Commit Graph

14233 Commits

Author SHA1 Message Date
machenbach
81dd9847cf Revert of [crankshaft] Fix IsClassOfTest helper method (patchset #1 id:1 of https://codereview.chromium.org/2586933002/ )
Reason for revert:
Breaks vtune:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20vtunejit/builds/15379

Original issue's description:
> [crankshaft] Fix IsClassOfTest helper method
>
> Drive-by-fix: Add AstNode::Print() and improve printing of CallRuntime
>               Expression.
>
> BUG=v8:5749
>
> Review-Url: https://codereview.chromium.org/2586933002
> Cr-Commit-Position: refs/heads/master@{#41792}
> Committed: d4493222b9

TBR=bmeurer@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5749

Review-Url: https://codereview.chromium.org/2587973002
Cr-Commit-Position: refs/heads/master@{#41795}
2016-12-19 11:22:36 +00:00
yangguo
07fa0f4967 [serializer] do not serialize script wrappers.
The scenario here: the asm function fails asm validation,
so we emit a message. In doing so, we create a JSValue wrapper for
the script object that we cache on the script object. This wrapper
is context-dependent and causes the code serializer to choke.

R=mtrofin@chromium.org, titzer@chromium.org
BUG=chromium:674446,chromium:673321

Review-Url: https://codereview.chromium.org/2586943003
Cr-Commit-Position: refs/heads/master@{#41794}
2016-12-19 10:53:02 +00:00
cbruni
d4493222b9 [crankshaft] Fix IsClassOfTest helper method
Drive-by-fix: Add AstNode::Print() and improve printing of CallRuntime
              Expression.

BUG=v8:5749

Review-Url: https://codereview.chromium.org/2586933002
Cr-Commit-Position: refs/heads/master@{#41792}
2016-12-19 10:45:48 +00:00
yangguo
1296dd1f5a [debug-wrapper] remove last uses of --expose-debug-as
The inspector cannot deal with breaking inside of debug-evaluate.
There is therefore no point in supporting that in the debugger.
The optional additional context parameter for debug-evaluate also
can be removed since it's not being used.

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2580323002
Cr-Commit-Position: refs/heads/master@{#41791}
2016-12-19 10:44:34 +00:00
henrique.ferreiro
815f91c0ed [es6] Perform the IsConstructor test in GetSuperConstructor.
This is so that a NotSuperConstructor error is thrown before evaluating the
arguments to the super constructor. Besides updating the runtime function, a
new bytecode GetSuperConstructor is introduced.

BUG=v8:5336

Review-Url: https://codereview.chromium.org/2504553003
Cr-Commit-Position: refs/heads/master@{#41788}
2016-12-19 10:12:22 +00:00
kozyatinskiy
c42915f02d [inspector] introduce limit for amount of stored async stacks
BUG=v8:5738
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2579403002
Cr-Commit-Position: refs/heads/master@{#41783}
2016-12-18 17:04:40 +00:00
bbudge
431223f34f [ARM] Add NEON instructions for implementing SIMD.
- Adds vabs, vneg, vmul, vext, vzip, vrev instructions.
- Adds Swizzle function to macro assembler.
- Simplifies if-else logic in disassembler, simulator, for Neon special.
- Some refactoring of Neon assembler, macro-assembler tests.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2579913002
Cr-Commit-Position: refs/heads/master@{#41781}
2016-12-17 21:56:26 +00:00
mtrofin
9564d803ea Move register allocation unittests and constrain owners
There are subtle test expectations/nuances that are easy to break.

BUG=

Review-Url: https://codereview.chromium.org/2585583006
Cr-Commit-Position: refs/heads/master@{#41778}
2016-12-17 00:24:36 +00:00
mtrofin
8e833623e9 Revert of MIPS: Fix bad RegisterConfiguration usage in InstructionSequence unit tests. (patchset #3 id:40001 of https://codereview.chromium.org/2433093002/ )
Reason for revert:
This change rendered InstructionSequenceTest::SetNumRegs ineffectual, thus
loosening the tests that were using that API to ensure correct register
allocation under intentionally constrained setups.

For the problem stated in this CL, a solution needs to continue supporting the
intentionally set-up test configuration.

Original issue's description:
> MIPS: Fix bad RegisterConfiguration usage in InstructionSequence unit tests.
>
> Test InstructionSequenceTest has been initialized with a testing RegisterConfiguration
> instance defined in instruction-sequence-unittest.h, whereas class ExplicitOperand which
> is being tested used RegisterConfiguration from instruction.cc. In case these two
> instances are different, the tests would fail. The issue is fixed by using the same
> instance of RegisterConfiguration both for test code and code under test.
>
> Additionally, the tests in register-allocator-unittest.cc use hardcoded values
> for register and begin failing is the hardcoded register is not available for
> allocation. Fix by forcing the use of allocatable registers only.
>
> TEST=unittests.MoveOptimizerTest.RemovesRedundantExplicit,unittests.RegisterAllocatorTest.SpillPhi
> BUG=
>
> Committed: https://crrev.com/0cf56232209d4c9c669b8426680de18806f6c29a
> Cr-Commit-Position: refs/heads/master@{#40862}

TBR=dcarney@chromium.org,bmeurer@chromium.org,mstarzinger@chromium.org,vogelheim@chromium.org,titzer@chromium.org,ivica.bogosavljevic@imgtec.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2587593002
Cr-Commit-Position: refs/heads/master@{#41777}
2016-12-16 23:09:34 +00:00
gsathya
b1c148b91f [promisehook] Implement PromiseHook
This adds kInit, kResolve, kBefore and kAfter lifecycle hooks to promises.

This also exposes an API to set the PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2575313002
Cr-Commit-Position: refs/heads/master@{#41775}
2016-12-16 19:17:16 +00:00
clemensh
8341b8baf4 [wasm] Fix nondeterministic Win64 failures
E.g.
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/14083/steps/Check/logs/RunWasmCompiledWithTr..

This also reverts CL http://crrev.com/2584833002 which
disabled the tests on windows.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2579213004
Cr-Commit-Position: refs/heads/master@{#41769}
2016-12-16 15:32:09 +00:00
mythria
74ccda64dc [Interpreter] Transform StrictEquality with null/undefined to special bytecodes.
Transform LdaNull/LdaUndefined followed by StrictEquality to TestNull/TestUndefined.
This would avoid a call to the compare IC. In the bytecode-graph builder these are
mapped to StrictEqual javascript operator. When reducing this operator, we already
optimize the cases for null/undefined.

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2554723004
Cr-Commit-Position: refs/heads/master@{#41768}
2016-12-16 15:01:08 +00:00
jochen
692ba84f4f Use idle time to make progress on scheduled compilation jobs
BUG=v8:5215
R=rmcilroy@chromium.org,marja@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2573493002
Cr-Commit-Position: refs/heads/master@{#41767}
2016-12-16 14:40:32 +00:00
yangguo
bcb73f6219 [inspector] add scope type for modules.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2568083002
Cr-Commit-Position: refs/heads/master@{#41765}
2016-12-16 14:28:56 +00:00
rossberg
16fe426320 Implement LinkError; import tweaks
- Implement new WebAssembly.LinkError exception
- Implement stricter checks for glboal imports
- Add tests
- Refactor handling of import names
- Add TODOs for empty import names

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2584843002
Cr-Commit-Position: refs/heads/master@{#41764}
2016-12-16 14:23:35 +00:00
clemensh
bb76432fde [wasm] Disable trap-if test on windows for now
It's failing nondeterministically.
Disable trap-if tests on windows until this issue is fixed.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2584833002
Cr-Commit-Position: refs/heads/master@{#41763}
2016-12-16 14:20:13 +00:00
yangguo
d2d6da0354 [serializer] add test for snapshotting cached accessor property.
R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2582623003
Cr-Commit-Position: refs/heads/master@{#41761}
2016-12-16 13:25:19 +00:00
cbruni
89f159b042 [runtime] Port simple String.prototype.indexOf cases to TF Builtin
Many websites use simple calls to String.prototype.indexOf with either a
one character ASCII needle or needles bigger than the search string. This
CL adds a TFJ builtin for these simple cases, giving up to factor 5 speedup.

Drive-by-fix: Add default Object type to Arguments.at

BUG=

Review-Url: https://codereview.chromium.org/2539093002
Cr-Commit-Position: refs/heads/master@{#41760}
2016-12-16 13:24:07 +00:00
yangguo
55e8c2e4d3 [serializer] allocate global proxy with the expected size.
If a context snapshot includes the global proxy constructor function, we
expect the incoming global proxy to have the correct instance size so
that we can reinitialize it with said constructor. However, when the
bootstrapper allocates a new global proxy, we need to know the expected
size.

We solve this by storing the size on the to-be-serialized isolate.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2585693002
Cr-Commit-Position: refs/heads/master@{#41756}
2016-12-16 12:40:38 +00:00
jochen
87bf033799 Don't compile inner functions when compiling via the dispatcher
BUG=v8:5394
R=mstarzinger@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2579973002
Cr-Commit-Position: refs/heads/master@{#41754}
2016-12-16 12:38:17 +00:00
mstarzinger
92b370ee64 Introduce {ConstantElementsPair} struct for type safety.
This introduces an explicit struct for the communication channel between
the {ArrayLiteral} AST node and the corresponding runtime methods. Those
methods take a pair of {ElementsKind} as well as an array (can either be
a FixedArray or a FixedDoubleArray) of constant values.

For bonus points it also reduces the size of the involved heap object by
one word (i.e. length field of FixedArray not needed anymore).

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2581683003
Cr-Commit-Position: refs/heads/master@{#41752}
2016-12-16 10:57:06 +00:00
rmcilroy
cb9d0fe7f4 [Complier] Only optimize a function marked for tier-up if it is compiled.
When mark-shared-funtion-for-tier-up is enabled, a function could be marked for
optimization, then the baseline (FCG) code is flushed by the GC. The next time
the function is executed, we shouldn't optimize the code if there isn't
baseline code.

BUG=chromium:673242

Review-Url: https://codereview.chromium.org/2575333003
Cr-Commit-Position: refs/heads/master@{#41751}
2016-12-16 10:44:50 +00:00
clemensh
6709edd7f6 [wasm] Make WasmRunner the central test structure
The WasmRunner now always holds a TestingModule, and allows to add
several functions to it. The prepares a change to always run wasm code
with a full module behind it, removing the special handling for "no wasm
instance" at runtime (http://crrev.com/2551053002).
This CL here also templatizes the WasmRunner such that the Call method must
be called with the same signature specified for the WasmRunner. This
already catched several mismatches there.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551043002
Cr-Original-Commit-Position: refs/heads/master@{#41728}
Committed: 2ff5906231
Review-Url: https://codereview.chromium.org/2551043002
Cr-Commit-Position: refs/heads/master@{#41747}
2016-12-16 10:13:11 +00:00
neis
e3ad4f131b [modules] Remove @@iterator on namespace objects.
TC39 decided at their last meeting to remove this feature.

R=adamk@chromium.org
TBR=ulan@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2578053003
Cr-Commit-Position: refs/heads/master@{#41745}
2016-12-16 08:57:29 +00:00
machenbach
6932ea5904 Revert of Disallow passing a SharedArrayBuffer in the transfer list. (patchset #4 id:60001 of https://codereview.chromium.org/2570433005/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/12098

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Disallow passing a SharedArrayBuffer in the transfer list.
>
> This behavior changed recently. SharedArrayBuffers should not be put in the
> transfer list, because they are not detached, and that is the meaning of being
> in the transfer list.
>
> This is the V8 side of the change, the Blink side will come next.
>
> Review-Url: https://codereview.chromium.org/2570433005
> Cr-Commit-Position: refs/heads/master@{#41740}
> Committed: 1c5e1504e0

TBR=jbroman@chromium.org,jkummerow@chromium.org,binji@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2579963002
Cr-Commit-Position: refs/heads/master@{#41744}
2016-12-16 07:34:40 +00:00
binji
1c5e1504e0 Disallow passing a SharedArrayBuffer in the transfer list.
This behavior changed recently. SharedArrayBuffers should not be put in the
transfer list, because they are not detached, and that is the meaning of being
in the transfer list.

This is the V8 side of the change, the Blink side will come next.

Review-Url: https://codereview.chromium.org/2570433005
Cr-Commit-Position: refs/heads/master@{#41740}
2016-12-15 23:55:03 +00:00
bbudge
03f33f2e68 [Turbofan] Add ARM NEON instructions for implementing SIMD.
- Adds NEON instructions to assembler, disassembler, simulator.
- Adds ExtractLane, ReplaceLane functions to macro assembler.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2546933002
Cr-Commit-Position: refs/heads/master@{#41737}
2016-12-15 18:15:23 +00:00
jochen
4f2cb8fe82 Reland of "Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID"
Original CL description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Review-Url: https://codereview.chromium.org/2547483002

BUG=v8:5589
TBR=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2577063002
Cr-Commit-Position: refs/heads/master@{#41734}
2016-12-15 17:19:55 +00:00
clemensh
5993a1161b Revert of [wasm] Make WasmRunner the central test structure (patchset #5 id:80001 of https://codereview.chromium.org/2551043002/ )
Reason for revert:
Win64 dbg failures

Original issue's description:
> [wasm] Make WasmRunner the central test structure
>
> The WasmRunner now always holds a TestingModule, and allows to add
> several functions to it. The prepares a change to always run wasm code
> with a full module behind it, removing the special handling for "no wasm
> instance" at runtime (http://crrev.com/2551053002).
> This CL here also templatizes the WasmRunner such that the Call method must
> be called with the same signature specified for the WasmRunner. This
> already catched several mismatches there.
>
> R=titzer@chromium.org, ahaas@chromium.org
> BUG=v8:5620
>
> Review-Url: https://codereview.chromium.org/2551043002
> Cr-Commit-Position: refs/heads/master@{#41728}
> Committed: 2ff5906231

TBR=ahaas@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2583543002
Cr-Commit-Position: refs/heads/master@{#41732}
2016-12-15 16:51:11 +00:00
neis
7ca7229283 [parsing] Be less pessimistic about maybe_assigned of parameters.
Instead of unconditionally setting maybe_assigned for parameters, treat
parameters like other variables except that at the end we set maybe_assigned if
the function has a sloppy arguments object.

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2578103002
Cr-Commit-Position: refs/heads/master@{#41731}
2016-12-15 16:04:44 +00:00
gsathya
b4aadaec1e [promisehook] Store promise in PromiseReactionJob
This will be used in PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2581503003
Cr-Commit-Position: refs/heads/master@{#41730}
2016-12-15 15:50:54 +00:00
clemensh
2ff5906231 [wasm] Make WasmRunner the central test structure
The WasmRunner now always holds a TestingModule, and allows to add
several functions to it. The prepares a change to always run wasm code
with a full module behind it, removing the special handling for "no wasm
instance" at runtime (http://crrev.com/2551053002).
This CL here also templatizes the WasmRunner such that the Call method must
be called with the same signature specified for the WasmRunner. This
already catched several mismatches there.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551043002
Cr-Commit-Position: refs/heads/master@{#41728}
2016-12-15 15:37:29 +00:00
franzih
0e7a2ca0d7 [runtime] Throw if re-declaring a non-configurable accessor.
If an accessor property is non-configurable, one should not be able
to re-declare it as a function. This specifically applies to special properties like window.location.

BUG=chromium:670596

Review-Url: https://codereview.chromium.org/2582493002
Cr-Commit-Position: refs/heads/master@{#41725}
2016-12-15 14:41:07 +00:00
marja
ed080e6966 Disable lazy parsing inside eval (see bug).
If the eval contains a let, we need to know whether an inner function
refers to the variable to be able to decide its context allocation
status.

The added test needs https://codereview.chromium.org/2435023002/ too
in order to pass.

BUG=v8:5736

Review-Url: https://codereview.chromium.org/2574753002
Cr-Commit-Position: refs/heads/master@{#41723}
2016-12-15 14:26:58 +00:00
ishell
f1441384ff [stubs] Remove CSA::INTEGER_PARAMETERS in favor of CSA::INTPTR_PARAMETERS.
BUG=

Review-Url: https://codereview.chromium.org/2580533002
Cr-Commit-Position: refs/heads/master@{#41722}
2016-12-15 14:01:07 +00:00
ahaas
7bd61b601c [wasm] Introduce the TrapIf and TrapUnless operators to generate trap code.
Some instructions in WebAssembly trap for some inputs, which means that the
execution is terminated and (at least at the moment) a JavaScript exception is
thrown. Examples for traps are out-of-bounds memory accesses, or integer
divisions by zero.

Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
constant), in addition to the trap condition itself. Additionally, each
WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
number of inputs is linear to the number of trap checks in the function.
Especially for functions with high numbers of trap checks we observe a
significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
a TrapIf common operator only a single node is necessary per trap check, in
addition to the trap condition. Also the nodes which are shared between trap
checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
speedup of 30-50% on average.

This CL only implements TrapIf and TrapUnless on x64. The implementation is also
hidden behind the --wasm-trap-if flag.

Please take a special look at how the source position is transfered from the
instruction selector to the code generator, and at the context that is used for
the runtime call.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2562393002
Cr-Commit-Position: refs/heads/master@{#41720}
2016-12-15 13:31:29 +00:00
leszeks
bcb38979f7 [turbofan] Add and use bytecode loop assigment analysis
Adds assignment tracking to the bytecode analysis pass, and updates
bytecode graph builder to only create LoopExitValues for assigned
values.

Review-Url: https://codereview.chromium.org/2558093005
Cr-Commit-Position: refs/heads/master@{#41719}
2016-12-15 13:24:19 +00:00
jarin
01de216fd7 [turbofan] Handle the impossible value representation mismatch in instruction selector.
Review-Url: https://codereview.chromium.org/2579743002
Cr-Commit-Position: refs/heads/master@{#41718}
2016-12-15 12:13:06 +00:00
ivica.bogosavljevic
ee7281f8ff MIPS[64]: Disable fusion multiple-accumulate instructions
MIPS[64]R6 supports only fusion multiply-accumulate instructions, and using
these causes failures of several tests that expect exact floating-point
results. Therefore we disable fusion multiply-accumulate in both emitted and
compiled code on R6.

TEST=cctest/test-run-machops/RunFloat64MulAndFloat64Add1,mjsunit/es6/math-expm1.js
mjsunit/es6/math-fround.js,mjsunit/compiler/multiply-add.js

BUG=

Review-Url: https://codereview.chromium.org/2569683002
Cr-Commit-Position: refs/heads/master@{#41717}
2016-12-15 11:50:12 +00:00
ishell
b5925c0ad0 [stubs] Enable machine graph verification for CodeStubAssembler and friends by default in debug mode.
BUG=

Review-Url: https://codereview.chromium.org/2570213002
Cr-Commit-Position: refs/heads/master@{#41715}
2016-12-15 11:45:18 +00:00
rmcilroy
ae741d042c [Interpreter] Allocate registers used as call arguments on-demand.
Allocate the registers used as arguments to a call on-demand after visiting the
argument (or reciever). This means that the visited expression can use registers
that would otherwise have been allocated for arguments which haven't been
visited yet.

The reason for doing this is to avoid keeping things live in registers
unecessarily for chained function calls, which avoids a memory leak for
functions which chain a large number of calls with large temporary arguments /
recievers.

BUG=chromium:672027

Review-Url: https://codereview.chromium.org/2557173004
Cr-Commit-Position: refs/heads/master@{#41714}
2016-12-15 10:59:57 +00:00
mstarzinger
6c620e5312 Fix usage of literal cloning for large double arrays.
This fixes a corner case where the {FastCloneShallowArrayStub} was used
for literals that are backed by a double backing store and would exceed
limits for new-space allocations on 32-bit architectures. The stub in
question does not support such literals, callers must use the runtime.
Note that this fix is for Ignition as well as FullCodeGenerator.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-672792
BUG=chromium:672792

Review-Url: https://codereview.chromium.org/2570843002
Cr-Commit-Position: refs/heads/master@{#41713}
2016-12-15 10:29:47 +00:00
rmcilroy
e27b348d1a [Interpreter] Templatize AccumulatorUsage and OperandType for bytecode creation.
Templatizes the AccumulatorUsage and OperandType for BytecodeNode creation and
BytecodeRegisterOptimizer::PrepareForBytecode. This allows the compiler to
statically know whether the bytecode being created accesses the accumulator
and what operand types need scaling, avoiding runtime checks in the code.

Also removes BytecodeNode::set_bytecode methods.

Review-Url: https://codereview.chromium.org/2542903003
Cr-Commit-Position: refs/heads/master@{#41706}
2016-12-15 07:56:21 +00:00
jgruber
f3b9d570cb [regexp] Let RegExp.prototype.compile return this
ES6 requires the compile method to return this:
www.ecma-international.org/ecma-262/6.0/#sec-regexp.prototype.compile

BUG=v8:5722,chromium:585775

Review-Url: https://codereview.chromium.org/2577653002
Cr-Commit-Position: refs/heads/master@{#41705}
2016-12-15 07:29:39 +00:00
mtrofin
77b50a8e12 [wasm] disable serialization for asm-wasm
Determine if the scope of the function to be serialized includes asm-
wasm, and if so, bypass serialization, since we do not support it in
that scenario.

In this change, we do so regardless of whether the asm-wasm path was
successful. This is so we keep the design simple, since the guidance
to developers, moving forward, is to use wasm.

BUG=643595

Review-Url: https://codereview.chromium.org/2573193002
Cr-Commit-Position: refs/heads/master@{#41704}
2016-12-15 05:06:54 +00:00
titzer
058939ab93 [wasm] Enforce limits for maximums for many WebAssembly binary entities.
This CL moves even more limits to wasm-limits.h and enforces limits for
types, functions, parameter counts, return counts, local counts, imports,
globals, and exports.

R=clemensh@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2574133002
Cr-Commit-Position: refs/heads/master@{#41699}
2016-12-14 17:46:47 +00:00
nikolaos
f39665e360 [parser] Fix bug with non-static name method/property
Without this patch, the tests on lines 410, 414, 418 and 422 in
function testNonStaticName of test/mjsunit/es6/function-name.js
would all fail.  The bug caused non-static "name" methods and
properties to be mistaken for static ones.

R=adamk@chromium.org, verwaest@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2567343004
Cr-Commit-Position: refs/heads/master@{#41692}
2016-12-14 12:12:01 +00:00
titzer
576abe14c6 [runtime] Add instance size check for CheckEquivalent().
WASM exported functions have additional internal fields which change the instance
size. Adding a getter or setter to such an exported function results in its map
becoming normalized. The normalized map cache, however, finds a different map
with a different instance size, and thus BOOM.

R=verwaest@chromium.org,cbruni@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2554343002
Cr-Commit-Position: refs/heads/master@{#41691}
2016-12-14 11:59:56 +00:00
yangguo
341b39f9d0 [debug-wrapper] migrate some scope related tests
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2566093002
Cr-Commit-Position: refs/heads/master@{#41688}
2016-12-14 07:20:33 +00:00
jgruber
bbf3c697ae [heap] Initialize the owner on each page after lospace allocation
The least two bits of the owner field of a Page are used to determine
whether the Page is part of a large object. If these bits are not equal
to 0x11, the page is part of a large object and needs special handling
e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
belongs to.

This CL fixes an issue in which the store buffer overflows after
a large object space allocation but before the object has been fully
initialized. Store buffer overflow handling attempts to look up the
chunk of a page, but fails to do so correctly since the page's owner
field has not yet been initialized.

This CL ensures that the owner field of all pages belonging to a large
object allocation are initialized to a value that is interpreted
correctly.

BUG=chromium:672041

Committed: https://crrev.com/9b6808bfb5366beebe3af30a06f9851edb2039d4
Review-Url: https://codereview.chromium.org/2565713002
Cr-Original-Commit-Position: refs/heads/master@{#41641}
Cr-Commit-Position: refs/heads/master@{#41687}
2016-12-14 06:45:35 +00:00