Commit Graph

8915 Commits

Author SHA1 Message Date
Qingyan Li
473d747dbe [snapshot]: Fix missing Cast in {Private, Signature, AccessorSignature}
R=yangguo@chromium.org

Bug: v8:7306
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I40037ebb66a856b52454c50d17b4c8a51aab7a84
Reviewed-on: https://chromium-review.googlesource.com/866215
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50618}
2018-01-16 12:07:41 +00:00
Choongwoo Han
3a4f3b73e2 Reland "Optimize TypedArraySpeciesCreate using SpeciesProtector of Array"
If there is no constructor or species updates on Array or TypedArrays,
then skip lookups of constructor and species so that we can create a new
typed array quickly. This path makes TA.p.slice() 2x faster in fast
cases.


Bug: chromium:800356, v8:7161
Change-Id: Ied8c90e23ca6708f4a3cec077c1fd733e4a6609e
Reviewed-on: https://chromium-review.googlesource.com/859397
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50617}
2018-01-16 11:55:32 +00:00
Martyn Capewell
7f6355cf6d [arm64] Remove remains of jssp
Remove remaining references to jssp, and return register to the allocator.

Bug: v8:6644
Change-Id: Ia6938e6c9548cd45d8c9c12032920b32d3da3c4c
Reviewed-on: https://chromium-review.googlesource.com/866747
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50613}
2018-01-16 10:45:13 +00:00
Clemens Hammacher
6b909391fc [cleanup] Refactor CSignature helper
The implementation can be greatly simplified by using variadic
templates.

R=mstarzinger@chromium.org

Change-Id: I8dbeea3d570bf0fac83109f334c48dbe39aaa853
Reviewed-on: https://chromium-review.googlesource.com/859785
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50611}
2018-01-16 10:01:13 +00:00
Ben L. Titzer
19ce4fc96d [compiler] Add kRetpoline CallDescriptor flag and codegen
This CL adds support for the "retpoline" construction on x64
https://support.google.com/faqs/answer/7625886
which protects against speculative execution of indirect calls.

R=mstarzinger@chromium.org,jarin@chromium.org
CC=eholk@chromium.org

Bug: chromium:798964
Change-Id: I2aa5ab9a62dac53c67061378a0bc9cd2026ca7a2
Reviewed-on: https://chromium-review.googlesource.com/867063
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50608}
2018-01-16 09:35:03 +00:00
Andreas Haas
0c28bfb054 [arm][turbofan] Pass the slot index for the peek instruction by operand
This is the implementation of crrev.com/c/866721 for arm.

Drive-by change: I simplified the slot index calculation.

Original description:

At the moment the slot index is encoded in the opcode. This, however,
sets an upper limit the slot index which is lower than what we want to
have (i.e. < 512). With this change we pass the slot index as an
immediate operand, which does not impose limits on the value it
contains.

R=v8-arm-ports@googlegroups.com

Change-Id: Ic448872aa1da63f421d569ab5ec9160f36e6652b
Reviewed-on: https://chromium-review.googlesource.com/866745
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50607}
2018-01-16 09:28:08 +00:00
Clemens Hammacher
4418b48691 [cleanup] Refactor codegen-tester
The implementation can be greatly simplified by using variadic
templates.

R=mstarzinger@chromium.org

Change-Id: Ifbda09bc536c9660a83d1888b395e92367c9b03e
Reviewed-on: https://chromium-review.googlesource.com/860458
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50603}
2018-01-16 09:01:22 +00:00
Andreas Haas
cd43f56eb1 [x64][turbofan] Pass the slot index for the peek instruction by operand
At the moment the slot index is encoded in the opcode. This, however,
sets an upper limit the slot index which is lower than what we want to
have (i.e. < 512). With this change we pass the slot index as an
immediate operand, which does not impose limits on the value it
contains.

R=titzer@chromium.org

Change-Id: Iab676186f41b8174bcc6c5a6053e6b0d5640ed3c
Reviewed-on: https://chromium-review.googlesource.com/866721
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50586}
2018-01-15 15:22:27 +00:00
Andreas Haas
c710e6584c [arm64][turbofan] Implement on-stack returns.
This is the implementation of crrev.com/c/766371 for arm64.

Original description:

Add the ability to return (multiple) return values on the stack:

- Extend stack frames with a new buffer region for return slots.
  This region is located at the end of a caller's frame such that
  its slots can be indexed as caller frame slots in a callee
  (located beyond its parameters) and assigned return values.
- Adjust stack frame constructon and deconstruction accordingly.
- Extend linkage computation to support register plus stack returns.
- Reserve return slots in caller frame when respective calls occur.
- Introduce and generate architecture instructions ('peek') for
  reading back results from return slots in the caller.
- Aggressive tests.
- Some minor clean-up.

R=v8-arm-ports@googlegroups.com

Change-Id: I6e344a23f359861c9a1ff5a6511651c2176ce9a8
Reviewed-on: https://chromium-review.googlesource.com/842545
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50585}
2018-01-15 15:18:47 +00:00
Yang Guo
43ac9d5151 Fix TransitionArray::Sort.
R=ulan@chromium.org

Bug: v8:7303
Change-Id: Ica6db623fbb5a4c4dd3ccf1dcbd6f796bb4406fc
Reviewed-on: https://chromium-review.googlesource.com/865907
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50575}
2018-01-15 12:52:03 +00:00
Martyn Capewell
153f6705c2 [arm64] Remove SetStackPointer
Remove SetStackPointer function and update assembler tests.

Bug: v8:6644
Change-Id: I5ea26e57b848d56433c84d8eea22d7e9b761e6bb
Reviewed-on: https://chromium-review.googlesource.com/864147
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50571}
2018-01-15 11:35:31 +00:00
Adam Klein
49898aad76 Remove always-true --harmony-async-iteration runtime flag
It was shipped in Chrome 63.

Bug: v8:5855
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Icc00b8300622d1c7b5662be8ac5e425b9781f666
Reviewed-on: https://chromium-review.googlesource.com/858381
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50558}
2018-01-12 20:14:34 +00:00
Ali Ijaz Sheikh
c3bb73f6b9 [tracing] implement TRACE_EVENT_ADD_WITH_TIMESTAMP
Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icb3cf7b7f96704e1eaa4c5fbf773b94b70cddc85
Reviewed-on: https://chromium-review.googlesource.com/861302
Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#50549}
2018-01-12 16:27:25 +00:00
Hannes Payer
14eec66781 [heap] Remove page header tag from owner field.
This reverts commit 8d7522bc67 and fixes
the TSAN issue.

Bug: chromium:800251
Change-Id: Ie88e5281f7543bb3420703e798416d4a6dbbd91a
Reviewed-on: https://chromium-review.googlesource.com/864042
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50535}
2018-01-12 13:44:55 +00:00
Andreas Haas
a7b26c6b83 [turbofan] Add fuzzer to test different signatures for multi-returns
This CL makes a fuzzer out of the cctest
test-multiple-return/ReturnMultipleRandom. The fuzzer creates a
CallDescriptor with input parameters and returns, and a function which
maps input parameters to returns. The fuzzer then calls this function
with a wrapper which checks that the correct mapping happened.

R=clemensh@chromium.org

Change-Id: Ib89c4063638baae69540a44486d7b2e9d13f8c1f
Reviewed-on: https://chromium-review.googlesource.com/859768
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50532}
2018-01-12 12:20:27 +00:00
Martyn Capewell
c6c2d9a3e4 [arm64] Tidy up stack related TF opcodes
Unify PokeCSP/JSSP and ClaimCSP/JSSP, remove RestoreJSSP/CSP, and
remove UseNativeStack.

Bug: v8:6644
Change-Id: I482237a0e112f986c6155dce253749f55bd08f5f
Reviewed-on: https://chromium-review.googlesource.com/860104
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50531}
2018-01-12 11:58:56 +00:00
Caitlin Potter
2d889aa9a4 Reland "[esnext] load iterator.next only once at beginning of iteration"
https://github.com/tc39/ecma262/pull/988 gained concensus during the
september 2017 TC39 meetings. This moves the load of the "next" method
to the very beginning of the iteration protocol, rather than during
each iteration step.

This impacts:

- yield*
- for-of loops
- spread arguments
- array spreads

In the v8 implementation, this also affects async iteration versions of
these things (the sole exception being the Async-From-Sync iterator,
which requires a few more changes to work with this, likely done in a
followup patch).

This change introduces a new AST node, ResolvedProperty, which can be used
as a callee by Call nodes to produce the same bytecode as Property calls,
without observably re-loading the property. This is used in several
AST-desugarings involving the iteration protocol.

BUG=v8:6861, v8:5699
R=rmcilroy@chromium.org
TBR=neis@chromium.org, adamk@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I9685db6e85315ba8a2df87a4537c2bf491e1e35b
Reviewed-on: https://chromium-review.googlesource.com/857593
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50518}
2018-01-11 20:27:13 +00:00
Martyn Capewell
c6ea032850 Reland "[arm64] Switch jssp to csp"
This is a reland of 50baf93425

This fixes the number of expected instructions in MaybeCallEntryHookDelayed,
only exposed by nosnap tests.

Original change's description:
> [arm64] Switch jssp to csp
>
> Switch stack pointer to using csp directly, making jssp redundant.
>
> Bug: v8:6644
> Change-Id: I8e38eda50d56a25161b187c0a033608dd9f90239
> Reviewed-on: https://chromium-review.googlesource.com/860097
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
> Cr-Commit-Position: refs/heads/master@{#50487}

Bug: v8:6644
Change-Id: Ie9a969ccbf00fd7a7cff8f45b73cdb6bc4f17df9
Reviewed-on: https://chromium-review.googlesource.com/860639
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50513}
2018-01-11 18:42:13 +00:00
Adam Klein
8d7522bc67 Revert "[heap] Remove page header tag from owner field."
This reverts commit 6af43874b5.

Reason for revert: Linux TSAN failures:

https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/19028

Original change's description:
> [heap] Remove page header tag from owner field.
> 
> Bug: chromium:800251
> Change-Id: I101131b4651b0bb27a79e5107ee43caf1229ffc7
> Reviewed-on: https://chromium-review.googlesource.com/860010
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50507}

TBR=ulan@chromium.org,hpayer@chromium.org

Change-Id: I29001423959f6d9faadbdba5228b28cfb1f5b341
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:800251
Reviewed-on: https://chromium-review.googlesource.com/861923
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50512}
2018-01-11 17:56:55 +00:00
Hannes Payer
6af43874b5 [heap] Remove page header tag from owner field.
Bug: chromium:800251
Change-Id: I101131b4651b0bb27a79e5107ee43caf1229ffc7
Reviewed-on: https://chromium-review.googlesource.com/860010
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50507}
2018-01-11 14:49:34 +00:00
Dan Elphick
9dd2b20350 [CSA]: Fix ElementOffsetFromIndex for dynamic SMIs
Non-constant SMIs were being shifted to the right with SHR instead of SAR,
which caused corruption of negative offsets.

Add tests for SMI access to arguments using CodeStubArguments.

Change-Id: I6cc4fc0a5dd0018524f5ff4f16f9e9a21866363f
Reviewed-on: https://chromium-review.googlesource.com/854055
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50506}
2018-01-11 14:38:25 +00:00
Ben L. Titzer
3a79d5bcc5 [wasm] Move (almost all) constants to wasm-constants.h
This CL centralizes constants related to decoding from several places
into one place and makes it no longer necessary to include
wasm-opcodes.h for some simple constants.

R=clemensh@chromium.org

Bug: 
Change-Id: I53aa81e34167df467bc7455b717bf67083033943
Reviewed-on: https://chromium-review.googlesource.com/859764
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50503}
2018-01-11 12:25:54 +00:00
Leszek Swirski
713eb9e765 [ignition] Change RestoreGeneratorRegisters to ResumeGenerator
This makes RestoreGeneratorRegisters do a fuller resume process: update
the state register to indicate that it is now executing, and update the
accumulator with the input_or_debug_pos of the generator - i.e., perform
the boilerplate generator resuming in one bytecode instead of several.

Change-Id: Ia87b6766ac023064b40d3e9a143e7b32118ea3a0
Reviewed-on: https://chromium-review.googlesource.com/859770
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50499}
2018-01-11 11:25:04 +00:00
Junliang Yan
7cb600f26f PPC: Replace CALL_GENERATED_CODE by GeneratedCode wrapper
Port 30fabc4cdf

Original Commit Message:

    This ensures that there is only one entrance point from C++ to
    generated code, hence only one method has to be excluded from CFI.
    It also introduces type safety by only allowing the code to be called
    with the right arguments.
    This CL includes minor drive-by fixes in the tests, like removing
    unused dummy variables.

R=clemensh@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Idb21a7b8103a8fb833c963c182463006d9dd6288
Reviewed-on: https://chromium-review.googlesource.com/857425
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#50490}
2018-01-10 20:40:13 +00:00
Ali Ijaz Sheikh
814577e3fd [tracing] allow embedders to provide own tracing timestamps
Make it possible for embedders to provide their own tracing timetamps by
providing an overridable virtual function on V8's tracing controller.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I727e633cb7f63d4b41c2e427ecca3c9174c90bfe
Reviewed-on: https://chromium-review.googlesource.com/847690
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#50489}
2018-01-10 19:36:23 +00:00
Adam Klein
89348016ff Revert "[arm64] Switch jssp to csp"
This reverts commit 50baf93425.

Reason for revert: breaks arm64 nosnap debug tests:

https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/8418

Original change's description:
> [arm64] Switch jssp to csp
> 
> Switch stack pointer to using csp directly, making jssp redundant.
> 
> Bug: v8:6644
> Change-Id: I8e38eda50d56a25161b187c0a033608dd9f90239
> Reviewed-on: https://chromium-review.googlesource.com/860097
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
> Cr-Commit-Position: refs/heads/master@{#50487}

TBR=martyn.capewell@arm.com,bmeurer@chromium.org

Change-Id: I20015885e6029271ee6558509cdb92ff1a106e5f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6644
Reviewed-on: https://chromium-review.googlesource.com/860319
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50488}
2018-01-10 18:38:44 +00:00
Martyn Capewell
50baf93425 [arm64] Switch jssp to csp
Switch stack pointer to using csp directly, making jssp redundant.

Bug: v8:6644
Change-Id: I8e38eda50d56a25161b187c0a033608dd9f90239
Reviewed-on: https://chromium-review.googlesource.com/860097
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#50487}
2018-01-10 17:45:35 +00:00
Timothy Gu
5b9adade64 [proxy] Set [[ProxyTarget]] to null during revocation
Before this, only the [[ProxyHandler]] was set to null during revocation
of the Proxy through either the v8::Proxy::Revoke() or the
Proxy.revocable() API. To be consistent with the spec, the Proxy's
target is set to null as well. This change should not be observable
through JS, since the check for if the Proxy is revoked should always
use the handler. But the changed value is exposed through the public
v8::Proxy::GetTarget() API, which is used by the inspector API and
Node.js.

Also included is a much more comprehensive test for Inspector's support
for Proxy, which prior to this commit did not work as intended.

Bug: 
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I727607ec2b3cea8642cd636573932c1e6bb5cc07
Reviewed-on: https://chromium-review.googlesource.com/854676
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50476}
2018-01-10 11:23:54 +00:00
Pierre Langlois
5361c57bd5 [arm] Restrict usage of pc-relative LDR.
Disallow using the PC as a base in LDR and instead provide a dedicated assembler
method for pc-relative loads. The reason for this is that the generic
`Assembler::ldr` method may decide to generate more instructions if the offset
is out of range, and if the PC was the base, we would get surprising
results. For example:

~~~
ldr r0, [pc, #0xcabba9e]
~~~

is not equivalent to:

~~~
movw ip, #0xba9e
movt ip, #0xcab
ldr r0, [pc, ip]
~~~

since the reference to the PC has moved down two instructions!

We could teach the assembler to handle those cases correctly, but pc-relative
loads are used in specific cases only so that's not necessary.

As a drive-by, remove a reference to code aging.

Bug: 
Change-Id: I586d83a418db52cf28d3b524f889bf40f077998a
Reviewed-on: https://chromium-review.googlesource.com/847008
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#50475}
2018-01-10 11:22:49 +00:00
Ivo Markovic
93e04fd3d6 Fix wasm_context wrong usage.
Previous usage was getting wrong address on Mips.

TEST=test-wasm-trap-position/RunWasmTurbofan_IllegalLoad

Bug: 
Change-Id: I325ada99540f01ae509dfbfe3c0e55693dacca19
Reviewed-on: https://chromium-review.googlesource.com/859457
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50474}
2018-01-10 11:13:49 +00:00
Jakob Gruber
b131cc35bc Revert "Optimize TypedArraySpeciesCreate using SpeciesProtector of Array"
This reverts commit 8fbc6a05c1.

Reason for revert: https://crbug.com/800356

Original change's description:
> Optimize TypedArraySpeciesCreate using SpeciesProtector of Array
> 
> If there is no constructor or species updates on Array or TypedArrays,
> then skip lookups of constructor and species so that we can create a new
> typed array quickly. This path makes TA.p.slice() 4x faster in fast
> cases.
> 
> Bug: v8:7161
> Change-Id: Ib8d2a3f6b8b5ed356c5822a814164166d1285f64
> Reviewed-on: https://chromium-review.googlesource.com/828343
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50423}

TBR=jkummerow@chromium.org,jgruber@chromium.org,ishell@chromium.org,bmeurer@chromium.org,cwhan.tunz@gmail.com

Change-Id: Icca07564d2a83710852eb797bac25f1d5600696e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7161
Reviewed-on: https://chromium-review.googlesource.com/859156
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50470}
2018-01-10 07:46:29 +00:00
jing.bao
058f166bd4 [ia32][wasm] Add F32x4 Add/Sub/Mul/Min/Max
Bug: 
Change-Id: I75de89ca895ef5a408a1d958b75dbc79d07e007a
Reviewed-on: https://chromium-review.googlesource.com/856096
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#50468}
2018-01-10 01:46:29 +00:00
Aseem Garg
0d0888c4e1 Reland "[wasm] remove kExecuteSimdLowered mode from wasm cctest"
This is a reland of 86bc15174f
Original change's description:
> [wasm] remove kExecuteSimdLowered mode from wasm cctest
> 
> R=clemensh@chromium.org,titzer@chromium.org,bbudge@chromium.org,gdeepti@chromium.org
> BUG=v8:7028
> 
> Change-Id: Ie0b984ebd18e267cdaf7aaff9f17fb4328d8e5fa
> Reviewed-on: https://chromium-review.googlesource.com/849638
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50385}

Bug: v8:7028
Change-Id: I64ef0f55268d542588d69a661c0ce88b8aa2f6d5
Reviewed-on: https://chromium-review.googlesource.com/854776
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50463}
2018-01-09 18:30:29 +00:00
Josh Wolfe
b065ed4795 Support Function::SetName() with --harmony-function-tostring
This is used in chromium for html attribute event handlers.

See blink layout test fast/events/event-function-toString.html

Bug: v8:4958
Change-Id: Ib3d88af834bbb62b4ccd4683eda743d92064b075
Reviewed-on: https://chromium-review.googlesource.com/837641
Commit-Queue: Josh Wolfe <jwolfe@igalia.com>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50460}
2018-01-09 18:13:09 +00:00
Michael Achenbach
163b5d705e Revert "[esnext] load iterator.next only once at beginning of iteration"
This reverts commit bf4cc9ee15.

Reason for revert: Breaks windows with msvc and linux with gcc
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/841
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/17265

Original change's description:
> [esnext] load `iterator.next` only once at beginning of iteration
> 
> https://github.com/tc39/ecma262/pull/988 gained concensus during the
> september 2017 TC39 meetings. This moves the load of the "next" method
> to the very beginning of the iteration protocol, rather than during
> each iteration step.
> 
> This impacts:
> 
> - yield*
> - for-of loops
> - spread arguments
> - array spreads
> 
> In the v8 implementation, this also affects async iteration versions of
> these things (the sole exception being the Async-From-Sync iterator,
> which requires a few more changes to work with this, likely done in a
> followup patch).
> 
> This change introduces a new AST node, ResolvedProperty, which can be used
> as a callee by Call nodes to produce the same bytecode as Property calls,
> without observably re-loading the property. This is used in several
> AST-desugarings involving the iteration protocol.
> 
> BUG=v8:6861, v8:5699
> R=​rmcilroy@chromium.org, neis@chromium.org, adamk@chromium.org
> 
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ib81106a0182687fc5efea0bc32302ad06376773b
> Reviewed-on: https://chromium-review.googlesource.com/687997
> Commit-Queue: Caitlin Potter <caitp@igalia.com>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Adam Klein <adamk@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50452}

TBR=rmcilroy@chromium.org,adamk@chromium.org,neis@chromium.org,caitp@igalia.com,caitp@chromium.org

Change-Id: I1797c0d596dfd6850d6f0f505f591a7a990dd1f1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6861, v8:5699
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/857616
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50454}
2018-01-09 16:50:33 +00:00
Caitlin Potter
bf4cc9ee15 [esnext] load iterator.next only once at beginning of iteration
https://github.com/tc39/ecma262/pull/988 gained concensus during the
september 2017 TC39 meetings. This moves the load of the "next" method
to the very beginning of the iteration protocol, rather than during
each iteration step.

This impacts:

- yield*
- for-of loops
- spread arguments
- array spreads

In the v8 implementation, this also affects async iteration versions of
these things (the sole exception being the Async-From-Sync iterator,
which requires a few more changes to work with this, likely done in a
followup patch).

This change introduces a new AST node, ResolvedProperty, which can be used
as a callee by Call nodes to produce the same bytecode as Property calls,
without observably re-loading the property. This is used in several
AST-desugarings involving the iteration protocol.

BUG=v8:6861, v8:5699
R=rmcilroy@chromium.org, neis@chromium.org, adamk@chromium.org

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ib81106a0182687fc5efea0bc32302ad06376773b
Reviewed-on: https://chromium-review.googlesource.com/687997
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50452}
2018-01-09 16:21:30 +00:00
Yang Guo
11e80a3509 [snapshot] support attaching arbitrary v8::Data.
In collaboration with Qingyan Li <qingyan.liqy@alibaba-inc.com>.

R=jgruber@chromium.org, mlippautz@chromium.org

Bug: v8:7249
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I87f62103ec5b31de274fa22ad275f1c1bcb3ed86
Reviewed-on: https://chromium-review.googlesource.com/846750
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50433}
2018-01-09 12:06:40 +00:00
Clemens Hammacher
566b3bf4a7 [Liftoff] Implement direct calls
This adds support for direct calls in Liftoff.

Drive-by: Fix / extend two tests for calls which were helpful for
developing this CL.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I20a98d9dd330da9a020c8c9b5c10b04e94af684d
Reviewed-on: https://chromium-review.googlesource.com/847579
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50427}
2018-01-09 10:54:56 +00:00
Clemens Hammacher
30fabc4cdf Replace CALL_GENERATED_CODE by GeneratedCode wrapper
This ensures that there is only one entrance point from C++ to
generated code, hence only one method has to be excluded from CFI.
It also introduces type safety by only allowing the code to be called
with the right arguments.
This CL includes minor drive-by fixes in the tests, like removing
unused dummy variables.

R=mstarzinger@chromium.org

Bug: v8:7182
Change-Id: Ied9164a2497db9e7c032324c5e082094fdffc72d
Reviewed-on: https://chromium-review.googlesource.com/852213
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50426}
2018-01-09 10:33:36 +00:00
Hannes Payer
4bf8043148 [heap] Refactor and clean-up runtime allocation.
Bug: chromium:796896
Change-Id: I7f46f82d079502b8ec04c5e3be5f803ec9e62ffa
Reviewed-on: https://chromium-review.googlesource.com/854797
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50424}
2018-01-09 09:51:21 +00:00
Choongwoo Han
8fbc6a05c1 Optimize TypedArraySpeciesCreate using SpeciesProtector of Array
If there is no constructor or species updates on Array or TypedArrays,
then skip lookups of constructor and species so that we can create a new
typed array quickly. This path makes TA.p.slice() 4x faster in fast
cases.

Bug: v8:7161
Change-Id: Ib8d2a3f6b8b5ed356c5822a814164166d1285f64
Reviewed-on: https://chromium-review.googlesource.com/828343
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50423}
2018-01-09 09:50:16 +00:00
Sathya Gunasekaran
779c080895 [ESNext] Implement optional catch binding
This is just a rebased version of
https://chromium-review.googlesource.com/c/v8/v8/+/571453 with
no functional changes

Bug: v8:6889
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ia082cc09ca527505b288ac88e68e0b74eae94765
Reviewed-on: https://chromium-review.googlesource.com/849423
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50417}
2018-01-08 18:09:34 +00:00
Clemens Hammacher
a3baa35372 [simulator] Make Call variadic
In order to remove the CALL_GENERATED_CODE macro, it helps a lot to
unify the interfaces of the simulators and make the Call method variadic
in the number of arguments.
This CL does that for each simulator. A follow-up CL will then
completely remove the CALL_GENERATED_CODE macro and replace uses with
the (new) GeneratedCode wrapper.

R=mstarzinger@chromium.org

Bug: v8:7182
Change-Id: I1f81445ec2faba30f0bd233b022ae1f0fae4e96f
Reviewed-on: https://chromium-review.googlesource.com/850873
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50413}
2018-01-08 16:53:45 +00:00
Georg Neis
0c35b7252a [api,modules] Allow GetModuleNamespace on unevaluated modules.
Bug: v8:7217
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I97b067254355eb91e12b92eba92631cbc3ce8000
Reviewed-on: https://chromium-review.googlesource.com/839280
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50395}
2018-01-08 09:01:25 +00:00
Adam Klein
211d569a2b [parser] Remove incorrect UseCounter code for LabeledExpressionStatement
As noted in the attached bug, accurately counting this would require
significant changes to the parser and is thus infeasible.

Bug: v8:7211
Change-Id: I61f14c948f50e0f97e596a9696d72a3570ad588a
Reviewed-on: https://chromium-review.googlesource.com/853214
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50393}
2018-01-06 00:17:43 +00:00
Karl Schimpf
716e539c2e [wasm] Use static_assert instead of assert
Fixes nits found by @clemensh after
CL https://chromium-review.googlesource.com/c/v8/v8/+/834670
was committed. That is, the code uses static asserts instead of
assert.

Bug: v8:7226
Change-Id: I5488ec4609d1bee3aafa61a3ff2505f71b06d80d
Reviewed-on: https://chromium-review.googlesource.com/847687
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50388}
2018-01-05 19:17:26 +00:00
Michael Achenbach
4eae36ad79 Revert "[wasm] remove kExecuteSimdLowered mode from wasm cctest"
This reverts commit 86bc15174f.

Reason for revert: breaks gcc bot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/17209

Original change's description:
> [wasm] remove kExecuteSimdLowered mode from wasm cctest
> 
> R=​clemensh@chromium.org,titzer@chromium.org,bbudge@chromium.org,gdeepti@chromium.org
> BUG=v8:7028
> 
> Change-Id: Ie0b984ebd18e267cdaf7aaff9f17fb4328d8e5fa
> Reviewed-on: https://chromium-review.googlesource.com/849638
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50385}

TBR=bbudge@chromium.org,titzer@chromium.org,gdeepti@chromium.org,aseemgarg@chromium.org,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I890b8810ea802fe2b9273def07c9056d4b904a4e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7028
Reviewed-on: https://chromium-review.googlesource.com/852712
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50386}
2018-01-05 18:13:00 +00:00
Aseem Garg
86bc15174f [wasm] remove kExecuteSimdLowered mode from wasm cctest
R=clemensh@chromium.org,titzer@chromium.org,bbudge@chromium.org,gdeepti@chromium.org
BUG=v8:7028

Change-Id: Ie0b984ebd18e267cdaf7aaff9f17fb4328d8e5fa
Reviewed-on: https://chromium-review.googlesource.com/849638
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50385}
2018-01-05 17:28:35 +00:00
Sathya Gunasekaran
3828ce0cae [class] Ban arguments in class field initializers
Create a new function kind for initializer functions and ban arguments
if used in such a function.

Bug: v8:5367, v8:7183
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Id3089e587b3d6a25f27224045f250e032b831818
Reviewed-on: https://chromium-review.googlesource.com/850547
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50369}
2018-01-04 23:11:25 +00:00
Sathya Gunasekaran
fba4cdf16c Refactor bailout reasons
This patch breaks out bailout reasons into two enum classes.

This helps save 3 bits on the SharedFunctionInfo as we don't have to
track the abort reasons.

Change-Id: Ic2e7e7e32b0fa31491f1c6f0003a61390d68fd97
Reviewed-on: https://chromium-review.googlesource.com/848244
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50364}
2018-01-04 19:08:45 +00:00