Commit Graph

10219 Commits

Author SHA1 Message Date
verwaest
a1e9ccf90f Fix Object.prototype.toString.call(proxy)
BUG=

Review URL: https://codereview.chromium.org/1517673002

Cr-Commit-Position: refs/heads/master@{#32806}
2015-12-11 15:57:30 +00:00
jkummerow
cf46317483 [proxies] Fix JSObject::AllCanRead for Proxies on the prototype chain
Review URL: https://codereview.chromium.org/1517753003

Cr-Commit-Position: refs/heads/master@{#32805}
2015-12-11 15:51:46 +00:00
jarin
56673804e0 [turbofan] Store nodes use only MachineRepresentation, not MachineType.
Review URL: https://codereview.chromium.org/1513383003

Cr-Commit-Position: refs/heads/master@{#32803}
2015-12-11 15:34:16 +00:00
ahaas
3ee4c36089 [wasm] Fixed F32Neg and F64Neg for -0.0.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1516143004

Cr-Commit-Position: refs/heads/master@{#32802}
2015-12-11 15:30:15 +00:00
cbruni
df2a92972b [proxy] fixing for-in for proxies, fixing harmony/proxy.js tests, improving error messages and some drive-by fixes
BUG=v8:1543
LOG=n

patch from issue 1519473002 at patchset 1 (http://crrev.com/1519473002#ps1)

Review URL: https://codereview.chromium.org/1516843002

Cr-Commit-Position: refs/heads/master@{#32801}
2015-12-11 14:56:00 +00:00
ahaas
d83057b4ce [wasm] Change the return type of traps for tests, and added ftoi64 instructions.
Before this change traps always returned a 32 bit word in tests. With this
change traps return either a 32 bit word or a64 bit word, depending on the size
of the actual return value of the test.

Additionally this CL implements the wasm instructions I64SCONVERTF32,
I64UCONVERTF32, I64SCONVERTF64, and I64UCONVERTF64.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1519013003

Cr-Commit-Position: refs/heads/master@{#32800}
2015-12-11 14:54:20 +00:00
jkummerow
a83546932b Move Object.assign implementation to C++
This avoids a pair of super-high-degree polymorphic load/store ICs, and
creates the opportunity to add more fast paths if needed.

Review URL: https://codereview.chromium.org/1517963002

Cr-Commit-Position: refs/heads/master@{#32799}
2015-12-11 14:10:55 +00:00
bradnelson
ff0cc4a4c1 Reland addition of init function for asm->wasm.
This relands this, in it's new home:
032faa8a90

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1522473002

Cr-Commit-Position: refs/heads/master@{#32798}
2015-12-11 14:10:00 +00:00
ahaas
97161a29ed [turbofan] Change TruncateFloat32ToUint64 to TryTruncateFloat32ToUint64.
TryTruncateFloat32ToUint64 converts a float32 to a uint64. Additionally it
provides an optional second return value which indicates whether the conversion
succeeded (i.e. float32 value was within uint64 range) or not.

I implemented the new operator on x64, arm64, and mips64. @v8-ppc-ports, can you
please take care of the ppc64 implementation of the second output?

Additionally I fixed a bug on x64 and mips64 in the implementation of
TryTruncateFloat64ToUint64. Cases where the input value was between -1 and 0
were handled incorrectly.

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1512023002

Cr-Commit-Position: refs/heads/master@{#32796}
2015-12-11 14:07:18 +00:00
Hannes Payer
9a5650ac9e Remove obsolete PrototypeTransitionClearing cctest.
BUG=

Review URL: https://codereview.chromium.org/1520793003 .

Cr-Commit-Position: refs/heads/master@{#32795}
2015-12-11 12:53:09 +00:00
titzer
4c5b3609fd Initial import of v8-native WASM.
As discussed in person, this adds the code from v8-native-prototype into
V8 proper, guarded by GYP flags that do not build the code by default.
Passing wasm=on to 'make' or setting v8_wasm as a GYP flag activates
building of this code.

An additional header file is added to and exported from the compiler
directory, src/compiler/wasm-compiler.h. This exposes a limited interface
with opaque Node and Graph types to the decoder to build TF graphs, as
well as functions to compile WASM graphs.

The mjsunit tests added are blacklisted because they fail without the
WASM object exposed to JS, which is also disabled by the build config
option.

This corresponds closely to 5981e06ebc, with some formatting fixes and moving some files into src/compiler.

R=mstarzinger@chromium.org, bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1504713014

Cr-Commit-Position: refs/heads/master@{#32794}
2015-12-11 12:27:05 +00:00
Ben L. Titzer
69cf31f0b7 Disable test-heap/PrototypeTransitionClearing
R=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1521583003 .

Cr-Commit-Position: refs/heads/master@{#32792}
2015-12-11 12:21:09 +00:00
mvstanton
3f648d7b44 Turbofan instanceof lowering needs to address proxies.
BUG=

Review URL: https://codereview.chromium.org/1518773003

Cr-Commit-Position: refs/heads/master@{#32788}
2015-12-11 11:03:07 +00:00
epertoso
474ecd67ea Revert of Removes the Callee parameter from FunctionCallbackInfo. (patchset #1 id:1 of https://codereview.chromium.org/1510483002/ )
Reason for revert:
Need to figure out a better solution for this.

Original issue's description:
> Removes the Callee parameter from FunctionCallbackInfo.
>
> This will help us to instantiate AccessorPair's getters and setters only when they are needed.
>
> BUG=
>
> Committed: https://crrev.com/2fe34ebdcdee0f21b88daa4098a7918e91abb8fb
> Cr-Commit-Position: refs/heads/master@{#32759}

TBR=jochen@chromium.org,verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1520843002

Cr-Commit-Position: refs/heads/master@{#32787}
2015-12-11 10:20:51 +00:00
vogelheim
5819e4be5b Re-re-land FastAccessorBuilder.
... using the RawMachineAssembler and the work in crrev.com/1407313004.

The original change collided with crrev.com/1513543003.

BUG=chromium:508898
LOG=Y

Committed: https://crrev.com/515d9ccd8e6df7bf2ca01e2a55aaad30226399e1
Cr-Commit-Position: refs/heads/master@{#32742}

patch from issue 1474543004 at patchset 260001 (http://crrev.com/1474543004#ps260001)

Committed: https://crrev.com/ee5c38d7db907ff86dd4049721c0cb4bc90a6c4d
Cr-Commit-Position: refs/heads/master@{#32753}

patch from issue 1504713012 at patchset 20001 (http://crrev.com/1504713012#ps20001)

Review URL: https://codereview.chromium.org/1518703002

Cr-Commit-Position: refs/heads/master@{#32786}
2015-12-11 09:54:00 +00:00
mlippautz
a86ddc5bc3 Revert of [cctest] Add tests for aborting compaction of pages (patchset #6 id:140001 of https://codereview.chromium.org/1511933002/ )
Reason for revert:
Failing on Win 32bit nosnap:
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/10602

Original issue's description:
> [cctest] Add tests for aborting compaction of pages
>
> Tests for
> * aborting a full page.
> * partially aborting a page.
> * partially aborting a page with pointers between aborted pages.
> * partially aborting a page with store buffer entries.
>
> Also introduces force_oom() which prohibits a old space to
> expand
>
> BUG=chromium:524425
> LOG=N

TBR=ulan@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1514603008

Cr-Commit-Position: refs/heads/master@{#32785}
2015-12-11 09:50:47 +00:00
mlippautz
161a0e0051 [cctest] Add tests for aborting compaction of pages
Tests for
* aborting a full page.
* partially aborting a page.
* partially aborting a page with pointers between aborted pages.
* partially aborting a page with store buffer entries.

Also introduces ShouldForceOOM() which prohibits a PagedSpace from expanding.
Compaction spaces refer to the corresponding actual space.

BUG=chromium:524425
LOG=N

Review URL: https://codereview.chromium.org/1511933002

Cr-Commit-Position: refs/heads/master@{#32783}
2015-12-11 09:14:46 +00:00
bmeurer
7e5ff19ee2 [turbofan] Some more cleanup on the intrinsics.
Remove unused obsolete %_StringGetStringLength intrinsic, and properly
optimize the %_SubString, %_RegExpExec, %_RegExpFlags, %_RegExpSource
and %_RegExpConstructResult intrinsics.

Review URL: https://codereview.chromium.org/1516753006

Cr-Commit-Position: refs/heads/master@{#32782}
2015-12-11 09:12:12 +00:00
adamk
8b968b70e9 Revert of [es6] support AssignmentPattern as LHS in for-in/of loops (patchset #9 id:280001 of https://codereview.chromium.org/1508933004/ )
Reason for revert:
Hits unreachable code (found by fuzzer). Example crasher:

"for(();;);"

Original issue's description:
> [es6] support AssignmentPattern as LHS in for-in/of loops
>
> BUG=v8:811, v8:4599
> LOG=N
> R=adamk@chromium.org, rossberg@chromium.org
>
> Committed: https://crrev.com/e47bdb775564b2cd8365047425898ab4274190a6
> Cr-Commit-Position: refs/heads/master@{#32773}

TBR=rossberg@chromium.org,caitpotter88@gmail.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:811, v8:4599

Review URL: https://codereview.chromium.org/1511773009

Cr-Commit-Position: refs/heads/master@{#32774}
2015-12-11 02:00:01 +00:00
caitpotter88
e47bdb7755 [es6] support AssignmentPattern as LHS in for-in/of loops
BUG=v8:811, v8:4599
LOG=N
R=adamk@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1508933004

Cr-Commit-Position: refs/heads/master@{#32773}
2015-12-11 01:06:48 +00:00
littledan
88c8361b8f Unstage non-standard Promise functions
This patch removes Promise functions and methods which are absent
from the ES2015 specification when the --es-staging flag is on.
The patch is being relanded after being reverted due to an
unrelated bug. This version is slightly different as promise_chain
is installed on the context regardless of the flag value, so that
the Promise::Chain API continues to work until it is deprecated.

BUG=v8:3237
R=rossberg
LOG=Y

Review URL: https://codereview.chromium.org/1513873002

Cr-Commit-Position: refs/heads/master@{#32772}
2015-12-10 23:58:26 +00:00
littledan
46cb23c24b Disable new regression tests with noi18n
BUG=chromium:487322
R=adamk
LOG=N

Review URL: https://codereview.chromium.org/1514993002

Cr-Commit-Position: refs/heads/master@{#32770}
2015-12-10 22:52:44 +00:00
littledan
bff3074d73 Allow ICU to normalize time zones
There's at least one case of a time zone alias: Asia/Kathmandu aliases
Asia/Katmandu. ICU seems to normalize to the (deprecated) latter choice.
V8 internationalization choked on this change; this patch interprets
ICU's output more precisely and allows it.

BUG=chromium:487322
R=jungshik,adamk
LOG=Y

Review URL: https://codereview.chromium.org/1509273007

Cr-Commit-Position: refs/heads/master@{#32769}
2015-12-10 20:13:45 +00:00
adamk
eb67f85439 Fix FuncNameInferrer usage in ParseAssignmentExpression
Without this fix, AssignmentExpressions that happen to be arrow functions
would lead to unbalanced Enter/Leave calls on the fni_, causing thrashing
while trying to infer function names. Symptoms include slow parsing
or OOM (when we create too many AstConsStrings).

To try to keep this from happening in the future, added an RAII helper
class to handle Entering/Leaving FNI state.

The included regression test crashes on my workstation without the patch.
Note that it's too slow in debug mode (as well as under TurboFan),
so I've skipped it there.

BUG=v8:4595
LOG=y

Review URL: https://codereview.chromium.org/1507283003

Cr-Commit-Position: refs/heads/master@{#32768}
2015-12-10 19:19:35 +00:00
ishell
dddcd0ac17 Fix Function subclassing.
Function subclasses did not have function properties installed (name, prototype, etc.).
Now when an instance of a Function subclass is created it gets initial map that corresponds
to the language mode of the function body. The language mode dependent maps are cached as
special transitions on initial map of the subclass constructor.

BUG=v8:4597, v8:3101, v8:3330
LOG=Y

Review URL: https://codereview.chromium.org/1510753005

Cr-Commit-Position: refs/heads/master@{#32764}
2015-12-10 17:28:08 +00:00
mythria
67f3c80da9 Adds additional tests for bytecode graph builder
Adds more tests for Delete, InstanceOf, and ToName bytecodes.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1509273005

Cr-Commit-Position: refs/heads/master@{#32763}
2015-12-10 17:08:45 +00:00
rmcilroy
42718a4c88 Remove dummy control / effect edges from RMA Load / Store / Div nodes.
Review URL: https://codereview.chromium.org/1510173004

Cr-Commit-Position: refs/heads/master@{#32762}
2015-12-10 17:07:41 +00:00
epertoso
2fe34ebdcd Removes the Callee parameter from FunctionCallbackInfo.
This will help us to instantiate AccessorPair's getters and setters only when they are needed.

BUG=

Review URL: https://codereview.chromium.org/1510483002

Cr-Commit-Position: refs/heads/master@{#32759}
2015-12-10 15:36:54 +00:00
cbruni
c20156c550 [runtime] [proxies] adding tests for uncovered branches
fly-by fix of Proxy [[Construct]] on mips.

BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1517463002

Cr-Commit-Position: refs/heads/master@{#32758}
2015-12-10 15:35:15 +00:00
jkummerow
989f44f126 Fix mix-up in HasEnumerableElements()
Only JSArrays ever have packed elements; holey elements can be on any kind of object.

BUG=chromium:568525
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1515963002

Cr-Commit-Position: refs/heads/master@{#32755}
2015-12-10 15:01:49 +00:00
vogelheim
f564231a6b Revert of Re-land FastAccessorBuilder. (patchset #2 id:20001 of https://codereview.chromium.org/1504713012/ )
Reason for revert:
Meeh. Now "V8 Linux - gcmole" bot has issues; apparently due to a somewhat exotic builder configuration.

Original issue's description:
> Re-land FastAccessorBuilder.
>
> ... using the RawMachineAssembler and the work in crrev.com/1407313004.
>
> The original change collided with crrev.com/1513543003.
>
> BUG=chromium:508898
> LOG=Y
>
> Committed: https://crrev.com/515d9ccd8e6df7bf2ca01e2a55aaad30226399e1
> Cr-Commit-Position: refs/heads/master@{#32742}
>
> patch from issue 1474543004 at patchset 260001 (http://crrev.com/1474543004#ps260001)
>
> Committed: https://crrev.com/ee5c38d7db907ff86dd4049721c0cb4bc90a6c4d
> Cr-Commit-Position: refs/heads/master@{#32753}

TBR=epertoso@chromium.org,mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:508898

Review URL: https://codereview.chromium.org/1517683002

Cr-Commit-Position: refs/heads/master@{#32754}
2015-12-10 14:45:55 +00:00
vogelheim
ee5c38d7db Re-land FastAccessorBuilder.
... using the RawMachineAssembler and the work in crrev.com/1407313004.

The original change collided with crrev.com/1513543003.

BUG=chromium:508898
LOG=Y

Committed: https://crrev.com/515d9ccd8e6df7bf2ca01e2a55aaad30226399e1
Cr-Commit-Position: refs/heads/master@{#32742}

patch from issue 1474543004 at patchset 260001 (http://crrev.com/1474543004#ps260001)

Review URL: https://codereview.chromium.org/1504713012

Cr-Commit-Position: refs/heads/master@{#32753}
2015-12-10 14:15:19 +00:00
rmcilroy
c4745aa187 Remove dummy control / effect edges from RMA Call nodes.
Removes the dummy control and effect edges from the RMA Call nodes. This
requires a change to the node matchers to allow them to cope with nodes
which don't have control or effect matchers.

Review URL: https://codereview.chromium.org/1518673002

Cr-Commit-Position: refs/heads/master@{#32752}
2015-12-10 13:36:28 +00:00
neis
a5380fe9ed JSON.parse: properly deal with reviver result
When the reviver returns undefined, the property in question must be deleted
even for arrays.  So far this only happened for non-array objects.

Also change the property enumeration to be spec-conformant, which is observable when the reviver modifies its "this" object directly.  There are a few further issues that need to be addressed in a separate CL.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1506933003

Cr-Commit-Position: refs/heads/master@{#32750}
2015-12-10 12:49:06 +00:00
jarin
9c87bd4b82 [turbofan] Get rid of truncation by store.
Nowadays, representation inference and simplified lowering can insert the
right truncations based on the use.

Review URL: https://codereview.chromium.org/1512243002

Cr-Commit-Position: refs/heads/master@{#32747}
2015-12-10 11:23:55 +00:00
vogelheim
0a50af8625 Revert of Implement Fast Accessor Builder (patchset #14 id:260001 of https://codereview.chromium.org/1474543004/ )
Reason for revert:
Broke the build, apparently.

Original issue's description:
> Implement FastAccessorBuilder.
>
> ... using the RawMachineAssembler and the work in cl/1407313004
>
> BUG=chromium:508898
> LOG=Y
>
> Committed: https://crrev.com/515d9ccd8e6df7bf2ca01e2a55aaad30226399e1
> Cr-Commit-Position: refs/heads/master@{#32742}

TBR=epertoso@chromium.org,bmeurer@chromium.org,jochen@chromium.org,mstarzinger@chromium.org,mvstanton@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:508898

Review URL: https://codereview.chromium.org/1513203002

Cr-Commit-Position: refs/heads/master@{#32744}
2015-12-10 10:16:35 +00:00
vogelheim
515d9ccd8e Implement FastAccessorBuilder.
... using the RawMachineAssembler and the work in cl/1407313004

BUG=chromium:508898
LOG=Y

Review URL: https://codereview.chromium.org/1474543004

Cr-Commit-Position: refs/heads/master@{#32742}
2015-12-10 10:10:11 +00:00
balazs.kilvady
9597b019bc MIPS: Fix NaN tests.
BUG=
TEST=mjsunit/regress/regress-undefined-nan, mjsunit/regress/regress-undefined-nan3, mjsunit/regress/regress-2596

Review URL: https://codereview.chromium.org/1507363002

Cr-Commit-Position: refs/heads/master@{#32741}
2015-12-10 10:06:17 +00:00
jarin
bb2a830deb [turbofan] Make MachineType a pair of enums.
MachineType is now a class with two enum fields:
- MachineRepresentation
- MachineSemantic

Both enums are usable on their own, and this change switches some places from using MachineType to use just MachineRepresentation. Most notably:
- register allocator now uses just the representation.
- Phi and Select nodes only refer to representations.

Review URL: https://codereview.chromium.org/1513543003

Cr-Commit-Position: refs/heads/master@{#32738}
2015-12-10 09:03:53 +00:00
ahaas
28261daa47 [turbofan] Change TruncateFloat32ToInt64 to TryTruncateFloat32ToInt64.
This operator now provides a second output which indicates whether the
conversion from float32 to int64 was successful or not. The second output
returns 0 if the conversion fails, or something else if the conversion succeeds.

The second output can be ignored, which means that the operator can be used the
same as the original operator.

I implement the new operator on x64, arm64, and mips64. @v8-ppc-ports, can you
please take care of the ppc64 implementation of the second output?

R=titzer@chromium.org, v8-arm-ports@googlegroups.com, v8-mips-ports@googlegroups.com

Review URL: https://codereview.chromium.org/1504363002

Cr-Commit-Position: refs/heads/master@{#32737}
2015-12-10 08:12:23 +00:00
verwaest
2d13f6ec43 Fix Promise intrinsicDefaultProto
BUG=v8:3900, v8:3931, v8:1543, v8:3330
LOG=n

Review URL: https://codereview.chromium.org/1511893002

Cr-Commit-Position: refs/heads/master@{#32731}
2015-12-10 00:33:51 +00:00
yangguo
e110a2a8f3 Make mjsunit/random-bit-correlations more predictable.
R=machenbach@chromium.org
BUG=v8:4588
LOG=N

Review URL: https://codereview.chromium.org/1508583002

Cr-Commit-Position: refs/heads/master@{#32730}
2015-12-09 21:05:07 +00:00
adamk
2f9c68cfb1 Pass --harmony-object-observe in tests that depend on it
This is in preparation for turning the flag off by default.

BUG=chromium:552100
LOG=n

Review URL: https://codereview.chromium.org/1511293002

Cr-Commit-Position: refs/heads/master@{#32729}
2015-12-09 20:34:16 +00:00
verwaest
897fecd58c Improve the CallSite constructor
BUG=

Review URL: https://codereview.chromium.org/1510833003

Cr-Commit-Position: refs/heads/master@{#32722}
2015-12-09 17:28:35 +00:00
verwaest
454c1faeef Make Error.prototype.toString spec compliant; and fix various side-effect-free error printing methods
R=yangguo@chromium.org
LOG=n

Committed: https://crrev.com/5dffa35350d0f57402806e6bd87a914e1d5933e4
Cr-Commit-Position: refs/heads/master@{#32695}

Review URL: https://codereview.chromium.org/1507273002

Cr-Commit-Position: refs/heads/master@{#32720}
2015-12-09 17:03:08 +00:00
cbruni
a2d5641bc4 [runtime] [proxy] implement [[Construct]]
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1509603005

Cr-Commit-Position: refs/heads/master@{#32718}
2015-12-09 14:55:33 +00:00
ulan
02320548a5 Move map retaining to finalization of incremental marking.
Compaction of the array with maps happens lazily upon adding new maps.

BUG=

Review URL: https://codereview.chromium.org/1481953002

Cr-Commit-Position: refs/heads/master@{#32717}
2015-12-09 14:53:52 +00:00
vogelheim
35452afafb Remove deprecated APIs from test-api.cc, lines 10k - 17k.
- Except 2x applications of ForceSet, where I still need to debug
  why the expected replacement doesn't work as expected.
- Ca. 3/4 of the file is covered.

R=jochen@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1516483002

Cr-Commit-Position: refs/heads/master@{#32714}
2015-12-09 13:18:48 +00:00
bmeurer
6a1328452a [turbofan] The JSCreateWithContext operator doesn't need a frame state.
Creating a with context cannot lazy/eager deoptimize, so we don't need
to pass a frame state.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1508373002

Cr-Commit-Position: refs/heads/master@{#32711}
2015-12-09 12:00:26 +00:00
mythria
67c99a9918 [Interpreter] Adds wide variant of CreateLiterals. Adds CreateLiterals to BytecodeGraphBuilder.
Adds implementation and tests for CreateObjectLiteral, CreateArrayLiteral and CreateRegExpLiteral
to bytecode graph builder. Also changes these bytecodes to expect three operands instead of using
accumulator to pass one of the operands. This is done to avoid looking into the earlier nodes to
fetch operands in the bytecode graph builder. Also adds support for wide variant of these
bytecodes to bytecode generator and bytecode graph builder.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1503963002

Cr-Commit-Position: refs/heads/master@{#32710}
2015-12-09 11:53:14 +00:00