Commit Graph

5709 Commits

Author SHA1 Message Date
mstarzinger
cbf2a5420e [interpreter] Enable tests that no longer fail.
The compilation pipeline is correctly guarding against accidental
tier-ups by now, the tests in question should no longer fail.

R=yangguo@chromium.org
BUG=v8:4961
LOG=n

Review-Url: https://codereview.chromium.org/1938983002
Cr-Commit-Position: refs/heads/master@{#35934}
2016-05-02 14:01:10 +00:00
machenbach
78cf397def [Interpreter] Skip some tests that fail with --ignition
BUG=v8:4280
LOG=N
TBR=rmcilroy@chromium.org, rmcilroy@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/1934283002
Cr-Commit-Position: refs/heads/master@{#35931}
2016-05-02 12:17:52 +00:00
machenbach
8ba46715b0 [Ignition] Test ignition on all bots.
This adds ignition to the testing variants that are run on all
bots.

Failing tests can only be skipped with the NO_IGNITION
keyword in status files. Existing expectations for the
ignition_turbofan variant are all duplicated and use the
NO_IGNITION keyword as well now.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/132c09ed619f23fb7c6d26a4e3552c703389eabd
Cr-Commit-Position: refs/heads/master@{#35865}

Review-Url: https://codereview.chromium.org/1804003002
Cr-Commit-Position: refs/heads/master@{#35926}
2016-05-02 09:25:00 +00:00
fedor
aee17a63b3 [prof] export slide offset in profile log
When exporting `shared-library` in profile log, additionally export a
slide offset. This is required to parse profile logs generated on
systems with ASLR (OS X), otherwise it is impossible to assign C++
symbol names to their addresses in the log.

See: https://github.com/nodejs/node/issues/6466

BUG=

Review-Url: https://codereview.chromium.org/1934453003
Cr-Commit-Position: refs/heads/master@{#35921}
2016-05-02 08:03:01 +00:00
ishell
b83edcc8b1 [runtime] Don't crash when creating an instance of a class inherited from a Proxy.
BUG=v8:4972
LOG=N

Review-Url: https://codereview.chromium.org/1925803005
Cr-Commit-Position: refs/heads/master@{#35911}
2016-04-29 15:07:35 +00:00
mstarzinger
5749d710bc [compiler] Fix TurboFan to respect kOptimizeFromBytecode.
This ensures that the TurboFan pipeline is respecting the flag on the
CompilationInfo controlling whether to use the BytecodeGraphBuilder or
the AstGraphBuilder when ensuring deoptimization support.

R=rmcilroy@chromium.org
BUG=chromium:607871
LOG=n

Review-Url: https://codereview.chromium.org/1934563002
Cr-Commit-Position: refs/heads/master@{#35904}
2016-04-29 12:04:43 +00:00
machenbach
3bf44848c3 [gn] Move build to gypfiles
This prepares for pulling chromium's build as dependency for
gn. After this, the files in build and gypfiles need to stay
in sync until chromium is updated.

BUG=chromium:474921
LOG=n

Review-Url: https://codereview.chromium.org/1848553003
Cr-Commit-Position: refs/heads/master@{#35898}
2016-04-29 10:11:11 +00:00
titzer
ee03b7217b [wasm] Binary 11: Bump module version to 0xB.
[wasm] Binary 11: Swap the order of section name / section length.
[wasm] Binary 11: Shorter section names.
[wasm] Binary 11: Add a prefix for function type declarations.
[wasm] Binary 11: Function types encoded as pcount, p*, rcount, r*
[wasm] Fix numeric names for functions.

R=rossberg@chromium.org,jfb@chromium.org,ahaas@chromium.org
BUG=chromium:575167
LOG=Y

Review-Url: https://codereview.chromium.org/1896863003
Cr-Commit-Position: refs/heads/master@{#35897}
2016-04-29 09:40:24 +00:00
titzer
2aa4656eeb [wasm] Binary 11: WASM AST is now postorder.
[wasm] Binary 11: br_table takes a value.
[wasm] Binary 11: Add implicit blocks to if arms.
[wasm] Binary 11: Add arities to call, return, and breaks
[wasm] Binary 11: Add experimental version.

This CL changes the encoder, decoder, and tests to use a postorder
encoding of the AST, which is more efficient in decode time and
space.

R=bradnelson@chromium.org,rossberg@chromium.org,binji@chromium.org
BUG=chromium:575167
LOG=Y

Review-Url: https://codereview.chromium.org/1830663002
Cr-Commit-Position: refs/heads/master@{#35896}
2016-04-29 09:16:21 +00:00
mstarzinger
b06fa13704 [interpreter] Be explicit when to test BytecodeGraphBuilder.
This adds a dedicated flag for enabling the BytecodeGraphBuilder. The
intention is to be explicit when this variant is being tested and to
avoid unnecessary overhead in production code for a configuration that
is not yet shipping.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/1925123002
Cr-Commit-Position: refs/heads/master@{#35892}
2016-04-29 08:41:11 +00:00
machenbach
819371c628 Revert of Remove more dead code after Object.observe removal (patchset #5 id:80001 of https://codereview.chromium.org/1904313004/ )
Reason for revert:
[Sheriff] Looks like this breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/6442

Original issue's description:
> Remove more dead code after Object.observe removal
>
> This moves __{define,lookup}{Getter,Setter}__ to builtins.cc to free up the JavaScript implementation of DefineOwnProperty for deletion.

TBR=verwaest@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1929293002
Cr-Commit-Position: refs/heads/master@{#35886}
2016-04-29 06:31:02 +00:00
littledan
3d66e5d1d7 Add checks for detached ArrayBuffers to ArrayBuffer.prototype.slice
These checks ensure that a TypeError is thrown, per spec, rather than
a runtime assert failure.

BUG=v8:4964
R=adamk
LOG=Y

Review-Url: https://codereview.chromium.org/1929123002
Cr-Commit-Position: refs/heads/master@{#35885}
2016-04-28 22:50:56 +00:00
jkummerow
15e106382e Remove more dead code after Object.observe removal
This moves __{define,lookup}{Getter,Setter}__ to builtins.cc to free up the JavaScript implementation of DefineOwnProperty for deletion.

Review-Url: https://codereview.chromium.org/1904313004
Cr-Commit-Position: refs/heads/master@{#35876}
2016-04-28 18:35:42 +00:00
machenbach
af41997177 Revert of [Ignition] Test ignition on all bots. (patchset #4 id:60001 of https://codereview.chromium.org/1804003002/ )
Reason for revert:
Will resubmit with proper fix and more test skips.

Original issue's description:
> [Ignition] Test ignition on all bots.
>
> This adds ignition to the testing variants that are run on all
> bots.
>
> Failing tests can only be skipped with the NO_IGNITION
> keyword in status files. Existing expectations for the
> ignition_turbofan variant are all duplicated and use the
> NO_IGNITION keyword as well now.
>
> BUG=v8:4280
> LOG=N
> NOTRY=true

TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,yangguo@chromium.org,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review-Url: https://codereview.chromium.org/1930943002
Cr-Commit-Position: refs/heads/master@{#35871}
2016-04-28 14:53:57 +00:00
rossberg
9e7793eaac Ship for-in initializer deprecation
R=hablich@chromium.org
BUG=v8:4942
LOG=true

Review-Url: https://codereview.chromium.org/1928513004
Cr-Commit-Position: refs/heads/master@{#35868}
2016-04-28 13:39:18 +00:00
machenbach
132c09ed61 [Ignition] Test ignition on all bots.
This adds ignition to the testing variants that are run on all
bots.

Failing tests can only be skipped with the NO_IGNITION
keyword in status files. Existing expectations for the
ignition_turbofan variant are all duplicated and use the
NO_IGNITION keyword as well now.

BUG=v8:4280
LOG=N
NOTRY=true

Review-Url: https://codereview.chromium.org/1804003002
Cr-Commit-Position: refs/heads/master@{#35865}
2016-04-28 13:32:27 +00:00
yangguo
5ea8412304 [debugger,interpreter] add source position to stack checks.
DevTools uses the debug interrupt to trap on function entry. Without
source position at the stack check, we would get bogus source positions.

R=mstarzinger@chromium.org
BUG=chromium:595646
LOG=N

Review-Url: https://codereview.chromium.org/1925063002
Cr-Commit-Position: refs/heads/master@{#35864}
2016-04-28 13:16:57 +00:00
yangguo
9a93964503 [debugger,interpreter] tentatively unskip gc-stress tests.
R=machenbach@chromium.org
BUG=v8:4690
LOG=N

Review-Url: https://codereview.chromium.org/1925993002
Cr-Commit-Position: refs/heads/master@{#35856}
2016-04-28 11:19:16 +00:00
neis
622c92b88f Correctly set the closing condition in array patterns.
This fixes a bug where the iterable's .return method gets called when it
shouldn't.

R=littledan@chromium.org
BUG=v8:4952
LOG=n

Review-Url: https://codereview.chromium.org/1927073002
Cr-Commit-Position: refs/heads/master@{#35850}
2016-04-28 10:01:23 +00:00
yangguo
31182fb2aa Skip more tests for ignition and gc-stress.
NOTRY=true
TBR=machenbach@chromium.org
BUG=v8:4961
LOG=N

Review-Url: https://codereview.chromium.org/1928893002
Cr-Commit-Position: refs/heads/master@{#35849}
2016-04-28 09:34:23 +00:00
yangguo
47ffcac6d5 Skip es6/block-conflicts for ignition and gc-stress.
TBR=machenbach@chromium.org
BUG=v8:4961
LOG=N
NOTRY=true

Review-Url: https://codereview.chromium.org/1924093004
Cr-Commit-Position: refs/heads/master@{#35845}
2016-04-28 08:13:05 +00:00
yangguo
cd3a5ee951 Skip es6/typedarray-copywithin for ignition
R=machenbach@chromium.org
BUG=v8:4961
NOTRY=true
LOG=N
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/1915033008
Cr-Commit-Position: refs/heads/master@{#35842}
2016-04-28 07:33:25 +00:00
yangguo
c218683494 [debugger,interpreter] precisely determine execution tier.
R=mstarzinger@chromium.org
BUG=v8:4690
LOG=N

Review-Url: https://codereview.chromium.org/1921853005
Cr-Commit-Position: refs/heads/master@{#35840}
2016-04-28 06:19:48 +00:00
caitpotter88
ff956f4dee [esnext] implement StringPad spec changes from March TC39 meeting
Return the empty string from StringPad if the filler argument is the empty
string, effectively returning the string unchanged in StringPadStart and
StringPadEnd.

```
"foo".padStart(100000, "") -> "foo"
```

BUG=v8:4957, v8:4954
LOG=N
R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/1926773003
Cr-Commit-Position: refs/heads/master@{#35837}
2016-04-27 22:03:27 +00:00
verwaest
41acd51bc3 Remove now-dead DefineDataPropertyUnchecked
BUG=

Review URL: https://codereview.chromium.org/1926493003

Cr-Commit-Position: refs/heads/master@{#35823}
2016-04-27 13:22:17 +00:00
neis
42c0e2ec7c [generators] Perform state dispatch in loop header.
This is necessary to eventually build a turbofan graph.

BUG=v8:4907
LOG=n

Review URL: https://codereview.chromium.org/1901713003

Cr-Commit-Position: refs/heads/master@{#35820}
2016-04-27 12:42:10 +00:00
ssanfilippo
905becd13b [Interpreter] Add Ignition statistics JavaScript extension.
This commit introduces IgnitionStatisticsExtension, which provides
methods for accessing Ignition statistics and counters from JavaScript.

The extension is registered when FLAG_ignition and
FLAG_trace_ignition_dispatches are both enabled.

For the moment, the only exposed function is
getIgnitionDispatchCounters(), which allows to retrieve Ignition
dispatch counters as a JavaScript object.

BUG=v8:4899
LOG=N

Review URL: https://codereview.chromium.org/1899133004

Cr-Commit-Position: refs/heads/master@{#35816}
2016-04-27 11:11:44 +00:00
yangguo
612985b298 Revert of [debugger] unskip mjsunit/debug-stepin-builtin-callback-opt. (patchset #1 id:1 of https://codereview.chromium.org/1927543002/ )
Reason for revert:
Now we do have a repro!

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3187/steps/Mjsunit%20-%20ignition%20-%20turbofan/logs/debug-stepin-builtin-..

Original issue's description:
> [debugger] unskip mjsunit/debug-stepin-builtin-callback-opt.
>
> This test does not seem to fail any longer.
>
> R=machenbach@chromium.org
> BUG=v8:4690
> LOG=N
>
> Committed: https://crrev.com/f8e44fb5aaaa80cf2d39bc3164f2c962a6b57f5e
> Cr-Commit-Position: refs/heads/master@{#35814}

TBR=machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4690

Review URL: https://codereview.chromium.org/1931433002

Cr-Commit-Position: refs/heads/master@{#35815}
2016-04-27 10:54:53 +00:00
yangguo
f8e44fb5aa [debugger] unskip mjsunit/debug-stepin-builtin-callback-opt.
This test does not seem to fail any longer.

R=machenbach@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1927543002

Cr-Commit-Position: refs/heads/master@{#35814}
2016-04-27 10:20:33 +00:00
ishell
813f2778f3 [es6] Don't eliminate tail calls from for-in and for-of bodies.
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1914393002

Cr-Commit-Position: refs/heads/master@{#35813}
2016-04-27 09:34:10 +00:00
verwaest
f1cc6e646f Check the state of the current binary op IC before patching smi code
Between the miss and patching, we run user code. That may already patch the same code. IC refactoring broke this (again), so including a regression test this time around.

BUG=chromium:601392
LOG=n

Review URL: https://codereview.chromium.org/1925583002

Cr-Commit-Position: refs/heads/master@{#35811}
2016-04-27 09:19:15 +00:00
yangguo
d1e08e7a72 [debugger] do not expose temporary variables introduced by the parser.
R=bmeurer@chromium.org, kozyatinskiy@chromium.org
BUG=chromium:582048
LOG=N

Review URL: https://codereview.chromium.org/1916343002

Cr-Commit-Position: refs/heads/master@{#35805}
2016-04-27 04:49:46 +00:00
ishell
ea2fbb7620 [es8] Initial set of changes to support syntactic tail calls.
The syntax is "return continue expr;".

BUG=v8:4915
LOG=Y

Review URL: https://codereview.chromium.org/1917993004

Cr-Commit-Position: refs/heads/master@{#35799}
2016-04-26 17:31:23 +00:00
adamk
967a04634d Forward accept_IN to ParseYieldExpression
This allows "yield 'x' in o" as an expression in a generator.

R=ishell@chromium.org
BUG=v8:4945
LOG=n

Review URL: https://codereview.chromium.org/1916183003

Cr-Commit-Position: refs/heads/master@{#35798}
2016-04-26 17:24:49 +00:00
yangguo
eee6ddb2ac [debugger] add test case for debug-evaluate for values in TDZ.
R=jkummerow@chromium.org
BUG=chromium:605581
LOG=N

Review URL: https://codereview.chromium.org/1920953003

Cr-Commit-Position: refs/heads/master@{#35794}
2016-04-26 14:11:21 +00:00
machenbach
4ffdce65dd [Interpreter] Prepare switching to new ignition testing variant.
This adds a new ignition_turbofan testing variant that'll
allow switching turbofan off in the other ignition variant.

The switch will happen in a follow up after reconfiguring
the bots.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1922623003

Cr-Commit-Position: refs/heads/master@{#35790}
2016-04-26 11:24:34 +00:00
ishell
086fe2199b [es6] Fix tail call elimination in single-expression arrow functions.
BUG=v8:4698
LOG=Y

Review URL: https://codereview.chromium.org/1921083002

Cr-Commit-Position: refs/heads/master@{#35786}
2016-04-26 09:07:51 +00:00
verwaest
1678bb557c MigrateInstance(target) before Object.assign(target, ...)
If the target is deprecated, the object will be updated on first store. If the source for that store equals the target, this will invalidate the cached representation of the source. Preventively upgrade the target.

BUG=chromium:604300
LOG=n

Review URL: https://codereview.chromium.org/1905933002

Cr-Commit-Position: refs/heads/master@{#35770}
2016-04-25 15:41:21 +00:00
yangguo
6f67d171f1 [regexp] Fix non-match and max match length in RegExpCharacterClass.
R=mstarzinger@chromium.org
BUG=chromium:605862
LOG=N

Review URL: https://codereview.chromium.org/1916763002

Cr-Commit-Position: refs/heads/master@{#35764}
2016-04-25 13:32:14 +00:00
yangguo
3c7391093b [debugger] fix mjsunit/regress/regress-crbug-119800 for ignition.
R=vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1907293002

Cr-Commit-Position: refs/heads/master@{#35758}
2016-04-25 11:37:12 +00:00
yangguo
098ff93558 [debugger] make step positions for for-of compatible with interpreter.
R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1906653004

Cr-Commit-Position: refs/heads/master@{#35750}
2016-04-25 06:53:41 +00:00
Adam Klein
f6c09c893a Remove non-existent object-observe test from mjsunit.status
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1907423002 .

Cr-Commit-Position: refs/heads/master@{#35740}
2016-04-22 18:31:44 +00:00
yangguo
4b580cad0c [debugger,interpreter] fix source position of compare operation.
R=mstarzinger@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1903223003

Cr-Commit-Position: refs/heads/master@{#35729}
2016-04-22 13:11:48 +00:00
rossberg
9ce87d6772 Add flag for disallowing for-in initializers
This does not affect use counters.

R=nikolaos@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1911963003

Cr-Commit-Position: refs/heads/master@{#35726}
2016-04-22 12:04:15 +00:00
yangguo
672983830f [debugger] Hide scopes that originate from desugaring.
Some scopes are introduced by the parser for desugaring and do not
have any positions associated. The debugger should not make them
visible.

Also add some missing source positions.

R=kozyatinskiy@chromium.org, rossberg@chromium.org
BUG=chromium:604458
LOG=Y

Review URL: https://codereview.chromium.org/1901413002

Cr-Commit-Position: refs/heads/master@{#35721}
2016-04-22 10:48:45 +00:00
rmcilroy
11e3ba34f5 [Interpreter] Fix incorrect Register OperandSize calculation for ExtraWide.
Fixes a mistake made in r35618 for register OperandSize calculations.

BUG=605470
LOG=N

Review URL: https://codereview.chromium.org/1908033002

Cr-Commit-Position: refs/heads/master@{#35719}
2016-04-22 10:32:14 +00:00
jkummerow
f4a9a50147 [tests] Add testcase for r35397
This is a follow-up to 58429beb7b
"Fix KeyedStore stub selection for STRING_WRAPPER_ELEMENTS".

BUG=chromium:602184
LOG=n

Review URL: https://codereview.chromium.org/1912443004

Cr-Commit-Position: refs/heads/master@{#35715}
2016-04-22 09:08:46 +00:00
adamk
6a370a6f01 Remove support for Object.observe
The feature was deprecated in M49 and flagged off in M50.
This patch removes it entirely from the codebase.

Review URL: https://codereview.chromium.org/1909433003

Cr-Commit-Position: refs/heads/master@{#35714}
2016-04-22 09:02:41 +00:00
jkummerow
9bebebd909 [ic] Restore PROPERTY key tracking in keyed ICs
Non-vectorized KeyedLoadICs used to remember whether they had seen Names
as keys; Crankshaft uses this information to avoid emitting elements
accesses which would always deopt. This CL restores that functionality
for vector ICs.

BUG=chromium:594183
LOG=y
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1912593002

Cr-Commit-Position: refs/heads/master@{#35706}
2016-04-21 13:18:28 +00:00
yangguo
ff2a04bbb9 [debugger] fix mjsunit/es6/debug-promises/stepin-constructor.js for ignition.
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1907973002

Cr-Commit-Position: refs/heads/master@{#35704}
2016-04-21 13:16:04 +00:00
yangguo
4d824551c7 [debugger] fix mjsunit/debug-allscopes-on-debugger.js for ignition.
R=vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1910813002

Cr-Commit-Position: refs/heads/master@{#35701}
2016-04-21 11:30:44 +00:00
verwaest
7dfb5beeec Fix 'typeof null' canonicalization in crankshaft
BUG=

Review URL: https://codereview.chromium.org/1912553002

Cr-Commit-Position: refs/heads/master@{#35699}
2016-04-21 11:24:31 +00:00
titzer
b3cf031eb8 [wasm] Enforce strict ordering of WASM module sections.
R=jfb@chromium.org,rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1900153002

Cr-Commit-Position: refs/heads/master@{#35698}
2016-04-21 11:20:15 +00:00
verwaest
4a6a0f5530 Make sure we always try to make prototypes fast again when transitioning accessors
BUG=chromium:605060
LOG=n

Review URL: https://codereview.chromium.org/1907953002

Cr-Commit-Position: refs/heads/master@{#35697}
2016-04-21 11:18:08 +00:00
ishell
b4dbb2f710 [deoptimizer] Do not modify stack_fp which is used as a key for lookup of previously materialized objects.
BUG=chromium:604680, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1904663003

Cr-Commit-Position: refs/heads/master@{#35693}
2016-04-21 09:54:33 +00:00
clemensh
e530556471 [wasm] Add test case for stack trace of wasm traps
Since traps now throw real Error objects, we get stack traces
containing <WASM> functions on top-level. The additional tests check
for two traps: unreachable and memory out-of-bounds.

R=ahaas@chromium.org, jfb@chromium.org, titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1878563003

Cr-Commit-Position: refs/heads/master@{#35691}
2016-04-21 09:38:21 +00:00
clemensh
449af6f229 [wasm] Also test structured stack trace
This extends the wasm test case which only checks the "simple"
string-variant of the stack trace.
It checks the return values of the getFunctionName, getLineNumber,
getFileName and toString methods.

R=machenbach@chromium.org, jfb@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/1875153002

Cr-Commit-Position: refs/heads/master@{#35687}
2016-04-21 08:37:19 +00:00
adamk
e96cbdcdd6 More accurately record an end position for default parameters in arrows
Our previous over-conservative answer caused us to emit hole checks in
full-codegen when eagerly parsing but not when lazily parsing.

With this patch, we use the positions of the BinaryOperations making up
the parameter list (which are the positions of the commas) to determine
the appropriate "end position" for each parameter's initializer. This means
that we get accurate-enough positions for the initializers in the eager
parsing step to get the same answers for hole-check-elimination that we
will later during ParseLazy.

In the included test case, for example:

  (function() { ((s = 17, y = s) => s)(); } )();
                        ^2     ^1

The old code would generate a hole check when trying to load
|s| for assignment to |y| (because it treated the closing parentheses
pointed to by "^1" as the "initialization position" of |s|).

The new code uses the comma pointed to by "^2" as the initialization
position of |s|. Since that occurs textually before the load of |s|,
full-codegen knows it can avoid the hole check.

BUG=v8:4908
LOG=n

Review URL: https://codereview.chromium.org/1900343002

Cr-Commit-Position: refs/heads/master@{#35678}
2016-04-20 20:49:16 +00:00
machenbach
921381bc13 Revert of [wasm] Also test structured stack trace (patchset #4 id:60001 of https://codereview.chromium.org/1875153002/ )
Reason for revert:
Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/6322

Original issue's description:
> [wasm] Also test structured stack trace
>
> This extends the wasm test case which only checks the "simple"
> string-variant of the stack trace.
> It checks the return values of the getFunctionName, getLineNumber,
> getFileName and toString methods.
>
> R=ahaas@chromium.org, jfb@chromium.org, titzer@chromium.org
> BUG=

TBR=ahaas@chromium.org,jfb@chromium.org,titzer@chromium.org,clemensh@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1903293002

Cr-Commit-Position: refs/heads/master@{#35670}
2016-04-20 16:25:21 +00:00
clemensh
0fd76cc29c Ignore test failure for today
Fix tomorrow.

BUG=
TBR=mstarzinger@chromium.org,machenbach@chromium.org
NOTRY=true
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1910493002

Cr-Commit-Position: refs/heads/master@{#35669}
2016-04-20 16:23:09 +00:00
clemensh
782c204c80 [wasm] Also test structured stack trace
This extends the wasm test case which only checks the "simple"
string-variant of the stack trace.
It checks the return values of the getFunctionName, getLineNumber,
getFileName and toString methods.

R=ahaas@chromium.org, jfb@chromium.org, titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1875153002

Cr-Commit-Position: refs/heads/master@{#35666}
2016-04-20 15:20:18 +00:00
clemensh
b1434ac460 [wasm] Throw real Error on wasm trap
Before, just a string was thrown, so no stack trace was attached there.
Generated code from wasm does not grow by this change, we just pass a
message id to the respective (new) runtime function.

R=mstarzinger@chromium.org, titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1874383002

Cr-Commit-Position: refs/heads/master@{#35664}
2016-04-20 14:53:28 +00:00
ahaas
965e6bdc0a [wasm] Wasm functions with int64 parameters can now be called from JS.
All wasm spec tests can now be run on ia32.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1899753004

Cr-Commit-Position: refs/heads/master@{#35663}
2016-04-20 14:45:08 +00:00
titzer
b994ad45b0 [turbofan] Length and index2 are unsigned in CheckedLoad/CheckedStore.
Also factor out test cases from test-run-machops.cc into test-run-load-store.cc

BUG=chromium:599717
LOG=Y

Review URL: https://codereview.chromium.org/1858323003

Cr-Commit-Position: refs/heads/master@{#35651}
2016-04-20 09:35:06 +00:00
vogelheim
ed9b7d92e7 Prevent un-parsed LiteralFunction reaching the compiler.
BUG=chromium:604044
LOG=Y

Review URL: https://codereview.chromium.org/1895123002

Cr-Commit-Position: refs/heads/master@{#35650}
2016-04-20 09:35:05 +00:00
ishell
28113880e3 Fix polymorphic keyed load handler selection for proxies.
BUG=chromium:603463
LOG=N

Review URL: https://codereview.chromium.org/1894203002

Cr-Commit-Position: refs/heads/master@{#35607}
2016-04-19 08:58:43 +00:00
neis
d0ccddd032 First version of the new generators implementation.
Behind --ignition-generators. Does not yet support Turbofan.

TBR=bmeurer@chromium.org
BUG=v8:4907
LOG=n

Review URL: https://codereview.chromium.org/1884183002

Cr-Commit-Position: refs/heads/master@{#35584}
2016-04-18 14:13:30 +00:00
yangguo
89d7bfda0d Correctly annotate eval origin.
There were a couple of issues with it:
- interpreter is not supported
- the source position was just accidentally correct for full-codegen
- the eval origin could have been cached

Also fixes a few other places to use AbstractCode.

R=mstarzinger@chromium.org

Committed: https://crrev.com/2f3a171adc9e620c2235bf0562145b9d4eaba66d
Cr-Commit-Position: refs/heads/master@{#35257}

Committed: https://crrev.com/ad4e8a27963b704bb70ec8bac0991c57296b1d16
Cr-Commit-Position: refs/heads/master@{#35481}

Review URL: https://codereview.chromium.org/1854713002

Cr-Commit-Position: refs/heads/master@{#35581}
2016-04-18 13:21:07 +00:00
jochen
a142dedaff Reland of Immediately cache compiled scripts. (patchset #1 id:1 of https://codereview.chromium.org/1882833006/ )
Reason for revert:
Fixed webkit_unit_tests

Original issue's description:
> Revert of Immediately cache compiled scripts. (patchset #2 id:20001 of https://codereview.chromium.org/1890083002/ )
>
> Reason for revert:
> [Sheriff] Breaks:
> https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/8769
>
> Auto-bisect points to this CL.
>
> Original issue's description:
> > Immediately cache compiled scripts.
> >
> > Usually, script compilation is expensive enough to warrant the extra
> > overhead of caching scripts immediatly.
> >
> > BUG=chromium:588900
> > R=yangguo@chromium.org
> > LOG=n
> >
> > Committed: https://crrev.com/3533c084d470912384988768c4b3b109304da357
> > Cr-Commit-Position: refs/heads/master@{#35527}
>
> TBR=yangguo@chromium.org,jochen@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:588900
>
> Committed: https://crrev.com/f8a5a4da70d0a8e6dbb1b5c633c2b6b47fe5c3f6
> Cr-Commit-Position: refs/heads/master@{#35536}

TBR=yangguo@chromium.org,machenbach@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:588900
LOG=n

Review URL: https://codereview.chromium.org/1901573002

Cr-Commit-Position: refs/heads/master@{#35566}
2016-04-18 09:01:10 +00:00
bmeurer
e96c143171 [turbofan] Optimize typeof in abstract/strict equality comparison.
Add support to optimize certain comparisons of typeof with known
strings to utilize the existing ObjectIs<Type> predicates. Also
add a new ObjectIsCallable, which is used to optimize the common
typeof x === "function" pattern.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1898653003

Cr-Commit-Position: refs/heads/master@{#35562}
2016-04-18 07:03:23 +00:00
bmeurer
662caac9d2 [turbofan] JSTypeOf, JSStrictEqual, JSStrictNotEqual and JSToBoolean are pure.
These operators are really pure on the JavaScript level, and were only
part of the effect chain to make sure we don't accidentially schedule
them right after raw allocations, which is no longer an issue since we
now have the concept of atomic regions.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1893543004

Cr-Commit-Position: refs/heads/master@{#35552}
2016-04-16 19:28:12 +00:00
nikolaos
451fa77235 Re-scope inner scopes in arrow parameter initializers
This patch correctly re-scopes inner scopes that can appear in do
expressions used as initializers to arrow parameters.

R=rossberg@chromium.org
BUG=v8:4904
LOG=N

Review URL: https://codereview.chromium.org/1887743002

Cr-Commit-Position: refs/heads/master@{#35542}
2016-04-15 18:08:31 +00:00
machenbach
f8a5a4da70 Revert of Immediately cache compiled scripts. (patchset #2 id:20001 of https://codereview.chromium.org/1890083002/ )
Reason for revert:
[Sheriff] Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/8769

Auto-bisect points to this CL.

Original issue's description:
> Immediately cache compiled scripts.
>
> Usually, script compilation is expensive enough to warrant the extra
> overhead of caching scripts immediatly.
>
> BUG=chromium:588900
> R=yangguo@chromium.org
> LOG=n
>
> Committed: https://crrev.com/3533c084d470912384988768c4b3b109304da357
> Cr-Commit-Position: refs/heads/master@{#35527}

TBR=yangguo@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:588900

Review URL: https://codereview.chromium.org/1882833006

Cr-Commit-Position: refs/heads/master@{#35536}
2016-04-15 14:21:48 +00:00
mvstanton
401450493e Security: type confusion lead to information leak in decodeURI
Quit using the global array in uri code.

R=yangguo@chromium.org
BUG=chromium:602970
LOG=N

Review URL: https://codereview.chromium.org/1889133003

Cr-Commit-Position: refs/heads/master@{#35530}
2016-04-15 13:09:45 +00:00
jochen
3533c084d4 Immediately cache compiled scripts.
Usually, script compilation is expensive enough to warrant the extra
overhead of caching scripts immediatly.

BUG=chromium:588900
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1890083002

Cr-Commit-Position: refs/heads/master@{#35527}
2016-04-15 12:53:36 +00:00
mstarzinger
5882033203 [turbofan] Mark escape analysis as experimental.
This prefixes the escape analysis flag with "experimental", thereby
making sure the flag in question is not being fuzzed. It will reduce
noise levels on ClusterFuzz again.

R=jarin@chromium.org
BUG=chromium:603653
LOG=n

Review URL: https://codereview.chromium.org/1894513002

Cr-Commit-Position: refs/heads/master@{#35521}
2016-04-15 12:19:29 +00:00
mstarzinger
62cca39e6c [compiler] Move ensuring deoptimization support to backends.
This moves the responsibility of preparing full-codegen code with
deoptimization support into the backends. This avoids generating such
code when optimization can be done directly from existing bytecode.

R=bmeurer@chromium.org
BUG=v8:4280
LOG=n

Review URL: https://codereview.chromium.org/1883403002

Cr-Commit-Position: refs/heads/master@{#35517}
2016-04-15 11:26:44 +00:00
yangguo
85e9c2095a Unskip debugger tests after GC fix.
This has been fixed by 165186f272.

R=machenbach@chromium.org
BUG=v8:4893,v8:4894
LOG=N

Review URL: https://codereview.chromium.org/1882923006

Cr-Commit-Position: refs/heads/master@{#35515}
2016-04-15 11:00:54 +00:00
yangguo
93135d8c0d [regexp] fix assertion failure when parsing close to stack overflow.
R=jkummerow@chromium.org
BUG=chromium:600257
LOG=N

Review URL: https://codereview.chromium.org/1884143002

Cr-Commit-Position: refs/heads/master@{#35496}
2016-04-14 14:44:28 +00:00
yangguo
5af0a68442 Revert of Correctly annotate eval origin. (patchset #5 id:80001 of https://codereview.chromium.org/1854713002/ )
Reason for revert:
performance impact

Original issue's description:
> Correctly annotate eval origin.
>
> There were a couple of issues with it:
> - interpreter is not supported
> - the source position was just accidentally correct for full-codegen
> - the eval origin could have been cached
>
> Also fixes a few other places to use AbstractCode.
>
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/2f3a171adc9e620c2235bf0562145b9d4eaba66d
> Cr-Commit-Position: refs/heads/master@{#35257}
>
> Committed: https://crrev.com/ad4e8a27963b704bb70ec8bac0991c57296b1d16
> Cr-Commit-Position: refs/heads/master@{#35481}

TBR=mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1888013002

Cr-Commit-Position: refs/heads/master@{#35491}
2016-04-14 12:46:00 +00:00
yangguo
ad4e8a2796 Correctly annotate eval origin.
There were a couple of issues with it:
- interpreter is not supported
- the source position was just accidentally correct for full-codegen
- the eval origin could have been cached

Also fixes a few other places to use AbstractCode.

R=mstarzinger@chromium.org

Committed: https://crrev.com/2f3a171adc9e620c2235bf0562145b9d4eaba66d
Cr-Commit-Position: refs/heads/master@{#35257}

Review URL: https://codereview.chromium.org/1854713002

Cr-Commit-Position: refs/heads/master@{#35481}
2016-04-14 10:08:15 +00:00
mythria
7effb4f736 [Interpreter] Updates mjsunit.status.
Removes skips for two tests that no longer fail on windows system.
Updates description of another failing test with more details.

BUG=v8:4280,v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1878893004

Cr-Commit-Position: refs/heads/master@{#35475}
2016-04-14 09:01:34 +00:00
aseemgarg
c09792bf37 [wasm] Enable the remaining embenchen tests for asm to wasm
BUG=v8:4203
TEST=mjsunit/asm-wasm
R=titzer@chromium.org,bradnelson@chromium.org,ahaas@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1887833002

Cr-Commit-Position: refs/heads/master@{#35458}
2016-04-14 00:35:12 +00:00
aseemgarg
1d37d4216b [wasm] optimized switch implementation in asm.js to wasm builder
This change implements switch as a balanced if/else tree or break table or
hybrid. A lot of asm.js modules are expected to extensively use switch
alongside function tables that can benefit from a better implementation.

BUG=v8:4203
TEST=mjsunit/asm-wasm
R=titzer@chromium.org,bradnelson@chromium.org,ahaas@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1838973002

Cr-Commit-Position: refs/heads/master@{#35455}
2016-04-13 21:56:42 +00:00
binji
5e9ddf6ce4 [Atomics] code stubs for atomic operations
Reland of (https://codereview.chromium.org/1617503003)

* New atomic code stubs for x64, ia32, arm, arm64
* Add convenience functions JumpIfNotValidSmiValue, JumpIfUintNotValidSmiValue
  to macro-assembler-ia32 (API based on x64 macro assembler)
* Remove runtime implementation of Atomics.load, the code stub should always be
  called instead
* Add new test to mjsunit atomics test; check that Smi values of different
  sizes are supported when possible, else fall back to HeapNumbers

These changes were needed to add another codestub:
* Bump kStubMajorKeyBits from 7 to 8
* Reduce ScriptContextFieldStub::kSlotIndexBits from 13 to 12

BUG=v8:4614
LOG=y
TBR=jarin@chromium.org,bmeurer@chromium.org,rodolph.perfetta@gmail.com,machenbach@chromium.org

Review URL: https://codereview.chromium.org/1617503003

Cr-Commit-Position: refs/heads/master@{#35427}

Review URL: https://codereview.chromium.org/1881383003

Cr-Commit-Position: refs/heads/master@{#35453}
2016-04-13 18:24:28 +00:00
machenbach
2a5cce6580 Revert of [Atomics] code stubs for atomic operations (patchset #28 id:530001 of https://codereview.chromium.org/1617503003/ )
Reason for revert:
[Sheriff] Roll was reverted. Please fix unused methods, see:
https://codereview.chromium.org/1884913002/

https://build.chromium.org/p/tryserver.chromium.win/builders/win_clang/builds/5585/steps/compile%20%28with%20patch%29/logs/stdio

Original issue's description:
> [Atomics] code stubs for atomic operations
>
> * New atomic code stubs for x64, ia32, arm, arm64
> * Add convenience functions JumpIfNotValidSmiValue, JumpIfUintNotValidSmiValue
>   to macro-assembler-ia32 (API based on x64 macro assembler)
> * Remove runtime implementation of Atomics.load, the code stub should always be
>   called instead
> * Add new test to mjsunit atomics test; check that Smi values of different
>   sizes are supported when possible, else fall back to HeapNumbers
>
> These changes were needed to add another codestub:
> * Bump kStubMajorKeyBits from 7 to 8
> * Reduce ScriptContextFieldStub::kSlotIndexBits from 13 to 12
>
> BUG=v8:4614
> LOG=y
>
> Committed: https://crrev.com/10b5febe11b318cfef130abae343183ac862e60d
> Cr-Commit-Position: refs/heads/master@{#35427}

TBR=jarin@chromium.org,bmeurer@chromium.org,rodolph.perfetta@gmail.com,binji@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review URL: https://codereview.chromium.org/1884883003

Cr-Commit-Position: refs/heads/master@{#35443}
2016-04-13 11:59:28 +00:00
binji
10b5febe11 [Atomics] code stubs for atomic operations
* New atomic code stubs for x64, ia32, arm, arm64
* Add convenience functions JumpIfNotValidSmiValue, JumpIfUintNotValidSmiValue
  to macro-assembler-ia32 (API based on x64 macro assembler)
* Remove runtime implementation of Atomics.load, the code stub should always be
  called instead
* Add new test to mjsunit atomics test; check that Smi values of different
  sizes are supported when possible, else fall back to HeapNumbers

These changes were needed to add another codestub:
* Bump kStubMajorKeyBits from 7 to 8
* Reduce ScriptContextFieldStub::kSlotIndexBits from 13 to 12

BUG=v8:4614
LOG=y

Review URL: https://codereview.chromium.org/1617503003

Cr-Commit-Position: refs/heads/master@{#35427}
2016-04-12 23:10:36 +00:00
hablich
b88d048adf Reland of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1876103002/ )
Reason for revert:
Did not fail on another roll including this CL ..

Original issue's description:
> Revert of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1869693003/ )
>
> Reason for revert:
> Blocks current roll: https://codereview.chromium.org/1876713002/ according to bisect: https://codereview.chromium.org/1872353002/#ps80001
>
> Original issue's description:
> > [compiler] Make feedback vector cope with flag changes.
> >
> > This fixes corner cases where the layout of feedback vectors baked into
> > the snapshot is different from the expected layout, depending on some
> > runtime flags. We make sure the feedback vector is regenereated for
> > functions that are not compiled. Flag changes of this kind are only
> > allowed when code is not serialized.
> >
> > An alternative solution would be to not serialize the feedback vector
> > for such cases in the first place. That solution however would have a
> > higher overhead, as it would required the serializer to be able to
> > recognize feedback vectors while generating a snapshot.
> >
> > R=mvstanton@chromium.org
> > TEST=mjsunit/regress/regress-crbug-600995
> > BUG=chromium:600995
> > LOG=n
> >
> > Committed: https://crrev.com/460bff5fb6af2bd79e610f89afdf6da9dba3cf0c
> > Cr-Commit-Position: refs/heads/master@{#35339}
>
> TBR=mvstanton@chromium.org,mstarzinger@chromium.org
>
> BUG=chromium:600995
> LOG=N
> NOTRY=true
>
> Committed: https://crrev.com/78049e9c4837f053575d6c71e53ae12fec99f1aa
> Cr-Commit-Position: refs/heads/master@{#35392}

TBR=mvstanton@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:600995

Review URL: https://codereview.chromium.org/1876973002

Cr-Commit-Position: refs/heads/master@{#35398}
2016-04-11 18:56:37 +00:00
hablich
78049e9c48 Revert of [compiler] Make feedback vector cope with flag changes. (patchset #1 id:1 of https://codereview.chromium.org/1869693003/ )
Reason for revert:
Blocks current roll: https://codereview.chromium.org/1876713002/ according to bisect: https://codereview.chromium.org/1872353002/#ps80001

Original issue's description:
> [compiler] Make feedback vector cope with flag changes.
>
> This fixes corner cases where the layout of feedback vectors baked into
> the snapshot is different from the expected layout, depending on some
> runtime flags. We make sure the feedback vector is regenereated for
> functions that are not compiled. Flag changes of this kind are only
> allowed when code is not serialized.
>
> An alternative solution would be to not serialize the feedback vector
> for such cases in the first place. That solution however would have a
> higher overhead, as it would required the serializer to be able to
> recognize feedback vectors while generating a snapshot.
>
> R=mvstanton@chromium.org
> TEST=mjsunit/regress/regress-crbug-600995
> BUG=chromium:600995
> LOG=n
>
> Committed: https://crrev.com/460bff5fb6af2bd79e610f89afdf6da9dba3cf0c
> Cr-Commit-Position: refs/heads/master@{#35339}

TBR=mvstanton@chromium.org,mstarzinger@chromium.org

BUG=chromium:600995
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1876103002

Cr-Commit-Position: refs/heads/master@{#35392}
2016-04-11 15:36:30 +00:00
ishell
26c480d13c [deoptimizer] Extend assert to also expect kTailCallerFunction as bottommost frame when accessing arguments for inlined function.
BUG=chromium:601617, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1876753002

Cr-Commit-Position: refs/heads/master@{#35385}
2016-04-11 12:20:37 +00:00
mythria
8982cb5c70 [Interpreter] Handles legacy constants in strict mode.
Function bindings are the only variables in LEGACY_CONST mode.
(https://codereview.chromium.org/1819123002/). Since these variables
can also be accessed in strict mode functions we should support
handling such variables. Assigning to a legacy constant throws
a TypeError in strict mode. Also fixes hydrogen.cc to throw a
TypeError for legacy constants.

BUG=v8:4280,chromium:599068
LOG=N
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1845223006

Cr-Commit-Position: refs/heads/master@{#35383}
2016-04-11 12:04:01 +00:00
cbruni
a6fd69ac29 [elements] Add more tests to increase coverage
BUG=

Review URL: https://codereview.chromium.org/1873833002

Cr-Commit-Position: refs/heads/master@{#35371}
2016-04-11 08:28:18 +00:00
jarin
03975befe3 [turbofan] Remove some clever-but-wrong bits from select lowering.
BUG=chromium:600593
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1870763003

Cr-Commit-Position: refs/heads/master@{#35347}
2016-04-08 08:26:13 +00:00
cbruni
ad1784e5c6 [elements] revert overzealous optimzation for fast sloppy arguments delete
BUG=chromium:601390
LOG=n

Review URL: https://codereview.chromium.org/1865343002

Cr-Commit-Position: refs/heads/master@{#35345}
2016-04-08 08:02:47 +00:00
yangguo
e39ba01420 [regexp] extend \p syntax to binary and enumerated properties.
Also make the syntax a bit less complicated and speculative.

R=littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1845243002

Cr-Commit-Position: refs/heads/master@{#35344}
2016-04-08 05:39:43 +00:00
adamk
a0a8ecd078 Remove runtime flags for sloppy mode block scoping features
These were all on by default in M49 without complaint.

R=littledan@chromium.org

Review URL: https://codereview.chromium.org/1858943002

Cr-Commit-Position: refs/heads/master@{#35342}
2016-04-08 00:30:20 +00:00
mstarzinger
460bff5fb6 [compiler] Make feedback vector cope with flag changes.
This fixes corner cases where the layout of feedback vectors baked into
the snapshot is different from the expected layout, depending on some
runtime flags. We make sure the feedback vector is regenereated for
functions that are not compiled. Flag changes of this kind are only
allowed when code is not serialized.

An alternative solution would be to not serialize the feedback vector
for such cases in the first place. That solution however would have a
higher overhead, as it would required the serializer to be able to
recognize feedback vectors while generating a snapshot.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-600995
BUG=chromium:600995
LOG=n

Review URL: https://codereview.chromium.org/1869693003

Cr-Commit-Position: refs/heads/master@{#35339}
2016-04-07 15:35:03 +00:00
mike
9acbca1845 [es6] Fix bug in pattern re-writing
As originally implemented, a SingleNameBinding within a BindingPattern
was incorrectly interpreted as an assignment if an initializer was
present and that initializer was itself an AssignmentExpresion.
For example:

    let x;
    { let [x = y = 1] = []; }
    print(x); // expected: undefined, actual: 1

Extend the heuristic that detects the "context" of a destructuring
pattern to account for AssignmentExpressions within SingleNameBindings.

BUG=v8:4891
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1859423002

Cr-Commit-Position: refs/heads/master@{#35334}
2016-04-07 13:26:54 +00:00
cbruni
9478356ed3 Fix representation issue in FastArrayPushStub
Pushing undefined onto a FAST_DOUBLE_ARRAY does not enforce the right representation checks.

BUG=chromuim:599089
LOG=n

Review URL: https://codereview.chromium.org/1868973002

Cr-Commit-Position: refs/heads/master@{#35332}
2016-04-07 12:46:08 +00:00
mvstanton
ce1fe78d7e Bugfix: assert in lithium compile for LMaybeGrowElements
BUG=chromium:585041
LOG=N

Review URL: https://codereview.chromium.org/1854423003

Cr-Commit-Position: refs/heads/master@{#35331}
2016-04-07 11:41:39 +00:00
machenbach
2e9fc9373b [test] Skip flaky test on linux.
BUG=v8:4894
NOTRY=true
LOG=n
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1868923002

Cr-Commit-Position: refs/heads/master@{#35325}
2016-04-07 08:42:44 +00:00
machenbach
ecb458440c [test] Skip flaky test on windows.
Crashes flakily with stressopt/alwaysopt.

BUG=v8:4893
LOG=n
TBR=yangguo@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1863393002

Cr-Commit-Position: refs/heads/master@{#35321}
2016-04-07 08:14:02 +00:00
jarin
3df0a8c1f2 [crankshaft] Make infinite loops preserve control flow.
We have to preserve control flow so that the liveness analysis is less
confused. This CL fixes loops to preserve teh original control flow.

BUG=chromium:599710
LOG=n

Review URL: https://codereview.chromium.org/1863123002

Cr-Commit-Position: refs/heads/master@{#35318}
2016-04-07 05:36:44 +00:00
cbruni
ca5b896fab [elements] cleaning up string wrapper elements kind and adding tests
drive-by-fix: unify template parameters

BUG=chromium:586068
LOG=n

Review URL: https://codereview.chromium.org/1857163002

Cr-Commit-Position: refs/heads/master@{#35302}
2016-04-06 13:38:34 +00:00
cbruni
604f5be5f7 [elements] add fast-path for slice with FastSloppyArguments
BUG=

Review URL: https://codereview.chromium.org/1834613003

Cr-Commit-Position: refs/heads/master@{#35300}
2016-04-06 13:30:08 +00:00
bmeurer
318d9f52fd [test] Fix windows nosnap test expectations.
Now that we pass all these tests, we need to update the test
expectations.

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1864013002

Cr-Commit-Position: refs/heads/master@{#35295}
2016-04-06 11:40:17 +00:00
bmeurer
974721c661 [generators] Decouple generator resume from fullcodegen.
Introduce a ResumeGeneratorTrampoline, which does the actual stack state
reconstruction (currently always restores a fullcodegen frame), and
introduce appropriate TurboFan builtins for %GeneratorPrototype%.next,
%GeneratorPrototype%.return and %GeneratorPrototype%.throw based on
this native builtin.

Also unify the flooding in case of step-in to always work based on
JSFunction and remove the special casing for JSGeneratorObject.

R=mstarzinger@chromium.org, neis@chromium.org
TBR=rossberg@chromium.org
BUG=chromium:513471
LOG=n

Review URL: https://codereview.chromium.org/1865833002

Cr-Commit-Position: refs/heads/master@{#35283}
2016-04-06 08:39:24 +00:00
adamk
9bfad834d3 Ship --harmony-regexp-exec
The Chrome Extensions code that was broken by this change the first time
it landed has been amended to deal appropriately with the ES2015
semantics in https://codereview.chromium.org/1864733002/.

BUG=v8:4602
LOG=y

Review URL: https://codereview.chromium.org/1857313003

Cr-Commit-Position: refs/heads/master@{#35279}
2016-04-05 22:50:42 +00:00
hablich
dc39c194d4 [Ignition] Skip timing out WASM tests
BUG=v8:4680
LOG=N
TBR=mstarzinger@chromium.org,rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1865683002

Cr-Commit-Position: refs/heads/master@{#35278}
2016-04-05 21:56:15 +00:00
caitpotter88
f60048c556 [destructuring] don't attempt to visit contents of FunctionLiterals
The parser eagerly rewrites destructuring assignments occuring
in formal parameter initializers, because not doing so would
cause the BindingPattern rewriting to be confused and do the
wrong thing.

This change prevents this rewriting from descending into the
bodies of lazily parsed functions.

In general, it's a mistake to descend into the bodies of function
literals anyways, since they are rewritten separately on their
own time, so there is no distinction made between lazily
"throw away" eagerly parsed functions in the temporary parser
arena, or "real" eagerly parsed functions that will be compiled.

BUG=chromium:594084, v8:811
LOG=N
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1864553002

Cr-Commit-Position: refs/heads/master@{#35277}
2016-04-05 18:43:17 +00:00
kozyatinskiy
725672512a [V8] Removed debugger V8::PromiseEvent
We decided to remove related devtools experiment.

BUG=chromium:526811
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1833563002

Cr-Commit-Position: refs/heads/master@{#35275}
2016-04-05 18:13:02 +00:00
titzer
77a8c2ea86 [asm.js] Fix typing bug for non-literals in heap access.
R=bradnelson@chromium.org
BUG=chromium:599825
LOG=Y

Review URL: https://codereview.chromium.org/1858263002

Cr-Commit-Position: refs/heads/master@{#35273}
2016-04-05 17:24:03 +00:00
littledan
7a38462e8b Ensure CreateDataProperty works correctly on TypedArrays
Previously, CreateDataProperty would fail a DCHECK when used to create
an integer indexed property on a TypedArray. This patch makes it throw
a TypeError instead. The issue came up when Array.prototype.concat
was repaired to use CreateDataProperty rather than SetElement; concat
can be tricked into making a new TypedArray if it is given an Array
whose prototype is a TypedArray. This patch prevents the issue.

R=adamk
LOG=Y
BUG=chromium:596394

Review URL: https://codereview.chromium.org/1821723004

Cr-Commit-Position: refs/heads/master@{#35271}
2016-04-05 16:56:12 +00:00
cbruni
823224f3ee [elements] Fix length bounds precheck for Array.prototype.concat
BUG=chromium:599414
LOG=n

Review URL: https://codereview.chromium.org/1863553003

Cr-Commit-Position: refs/heads/master@{#35269}
2016-04-05 15:35:27 +00:00
ssanfilippo
9e39a9fff1 Remove snapshot log parsing and option from tools.
LOG=N

Review URL: https://codereview.chromium.org/1796863002

Cr-Commit-Position: refs/heads/master@{#35268}
2016-04-05 15:31:32 +00:00
machenbach
cf951dfb37 Revert of Correctly annotate eval origin. (patchset #4 id:60001 of https://codereview.chromium.org/1854713002/ )
Reason for revert:
[Sheriff] Crashes a layout test:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/5855

Original issue's description:
> Correctly annotate eval origin.
>
> There were a couple of issues with it:
> - interpreter is not supported
> - the source position was just accidentally correct for full-codegen
> - the eval origin could have been cached
>
> Also fixes a few other places to use AbstractCode.
>
> R=mstarzinger@chromium.org
>
> Committed: https://crrev.com/2f3a171adc9e620c2235bf0562145b9d4eaba66d
> Cr-Commit-Position: refs/heads/master@{#35257}

TBR=mstarzinger@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1858773004

Cr-Commit-Position: refs/heads/master@{#35260}
2016-04-05 13:01:17 +00:00
jarin
4142bc6bc1 [turbofan] Restrict types in load elimination.
In simplified numbering, we make sanity checks based on types (e.g.,
NumberSubtract should take numbers as inputs), but this can be
violated if optimization passes make types less precise.

In this CL, we fix load elimination to make sure that types are
smaller in the store -> load elimination by taking an intersection
of the load's type with the store value's type and inserting a guard
with that type. Note that the load type comes from type feedback, so
it can be disjoint from the stored value type (in that case, this
must be dead code because the map chack for the load should prevent
us from using the stored value).

BUG=chromium:599412
LOG=n

Review URL: https://codereview.chromium.org/1857133003

Cr-Commit-Position: refs/heads/master@{#35259}
2016-04-05 12:30:14 +00:00
yangguo
2e191cee8a [debugger] ScopeIterator should unwrap debug-evaluate contexts.
If we use ScopeIterator inside a debug-evaluate call, we may iterate
over a debug-evaluate context that we created for the debug-evaluate
call. This may trigger assertions.

The solution is to have the ScopeIterator hide debug-evaluate contexts
by unwrapping it if it comes across any.

R=cbruni@chromium.org
BUG=chromium:599662
LOG=N

Review URL: https://codereview.chromium.org/1859033002

Cr-Commit-Position: refs/heads/master@{#35258}
2016-04-05 12:08:19 +00:00
yangguo
2f3a171adc Correctly annotate eval origin.
There were a couple of issues with it:
- interpreter is not supported
- the source position was just accidentally correct for full-codegen
- the eval origin could have been cached

Also fixes a few other places to use AbstractCode.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1854713002

Cr-Commit-Position: refs/heads/master@{#35257}
2016-04-05 11:31:44 +00:00
cbruni
47e0a39246 Setting Symbol.length to 0 according to the spec
BUG=v8:4882
LOG=n

Review URL: https://codereview.chromium.org/1863543002

Cr-Commit-Position: refs/heads/master@{#35255}
2016-04-05 10:57:47 +00:00
ishell
792bf2a093 [crankshaft] Fix environment handling after leaving inlined tail call.
BUG=chromium:537444, v8:4698
LOG=N
TBR=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1859763005

Cr-Commit-Position: refs/heads/master@{#35253}
2016-04-05 09:43:56 +00:00
yangguo
1354b1bf37 [interpreter] statement position always overwrites earlier positions.
If a statement or expression does not produce any bytecode, it's position
should always be overwritten by a following statement position.

R=mstarzinger@chromium.org, vogelheim@chromium.org
BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1854113002

Cr-Commit-Position: refs/heads/master@{#35252}
2016-04-05 09:14:19 +00:00
neis
4edf16ddd9 Fix treatment of rest pattern in array destructuring.
When seeing a rest pattern, we used to get the remaining elements from the
iterator by calling %concat_iterable_to_array on it.  This was wrong because it
caused an observable [[Get]] for @@iterator (which the iterator may not even
provide).

This CL gets rid of the call to %concat_iterable_to_array and does the iteration
manually in a simple while-loop.  It also gets rid of %concat_iterable_to_array
itself because there aren't any other uses of it.

BUG=v8:4759
LOG=n
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1852703002

Cr-Commit-Position: refs/heads/master@{#35251}
2016-04-05 08:56:51 +00:00
bmeurer
e5724d958b [frames] Also properly deal with TF builtins in OptimizedFrame::GetFunctions().
This was missing from the previous fix.

R=ishell@chromium.org
BUG=chromium:599714
LOG=n

Review URL: https://codereview.chromium.org/1861583002

Cr-Commit-Position: refs/heads/master@{#35249}
2016-04-05 06:41:20 +00:00
hablich
ba18967453 Revert of [Ignition] Skip failing tests (patchset #1 id:1 of https://codereview.chromium.org/1852263002/ )
Reason for revert:
Already fixed

Original issue's description:
> [Ignition] Skip failing tests
>
> BUG=v8:4680
> LOG=N
> TBR=machenbach@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
>
> Committed: https://crrev.com/2b46892be60b025dcba7513be749f504046055ef
> Cr-Commit-Position: refs/heads/master@{#35241}

TBR=machenbach@chromium.org,mstarzinger@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4680

Review URL: https://codereview.chromium.org/1854143002

Cr-Commit-Position: refs/heads/master@{#35242}
2016-04-04 16:06:19 +00:00
hablich
2b46892be6 [Ignition] Skip failing tests
BUG=v8:4680
LOG=N
TBR=machenbach@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1852263002

Cr-Commit-Position: refs/heads/master@{#35241}
2016-04-04 16:02:30 +00:00
mstarzinger
54e336885b [interpreter] Skip failing generator regression test.
TBR=rmcilroy@chromium.org,machenbach@chromium.org
TEST=mjsunit/regress/regress-crbug-513471
BUG=chromium:513471
LOG=n

Review URL: https://codereview.chromium.org/1859523003

Cr-Commit-Position: refs/heads/master@{#35240}
2016-04-04 14:47:40 +00:00
yangguo
f7e7ba1125 [interpreter] add some expression positions.
Statement positions should overwrite expression positions if they
have the same bytecode offset.

R=mstarzinger@chromium.org, vogelheim@chromium.org
BUG=v8:4680,v8:4689
LOG=N

Review URL: https://codereview.chromium.org/1855913002

Cr-Commit-Position: refs/heads/master@{#35236}
2016-04-04 12:37:48 +00:00
mstarzinger
6ab9c1850f Fix resuming generator marked for optimization.
This fixes a corner case where the generator function of a suspended
generator has been marked for optimization. We assume the optimization
approach will cause a bailout because generators are not optimized. But
resuming is more resilient by always activating the unoptimized code.

R=neis@chromium.org,bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-513471
BUG=chromium:513471
LOG=n

Review URL: https://codereview.chromium.org/1856683002

Cr-Commit-Position: refs/heads/master@{#35234}
2016-04-04 11:52:09 +00:00
ishell
4598356f17 Properly complete in-object slack tracking.
BUG=chromium:599003
LOG=N

Review URL: https://codereview.chromium.org/1856653002

Cr-Commit-Position: refs/heads/master@{#35232}
2016-04-04 10:00:44 +00:00
ishell
c7ff5766cf Display a meaningfull error message when trying to capture a stack trace to a proxy.
... instead of RUNTIME_ASSERT pointing to V8 guts.

BUG=chromium:599067
LOG=N

Review URL: https://codereview.chromium.org/1844223004

Cr-Commit-Position: refs/heads/master@{#35227}
2016-04-04 08:37:30 +00:00
littledan
277f5bd0a3 Further ES2015 RegExp spec compliance fixes
- RegExp.prototype.toString() doesn't have any special handling of
  RegExp instances and simply calls the source and flags getters
- Use the original values of global and sticky, rather than based
  on the current flag getters, as specified in
  https://github.com/tc39/ecma262/pull/494

R=yangguo@chromium.org,adamk
LOG=Y
BUG=v8:4602

Review URL: https://codereview.chromium.org/1846303002

Cr-Commit-Position: refs/heads/master@{#35225}
2016-04-04 07:06:18 +00:00
bmeurer
eaa92feb9a [builtins] Migrate Math.clz32 to a TurboFan builtin.
This allows us to remove the troublesome %_MathClz32 intrinsic and also
allows us to utilize the functionality that is already available in
TurboFan. Also introduce a proper NumberClz32 operator so we don't need
to introduce a machine operator at the JS level.

R=epertoso@chromium.org

Review URL: https://codereview.chromium.org/1852553003

Cr-Commit-Position: refs/heads/master@{#35208}
2016-04-01 14:36:32 +00:00
mythria
8a9ada4863 [Interpreter] Handles BytecodeArrays when scanning objects in heap.
Handles bytecodeArray Objects when verifying the heap and also when
collecting code statistics. The changes include:
1. BytecodeArrays could be a part of the large object space. When
verifying the large object space we should also allow BytecodeArray
objects.
2. Adds support for BytecodeArrays when collecting code statistics.

BUG=v8:4280,chromium:599001
LOG=N

Review URL: https://codereview.chromium.org/1850443006

Cr-Commit-Position: refs/heads/master@{#35202}
2016-04-01 13:14:33 +00:00
hablich
701911f9a0 Revert of Ship --harmony-regexp-exec (patchset #3 id:40001 of https://codereview.chromium.org/1847103002/ )
Reason for revert:
breaks some chromium browser_tests: https://codereview.chromium.org/1848233002/

Original issue's description:
> Ship --harmony-regexp-exec
>
> There are still spec compliance fixes to be made, but this patch
> turns the flag to shipping to make sure we get more canary coverage
> and performance data from the bots.
>
> BUG=v8:4602
> LOG=y
>
> Committed: https://crrev.com/84492bb66b340f4e0df36758e98fddbb10b5d1dc
> Cr-Commit-Position: refs/heads/master@{#35181}

TBR=littledan@chromium.org,adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4602

Review URL: https://codereview.chromium.org/1852673003

Cr-Commit-Position: refs/heads/master@{#35198}
2016-04-01 10:48:20 +00:00
yangguo
3a2174c89e [debugger] add test case for stepping out from tail calls.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1839043002

Cr-Commit-Position: refs/heads/master@{#35193}
2016-04-01 09:42:43 +00:00
ishell
ecb8fcfcca [crankshaft] [turbofan] Fix environment handling when generating a tail call from inlined function.
This CL ensures that we build environments/frame states so that tail caller frame will never become topmost.

BUG=chromium:598998, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1849503002

Cr-Commit-Position: refs/heads/master@{#35188}
2016-04-01 07:22:47 +00:00
bmeurer
6df9a22c3f [ic] Use the CallFunction builtin to invoke accessors.
The HandlerCompiler did not properly handle the weird edge case when a
sloppy mode function was installed as an accessor on one of the value
wrapper prototypes and then accessed via a load from a primitive value.
In this case we just passed the primitive value untouched instead of
properly wrapping it first. The CallFunction builtin properly deals with
all the funny edge cases, so we use it instead of duplicating almost all
of the logic here (the performance difference is neglible).

R=verwaest@chromium.org
BUG=chromium:599073, v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1845243005

Cr-Commit-Position: refs/heads/master@{#35187}
2016-04-01 06:37:57 +00:00
adamk
84492bb66b Ship --harmony-regexp-exec
There are still spec compliance fixes to be made, but this patch
turns the flag to shipping to make sure we get more canary coverage
and performance data from the bots.

BUG=v8:4602
LOG=y

Review URL: https://codereview.chromium.org/1847103002

Cr-Commit-Position: refs/heads/master@{#35181}
2016-04-01 00:39:25 +00:00
littledan
31e806ebd1 Revert of Remove RegExp.prototype.source getter compat workaround (patchset #2 id:20001 of https://codereview.chromium.org/1837843002/ )
Reason for revert:
TC39 decided that this compatibility fix should be standardized.

Original issue's description:
> Remove RegExp.prototype.source getter compat workaround
>
> The getter RegExp.prototype.source is specified in ES2015 to throw when
> called on a non-RegExp instance, such as RegExp.prototype. We had previously
> put in a compatibility workaround for all RegExp getters to make them
> throw on access specifically with RegExp.prototype as the receiver; however,
> we only have evidence that this is needed for properties other than source.
> This patch removes the compatibility workaround for get RegExp.prototype.source
> and gives it semantics precisely as per the ES2015 specification.
>
> R=adamk
> BUG=chromium:581577,v8:4827
> LOG=Y
>
> Committed: https://crrev.com/80803aa89e31839b8f73959776fa7e1923c6b461
> Cr-Commit-Position: refs/heads/master@{#35086}

R=adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:581577,v8:4827
LOG=Y

Review URL: https://codereview.chromium.org/1847783003

Cr-Commit-Position: refs/heads/master@{#35180}
2016-04-01 00:37:25 +00:00
mythria
e6b6e55453 [Interpreter] Changes GenerateDoubleToObject to push and pop rsi value.
In the earlier implementation of GenerateDoubleToObject the context
is loaded from the parent's frame. rsi is clobbered because it is used
to store kHoleNan constnat. It is not always safe to peek at
the parents frame. Bytecode handlers have TypedFrame and the type of
frame is stored at FP + 1. GenerateDoubleToObject expects context
to be store at that place. In the current implementation rsi is pushed
onto the stack and is popped when exiting this function.

BUG=v8:4280,chromium:597565
LOG=N

Review URL: https://codereview.chromium.org/1848473002

Cr-Commit-Position: refs/heads/master@{#35163}
2016-03-31 13:45:48 +00:00
oth
8cf73ae1e9 [interpreter] Adds test for tracing.
Fixes a stale DCHECK and a memory leak in tracing output.

LOG=N
BUG=v8:4280
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1844023003

Cr-Commit-Position: refs/heads/master@{#35161}
2016-03-31 11:58:06 +00:00
titzer
08e0ea38cd [wasm] Fix and enable more tests.
R=ahaas@chromium.org, bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1846613002

Cr-Commit-Position: refs/heads/master@{#35156}
2016-03-31 09:20:21 +00:00
mlippautz
f2a585935f Remove usages of Heap::NewSpaceStart and its external reference
Replace the uses with proper page flag lookups.

BUG=chromium:581412
LOG=N
TEST=mjsunit/allocation-site-info

Review URL: https://codereview.chromium.org/1845463003

Cr-Commit-Position: refs/heads/master@{#35153}
2016-03-31 07:55:26 +00:00
yangguo
297daf6c37 [debugger] allow debug-evaluate to change stack and context values.
R=bmeurer@chromium.org, cbruni@chromium.org, ulan@chromium.org
BUG=chromium:124206,chromium:569811
LOG=N

Review URL: https://codereview.chromium.org/1834633003

Cr-Commit-Position: refs/heads/master@{#35145}
2016-03-31 06:00:21 +00:00
titzer
d167c3743d [wasm] Mask shift counts on architectures that don't implicitly mask.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1845443003

Cr-Commit-Position: refs/heads/master@{#35136}
2016-03-30 12:40:22 +00:00
bmeurer
8d20f2fe37 [builtins] Make Math.ceil, Math.trunc and Math.round optimizable.
Migrate Math.ceil, Math.round and Math.trunc to TurboFan code stubs,
similar to what we did with Math.floor, and make these builtins properly
optimizable in TurboFan via appropriate simplified operators NumberCeil,
NumberRound and NumberTrunc, which are intended to be reusable for
ToInteger and ToLength optimizations that will be done in a followup CL.

Also allows us to kill the funky %RoundNumber runtime function, which
was quite heavy.

Improve test coverage for Math.ceil and Math.trunc a lot, especially
making sure that we also properly trigger the TurboFan builtin reducer
case.

R=jarin@chromium.org
BUG=v8:4059
LOG=n

Review URL: https://codereview.chromium.org/1841993002

Cr-Commit-Position: refs/heads/master@{#35135}
2016-03-30 11:57:20 +00:00
titzer
257bdfe543 [wasm] Fix asm.js semantics for divide by zero in WASM translation.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1839333002

Cr-Commit-Position: refs/heads/master@{#35134}
2016-03-30 11:37:44 +00:00
hablich
2bb46c3cb9 [Interpreter][WASM] Skip timing out tests
Reference build:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/7641

BUG=v8:4680
LOG=N
TBR=titzer@chromium.org,rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1841963002

Cr-Commit-Position: refs/heads/master@{#35128}
2016-03-30 08:59:24 +00:00
mythria
b82720df34 [Interpreter] Adds support to fetch return value on break at return.
Debugger fetches the return value of a function when we break at return.
Interpreter holds the return value in accumulator. This is not stored in a
specified location on stack and hence it is not possible to look it up from
stack similar to full-codegen or optimized frames. This cl adds support to
store the value of accumulator on debug breaks. The value of accumulator is
passed to the runtime function and is then stored in thread local data.

Also changes full-codegen implementation to match that of ignition.
The return value from full-codegen is also stored in thread local data.
The return value is fetched directly thread local data instead of
finding it by iterating over frames.

BUG=v8:4280, v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1842683002

Cr-Commit-Position: refs/heads/master@{#35127}
2016-03-30 08:52:03 +00:00
yangguo
b25131a451 [debugger] add test case for stepping into tail calls.
R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1837173002

Cr-Commit-Position: refs/heads/master@{#35124}
2016-03-30 05:31:10 +00:00
neis
7ed2d00bc3 [runtime] Don't call GetArrayKeys on proxies.
This fixes another bug in Array.prototype.sort (when the array is not a
JSArray and there is a proxy on the prototype chain).

R=cbruni@chromium.org
BUG=chromium:596866
LOG=n

Review URL: https://codereview.chromium.org/1842563004

Cr-Commit-Position: refs/heads/master@{#35101}
2016-03-29 12:36:04 +00:00
titzer
c9f59780f7 [wasm] Fix arm64 frame alignment.
In JavaScript code and stubs, JSSP mirrors the CSP but may be unaligned.
    But in WASM code only CSP is used, like native code, and it must be
    aligned.
    Calls into WASM from JS need to carefully align the C stack
    pointer (csp) and restore the previous JSSP, while calls from WASM
    to JS need to compute a new JSSP and restore their CSP after the
    call.

R=ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1811283003

Cr-Commit-Position: refs/heads/master@{#35096}
2016-03-29 11:42:48 +00:00
bmeurer
978ad03b92 [crankshaft] Address the deoptimization loops of Math.floor, Math.round and Math.ceil.
Fix and re-enable the flexible representation for Math.floor (which is used to
implement Math.ceil) and Math.round, which allows Math.floor and Math.round to
return double results instead of int32, and therefore allows values outside
the int32 range, especially -0 is now a valid result, which doesn't deopt.

Also port this feature to x64 and ia32 when the CPU supports the SSE4.1
extension.

This addresses all the known deoptimization loops related to Math.round
in the Kraken benchmark suite, and seems to also address most of the
deoptimization loops related to Math.floor in the Oort Online benchmark.

Drive-by-fix: Import the regression tests for the broken HMathFloorOfDiv
optimization that caused the initial revert of the feature (for arm64 only
back then).

BUG=chromium:476477,v8:2890,v8:4059
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1841513003

Cr-Commit-Position: refs/heads/master@{#35094}
2016-03-29 10:24:54 +00:00
littledan
80803aa89e Remove RegExp.prototype.source getter compat workaround
The getter RegExp.prototype.source is specified in ES2015 to throw when
called on a non-RegExp instance, such as RegExp.prototype. We had previously
put in a compatibility workaround for all RegExp getters to make them
throw on access specifically with RegExp.prototype as the receiver; however,
we only have evidence that this is needed for properties other than source.
This patch removes the compatibility workaround for get RegExp.prototype.source
and gives it semantics precisely as per the ES2015 specification.

R=adamk
BUG=chromium:581577,v8:4827
LOG=Y

Review URL: https://codereview.chromium.org/1837843002

Cr-Commit-Position: refs/heads/master@{#35086}
2016-03-28 20:43:02 +00:00
adamk
0fdf32556c String.prototype.{match,search} should do only one RegExp brand check
Previously, they would check for Symbol.match/Symbol.search, and then
do another check for Symbol.match in the RegExp constructor. This patch
avoids the second one by skipping the RegExp constructor, as the spec does.

Review URL: https://codereview.chromium.org/1840723002

Cr-Commit-Position: refs/heads/master@{#35085}
2016-03-28 18:53:39 +00:00
caitpotter88
f5b85cb74c [esnext] handle elements in FastObjectValuesOrEntries()
Add support for optimizing objects with elements, which do not invoke JS and
cannot change the shape of the Object.

BUG=v8:4663
LOG=N

Review URL: https://codereview.chromium.org/1767113004

Cr-Commit-Position: refs/heads/master@{#35081}
2016-03-28 15:54:23 +00:00
machenbach
62b9f3ce46 [Ignition] Skip failing tests on windows.
BUG=v8:4680
LOG=n
NOTRY=true
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1836763002

Cr-Commit-Position: refs/heads/master@{#35079}
2016-03-26 12:47:52 +00:00
machenbach
da0e49db30 [test] Skip slow tests for deopt fuzzer.
TBR=ishell@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1834083002

Cr-Commit-Position: refs/heads/master@{#35078}
2016-03-26 12:45:44 +00:00
adamk
06403470e3 Remove --harmony-regexps flag
It's been on since M49. Also moved tests from harmony -> es6,
one of which was merged with another test of the same name.

While moving stuff over to regexp.js, I also noticed that there
were unused calls to %FunctionSetName and %SetNativeFlag (those
calls are already handled by InstallGetter()).

Review URL: https://codereview.chromium.org/1838563003

Cr-Commit-Position: refs/heads/master@{#35076}
2016-03-25 23:02:11 +00:00
binji
88724ec4cb [Atomics] Fix atomic access index validation
BUG=v8:4737
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1676613002

Cr-Commit-Position: refs/heads/master@{#35074}
2016-03-25 21:52:52 +00:00
littledan
97fce6214e Check for proper types from error handling code
A bug in error printing meant that we failed to do proper type checks
before calling into C++ code, which could lead to RUNTIME_ASSERT
failures if methods are called on alternative receivers. This patch
adds the right type checks.

BUG=chromium:596718
LOG=Y
R=adamk

Review URL: https://codereview.chromium.org/1831053003

Cr-Commit-Position: refs/heads/master@{#35069}
2016-03-25 02:10:02 +00:00
littledan
92a571e546 Add ES2015 RegExp full subclassing semantics behind a flag
This patch implements ES2015 RegExp subclassing semantics, namely the
hardest part where RegExp.prototype.exec and certain flag getters can
be overridden in order to provide different behavior. This change is
hidden behind a new flag, --harmony-regexp-exec. The flag guards the
behavior by installing entirely different implementations of the
methods which follow the new semantics.

Preliminary performance tests show a 3-4x regression in the Octane
RegExp benchmark. The new code doesn't call out into several fast
paths that the old code supported, so this is expected.

The patch is tested mostly by test262, where most RegExp tests are fixed,
with the exception of deliberate spec violations for web compatibility,
and for the 'sticky' flag, which is not dynamically read by this patch
in all cases but rather statically compiled into the RegExp. The latter
will require a follow-on patch to implement. A small additional set of
tests verifies one particular case, mostly to check whether the flag
mechanism works.

R=adamk,yangguo@chromium.org
LOG=Y
BUG=v8:4602

Review URL: https://codereview.chromium.org/1596483005

Cr-Commit-Position: refs/heads/master@{#35068}
2016-03-24 22:27:21 +00:00
titzer
5134242378 [wasm] Enable more ASM->WASM tests.
R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1830703003

Cr-Commit-Position: refs/heads/master@{#35067}
2016-03-24 19:03:21 +00:00
rmcilroy
838cea4e4e [Interpreter] Make ignition compiler eagerly.
Makes --ignition cause eager compilation if we aren't building the startup
snapshot.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1811553003

Cr-Commit-Position: refs/heads/master@{#35066}
2016-03-24 18:38:24 +00:00
machenbach
25d2b24771 Revert of [Interpreter] Adds support to fetch return value on break at return. (patchset #9 id:160001 of https://codereview.chromium.org/1818873003/ )
Reason for revert:
[Sheriff] Seems to break nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/6019

Original issue's description:
> [Interpreter] Adds support to fetch return value on break at return.
>
> Debugger fetches the return value of a function when we break at return.
> Interpreter holds the return value in accumulator. This is not stored in a
> specified location on stack and hence it is not possible to look it up from
> stack similar to full-codegen or optimized frames. This cl adds support to
> store the value of accumulator on debug breaks. The value of accumulator is
> passed to the runtime function and is then stored in thread local data.
>
> Also changes full-codegen implementation to match that of ignition.
> The return value from full-codegen is also stored in thread local data.
> The return value is fetched directly thread local data instead of
> finding it by iterating over frames.
>
> BUG=v8:4280, v8:4690
> LOG=N
>
> Committed: https://crrev.com/fb65527b75754bcf3b173f16f5d0b04a1c6d9b99
> Cr-Commit-Position: refs/heads/master@{#35060}

TBR=rmcilroy@chromium.org,yangguo@chromium.org,weiliang.lin@intel.com,balazs.kilvady@imgtec.com,jyan@ca.ibm.com,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280, v8:4690

Review URL: https://codereview.chromium.org/1834733002

Cr-Commit-Position: refs/heads/master@{#35065}
2016-03-24 18:18:29 +00:00
bradnelson
2e87c7f5ae Add a test of depot across an asm.js -> wasm module.
This previously tickled the failure fixed in this issue:
https://crrev.com/6a806a558158cbab55ad9a1a456942a7c509c810

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=asm-wasm-deopt
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1766153002

Cr-Commit-Position: refs/heads/master@{#35064}
2016-03-24 17:28:26 +00:00
bradnelson
376ffacc64 Enable zlib wasm embenchen test.
gc-stress failure believed to have been fixed in:
https://crrev.com/6a806a558158cbab55ad9a1a456942a7c509c810

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/wasm/embenchen
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1827813006

Cr-Commit-Position: refs/heads/master@{#35063}
2016-03-24 17:20:57 +00:00
caitpotter88
1a272ba23e [esnext] implement String padding proposal
Spec http://tc39.github.io/proposal-string-pad-start-end/

BUG=
LOG=Y
R=adamk@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1700003002

Cr-Commit-Position: refs/heads/master@{#35061}
2016-03-24 17:15:09 +00:00
mythria
fb65527b75 [Interpreter] Adds support to fetch return value on break at return.
Debugger fetches the return value of a function when we break at return.
Interpreter holds the return value in accumulator. This is not stored in a
specified location on stack and hence it is not possible to look it up from
stack similar to full-codegen or optimized frames. This cl adds support to
store the value of accumulator on debug breaks. The value of accumulator is
passed to the runtime function and is then stored in thread local data.

Also changes full-codegen implementation to match that of ignition.
The return value from full-codegen is also stored in thread local data.
The return value is fetched directly thread local data instead of
finding it by iterating over frames.

BUG=v8:4280, v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1818873003

Cr-Commit-Position: refs/heads/master@{#35060}
2016-03-24 17:15:08 +00:00
titzer
6a806a5581 [wasm] Fix formal parameter count and parameter indexes in JS->wasm wrappers.
R=jarin@chromium.org,bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1828223002

Cr-Commit-Position: refs/heads/master@{#35056}
2016-03-24 13:24:20 +00:00
bradnelson
b224651b73 Fixing invalid asm.js in asm-wasm-literals.js
This was previously undetected due to a now fixed typing bug.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1823333005

Cr-Commit-Position: refs/heads/master@{#35048}
2016-03-24 00:00:39 +00:00
bradnelson
e4616fb981 Disable asm-wasm-literals test for some arches.
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
TBR=titzer@chromium.org
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1832623003

Cr-Commit-Position: refs/heads/master@{#35047}
2016-03-23 23:45:02 +00:00
bradnelson
942ed11488 Properly handle unsigned literals, fix typing issue with unary +.
Properly convert unsigned literals.
Forbid using unary + on a kAsmInt.
Forbid multiplies other than * 1.0 as being equivalent to unary +.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,aseemgarg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1832603002

Cr-Commit-Position: refs/heads/master@{#35046}
2016-03-23 23:21:21 +00:00
titzer
3e0b6daf54 [wasm] Add more extensive tests for asm->wasm translation.
R=bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1825333004

Cr-Commit-Position: refs/heads/master@{#35045}
2016-03-23 23:19:22 +00:00
bradnelson
c728dad8b8 Enable embenchen/copy for wasm.
This got fixed by this change:
    https://crrev.com/32a2ab0c724673961aa145ab63c79a29e6d28fa8

Adding a smaller mjsunit test capturing the issue (was with idiv register allocation).

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=593283
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N
TEST=asm-wasm-copy

Review URL: https://codereview.chromium.org/1820163002

Cr-Commit-Position: refs/heads/master@{#35041}
2016-03-23 17:50:05 +00:00
neis
7e3772713f Reenable and adapt long forgotten proxy test.
R=rossberg
BUG=

Review URL: https://codereview.chromium.org/1823973002

Cr-Commit-Position: refs/heads/master@{#35020}
2016-03-23 09:14:58 +00:00
cbruni
2efc138131 [proxies] use [[GetPrototypeOf]] trap in for-in key accumulation
With the recent spec change removing the [[Enumerate]] internal method, we now
have to walk the complete prototype chain. This implies that we call the
[[GetPrototypeOf]] trap on proxies.

As a secondary change we now trigger the [[GetOwnProperty]] trap for the for-in
filter step to see whether the properties are still enumerable. Before we did this
in the key-accumulation phase. This way we slightly reduce the number of traps
invoked. Whilst this is not ideal, it comes closer to the Spec's example
implementation.

BUG=v8:1543, v8:4768
LOG=n

Review URL: https://codereview.chromium.org/1748923003

Cr-Commit-Position: refs/heads/master@{#35017}
2016-03-23 08:36:59 +00:00
adamk
ed18aa65ea Remove support for legacy const, part 1
Now that ES2015 const has shipped, in Chrome 49, legacy const declarations
are no more. This lets us remove a bunch of code from many parts of the
codebase.

In this patch, I remove parser support for generating legacy const variables
from const declarations. This also removes the special "illegal declaration"
bit from Scope, which has ripples into all compiler backends.

Also gone are any tests which relied on legacy const declarations.

Note that we do still generate a Variable in mode CONST_LEGACY in one case:
function name bindings in sloppy mode. The likely fix there is to add a new
Variable::Kind for this case and handle it appropriately for stores in each
backend, but I leave that for a later patch to make this one completely
subtractive.

Review URL: https://codereview.chromium.org/1819123002

Cr-Commit-Position: refs/heads/master@{#35002}
2016-03-22 17:52:13 +00:00
oth
9383d14b9f [interpreter] Disable mjsunit/ignition/elided-instruction
BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1821183002

Cr-Commit-Position: refs/heads/master@{#34991}
2016-03-22 14:40:45 +00:00
bmeurer
43fe7d6854 [builtins] Add support for JS builtins written in TurboFan.
This CL adds support for builtins with JavaScript linkage written using
the TurboFan CodeStubAssembler, but with a JSCall descriptor (which was
already supported thanks to a previous patch by Ben Smith). As a first
example, we convert the Math.sqrt builtin and thereby get rid of the
%_MathSqrt intrinsic, which causes trouble for the representation
selection pass in the JavaScript pipeline.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1824993002

Cr-Commit-Position: refs/heads/master@{#34989}
2016-03-22 13:25:54 +00:00
mythria
27338320f4 [Interpreter] Fixes CopyBytecodeArray to copy interrupt_budget field.
Fixes CopyBytecodeArray to set the interrupt_budget field.

BUG=v8:4280,v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1809123003

Cr-Commit-Position: refs/heads/master@{#34982}
2016-03-22 11:05:21 +00:00
bradnelson
cca5c3f630 Fix conversion to float32, typing issue, split apart asm-wasm tests.
Add missing conversions from other types to f32 in fround.
Restrict fround() to only float, double, signed, unsigned (no unions / intish).
Restrict Bitwise operations to intish, particularly |0, when not applied to a foreign function.

Adding more exhaustive tests of stdlib Math, move to a separate file.
Adding tests of interesting values for the stdlib asm.js functions.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=test-asm-validator,asm-wasm
R=titzer@chromium.org,rossberg@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1804243003

Cr-Commit-Position: refs/heads/master@{#34967}
2016-03-21 20:34:40 +00:00
adamk
249bf75e0c Remove runtime flags for Proxy and Reflect
Both of them shipped in Chrome 49 without incident.

Also move relevant tests from harmony/ to es6/.

Review URL: https://codereview.chromium.org/1815773002

Cr-Commit-Position: refs/heads/master@{#34964}
2016-03-21 19:40:02 +00:00
ishell
e6dca379b6 [crankshaft] Check if the function is callable before generating a tail call via Call builtin.
This is necessary to ensure that "Called non callable" exception will get a proper message and stack trace even for calls at tail position.

BUG=chromium:595615, v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818003002

Cr-Commit-Position: refs/heads/master@{#34962}
2016-03-21 19:24:28 +00:00
yangguo
5dedb164eb [regexp] require exact match for unicode property names.
R=littledan@chromium.org
BUG=v8:4810
LOG=N

Review URL: https://codereview.chromium.org/1824613002

Cr-Commit-Position: refs/heads/master@{#34961}
2016-03-21 19:22:24 +00:00
ishell
35a14c75e3 Disable ES6 tail call elimination for native functions.
We don't want them to disappear from the stack traces.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1818063002

Cr-Commit-Position: refs/heads/master@{#34957}
2016-03-21 17:44:57 +00:00
oth
48d082af38 [interpreter] Add support for scalable operands.
This change introduces wide prefix bytecodes to support wide (16-bit)
and extra-wide (32-bit) operands. It retires the previous
wide-bytecodes and reduces the number of operand types.

Operands are now either scalable or fixed size. Scalable operands
increase in width when a bytecode is prefixed with wide or extra-wide.

The bytecode handler table is extended to 256*3 entries. The
first 256 entries are used for bytecodes with 8-bit operands,
the second 256 entries are used for bytecodes with operands that
scale to 16-bits, and the third group of 256 entries are used for
bytecodes with operands that scale to 32-bits.

LOG=N
BUG=v8:4747,v8:4280

Review URL: https://codereview.chromium.org/1783483002

Cr-Commit-Position: refs/heads/master@{#34955}
2016-03-21 17:09:49 +00:00
mstarzinger
02a015b1c1 [es6] Rebaseline tests of 'instanceof' error messages.
This rebaselines all our internal tests for error messages thrown by the
implementation of 'instanceof' to the new ES6 semantics. It also applies
a minor rephrasing to the messages in question.

R=rossberg@chromium.org
BUG=v8:4447
LOG=n

Review URL: https://codereview.chromium.org/1822663002

Cr-Commit-Position: refs/heads/master@{#34940}
2016-03-21 14:01:50 +00:00
ishell
1c34e5f822 Run some slow tail call tests only for fast configurations.
NOTRY=true

Review URL: https://codereview.chromium.org/1822683002

Cr-Commit-Position: refs/heads/master@{#34935}
2016-03-21 13:06:03 +00:00
ishell
ac83355748 [interpreter] Disable some slow tail call tests.
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1817993002

Cr-Commit-Position: refs/heads/master@{#34929}
2016-03-21 11:20:14 +00:00
ishell
acbb968ded [crankshaft] Fixing ES6 tail call elimination.
In case when F inlined normal call to G which tail calls H we should not write translation for G for the tail call site.
Otherwise we will see G in a stack trace inside H.

This CL also enables all existing tests related to ES6 tail call elimination and adds more combinations.

TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N

Committed: https://crrev.com/689980f7d4dfd4c29492f616d7b616b86ec9af91
Cr-Commit-Position: refs/heads/master@{#34830}

Review URL: https://codereview.chromium.org/1780043004

Cr-Commit-Position: refs/heads/master@{#34920}
2016-03-21 08:48:37 +00:00
bmeurer
cc04776632 [json] Allow any callable object for toJSON.
Previously only JSFunctions seemed to be valid for toJSON, which doesn't
match the ES6 specification that allows any object with [[Call]]
internal method (i.e. any Callable in V8 terminology), including bound
functions and proxies.

BUG=chromium:595738, chromium:535408
R=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1824533002

Cr-Commit-Position: refs/heads/master@{#34913}
2016-03-20 19:35:28 +00:00
adamk
6a8de15322 Several mjsunit cleanups
- Move default parameters tests from harmony/ to es6/ and remove
    non-existent --harmony-default-parameters flag.
  - Remove some non-existent tests from mjsunit.status

Review URL: https://codereview.chromium.org/1812313002

Cr-Commit-Position: refs/heads/master@{#34908}
2016-03-18 23:20:44 +00:00
littledan
0d2e28cb24 Revert of Restore per-TypedArray-class length accessors as a perf workaround (patchset #2 id:20001 of https://codereview.chromium.org/1624383003/ )
Reason for revert:
This patch actually seemed to cause a further GameBoy regression! Reverting it seems to address the regression.

Original issue's description:
> Restore per-TypedArray-class length accessors as a perf workaround
>
> This patch is a workaround to the performance regression caused by
> implementing the ES2015 TypedArray prototype chain: Include a
> per-TypedArray-subclass length getter so that the superclass getter does
> not become polymorphic. The patch appears to fix a regression in the
> Gameboy Octane benchmark.
>
> BUG=chromium:579905
> R=adamk
> LOG=Y
>
> Committed: https://crrev.com/03ce7711e474a0ef74f723b30ae1527c89dec010
> Cr-Commit-Position: refs/heads/master@{#33501}

R=adamk@chromium.org
BUG=chromium:579905,chromium:593634
LOG=Y

Review URL: https://codereview.chromium.org/1812143004

Cr-Commit-Position: refs/heads/master@{#34906}
2016-03-18 18:29:37 +00:00
yangguo
1e2d0e1136 [regexp] catch stack overflow when parsing back references.
R=jkummerow@chromium.org
BUG=chromium:595657
LOG=N

Review URL: https://codereview.chromium.org/1811913006

Cr-Commit-Position: refs/heads/master@{#34894}
2016-03-18 14:52:41 +00:00
verwaest
c6f9883d53 Remove oob elements collected from the prototype chain by trimming in GetArrayKeys
BUG=chromium:594953
LOG=n

Review URL: https://codereview.chromium.org/1817443003

Cr-Commit-Position: refs/heads/master@{#34893}
2016-03-18 14:37:36 +00:00
caitpotter88
17c92fe6bb [es7] implement exponentiation operator proposal
Implements Stage 4 proposal from http://rwaldron.github.io/exponentiation-operator/,
without adding any knowledge of the feature to compiler backends.

BUG=v8:3915
LOG=Y
R=adamk@chromium.org, rossberg@chromium.org, littledan@chromium.org

Review URL: https://codereview.chromium.org/1678303002

Cr-Commit-Position: refs/heads/master@{#34890}
2016-03-18 13:54:05 +00:00
mvstanton
84af5e4426 ES6: instanceof error messages need updating.
We need one message in case the function is not an object, and
another if it was an object but not callable.

R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1814823002

Cr-Commit-Position: refs/heads/master@{#34883}
2016-03-18 10:39:28 +00:00
littledan
7acee1ef61 Throw the right exceptions from setting elements in Array.prototype.concat
This patch fixes two bugs in Array.prototype.concat in conjunction with
subclassing Arrays:
- Create a new property rather than calling Set when adding elements to
  the output array. This means setters are not called.
- If there is an exception thrown from DefineProperty, propagate it
  outwards properly, rather than swallowing it. This can occur, e.g., with
  a Proxy as the new output array.

R=adamk
LOG=Y
BUG=chromium:595319

Review URL: https://codereview.chromium.org/1814933002

Cr-Commit-Position: refs/heads/master@{#34876}
2016-03-17 22:42:00 +00:00