Commit Graph

17653 Commits

Author SHA1 Message Date
Jakob Gruber
4ad4a8d725 Eager-deserialize in test-debug/BuiltinsExceptionPrediction
This test iterates all builtin objects; explicitly deserialize builtins
when necessary to avoid verifying DeserializeLazy by accident.

Bug: v8:6624
Change-Id: Iab3f708380809b7486ef11a2816e9593ee7e65cd
Reviewed-on: https://chromium-review.googlesource.com/654902
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49451}
2017-11-17 16:11:48 +00:00
Michael Achenbach
c13b62d7db Revert "[log] Properly log all maps creating during bootstrapping"
This reverts commit acfef3ec93.

Reason for revert: Makes logmaps timeout in nosnap mode:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/18933

Original change's description:
> [log] Properly log all maps creating during bootstrapping
> 
> Logger::LogMaps will print all maps currently present on the heap.
> 
> Note that currently this does not properly log the detailed transitions
> for these maps.
> 
> Change-Id: Ia3218d371549d7634fe3eda9e8e59b0b0bd8bebb
> Reviewed-on: https://chromium-review.googlesource.com/753885
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49444}

TBR=yangguo@chromium.org,cbruni@chromium.org

Change-Id: I264362552cbc2f8f0c1df84412f4dbeea08ef384
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/776815
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49447}
2017-11-17 13:38:54 +00:00
Camillo Bruni
acfef3ec93 [log] Properly log all maps creating during bootstrapping
Logger::LogMaps will print all maps currently present on the heap.

Note that currently this does not properly log the detailed transitions
for these maps.

Change-Id: Ia3218d371549d7634fe3eda9e8e59b0b0bd8bebb
Reviewed-on: https://chromium-review.googlesource.com/753885
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49444}
2017-11-17 12:55:51 +00:00
Predrag Rudic
e6d92f61e7 MIPS[64]: Skip regress-779407 test
This test uses 136GB of memory which is too much for our MIPS boards.

NOTRY=true

Bug: v8:7093
Change-Id: I382bf0832da6ae74241e89a2016c3738f03979fd
Reviewed-on: https://chromium-review.googlesource.com/776765
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49443}
2017-11-17 12:47:12 +00:00
Clemens Hammacher
4c420258d3 Revert "MIPS[64] Implementation of MSA instructions in builtin simulator"
This reverts commit 3e0bf580e8.

Reason for revert: MSVC does not compile any more, see https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20msvc/builds/172

Original change's description:
> MIPS[64] Implementation of MSA instructions in builtin simulator
> 
> This commit is a step toward enabling test-run-wasm-simd tests for MIPS.
> 36 of those were failing in V8 builtin simulator because some instructions
> were not implemented.  Also there are minor fixes to some of the already
> implemented instructions.
> 
> This commit has only 32-bit implementation. After review I will add
> 64-bit version.
> 
> Bug: 
> Change-Id: I25b0cac352db3efb56b922ace64ab2aaef82472d
> Reviewed-on: https://chromium-review.googlesource.com/744008
> Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
> Cr-Commit-Position: refs/heads/master@{#49439}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org,mlippautz@chromium.org,bmeurer@chromium.org,predrag.rudic@mips.com,ivica.bogosavljevic@mips.com,Ilija.Pavlovic@mips.com,sreten.kovacevic@mips.com,Miran.Karic@imgtec.com

Change-Id: Ic0c6339473481fa75908e942bc86de2b5c6349d8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/776655
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49441}
2017-11-17 11:02:48 +00:00
Predrag Rudic
3e0bf580e8 MIPS[64] Implementation of MSA instructions in builtin simulator
This commit is a step toward enabling test-run-wasm-simd tests for MIPS.
36 of those were failing in V8 builtin simulator because some instructions
were not implemented.  Also there are minor fixes to some of the already
implemented instructions.

This commit has only 32-bit implementation. After review I will add
64-bit version.

Bug: 
Change-Id: I25b0cac352db3efb56b922ace64ab2aaef82472d
Reviewed-on: https://chromium-review.googlesource.com/744008
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#49439}
2017-11-17 10:24:15 +00:00
Adam Klein
6e39c9e1a7 Remove always-on flag --harmony-strict-legacy-accessor-builtins
It was shipped in Chrome 62.

Bug: v8:5070
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I77119540411d1fe15691d40012cb96f4e2e45048
Reviewed-on: https://chromium-review.googlesource.com/776154
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49434}
2017-11-17 04:06:30 +00:00
Jakob Kummerow
b5997de8a9 [bigint] Fix accidental input modification in Divide
"AbsoluteDivSmall" had a shortcut path for abs(divisor) == 1 where
it would simply return the dividend as result. However, its caller
"Divide" was blissfully ignorant of this trick and would therefore
simply set the value's sign as needed, modifying the input.
This CL prevents that, while continuing to avoid the full division
algorithm for abs(divisor) == 1.

Bug: v8:6791
Change-Id: I04cdc93f5ed2a696587c35c754e68f07012dd1a9
Reviewed-on: https://chromium-review.googlesource.com/772332
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49433}
2017-11-17 01:50:50 +00:00
Bill Budge
0df1471ac6 [Memory] Add base::OS::SetPermissions method.
- Adds SetPermissions method which returns bool result.
- Eliminates Guard, SetReadAndWritable, SetReadAndExecutable, and
  SetReadWriteAndExecutable methods.
- Adds some Fuchsia memory allocation implementation.
- Some minor fixes in usage of OS::AllocatePageSize and
  OS::CommitPageSize.
- Adds DCHECKs for sanitizing parameters to OS::Allocate/Free.

Bug: chromium:756050
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I966ec6f029dd0371d70eca20bae197d87956f8b5
Reviewed-on: https://chromium-review.googlesource.com/760657
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49430}
2017-11-16 20:09:12 +00:00
Tobias Tebbi
19ac10e58a Reland^6 "[turbofan] eagerly prune None types and deadness from the graph"
Reland of https://chromium-review.googlesource.com/c/v8/v8/+/727893
The crashes should be fixed by https://chromium-review.googlesource.com/c/v8/v8/+/763531

Original change's description:
> Revert "Reland^5 "[turbofan] eagerly prune None types and deadness from the graph""
> 
> This reverts commit ac0661b358.
> 
> Reason for revert: Clusterfuzz unhappy: chromium:783019 chromium:783035
> 
> Original change's description:
> > Reland^5 "[turbofan] eagerly prune None types and deadness from the graph"
> >
> > This gives up on earlier attempts to interpret DeadValue as a signal of
> > unreachable code. This does not work because free-floating dead value
> > nodes, and even pure branch nodes that use them, can get scheduled so
> > early that they get reachable. Instead, we now eagerly remove branches
> > that use DeadValue in DeadCodeElimination and replace DeadValue inputs
> > to value phi nodes with dummy values.
> >
> > Reland of https://chromium-review.googlesource.com/715716
> >
> > Bug: chromium:741225 chromium:776256
> > Change-Id: I251efd507c967d4a8882ad8fd2fd96c4185781fe
> > Reviewed-on: https://chromium-review.googlesource.com/727893
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#49188}
> 
> TBR=jarin@chromium.org,tebbi@chromium.org
> 
> Bug: chromium:741225 chromium:776256 chromium:783019 chromium:783035
> Change-Id: I6a8fa3a08ce2824a858ae01817688e63ed1f442e
> Reviewed-on: https://chromium-review.googlesource.com/758770
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49262}

TBR=jarin@chromium.org,tebbi@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:741225 chromium:776256 chromium:783019 chromium:783035
Change-Id: I6c02b4beb02997ec34015ed2f6791a93c70f5e36
Reviewed-on: https://chromium-review.googlesource.com/772150
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49429}
2017-11-16 20:01:22 +00:00
Tobias Tebbi
82271defd6 [turbofan] fix typing and lowering of SpeculativeSafeInteger{Add,Subtract}
Bug: 
Change-Id: Ibd7c17b4ace25237c3d35466280aff27c44016f0
Reviewed-on: https://chromium-review.googlesource.com/774461
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49427}
2017-11-16 19:02:27 +00:00
Clemens Hammacher
6802775efc Reland "[wasm] Fix importing wasm-lazy-compile stubs"
This is a reland of 77b0baa649.

Original change's description:
> [wasm] Fix importing wasm-lazy-compile stubs
>
> If two modules use lazy compilation, and one imports a function of
> another, we are unwrapping the js-to-wasm wrapper of the export. This
> was failing so far, because during unwrapping we did not find the wasm
> code.
> This CL fixes this by also recognizing WasmCompileLazy stubs as "wasm
> code".
>
> R=ahaas@chromium.org
>
> Bug: chromium:779569, v8:5991
> Change-Id: If2260c3721e3746a7635b9d0182fd520df2fb773
> Reviewed-on: https://chromium-review.googlesource.com/771672
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49405}

Bug: chromium:779569, v8:5991
Change-Id: I4818e933467bd5a040f1514b8fc18db219a092c7
Reviewed-on: https://chromium-review.googlesource.com/774538
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49426}
2017-11-16 18:50:07 +00:00
Andreas Haas
d9a91da635 [inspector] Dispose the isolate in the inspector tests
At the moment the inspector tests do not dispose the isolate. This is a
problem because the disposal of the isolate is used to stop the
execution of background tasks. The missing disposal of the isolate
caused flaky tests on the bots recently. With this CL the isolates of
the inspector tests get disposed.

The disposal of the isolate requires the following changes: 1) Store the
isolate in a unique_ptr so that it gets disposed when the isolate-data
gets disposed. It is necessary to use the unique_ptr so that the isolate
gets disposed after other members of isolate-data get disposed.  2)
Dispose all sessions. The reason is that the sessions require the
isolate to exist when they get disposed because they own handles.
Sessions, however, are stored in a static map, whereas the isolate is
stored indirectly in a local variable of the main function. Since local
variables get disposed before the static map is cleared, we have to
clear the map before the end of the main function.

R=kozyatinskiy@chromium.org

Change-Id: Icb33184de254638b6cdfb899e940f18e6064cd69
Reviewed-on: https://chromium-review.googlesource.com/774885
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49424}
2017-11-16 17:42:37 +00:00
Clemens Hammacher
1cec66d31b [Liftoff] Don't force unrelated stack slots into registers
When initializing the stack state at a merge point, don't force all
stack slots into registers. Allow constants to stay constants as long
as they are not part of the merge. Otherwise we might break assumptions
of outer blocks which then try to merge a register into a constant and
fail.
Also, add some documentation to {InitMergeStackSlot} to document the
intent of the implementation.

R=titzer@chromium.org

Bug: v8:784050, v8:6600
Change-Id: I3a4c83b446909027be075d3207cb7c748a6b1aad
Reviewed-on: https://chromium-review.googlesource.com/766353
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49423}
2017-11-16 17:34:17 +00:00
Ross McIlroy
72575d3c67 [Compile] Move stepping logic from compilation job to compiler dispatcher.
Now that UnoptimizedCompileJob only has three stages, move the logic for
stepping between these stages out of UnoptimizedCompileJob and back into
CompilerDispatcher.

BUG=v8:5203

Change-Id: I3bb776e14ef9da801dc9792e9e643b8026135060
Reviewed-on: https://chromium-review.googlesource.com/774743
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49422}
2017-11-16 17:20:07 +00:00
Michal Majewski
430e03b3c6 Remove shell info from testcase.
Bug: v8:6917
Change-Id: Ic50ed8aca2ef6b6e60eae194cf46c2264a416657
Reviewed-on: https://chromium-review.googlesource.com/774265
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49417}
2017-11-16 15:42:26 +00:00
Michal Majewski
0a12eaea45 Remove env field from testcase.
Bug: v8:6917
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I09fb05ac6d4b9b1223118494ce2c89e3ab5de109
Reviewed-on: https://chromium-review.googlesource.com/771870
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#49415}
2017-11-16 15:26:06 +00:00
Michael Starzinger
b8b622c94a [builtins] Set {builtin_index} during code allocation.
This ensures that the {Code::builtin_index} field is only set during
allocation of new {Code} objects, making this field truly immutable.

R=jgruber@chromium.org
BUG=v8:6792

Change-Id: Ic793346976183149e2d077e92cb9da3c925ea865
Reviewed-on: https://chromium-review.googlesource.com/774439
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49414}
2017-11-16 13:56:49 +00:00
Ross McIlroy
8ff0ca1b1c [Compiler] Simplify UnoptimizedCompileJob
Simplifies the unoptimized compile job to have only three steps, the
on-main-thread prepare step, the off-thread compile step and the
on-main-thread finalization step.

As part of this change, the compiler dispatcher no longer supports
functions with outer scopeinfo's, since these need to be analysed on the
main thread.

BUG=v8:5203

Change-Id: Ifb378ef81bd47b6f6d4037a3b8acf88660896c4e
Reviewed-on: https://chromium-review.googlesource.com/774558
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49413}
2017-11-16 13:31:37 +00:00
Hannes Payer
6c431dde20 [heap] Always allocate executable MemoryChunks rw.
This CL also narrows the rw scopes on various call sites.

Bug: chromium:774108,v8:6792
Change-Id: I41a6f5dc4948833baaa441fb998ef40d8a832619
Reviewed-on: https://chromium-review.googlesource.com/758370
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49411}
2017-11-16 12:34:48 +00:00
Daniel Clifford
4002bf96e3 Fix hole escape in dictionary mode Array.prototype.slice()
Bug: chromium:778668
Change-Id: I0d2cc2166aab93bb7cb5dcc6c72cdb0b335a655f
Reviewed-on: https://chromium-review.googlesource.com/774263
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49410}
2017-11-16 12:17:58 +00:00
Clemens Hammacher
0d5d2a1ede Revert "[wasm] Fix importing wasm-lazy-compile stubs"
This reverts commit 77b0baa649.

Reason for revert: Breaks on win64 bot: https://logs.chromium.org/v/?s=chromium%2Fbb%2Fclient.v8%2FV8_Win64_-_debug%2F20172%2F%2B%2Frecipes%2Fsteps%2FCheck%2F0%2Flogs%2Flazy-compilation%2F0

Original change's description:
> [wasm] Fix importing wasm-lazy-compile stubs
> 
> If two modules use lazy compilation, and one imports a function of
> another, we are unwrapping the js-to-wasm wrapper of the export. This
> was failing so far, because during unwrapping we did not find the wasm
> code.
> This CL fixes this by also recognizing WasmCompileLazy stubs as "wasm
> code".
> 
> R=​ahaas@chromium.org
> 
> Bug: chromium:779569, v8:5991
> Change-Id: If2260c3721e3746a7635b9d0182fd520df2fb773
> Reviewed-on: https://chromium-review.googlesource.com/771672
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49405}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: If5ab7b9de95ef662a65a6a5b919fa1f13aa492cd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:779569, v8:5991
Reviewed-on: https://chromium-review.googlesource.com/774518
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49409}
2017-11-16 12:07:36 +00:00
Sathya Gunasekaran
3cf3259973 [class] Lazy parse class constructor with class fields
Previously, we had lazy parsing of class constructor disabled when a
class literal had class fields because we were using a reference to
the initializer function variable to load the function and call it.

Instead, in this patch, we use the scope analysis to lookup this
initializer function variable.

Bug: v8:5367
Change-Id: Ib73d7e6abed33c04d1f574e7976bea4869d54757
Reviewed-on: https://chromium-review.googlesource.com/768384
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49406}
2017-11-16 11:18:04 +00:00
Clemens Hammacher
77b0baa649 [wasm] Fix importing wasm-lazy-compile stubs
If two modules use lazy compilation, and one imports a function of
another, we are unwrapping the js-to-wasm wrapper of the export. This
was failing so far, because during unwrapping we did not find the wasm
code.
This CL fixes this by also recognizing WasmCompileLazy stubs as "wasm
code".

R=ahaas@chromium.org

Bug: chromium:779569, v8:5991
Change-Id: If2260c3721e3746a7635b9d0182fd520df2fb773
Reviewed-on: https://chromium-review.googlesource.com/771672
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49405}
2017-11-16 11:16:58 +00:00
Clemens Hammacher
22e4c4613b [wasm] [interpreter] Fix interpreter-to-wasm calls
When calling the CWasmEntry in order to call from the interpreter to a
wasm function, the given buffer must hold the arguments, and must also
have enough space to hold the return values. We were missing the second
part, hence we failed when there are no parameters, but a return.

R=ahaas@chromium.org

Bug: chromium:784125
Change-Id: I08d417cae60eea64fda8a72e898dbed9f3e88148
Reviewed-on: https://chromium-review.googlesource.com/771633
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49402}
2017-11-16 11:13:43 +00:00
peterwmwong
0a66361d7c [js-perf-test] Add Collection constructor and double type microbenchmarks
- Add {Map/Set/WeakMap/WeakSet}-Constructor microbenchmarks
- Add {Map/Set}-Double microbenchmarks (testing heap number keys)

Bug: v8:6604
Change-Id: Icadd5c81bfb59a58a2a65e119663d3f22637165d
Reviewed-on: https://chromium-review.googlesource.com/773595
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49398}
2017-11-16 07:21:05 +00:00
peterwmwong
007203abd0 [collections] Handle holes in collection constructor fast paths
Bug: chromium:784990
Change-Id: I08c10ec706ccaba765edc7322dc92374863b8a7a
Reviewed-on: https://chromium-review.googlesource.com/771387
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49397}
2017-11-16 06:59:25 +00:00
Benedikt Meurer
3dddc2b50f [ic] Properly handle negative indices.
We need to explicitly rule out negative indices for the out-of-bounds
case, otherwise we can end up with a monomorphic KeyedLoadIC that allows
OOB accesses, but doesn't properly check whether there are properties
with negative integer names on the receiver.

Bug: chromium:784835
Change-Id: Ic3ef5438b76094f024de0c6348183fb62b32088c
Reviewed-on: https://chromium-review.googlesource.com/774278
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49396}
2017-11-16 06:56:25 +00:00
jing.bao
69ab034892 [ia32][wasm] Add I16x8 Binop and CompareOp.
Mul/MinS/MaxS/AddSaturateU/SubSaturateU/MinU/MaxU, Eq/Ne

Bug: 
Change-Id: I197712c37dcbc6648be5fd040ca23f2ea777a4f3
Reviewed-on: https://chromium-review.googlesource.com/760156
Commit-Queue: Jing Bao <jing.bao@intel.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49395}
2017-11-16 02:40:35 +00:00
Georgia Kouveli
1adce94ab3 [arm64] Add CopyDoubleWordsMode option to CopyDoubleWords.
The option lets us use the function in cases where we cannot use the current
version due to restrictions on src and dst. This will be useful for some arm64
builtins when we pad the stack arguments, where we will need to copy the
existing arguments either one slot up or one slot down in memory.

Bug: v8:6644
Change-Id: I75281cdc9fa6812e3b24bf5756057c93305cbb95
Reviewed-on: https://chromium-review.googlesource.com/771711
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#49394}
2017-11-15 19:03:47 +00:00
Alexey Kozyatinskiy
11e635bd19 [inspector] followup with adding missing entry to JSTests.json
TBR=jgruber@chromium.org

Bug: v8:7078
Change-Id: I032bb6c8a9d1079ac9d8f69f6bef3de32f6e78ca
Reviewed-on: https://chromium-review.googlesource.com/772250
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49393}
2017-11-15 18:52:37 +00:00
Clemens Hammacher
b46cc820ba [wasm] compile fuzzer: Also generate loops
Beside blocks, do also generate loops.
Also, generalize generation of breaks such that they can happen
anywhere, even outside of a block or loop.

R=eholk@chromium.org

Change-Id: Ib2f8c75913e97f331ec105fd87fc882bc5c04864
Reviewed-on: https://chromium-review.googlesource.com/771610
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49392}
2017-11-15 17:44:05 +00:00
Ross McIlroy
aafdfba899 [Compiler] Remove isolate from CompilationInfo.
Removes Isolate from compilation info and instead threads isolate through
function calls. This ensures that we can't access the isolate from
background thread compilations.

BUG=v8:5203

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9a4e1cd67c4736e36f609360b996fb55166a1c50
Reviewed-on: https://chromium-review.googlesource.com/751745
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49386}
2017-11-15 15:40:55 +00:00
Andreas Haas
1031b5e75f [platform] Add TaskRunners to the TestPlatform
R=rmcilroy@chromium.org

Change-Id: I8c62ab212d9b741a5413b075ecbebee515161d6f
Reviewed-on: https://chromium-review.googlesource.com/771831
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49385}
2017-11-15 15:04:14 +00:00
Andreas Haas
859af1b734 [wasm] Add task runner to the platform in the streaming compilation cctests
The foreground task runner and the background task runner are the same.
Thereby we can get predictable behavior.

R=clemensh@chromium.org

Change-Id: I18f9c7277a344b7884d6de0c2159cc3f010576b4
Reviewed-on: https://chromium-review.googlesource.com/771833
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49383}
2017-11-15 14:47:24 +00:00
Toon Verwaest
8123f5c3c7 [csa] Type CSA code related to String length accesses
Bug: v8:7065
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I7882b719f72561cd22b874eae239000936fad35c
Reviewed-on: https://chromium-review.googlesource.com/768874
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49381}
2017-11-15 12:59:04 +00:00
Andreas Haas
0ef8da2664 [wasm] Check code section bytes in the streaming decoder
The streaming decoder allocates the whole section buffer of the code
section when it reads the section length of the code section. Therefore
we have to check that the different parts of the code section actually
use all the bytes, and that the different parts of the code section do
not need more bytes than available. The check that all bytes are used
was missing in the case where the code section contained zero functions.

In addition, this CL adds some tracing to the streaming decoder which
may be useful in future debugging.

R=clemensh@chromium.org

Bug: chromium:783595
Change-Id: Icf056c25a3000b4a08a791939dab0ccde9fc3f80
Reviewed-on: https://chromium-review.googlesource.com/768788
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49380}
2017-11-15 12:42:54 +00:00
Andreas Haas
8a1bafaf1a Reland "[platform] Implement TaskRunners in the DefaultPlatform"
There was a data race in the access of the foreground_task_runner_map_.
I protect each access to foreground_task_runner_map_ with a lock now.

Original change's description:
> [platform] Implement TaskRunners in the DefaultPlatform
>
> This CL implements the TaskRunners in the DefaultPlatform which has been
> added recently to the platform API. In addition I changed how task
> posting works on the DefaultPlatform.
>
> With this implementation the DefaultPlatform keeps one
> DefaultForegroundTaskRunner per isolate, plus one
> DefaultBackgroundTaskRunner. The DefaultPlatform owns these TaskRunners
> with a shared_ptr, which is also shared with any caller of
> GetForegroundTaskRunner or GetBackgroundTaskrunner.
>
> This CL moves the task management from the DefaultPlatform to the
> TaskRunners.  The DefaultForegroundTaskRunner owns and manages the the
> task queue, the delayed task  queue, and the idle task queue. The
> DefaultBackgroundTaskRunner owns the WorkerThread pool and the
> background task queue.
>
> In addition changed many Task* to std::unique_ptr<Task> to document task
> ownership.
>
> R=rmcilroy@chromium.org
>
> Change-Id: Ib9a01f1f45e5b48844a37d801f884210ec3f6c27
> Reviewed-on: https://chromium-review.googlesource.com/753583
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49354}

Change-Id: Iddccdb07bde1a799815ec6ed6af37082df4987c7
Reviewed-on: https://chromium-review.googlesource.com/770970
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49379}
2017-11-15 12:35:54 +00:00
Jakob Gruber
271ffdb0f7 [collections] Allocate large collections in large object space
The backing store fixed array for collections needs to be allocated
in LOS if it exceeds the maximum regular heap object size.

Drive-by-fix: Only store fixed array map once as per TODO.

Bug: chromium:784862
Change-Id: I6b4dd2e45153ae107171e21bc7448e0d9b54b0ed
Reviewed-on: https://chromium-review.googlesource.com/771150
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49378}
2017-11-15 12:08:35 +00:00
Tobias Tebbi
9e92289536 [turbofan] Escape analysis no longer introduces Dead nodes in unreachable code.
Bug: chromium:780658
Change-Id: Ie1252a4e4e8ae8621817ab8c058715dcc3cef7d9
Reviewed-on: https://chromium-review.googlesource.com/769507
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49377}
2017-11-15 11:16:01 +00:00
Ross McIlroy
2f5d90a816 [d8] Add a stress-background-compile mode
Adds a stress-background-compile mode which runs compilation on a background
thread at the same time as compiling on the main thread to flush out races.
This is added as one of the variants, removing stress_asm_validation since this
is no longer a useful variant.

BUG=v8:5203

Change-Id: I73dd9f21d9b6da4a4cb39c05061aa24116e6c5ad
Reviewed-on: https://chromium-review.googlesource.com/741746
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49376}
2017-11-15 11:08:21 +00:00
Michael Starzinger
d80d85bfc1 [heap] Introduce {Movability} enum for type safety.
R=mlippautz@chromium.org

Change-Id: Ie5ff0347d7c849e1941f8c8237a0bd56fdb68a4e
Reviewed-on: https://chromium-review.googlesource.com/768672
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49372}
2017-11-15 10:11:26 +00:00
Adam Klein
082009fc3d [parser] RewritableExpressions should keep track of their Scope directly
Previously, the Parser stored a Scope alongside a RewritableExpression
for each potential destructuring assignment. This Scope was later used
during rewriting to set the correct context for the rewriting. But this
approach failed if a new Scope was inserted into the Scope chain between
the time the assignment was parsed and when it was rewritten.

By storing the Scope directly in RewritableExpression,
ReparentExpressionScopes() is able to appropriately re-scope such
expressions prior to their rewriting.

Bug: chromium:779457
Change-Id: Ieb429a3da841f76d5798610af59da4fccb000652
Reviewed-on: https://chromium-review.googlesource.com/767666
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49368}
2017-11-14 20:30:14 +00:00
Alexey Kozyatinskiy
7345bfcc21 [inspector] perf test for inspector async instrumentation
Prior langing massive async instrumentation refactoring let's add a perf
test to track our progress.

R=dgozman@chromium.org

Bug: v8:7078
Change-Id: I11e1ec962a9f384c2c778061c48935ac410fbe53
Reviewed-on: https://chromium-review.googlesource.com/766647
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49365}
2017-11-14 19:06:15 +00:00
Bill Budge
adc52af506 Reland "[Memory] Use OS::Allocate for all OS memory allocations."
This is a reland of 4899bcb66d
This is a reland of b73ee3344a

Original change's description:
> [Memory] Use OS::Allocate for all OS memory allocations.
>
> - Eliminates OS::ReserveRegion and OS::ReserveAlignedRegion.
> - Changes OS::Allocate to take alignment parameter, reorders parameters
>   to match page_allocator.
> - Since the size of memory allocation can be deduced, don't return the
>   amount of memory allocated.
> - Changes reservation of aligned address space. Before we would reserve
>   (size + alignment) rounded up to page size. This is too much, because
>   maximum misalignment is (alignment - page_size).
> - On Windows and Cygwin, we release an oversize allocation and
>   immediately retry at the aligned address in the allocation. If we
>   lose the address due to a race, we just retry.
> - Clean up all the calls to OS::Allocate in codegen and tests by adding
>   helper AllocateSystemPage function (allocation.h) and
>   AllocateAssemblerBuffer (cctest.h).
> - Changes 'assm' to 'masm' in some targets for consistency when using
>   a macro-assembler.
>
> - Eliminates OS::ReleaseRegion, replacing with calls to OS::Free.
> - Adds bool return value to OS::Free.
> - Cleans up types of flags, protection on Windows and Cygwin.

> Bug: chromium:756050
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I306dbe042cc867670fdc935abca29db074b0da71

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iad3c025334e8f8d7d647be99a36a11ee449c9087
Reviewed-on: https://chromium-review.googlesource.com/767014
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49363}
2017-11-14 17:21:58 +00:00
Michael Achenbach
c56cff2359 Revert "[platform] Implement TaskRunners in the DefaultPlatform"
This reverts commit 8de2e6db02.

Reason for revert: Suspect for:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/24237
https://build.chromium.org/p/client.v8/builders/V8%20Win64/builds/20896

Original change's description:
> [platform] Implement TaskRunners in the DefaultPlatform
> 
> This CL implements the TaskRunners in the DefaultPlatform which has been
> added recently to the platform API. In addition I changed how task
> posting works on the DefaultPlatform.
> 
> With this implementation the DefaultPlatform keeps one
> DefaultForegroundTaskRunner per isolate, plus one
> DefaultBackgroundTaskRunner. The DefaultPlatform owns these TaskRunners
> with a shared_ptr, which is also shared with any caller of
> GetForegroundTaskRunner or GetBackgroundTaskrunner.
> 
> This CL moves the task management from the DefaultPlatform to the
> TaskRunners.  The DefaultForegroundTaskRunner owns and manages the the
> task queue, the delayed task  queue, and the idle task queue. The
> DefaultBackgroundTaskRunner owns the WorkerThread pool and the
> background task queue.
> 
> In addition changed many Task* to std::unique_ptr<Task> to document task
> ownership.
> 
> R=​rmcilroy@chromium.org
> 
> Change-Id: Ib9a01f1f45e5b48844a37d801f884210ec3f6c27
> Reviewed-on: https://chromium-review.googlesource.com/753583
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49354}

TBR=rmcilroy@chromium.org,ahaas@chromium.org

Change-Id: I6c381915a2cae8ea1a0d21d6cfa6e797ccd2d947
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/768748
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49357}
2017-11-14 14:51:16 +00:00
Andreas Haas
8de2e6db02 [platform] Implement TaskRunners in the DefaultPlatform
This CL implements the TaskRunners in the DefaultPlatform which has been
added recently to the platform API. In addition I changed how task
posting works on the DefaultPlatform.

With this implementation the DefaultPlatform keeps one
DefaultForegroundTaskRunner per isolate, plus one
DefaultBackgroundTaskRunner. The DefaultPlatform owns these TaskRunners
with a shared_ptr, which is also shared with any caller of
GetForegroundTaskRunner or GetBackgroundTaskrunner.

This CL moves the task management from the DefaultPlatform to the
TaskRunners.  The DefaultForegroundTaskRunner owns and manages the the
task queue, the delayed task  queue, and the idle task queue. The
DefaultBackgroundTaskRunner owns the WorkerThread pool and the
background task queue.

In addition changed many Task* to std::unique_ptr<Task> to document task
ownership.

R=rmcilroy@chromium.org

Change-Id: Ib9a01f1f45e5b48844a37d801f884210ec3f6c27
Reviewed-on: https://chromium-review.googlesource.com/753583
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49354}
2017-11-14 14:11:34 +00:00
Camillo Bruni
e634740bf9 [log] Support --log-function-events in the parser
This partially retires --trace-parse and --trace-preparse which will be fully removed in
a later CL.

Drive-by-fix: make the Parser constructor arguments order more
consistent.

Bug: chromium:757467
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I80a688ce553adfa65ad346718604bd53a9e606a9
Reviewed-on: https://chromium-review.googlesource.com/744046
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49350}
2017-11-14 10:36:58 +00:00
Andreas Haas
ffee558e14 [cleanup] use unique_ptr for the DefaultPlatform
With this CL, {CreateDefaultPlatform} returns a unique_ptr to indicate
that the caller owns the returned memory. We had several memory leaks
where the memory of the DefaultPlatform did not get deallocated.

In addition, the {TracingController} of the {DefaultPlatform} also gets
received as a unique_ptr. Thereby we document that the {DefaultPlatform}
takes ownership of the {TracingController}. Note that the memory of the
{TracingController} was already owned by the {DefaultPlatform}, but it
was not documented in the interface, and it was used incorrectly in
tests.

This CL fixes the asan issues in 
https://chromium-review.googlesource.com/c/v8/v8/+/753583	
([platform] Implement TaskRunners in the DefaultPlatform)

R=rmcilroy@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I0d1a6d3b22bb8289dc050b1977e4f58381cec675
Reviewed-on: https://chromium-review.googlesource.com/755033
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49349}
2017-11-14 09:57:18 +00:00
Camillo Bruni
6526c6dd10 [RCS] Add explicit tests for function callbacks
This CL adds a very crude unittest to check that RuntimeCallStats work
correctly with api callbacks present. This currently doesn't check that
all parent timers (namely FunctionCallback) are handled properly.

Drive-by-Fix:
- Use Microseconds for all RCS timer tests
- Add TestWithContext::SetGlobalProperty helper
- Use explicit v8:: prefix in test-utils.{h,cc}

Change-Id: I054e78abca0b87a3b9e07d3b06cccdad15403bae
Reviewed-on: https://chromium-review.googlesource.com/766429
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49348}
2017-11-14 09:48:08 +00:00