Commit Graph

41555 Commits

Author SHA1 Message Date
Michael Achenbach
577cb0aa6b Update V8 DEPS.
Rolling v8/build: ece477b..c15e746

Rolling v8/buildtools: 5ad1454..275b8c4

Rolling v8/third_party/catapult: cc7953a..3ec5781

Rolling v8/tools/clang: 7185692..b18e402

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I7656cce0cbe7d187d8ee25951c25057b540b07ae
Reviewed-on: https://chromium-review.googlesource.com/597389
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47063}
2017-08-02 07:09:50 +00:00
Yang Guo
266be35b3b Support circular references between generated builtins.
Until now, when generating a builtin, it can only embed builtins
(as call targets) that have already been generated. This is either
achieved by reordering the builtins list, or by loading the call
target at runtime from the builtins list (see
MacroAssembler::TailCallBuiltin).

This patch works around this issue by filling the builtins list
with dummy code objects, which are later replaced with the completed
actual builtins. In release mode, this adds around 3ms to 140ms we
previously needed to populate the builtins list. 

Change-Id: I7d451b3c09a1db4b9e755548102a80c7f0dfada2
Reviewed-on: https://chromium-review.googlesource.com/586531
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47062}
2017-08-02 05:47:40 +00:00
Jaroslav Sevcik
b4b32df0b4 Remove the unused hydrogen_track_positions flag.
Change-Id: Ife88feb55f12c592b1c3b4435cd584333953ef6b
Reviewed-on: https://chromium-review.googlesource.com/593619
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47061}
2017-08-02 03:41:30 +00:00
Alexey Kozyatinskiy
f19b889be8 [inspector] support for cases when embedder doesn't call contextDestroyed
Node.js doesn't have good place to call contextDestroyed.
We need to cleanup everything on our side to allow clients to not call
contextDestroyed method.

R=dgozman@chromium.org,eostroukhov@chromium.com

Bug: none
Change-Id: Ibe3f01fd18afbfa579e5db66ab6f174d5fad7c82
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/575519
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#46849}
Reviewed-on: https://chromium-review.googlesource.com/596549
Cr-Commit-Position: refs/heads/master@{#47060}
2017-08-01 23:06:20 +00:00
Annie Sullivan
25f03308a7 Revert "[wasm] redirect wasm calls to js functions through a GCed table"
This reverts commit eb65f35e96.

Reason for revert: Broke jetstream benchmark on android.

BUG=chromium:750828

Original change's description:
> [wasm] redirect wasm calls to js functions through a GCed table
> 
> With this patch, rather than embedding the JSReceiver address directly
> in the WasmToJS wrappers, we put that in a fixed array with global handle
> scope and instead embed the location of the handle and the index in the
> wrapper. This ensures that the wrapper doesn't need to be patched if the
> GC kicks in. This is needed to get the WASM code off the GCed heap.
> 
> R=​mtrofin@chromium.org
> 
> Bug: 
> Change-Id: Ie5a77a78cdecec51b04f702c63b8e4285e6a2d8d
> Reviewed-on: https://chromium-review.googlesource.com/581682
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46884}

TBR=mtrofin@chromium.org,aseemgarg@google.com,aseemgarg@chromium.org,clemensh@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I26f49ee0a1fe73cc5d8852ded87b56638be39ebf
Reviewed-on: https://chromium-review.googlesource.com/596268
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47059}
2017-08-01 21:34:25 +00:00
Caitlin Potter
ac6ed35a31 Reland "[async-iteration] implement spec-change to yield in async generators"
Per https://github.com/tc39/proposal-async-iteration/pull/102/files:

AsyncGeneratorResolve no longer unwraps a value component. Instead, the value is
unwrapped before the builtin call via Await, allowing Promise rejections to
affect the generator control flow.

Thus, all `yield <expr>` implicitly become `yield await <expr>`.

Additionally, `return <expr>` becomes `return await <expr>`. Finally, when the
generator is resumed with `.return()`, the parameter passed to .return() is
awaited before generator execution properly continues).

BUG=v8:6187, v8:5855
R=littledan@chromium.org, neis@chromium.org, adamk@chromium.org
TBR=rmcilroy@chromium.org, neis@chromium.org

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Id7718028fd555481f9f4ca0dbecfa788e3057c48
Reviewed-on: https://chromium-review.googlesource.com/594500
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#47058}
2017-08-01 18:39:26 +00:00
Ulan Degenbaev
638343afd2 [heap] Revert remaining parts of 5337b9
BUG=chromium:694255
TBR=ulan@chromium.org,mlippautz@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I832014d423335514cf1564984832b7a4e2c104ad
Reviewed-on: https://chromium-review.googlesource.com/595984
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47057}
2017-08-01 18:38:20 +00:00
Sathya Gunasekaran
7ff6471c48 [modules] Add comment explaining synchronous error handling
Bug: v8:5785
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I1792c57c37bac996079d5ecce5b61a13b327fb54
Reviewed-on: https://chromium-review.googlesource.com/596467
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47056}
2017-08-01 18:37:13 +00:00
Junliang Yan
04ac652862 s390: Fix lay overflow when too many arguments on stack
R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com

Bug: 
Change-Id: Ia9fa7785b0f508775f38547e56f07bc7ef9ee03d
Reviewed-on: https://chromium-review.googlesource.com/557928
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47055}
2017-08-01 18:23:48 +00:00
Jaideep Bajwa
788d828948 PPC/s390: MIPS[64] Fix SizeOfInitialHeap test failing
Port 316254a710

Original Commit Message:

    Commit 0d833cb94f deleted function call
    that created CEntryStub code in snapshot. So when CEntryStub::GetCode is
    called while initializing V8, the code for it, is not found in shapshot.
    Hence this code has to be generated in new allocation on heap, that is
    why initial heap is above the limit.
    This patch assures that CEntryStub code is in the snapshot.

R=predrag.rudic@imgtec.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I976dacf885e0d4ce8c5446a2c560a00cc0792150
Reviewed-on: https://chromium-review.googlesource.com/596071
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47054}
2017-08-01 18:15:55 +00:00
Ulan Degenbaev
2614b26b44 [heap] Disable compaction for concurrent marking.
7a5a777 is going to be reverted and compaction depends on it.

BUG=chromium:694255
TBR=ulan@chromium.org,mlippautz@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I975ea597860dd63e543b69bdc787c6667b015567
Reviewed-on: https://chromium-review.googlesource.com/595993
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47053}
2017-08-01 18:14:50 +00:00
Ulan Degenbaev
c59b81d7b8 Revert "[heap] Add mechanism for tracking invalidated slots per memory chunk."
This reverts commit 7a5a777c97.

Reason for revert: crashing in test-api

Original change's description:
> [heap] Add mechanism for tracking invalidated slots per memory chunk.
> 
> For correct slots recording in concurrent marker, we need to resolve
> the race that happens when
> 1) the mutator is invalidating slots for double unboxing or string
> conversions
> 2) and the concurrent marker is recording these slots.
> 
> This patch adds a data-structure for tracking the invalidated objects.
> Thus we can allow the concurrent marker to record slots without
> worrying about clearing them. During old-to-old pointer updating phase
> we re-check all slots that belong to the invalidated objects.
> 
> BUG=chromium:694255
> 
> Change-Id: Ifc3d82918cd3b96e5a5fb7125691626a56f4ab83
> Reviewed-on: https://chromium-review.googlesource.com/591810
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47049}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: I7f4f8e8cb027b921a82e9c0a0623536af02581fb
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/595994
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47052}
2017-08-01 18:13:41 +00:00
Ulan Degenbaev
5337b905ce [heap] Record slots in concurrent marker and enable compaction.
BUG=chromium:694255

Change-Id: I25ac134ea2e6f9af13f18e2da819b6d368497646
Reviewed-on: https://chromium-review.googlesource.com/593009
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47051}
2017-08-01 17:30:04 +00:00
Bill Budge
0eb28cd5b9 [cctest] Simplify tests that mock v8::Platform.
Adds a base class TestPlatform which implements the most common defaults
for v8::Platform methods.

Reworks existing cctests and unittests to use TestPlatform.

Bug: 
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ifeb28a5a190529697d5bcac227e80b10d454d9bd
Reviewed-on: https://chromium-review.googlesource.com/590194
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47050}
2017-08-01 17:06:13 +00:00
Ulan Degenbaev
7a5a777c97 [heap] Add mechanism for tracking invalidated slots per memory chunk.
For correct slots recording in concurrent marker, we need to resolve
the race that happens when
1) the mutator is invalidating slots for double unboxing or string
conversions
2) and the concurrent marker is recording these slots.

This patch adds a data-structure for tracking the invalidated objects.
Thus we can allow the concurrent marker to record slots without
worrying about clearing them. During old-to-old pointer updating phase
we re-check all slots that belong to the invalidated objects.

BUG=chromium:694255

Change-Id: Ifc3d82918cd3b96e5a5fb7125691626a56f4ab83
Reviewed-on: https://chromium-review.googlesource.com/591810
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47049}
2017-08-01 16:12:53 +00:00
Alexey Kozyatinskiy
896afddedc [inspector] rewritten test/inspector/let-const-with-api.js
- rewritten test using new harness,
- removed command line API part since we check it separatelu in inspector/runtime/command-line-api.js

R=jgruber@chromium.org

Bug: none
Change-Id: Ia12cab10a8e299bb17688c9c5f36e7f712aa70ee
Reviewed-on: https://chromium-review.googlesource.com/595032
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47048}
2017-08-01 15:36:02 +00:00
Georg Neis
f7d41ebe2c [modules] Produce more debug output for --trace-module-status.
R=adamk@chromium.org

Bug: v8:1569
Change-Id: I3931418ef17a309789cbc5281a4542a20a1db94e
Reviewed-on: https://chromium-review.googlesource.com/596029
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47047}
2017-08-01 15:20:33 +00:00
Adam Klein
5ff10f2060 [ignition] Add a DCHECK that scopes are visited in nesting order
Also fix one apparently-harmless bug in the Parser where we failed
to Finalize an empty scope. Without this fix, the DCHECK fails
on any C-style for-loop with a lexical binding that hits the
fast path (this is well-covered by many existing tests in mjsunit).

Thanks to Georg Neis for the suggestion of this DCHECK.

Change-Id: Ie1a8f8809f4d152c87f2da08209c610514645827
Reviewed-on: https://chromium-review.googlesource.com/587750
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47046}
2017-08-01 14:43:26 +00:00
Bill Budge
e11332f34b [ARM simulator] Fix vrev for Neon64-Neon16.
Bug: v8:750454
Change-Id: Ia270d2ede546bdc0b8a61b944dada59905a5c862
Reviewed-on: https://chromium-review.googlesource.com/594490
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47045}
2017-08-01 14:36:32 +00:00
Ben L. Titzer
b488e73a02 Move RegList and related out of frame.h and arch-specific files.
Register configuration data is not the same as frame configuration data.
This CL moves the last remnants of register configuration into
the assembler files, to be with the other register configuration
macros.

Next step: extract this register configuration data into
platform-specific files that can be included independent of the
assembler.

R=mstarzinger@chromium.org

Bug: 
Change-Id: I10933b5090be94e90e2a1442197528dfe30bb566
Reviewed-on: https://chromium-review.googlesource.com/595590
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47044}
2017-08-01 14:32:57 +00:00
Michael Lippautz
481c170505 [RCS] Reuse GCTracer scopes in RCS
This makes all the information that is present for GCTracer also
available to RCS.

Bug: chromium:748569
Change-Id: Ie7e8c3770b81ab1321cad08f6954492b72ef0514
Reviewed-on: https://chromium-review.googlesource.com/585427
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47043}
2017-08-01 14:23:22 +00:00
Ulan Degenbaev
d624daacc6 [heap] Remove special handling of map space in old-to-old pointer update.
Now that the layout descriptor is pretenured, we don't need atomic
accessor for the map space.

BUG=chromium:694255

Change-Id: I0ced8c04eaa61eec0f6a7b518ecba6413a691501
Reviewed-on: https://chromium-review.googlesource.com/595742
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47042}
2017-08-01 13:43:36 +00:00
Leszek Swirski
77cd84169b [heap] Remove IC age
Remove the concept of IC age from the heap and SFI, since it no
longer does anything useful.

Change-Id: I4ce466efc77c007c09c0889bae09ec6a0c907e33
Reviewed-on: https://chromium-review.googlesource.com/593623
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47041}
2017-08-01 13:25:30 +00:00
Michael Starzinger
2bdf6ac554 [deoptimizer] Removed unused argument from {TranslatedState}.
R=jarin@chromium.org
BUG=v8:6586

Change-Id: I1eedfe8d3d420fe88df5321cc855cfd6266d7c6e
Reviewed-on: https://chromium-review.googlesource.com/595653
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47040}
2017-08-01 13:05:53 +00:00
Yang Guo
809c3d455b Remove cell visiting in object visitor.
Change-Id: Ida5c537fa94a376a134e60edce889b96b676a8f9
Reviewed-on: https://chromium-review.googlesource.com/584874
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47039}
2017-08-01 12:39:12 +00:00
Michael Achenbach
3138850ed6 Revert "Replacing pc with trampoline on stack"
This reverts commit a01ac7cbd9.

Reason for revert: Causes flakes on gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/14218

Original change's description:
> Replacing pc with trampoline on stack
> 
> This CL is the follow up of https://chromium-review.googlesource.com/c/586707/
> which used to crash when running the gc-stress bots. 
> It seems to be working now. We now keep the trampoline PC in the Safepoint 
> table and use that information to find SafepointEntries.
> 
> There's some refactoring that can be done, such as changing the code for 
> exceptions in a similar way and removing the trampoline from the 
> DeoptimizationInputData. Will take care of this in the next CL.
> 
> Bug: v8:6563
> Change-Id: I02565297093620023a1155b55d76a4dafcb54794
> Reviewed-on: https://chromium-review.googlesource.com/593622
> Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47030}

TBR=jarin@chromium.org,bmeurer@chromium.org,jupvfranco@google.com

Change-Id: Ie9929c9acae321a91014b76b9008f8835313e67d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6563
Reviewed-on: https://chromium-review.googlesource.com/595927
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47038}
2017-08-01 12:15:45 +00:00
jgruber
fcaa2c2e57 Reland "[builtins] Remove Builtins::Name() accessors"
This is a reland of 2f79e03560
Original change's description:
> [builtins] Remove Builtins::Name() accessors
> 
> Instead of auto-generating the Name() convenience accessor, use a macro to
> avoid wasting code space.
> 
>   BUILTIN_CODE(isolate, Name)
> 
> expands to
> 
>   isolate->builtins()->builtin_handle(Builtins::kName);
> 
> This reduces the size of libv8.so by 134,752 bytes on a x64 release build.
> 
> Bug: v8:6624
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: Idff7ee5c45e344e73412c0f47e92553c7c7ff75f
> Reviewed-on: https://chromium-review.googlesource.com/593607
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47010}

TBR=bmeurer@chromium.org,ahaas@chromium.org

Bug: v8:6624
Change-Id: I4733731e56dc8873ee06c2b36cac1918c0a658b2
Reviewed-on: https://chromium-review.googlesource.com/594087
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47037}
2017-08-01 10:39:10 +00:00
Michael Lippautz
6e9e2e58cf [heap] Move SweeperTask to CancelableTask
This mitigates the problem of blocking on the main thread when the
platform is unable to execute background tasks in a timely manner.

Bug: v8:6655
Change-Id: Icdaae744ee73146b86b9a28c8035138746721971
Reviewed-on: https://chromium-review.googlesource.com/595467
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47036}
2017-08-01 10:38:01 +00:00
Michael Achenbach
828e0e3595 Revert "[turbofan] enable new implementation of escape analysis"
This reverts commit a6c3f14374.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/14478
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/11907

Original change's description:
> [turbofan] enable new implementation of escape analysis
> 
> Bug: 
> Change-Id: I0218ab67bf391deb8f1b1b78811643eb84745b7c
> Reviewed-on: https://chromium-review.googlesource.com/595508
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47032}

TBR=jarin@chromium.org,tebbi@chromium.org

Change-Id: Ib534a1c5e3b67e0585c63185065370a23ba954c5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/595647
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47035}
2017-08-01 10:05:26 +00:00
Benedikt Meurer
31800120cc [builtins] Speed-up Object.prototype.toString.
The @@toStringTag lookup in Object.prototype.toString causes quite a
lot of overhead and oftentimes dominates the builtin performance. These
lookups are almost always negative, especially for primitive values,
and Object.prototype.toString is often used to implement predicates
(like in Node core or in AngularJS), so having a way to skip the
negative lookup yields big performance gains.

This CL introduces a "MayHaveInterestingSymbols" bit on every map,
which says whether instances with this map may have an interesting
symbol. Currently only @@toStringTag is considered an interesting
symbol, but we can extend that in the future.

In the Object.prototype.toString we can use the interesting symbols
bit to do a quick check on the prototype chain to see if there are
any maps that might have the @@toStringTag, and if not, we can just
immediately return the result, which is very fast because it's derived
from the instance type. This also avoids the ToObject conversions for
primitive values, which is important, since this causes unnecessary
GC traffic and in for example AngularJS, strings are also often probed
via the Object.prototype.toString based predicates.

This boosts Speedometer/AngularJS by over 3% and Speedometer overall
by up to 1%. On the microbenchmark from the similar SpiderMonkey bug
(https://bugzilla.mozilla.org/show_bug.cgi?id=1369042), we go from
roughly 450ms to 70ms, which corresponds to a 6.5x improvement.

```
function f() {
    var res = "";
    var a = [1, 2, 3];
    var toString = Object.prototype.toString;
    var t = new Date;
    for (var i = 0; i < 5000000; i++)
	res = toString.call(a);
    print(new Date - t);
    return res;
}
f();
```

The design document at https://goo.gl/e8CruQ has some additional
data points.

TBR=ulan@chromium.org

Bug: v8:6654
Change-Id: I31932cf41ecddad079d294e2c322a852af0ed244
Reviewed-on: https://chromium-review.googlesource.com/593620
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47034}
2017-08-01 09:30:44 +00:00
Andreas Haas
a4d914c904 [x64] Do not encode RelocatableInt32Constant(0) with xor
R=titzer@chromium.org

Bug: v8:6640
Change-Id: I08bed124f7c6f6607b28844ea91bee90c1c1ab22
Reviewed-on: https://chromium-review.googlesource.com/586603
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47033}
2017-08-01 09:27:24 +00:00
Tobias Tebbi
a6c3f14374 [turbofan] enable new implementation of escape analysis
Bug: 
Change-Id: I0218ab67bf391deb8f1b1b78811643eb84745b7c
Reviewed-on: https://chromium-review.googlesource.com/595508
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47032}
2017-08-01 08:54:23 +00:00
Clemens Hammacher
6a8432da4f Add DCHECKs for no pending exceptions
We were just debugging a trap triggered in the c entry stub, because
there was a pending exception even though the return value of the
runtime function was not {heap()->exception()}.
The DCHECKs added here help to catch this common error earlier.

R=mstarzinger@chromium.org
CC=ahaas@chromium.org

Also-by: ahaas@chromium.org
Change-Id: I3718dcb64a7924137c9f4bddff62776772d10386
Reviewed-on: https://chromium-review.googlesource.com/594447
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47031}
2017-08-01 08:28:32 +00:00
Juliana Franco
a01ac7cbd9 Replacing pc with trampoline on stack
This CL is the follow up of https://chromium-review.googlesource.com/c/586707/
which used to crash when running the gc-stress bots. 
It seems to be working now. We now keep the trampoline PC in the Safepoint 
table and use that information to find SafepointEntries.

There's some refactoring that can be done, such as changing the code for 
exceptions in a similar way and removing the trampoline from the 
DeoptimizationInputData. Will take care of this in the next CL.

Bug: v8:6563
Change-Id: I02565297093620023a1155b55d76a4dafcb54794
Reviewed-on: https://chromium-review.googlesource.com/593622
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47030}
2017-08-01 08:08:33 +00:00
Enrico Bacis
9a3b2a76c2 [wasm] Add test for growing exported memory past maximum
The test TestExportImportedMemoryGrowMultipleInstances in
test/mjsunit/wasm/import-memory.js had a TODO about not taking into
account the maximum size for exported memory objects, thus permitting to
grow past thhe maximum specified in the exported memory object.

The check is already in place at wasm-objects.cc:266
(https://cs.chromium.org/chromium/src/v8/src/wasm/wasm-objects.cc?rcl=a01b55b548add5aec1d3d4d8fcdadfa01555c6ea&l=266).

This CL removes the TODO and asserts that growing past maximum for
exported objects fails.

R=ahaas@chromium.org, gdeepti@chromium.org

Change-Id: Ifa69e4e85e04bc2280b629cebb30d400cca9420f
Reviewed-on: https://chromium-review.googlesource.com/593948
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Enrico Bacis <enricobacis@google.com>
Cr-Commit-Position: refs/heads/master@{#47029}
2017-08-01 08:03:22 +00:00
Predrag Rudic
316254a710 MIPS[64] Fix SizeOfInitialHeap test failing
Commit 0d833cb94f deleted function call
that created CEntryStub code in snapshot. So when CEntryStub::GetCode is
called while initializing V8, the code for it, is not found in shapshot.
Hence this code has to be generated in new allocation on heap, that is
why initial heap is above the limit.
This patch assures that CEntryStub code is in the snapshot.

Bug: 
Change-Id: Ifc885998e9253ab3e19e4e2409e4c124a5f1b0d1
Reviewed-on: https://chromium-review.googlesource.com/593950
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#47028}
2017-08-01 07:46:42 +00:00
Bill Budge
f8db3e8f38 Reland "[Memory] Add an OnCriticalMemoryPressure method to V8::Platform."
This is a reland of 3f90d9f994
Original change's description:
> [Memory] Add an OnCriticalMemoryPressure method to V8::Platform.
> 
> Adds virtual V8::Platform::OnCriticalMemoryPressure method, default
> implementation does nothing.
> 
> Calls this method on first allocation failures in NewArray, Malloced,
> and zone AccountingAllocator and adds retry logic.
> 
> Adds utility functions for allocating base::VirtualMemory to functions
> in allocation.h, which call this method and add retry logic.
> 
> Calls these utility functions in heap CodeRange, Spaces, StoreBuffer
> and SequentialMarkingDeque.
> 
> Bug: v8:6635
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: I38afd394f3be556aca037d16675e9884658158cb
> Reviewed-on: https://chromium-review.googlesource.com/583543
> Commit-Queue: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46988}

Bug: v8:6635
Change-Id: I0d70c5796f407f0ed42cfddf581d26f533f9bea8
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/593090
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47027}
2017-08-01 01:42:19 +00:00
Deepti Gandluri
03da4fecb7 [wasm] Remove shared parameter to Memory.Grow()
R=mtrofin@chromium.org

Change-Id: Ia1e215d59e9ea863b85c64c2eab41f6cd6fe3404
Reviewed-on: https://chromium-review.googlesource.com/570842
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47026}
2017-08-01 01:26:21 +00:00
Sathya Gunasekaran
c805d5e317 [parser] Provide better error when destructuring callable
The patch changes CallPrinter's AST traversal to continue even after
the first positive match for an AST node. This helps us check for the
subsequent GetIterator AST node in case of destructuring.

We can not differentiate between the function call failing and the
GetIterator failing based on source position info. This would involve
runtime checks costing performance.

Instead of providing an incorrect error, we provide both the
possiblities to user and allow them to disambiguate.

Previously,
  d8> function f() { return 5; }
  undefined
  d8> var [a] = f();
  (d8):1: TypeError: f is not a function
  var [a] = f();
            ^
  TypeError: f is not a function
      at (d8):1:11


Now,
  d8> function f() { return 5; }
  undefined
  d8> var [a] = f();
  (d8):1: TypeError: f is not a function or its return value is not iterable
  var [a] = f();
            ^
  TypeError: f is not a function or its return value is not iterable
      at (d8):1:11

Bug: v8:6616, v8:6513
Change-Id: I3d6427f10cae54951b0ad0e5ddcbe802bb7191c1
Reviewed-on: https://chromium-review.googlesource.com/594894
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47025}
2017-08-01 01:19:08 +00:00
Mathias Bynens
473a6f5b03 Ship RegExp lookbehind assertions
Intent to ship:
https://groups.google.com/d/msg/v8-users/r-SN2yuKTL8/pfwrSuqSBQAJ

BUG=v8:4545

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I15a8a5af211a3af1d2f952b48923288adc09d93c
Reviewed-on: https://chromium-review.googlesource.com/592705
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47024}
2017-08-01 00:01:33 +00:00
Jaideep Bajwa
68b2450bb7 PPC: Disable wasm simd load store testcase
For this testcase to run on BE, it requires Load/store
reversed byte instructions. Disabling testcase until
the necessary instructions are implemented.

R=machenbach@chromium.org, jkummerow@chromium.org
BUG=
LOG=N

Change-Id: I380c9a07030ba12e9b9e81c372496819102e2b0d
Reviewed-on: https://chromium-review.googlesource.com/595047
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47023}
2017-07-31 22:16:39 +00:00
Alexey Kozyatinskiy
f2fe13f663 [inspector] don't call clearAllBreakpoints
This call from inspector side is redundant, V8 will clear all breakpoints on removing debug delegate in v8::internal::Debug::Unload method.

In any case for correct support of multiclient we need to clear breakpoints in V8DebuggerAgentImpl::disable method.

R=dgozman@chromium.org

Bug: v8:5510,chromium:652939
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I66f9b97797860bad28884a099928d54ac3560428
Reviewed-on: https://chromium-review.googlesource.com/592281
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47022}
2017-07-31 21:23:27 +00:00
Alexey Kozyatinskiy
f455986fc1 [inspector] speedup Debugger.getPossibleBreakpoints
In current implementation we call PrepareForBreakPoints during getting possible breakpoints, this call produce GC and iteration through heap, but it's not needed before we set real breakpoint.

On my machine, get-possible-breakpoints-master.js without CL takes ~200ms, with CL it takes ~60 ms. Running test without getPossibleBreakpoints protocol call takes ~50 ms. It means that we have (200-50)/(60-50) = 15 times faster getPossibleBreakpoints.

R=yangguo@chromium.org,jgrubber@chromium.org

Bug: none
Change-Id: If12e41cd87dbba11a89aa5895e3b4d88123d7d3d
Reviewed-on: https://chromium-review.googlesource.com/591027
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47021}
2017-07-31 21:00:57 +00:00
Ulan Degenbaev
6fbbe93c5e Revert "[heap, runtime] Fix data race in prototype map transition during"
This reverts commit d8846ffd5f.

Reason: the fix doesn't work, the proper fix is to not mutate the map.

BUG=chromium:694255
TBR=ishell@chromium.org

Change-Id: Iebef7cd01081145c172902727e0035a8745703b7
Reviewed-on: https://chromium-review.googlesource.com/594727
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47020}
2017-07-31 19:16:24 +00:00
Adam Klein
30a7d497c5 Rename parameter-initializer-rewriter.cc to match its current use
Change-Id: Idb6dfed1d0314c38c25b230faa7e28728cff2637
Reviewed-on: https://chromium-review.googlesource.com/587250
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47019}
2017-07-31 18:54:23 +00:00
Ross McIlroy
9dc664bbdd [Compile] Remove CompilationInfo::ExpectsJSReceiverAsReceiver.
Removes CompilationInfo::ExpectsJSReceiverAsReceiver and the associated
debug code in full-codegen which uses it. This avoids the need to check
language_mode from CompilationInfo and will enable decoupling of
ParseInfo and CompilationInfo in a followup CL.

BUG=v8:5203

Change-Id: Ib88252408e59ef321d16d5a1dd4b2b6cea609729
Reviewed-on: https://chromium-review.googlesource.com/593954
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47018}
2017-07-31 18:08:34 +00:00
Ulan Degenbaev
14e6a65afe [runtime] Use nullptr instead of NULL when calling WRITE_FIELD.
BUG=chromium:694255
TBR=cbruni@chromium.org

Change-Id: I8a7907aa18d2855ca571ae564c7eeda41bf13fbb
Reviewed-on: https://chromium-review.googlesource.com/593655
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47017}
2017-07-31 16:54:17 +00:00
Ulan Degenbaev
7486dc3331 [heap] Partially reland "Allow a minimum semi-space size of 512K."
This sets the minimum semi-space size to 512K, but does not
change the initial semi-space size.

This reverts commit 774a4c5e24.

Original commit message:
> [heap] Allow a minimum semi-space size of 512K.
> This CL also reduces the minimum semi-space size to 512K.
> BUG=chromium:716032
BUG=chromium:735649
TBR=mlippautz@chromium.org

Change-Id: I1f5dd05b0851ba2b438bedcc023a5cf5f9242a81
Reviewed-on: https://chromium-review.googlesource.com/594107
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47016}
2017-07-31 15:45:06 +00:00
Ross McIlroy
9a118af647 [Compile] Remove unused language mode from DeclareGlobalsFlag.
BUG=v8:5203

Change-Id: Id7f1b3a50f5f407e9fdada8a5b62a7ada8d966df
Reviewed-on: https://chromium-review.googlesource.com/593951
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47015}
2017-07-31 15:43:32 +00:00
Leszek Swirski
b34d2ec6a8 [objects] Move deopt_count to FeedbackVector
Since any deopt-count-based heuristics should be native context
dependent, it belongs in the feedback vector rather than the SFI.

Bug: v8:6402
Change-Id: I30804d58bc1dec9150558e6ee21ee5b4dbd36c8d
Reviewed-on: https://chromium-review.googlesource.com/593661
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47014}
2017-07-31 15:28:44 +00:00