Commit Graph

7579 Commits

Author SHA1 Message Date
Andreas Rossberg
5614747680 [wasm] Fix index range checking in table accessors
R=titzer@chromium.org

Bug: 
Change-Id: Ib1a13b5131ec1b5a155c893de3c5ceb376bd33a3
Reviewed-on: https://chromium-review.googlesource.com/600227
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47139}
2017-08-03 16:11:42 +00:00
Adam Klein
9dd9419c38 Add test coverage for do-expressions in ReparentExpressionScope()
Change-Id: I42f51fd00b1a21a1ff7ef2379fbf81a42266a737
Reviewed-on: https://chromium-review.googlesource.com/599111
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47137}
2017-08-03 16:07:41 +00:00
Andreas Rossberg
439f1f6f80 [wasm] Fix string conversion of customSections name
R=titzer@chromium.org

Bug: v8:5815
Change-Id: Ied267a431ed294f022628169e811069f2a4851b1
Reviewed-on: https://chromium-review.googlesource.com/599875
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47133}
2017-08-03 14:40:59 +00:00
Andreas Rossberg
fa53a0dae7 [wasm] Fix API prototype chains
R=titzer@chromium.org

Bug: v8:6647
Change-Id: I73f19111b5c40988d57e9086852da902ba36acb2
Reviewed-on: https://chromium-review.googlesource.com/599872
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47128}
2017-08-03 12:35:48 +00:00
Ben L. Titzer
4754b211f6 [wasm][test] Avoid stack overflow that can happen with spread call to Array.push.
R=rossberg@chromium.org

Bug: 
Change-Id: I2401709b42106c7e325144b53be3c3b3d1ed16c7
Reviewed-on: https://chromium-review.googlesource.com/599874
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47127}
2017-08-03 12:33:28 +00:00
Michael Achenbach
c560d2e7d3 Revert "[builtins] Port getting property from Proxy to CSA"
This reverts commit 47a97aa53b.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug

Original change's description:
> [builtins] Port getting property from Proxy to CSA
> 
> Bug: v8:6559, v8:6557
> Change-Id: If6c51f5483adb73ddd2495cede5d85e887a3c298
> Reviewed-on: https://chromium-review.googlesource.com/589212
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@google.com>
> Cr-Commit-Position: refs/heads/master@{#47113}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org,franzih@chromium.org,ishell@chromium.org,bmeurer@chromium.org,mslekova@google.com

Change-Id: Id28e529d1d88f7589d4d66ef23b8b510a33a817b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6559, v8:6557
Reviewed-on: https://chromium-review.googlesource.com/600049
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47117}
2017-08-03 11:32:38 +00:00
Maya Lekova
47a97aa53b [builtins] Port getting property from Proxy to CSA
Bug: v8:6559, v8:6557
Change-Id: If6c51f5483adb73ddd2495cede5d85e887a3c298
Reviewed-on: https://chromium-review.googlesource.com/589212
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#47113}
2017-08-03 09:04:30 +00:00
Michael Starzinger
c8ee3fb405 [deoptimizer] Fix bogus DCHECK in OptimizedFrame::Summarize.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-751715
BUG=chromium:751715

Change-Id: Ibc5d2ce958b6f0c94b41926eb215e81d70833a9d
Reviewed-on: https://chromium-review.googlesource.com/598227
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47108}
2017-08-03 07:34:42 +00:00
Deepti Gandluri
ac774a36a7 [wasm] Implement atomic add/sub operations.
- Decode logic for atomic operations
 - Implementations for I32AtomicAdd, I32AtomicAdd8U, I32AtomicAdd16U,
I32AtomicSub, I32AtomicSub8U, I32AtomicSub16U
 - cctest value helpers for Uint16/Uint8 types

R=binji@chromium.org, bbudge@chromium.org, bradnelson@chromium.org

BUG=v8:6532

Change-Id: I710ee8ef566c5e33866afdf5b47375c2ea6fdbe6
Reviewed-on: https://chromium-review.googlesource.com/595241
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47102}
2017-08-02 22:59:18 +00:00
Ulan Degenbaev
5a506a9a97 Disable mjsunit/wasm/js-api on GC stress bots.
Bug: chromium:751825
No-Tree-Checks: true
Change-Id: I8e9e5c030dca001a8dc881d8fdeefa5c140f3792
Reviewed-on: https://chromium-review.googlesource.com/599047
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47101}
2017-08-02 22:57:24 +00:00
Karl Schimpf
ad49b7b433 Reland "Start migration of try/throw/catch to match proposal."
This is a reland of 470a10015d
Original change's description:
> Start migration of try/throw/catch to match proposal.
> 
> This CL does the first baby steps on moving the current (experimental)
> exception handling to match that of the WebAssembly proposal.
> 
> It does the following:
> 
> 1) Use exception tags instead of integers.
> 
> 2) Only handle empty exception signatures (i.e. no values associated
>    with the exception tag.
> 
> 3) Only handle one catch clause.
> 
> 4) Be sure to rethrow the exception if the exception tag does not match.
> 
> Note: There are many things that need to be fixed, and are too
> numerous to list here. However, the code should have TODO's on each
> missing parts of the implementation.
> 
> Also note that the code currently doesn't handle nested catch blocks,
> nor does it change the throw value being an integer. Rather, the
> integer value is still being thrown, and currently is the exception
> tag. Therefore, we don't build an exception object. This is the reason
> why this CL doesn't handle exceptions that pass values.
> 
> Also, the current implementation still can't handle multiple modules
> because tag resolution (between) modules has not be implemented yet.
> 
> Bug: v8:6577
> Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
> Reviewed-on: https://chromium-review.googlesource.com/591910
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47087}

Bug: v8:6577
Change-Id: I41c3309827c292cb787681a95aaef7cf9b931835
Reviewed-on: https://chromium-review.googlesource.com/598968
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47100}
2017-08-02 22:35:07 +00:00
Adam Klein
74edfccd45 Enable --harmony-strict-legacy-accessor-builtins by default
This behavior has been staged successfully without a bug report, and
has been shipped in the latest versions of Firefox and Safari.

Bug: v8:5070
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I084cae2cc303d6a213bd6789297b91656e162d6b
Reviewed-on: https://chromium-review.googlesource.com/595129
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47098}
2017-08-02 21:30:57 +00:00
Ulan Degenbaev
41daf8a579 Revert "Start migration of try/throw/catch to match proposal."
This reverts commit 470a10015d.

Reason for revert: GC stress bot failures.
https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Mac%20GC%20Stress/builds/14522


Original change's description:
> Start migration of try/throw/catch to match proposal.
> 
> This CL does the first baby steps on moving the current (experimental)
> exception handling to match that of the WebAssembly proposal.
> 
> It does the following:
> 
> 1) Use exception tags instead of integers.
> 
> 2) Only handle empty exception signatures (i.e. no values associated
>    with the exception tag.
> 
> 3) Only handle one catch clause.
> 
> 4) Be sure to rethrow the exception if the exception tag does not match.
> 
> Note: There are many things that need to be fixed, and are too
> numerous to list here. However, the code should have TODO's on each
> missing parts of the implementation.
> 
> Also note that the code currently doesn't handle nested catch blocks,
> nor does it change the throw value being an integer. Rather, the
> integer value is still being thrown, and currently is the exception
> tag. Therefore, we don't build an exception object. This is the reason
> why this CL doesn't handle exceptions that pass values.
> 
> Also, the current implementation still can't handle multiple modules
> because tag resolution (between) modules has not be implemented yet.
> 
> Bug: v8:6577
> Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
> Reviewed-on: https://chromium-review.googlesource.com/591910
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47087}

TBR=bradnelson@chromium.org,eholk@chromium.org,kschimpf@chromium.org

Change-Id: I01dc8c40cc1057333a988c1d275ce5f457b0cb64
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6577
Reviewed-on: https://chromium-review.googlesource.com/598847
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47090}
2017-08-02 19:19:20 +00:00
Deepti Gandluri
201bcba2c2 [wasm] Memory.grow(0) should return a new ArrayBuffer when the buffer is empty
R=ahaas@chromium.org

BUG=v8:6546

Change-Id: I2808b78cd047d875d4530c86cc079488a78e5ea1
Reviewed-on: https://chromium-review.googlesource.com/557355
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47088}
2017-08-02 18:02:22 +00:00
Karl Schimpf
470a10015d Start migration of try/throw/catch to match proposal.
This CL does the first baby steps on moving the current (experimental)
exception handling to match that of the WebAssembly proposal.

It does the following:

1) Use exception tags instead of integers.

2) Only handle empty exception signatures (i.e. no values associated
   with the exception tag.

3) Only handle one catch clause.

4) Be sure to rethrow the exception if the exception tag does not match.

Note: There are many things that need to be fixed, and are too
numerous to list here. However, the code should have TODO's on each
missing parts of the implementation.

Also note that the code currently doesn't handle nested catch blocks,
nor does it change the throw value being an integer. Rather, the
integer value is still being thrown, and currently is the exception
tag. Therefore, we don't build an exception object. This is the reason
why this CL doesn't handle exceptions that pass values.

Also, the current implementation still can't handle multiple modules
because tag resolution (between) modules has not be implemented yet.

Bug: v8:6577
Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
Reviewed-on: https://chromium-review.googlesource.com/591910
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47087}
2017-08-02 17:38:42 +00:00
jgruber
7ac416caf7 [coverage] Ensure that closing braces of functions are never uncovered
Consider:

function f() {
  return;
}

This CL ensures that the closing brace is considered as covered by
introducing a special case for open-ended range rewrites when the
parent range is the function range itself.

Bug: v8:6000, v8:6661
Change-Id: I0be307759967e9f4df245a4f367326a37dda86fd
Reviewed-on: https://chromium-review.googlesource.com/597651
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47079}
2017-08-02 12:03:39 +00:00
Benedikt Meurer
71012480b7 [runtime] Properly forward the "interesting symbol" bit.
This fixes a corner case of rewriting the transition trees, where the
"interesting symbols" bit was not properly forwarded.

Drive-by-fix: Introduce additional checking in Map::ConnectTransition to
make it easier for clusterfuzz to detect cases we might have missed.

R=mstarzinger@chromium.org

Bug: chromium:751109
Change-Id: I3f1a1e6232db9b3694064b3d4e9f37255b018acc
Reviewed-on: https://chromium-review.googlesource.com/597669
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47075}
2017-08-02 11:08:38 +00:00
Julien Brianceau
b41f857b9e Fix common misspellings
Bug: chromium:750830
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Icab7b5a1c469d5e77d04df8bfca8319784e92af4
Reviewed-on: https://chromium-review.googlesource.com/595655
Commit-Queue: Julien Brianceau <jbriance@cisco.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47072}
2017-08-02 09:35:28 +00:00
Michael Starzinger
54bee830dd [deoptimizer] Support materialization in frame summary.
This adds support to materialize objects when generating a frame summary
for an optimized frame via {OptimizedFrame::Summarize}. Note that this
means each summary might re-materialize objects and hence produce new
object identities every time. All use sites need to be able to cope with
such semantics.

R=jarin@chromium.org
BUG=v8:6586

Change-Id: I85c66ad3e7d247cd40f37a0a6e4391c0ee279706
Reviewed-on: https://chromium-review.googlesource.com/595745
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47067}
2017-08-02 08:44:25 +00:00
Caitlin Potter
ac6ed35a31 Reland "[async-iteration] implement spec-change to yield in async generators"
Per https://github.com/tc39/proposal-async-iteration/pull/102/files:

AsyncGeneratorResolve no longer unwraps a value component. Instead, the value is
unwrapped before the builtin call via Await, allowing Promise rejections to
affect the generator control flow.

Thus, all `yield <expr>` implicitly become `yield await <expr>`.

Additionally, `return <expr>` becomes `return await <expr>`. Finally, when the
generator is resumed with `.return()`, the parameter passed to .return() is
awaited before generator execution properly continues).

BUG=v8:6187, v8:5855
R=littledan@chromium.org, neis@chromium.org, adamk@chromium.org
TBR=rmcilroy@chromium.org, neis@chromium.org

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Id7718028fd555481f9f4ca0dbecfa788e3057c48
Reviewed-on: https://chromium-review.googlesource.com/594500
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#47058}
2017-08-01 18:39:26 +00:00
Enrico Bacis
9a3b2a76c2 [wasm] Add test for growing exported memory past maximum
The test TestExportImportedMemoryGrowMultipleInstances in
test/mjsunit/wasm/import-memory.js had a TODO about not taking into
account the maximum size for exported memory objects, thus permitting to
grow past thhe maximum specified in the exported memory object.

The check is already in place at wasm-objects.cc:266
(https://cs.chromium.org/chromium/src/v8/src/wasm/wasm-objects.cc?rcl=a01b55b548add5aec1d3d4d8fcdadfa01555c6ea&l=266).

This CL removes the TODO and asserts that growing past maximum for
exported objects fails.

R=ahaas@chromium.org, gdeepti@chromium.org

Change-Id: Ifa69e4e85e04bc2280b629cebb30d400cca9420f
Reviewed-on: https://chromium-review.googlesource.com/593948
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Enrico Bacis <enricobacis@google.com>
Cr-Commit-Position: refs/heads/master@{#47029}
2017-08-01 08:03:22 +00:00
Michael Achenbach
2d79d2c3a7 Revert "[async-iteration] implement spec-change to yield in async generators"
This reverts commit 409f84c93b.

Reason for revert: Breaks nosnap debug:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/14288

Original change's description:
> [async-iteration] implement spec-change to `yield` in async generators
> 
> Per https://github.com/tc39/proposal-async-iteration/pull/102/files:
> 
> AsyncGeneratorResolve no longer unwraps a value component. Instead, the
> value is unwrapped before the builtin call via Await, allowing Promise
> rejections to affect the generator control flow.
> 
> Thus, all `yield <expr>` implicitly become `yield await <expr>`.
> 
> Additionally, `return <expr>` becomes `return await <expr>`. Finally, when
> the generator is resumed with `.return()`, the parameter passed to .return()
> is awaited before generator execution properly continues).
> 
> BUG=v8:5855
> R=​littledan@chromium.org, neis@chromium.org, adamk@chromium.org
> 
> Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
> Change-Id: Ife084076c3ed434b5467e6aeba14082f8b410ad5
> Reviewed-on: https://chromium-review.googlesource.com/523844
> Commit-Queue: Caitlin Potter <caitp@igalia.com>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47011}

TBR=rmcilroy@chromium.org,adamk@chromium.org,yangguo@chromium.org,neis@chromium.org,littledan@chromium.org,gsathya@chromium.org,caitp@igalia.com

Change-Id: Ie6ad7e5410a3a89aab7a5dc68de36eb27b9354fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5855
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/593952
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47013}
2017-07-31 15:23:56 +00:00
Caitlin Potter
409f84c93b [async-iteration] implement spec-change to yield in async generators
Per https://github.com/tc39/proposal-async-iteration/pull/102/files:

AsyncGeneratorResolve no longer unwraps a value component. Instead, the
value is unwrapped before the builtin call via Await, allowing Promise
rejections to affect the generator control flow.

Thus, all `yield <expr>` implicitly become `yield await <expr>`.

Additionally, `return <expr>` becomes `return await <expr>`. Finally, when
the generator is resumed with `.return()`, the parameter passed to .return()
is awaited before generator execution properly continues).

BUG=v8:5855
R=littledan@chromium.org, neis@chromium.org, adamk@chromium.org

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ife084076c3ed434b5467e6aeba14082f8b410ad5
Reviewed-on: https://chromium-review.googlesource.com/523844
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47011}
2017-07-31 14:15:49 +00:00
Leszek Swirski
e47d175738 [sfi] Remove opt_count
Remove opt_count from SFI, which only had two real uses:

  1. Detecting OSR in tests -- replaced with a stack walk in
     %GetOptimizationStatus
  2. Naming optimization log files -- replaced with the
     optimization id

This allows us to remove a field from the SFI, moving the
bailout reason into the counters field.

As a drive-by, add optimization marker information (e.g.
marked for optimization) to the optimization status.

Change-Id: Id77deb5dd5439dfba058a7e1e1748de26b717d0d
Reviewed-on: https://chromium-review.googlesource.com/592028
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47009}
2017-07-31 13:18:49 +00:00
Clemens Hammacher
20d25f4036 Revert "[wasm] Allow for arbitrarily long error messages"
This reverts commit 072d0e3eb6.

Reason for revert: Performance regressions (https://crbug.com/749041).

Original change's description:
> [wasm] Allow for arbitrarily long error messages
> 
> We currently have a fixed limit of 256 characters for error messages
> generated in the decoder. However, we sometimes embed names in it,
> which makes it easy to generate a crash by using long names (e.g. for
> exports) in invalid wasm modules.
> This CL fixes this by switching to a stream based interface, allowing
> to pass arbitrary objects to be printed. With this interface, we can
> easily limit the length of output later.
> 
> R=​titzer@chromium.org
> 
> Bug: chromium:740023
> Change-Id: I2848c31c63a015157e2a3a9458b54e523060cd69
> Reviewed-on: https://chromium-review.googlesource.com/565282
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46860}

TBR=titzer@chromium.org,clemensh@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:740023, chromium:749041
Change-Id: I005a60d55dcf01d350230f8d98f715bab9c43886
Reviewed-on: https://chromium-review.googlesource.com/593807
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47008}
2017-07-31 13:00:54 +00:00
Ross McIlroy
3c31e109ea [Interpreter] Internalize AST before print-ast is triggered
Print AST needs access to the internalized strings, so make sure AST
is internalized before we print it.

BUG=v8:5203

Change-Id: Ia4995147feb7ec466523a0c4a89620749b23dcab
Reviewed-on: https://chromium-review.googlesource.com/593648
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47006}
2017-07-31 12:16:48 +00:00
Clemens Hammacher
f1fb4c1c23 Fix mjsunit.js failure output
The bug was introduced in a previous refactoring:
https://chromium-review.googlesource.com/c/455555/14/test/mjsunit/mjsunit.js

R=mstarzinger@chromium.org
CC=gsathya@chromium.org

Change-Id: I49d2797c3ba834c89011910a81cffd9e119e719f
Reviewed-on: https://chromium-review.googlesource.com/593612
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47004}
2017-07-31 11:23:28 +00:00
Tobias Tebbi
68fb62152a Reland2: [turbofan] staging new implementation of escape analysis
Reland of https://chromium-review.googlesource.com/c/591667/, removing thread-local variable

Bug: 
Change-Id: Ia9bc73be4a46a6bf052220726193c8b6634eb73e
Reviewed-on: https://chromium-review.googlesource.com/593559
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47001}
2017-07-31 10:01:07 +00:00
Jakob Gruber
793053fd76 [coverage] Don't skip collection if invocation_count is zero
Function-granularity coverage skips functions that are both uncovered
and have an uncovered parent. This optimization needs to be tweaked once
block coverage and incremental collection is in play, as it is possible
to have a function with invocation_count == 0 (i.e. uncovered at
function granularity) that still has relevant block-granularity
coverage.

Bug: v8:6000
Change-Id: I4cc81b8a6935aa58e29d383ed4fa749cbfe69352
Reviewed-on: https://chromium-review.googlesource.com/589508
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46991}
2017-07-31 07:56:28 +00:00
Tobias Tebbi
c87a3ddaf1 Revert "Reland: [turbofan] staging new implementation of escape analysis"
This reverts commit ccd8bb692b.

Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/Mac%20Release%20%28Intel%29/builds/2643

Original change's description:
> Reland: [turbofan] staging new implementation of escape analysis
> 
> Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall.
> 
> Bug: 
> Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe
> Reviewed-on: https://chromium-review.googlesource.com/591667
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46975}

TBR=jarin@chromium.org,tebbi@chromium.org

Change-Id: I30016fd8d71535c02bab8678b02147195c3e97a6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/591672
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46980}
2017-07-28 19:16:17 +00:00
Tobias Tebbi
ccd8bb692b Reland: [turbofan] staging new implementation of escape analysis
Reland of https://chromium-review.googlesource.com/c/565720, fixing compilation issues on the waterfall.

Bug: 
Change-Id: Ide4f1ea4470e946820edc990c9bf027f04844efe
Reviewed-on: https://chromium-review.googlesource.com/591667
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46975}
2017-07-28 14:29:34 +00:00
Tobias Tebbi
8616be0c94 Revert "[turbofan] staging new implementation of escape analysis"
This reverts commit d230b44f0c.

Reason for revert: compile errors on the waterfall

Original change's description:
> [turbofan] staging new implementation of escape analysis
> 
> Bug: 
> Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9
> Reviewed-on: https://chromium-review.googlesource.com/565720
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46966}

TBR=mstarzinger@chromium.org,jarin@chromium.org,tebbi@chromium.org

Change-Id: I73c3cb270d498aeb181e31bad04f1c73d5ca6741
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/591370
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46968}
2017-07-28 12:18:38 +00:00
Tobias Tebbi
d230b44f0c [turbofan] staging new implementation of escape analysis
Bug: 
Change-Id: Idebe4fa6d651a404a0dc1947ed4a34a8dc9707a9
Reviewed-on: https://chromium-review.googlesource.com/565720
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46966}
2017-07-28 11:45:25 +00:00
Leszek Swirski
1c02987d2d [compiler] Kill the deoptimized too many times bailout
With TurboFan, there should no longer be any deopt loops (aside from
bugs). So, the "too many deopts" bailout is no longer needed, at least
in its current form.

This fixes an issue where deopt counts are leaked between native
contexts, resulting in optimization being disabled unnecessarily.

Bug: v8:6402
Change-Id: Ia06374ae6b5c2d473bcdd8eef1284bf02766c2fb
Reviewed-on: https://chromium-review.googlesource.com/588894
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46961}
2017-07-28 10:08:29 +00:00
Mathias Bynens
f4b2b9bef7 Ship RegExp dotAll mode / s flag
Intent to ship:
https://groups.google.com/a/chromium.org/d/msg/blink-dev/0uSHjqvgAwQ/CqmFd6KNAwAJ

BUG=v8:6172

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I50fab93516065195b4e9eea0d3be14ccf935a04f
Reviewed-on: https://chromium-review.googlesource.com/589150
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46960}
2017-07-28 08:17:38 +00:00
jgruber
d4c1b2aaeb [coverage] Include catch and finally keywords in ranges
This includes the catch and finally keywords in the respective range.
For instance:

// Catch range previously:  |<--------->|
try { /* ... */ } catch (e) { /* ... */ }
// Now:           |<------------------->|

Bug: v8:6000
Change-Id: I1bd9f7fce8bb7de945da83ab512833841b9d956a
Reviewed-on: https://chromium-review.googlesource.com/586598
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46959}
2017-07-28 08:06:08 +00:00
Adam Klein
48a903eb3f Properly fix-up ClassLiterals in ReparentExpressionScope()
Everything inside a class lives inside the class scope, so
reparenting the class scope is the only operation that
should be done to ClassLiterals during reparenting.

Bug: chromium:740591
Change-Id: Ia5b96b44ff1ca6cfa274effb5a04651809bab9bd
Reviewed-on: https://chromium-review.googlesource.com/588054
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46951}
2017-07-27 18:22:57 +00:00
jgruber
ffeea0fe05 [coverage] Add continuation counters for catch and finally blocks
These counters handle cases in which the catch/finally block contains a jump
statement.

Bug: v8:6000
Change-Id: Ic83f11ee431edabe61f129c9abc3adc12a79c338
Reviewed-on: https://chromium-review.googlesource.com/586595
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46945}
2017-07-27 15:31:58 +00:00
Michael Starzinger
44f88dcd87 [turbofan] Fix missing callability check on Array callbacks
This fixes the second-order Array.prototype function {forEach} and {map}
to now perform a callability check of the given callback function. For
empty arrays it is observable whether such a check outside the loop has
been elided or not.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-747062
BUG=chromium:747062

Change-Id: I1bbe7f44b3b3d18e9b41ad0436975434adf84321
Reviewed-on: https://chromium-review.googlesource.com/588893
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46942}
2017-07-27 14:49:58 +00:00
Michael Starzinger
e398bf81d7 [test] Remove deprecated "fullcode" test variant.
Note that this also renames the existing "asm_wasm" variant to use the
more appropriate "stress_asm_wasm" name.

R=rmcilroy@chromium.org
BUG=v8:6409

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I1f9550cd03874c678f4583047a4e123a6f090250
Reviewed-on: https://chromium-review.googlesource.com/584879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46937}
2017-07-27 14:01:03 +00:00
Mike Stanton
950e4f4631 [TurboFan] Improved unit test for optimized Array.prototype.map.
Test mjsunit/optimized-map walked an array through different
ElementsKind transitions, but it failed to verify that the
expected ElementsKind was in place. Although we have a regression
test for the bug, it's a good idea to make sure the basic
test covers all paths.

Bug: chromium:747075
Change-Id: I1424880801857f3356bfd63839d351d6fd1521e0
Reviewed-on: https://chromium-review.googlesource.com/584837
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46933}
2017-07-27 12:39:44 +00:00
Juliana Franco
337f38e0ec Deoptimizer tests
Adding (very) small tests for deoptimization.
Some of these tests were failing when the safepoints were not found,
after setting the return address.

BUG=V8:6563

Change-Id: I3af36b193a5982cd73414cc1884c5f0a7a727f5a
Reviewed-on: https://chromium-review.googlesource.com/584751
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Cr-Commit-Position: refs/heads/master@{#46922}
2017-07-27 07:21:46 +00:00
Igor Sheludko
10e4fe3d32 [runtime] Don't create class field types for arrays' fields.
... when generalizing const fields to mutable fields.

Bug: chromium:748539, chromium:747979, chromium:738763
Change-Id: Iee772a5d0cddd23599f1f68bca00b8beecb76da0
Reviewed-on: https://chromium-review.googlesource.com/586709
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46921}
2017-07-27 07:11:05 +00:00
Sathya Gunasekaran
61ed6a0088 [tests] Async test framework
- No need for multiple assertAsyncRan() calls, just do t.plan(count)

- Previously, if you forget to call assertAsyncRan(), the test will still
  pass, which is no longer true.

- No longer hold global state (with
  asyncAssertsExpected). Previously if one assert wasn't hit then
  there's no way to find out which test failed. You'd have to
  comment each test and try again.

- Each test runs independently in the microtask queue.

- Better failure reporting by printing the entire function.

Example error :
=== mjsunit/harmony/promise-prototype-finally ===
abort: Expected asserts: 2, Actual asserts: 1
in test: reject/finally/then
assert => {
  assert.plan(2);
  Promise.reject(3).finally().then(
    assert.unreachable,
    x => {
      assert.equals(3, x);
    });
}


Change-Id: Ic3f6272e1e87b8b0121b8c8c7cce19cf90d1f1be
Reviewed-on: https://chromium-review.googlesource.com/455555
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#46910}
2017-07-26 17:40:15 +00:00
Ben L. Titzer
7a0898c727 [wasm][test] Integrate improvements to wasm-module-builder.js from spec repo.
R=ahaas@chromium.org

Bug: 
Change-Id: Ic2331617624ce724ba33e07a1a42ebe2549f8054
Reviewed-on: https://chromium-review.googlesource.com/586547
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46903}
2017-07-26 14:28:56 +00:00
Alexandre Talon
231bb1a2ec [Turbofan] Merged the OSR phase into the graph building phase (reland)
Reland of https://chromium-review.googlesource.com/c/543042/.

Now the OSR phase is only used when OSRing from the ast graph builder.
When OSRing from Turbofan, the implementation is now in the graph
building phase, at the beginning of the VisitBytecode function.
We are no longer generating any OSRLoopEntry or OSRNormalEntry nodes,
nor nodes for the possible code of the OSRed function which is before
the OSRed loops.

The trimming and reducing of the OSR phase is not done either. This
change in the way the way the OSR is done enabled to remove the
workaround to the bug mentioned below.

Bug: v8:6112
Bug: v8:6518
Change-Id: Ia02f2138f54fc79cab2f02fed68d9bb522d6ce14
Reviewed-on: https://chromium-review.googlesource.com/584756
Commit-Queue: Alexandre Talon <alexandret@google.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46899}
2017-07-26 13:15:16 +00:00
Peter Marshall
8315422762 [runtime] Check for overflow when serializing Strings for JSON.
Previously we would shift the length of the string by three, which
could overflow with the new larger string length limit. Now we check
that the length will fit without extra allocation before and after
the shift, because really large strings will never fit, and will
always go to the Checked case.

Bug: chromium:748069, v8:6148
Change-Id: I41cac14b0fde6c5e8ca92305a052cbb743111554
Reviewed-on: https://chromium-review.googlesource.com/584611
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46896}
2017-07-26 11:40:56 +00:00
Ben L. Titzer
cbd8d67f3e [wasm][test] Remove non-standard S128 from wasm-constants.js
This brings the wasm-constants.js file inline with that (forked copy) in
the WebAssembly spec repo, which should make it easier to export tests
from V8 to the spec in the future.

R=clemensh@chromium.org

Bug: 
Change-Id: I7db23efc2d671f65b614f9dbc97ae2f355f91b04
Reviewed-on: https://chromium-review.googlesource.com/586248
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46894}
2017-07-26 10:49:22 +00:00
jgruber
dc7abf3e21 [coverage] Support Yield and Async
The yield* statement when used in combination with async iterators is not
supported yet, as that is desugared into a more complex construct that doesn't
offer a good dedicated bytecode to attach the source range information yet.

Note that invocation counts of generator functions are incorrect as they count
each resumption as an individual call. See https://crbug.com/v8/6594.

Bug: v8:6000
Change-Id: I7ac7073473c9b64bb207cdbc4dab083ec1145656
Reviewed-on: https://chromium-review.googlesource.com/582690
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46890}
2017-07-26 09:04:42 +00:00
jgruber
6e4d2a60ba [coverage] Refactor tests
Refactor common test code into code-coverage-utils.js and add tests to
verify counter behavior in opt/no-opt situations.

Bug: v8:6000
Change-Id: I07e62345476e8c81521c491ae605ddaf71600667
Reviewed-on: https://chromium-review.googlesource.com/584449
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46888}
2017-07-26 06:40:07 +00:00