Commit Graph

1441 Commits

Author SHA1 Message Date
yangguo
47fce35e80 Debugger: correctly redirect code with no stack check.
This fix makes the redirect mechanism a bit more stable.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1269733002

Cr-Commit-Position: refs/heads/master@{#29936}
2015-07-30 14:23:13 +00:00
binji
a87db3dec8 [d8 Workers] Fix bug creating Worker during main thread termination
When the main thread terminates, it forcibly terminates all Worker threads.
When this happens, the threads objects were only half-created; they had a
JavaScript Worker object, but not a C++ worker object.

This CL fixes that bug, as well as some other fixes:
* Signatures on Worker methods
* Use SetAlignedPointerFromInternalField instead of using an External.
* Remove state_ from Worker. Simplify to atomic bool running_.

BUG=chromium:511880
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1255563002

Cr-Commit-Position: refs/heads/master@{#29911}
2015-07-30 08:19:39 +00:00
jkummerow
c906efd5d1 Fix prototype registration upon SlowToFast migration
When a prototype object migrates from a slow to a fast map, where the slow map
was registered as a user of its own prototype, then the registration must be
transferred to the new map (just like MigrateToMap does for all other cases).

BUG=chromium:513602
LOG=y
NOTREECHECKS=true

Review URL: https://codereview.chromium.org/1263543004

Cr-Commit-Position: refs/heads/master@{#29898}
2015-07-28 15:41:29 +00:00
bmeurer
cac64b9f63 [stubs] Properly handle read-only properties in StoreGlobalViaContextStub.
We don't need the hole check and slow runtime mode for read-only
properties this way.

R=ishell@chromium.org

Review URL: https://codereview.chromium.org/1255133002

Cr-Commit-Position: refs/heads/master@{#29881}
2015-07-27 18:45:36 +00:00
ishell
156042f7f7 Cross-script variables handling fixed. It was possible to write to read-only global variable.
Review URL: https://codereview.chromium.org/1259853002

Cr-Commit-Position: refs/heads/master@{#29860}
2015-07-27 05:53:05 +00:00
yangguo
cc8fa95f7c Debugger: fix deoptimizing inlined function.
BUG=v8:4320
LOG=N
R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1255803004

Cr-Commit-Position: refs/heads/master@{#29842}
2015-07-24 10:37:57 +00:00
danno
bc8041dc2b Unify "runtime-style" IC functions with Runtime intrinsics
Previous to this CL, ICs used a slightly different code idiom
to get to C++ code from generated code than runtime intrinsics,
using an IC_Utility class that in essence provided exactly
the same functionality as Runtime::FunctionForId, but in its
own quirky way.

This CL unifies the two mechanisms, folding IC_Utility
away by making all IC entry points in C++ code, e.g. IC
miss handlers, full-fledged runtime intrinsics. This makes
it possible to eliminate a bunch of ad-hoc declarations and
adapters that the IC system had to needlessly re-invent.

As a bonus and the original reason for this yak-shave:
IC-related C++ runtime functions are now callable from
TurboFan.

Review URL: https://codereview.chromium.org/1248303002

Cr-Commit-Position: refs/heads/master@{#29811}
2015-07-23 13:32:26 +00:00
ishell
9e6647c216 Speedup some slow running stack-overflow tests.
BUG=chromium:505007
LOG=N

Review URL: https://codereview.chromium.org/1238273003

Cr-Commit-Position: refs/heads/master@{#29747}
2015-07-20 09:50:53 +00:00
adamk
e6cb6bb6b7 Fix element enumeration on String wrappers with dictionary elements
BUG=chromium:510426
LOG=n

Review URL: https://codereview.chromium.org/1246513002

Cr-Commit-Position: refs/heads/master@{#29745}
2015-07-20 09:01:06 +00:00
yangguo
01902e4eab Debugger: use FrameInspector in ScopeIterator to find context.
In optimized code, it's not guaranteed that the current context
is stored in its frame slot.

R=bmeurer@chromium.org
BUG=v8:4309
LOG=N

Committed: https://crrev.com/3a0ee39cbde6a9778cfc4e2a6a0a8ff68933ff38
Cr-Commit-Position: refs/heads/master@{#29697}

Review URL: https://codereview.chromium.org/1239033002

Cr-Commit-Position: refs/heads/master@{#29744}
2015-07-20 08:53:39 +00:00
ishell
cc66a1c64e Crankshaft part of the 'loads and stores to global vars through property cell shortcuts' feature.
BUG=chromium:510738
LOG=N

Review URL: https://codereview.chromium.org/1228113008

Cr-Commit-Position: refs/heads/master@{#29743}
2015-07-20 08:49:28 +00:00
caitpotter88
c9007d8f7e [d8] bounds-check before getting Shell::Worker internal field
Prevents fatal error in debug builds

BUG=v8:4271, 506954
R=binji@chromium.org
LOG=N

Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
Cr-Commit-Position: refs/heads/master@{#29524}

Review URL: https://codereview.chromium.org/1214053004

Cr-Commit-Position: refs/heads/master@{#29737}
2015-07-17 21:44:37 +00:00
yangguo
c062b28aeb Revert of Debugger: use FrameInspector in ScopeIterator to find context. (patchset #3 id:40001 of https://codereview.chromium.org/1239033002/)
Reason for revert:
breaks roll: http://build.chromium.org/p/tryserver.chromium.linux/builders/linux_chromium_rel_ng/builds/87292/steps/browser_tests%20%28with%20patch%29/logs/DevToolsSanityTest.TestPauseWhenScriptIsRunning

Original issue's description:
> Debugger: use FrameInspector in ScopeIterator to find context.
>
> In optimized code, it's not guaranteed that the current context
> is stored in its frame slot.
>
> R=bmeurer@chromium.org
> BUG=v8:4309
> LOG=N
>
> Committed: https://crrev.com/3a0ee39cbde6a9778cfc4e2a6a0a8ff68933ff38
> Cr-Commit-Position: refs/heads/master@{#29697}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4309

Review URL: https://codereview.chromium.org/1243553002

Cr-Commit-Position: refs/heads/master@{#29722}
2015-07-17 09:53:49 +00:00
yangguo
3a0ee39cbd Debugger: use FrameInspector in ScopeIterator to find context.
In optimized code, it's not guaranteed that the current context
is stored in its frame slot.

R=bmeurer@chromium.org
BUG=v8:4309
LOG=N

Review URL: https://codereview.chromium.org/1239033002

Cr-Commit-Position: refs/heads/master@{#29697}
2015-07-16 09:28:20 +00:00
mvstanton
ae11f20e26 Scoping error caused crash in CallICNexus::StateFromFeedback
A sloppy mode eval call that establishes strict mode will leak that strictness
into the sloppy surrounding scope on recompile. This changes the structure
of the type feedback vector for the function and crashes follow.

The fix is straightforward.

BUG=491536, 503565
LOG=N

Review URL: https://codereview.chromium.org/1231343003

Cr-Commit-Position: refs/heads/master@{#29671}
2015-07-15 09:15:05 +00:00
binji
a55fcc93ae Don't use length property when bounds checking atomics functions
The length property can be monkey-patched, so use the native function instead.

R=jarin@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1227913006

Cr-Commit-Position: refs/heads/master@{#29653}
2015-07-14 16:17:21 +00:00
verwaest
5f24690384 Properly handle missing from normalized stores with keys convertible to array indices
BUG=chromium:509961
LOG=n

Review URL: https://codereview.chromium.org/1241613003

Cr-Commit-Position: refs/heads/master@{#29648}
2015-07-14 11:44:56 +00:00
yangguo
541aa57718 Fix test case for crbug/507070.
--debug-code causes full-codegen on arm64 to emit different number
of calls, which confuses the debugger when on-stack replacing code
with recompiled debug version on-stack.

BUG=chromium:507070
TBR=mstarzinger@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1228353004

Cr-Commit-Position: refs/heads/master@{#29638}
2015-07-14 08:50:18 +00:00
yangguo
dec11f5ee0 Debugger: make debug code on-stack replacement more robust.
The new implemtation counts the number of calls (or continuations)
before the PC to find the corresponding PC in the new code.

R=mstarzinger@chromium.org
BUG=chromium:507070
LOG=N

Review URL: https://codereview.chromium.org/1235603002

Cr-Commit-Position: refs/heads/master@{#29636}
2015-07-14 06:38:53 +00:00
verwaest
01f40e6ad6 Fix keyed element access wrt string wrappers
BUG=v8:4296
LOG=n

Review URL: https://codereview.chromium.org/1228063004

Cr-Commit-Position: refs/heads/master@{#29618}
2015-07-13 15:39:07 +00:00
verwaest
0b3d6f7a7d Reload the map of typed arrays after performing ToNumber.
BUG=chromium:507980
LOG=n

Review URL: https://codereview.chromium.org/1234553002

Cr-Commit-Position: refs/heads/master@{#29570}
2015-07-10 12:49:40 +00:00
ishell
b625d4d8cc [arm64] Fixed unnecessary environment assignment to LSmiTag instruction.
BUG=chromium:490021
LOG=N

Review URL: https://codereview.chromium.org/1235563002

Cr-Commit-Position: refs/heads/master@{#29567}
2015-07-10 11:36:17 +00:00
binji
d42e81d587 d8 workers: fix race on quit() with context_mutex_
When quit() is called, d8 shell exits without cleanup. If a worker is running,
it might be holding the context_mutex_, which if destroyed will DCHECK.

BUG=4279
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1231473002

Cr-Commit-Position: refs/heads/master@{#29557}
2015-07-09 19:30:29 +00:00
binji
54920cd2f0 Fix cluster-fuzz found regression with d8 Workers
This one occurred when serializing an object. When the property getter threw an
exception, that value was skipped, but the property count wasn't updated. The
deserializer then tried to deserialize the wrong value.

BUG=chromium:506549
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1220193004

Cr-Commit-Position: refs/heads/master@{#29541}
2015-07-08 17:58:00 +00:00
ishell
52b3e41799 Fixed a couple of proxies-related unhandled exceptions.
BUG=chromium:506956, chromium:505907
LOG=N

Review URL: https://codereview.chromium.org/1215463012

Cr-Commit-Position: refs/heads/master@{#29530}
2015-07-08 11:46:14 +00:00
jkummerow
5379d8bc36 [x64] Fix handling of Smi constants in LSubI and LBitI
Smi immediates are not supported, so instructions with Smi representations need their constants in a register. LAddI has already been doing this. The manifestation of the bug was that an operation would compute 0 instead of the correct result.

BUG=chromium:478612
LOG=y
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1224623017

Cr-Commit-Position: refs/heads/master@{#29529}
2015-07-08 10:20:31 +00:00
machenbach
650ef15c00 Revert of [d8] bounds-check before getting Shell::Worker internal field (patchset #4 id:80001 of https://codereview.chromium.org/1214053004/)
Reason for revert:
[Sheriff] Fails here:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/4737

Original issue's description:
> [d8] bounds-check before getting Shell::Worker internal field
>
> Prevents fatal error in debug builds
>
> BUG=v8:4271
> R=binji@chromium.org
> LOG=N
>
> Committed: https://crrev.com/43ce9c6f101c4224addd9a54e0c39963188dc7fa
> Cr-Commit-Position: refs/heads/master@{#29524}

TBR=binji@chromium.org,jochen@chromium.org,adamk@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4271

Review URL: https://codereview.chromium.org/1215333012

Cr-Commit-Position: refs/heads/master@{#29525}
2015-07-07 21:17:00 +00:00
caitpotter88
43ce9c6f10 [d8] bounds-check before getting Shell::Worker internal field
Prevents fatal error in debug builds

BUG=v8:4271
R=binji@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1214053004

Cr-Commit-Position: refs/heads/master@{#29524}
2015-07-07 21:06:19 +00:00
mstarzinger
b8ecd94c72 [turbofan] Fix bogus materialization from frame with OSR.
The context constant cannot be materialized from the frame when we are
compiling for OSR, because the context spill slot contains the current
instead of the outermost context in full-codegen.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1220013003

Cr-Commit-Position: refs/heads/master@{#29472}
2015-07-06 03:40:29 +00:00
yangguo
619570b3dd Make sure the constant pool size is as promised.
LOG=N
R=bmeurer@chromium.org
BUG=chromium:506443

Review URL: https://codereview.chromium.org/1217673003

Cr-Commit-Position: refs/heads/master@{#29463}
2015-07-03 10:32:37 +00:00
binji
ffa6b5fe6c Change d8 Worker API so it takes a string instead of a function.
This is more consistent with the DOM API, and is clearer w.r.t. which values
are available in the lexical environment of the Worker.

BUG=chromium:497295
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1218553004

Cr-Commit-Position: refs/heads/master@{#29426}
2015-07-01 16:41:56 +00:00
binji
abaa094a2b Fix cluster-fuzz found regression in d8 Workers
v8::Internal::List will DCHECK when indexing out of the array, even if just to
get the address, and the value is never used. So this construct will fail:

    memcpy(p, &data[0], length);

When data is empty and length is 0.

BUG=chromium:505778
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1216853003

Cr-Commit-Position: refs/heads/master@{#29388}
2015-06-30 16:49:09 +00:00
yangguo
4f9cf2bb1e Use correct LookupIterator in CallSite::GetMethodName.
R=verwaest@chromium.org
BUG=chromium:505370
LOG=N

Review URL: https://codereview.chromium.org/1218023002

Cr-Commit-Position: refs/heads/master@{#29385}
2015-06-30 16:28:07 +00:00
mstarzinger
a7697bdcc7 Fix clobbered register when setting this_function variable.
Reland of https://crrev.com/bf2bbc8ba508ccd21edf3c08d2e4192c4764ae91

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-498022
BUG=chromium:498022
LOG=N

Review URL: https://codereview.chromium.org/1214483008

Cr-Commit-Position: refs/heads/master@{#29372}
2015-06-30 10:39:16 +00:00
ishell
b8cce79f41 A couple of other "stack overflow" vs. "has_pending_exception()" issues in debugger fixed.
BUG=chromium:505007
LOG=N

Review URL: https://codereview.chromium.org/1219693003

Cr-Commit-Position: refs/heads/master@{#29369}
2015-06-30 08:30:18 +00:00
mstarzinger
df06f1c715 [turbofan] Fix exit control flow in TryCatchBuilder.
This makes sure that the exit control flow that merges the try-block
with the catch-block after a try-catch-statement creates a new merge
node in cases where it has to. Otherwise dangling phi nodes might have
the wrong number of value inputs.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-505354
BUG=chromium:505354
LOG=N

Review URL: https://codereview.chromium.org/1213183003

Cr-Commit-Position: refs/heads/master@{#29362}
2015-06-30 03:23:41 +00:00
oth
cff8c9b933 Ensure mjsunit tests use dashes not underscores in flags directives.
BUG=chromium:505228
LOG=Y

Review URL: https://codereview.chromium.org/1219723002

Cr-Commit-Position: refs/heads/master@{#29355}
2015-06-29 17:08:18 +00:00
yangguo
972beef14c Parse eagerly inside block scopes.
Only this way we can precisely determine how to allocate let variables
inside the scope.

R=rossberg@chromium.org
BUG=v8:4255
LOG=N

Review URL: https://codereview.chromium.org/1216013002

Cr-Commit-Position: refs/heads/master@{#29354}
2015-06-29 16:16:21 +00:00
binji
e291b78a8e Fix cluster-fuzz found regression in d8 Workers.
This one occurs when Function.prototype.toString is overridden to return a
non-string.

BUG=chromium:504729
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1214803004

Cr-Commit-Position: refs/heads/master@{#29351}
2015-06-29 15:53:22 +00:00
binji
93c43523ea Fix cluster-fuzz found regression in d8 Workers.
Dumb typo introduced in refs/heads/master@{#29306}. I thought I was turning on
report_exceptions in Shell::ExecuteString, but instead I turned on print_result
(which assumes an interactive debugger and a HandleScope for the
utility_context_).

BUG=chromium:504727,chromium:504728
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1219563002

Cr-Commit-Position: refs/heads/master@{#29350}
2015-06-29 15:48:39 +00:00
arv
47dd45c0ab [es6] Remove harmony-object-literal flag
And move tests to es6 directory

BUG=v8:3516
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1218473003

Cr-Commit-Position: refs/heads/master@{#29334}
2015-06-26 19:49:53 +00:00
yangguo
8c72792b6d Mark function info as compiled after EnsureDeoptimizationSupport.
Note that prior to having canonical shared function infos, this has
been a source of duplicate shared function infos.

R=bmeurer@chromium.org
BUG=chromium:504787
LOG=N

Review URL: https://codereview.chromium.org/1209383002

Cr-Commit-Position: refs/heads/master@{#29326}
2015-06-26 13:17:05 +00:00
binji
28b0129b03 Fix cluster-fuzz regression when getting message from Worker
The issue is that Worker.prototype.terminate was deleting the C++ Worker
object, and then Worker.prototype.getMessage was trying to read messages from
the queue.

The simplest solution is to keep workers in a zombie state when they have been
terminated. They won't be reaped until Shell::CleanupWorkers is called.

I've also fixed some threading issues with Workers:

* Workers can be created by another Worker, so the Shell::workers_ variable
must be protected by a mutex.

* An individual Worker can typically only be accessed by the isolate that
created it, but the main thread can always terminate it, so the Worker::state_
must be accessed in a thread-safe way.

BUG=chromium:504136
R=jochen@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1208733002

Cr-Commit-Position: refs/heads/master@{#29306}
2015-06-25 18:01:22 +00:00
wingo
40b7d874b2 Reapply "Fix receiver when calling eval() bound by with scope"
Originally applied in https://codereview.chromium.org/1202963005

BUG=v8:4214
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
LOG=N
R=arv@chromium.org, mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1208873002

Cr-Commit-Position: refs/heads/master@{#29293}
2015-06-25 13:46:46 +00:00
yangguo
6434ec3087 Reland 2 "Keep a canonical list of shared function infos."
BUG=v8:4132
LOG=N

Review URL: https://codereview.chromium.org/1211803002

Cr-Commit-Position: refs/heads/master@{#29291}
2015-06-25 12:20:06 +00:00
erikcorry
daef0ec5f4 Reland Extend big-disjunction optimization to case-independent regexps
Previous code review https://codereview.chromium.org/1182783009/
R=yangguo@chromium.org
BUG=chromium:482998
LOG=n

Review URL: https://codereview.chromium.org/1204123003

Cr-Commit-Position: refs/heads/master@{#29290}
2015-06-25 11:42:20 +00:00
yangguo
f7ef0c9921 Revert of Reland "Keep a canonical list of shared function infos." (patchset #3 id:40001 of https://codereview.chromium.org/1211453002/)
Reason for revert:
proxies test failing https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/903/steps/Mjsunit/logs/proxies

Original issue's description:
> Reland "Keep a canonical list of shared function infos."
>
> This reverts commit 3164aa7483.
>
> Committed: https://crrev.com/cacb646d80daa429f6915824a741f595db7d5044
> Cr-Commit-Position: refs/heads/master@{#29282}

TBR=adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1206263002

Cr-Commit-Position: refs/heads/master@{#29285}
2015-06-25 10:35:12 +00:00
yangguo
cacb646d80 Reland "Keep a canonical list of shared function infos."
This reverts commit 3164aa7483.

Review URL: https://codereview.chromium.org/1211453002

Cr-Commit-Position: refs/heads/master@{#29282}
2015-06-25 09:09:44 +00:00
machenbach
93d130ce70 Revert of Fix receiver when calling eval() bound by with scope (patchset #3 id:40001 of https://codereview.chromium.org/1202963005/)
Reason for revert:
[Sheriff] Breaks layout tests. Please fix upstream blink first.
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/574

Please consider extra blink trybots on a reland.

Original issue's description:
> Fix receiver when calling eval() bound by with scope
>
> Thanks to André Bargull for the report.
>
> BUG=v8:4214
> LOG=N
> R=arv@chromium.org, mstarzinger@chromium.org
>
> Committed: https://crrev.com/3c5f0db3a1768ade68108bf003676ce378d1cbdc
> Cr-Commit-Position: refs/heads/master@{#29259}

TBR=arv@chromium.org,mstarzinger@chromium.org,verwaest@chromium.org,wingo@igalia.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4214

Review URL: https://codereview.chromium.org/1201273004

Cr-Commit-Position: refs/heads/master@{#29267}
2015-06-24 19:08:35 +00:00
machenbach
3eae40d7a4 Revert of Extend big-disjunction optimization to case-independent regexps (patchset #5 id:80001 of https://codereview.chromium.org/1182783009/)
Reason for revert:
[Sheriff] Test times out now on msan:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/2947

Original issue's description:
> Extend big-disjunction optimization to case-independent regexps
>
> R=yangguo@chromium.org
> BUG=chromium:482998
> LOG=n
>
> Committed: https://crrev.com/d2135603bcf462e15a1284d8ed969f6692610dda
> Cr-Commit-Position: refs/heads/master@{#29264}

TBR=yangguo@chromium.org,erikcorry@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:482998

Review URL: https://codereview.chromium.org/1204013003

Cr-Commit-Position: refs/heads/master@{#29266}
2015-06-24 19:04:15 +00:00