Commit Graph

13117 Commits

Author SHA1 Message Date
rmcilroy
a550528dd2 [Ignition] Add test of bytecode compilation on background thread.
BUG=v8:5203

Review-Url: https://codereview.chromium.org/2278153003
Cr-Commit-Position: refs/heads/master@{#39207}
2016-09-06 13:34:44 +00:00
mlippautz
059b56435a Move kMaxRegularHeapObjectSize into globals
This way we avoid the cyclic dependency between objects.h and heap.h and still
have one definition. Add a static assert that this size is indeed smaller than
the payload of a page.

Follow ups can finally remove the dependency on spaces.h for all heap.h users.

R=ulan@chromium.org,bmeurer@chromium.org,vogelheim@chromium.og

Review-Url: https://codereview.chromium.org/2311203002
Cr-Commit-Position: refs/heads/master@{#39206}
2016-09-06 12:59:37 +00:00
mstarzinger
553d504923 [turbofan] Handle ObjectIsReceiver in escape analysis.
This adds handling of {IrOpcode::kObjectIsReceiver} nodes to the escape
status analysis. Such uses are treated as escaping for now until we add
dedicated handling to the escape analysis reducer.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-631027
BUG=chromium:631027

Review-Url: https://codereview.chromium.org/2317623003
Cr-Commit-Position: refs/heads/master@{#39205}
2016-09-06 11:59:31 +00:00
rmcilroy
c950256013 [Turbofan] Fix CallSuper argument order in BytecodeGraphBuilder.
The constructor and new.target arguments were passed to CallConstruct in
the wrong order by BytecodeGraphBuilder, which caused subclassing to be
incorrect when optimizing from bytecode.

Also clean up some unecessary functions in interpreter.cc found while
figuring this out.

BUG=chromium:642409

Review-Url: https://codereview.chromium.org/2312103002
Cr-Commit-Position: refs/heads/master@{#39204}
2016-09-06 11:53:19 +00:00
jacob.bramley
1001ddf20f [arm] Implement barriers on ARMv6 using CP15.
ARMv6 has the same basic barriers as ARMv7+, but they are accessed using
the CP15 coprocessor. This patch allows the assembler to select the
appropriate instruction.

This also fixes TurboFan's atomic loads and stores for ARMv6 platforms.

BUG=

Review-Url: https://codereview.chromium.org/2318553002
Cr-Commit-Position: refs/heads/master@{#39203}
2016-09-06 11:30:31 +00:00
jacob.bramley
3396bb2907 [arm] Improve Float(32|64)(Max|Min).
ARMv8 can use vminnm and vmaxnm to handle most inputs. Other platforms
use an implementation similar to what was there before, except that
out-of-line code is used for the uncommon cases.

BUG=

Review-Url: https://codereview.chromium.org/2313863003
Cr-Commit-Position: refs/heads/master@{#39202}
2016-09-06 11:28:19 +00:00
mlippautz
ed8791ea65 [heap,snapshot] Replace first page size from snapshots with page trimming
Replace first page size in the snapshots with a heap logic that trims pages
after deserialization. The snapshot provided page sizes was just an
approximation, while the heap knows exactly where to trim.

Furthermore, trim the pages directly after deserialization, leaving no wiggle
room for further objects. This avoids pollution of the immortal immovable pages
with regular objects, e.g. Contexts. The downside is that we potentially require
expanding the space with a new page.

BUG=chromium:636331

Review-Url: https://codereview.chromium.org/2311963002
Cr-Commit-Position: refs/heads/master@{#39200}
2016-09-06 11:03:03 +00:00
ahaas
1a5f8fa536 [wasm] Validate the length of strings before validating the string.
BUG=chromium:644182
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:ExportNameWithInvalidStringLength

Review-Url: https://codereview.chromium.org/2310023002
Cr-Commit-Position: refs/heads/master@{#39199}
2016-09-06 09:50:38 +00:00
bmeurer
c071a8f0ca [turbofan] Introduce dedicated NumberToBoolean operator.
Previously we always lowered JSToBoolean(x:Number) to the subgraph
NumberLessThan(0.0, NumberAbs(x)), which deals with both 0, -0 and
NaNs appropriately. However this doesn't always generate the best,
especially when we can later derive from feedback that x is always
an Integral32 value, where the ideal code would be just a single
comparison to 0 w/o the absolute value computation.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309953002
Cr-Commit-Position: refs/heads/master@{#39194}
2016-09-06 08:54:55 +00:00
jacob.bramley
a0ff620fbf [arm] Add support for vminnm and vmaxnm.
These are ARMv8 instructions that will be used in a follow-up patch.

BUG=

Review-Url: https://codereview.chromium.org/2273003002
Cr-Commit-Position: refs/heads/master@{#39193}
2016-09-06 08:46:31 +00:00
jochen
77c4ba0767 Store the ScopeInfo in WithContexts
This will allow for chaining ScopeInfos together to form the same chains
as contexts chains currently do.

BUG=v8:5215
R=mstarzinger@chromium.org,marja@chromium.org,bmeurer@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2314483002
Cr-Commit-Position: refs/heads/master@{#39192}
2016-09-06 08:27:52 +00:00
jbroman
5a97e95520 Handle errors in v8::ValueDeserializer by throwing exceptions.
This restores the contract that all API methods that return Maybe<T> or
MaybeLocal<T> always throw an exception when they return nothing.

Since v8::ValueDeserializer::ReadHeader can now throw exceptions, it
needs a Local<Context> parameter so that it can set up execution state
(entering the context, etc.). The old method has been marked for
deprecation, but since this API is experimental I intend to remove it
as soon as I've removed the use from Blink.

value-serializer-unittest has been updated to expect an exception in
all decode failure cases.

BUG=chromium:148757,chromium:641964

Review-Url: https://codereview.chromium.org/2308053002
Cr-Commit-Position: refs/heads/master@{#39188}
2016-09-06 03:24:53 +00:00
mstarzinger
cc1249b779 [compiler] Bytecode preparation fails for asm.js modules.
This handles the case where preparation of bytecode might fail inside
Compiler::EnsureBytecode due to the underlying function being a fully
validated asm.js module. We simply bailout of bytecode preparation.

R=bradnelson@chromium.org
TEST=mjsunit/regress/regress-crbug-644111
BUG=chromium:644111

Review-Url: https://codereview.chromium.org/2309853002
Cr-Commit-Position: refs/heads/master@{#39187}
2016-09-05 23:03:07 +00:00
mvstanton
8af781ea82 [turbofan] Don't propagate truncations if output is tagged.
Disable the propagation of truncations through Phi, Select or TypeGuard
if the output representation is tagged, because when the truncations are
taken we don't necessarily reflect this in the types and therefore we
might end up in a situation where we produce a word32 value, the type
says Number, and now we need to change that to tagged, which is not
possible since we don't know how to interpret the bits, i.e. whether the
value is Signed32 or Unsigned32.

BUG=chromium:644048

Review-Url: https://codereview.chromium.org/2311903002
Cr-Commit-Position: refs/heads/master@{#39186}
2016-09-05 20:54:56 +00:00
georgia.kouveli
9da7ac6fdb [arm] Improve generation of flag setting instructions.
Generate a flag-setting instruction for a binary operation when
the result is tested for equality/inequality to zero.

BUG=

Review-Url: https://codereview.chromium.org/2315453002
Cr-Commit-Position: refs/heads/master@{#39183}
2016-09-05 16:18:42 +00:00
mvstanton
c30cc0722e [turbofan] put src/types.[h/cc] into src/compiler/types.[h/cc]
BUG=

Review-Url: https://codereview.chromium.org/2309823002
Cr-Commit-Position: refs/heads/master@{#39181}
2016-09-05 15:58:45 +00:00
jgruber
ee7f14cb54 Revert of [regexp] Port RegExp getters and setters (patchset id:80001 of https://codereview.chromium.org/2305573002/ )
Reason for revert:
Performance regressions: crbug.com/644087
Clusterfuzz: crbug.com/644074

We'll reland all regexp changes at once when the port is complete and at least performance-neutral, since the partial port requires slow workarounds.

Original issue's description:
> [regexp] Port RegExp getters and setters
>
> BUG=v8:5339
>
> Committed: https://crrev.com/ac0eb5e05af40e16ae9402bb8a62600b32cc2ec9
> Committed: https://crrev.com/7711b1a16f864ed6ea56fa40274ff3f6287bbe34
> Cr-Original-Commit-Position: refs/heads/master@{#39076}
> Cr-Commit-Position: refs/heads/master@{#39088}

TBR=bmeurer@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2313713002
Cr-Commit-Position: refs/heads/master@{#39176}
2016-09-05 13:48:46 +00:00
jkummerow
685be31203 Reland of [stubs] Port KeyedLoadIC_Generic stub to TurboFan
And also handle dictionary elements loads in the dispatcher.

This is a reland with fix for negative indices into DICTIONARY_ELEMENTS.
Original review: https://codereview.chromium.org/2245683002/

Review-Url: https://codereview.chromium.org/2313683002
Cr-Commit-Position: refs/heads/master@{#39172}
2016-09-05 13:18:08 +00:00
machenbach
6c335b7aae [gn] Switch linux asan to gn
Also disable four cpu-profiler tests under asan that fail
with the GN setup.

BUG=chromium:474921,v8:5243

Review-Url: https://codereview.chromium.org/2309263002
Cr-Commit-Position: refs/heads/master@{#39171}
2016-09-05 13:16:40 +00:00
bmeurer
68b47f5e0f [turbofan] Also nuke Array and Function types.
We used to have Array types for typed arrays in asm.js at some point,
but had to change that quite some time ago already. And Function types
were mostly used for the CallInterfaceDescriptor (and the code-stub.js
experiment), but are also unusedn nowadays.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2310923002
Cr-Commit-Position: refs/heads/master@{#39168}
2016-09-05 13:03:53 +00:00
bmeurer
b5f60820ac [turbofan] Nuke the context types.
Those have been effectively unused for quite a while now, and we
don't see any use in having them around. Actually it'd be way more
consistent and simpler to just use OtherInternal as type for contexts
instead.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2305383002
Cr-Commit-Position: refs/heads/master@{#39166}
2016-09-05 12:41:02 +00:00
jochen
9b6ff3a8f6 Store the scope info in catch contexts
Since the extension field is already used for the catch name, store a
ContextExtension there instead.

In the future, this will allow for chaining ScopeInfos together, so we
no longer need a context chain for lazy parsing / compilation.

BUG=v8:5215
R=bmeurer@chromium.org,neis@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2302013002
Cr-Commit-Position: refs/heads/master@{#39164}
2016-09-05 12:10:53 +00:00
mstarzinger
5fd798afd6 [interpreter] Make tick counter test code properly warm-up.
R=rmcilroy@chromium.org
BUG=v8:4680

Review-Url: https://codereview.chromium.org/2282733002
Cr-Commit-Position: refs/heads/master@{#39163}
2016-09-05 11:56:51 +00:00
marja
7a6fb4d0e9 Include only stuff you need, part 7: Fix scopes.h -> ast.h.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2312683002
Cr-Commit-Position: refs/heads/master@{#39161}
2016-09-05 11:54:34 +00:00
machenbach
359a00bf6f Revert of [wasm] reuse the first compiled module (patchset id:220001 of https://codereview.chromium.org/2305903002/ )
Reason for revert:
mac gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/8341

Original issue's description:
> [wasm] reuse the first compiled module.
>
> This change avoids needing to keep around an unused compiled
> module. Instead, the result of compiling the wasm bytes is
> given to the first instance. The module object and that instance object
> point to the same compiled module. Instances are, then, cloned from
> the compiled module the module object points to. When an instance is
> collected, we make sure that the module object still has a clone
> available, and, if the last instance is GC-ed, we also reset the compiled
> module so that it does not reference its heap, so that it (==heap) may
> be collected.
>
> This is achieved by linking the clones in a double-linked list and
> registering a finalizer for each. When we create an instance, we tie it
> in the front of the list, making the module object point to it (O(1)). When
> the finalizer is called, we relink the list over the dying object (O(1)). The
> costliest operation is finalizing the last instance, since we need to visit
> all wasm functions and reset heap references.
>
> BUG=v8:5316
>
> Committed: https://crrev.com/01f5af515728aebe6c5246f4f7dd6c573e8748af
> Cr-Commit-Position: refs/heads/master@{#39153}

TBR=bradnelson@chromium.org,verwaest@chromium.org,vogelheim@chromium.org,yangguo@chromium.org,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5316

Review-Url: https://codereview.chromium.org/2306403002
Cr-Commit-Position: refs/heads/master@{#39154}
2016-09-05 10:49:53 +00:00
mtrofin
01f5af5157 [wasm] reuse the first compiled module.
This change avoids needing to keep around an unused compiled
module. Instead, the result of compiling the wasm bytes is
given to the first instance. The module object and that instance object
point to the same compiled module. Instances are, then, cloned from
the compiled module the module object points to. When an instance is
collected, we make sure that the module object still has a clone
available, and, if the last instance is GC-ed, we also reset the compiled
module so that it does not reference its heap, so that it (==heap) may
be collected.

This is achieved by linking the clones in a double-linked list and
registering a finalizer for each. When we create an instance, we tie it
in the front of the list, making the module object point to it (O(1)). When
the finalizer is called, we relink the list over the dying object (O(1)). The
costliest operation is finalizing the last instance, since we need to visit
all wasm functions and reset heap references.

BUG=v8:5316

Review-Url: https://codereview.chromium.org/2305903002
Cr-Commit-Position: refs/heads/master@{#39153}
2016-09-05 10:08:44 +00:00
bmeurer
7e95e2064a [turbofan] Nuke class types.
There are no users of class types left inside TurboFan, so we can nuke
them and thereby simplify the type system quite a bit.

R=mvstanton@chromium.org
BUG=v8:5267,v8:5270

Review-Url: https://codereview.chromium.org/2309753002
Cr-Commit-Position: refs/heads/master@{#39152}
2016-09-05 09:19:16 +00:00
bmeurer
99e91aaeac [turbofan] Fold "boolean not"-like Selects into branches.
Fold a Select that negates a boolean value, i.e. returning true in the
false case and vice versa, into Branch users, similar to what we already
do for Branch nodes with BooleanNot inputs.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2308303003
Cr-Commit-Position: refs/heads/master@{#39149}
2016-09-05 07:02:36 +00:00
adamk
6dd2bc20b4 Remove unnessary includes of parser.h
This makes for slightly faster rebuilds when touching parser-base.h
(which changes frequently!). Also takes care of an old TODO,
moving CompileTimeValue into its own file under ast/, where it
properly belongs.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2305883002
Cr-Commit-Position: refs/heads/master@{#39141}
2016-09-02 17:48:46 +00:00
jgruber
300f4413eb Do not call into JS from WasmDebugInfo::GetFunctionScript
This disables notification of wasm script 'compilation' since
OnAfterCompile actually triggers a JS call (which is disallowed during
stack trace collection).

BUG=641065

Review-Url: https://codereview.chromium.org/2304943002
Cr-Commit-Position: refs/heads/master@{#39139}
2016-09-02 14:56:56 +00:00
franzih
d9a026e628 [api] Minor improvement to documentation for kNonMasking.
BUG=

Review-Url: https://codereview.chromium.org/2302133003
Cr-Commit-Position: refs/heads/master@{#39137}
2016-09-02 13:16:10 +00:00
mvstanton
17e9e2f4c8 Forking the type system between Crankshaft & Turbofan.
Our Type class has a semantic and representational dimension.
Much code in src/ast, Crankshaft and Turbofan is based on it.
Going forward in Turbofan we'd like to remove representational information
entirely. To that end, new type AstType has been created to preserve
existing behavior for the benefit of Crankshaft and the AST.

BUG=

Review-Url: https://codereview.chromium.org/2302283002
Cr-Commit-Position: refs/heads/master@{#39135}
2016-09-02 13:04:39 +00:00
mlippautz
ce66eec800 [heap] Introduce hard limit for external memory
We introduce, similar to regular heap, a hard and a soft limit for external memory.
- Upon reaching the hard limit we do a full GC. The hard limit is a a delta from
  the size of external memory at last GC.
- Upon reaching the soft limit we start incremental marking. Each further
  AdjustAmountOfExternalMemory will trigger a marking step. The step size depends
  on how far we are away from the hard limit. Further away means we have still
  some wiggle room and the step will be small. Being closer to the hard limit
  makes it more likely to trigger a full GC, so we increase the step size.

BUG=chromium:621829

Review-Url: https://codereview.chromium.org/2256853003
Cr-Commit-Position: refs/heads/master@{#39133}
2016-09-02 12:13:14 +00:00
ahaas
6a892bb451 [wasm] Validate the alignment of load and store instructions.
According to the WebAssembly specification the alignment of load and
store instructions has to be less or equal to natural alignment.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2285643002
Cr-Commit-Position: refs/heads/master@{#39131}
2016-09-02 11:59:49 +00:00
neis
19039efa2e [interpreter] Clarify some names and comments.
Also remove an unused declaration.

R=bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2302163003
Cr-Commit-Position: refs/heads/master@{#39129}
2016-09-02 11:33:01 +00:00
jgruber
64c518d06d Do not include Error.captureStackTrace in the trace
BUG=v8:5342

Review-Url: https://codereview.chromium.org/2307783002
Cr-Commit-Position: refs/heads/master@{#39124}
2016-09-02 09:51:42 +00:00
franzih
7c401bd84c [api] Add interceptor for defineProperty().
With the Indexed/GenericNamedPropertyDefinerCallback it is possible to intercept Object.defineProperty() calls.

Requests that call JSReceiver::OrdinaryDefineOwnProperty() internally, also trigger the interceptor. This includes Object.freeze(), Object.preventExtensions(), and Object.seal().

As without this patch, the query interceptor triggers on
defineProperty, unless the definer callback
intercepts the request.

As without this patch, the query interceptor triggers on defineProperty, unless the definer callback intercepts the request.

BUG=

Committed: https://crrev.com/b9d985975cf3bab0ded0cec9fafd3799f9bde29a
Review-Url: https://codereview.chromium.org/2272383002
Cr-Original-Commit-Position: refs/heads/master@{#39094}
Cr-Commit-Position: refs/heads/master@{#39122}
2016-09-02 09:09:08 +00:00
mythria
7e5b8feed3 [Interpreter] Collect type feedback for 'new' in the bytecode handler
Collect type feedback in the bytecode handler for 'new' bytecode. The
earlier cl (https://codereview.chromium.org/2153433002/) was reverted
because that implementation did not collect allocation site feedback.
This regressed delta blue by an order of magnitude. This implementation
includes collection of allocation site feedback.

Reland of https://codereview.chromium.org/2190293003/ with a bug fix.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2225923003
Cr-Commit-Position: refs/heads/master@{#39120}
2016-09-02 08:26:57 +00:00
nikolaos
628e9e3eb8 Fix bug with nested spreads as patterns
R=adamk@chromium.org, littledan@chromium.org
BUG=v8:5337
LOG=N

Review-Url: https://codereview.chromium.org/2297303003
Cr-Commit-Position: refs/heads/master@{#39118}
2016-09-02 07:53:00 +00:00
bmeurer
86af343749 [test] Add regression test for http://crbug.com/642056.
The bug itself was already fixed in ToT as part of
http://crrev.com/2263273003.

R=machenbach@chromium.org
BUG=chromium:642056

Review-Url: https://codereview.chromium.org/2306913002
Cr-Commit-Position: refs/heads/master@{#39117}
2016-09-02 07:08:29 +00:00
machenbach
d67fedb12c Revert of Allow lexically declared "arguments" in function scope in sloppy mode. (patchset id:100001 of https://codereview.chromium.org/2290753003/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/9470

Original issue's description:
> Allow lexically declared "arguments" in function scope in sloppy mode.
>
> Lexically declared "arguments" in sloppy mode will throw redeclaration error
> currently, this patch fixes it by delaying the declaration of arguments until we
> fully parse parameter list and function body.
>
> BUG=v8:4577
> LOG=N
>
> Committed: https://crrev.com/70a613dd0a5f5d205b46559b55702764464851fa
> Cr-Commit-Position: refs/heads/master@{#39109}

TBR=adamk@chromium.org,mythria@chromium.org,lpy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4577

Review-Url: https://codereview.chromium.org/2304853002
Cr-Commit-Position: refs/heads/master@{#39115}
2016-09-02 06:23:57 +00:00
gdeepti
53cb7e5ffc Populate relocation information correctly for RelocatableInt32Constants.
BUG=v8:5304
R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2277443009
Cr-Commit-Position: refs/heads/master@{#39112}
2016-09-02 01:39:21 +00:00
lpy
70a613dd0a Allow lexically declared "arguments" in function scope in sloppy mode.
Lexically declared "arguments" in sloppy mode will throw redeclaration error
currently, this patch fixes it by delaying the declaration of arguments until we
fully parse parameter list and function body.

BUG=v8:4577
LOG=N

Review-Url: https://codereview.chromium.org/2290753003
Cr-Commit-Position: refs/heads/master@{#39109}
2016-09-01 22:10:34 +00:00
Adam Klein
50b7a9ca24 Mark one more failing test262 test on the noi18n build
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/2302123002 .

Cr-Commit-Position: refs/heads/master@{#39108}
2016-09-01 20:59:02 +00:00
mlippautz
3b8ad45e0f [heap] Change LO space limit to 512k - page header
BUG=chromium:636331
R=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2289683002
Cr-Commit-Position: refs/heads/master@{#39106}
2016-09-01 20:10:57 +00:00
jarin
25504a220f [turbofan] Fix typing rule for Math.sign.
Review-Url: https://codereview.chromium.org/2306583002
Cr-Commit-Position: refs/heads/master@{#39103}
2016-09-01 20:06:27 +00:00
Adam Klein
3ecff04778 Skip new test262 toLocaleLowerCase test under noi18n build
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/2305793002 .

Cr-Commit-Position: refs/heads/master@{#39102}
2016-09-01 20:05:13 +00:00
littledan
af1d06a9bc This patch updates to the latest test262 version
A number of known failures are marked. To support test262's
new tests which simulate multiple script tags, this patch
calls out to the d8 realm API from the harness adaptation code.

Review-Url: https://codereview.chromium.org/2290023002
Cr-Commit-Position: refs/heads/master@{#39099}
2016-09-01 17:43:31 +00:00
mtrofin
5f8a6ec4b1 [wasm] consolidate wasm and asm.js module compilation sequence
This unblocks avoiding the separate code template.
In the upcoming CL doing away with code templates, We need to track instances
through the module object, which needs to be separate from the compiled module
data, which is then shared with the first instance.

This CL ensures we have the object available in the asm.js scenario, too.

Note that this CL also unifies the error messaging when module
decoding fails.

BUG=v8:5316

Review-Url: https://codereview.chromium.org/2299873002
Cr-Commit-Position: refs/heads/master@{#39097}
2016-09-01 16:47:39 +00:00
jkummerow
9fe4efe5b8 Revert of [api] Add interceptor for defineProperty(). (patchset id:160001 of https://codereview.chromium.org/2272383002/ )
Reason for revert:
Breaks cctest/test-api-interceptors/QueryInterceptor on the waterfall

Original issue's description:
> [api] Add interceptor for defineProperty().
>
> With the Indexed/GenericNamedPropertyDefinerCallback it is possible to intercept Object.defineProperty() calls.
>
> Requests that call JSReceiver::OrdinaryDefineOwnProperty() internally, also trigger the interceptor. This includes Object.freeze(), Object.preventExtensions(), and Object.seal().
>
> BUG=
>
> Committed: https://crrev.com/b9d985975cf3bab0ded0cec9fafd3799f9bde29a
> Cr-Commit-Position: refs/heads/master@{#39094}

TBR=jochen@chromium.org,franzih@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2303533004
Cr-Commit-Position: refs/heads/master@{#39095}
2016-09-01 16:04:00 +00:00
franzih
b9d985975c [api] Add interceptor for defineProperty().
With the Indexed/GenericNamedPropertyDefinerCallback it is possible to intercept Object.defineProperty() calls.

Requests that call JSReceiver::OrdinaryDefineOwnProperty() internally, also trigger the interceptor. This includes Object.freeze(), Object.preventExtensions(), and Object.seal().

BUG=

Review-Url: https://codereview.chromium.org/2272383002
Cr-Commit-Position: refs/heads/master@{#39094}
2016-09-01 15:18:30 +00:00
franzih
8acb7ab9f1 [api] Add PropertyDescriptor and DefineProperty().
BUG=

Review-Url: https://codereview.chromium.org/2244123005
Cr-Commit-Position: refs/heads/master@{#39093}
2016-09-01 15:09:59 +00:00
franzih
8225465b09 [api] Add documentation for PropertyQueryCallback.
Also add tests that document the behavior of the PropertyQueryCallback.

BUG=v8:5260

Review-Url: https://codereview.chromium.org/2286323002
Cr-Commit-Position: refs/heads/master@{#39090}
2016-09-01 14:41:56 +00:00
ahaas
79e685e277 [wasm] Validate the index of set local in AnalyzeLoopAssignment
BUG=chromium:642867
R=titzer@chromium.org
TEST=loop-assignment-analysis-unittest.cc:regress_642867

Review-Url: https://codereview.chromium.org/2290233008
Cr-Commit-Position: refs/heads/master@{#39089}
2016-09-01 14:05:50 +00:00
jgruber
7711b1a16f [regexp] Port RegExp getters and setters
BUG=v8:5339

Committed: https://crrev.com/ac0eb5e05af40e16ae9402bb8a62600b32cc2ec9
Review-Url: https://codereview.chromium.org/2305573002
Cr-Original-Commit-Position: refs/heads/master@{#39076}
Cr-Commit-Position: refs/heads/master@{#39088}
2016-09-01 13:41:28 +00:00
machenbach
6c25d789ba Revert of [regexp] Port RegExp getters and setters (patchset id:60001 of https://codereview.chromium.org/2305573002/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/9437

Original issue's description:
> [regexp] Port RegExp getters and setters
>
> BUG=v8:5339
>
> Committed: https://crrev.com/ac0eb5e05af40e16ae9402bb8a62600b32cc2ec9
> Cr-Commit-Position: refs/heads/master@{#39076}

TBR=bmeurer@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2301963002
Cr-Commit-Position: refs/heads/master@{#39085}
2016-09-01 12:50:40 +00:00
marja
8e7241fdde Include only stuff you need, part 6: Fix cctest.h.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control. Many of these files we need to rebuild are
cctests which pull in more includes than they need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2304553002
Cr-Commit-Position: refs/heads/master@{#39080}
2016-09-01 12:02:16 +00:00
jgruber
ac0eb5e05a [regexp] Port RegExp getters and setters
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2305573002
Cr-Commit-Position: refs/heads/master@{#39076}
2016-09-01 11:22:21 +00:00
bmeurer
9f37e303c3 [turbofan] Properly look through FinishRegion in alias analysis.
For two FinishRegion nodes, the alias analysis returned "may alias" even
without properly looking through them.

Drive-by-fix: Add meaningful output for --trace-turbo-load-elimination.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2301903002
Cr-Commit-Position: refs/heads/master@{#39075}
2016-09-01 10:50:27 +00:00
jarin
39d65198ed [turbofan] Fix Math.sign.
Review-Url: https://codereview.chromium.org/2294143004
Cr-Commit-Position: refs/heads/master@{#39073}
2016-09-01 10:26:12 +00:00
ahaas
5e7428b5b1 [wasm] Read global names only if their name length is valid.
BUG=chromium:642987
R=titzer@chromium.org
TEST=module-decoder-unittest.cc:GlobalWithInvalidNameLength

Review-Url: https://codereview.chromium.org/2301873002
Cr-Commit-Position: refs/heads/master@{#39071}
2016-09-01 09:52:40 +00:00
bmeurer
432790c92c [turbofan] Only check semantic axis for Type::None.
R=jarin@chromium.org
BUG=chromium:643073

Review-Url: https://codereview.chromium.org/2299903002
Cr-Commit-Position: refs/heads/master@{#39065}
2016-09-01 07:11:21 +00:00
bmeurer
83e1410320 [turbofan] Float32Constant/Float64Constant cannot occur in JS level graph.
Now that the hole NaN is no longer represented as Float64Constant early
on, we should never see such a constant node in any JS-level graph, but
we will only see them after representation selection. Change Typer and
SimplifiedLowering appropriately (and fix the invalid tests).

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2299883003
Cr-Commit-Position: refs/heads/master@{#39063}
2016-09-01 06:27:06 +00:00
bmeurer
64a7bd3877 [turbofan] Don't treat the hole NaN as constant inside the compiler.
We use a signaling NaN to represent the hole in
FAST_HOLEY_DOUBLE_ELEMENTS backing stores, but on Intel processors, the
C++ compiler may decide to (or be forced to due to calling conventions)
use X87 registers for double values. However transfering to X87
registers automatically quietens the NaNs and there's no way to disable
this. Therefore we should just always load the hole NaN from the canonical
place identified by the address_of_hole_nan external reference instead,
which might even be more efficient in some cases.

R=jarin@chromium.org, jkummerow@chromium.org
BUG=v8:5332

Review-Url: https://codereview.chromium.org/2303643002
Cr-Commit-Position: refs/heads/master@{#39062}
2016-09-01 06:02:19 +00:00
bakkot
8d5a267b19 Refactor object/class literal property name parsing
This patch arranges that property names are parsed in a single pass,
reporting the name as well as the type of the property, instead of
parsing qualifiers like 'static' or 'get' initially as names and then
re-parsing. This change is easier to reason about, very slightly (4%)
faster in some cases (although slower in other, less common ones, though
this slowdown will be fixed in an upcoming patch), and is a prerequisite
for separating the parsing of object and class literal properties, which
will become increasingly important as ECMAScript adds more class features.

This is a reland of https://codereview.chromium.org/2278153004/,
which fixes the issue causing the revert and adds more tests.

Review-Url: https://codereview.chromium.org/2300503002
Cr-Commit-Position: refs/heads/master@{#39056}
2016-08-31 21:14:14 +00:00
jkummerow
e1cb562224 [elements] Fix GetEntryForIndexImpl to honor array length
Previously, fast holey elements accessors would detect element presence
by simply doing a hole check on any slot within the backing store's
capacity. This relied on the (mostly-true but brittle) assumption that
slots beyond the length are always correctly zapped with The Hole.

Review-Url: https://codereview.chromium.org/2297253002
Cr-Commit-Position: refs/heads/master@{#39051}
2016-08-31 17:46:34 +00:00
jochen
60a783c246 Make the condition for when this is predeclared easier to understand.
Just always predeclare it

R=marja@chromium.org,verwaest@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2298743002
Cr-Commit-Position: refs/heads/master@{#39048}
2016-08-31 13:33:46 +00:00
ahaas
dd9995c066 [wasm] Use the right control input for the diamond in GrowMemory.
The fuzzer found out that "start" is not always a good control input
for a diamond.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2295173002
Cr-Commit-Position: refs/heads/master@{#39046}
2016-08-31 12:32:34 +00:00
bmeurer
7b79224b21 [crankshaft] Disable further folding already folded allocations.
When we try to further fold previously folded allocations in Crankshaft
GVN we don't properly transform the allocations involved, which causes
the mechanism to leave holes in the new/old space (and thereby violate
the iterability property of the new/old space).

BUG=chromium:621868
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2297983003
Cr-Commit-Position: refs/heads/master@{#39040}
2016-08-31 09:48:45 +00:00
marja
0645135446 Separate CompilationInfo into its own file.
This way, many files which only need CompilationInfo but not compiler.h
and its dependencies can include just compilation-info.h.

BUG=

Review-Url: https://codereview.chromium.org/2284313003
Cr-Commit-Position: refs/heads/master@{#39038}
2016-08-31 08:49:59 +00:00
jochen
5b25cbb503 Unify DeclarationScope::Analyze
R=marja@chromium.org
TBR=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2294193003
Cr-Commit-Position: refs/heads/master@{#39037}
2016-08-31 08:47:19 +00:00
bmeurer
b98d64f909 [turbofan] Extend LoadElimination to introduce TypeGuards.
If the type of a tracked field or element value is less precise than the
advertised type of the field or element load, then we replace the load
operation with a TypeGuard that guards the advertised type.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2295643002
Cr-Commit-Position: refs/heads/master@{#39032}
2016-08-31 05:48:28 +00:00
adamk
9c00c88902 Remove duplicated code from comma-separated Expression parsing
This removes two bits of duplication:
  - Parsing of each AssignmentExpression, which previously was called
    first outside the loop and then inside the loop.
  - Parsing of arrow rest parameters, which previously was handled
    separately for the one-arg and N-arg cases.

The only change in behavior is in a few error messages.

Review-Url: https://codereview.chromium.org/2279363002
Cr-Commit-Position: refs/heads/master@{#39030}
2016-08-31 01:24:19 +00:00
mtrofin
03f3da45e1 [wasm] mjsunit support for I32 globals and test
Test ensuring globals are isolated between instances. Also
added support for globals section to mjsunit's
WebModuleBuilder as a prerequisite.

BUG=

Review-Url: https://codereview.chromium.org/2296993002
Cr-Commit-Position: refs/heads/master@{#39028}
2016-08-31 00:36:18 +00:00
addaleax
8ed65b97a3 Make FieldType::None() non-nullptr value to avoid undefined behaviour
When FieldType::None() returns a cast Smi::FromInt(0), which translates
as nullptr, the FieldType::IsNone() check becomes equivalent to
`this == nullptr` which is not allowed by the standard and
therefore optimized away as a false constant by GCC 6.

This has lead to crashes when invoking methods on FieldType::None().

Using a different Smi constant for FieldType::None() makes the compiler
always include a comparison against that value. The choice of these
constants has no effect as they are effectively arbitrary.

BUG=https://github.com/nodejs/node/issues/8310

Review-Url: https://codereview.chromium.org/2292953002
Cr-Commit-Position: refs/heads/master@{#39023}
2016-08-30 17:56:05 +00:00
ahaas
9f747be5a7 [wasm] Check the input of grow-memory before calling the runtime.
If the input of grow-memory was not representable as a SMI, then the
input was not passed correctly to the runtime, which caused a crash.
With this CL the input of grow-memory is checked before the runtime is
called.

R=titzer@chromium.org, gdeepti@chromium.org
TEST=mjsunit/wasm/grow-memory.js:testGrowMemoryTrapsWithNonSmiInput()

Review-Url: https://codereview.chromium.org/2288773002
Cr-Commit-Position: refs/heads/master@{#39022}
2016-08-30 17:00:24 +00:00
epertoso
bdf5566281 [turbofan] Treat the INT32 state of a truncating binary op IC as number or oddball on 32-bit machines.
This was causing a few unexpected deopt loops.

BUG=v8:5320

Review-Url: https://codereview.chromium.org/2292873002
Cr-Commit-Position: refs/heads/master@{#39019}
2016-08-30 14:13:34 +00:00
jbroman
e2361954e5 Blink-compatible serialization of SharedArrayBuffer.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2290753002
Cr-Commit-Position: refs/heads/master@{#39017}
2016-08-30 14:05:49 +00:00
ahaas
510246f6e2 [wasm] Use the native_context for the TypeError in ToJS()
With this CL we use isolate->native_context() to provide a context for
the CEntryStub of the runtime call. The native_context() is sufficient
here because Runtime::kWasmThrowTypeError does not use the context.

R=titzer@chromium.org
TEST=mjsunit/wasm/ffi-error.js
BUG=chromium:639492

Review-Url: https://codereview.chromium.org/2291043002
Cr-Commit-Position: refs/heads/master@{#39014}
2016-08-30 12:46:02 +00:00
epertoso
708f80d243 [interpreter] Make the comparison bytecode handlers collect type feedback.
BUG=v8:5273

Review-Url: https://codereview.chromium.org/2286273002
Cr-Commit-Position: refs/heads/master@{#39006}
2016-08-30 10:21:39 +00:00
jochen
0c3789fb6a Create ScopeInfos while analyzing the Scope chain
Instead of creating them on demand all over the place.

I plan to link ScopeInfos together, and having one place where all
ScopeInfos are created will make this easier.

R=verwaest@chromium.org,adamk@chromium.org
TBR=mstarzinger@chromium.org
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2281073002
Cr-Commit-Position: refs/heads/master@{#39003}
2016-08-30 09:48:56 +00:00
bmeurer
864cdc124c [test] Speed-up regression test for growing stores.
TBR=machenbach@chromium.org
BUG=chromium:635798,chromium:638295

Review-Url: https://codereview.chromium.org/2288813003
Cr-Commit-Position: refs/heads/master@{#38991}
2016-08-30 04:04:32 +00:00
bradnelson
b42e12cd4a [wasm] Pull in fresher fuzzer binaries.
BUG=None
TEST=None
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2290803002
Cr-Commit-Position: refs/heads/master@{#38989}
2016-08-29 19:44:23 +00:00
bradnelson
08639b5b77 [WASM] Adding fuzzing binaries for wasm, and script to update them.
This adds:
* A script (tools/update-wasm-fuzzers.sh), which creates a new fuzzing seed
  corpus and uploads to google storage (you must have the right credentials).
* A new pair of DEPS entries to pull in the current version of the corpus
  based on a checked in pair of hash files.

BUG=None
TEST=None
R=ahaas@chromium.org,kcc@chromium.org,mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2273303002
Cr-Commit-Position: refs/heads/master@{#38987}
2016-08-29 19:01:48 +00:00
littledan
5af4cd9840 Disallow tail calls from async functions and generators
Tail calls don't make sense from async functions and generators, as
each activation of these functions needs to make a new, distnict,
non-reused generator object. These tail calls are not required per
spec. This patch disables both syntactic and implicit tail calls
in async functions and generators.

R=neis
BUG=v8:5301,chromium:639270

Review-Url: https://codereview.chromium.org/2278413003
Cr-Commit-Position: refs/heads/master@{#38986}
2016-08-29 18:31:35 +00:00
jbroman
248f3dafd0 Blink-compatible serialization of array buffer views.
The format of this is a little strange, and has to do with the previous
implementation maintaining a "stack" of objects as it works. As a result,
the format writes the array buffer before giving any hint that the reason
for doing so is to obtain a view wrapping it. Handling this without creating
an explicit on-heap stack requires checking whether the next tag is 'V'
after obtaining an array buffer.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2287653002
Cr-Commit-Position: refs/heads/master@{#38984}
2016-08-29 14:51:49 +00:00
ahaas
cb259fbd39 [wasm] Create a new fuzzer for wasm code.
The new fuzzer constructs a dummy module header and uses the fuzzer
data only as function code.

R=titzer@chromium.org, jochen@chromium.org

Review-Url: https://codereview.chromium.org/2280623002
Cr-Commit-Position: refs/heads/master@{#38983}
2016-08-29 13:56:00 +00:00
bgeron
791118fca5 [turbofan] Also inline into try blocks.
This removes test/webkit/fast/js/stack-overflow-arrity-catch.js, which tests that the stack overflows in a very particular way. It doesn't seem to test anything important, and only used to work because we didn't inline into try-blocks.

BUG=
R=jarin

Review-Url: https://codereview.chromium.org/2216353002
Cr-Commit-Position: refs/heads/master@{#38976}
2016-08-29 11:27:06 +00:00
bgeron
d90d76bdb5 [turbofan] Improve inline-exception tests.
- Make constants more interesting.
- Add an addition to be done after the inlined call in the try-block.
- On command line, have a bit more output.
- New alternative that deopts from unoptimized code.

BUG=
R=jarin

Review-Url: https://codereview.chromium.org/2285743002
Cr-Commit-Position: refs/heads/master@{#38974}
2016-08-29 11:17:16 +00:00
bmeurer
285e1e157a [turbofan] Remove invalid typing rules.
Drop the typing rules for the machine operators and replace them
with UNREACHABLE. These typing rules were never correct and there's
also no need to have those rules at all.

Drive-by-fix: Remove the extremely annoying test-simplified-lowering.cc
file, which is not very useful, but consumes a large amount of time to
keep it compiling and passing. Instead we should introduce appropriate
tests for the SimplifiedLowering that also test something meaningful
w/o just cementing the implementation.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2292463002
Cr-Commit-Position: refs/heads/master@{#38970}
2016-08-29 09:20:09 +00:00
bmeurer
1915762cc8 [turbofan] Remove special JSForInStep and JSForInDone.
These JavaScript operators were special hacks to ensure that we always
operate on Smis for the magic for-in index variable, but this never
really worked in the OSR case, because the OsrValue for the index
variable didn't have the proper information (that we have for the
JSForInPrepare in the non-OSR case).

Now that we have loop induction variable analysis and binary operation
hints, we can just use JSLessThan and JSAdd instead with appropriate
Smi hints, which handle the OSR case by inserting Smi checks (that are
always true). Thanks to OSR deconstruction and loop peeling these Smi
checks will be hoisted so they don't hurt the OSR case too much.

Drive-by-change: Rename the ForInDone bytecode to ForInContinue, since
we have to lower it to JSLessThan to get the loop induction variable
goodness.

R=epertoso@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2289613002
Cr-Commit-Position: refs/heads/master@{#38968}
2016-08-29 08:47:33 +00:00
bmeurer
f676db4655 [turbofan] Lazy bailout for calls doesn't need callee.
There's no need to preserve the exact callee for lazy bailouts
from JSCallFunction in the AstGraphBuilder, as fullcodegen code
will never look at that value after the callee returns. So we
just push optimized_out instead.

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2285183002
Cr-Commit-Position: refs/heads/master@{#38963}
2016-08-29 05:16:26 +00:00
mlippautz
933195a24c Revert of "[heap] Switch to 500k pages" (patchset id:1 of https://codereview.chromium.org/2278653003/ )
Reason for revert:
Tanks pretty much alle metrics across the board. Probably LO space limit too low but needs investigation.

Original issue's description:
> [heap] Switch to 500k pages
>
> Decrease regular heap object size to 400k. In a follow up, we can now get rid of
> the new space border page while keeping the 1M minimum new space size.
>
> This reverts commit 1617043c10.
>
> BUG=chromium:636331
>
> Committed: https://crrev.com/2101e691caeef656eb91f1c98620b3955d337c83
> Cr-Commit-Position: refs/heads/master@{#38916}

TBR=ulan@chromium.org,verwaest@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:636331
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2289493002
Cr-Commit-Position: refs/heads/master@{#38960}
2016-08-28 07:28:35 +00:00
jbroman
864728085d Blink-compatible serialization of ArrayBuffer transfer.
The embedder is expected to arrange for the array buffer contents to be
transferred into a v8::ArrayBuffer in the receiving context (generally by
assuming ownership of the externalized backing store).

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2275033003
Cr-Commit-Position: refs/heads/master@{#38948}
2016-08-26 15:47:41 +00:00
ivica.bogosavljevic
db56339952 MIPS: Fix crahses of tests unittests/AstDecoderTest.Float[32|64]Const
on architectures that do not support missaligned memory access

BUG=unittests/AstDecoderTest.Float64Const, unittests/AstDecoderTest.Float32Const

Review-Url: https://codereview.chromium.org/2275323002
Cr-Commit-Position: refs/heads/master@{#38941}
2016-08-26 12:29:54 +00:00
mstarzinger
80ae1b37b4 [test] Remove CompilationInfo from test-field-type-tracking.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2286593003
Cr-Commit-Position: refs/heads/master@{#38939}
2016-08-26 11:35:44 +00:00
ahaas
25cdfd79a4 [wasm] Remove the Float(32|64)SubMinusZero tests.
These tests became obsolete. They tested a requirement that has been
removed from the WebAssembly specification.

R=titzer@chromium.org, Balazs.Kilvady@imgtec.com

Review-Url: https://codereview.chromium.org/2284593002
Cr-Commit-Position: refs/heads/master@{#38938}
2016-08-26 10:04:03 +00:00
ahaas
71f93e6001 [wasm] Bound the allowed number of locals.
This CL fixes the first bug I found with the new fuzzing. The problem is
that the number of locals is unbounded. This CL bounds the number of
locals of one type with 8000000, an arbitrary number.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2271803004
Cr-Commit-Position: refs/heads/master@{#38936}
2016-08-26 09:13:22 +00:00
mstarzinger
e53d2acec1 [compiler] Remove default argument for code flags.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2281863002
Cr-Commit-Position: refs/heads/master@{#38935}
2016-08-26 09:04:23 +00:00
marja
fc6425c56a Include only stuff you need, part 5: make function-tester.h slimmer.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control. Many of these files we need to rebuild are
cctests which pull in more includes than they need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2278103002
Cr-Commit-Position: refs/heads/master@{#38933}
2016-08-26 08:41:38 +00:00
bmeurer
f154c75a39 [turbofan] Separate typed optimizations from JSTypedLowering.
Introduce a new TypedOptimization reducer that contains the type
based optimization reduction steps, which are not (directly)
related to lowering JavaScript operators based on types (which is
what JSTypedLowering is supposed to do).

This also addresses a chicken-and-egg problem that we see in the
Octane/Mandreel benchmark where type based constant folding isn't
applied to the numeric comparison operators introduced by the
JSTypedLowering itself, and thus gives up to 10% speedup for the
benchmark.

BUG=v8:5267

Review-Url: https://codereview.chromium.org/2280673003
Cr-Commit-Position: refs/heads/master@{#38928}
2016-08-26 07:58:30 +00:00
neis
a45d106db0 [modules] Rename ModuleDescriptor::ModuleEntry to ModuleDescriptor::Entry.
R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2278973002
Cr-Commit-Position: refs/heads/master@{#38924}
2016-08-26 07:04:21 +00:00
verwaest
5558a50878 Merge DeclarationScope::temps_ and Scope::ordered_variables_ into Scope::locals_
BUG=v8:5209

Review-Url: https://codereview.chromium.org/2272083003
Cr-Commit-Position: refs/heads/master@{#38920}
2016-08-25 19:12:00 +00:00
adamk
51c186dd98 Centralize and standardize logic for ExpressionClassifier accumulation
Previously the calls to ExpressionClassifier::Accumulate() each chose
slightly different sets of productions to accumulate, and it turned
out that these were in some cases broader than needed and in some
cases less broad.

The existence of some grab-bag production bitmasks like
ExpressionClassifier::ExpressionProductions made this situation more
error-prone (for example, that production was missing AsyncArrowFormalParametersProduction).

This patch removes all "grab-bags" besides AllProductions. In some of
the places where code was using those grab-bags for convenience, it
switches them to use negation of AllProductions. In other, specifically
those having to do with expressions that are disallowed anywhere in
a sub-expression of a parameter list, I've added a new method on
ExpressionClassifier to centralize the logic.

The aforementioned centralization/addition of
AsyncArrowFormalParametersProduction fixes several cases where we were
failing to report an error for 'await' in some contexts; I've added
those test cases.

The patch also narrows all cases to exactly the set or productions
necessary, with a comment on each explaining the choice.

BUG=v8:4483

Review-Url: https://codereview.chromium.org/2271063002
Cr-Commit-Position: refs/heads/master@{#38918}
2016-08-25 16:59:45 +00:00
jarin
2a97b1bcb1 Reland of [turbofan] Insert dummy values when changing from None type.
This reverts commit a55fdb1e7c, relands
https://codereview.chromium.org/2266823002/.

BUG=chromium:638132

Review-Url: https://codereview.chromium.org/2277283002
Cr-Commit-Position: refs/heads/master@{#38917}
2016-08-25 16:58:13 +00:00
mlippautz
2101e691ca [heap] Switch to 500k pages
Decrease regular heap object size to 400k. In a follow up, we can now get rid of
the new space border page while keeping the 1M minimum new space size.

This reverts commit 1617043c10.

BUG=chromium:636331

Review-Url: https://codereview.chromium.org/2278653003
Cr-Commit-Position: refs/heads/master@{#38916}
2016-08-25 16:26:32 +00:00
jbroman
58cac6501f Add an experimental public API for value serialization.
Suitably scary warnings attached, as this will yet evolve (notably to handle
host objects, which are not currently handled).

Unit tests adjusted to use the public version of ValueSerializer, eliminating
any need they have to access v8::internal.

With this, Blink can begin using this code experimentally behind a flag as it
develops.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2274693002
Cr-Commit-Position: refs/heads/master@{#38915}
2016-08-25 16:00:25 +00:00
jbroman
2646749cbc Blink-compatible serialization of ArrayBuffer.
Transferral is not included in this CL, nor is SharedArrayBuffer.

BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2264403004
Cr-Commit-Position: refs/heads/master@{#38913}
2016-08-25 14:43:54 +00:00
mlippautz
3866975f1b [heap] GCTracer: Record details for incremental marking
Record details, such as cumulative duration, number of steps, and longest steps
in IncrementalMarkingDetails which get populated at a single callsite
(AddScopeSample). Remove member fields that thus become obsolete (unfortunately
not all of them).

Additional remove some dead code and refactor printing. Printing in a single
statement allows for using logcat on Android.

This should also address the regression in chromium:640524.

BUG=chromium:639818,chromium:640524
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2269093002
Cr-Commit-Position: refs/heads/master@{#38912}
2016-08-25 14:22:42 +00:00
jyan
54f5558d52 Implement Big-Endian eqv test for DecodeDate and DecodeValueObjects
R=jkummerow@chromium.org, jbroman@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2274173003
Cr-Commit-Position: refs/heads/master@{#38910}
2016-08-25 14:11:31 +00:00
rmcilroy
677948255b Fix CompilerDispatcherJobTest::CompileFailureToFinalize on local runs.
BUG=

Review-Url: https://codereview.chromium.org/2276343003
Cr-Commit-Position: refs/heads/master@{#38909}
2016-08-25 13:57:56 +00:00
bgeron
244d9ccd40 [turbofan] Tests for inlining calls, constructors, property access inside try..catch..finally.
These tests were spliced out of changelist 2216353002 and extended.

BUG=

Review-Url: https://codereview.chromium.org/2245263003
Cr-Commit-Position: refs/heads/master@{#38906}
2016-08-25 12:50:48 +00:00
rmcilroy
b2734f6a1b [Test] Fix CompilerDispatcher test.
Review-Url: https://codereview.chromium.org/2281463002
Cr-Commit-Position: refs/heads/master@{#38900}
2016-08-25 11:29:43 +00:00
rmcilroy
c2d2d4d1ce [Compiler] Add compile operations to CompilerDispatcherJob.
Adds compile operations to the CompilerDispatcherJob interface. As such,
introduces Compiler::PrepareUnoptimizedCompilationJob and updates the
unoptimized compilation path to use CompilationJobs. Also unifies
FinalizeCompilationJob to deal with both optimized and unoptimized
compilation jobs.

A dummy FullCodegenCompilationJob is also introduced, where all the work
is done in the ExecuteJob phase, which cannot be run on a
background thread.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2251713002
Cr-Commit-Position: refs/heads/master@{#38897}
2016-08-25 10:25:12 +00:00
bmeurer
a55fdb1e7c Revert of [turbofan] Insert dummy values when changing from None type. (patchset id:80001 of https://codereview.chromium.org/2266823002/ )
Reason for revert:
Octane/Mandreel aborts with an exception now:

TypeError: __FUNCTION_TABLE__[(r2 >> 2)] is not a function

Original issue's description:
> [turbofan] Insert dummy values when changing from None type.
>
> Currently we choose the MachineRepresentation::kNone representation for
> values of Type::None, and when converting values from the kNone representation
> we use "impossible" conversions that will crash at runtime. This
> assumes that the impossible conversions should never be hit (the only
> way to produce the impossible values is to perform an always-failing
> runtime check on a value, such as Smi-checking a string). Note that
> this assumes that the runtime check is executed before the impossible
> convesrion.
>
> Introducing BitwiseOr type feedback broke this in two ways:
>
> - we always pick Word32 representation for bitwise-or, so the
>   impossible conversion does not trigger (it only triggers with
>   None representation), and we could end up with unsupported
>   conversions from Word32.
>
> - even if we inserted impossible conversions, they are pure conversions.
>   Since untagging, bitwise-or operations are also pure, we could hoist
>   all these before the smi check of the inputs and we could hit the
>   impossible conversions before we get to the smi check.
>
> This CL addresses this by just providing dummy values for conversions
> from the Type::None type. It also removes the impossible-to-* conversions.
>
> BUG=chromium:638132
>
> Committed: https://crrev.com/c83b21ab755f1420b6da85b3ff43d7e96ead9bbe
> Cr-Commit-Position: refs/heads/master@{#38883}

TBR=mstarzinger@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:638132

Review-Url: https://codereview.chromium.org/2280613002
Cr-Commit-Position: refs/heads/master@{#38893}
2016-08-25 08:50:23 +00:00
neis
6e67d04260 [modules] Split exports into regular and special, store regular ones in a multimap.
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2273013002
Cr-Commit-Position: refs/heads/master@{#38889}
2016-08-25 08:37:30 +00:00
baptiste.afsa
65ba1cdeb6 [turbofan] Allow tests to enable/disable instruction scheduling.
Some instruction selection tests rely on the instructions to be emitted
in a specific order.

R=jarin@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2276003002
Cr-Commit-Position: refs/heads/master@{#38886}
2016-08-25 08:05:15 +00:00
bmeurer
b471d4ab5c [turbofan] Disable LoadElimination completely for asm.js.
There's no point in running the LoadElimination on asm.js functions and
it would take serious amount of effort to actually make it correct for
the deprecated parts of the pipeline.

R=jarin@chromium.org
BUG=v8:5308

Review-Url: https://codereview.chromium.org/2276273002
Cr-Commit-Position: refs/heads/master@{#38884}
2016-08-25 06:14:59 +00:00
jarin
c83b21ab75 [turbofan] Insert dummy values when changing from None type.
Currently we choose the MachineRepresentation::kNone representation for
values of Type::None, and when converting values from the kNone representation
we use "impossible" conversions that will crash at runtime. This
assumes that the impossible conversions should never be hit (the only
way to produce the impossible values is to perform an always-failing
runtime check on a value, such as Smi-checking a string). Note that
this assumes that the runtime check is executed before the impossible
convesrion.

Introducing BitwiseOr type feedback broke this in two ways:

- we always pick Word32 representation for bitwise-or, so the
  impossible conversion does not trigger (it only triggers with
  None representation), and we could end up with unsupported
  conversions from Word32.

- even if we inserted impossible conversions, they are pure conversions.
  Since untagging, bitwise-or operations are also pure, we could hoist
  all these before the smi check of the inputs and we could hit the
  impossible conversions before we get to the smi check.

This CL addresses this by just providing dummy values for conversions
from the Type::None type. It also removes the impossible-to-* conversions.

BUG=chromium:638132

Review-Url: https://codereview.chromium.org/2266823002
Cr-Commit-Position: refs/heads/master@{#38883}
2016-08-25 06:06:58 +00:00
bmeurer
a124bf773f [turbofan] Add regression tests for LoadElement/Field in diamond.
This introduces appropriate unit tests to ensure that merging of
elements/fields information is correct for diamonds.

BUG=chromium:639210,v8:5266
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2278043002
Cr-Commit-Position: refs/heads/master@{#38881}
2016-08-25 05:09:21 +00:00
littledan
aae17eb31b Do not trigger ExceptionEvents for another forwarding case
This patch fixes up one last case of redundant ExceptionEvents being
triggered in the debugger for Promises--it makes the default reject
handler for Promises (e.g., if the second argument for
Promise.prototype.then is missing) appear to the debugger as a
rethrow.

R=adamk@chromium.org,jgruber@chromium.org
BUG=v8:5167

Review-Url: https://codereview.chromium.org/2278643002
Cr-Commit-Position: refs/heads/master@{#38876}
2016-08-24 20:38:13 +00:00
jarin
dc330f2bd3 [turbofan] Fix merging of empty and non-empty state in load elimination.
Unfortunately, I was unable to produce a repro without asm.js. In normal
JavaScript, the bounds check renaming saves us.

I have not done anything about the index variable aliasing and handling
of differently sized elements yet!

BUG=chromium:639210, v8:5266

Review-Url: https://codereview.chromium.org/2270793004
Cr-Commit-Position: refs/heads/master@{#38874}
2016-08-24 17:14:24 +00:00
jyan
abd32fb1c7 Fix FastAccessorToSmi CCTest to use ptr type
The generated FastAccessorAssembler uses IntPtr Load Op to load
from &flags. Therefore, flags should be a pointer type. This fixes
big endian issue.

R=peterssen@google.com, vogelheim@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2266403004
Cr-Commit-Position: refs/heads/master@{#38873}
2016-08-24 17:05:00 +00:00
jbroman
78131aa1d5 Blink-compatible serialization of Map and Set objects.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2269923004
Cr-Commit-Position: refs/heads/master@{#38871}
2016-08-24 15:58:55 +00:00
mstarzinger
b52aecac7e [compiler] Make Compiler::EnsureBytecode not switch tiers.
This preserves the original shared code of the underlying function when
bytecode is provided. The method in question should only ensure bytecode
is present, but should avoid switching compilation tiers of the given
function. It might be that the function was fast-tracked to baseline by
inlining without going through the interpreted tier first.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-635923
BUG=chromium:635923

Review-Url: https://codereview.chromium.org/2278543002
Cr-Commit-Position: refs/heads/master@{#38866}
2016-08-24 14:09:59 +00:00
bmeurer
6646d73b6f [turbofan] Use ObjectIsReceiver directly for inlining.
Don't bother using %_IsJSReceiver, which immediately gets lowered to
ObjectIsReceiver anyways (by the JSIntrinsicLowering), but requires
some complicated rewiring of effect/control chains.

R=mstarzinger@chromium.org
BUG=chromium:640369

Review-Url: https://codereview.chromium.org/2271973003
Cr-Commit-Position: refs/heads/master@{#38864}
2016-08-24 11:09:32 +00:00
bmeurer
b5629a108c [turbofan] Improve fast case of JSInstanceOf lowering.
For O instanceof C, we only need to check the instance type while
iterating the prototypes of O instead of checking both the instance
type and the access check bit of the map. This is because we have
the explicit range of "special object types", which include both
JSProxy as well as the global object and proxy and all API objects
that might have access checks or interceptors. Also restructure the
loop exits somewhat to ensure that the branch cloning gets a chance
to actually eliminate the bit materialization for the results.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2263273003
Cr-Commit-Position: refs/heads/master@{#38860}
2016-08-24 09:38:48 +00:00
littledan
013e49f73c Change which ExceptionEvents are triggered by Promises
To make async/await catch prediction work well, this patch regularizes
the exception events sent to DevTools from various places in the Promise
lifecycle. The core is that there should be an exception event when the
rejection first starts, rather than when it is propagated.

- Several cases within Promise code which propagate errors are
  modified to not trigger a new ExceptionEvent in that case, such
  as .then on a rejected Promise and returning a rejected Promise
  from .then, as well as Promise.race and Promise.all.
- Make Promise.reject() create an ExceptionEvent, subject to catch
  prediction based on the Promise stack. This is important
  so that, e.g., if "await Promise.reject()" will trigger a new
  throw (rather than a silent rethrow of something that never
  triggered an event in the first place).

BUG=v8:5167

Review-Url: https://codereview.chromium.org/2244003003
Cr-Commit-Position: refs/heads/master@{#38847}
2016-08-24 00:20:50 +00:00
adamk
9a558c5f4a Disallow 'yield' in async arrow parameter lists inside generators
R=littledan@chromium.org
BUG=v8:4483

Review-Url: https://codereview.chromium.org/2270223002
Cr-Commit-Position: refs/heads/master@{#38846}
2016-08-23 22:17:38 +00:00
jpp
cf5180c3ef [v8][wasm] Handles finally in try/finally blocks.
Introduces support for using

try {
} finally {
}

in wasm.

BUG=

Review-Url: https://codereview.chromium.org/2240743003
Cr-Commit-Position: refs/heads/master@{#38845}
2016-08-23 22:14:52 +00:00
gdeepti
6122465c88 [wasm] Add native x64 implementations for I32x4Splat, I32x4ExtractLane
- Instruction selection, code generation, test for Splat/Extract
 - Fixes for AstS128 Locals in wasm

R=bbudge@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2264533002
Cr-Commit-Position: refs/heads/master@{#38843}
2016-08-23 19:59:43 +00:00
adamk
ad07b49d7b Add a bit of test coverage for callers of destructuring assignment
In particular, this covers one caller of CheckDestructuringElement
that didn't have tests before.

R=caitp@igalia.com

Review-Url: https://codereview.chromium.org/2267153002
Cr-Commit-Position: refs/heads/master@{#38841}
2016-08-23 19:30:45 +00:00
jpp
a60e182250 [Asm.js] Prevents assignments to immutables.
Adds a check so that module validation fails if there are any
assignments to immutable identifiers (e.g., module name, module
parameters, stdlib imports.)

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=640194

Review-Url: https://codereview.chromium.org/2268363002
Cr-Commit-Position: refs/heads/master@{#38838}
2016-08-23 18:08:42 +00:00
jbroman
c4874b2fef Blink-compatible serialization of RegExp objects.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2262013002
Cr-Commit-Position: refs/heads/master@{#38835}
2016-08-23 15:16:29 +00:00
mlippautz
7695642e2c [heap] Tracer: Handle incremental marking scopes
Before this patch all tracing scopes in incremental marking would be reset
during a gc tracer start/stop cycle. This patch handles scopes the same way it
does other incremental marking metrics.

Also:
- Align finalization metric with regular marking metric.
- Smaller cleanups

BUG=chromium:639818

Review-Url: https://codereview.chromium.org/2273673002
Cr-Commit-Position: refs/heads/master@{#38834}
2016-08-23 15:13:50 +00:00
epertoso
b305c7dfcb [interpreter] Make the binary op with Smi bytecode handlers collect type feedback.
Drive-by fix: the order of parameters in the BinaryOpWithFeedback TurboFan code stubs now reflects the convention of having the context at the end.

BUG=v8:5273

Review-Url: https://codereview.chromium.org/2263253002
Cr-Commit-Position: refs/heads/master@{#38832}
2016-08-23 14:59:33 +00:00
jbroman
4dce969078 Blink-compatible serialization of Boolean, Number and String objects.
BUG=chromium:148757

Review-Url: https://codereview.chromium.org/2265603002
Cr-Commit-Position: refs/heads/master@{#38830}
2016-08-23 14:33:05 +00:00
verwaest
287a71525e Move scope_uses_super_property_ to DeclarationScope
This flag was only set on receiver scopes (declaration scopes) already. This makes it statically obvious.

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2268333002
Cr-Commit-Position: refs/heads/master@{#38828}
2016-08-23 14:18:29 +00:00
mlippautz
0f4f30a1d2 Revert of [heap] Tracer: Handle incremental marking scopes (patchset id:100001 of https://codereview.chromium.org/2264033002/ )
Reason for revert:
Unittest fails on win32 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/4188/steps/Check/logs/GCTracerTest.Incremen..

Original issue's description:
> [heap] Tracer: Handle incremental marking scopes
>
> Before this patch all tracing scopes in incremental marking would be reset
> during a gc tracer start/stop cycle. This patch handles scopes the same way it
> does other incremental marking metrics.
>
> Also:
> - Align finalization metric with regular marking metric.
> - Smaller cleanups
>
> BUG=chromium:639818
> R=jochen@chromium.org
>
> Committed: https://crrev.com/300a8f97472b88ff2f94eb977c36b4bf1bedabf1
> Cr-Commit-Position: refs/heads/master@{#38822}

TBR=jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:639818

Review-Url: https://codereview.chromium.org/2275583002
Cr-Commit-Position: refs/heads/master@{#38827}
2016-08-23 14:15:22 +00:00
vogelheim
e954e95400 Remove unused Utf8ToUtf16CharacterStream.
- The static method CopyChars was actually used and has been extracted.
- It was used in tests, where it's been replaced w/ ExternalOneByteString...
- Only one test actually relied on Utf8 handling (as opposed to ASCII only),
  and that was the test testing Utf8ToUtf16CharacterStream itself.

+66 -277 LOC :)

BUG=v8:4947

Review-Url: https://codereview.chromium.org/2256273002
Cr-Commit-Position: refs/heads/master@{#38824}
2016-08-23 13:30:38 +00:00
mlippautz
300a8f9747 [heap] Tracer: Handle incremental marking scopes
Before this patch all tracing scopes in incremental marking would be reset
during a gc tracer start/stop cycle. This patch handles scopes the same way it
does other incremental marking metrics.

Also:
- Align finalization metric with regular marking metric.
- Smaller cleanups

BUG=chromium:639818
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2264033002
Cr-Commit-Position: refs/heads/master@{#38822}
2016-08-23 13:25:50 +00:00
marja
1776fd09fa Include only stuff you need, part 4: ast, scopes + fallout.
Rebuilding (after touching certain files) is crazy slow because
includes are out of control.

Fixing it:
- Don't include stuff in headers unless necessary.
- Include the stuff you need, not some other stuff that happens to include the
 stuff you need.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2268303002
Cr-Commit-Position: refs/heads/master@{#38818}
2016-08-23 12:35:36 +00:00
jochen
b79259f632 Finalizing parsing in a compile job should immediately report errors
When preparing compilation, we can't delay error reporting either.

Also put handles during internalization into a deferred handle scope.

BUG=v8:5215
R=marja@chromium.org,rmcilory@chromium.org

Review-Url: https://codereview.chromium.org/2268983002
Cr-Commit-Position: refs/heads/master@{#38817}
2016-08-23 12:10:55 +00:00
jochen
f5b8686766 Add test for posting a single task to the worker pool
Also, clarify comments about how semaphores work

BUG=none
R=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2270703002
Cr-Commit-Position: refs/heads/master@{#38816}
2016-08-23 11:56:57 +00:00
mstarzinger
09a7ac5fca [deoptimizer] Potentially deopt into debug bytecode.
This makes sure the deoptimizer picks bytecode prepared for debugging
when materializing an interpreted frame if one is available. This is
normally done by the interpreter entry trampoline and hence needs to be
replicated by the deoptimizer.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2271443003
Cr-Commit-Position: refs/heads/master@{#38815}
2016-08-23 11:55:47 +00:00
verwaest
22cb3cba18 Allocate script scopes using a separate constructor
This avoids checking for outer_scope == nullptr in Scope::Scope

BUG=v8:5209

Review-Url: https://codereview.chromium.org/2266973002
Cr-Commit-Position: refs/heads/master@{#38812}
2016-08-23 10:09:40 +00:00
Miran.Karic
239f981653 MIPS: [stubs,interpreter] Optimise SMI loading for 64-bit targets.
Port 28e3467a72 (r38361)

  original commit message:
    Adding new methods to the code stub assembler and interpreter
    assembler to combine loading and untagging SMIs, so that on 64-bit
    architectures we can avoid loading the full 64 bits and load the
    32 interesting bits directly instead.

BUG=

Review-Url: https://codereview.chromium.org/2265043002
Cr-Commit-Position: refs/heads/master@{#38811}
2016-08-23 09:35:51 +00:00
mstarzinger
5e08f43531 [interpreter] Allow mixed stacks if bytecode is preserved.
This changes the compilation pipeline so that mixed stacks are allowed
when bytecode is preserved. This means there can be activations of both,
"baseline" as well as "unoptimized" code active on the stack at the same
time for any single given function.

R=rmcilroy@chromium.org
BUG=v8:4280

Review-Url: https://codereview.chromium.org/2267693002
Cr-Commit-Position: refs/heads/master@{#38809}
2016-08-23 07:41:01 +00:00
bradnelson
e5f5ac7d2b [wasm] asm.js - Remove Wasm.instantiateModuleFromAsm, use asm.js directly.
Make use of %IsAsmWasmCode in place of Wasm.instantiateModuleFromAsm,
in order to reduce the surface area of the Wasm object,
and to focus on testing asm.js coming in via the parser.

Ignore extra CONST_LEGACY assignment introduced by the parser
when modules have the form:
(function Foo(a, b, c) {..});
This requires both a validator and AsmWasmBuilder change.

Move stdlib use collection to import time,
to reject modules that import a function, even if not used.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=jpp@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2264913002
Cr-Commit-Position: refs/heads/master@{#38806}
2016-08-23 04:07:23 +00:00
littledan
b2a257f9ff Remove --promise-extra flag
This flag was shipped on in 52, so it's due for removal. The patch includes
removing the deprecated and unused-in-Blink API Promise::Chain, and many
test updates.

R=adamk@chromium.org
BUG=v8:4633

Review-Url: https://codereview.chromium.org/2267033002
Cr-Commit-Position: refs/heads/master@{#38804}
2016-08-22 21:35:06 +00:00