58696}
2019-01-10 12:24:51 +00:00
Leszek Swirski
f9a858fc96 [ignition] Remove useless iterator 'done' setting
The 'done' setting dance in BuildFillArrayWithIterator turned out to
not be useful, as the StoreInArrayLiteral call could not ever throw an
exception. Since iterator exceptions count as done, we are guarnteed to
be done as soon as we enter the loop.

Change-Id: Ibe2ba1fcbe383bfcfedb185169890b6931cc7884
Reviewed-on: https://chromium-review.googlesource.com/c/1402792
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58695}
2019-01-10 11:37:42 +00:00
Leszek Swirski
7fbbce5fa1 [ignition] Fix iteration finalization exception suppression
The IteratorClose spec specifies that exceptions in
%GetMethod(iterator.return) are not suppressed by exceptions in the
given continuation (body of a loop, assignments in destructuring),
while exceptions in the execution of iterator.return() are.

This means that we have to split out the property access + a typeof
check to be outside the try-catch, and keep the call inside of it.

The non-split version is only for cases when there is no 'throws'
continuation (as is the case for yield* calling IteratorClose), so
the existing BuildIteratorClose can be renamed to reflect this.

Change-Id: Id71aea4fddd6ffb986bd9aaa09d29615a8800f71
Reviewed-on: https://chromium-review.googlesource.com/c/1402789
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58694}
2019-01-10 11:29:12 +00:00
Jakob Kummerow
af8ff984f6 [ubsan] Fix numerical overflows in the compiler
Mostly signed integer overflows, and a few cases of double
division by zero (which is defined by IEEE-754 to return
Infinity (or NaN for 0/0) but is UB in C++).

Bug: v8:3770
Change-Id: I8007987594ff534ca697c1c3247215a72a001343
Reviewed-on: https://chromium-review.googlesource.com/c/1403132
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58693}
2019-01-10 11:17:37 +00:00
Jakob Gruber
566a885d4a [nojit] Don't allocate executable memory in jitless mode
This CL disables RX (read and execute) permissions for Code memory
when in jitless mode. All memory that was previously allocated RX
is now read-only.

Bug: v8:7777
Cq-Include-Trybots: luci.v8.try:v8_linux_arm_lite_rel_ng
Change-Id: I52d6ed785d244ec33168a02293c5506d26f36fe8
Reviewed-on: https://chromium-review.googlesource.com/c/1390122
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58692}
2019-01-10 10:55:48 +00:00
Andreas Haas
2755543ab3 [wasm] Remove --experimental-wasm-mut-global flag
The flag has been enabled by default since June 2018, see
https://crrev.com/c/1095650.

R=binji@chromium.org

Bug: v8:7625
Change-Id: I7cb4874db7f632b593f912e084b9fb7b8d568afe
Reviewed-on: https://chromium-review.googlesource.com/c/1402546
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58689}
2019-01-10 09:40:56 +00:00
Ujjwal Sharma
5dee355fe6 [test] add perf tests for String.p.startsWith
Add performance tests for String.prototype.startsWith ahead of port to
torque in order to keep track of how performance is affected.

Bug: v8:8400
Change-Id: Ifc753a6f13da20c1760e545a99fd693717e3acc6
Reviewed-on: https://chromium-review.googlesource.com/c/1402934
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58685}
2019-01-10 08:20:48 +00:00
Frank Tang
d286fe3dbc [Intl] Fix getting undefined property crash
If the key of the u-ext has no value it will return error so
we should just return undefined for that case.

Bug: v8:8663
Change-Id: I7446ad74c8d0609ad268385b6f4d986060424ce9
Reviewed-on: https://chromium-review.googlesource.com/c/1404194
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58682}
2019-01-10 00:59:53 +00:00
Clemens Hammacher
24a43b3c4e [Liftoff] Fix reloading register spilled multiple times
Since register can be used multiple times on the stack, they can also
be spilled into multiple stack slots. At merge points, we then might
have to reload the spilled slots. A DCHECK currently checks that each
register is only loaded once. Instead of failing, just load the first
stack slot, the others are statically known to contain the same value
anyways.

R=ahaas@chromium.org

Bug: v8:6600, chromium:919533
Change-Id: Ic0c806238b2997f006829b4b509a50468a55befa
Reviewed-on: https://chromium-review.googlesource.com/c/1403124
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58676}
2019-01-09 16:12:50 +00:00
Ben L. Titzer
49a526ace9 Remove invalid DCHECKS in unwinding-info-writer
The unwinding info writer was assuming that a block that had no initial
state must be the start or end block. It was trying to check if the
block was the start or end by asserting that the block had either
no predecessors or no successors. Loop rotation breaks this assumption,
since it can move a block from inside a loop to before the loop
header, and the block can then be the "start" block. But since
such a block has both predecessor(s) and a successor, the check was
wrong.

R=clemensh@chromium.org
BUG=chromium:913844

Change-Id: Ic24c67a822d510cb082f25608089d313c3459be8
Reviewed-on: https://chromium-review.googlesource.com/c/1373770
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58675}
2019-01-09 15:52:08 +00:00
Yang Guo
c736883ed4 Optionally use halfsiphash for integer hashing.
Change-Id: Ibd14f7b3fe78635675c76ae864112e3a3a7bc701
Reviewed-on: https://chromium-review.googlesource.com/c/1382463
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#58674}
2019-01-09 15:20:51 +00:00