Commit Graph

41739 Commits

Author SHA1 Message Date
Michael Achenbach
57200ddb42 Revert "Reland ^3 "[builtins] Port getting property from Proxy to CSA"""
This reverts commit edc4ae14c8.

Reason for revert: There's still this problem:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/5835

Original change's description:
> Reland ^3 "[builtins] Port getting property from Proxy to CSA""
> 
> This is a reland of e86c066b77
>  
> With fixes for crbug.com/752846, crbug.com/752712, crbug.com/752850
> 
> Previously landed as: 47a97aa53b / 47113
> Previously landed as: 15ef03cbf3 / 47159
> 
> TBR=jkummerow@chromium.org, franzih@chromium.org, bmeurer@chromium.org,
> jgruber@chromium.org, mstarzinger@chromium.org
> 
> Bug: v8:6559, v8:6557
> Change-Id: I12ccae44331b05dd3f304ac538c0154133b43c35
> Reviewed-on: https://chromium-review.googlesource.com/608187
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47245}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org,neis@chromium.org,franzih@chromium.org,jgruber@chromium.org,ishell@chromium.org,bmeurer@chromium.org,mslekova@google.com

Change-Id: Ib46b68f011c056675f2024f91c7f1024767b4dd0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6559, v8:6557
Reviewed-on: https://chromium-review.googlesource.com/608189
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47247}
2017-08-09 13:37:37 +00:00
Ulan Degenbaev
2178bbaf3f [heap] Adjust upper limit in ComputeMaxSemiSpaceSize.
This ensures that 2GB devices get 512K initial semi-space.

Bug: chromium:735649
TBR: mlippautz@chromium.org
Change-Id: I864c9dfa7cd3ea9040fa56d81d6bf1187c1cf776
Reviewed-on: https://chromium-review.googlesource.com/608129
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47246}
2017-08-09 13:06:41 +00:00
Maya Lekova
edc4ae14c8 Reland ^3 "[builtins] Port getting property from Proxy to CSA""
This is a reland of e86c066b77
 
With fixes for crbug.com/752846, crbug.com/752712, crbug.com/752850

Previously landed as: 47a97aa53b / 47113
Previously landed as: 15ef03cbf3 / 47159

TBR=jkummerow@chromium.org, franzih@chromium.org, bmeurer@chromium.org,
jgruber@chromium.org, mstarzinger@chromium.org

Bug: v8:6559, v8:6557
Change-Id: I12ccae44331b05dd3f304ac538c0154133b43c35
Reviewed-on: https://chromium-review.googlesource.com/608187
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47245}
2017-08-09 12:52:51 +00:00
Ulan Degenbaev
c5263279eb Revert "[heap] Disable parallel scavenge."
This reverts commit feb3ee40d0.

Reason for revert: canary crashes were caused by another CL.

Original change's description:
> [heap] Disable parallel scavenge.
> 
> Bug: chromium:752750
> TBR: mlippautz@chromium.org
> Change-Id: I95ca30742c05be03dcaebb0cd32af04b226e23e2
> Reviewed-on: https://chromium-review.googlesource.com/603652
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47201}

TBR=ulan@chromium.org,mlippautz@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:752750
Change-Id: Id26e58ded32af364b3274d6d1a7215944386bb70
Reviewed-on: https://chromium-review.googlesource.com/607891
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47244}
2017-08-09 11:53:49 +00:00
Ross McIlroy
265e87e59e [Compiler] Seperate AttachOuterScopeInfo out of DeclarationScope::Analyze
Splits out AttachOuterScopeInfo from DeclarationScope::Analyze and attaches
the outer scope info after parsing has completed (when parsing on the main
thread, which is the only time we have an outer scope info) instead of
during Compiler::Analyse().

BUG=v8:5203

TBR=yangguo@chromium.org

Change-Id: Idd8d2409fb20f09a9f6bbf5cff7e6edcf90077d7
Reviewed-on: https://chromium-review.googlesource.com/605889
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47243}
2017-08-09 11:04:13 +00:00
Ulan Degenbaev
ef0e835997 [heap] Fix clearing of slots in concurrent sweeper.
This fixes an old bug uncovered by
https://chromium-review.googlesource.com/591651

The bug is a race between the concurrent sweeper clearing slots and
the mutator adding slots and trimming fixed array:

1) The sweeper starts sweeping a page with an existing fixed array.
2) The sweeper pre-caches the slots clearing mode by checking if the
   slot set pointer on the page is null or not. (This is the bug).
3) The mutator updates the fixed array such that new slots are added.
4) The mutator trims the fixed array such that the added slots are
   now in free space.
5) The sweeper adds the trimmed part of the fixed array to free list,
   but does not clear slots there because of the cached flag.
6) A new object is allocated from the free list entry and it has
   a bogus slot entry recorded.

Bug: chromium:752750
TBR: mlippautz@chromium.org
Change-Id: I4f70514fa05b692a27d992954cb4c314ef4cac07
Reviewed-on: https://chromium-review.googlesource.com/608047
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47242}
2017-08-09 11:03:09 +00:00
Marja Hölttä
3e6cf71a77 [parser] Alternative fix for chromium:740591
- Previous fix is https://chromium-review.googlesource.com/c/583531 but it
  diverges Scopes created by PreParser from Scopes created by Parser.

- This CL creates the inner block scope a bit earlier and (temporarily) pushes
  it into the scope chain for parsing the variable declarations in a for
  loop. The previous approach was to first parse the variable declarations and
  then reparent the AST nodes / Scopes created while parsing it afterwards.

- This CL partially reverts https://chromium-review.googlesource.com/c/583531;
  the new fix only touches parser-base.h (diff between patch sets 2 and 3 is the
  fix).

- The Ignition golden changes are basically undoing the changes done in that CL
  too.

Bug: chromium:740591
Change-Id: Iceff1383ef066317e754942bb5ff0c70a91bc937
Reviewed-on: https://chromium-review.googlesource.com/603787
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47241}
2017-08-09 10:54:09 +00:00
Benedikt Meurer
487850c432 [ignition] Separate Call and Construct feedback logic.
Revert CollectCallOrConstructFeedback to just CollectCallFeedback again
and provide a separate copy of the code for ConstructWithSpread, where
the idea is that this will be unified with the Construct bytecode
handler, once there's support for spreading the final argument _and_
passing the AllocationSite at the same time.

This is following up on discussion with rmcilroy@ at
https://goo.gl/Cxy5mD where the outcome was to keep Call and Construct
logic separate for the sake of clarity.

Bug: v8:5517, v8:6399, v8:6679
Change-Id: I20ebe1d5ed80986359742cf5411f4abaad8b6a60
Reviewed-on: https://chromium-review.googlesource.com/606469
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47240}
2017-08-09 09:29:49 +00:00
Mostyn Bramley-Moore
2ddca9c260 add gn jumbo build support
To speed up compilation times, jumbo allows files to be compiled
together. This is a well known method ("unity builds") to both
compile faster and create a poor man's "full program optimization".
We are only interested in compile times.

Background:
https://chromium.googlesource.com/chromium/src/+/master/docs/jumbo.md

Note that jumbo builds are not enabled by default.  To try this out,
add use_jumbo_build=true to your GN args.

BUG=chromium:746958

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ieb9fdccb6c135e9806dbed91c09a29aa8b8bee11
Reviewed-on: https://chromium-review.googlesource.com/579090
Commit-Queue: Mostyn Bramley-Moore <mostynb@opera.com>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47239}
2017-08-09 09:05:29 +00:00
Georg Neis
b7227dc8d2 Make ValidateAndApplyPropertyDescriptor pass on its ShouldThrow mode.
This fixes a bug affecting module namespace objects, which are currently
implemented using native accessors.

Bug: v8:6681, v8:1569
Change-Id: I6a678652573a332c47315497d927c390d9da0926
Reviewed-on: https://chromium-review.googlesource.com/606027
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47238}
2017-08-09 09:01:39 +00:00
Benedikt Meurer
083ac1797f [turbofan] Fix logic error in ReduceJSConstruct.
Don't return NoChange when the new_target input to a JSConstruct node is
already a HeapConstant, but rather use that constant in the interesting
lowering below. This was introduced accidentally by 

  https://chromium-review.googlesource.com/604790

earlier. Also don't use ShouldUseCallICFeedback predicate here, as that
doesn't really make sense for JSConstruct, but is mostly interesting for
JSCall (hence the name).

Bug: v8:5517, v8:6399, v8:6679
Change-Id: I96201281cf1a10f2bfd2dc3859455161eb310ccf
Reviewed-on: https://chromium-review.googlesource.com/607887
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47237}
2017-08-09 08:59:08 +00:00
Georg Neis
703b5ff960 Revert "Reland^2 "[builtins] Port getting property from Proxy to CSA""
This reverts commit e86c066b77.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> Reland^2 "[builtins] Port getting property from Proxy to CSA"
> 
> With fixes for crbug.com/752846, crbug.com/752712, crbug.com/752850
> 
> Previously landed as: 47a97aa53b / 47113
> Previously landed as: 15ef03cbf3 / 47159
> 
> Bug: v8:6559, v8:6557
> This is a reland of 15ef03cbf3
> 
> Change-Id: Ia53ffb80ebe44581fdb923d9f572be92ee3ed080
> Reviewed-on: https://chromium-review.googlesource.com/603796
> Commit-Queue: Maya Lekova <mslekova@google.com>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47235}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org,franzih@chromium.org,jgruber@chromium.org,ishell@chromium.org,bmeurer@chromium.org,mslekova@google.com

Change-Id: Ibf0b9f786f3df247acaf9e7ffe9f49ec1db905d8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6559, v8:6557
Reviewed-on: https://chromium-review.googlesource.com/607928
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47236}
2017-08-09 08:58:03 +00:00
Maya Lekova
e86c066b77 Reland^2 "[builtins] Port getting property from Proxy to CSA"
With fixes for crbug.com/752846, crbug.com/752712, crbug.com/752850

Previously landed as: 47a97aa53b / 47113
Previously landed as: 15ef03cbf3 / 47159

Bug: v8:6559, v8:6557
This is a reland of 15ef03cbf3

Change-Id: Ia53ffb80ebe44581fdb923d9f572be92ee3ed080
Reviewed-on: https://chromium-review.googlesource.com/603796
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47235}
2017-08-09 07:59:48 +00:00
Michael Achenbach
180d81ea25 [test] Mark slow test
NOTRY=true
TBR=mstarzinger@chromium.org,clemensh@chromium.org

Change-Id: I1c4f43b3faa40ab6cc790647aa022890cb418d07
Reviewed-on: https://chromium-review.googlesource.com/607847
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47234}
2017-08-09 07:31:38 +00:00
Sergei D
b8d4ce2b99 Add get current wall-clock time to the Platform
To avoid breaking Chromium we expose a stub method first, and will start
using it only when V8 rolls into Chromium and we implement it there.

Bug: chromium:751993
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ida1f96f2dfa833552e7adfa36a580a6ef1bdd1aa
Reviewed-on: https://chromium-review.googlesource.com/604812
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Sergei Datsenko <dats@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47233}
2017-08-09 05:55:23 +00:00
v8-autoroll
300c0d38e5 Update V8 DEPS.
Rolling v8/build: 411d3b5..220748c

Rolling v8/third_party/catapult: 33a9271..49fffef

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I0dbf7437440b15e5d2d82dd04f1133a639ac7a90
Reviewed-on: https://chromium-review.googlesource.com/607489
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47232}
2017-08-09 03:53:03 +00:00
Aseem Garg
aee1e1fb8d Revert "[wasm] Reland "[wasm] redirect wasm calls to js functions through a GCed table""
This reverts commit 649b1e70e7.

Reason for revert: A1 Jetstream bots are still failing.

Original change's description:
> [wasm] Reland "[wasm] redirect wasm calls to js functions through a GCed table"
>
> This reverts commit 25f03308a7.
>
> Reason for revert: Fix the cause of bot failure and reland
>
> Original change's description:
> > Revert "[wasm] redirect wasm calls to js functions through a GCed table"
> >
> > This reverts commit eb65f35e96.
> >
> > Reason for revert: Broke jetstream benchmark on android.
> >
> > BUG=chromium:750828
> >
> > Original change's description:
> > > [wasm] redirect wasm calls to js functions through a GCed table
> > >
> > > With this patch, rather than embedding the JSReceiver address directly
> > > in the WasmToJS wrappers, we put that in a fixed array with global handle
> > > scope and instead embed the location of the handle and the index in the
> > > wrapper. This ensures that the wrapper doesn't need to be patched if the
> > > GC kicks in. This is needed to get the WASM code off the GCed heap.
> > >
> > > R=​mtrofin@chromium.org
> > >
> > > Bug:
> > > Change-Id: Ie5a77a78cdecec51b04f702c63b8e4285e6a2d8d
> > > Reviewed-on: https://chromium-review.googlesource.com/581682
> > > Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> > > Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#46884}
> >
> > TBR=mtrofin@chromium.org,aseemgarg@google.com,aseemgarg@chromium.org,clemensh@chromium.org
> >
> > # Not skipping CQ checks because original CL landed > 1 day ago.
> >
> > Change-Id: I26f49ee0a1fe73cc5d8852ded87b56638be39ebf
> > Reviewed-on: https://chromium-review.googlesource.com/596268
> > Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> > Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#47059}
>
> R=​mtrofin@chromium.org,aseemgarg@google.com,aseemgarg@chromium.org,clemensh@chromium.org,sullivan@chromium.org
>
> Change-Id: I29ef35f6e612a706d9f571da3e7beb1da8b5052b
> Bug: chromium:750828
> Reviewed-on: https://chromium-review.googlesource.com/597010
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47177}

TBR=bradnelson@chromium.org,sullivan@chromium.org,mtrofin@chromium.org,aseemgarg@google.com,aseemgarg@chromium.org,clemensh@chromium.org

Bug: chromium:750828
Change-Id: I04b12c0eb0705ad809822a7d7461423be77d942a
Reviewed-on: https://chromium-review.googlesource.com/606867
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Aseem Garg <aseemgarg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47231}
2017-08-08 19:37:45 +00:00
Anisha Rohra
78da0742d5 PPC/s390: Properly integrate the CallIC into Ignition.
Port ee350c3149

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, bjaideep@ca.ibm.com
BUG=
LOG=N

Change-Id: I2dfc7562fc327a4d8577c405d5fec8c440ef0a49
Reviewed-on: https://chromium-review.googlesource.com/606707
Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47230}
2017-08-08 18:10:44 +00:00
Mircea Trofin
f9d4090b4b [wasm] Consolidate ownership of instantiation/specialization parameters
This CL consolidates ownership of parameters used to compile code (which
we always specialize) in 2 places:
- ModuleEnv for compile-time data
- WasmCompiledModule for runtime data

The parameters in question are: memory size and start; globals start; 
address of indirect function tables (and their signatures, respectively); 
and address to be used for wasm call sites.

Ideally, we'd collapse this down to one place, however, we need
specialization data to survive serialization. We can achieve this we get off 
the GC heap and use a different wasm code serializer.

The CL:
- removes aliasing of parts of the specialization data, and moves
to using ModuleEnv as a token of passing around compile-time data, instead
of a mixture of ModuleEnv, WasmInstance, and some other structures. ModuleEnv
is responsible for providing a consistent view of the specialization data,
e.g. valid memory sizes (multiples of page size), and matching sized function
tables and signatures.

- removes WasmInstance, as its data is now contained by ModuleEnv.

- removes ModuleBytesEnv. We now pass the wire bytes explicitly. They can't
always be assumed as present (e.g. streaming compilation), and probably more
refactoring may need to happen once streaming compilation lands and we
better understand our dependencies.

Change-Id: Id7e6f2cf29e51b5756eee8b6f8827fb1f375e5c3
Reviewed-on: https://chromium-review.googlesource.com/592531
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47229}
2017-08-08 15:45:59 +00:00
jing.bao
9359dc4de1 [ia32] Add psignb/w/d and AVX version
Reconstruct pshufb using macro

Bug: 
Change-Id: I5556ce1108378fc7a7658443cd09c3f676c16aa7
Reviewed-on: https://chromium-review.googlesource.com/603907
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47228}
2017-08-08 15:23:04 +00:00
Clemens Hammacher
fc574b168b [wasm] Fix data type in decoder
We are only calling {checkAvailable} with uint32_t, thus the type
received should also be uint32_t. This also gives better error messages
for integers >kMaxInt.

R=titzer@chromium.org

Change-Id: I40655b80dcc601e05fbb0c92cedba72ca806e2b3
Reviewed-on: https://chromium-review.googlesource.com/605893
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47227}
2017-08-08 15:16:04 +00:00
Ivica Bogosavljevic
c0a632b3b1 MIPS[64]: Add simulation support for MIPS SIMD MI10 instruction group
Add support for the simulation of MIPS SIMD MI10 instruction group,
which included Load Vector and Store Vector instructions. Add
corresponding test for these instructions.

Bug: 
Change-Id: I7cbc9d8dff2a779d9a716f539cd9a2bbb8ac694a
Reviewed-on: https://chromium-review.googlesource.com/595567
Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#47226}
2017-08-08 14:32:27 +00:00
Adam Klein
6cd7fcd28f [parser] Remove never-triggered null check in AddParameterInitializationBlock()
Change-Id: I3f150ef3424cb28c89db6ef8fcb1a3340a8ff8b1
Reviewed-on: https://chromium-review.googlesource.com/604725
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47225}
2017-08-08 14:31:18 +00:00
Caitlin Potter
a094e360e9 [async-iteration] eliminate Suspend for AsyncGeneratorYield await
A spec change (a0dfeba1a8) introduced a number of Await operations to the spec. In turn, this caused generated bytecode for async generators to grow drastically.

This commit moves the Await within AsyncGeneratorYield (https://tc39.github.io/proposal-async-iteration/#sec-asyncgeneratoryield step 5) into a new TFJ builtin, similar in structure to AsyncGeneratorAwait, but instead of resuming the generator on resolution of the Promise, the current generator request's Promise is fulfilled instead.

This results in a reduction in generated bytecode without losing any statically available information.

BUG=v8:5855

Change-Id: Ib5bcf06132d221beffdea30639a7b4437030143b
Reviewed-on: https://chromium-review.googlesource.com/582487
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47224}
2017-08-08 14:18:08 +00:00
Yang Guo
10ec3951da [snapshot] update OWNERS file.
R=jgruber@chromium.org

Change-Id: I67b296c97091b4bfa3864f5187cf3e7e4d452961
Reviewed-on: https://chromium-review.googlesource.com/604800
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47223}
2017-08-08 13:32:01 +00:00
Michael Starzinger
673657161d Remove obsolete NumberOfBitsSet helper function.
R=clemensh@chromium.org

Change-Id: Ie964f001792e2be9647bfd32722071dd343755d2
Reviewed-on: https://chromium-review.googlesource.com/605688
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47222}
2017-08-08 13:30:11 +00:00
Ulan Degenbaev
b35a0789bc [heap, runtime] Fix conversion of large strings to thin strings.
This patch removes creation of fillers in the middle of a large page and
fixes assert in Heap::NotifyObjectLayoutChange.

The fillers in large pages are useless since we do not sweep large
object space.

Bug: chromium:752426
Change-Id: I01c230223f28d6d54b7362ee70e9d83de50678fd
Reviewed-on: https://chromium-review.googlesource.com/601994
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47221}
2017-08-08 12:35:11 +00:00
Michael Starzinger
d0f79eeb7e [deoptimizer] Remove remnants of stub failure support.
R=jarin@chromium.org

Change-Id: I336595bdcbdb41d7c33aa138fdc7893aa02e655b
Reviewed-on: https://chromium-review.googlesource.com/605647
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47220}
2017-08-08 12:31:11 +00:00
Jakob Gruber
95f868595c [snapshot] Simplify deserializer APIs
This moves deserializer setup boilerplate inside the deserializers, and
makes improper usage less likely. For instance:

  ObjectDeserializer deserializer(&scd);
  /* ... deserializer setup ... */
  MaybeHandle<HeapObject> obj = deserializer.Deserialize(isolate);
  /* ... result checks and casts ... */

has now become:

  /* All setup and casts inside deserializer, impossible to illegally
     use the same instance multiple times. */
  MaybeHandle<SharedFunctionInfo> maybe_result =
      ObjectDeserializer::DeserializeSharedFunctionInfo(
          isolate, &scd, source);

Bug: v8:6624
Change-Id: Id5a1848e024e89cf86e5292389ba7c89f31d8e6b
Reviewed-on: https://chromium-review.googlesource.com/604791
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47219}
2017-08-08 11:55:55 +00:00
Michael Starzinger
d929cc755c [turbofan] Fix introduction of contradicting {TypeGuard}.
This avoid introduction of {TypeGuard} nodes during load elimination.
Such type guard could lead to contradicting type information where a
constant {NumberConstant} node was guarded to have {ExternalPointer}
type, which would lead to an impossible constraint on representation
selection.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-752826
BUG=chromium:752826

Change-Id: Ida3815af24ccc8a48474b8d66117b9718f61adda
Reviewed-on: https://chromium-review.googlesource.com/605547
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47218}
2017-08-08 11:54:51 +00:00
Clemens Hammacher
5507162e78 [wasm] Use LowerInt64 method where possible
This removes the last instance where we did manually what {LowerInt64}
already does.

R=titzer@chromium.org

Change-Id: I5e0de0f8ed1ae31f295e947a9fe36e4142200b65
Reviewed-on: https://chromium-review.googlesource.com/602238
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47217}
2017-08-08 10:24:17 +00:00
Michael Starzinger
1d92fd2edf [turbofan] Fix missing holder lookup in AccessInfoFactory.
This makes sure we perform a proper holder lookup when trying to inline
API accessors calls in TurboFan. Inlining is completely disabled in case
the holder is not found, otherwise the appropriate holder is passed via
the {PropertyAccessInfo} structure (if different from the receiver).

R=bmeurer@chromium.org
TEST=cctest/test-api/ReceiverSignature
BUG=chromium:752149

Change-Id: I7b192724afd99d651b6477b2f2c8b403a10efb9d
Reviewed-on: https://chromium-review.googlesource.com/603615
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47216}
2017-08-08 08:53:13 +00:00
Ben L. Titzer
2070a4fee4 Inline HeapNumber::HeapNumberBooleanValue(), only used in objects.cc.
R=cbruni@chromium.org

Bug: 
Change-Id: Id1993e64375084e43479c20607a5c20778117ecc
Reviewed-on: https://chromium-review.googlesource.com/601910
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47215}
2017-08-08 08:43:32 +00:00
Tobias Tebbi
66d31d19c4 Reland "[turbofan] enable new implementation of escape analysis"
This is a reland of a6c3f14374
Original change's description:
> [turbofan] enable new implementation of escape analysis
> 
> Bug: 
> Change-Id: I0218ab67bf391deb8f1b1b78811643eb84745b7c
> Reviewed-on: https://chromium-review.googlesource.com/595508
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47032}

Change-Id: I8efc9676088508c0102c70785b546d80d9c4036c
Reviewed-on: https://chromium-review.googlesource.com/603788
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47214}
2017-08-08 08:39:02 +00:00
Clemens Hammacher
0ecdbeb026 Revert "Partial revert of "Remove ~MaybeHandle and statically assert that handles are trivially copyable""
This reverts commit 1dfaec2647.

Reason for revert: Does not fix the performance regression, see bug.

Original change's description:
> Partial revert of "Remove ~MaybeHandle and statically assert that handles are trivially copyable"
> 
> Reason: cause Blink regression on Android
> 
> Original CL: https://chromium-review.googlesource.com/c/538463/
> 
> Bug: chromium:735910
> Change-Id: I405e71f6ffeaf9fa467036a6fafa0271a60de9d3
> Reviewed-on: https://chromium-review.googlesource.com/593247
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Loo Rong Jie <loorongjie@gmail.com>
> Cr-Commit-Position: refs/heads/master@{#46995}

R=yangguo@chromium.org,loorongjie@gmail.com,jbroman@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:735910
Change-Id: I65eecd575fb1b77471c6dd83a01df6c4e8a85214
Reviewed-on: https://chromium-review.googlesource.com/603797
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47213}
2017-08-08 08:17:47 +00:00
Tobias Tebbi
e08d1ebe3c [builtins] add test for Array.shift on holey double array
Adding the missing test for https://chromium-review.googlesource.com/c/603717.

Bug: chromium:752722
Change-Id: I8a4ca161b691532e481ebe9f7d05c306beb4c90a
Reviewed-on: https://chromium-review.googlesource.com/604792
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47212}
2017-08-08 08:16:42 +00:00
Jakob Gruber
2e2069cdf6 [snapshot] Continue splitting up Deserializer
Another pure refactoring CL. This extracts methods used only by Deserializer
subclasses.

Bug: v8:6624
Change-Id: Ib4dd7cdc591dff217e282e68a490c8c7129b9c96
Reviewed-on: https://chromium-review.googlesource.com/602188
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47211}
2017-08-08 07:26:02 +00:00
Benedikt Meurer
650d65c951 [ic] Collect new.target feedback for Construct bytecodes.
Change the CALL_IC machinery inside of Ignition to collect new.target
feedback for Construct and ConstructWithSpread bytecodes instead of
collecting feedback about the target, and adapt TurboFan's JSCallReducer
to consume feedback for new.target instead of target on JSConstruct
nodes.

This enables TurboFan to inline JSCreate - and thus the actual instance
allocation - into derived leaf constructors even if the leaf constructor
itself is not inlined, and thereby removes this weird performance cliff.
The feedback for target in case of class constructors is provided by
the function context specialization, and in case of `new A`, we can
just use the feedback for new.target, as both target and new.target are
A in that case.

Bug: v8:5517, v8:6399, v8:6679
Change-Id: I0475e2500e787fd672ed037ac0faed78a8fa5dc0
Reviewed-on: https://chromium-review.googlesource.com/604790
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47210}
2017-08-08 05:56:11 +00:00
Benedikt Meurer
f2c702743c [js-perf-test] Add microbenchmarks for leaf constructors.
Bug: v8:6679
Change-Id: I1fff8ffa037629636f31ecd2b731f5b9de89ce44
Reviewed-on: https://chromium-review.googlesource.com/604789
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47209}
2017-08-08 05:25:31 +00:00
v8-autoroll
6ee1996153 Update V8 DEPS.
Rolling v8/build: 181c098..411d3b5

Rolling v8/third_party/icu: 1fec0c8..98218d1

Rolling v8/tools/swarming_client: a56c2b3..42721e1

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I3d2d98ec9abd9d813986d3d82c010c8b0d46fa67
Reviewed-on: https://chromium-review.googlesource.com/604549
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47208}
2017-08-08 03:59:11 +00:00
Adam Klein
a9846ad451 Throw errors when assigning to const variables inside with
This code appears to have been wrong forever, as it only
threw in strict mode (presumably predating ES2015 const).

In order to get exactly the right behavior, special
handling of sloppy named function expressions is required.
Rather than polluting PropertyAttributes with another
dummy value, this CL simply adds a bool output argument
to Context::Lookup to indicate that case.

Bug: v8:6677
Change-Id: I34daa5080d291808f10cbaefc91d716f0b22963b
Reviewed-on: https://chromium-review.googlesource.com/602690
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47207}
2017-08-08 02:00:22 +00:00
Benedikt Meurer
cb9402aa98 [turbofan] Properly check new.target parameter in inlined Reflect.construct.
The ConstructFunctionForwardVarargs and ConstructForwardVarargs
builtins, which are used when inlining the Reflect.construct
builtin into TurboFan optimized code, didn't properly check the
new.target parameter whether it's a constructor.

Bug: chromium:752481
Change-Id: I9b8f8c429d6eaed0ff8d27fc3f6b52eb906766a2
Reviewed-on: https://chromium-review.googlesource.com/604187
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47206}
2017-08-07 18:15:30 +00:00
Mircea Trofin
3f1e32b336 [wasm] Clarify source of runtime information for interpreter.
This is part of the effort to consolidate the ownership of
wasm instantiation/specialization parameters.

This change is focused solely on the interpreter part of that effort, to
verify we're not regressing performance in interpreter benchmarks.

There are two aspects being addressed:
- dataflow-wise, we always fetch the interpreter's memory view from the
runtime objects (i.e. WasmInstanceObject/WasmCompiledModule). This is
consistent with how other instance-specific information is obtained
(e.g. code, indirect functions).

- representation-wise, we do not reuse ModuleEnv/WasmInstance just for
the memory view, because it is surprising that other instance info isn't
accessed from there. 

Bug: 
Change-Id: I536fbffd8e1f142a315fa1770ba9b08319f56a8e
Reviewed-on: https://chromium-review.googlesource.com/602083
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47205}
2017-08-07 18:14:23 +00:00
Tobias Tebbi
81778aaf72 [builtins] Fix ArrayShift for double elements kind if head is the hole.
The code accidentally jumped over the actual left-shift part when the
head of the array was the hole.

Bug: chromium:752722
Change-Id: I300a3ebcfafb07d6ecebc01fa57c66eb26f349ac
Reviewed-on: https://chromium-review.googlesource.com/603717
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47204}
2017-08-07 17:41:06 +00:00
Tobias Tebbi
688689d309 [turbofan] new escape analysis reducer: look through newly introduced typeguards
Bug: chromium:752438
Change-Id: I6e168f0e8101cf9f28915ca94c40d408ed75d079
Reviewed-on: https://chromium-review.googlesource.com/603612
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47203}
2017-08-07 17:33:27 +00:00
Alexandre Talon
864837ff3c [Turbofan] Fixing A/B/C test operators in unittests
Currently only A test operators had output, but since ABReducer and BCReducer
perform in-place replacement of A nodes into B nodes, and then sometimes into
C nodes, we need B and C nodes to have as many outputs. Otherwise, we run into
a situation where a node {x} has a use {y}, but its operators has 0 outputs,
which is inconsistent.

Bug: 
Change-Id: I0f73b83d2115dfeda3c9cbc97b9a2fc168f4c31b
Reviewed-on: https://chromium-review.googlesource.com/603716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Alexandre Talon <alexandret@google.com>
Cr-Commit-Position: refs/heads/master@{#47202}
2017-08-07 17:12:36 +00:00
Ulan Degenbaev
feb3ee40d0 [heap] Disable parallel scavenge.
Bug: chromium:752750
TBR: mlippautz@chromium.org
Change-Id: I95ca30742c05be03dcaebb0cd32af04b226e23e2
Reviewed-on: https://chromium-review.googlesource.com/603652
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47201}
2017-08-07 16:21:24 +00:00
Maya Lekova
ceb55494bd Revert "Reland "[builtins] Port getting property from Proxy to CSA""
This reverts commit 15ef03cbf3.

Reason for revert: Found the following bugs

Bug: chromium:752846, chromium:752712, chromium:752850

Original change's description:
> Reland "[builtins] Port getting property from Proxy to CSA"
> 
> This reland is after fix in [heap] Delete wrong DCHECK.
> It includes moving ProxyGetProperty to its own stub to reduce
> binary size.
> 
> This is a reland of 47a97aa53b
> Original change's description:
> > [builtins] Port getting property from Proxy to CSA
> > 
> > Bug: v8:6559, v8:6557
> > Change-Id: If6c51f5483adb73ddd2495cede5d85e887a3c298
> > Reviewed-on: https://chromium-review.googlesource.com/589212
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> > Commit-Queue: Maya Lekova <mslekova@google.com>
> > Cr-Commit-Position: refs/heads/master@{#47113}
> 
> Bug: v8:6559, v8:6557
> Change-Id: I76acd97ba1acb62b7e7983db1741441d997050f0
> Reviewed-on: https://chromium-review.googlesource.com/600215
> Commit-Queue: Maya Lekova <mslekova@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47159}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org,franzih@chromium.org,jgruber@chromium.org,ishell@chromium.org,bmeurer@chromium.org,mslekova@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I51bef25a031b02cf4deab11282473acae57f1ed3
Reviewed-on: https://chromium-review.googlesource.com/603708
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47200}
2017-08-07 15:57:14 +00:00
Ross McIlroy
a704cc7932 [Compiler] Refactor CompileUnoptimizedCode to do all Finalization at the end.
Refactors CompileUnoptimizedCode to do all the finalization for both
inner and the outermost function after having prepared and executed their
compile jobs. This will enable the function to be split into an off-thread
phase and a finalization main thread phase.

BUG=v8:5203

Change-Id: I400933c27b7aa52f9a7318b721adecfc94c80981
Reviewed-on: https://chromium-review.googlesource.com/602236
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47199}
2017-08-07 15:41:41 +00:00
Ross McIlroy
a7a166e30c [Compiler] Move CompilationInfo into CompilationJob for unoptimized jobs.
Moves creation of the CompilationInfo for unoptimized compilation into the
respective CompilationJobs for Igntition, Fullcode and asm.js. This unifies
the behaviour with respect to the optimized compilation jobs, and enables the
CompileInfo to be owned by the CompilationJob.

As part of this change, we no longer build new dummy ParseInfos for eager inner
functions, instead using just the single outer ParseInfo created during the
actual parsing.

BUG=v8:5203

Change-Id: I6813758dfc5eeff44f5a40bf621184e330593bf9
Reviewed-on: https://chromium-review.googlesource.com/601990
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47198}
2017-08-07 15:23:20 +00:00