Commit Graph

6637 Commits

Author SHA1 Message Date
neis
67f1969a07 [parsing] Fix bug in completion value of try-finally.
R=adamk@chromium.org, verwaest@chromium.org
BUG=v8:5698

Review-Url: https://codereview.chromium.org/2537413003
Cr-Commit-Position: refs/heads/master@{#41495}
2016-12-05 17:00:48 +00:00
bmeurer
a639f7df04 [test] Remove useless test code.
That ADD builtin is gone for a long time.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2547423002
Cr-Commit-Position: refs/heads/master@{#41473}
2016-12-05 07:01:59 +00:00
gdeepti
6454102c5b [wasm] Fix WasmInstanceWrapper allocation.
In the current implementation, WasmInstanceWrapper is allocated after the imports for the instance are processed, and before the InstanceFinalizer callback is associated with the instance. This raises the possibility of triggering a gc in the middle of the instantiate flow which is incorrect.

BUG=5707

R=titzer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2544273002
Cr-Commit-Position: refs/heads/master@{#41464}
2016-12-03 01:29:49 +00:00
enne
0ea4a54220 Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )
Reason for revert:
Speculative revert for causing timeouts on Win Debug gpu fyi bot

Nothing else looks even remotely relevant in the list of changes.
Will reland if this doesn't fix the issues.

BUG=670396

Original issue's description:
> [typedarrays] remove invalid optimization in NAMEConstructor()
>
> Before, we were treating objects with the builtin ArrayValues iterator
> method as array-like, where the iterator would iterate through to the
> full length of the object.
>
> This optimization was not sound, because it does not ensure that the
> next method hasn't been modified. Even if it hasn't been modified,
> it's entirely possible to be modified during iteration. Thus, this
> optimization has been removed due to its observability.
>
> BUG=v8:5699
> R=littledan@chromium.org, cbruni@chromium.org
>
> Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> Cr-Commit-Position: refs/heads/master@{#41394}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5699

Review-Url: https://codereview.chromium.org/2548583003
Cr-Commit-Position: refs/heads/master@{#41461}
2016-12-02 18:48:35 +00:00
ishell
e7a51fff24 [ic] Ensure state of load/store ICs always progresses.
... even when a receiver is not an object.

BUG=v8:5697

Review-Url: https://codereview.chromium.org/2548753003
Cr-Commit-Position: refs/heads/master@{#41458}
2016-12-02 15:07:31 +00:00
bmeurer
6e2bb99738 [test] Skip regress/regress-2185-2 with msan.
TBR=machenbach@chromium.org
BUG=v8:5666

Review-Url: https://codereview.chromium.org/2542843008
Cr-Commit-Position: refs/heads/master@{#41457}
2016-12-02 14:30:38 +00:00
titzer
e454742d7c [wasm] Avoid using const that triggers ignition and flakes on ARM.
R=machenbach@chromium.org,jarin@chromium.org
BUG=v8:5710

Review-Url: https://codereview.chromium.org/2551433002
Cr-Commit-Position: refs/heads/master@{#41454}
2016-12-02 13:54:43 +00:00
mstarzinger
651c1b86a2 [compiler] Make --debug-code the default in debug builds.
This enables {FLAG_debug_code} by default in debug builds. The advantage
is that generated code contained within the snapshot will contain such
debug code. Before we would only get coverage for these pieces with the
no-snapshot builds, which have a meager coverage. One can still pass the
inverse --no-debug-code flag to ensure generated code remains readable
within debug builds as well.

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2528913002
Cr-Commit-Position: refs/heads/master@{#41451}
2016-12-02 11:36:55 +00:00
ishell
39e6f2ca4a [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, chromium:669411, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
Review-Url: https://codereview.chromium.org/2534613002
Cr-Original-Commit-Position: refs/heads/master@{#41332}
Cr-Commit-Position: refs/heads/master@{#41449}
2016-12-02 10:03:33 +00:00
mstarzinger
f8fec66f0b [turbofan] Workaround for unknown array literal length.
This fixes the existing workaround in {BytecodeGraphBuilder} where the
number of elements in an array literal is unknown just from the bytecode
alone and needs to be deduced from the constant elements.

Note that this is just a quick fix to prevent calling the fast-clone
stub for boilerplates that are too big to fit on a regular page. In the
long run we need something more solid here.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-669850
BUG=chromium:669850

Review-Url: https://codereview.chromium.org/2542633002
Cr-Commit-Position: refs/heads/master@{#41420}
2016-12-01 12:01:00 +00:00
bradnelson
71cc94dae3 [wasm][asm.js] Allow a function to be exported more than once.
Allow a function to be exported multiple times in a asm.js
module.
Remarkably, this had not been working before.

BUG=670057
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2535723009
Cr-Commit-Position: refs/heads/master@{#41416}
2016-12-01 10:13:01 +00:00
jgruber
2c3fe6d961 [regexp] Migrate @@split to TurboFan
This shows around a 2.2x speedup compared to the old JS implementation (and
3.5x compared to CPP) for the fast path.

Adds ToUint32 to CodeStubAssembler.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2532403002
Cr-Commit-Position: refs/heads/master@{#41408}
2016-12-01 08:25:20 +00:00
bradnelson
00ec48335e [wasm] [asm.js] Ignore unused function tables in AsmWasmBuilder.
Incremental parsing of asm.js means we can see function tables that
are unused in the AsmWasmBuilder before they've been initialized.

BUG=669899
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2546553002
Cr-Commit-Position: refs/heads/master@{#41403}
2016-12-01 02:27:30 +00:00
caitp
d4918463a9 [accessors] handle writable changing during ArrayLengthSetter
The "writable" property descriptor may legally change during the call to
AnythingToArrayLength(). This change needs to be honoured before calling
JSArray::SetLength(). The change is only honoured when the "length"
property was previously writable, so that changes during a call to
DefineOwnPropertyIgnoreAttributes() is ignored.

BUG=v8:5688
R=cbruni@chromium.org, verwaest@chromium.org, jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2543553002
Cr-Commit-Position: refs/heads/master@{#41396}
2016-11-30 19:13:51 +00:00
caitp
77df8c67d9 [typedarrays] remove invalid optimization in NAMEConstructor()
Before, we were treating objects with the builtin ArrayValues iterator
method as array-like, where the iterator would iterate through to the
full length of the object.

This optimization was not sound, because it does not ensure that the
next method hasn't been modified. Even if it hasn't been modified,
it's entirely possible to be modified during iteration. Thus, this
optimization has been removed due to its observability.

BUG=v8:5699
R=littledan@chromium.org, cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2544503002
Cr-Commit-Position: refs/heads/master@{#41394}
2016-11-30 17:13:31 +00:00
jarin
e19f43df61 [crankshaft] Disable escape analysis of nested objects.
BUG=chromium:669024

Review-Url: https://codereview.chromium.org/2531163006
Cr-Commit-Position: refs/heads/master@{#41389}
2016-11-30 15:07:16 +00:00
rmcilroy
6d90507a7c [Turbofan] Disable JSFrameSpecialization for interpreted frames.
JSFrameSpecialization depends on the layout of the frame and doesn't work
with interpreted frames. Disable it since it is only used for OSR from asmjs code, which shouldn't go through the bytecode graph builder in many cases.

BUG=669517

Review-Url: https://codereview.chromium.org/2538823002
Cr-Commit-Position: refs/heads/master@{#41387}
2016-11-30 14:03:51 +00:00
rmcilroy
8037e98e44 [Interpreter] Remove skips for tests that no longer seem to be flaky.
BUG=v8:4680

Review-Url: https://codereview.chromium.org/2541563002
Cr-Commit-Position: refs/heads/master@{#41378}
2016-11-30 09:21:37 +00:00
bradnelson
14e05c1046 [wasm] asm.js - Parse and convert asm.js to wasm a function at a time.
Make the AsmWasmBuilder drive the process of typing and potentially parsing
function bodies. This will allow us to keep only a single asm.js function's
AST in memory as we convert to WebAssembly.
This is needed to keep our memory footprint low.

Add some additional output to a few tests that's helpful to see which stage they fail at.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=marja@chromium.org,adamk@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2398023002
Cr-Commit-Position: refs/heads/master@{#41372}
2016-11-30 00:26:05 +00:00
danno
df2578d2ec [stubs] Port builtin for Array.push fast-case from Crankshaft to TF
Improves performance in simple, single element case by 5% and in multiple
elements cases by 2%.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2497243002
Cr-Commit-Position: refs/heads/master@{#41368}
2016-11-29 16:58:30 +00:00
vogelheim
b1b7d19610 Cleanup: Move mjsunit/regress-*.js into mjsunit/regress/.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2531983004
Cr-Commit-Position: refs/heads/master@{#41362}
2016-11-29 14:20:53 +00:00
bmeurer
d6752d94a8 [turbofan] Teach escape analysis about ConvertTaggedHoleToUndefined.
The EscapeStatusAnalysis didn't know anything about the simplified
operator ConvertTaggedHoleToUndefined, thus leading to a crash. We
now just handled it by pretending that any allocation that goes into
such a node escapes.

BUG=chromium:669451
R=tebbi@chromium.org

Review-Url: https://codereview.chromium.org/2533263002
Cr-Commit-Position: refs/heads/master@{#41359}
2016-11-29 13:13:55 +00:00
leszeks
2bf71f888f [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41355}
2016-11-29 12:27:15 +00:00
verwaest
73a2d63df8 [scopes] Propagate inner-scope-calls-eval to make sure we context allocate in inserted scopes
BUG=v8:5664

Review-Url: https://codereview.chromium.org/2536153002
Cr-Commit-Position: refs/heads/master@{#41353}
2016-11-29 12:01:34 +00:00
bmeurer
719d6c1d58 [turbofan] Also optimize instanceof with bound functions.
For bound functions on the right-hand side of instanceof we can
constant-fold to the actual [[BoundTargetFunction]], actually
instance OrdinaryHasInstance. Move the Function.prototype[@@hasInstance]
reduction up to the JSCallReducer to allow this optimization to become
effective (and also enable other optimizations).

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2537763002
Cr-Commit-Position: refs/heads/master@{#41352}
2016-11-29 11:58:55 +00:00
mstarzinger
204babf5a0 [deoptimizer] Fix deoptimization in {TranslatedState}.
This ensures the deoptimization triggered due to materialization of
objects by the {TranslatedState} works in conjunction with OSR. The
optimized code used for OSR is not installed on the function, hence
needs to be specified explicitly when requesting deoptimization for
specific stack frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-668795
BUG=chromium:668795

Review-Url: https://codereview.chromium.org/2534143002
Cr-Commit-Position: refs/heads/master@{#41348}
2016-11-29 11:34:22 +00:00
leszeks
a2e2a39ff1 Revert of [ignition/turbo] Perform liveness analysis on the bytecodes (patchset #17 id:320001 of https://codereview.chromium.org/2523893003/ )
Reason for revert:
Breaks the build:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14886

Original issue's description:
> [ignition/turbo] Perform liveness analysis on the bytecodes
>
> Replaces the graph-based liveness analyzer in the bytecode graph builder
> with an initial bytecode-based liveness analysis pass, which is added to
> the existing loop extent analysis.
>
> Now the StateValues in the graph have their inputs initialised to
> optimized_out, rather than being modified after the graph is built.
>
> Committed: https://crrev.com/1852300954c216c29cf93444430681d213e87925
> Cr-Commit-Position: refs/heads/master@{#41344}

TBR=jarin@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2541443002
Cr-Commit-Position: refs/heads/master@{#41346}
2016-11-29 10:51:45 +00:00
bmeurer
777e142ca1 [turbofan] Add appropriate types to express Callable.
This introduces three new types OtherCallable, CallableProxy (and OtherProxy),
and BoundFunction to make it possible to express Callable in the Type system.
It also forces all undetectable receivers to be Callable, which matches the
use case for undetectable, namely document.all (guarded by proper checks and
tests).

It also uses these new types to properly optimize instanceof (indirectly via
OrdinaryHasInstance) based on the type of the constructor and the object. So
we are able to constant-fold certain instanceof expressions based on types
and completely avoid the builtin call.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2535753004
Cr-Commit-Position: refs/heads/master@{#41345}
2016-11-29 10:48:13 +00:00
leszeks
1852300954 [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41344}
2016-11-29 10:46:20 +00:00
ahaas
68f89a07c0 [wasm] Skip mjsunit/wasm/import-memory on gc-stress
BUG=v8:5683
NOTRY=true
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2541433002
Cr-Commit-Position: refs/heads/master@{#41340}
2016-11-29 09:24:15 +00:00
machenbach
9c0e2a6723 Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain modificati… (patchset #2 id:40001 of https://codereview.chromium.org/2534613002/ )
Reason for revert:
Layout test crashes:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11691

Original issue's description:
> [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
>
> ... instead of clearing of all the KeyedStoreICs which didn't always work.
>
> BUG=chromium:662907, v8:5561
> TBR=verwaest@chromium.org, bmeurer@chromium.org
>
> Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
> Cr-Commit-Position: refs/heads/master@{#41332}

TBR=jkummerow@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:662907, v8:5561

Review-Url: https://codereview.chromium.org/2538693002
Cr-Commit-Position: refs/heads/master@{#41337}
2016-11-29 08:49:48 +00:00
henrique.ferreiro
bc1a3820c2 Implement DefineOwnProperty for TypedArrays
TypedArrays need specific checks before calling OrdinaryDefineOwnProperty.

BUG=v8:5328

Review-Url: https://codereview.chromium.org/2431223005
Cr-Commit-Position: refs/heads/master@{#41333}
2016-11-29 00:07:58 +00:00
ishell
a39522f44f [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2534613002
Cr-Commit-Position: refs/heads/master@{#41332}
2016-11-28 22:56:52 +00:00
ishell
a814b8aeaf [heap] Clear recorded slots for inobject properties when migrating fast object to slow mode.
BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539493002
Cr-Commit-Position: refs/heads/master@{#41327}
2016-11-28 20:11:30 +00:00
zhengxing.li
0c6b6138bf X87: [test] disable number-tostring test case for x87.
The reason:
  The CL #41255 (https://codereview.chromium.org/2520363002 ) reimplemnt the Number.prototype.toString and the added number-tostring test cases failed at x87.

  Similar to many previos fixing CLs, i.e.: CL #37371 (https://codereview.chromium.org/2111493002 ), the root reason is:
  The Gcc compiler and it's dependent C++ libraris on linux platform use x87 in extended 80-bit double precision by default.
  So the reimplemented DoubleToRadixCString() will generate extended 80-bit double precision result which isn't the expected standard 64-bit double precision
  value.

  Although modifying DoubleToRadixCString() function to manually do the 80-bit <--> 64-bit conversion for each double/float computation step can fix this issue,
  but it wll drop the DoubleToRadixCString() function's performance of other architectures.

  This CL put the failed number-tostring test cases into number-tostring-big-integer.js and disables it for x87.

BUG=

Review-Url: https://codereview.chromium.org/2532073002
Cr-Commit-Position: refs/heads/master@{#41322}
2016-11-28 15:31:20 +00:00
vogelheim
e0d608a2b1 Fix 'combo breaker' in CreateDynamicFunction to handle template literals.
BUG=chromium:663410

Review-Url: https://codereview.chromium.org/2533463002
Cr-Commit-Position: refs/heads/master@{#41320}
2016-11-28 14:44:13 +00:00
jarin
72b5a0d40e [deoptimizer] Use the correct function for handler lookup for bytecode.
BUG=chromium:668760

Review-Url: https://codereview.chromium.org/2530403002
Cr-Commit-Position: refs/heads/master@{#41314}
2016-11-28 12:45:29 +00:00
yangguo
ee84d9f7f9 [debug] remove debug command processor from regress tests.
BUG=v8:5510
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2535733002
Cr-Commit-Position: refs/heads/master@{#41312}
2016-11-28 12:02:44 +00:00
yangguo
0398e5d5e4 [debug] remove debug command processor from scope tests.
BUG=v8:5510
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2536573002
Cr-Commit-Position: refs/heads/master@{#41311}
2016-11-28 12:01:44 +00:00
yangguo
e1470db7a3 [debug] remove debug command processor from debug evaluate tests.
R=jgruber@chromium.org
BUG=v8:5510

Review-Url: https://codereview.chromium.org/2532893002
Cr-Commit-Position: refs/heads/master@{#41308}
2016-11-28 11:38:15 +00:00
ahaas
5d5ccb6e45 [mjsunit] Change assertThrows such that it can check the exception message.
Up until now assertThrows allows to check the type field of an
exception, which is, however, a custom field introduced in a single
regression test. With the change assertThrows allows to check the
message field of an exception, which is set for standard V8 exceptions
by default.

I use the new assertThrows to refactor test/mjsunit/wasm/divrem-trap.js

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2525313003
Cr-Commit-Position: refs/heads/master@{#41302}
2016-11-28 10:26:44 +00:00
cbruni
a09e5eda26 [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS
A missing @@IsConcatSpreadable check caused the fast path inside the slow path
to be incorrect and follow the default concat strategy when the arguments
arrays contain only doubles.

BUG=chromium:668414

Review-Url: https://codereview.chromium.org/2527173002
Cr-Commit-Position: refs/heads/master@{#41301}
2016-11-28 10:06:17 +00:00
yangguo
b6d2bacd66 Fix Number.prototype.toString with non-default radix wrt modulo.
TBR=tebbi@chromium.org
BUG=chromium:668510

Review-Url: https://codereview.chromium.org/2526223003
Cr-Commit-Position: refs/heads/master@{#41280}
2016-11-25 07:46:40 +00:00
jkummerow
9be747666c Reland^2 of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2528883003
Cr-Commit-Position: refs/heads/master@{#41272}
2016-11-24 16:23:12 +00:00
neis
cde9f7bfed [modules] Propagate module status when creating ParseInfo from SFI.
In the ParseInfo constructor that takes a SharedFunctionInfo, we must
set the module flag when the function represents a module.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2525013002
Cr-Commit-Position: refs/heads/master@{#41257}
2016-11-24 10:49:03 +00:00
yangguo
21b0dbedfd Reimplement Number.prototype.toString with non-default radix.
The old algorithm produces unnecessary decimal digits. The new one
converts the significand of the input double into an uint64_t to be
just as precise as necessary.

R=tebbi@chromium.org
BUG=chromium:658712,chromium:666376

Review-Url: https://codereview.chromium.org/2520363002
Cr-Commit-Position: refs/heads/master@{#41255}
2016-11-24 10:30:46 +00:00
neis
b481afd893 [parser] Fix scopes in rewriting of for-of and destructuring assignments.
The catch scopes were created with the wrong parent scope.

R=littledan@chromium.org
BUG=v8:5648

Committed: https://crrev.com/f385268d11d6da9508e481202b39f75f4b56afdd
Review-Url: https://codereview.chromium.org/2520883002
Cr-Original-Commit-Position: refs/heads/master@{#41222}
Cr-Commit-Position: refs/heads/master@{#41253}
2016-11-24 09:48:21 +00:00
hablich
474bbec73d Revert of [stubs] KeyedStoreGeneric: inline dictionary property stores (patchset #2 id:10002 of https://codereview.chromium.org/2524943002/ )
Reason for revert:
Blocks current roll:
https://codereview.chromium.org/2526753003/

Bisect results:
https://codereview.chromium.org/2531483002

Original issue's description:
> Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
>
> For dictionary-mode receivers, the KeyedStoreGeneric stub can store
> properties directly in most cases. Doing so avoids the need to have
> an entry in the stub cache for every map/property combination.
>
> Original review: https://codereview.chromium.org/2504403005/
>
> Committed: https://crrev.com/7a963deb85a0cc04623947a759534c48e2871901
> Cr-Commit-Position: refs/heads/master@{#41218}

TBR=ishell@chromium.org,machenbach@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2522393002
Cr-Commit-Position: refs/heads/master@{#41251}
2016-11-24 08:43:22 +00:00
hablich
e461facff2 Revert of [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric (patchset #1 id:1 of https://codereview.chromium.org/2525913002/ )
Reason for revert:
Needed to revert 2661b3e8a5

Original issue's description:
> [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric
>
> BUG=chromium:668101
>
> Committed: https://crrev.com/2661b3e8a5447773a23a219ba085454c459b654b
> Cr-Commit-Position: refs/heads/master@{#41223}

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:668101

Review-Url: https://codereview.chromium.org/2525253002
Cr-Commit-Position: refs/heads/master@{#41250}
2016-11-24 08:41:29 +00:00
bmeurer
76fd6f25a9 [turbofan] Remove inlining support for the deprecated pipeline.
The deprecated pipeline is used for asm.js only, where we forcibly
disable inlining anyways (for performance reasons), so inlining via
the AstGraphBuilder is essentially dead code by now, thus there's no
point in trying to keep that around in the code base.

Also nuke the test-run-inlining.cc file, which would require some heavy
surgery (for probably little benefit), and move the useful tests for
mjsunit tests instead.

BUG=v8:2206,v8:5657
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2527053002
Cr-Commit-Position: refs/heads/master@{#41245}
2016-11-24 07:59:59 +00:00
gdeepti
e108f90d5c [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
 - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
 - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
 - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
 - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.

 R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org

Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
Committed: https://crrev.com/3c98e339599b068f1ed630afb7601ff942424d31
Review-Url: https://codereview.chromium.org/2471883003
Cr-Original-Original-Commit-Position: refs/heads/master@{#41121}
Cr-Original-Commit-Position: refs/heads/master@{#41198}
Cr-Commit-Position: refs/heads/master@{#41234}
2016-11-23 20:44:29 +00:00
machenbach
7edbd535a9 Revert of [parser] Fix scopes in rewriting of for-of and destructuring assignments. (patchset #6 id:100001 of https://codereview.chromium.org/2520883002/ )
Reason for revert:
Speculative revert: Seems to break jsfunfuzz:
https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/14385

Original issue's description:
> [parser] Fix scopes in rewriting of for-of and destructuring assignments.
>
> The catch scopes were created with the wrong parent scope.
>
> R=littledan@chromium.org
> BUG=v8:5648
>
> Committed: https://crrev.com/f385268d11d6da9508e481202b39f75f4b56afdd
> Cr-Commit-Position: refs/heads/master@{#41222}

TBR=littledan@chromium.org,verwaest@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5648

Review-Url: https://codereview.chromium.org/2519333005
Cr-Commit-Position: refs/heads/master@{#41228}
2016-11-23 15:23:17 +00:00
jkummerow
2661b3e8a5 [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric
BUG=chromium:668101

Review-Url: https://codereview.chromium.org/2525913002
Cr-Commit-Position: refs/heads/master@{#41223}
2016-11-23 13:27:22 +00:00
neis
f385268d11 [parser] Fix scopes in rewriting of for-of and destructuring assignments.
The catch scopes were created with the wrong parent scope.

R=littledan@chromium.org
BUG=v8:5648

Review-Url: https://codereview.chromium.org/2520883002
Cr-Commit-Position: refs/heads/master@{#41222}
2016-11-23 13:25:35 +00:00
jkummerow
7a963deb85 Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2524943002
Cr-Commit-Position: refs/heads/master@{#41218}
2016-11-23 12:43:48 +00:00
hablich
de330e13da Revert of [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects. (patchset #13 id:240001 of https://codereview.chromium.org/2471883003/ )
Reason for revert:
Test crashes after an unrelated revert: https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/7189

Reverting because of recommendation from WASM team.

Original issue's description:
> [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
>
> Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
>  - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
>  - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
>  - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
>  - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.
>
>  R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org
>
> Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
> Committed: https://crrev.com/3c98e339599b068f1ed630afb7601ff942424d31
> Cr-Original-Commit-Position: refs/heads/master@{#41121}
> Cr-Commit-Position: refs/heads/master@{#41198}

TBR=bradnelson@chromium.org,mtrofin@chromium.org,titzer@chromium.org,gdeepti@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2529573002
Cr-Commit-Position: refs/heads/master@{#41208}
2016-11-23 09:08:43 +00:00
jgruber
0dcc7a0e20 [debug] Add Eval scope type to inspector protocol
BUG=v8:5530,chromium:667218

Review-Url: https://codereview.chromium.org/2519773003
Cr-Commit-Position: refs/heads/master@{#41205}
2016-11-23 07:30:23 +00:00
gdeepti
3c98e33959 [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
 - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
 - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
 - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
 - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.

 R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org

Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
Review-Url: https://codereview.chromium.org/2471883003
Cr-Original-Commit-Position: refs/heads/master@{#41121}
Cr-Commit-Position: refs/heads/master@{#41198}
2016-11-23 03:09:35 +00:00
mtrofin
7a1ad0c581 [turbofan] Regalloc validator: support same block pending assessment
Previous fuzzer fix broke the case when the pending assessment came from the same
block. In that case, the assessments table does not have an entry yet for the block,
because we register only when we're done processing a block.

BUG=667745

Review-Url: https://codereview.chromium.org/2519973004
Cr-Commit-Position: refs/heads/master@{#41193}
2016-11-22 17:31:06 +00:00
marja
0f87349505 Update tests which are now failing with FLAG_lazy_inner_functions.
The tests were relying on early errors which we don't produce since we
now preparse more often.

BUG=v8:2728, v8:5501, v8:5663

Review-Url: https://codereview.chromium.org/2523683002
Cr-Commit-Position: refs/heads/master@{#41189}
2016-11-22 15:46:17 +00:00
jgruber
9eec1c8617 [debug-wrapper] Migrate wasm/frame-inspection test
Wasm frames are special in that they have a non-integer script id
in inspector. The way we treat script ids currently is a bit of a mess -
our runtime functions expected integer IDs while inspector has string
IDs (which contain integers, except for Wasm frames). This will need to
be cleaned up once more Wasm tests are added.

The meaning of line/column numbers has also changed; the old JS debug
API encoded the function index and byte offset into line/column numbers,
while inspector-based API actually translates into lines/columns in the
disassembly.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2515133003
Cr-Commit-Position: refs/heads/master@{#41182}
2016-11-22 13:59:05 +00:00
jgruber
cda1a60ab3 [debug-wrapper] Migrate suspended generator scope test
Unfortunately, there's currently no satisfying way of accessing scopes
of suspended generator objects through inspector. This CL implements
access to such scopes through runtime functions instead.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2513343004
Cr-Commit-Position: refs/heads/master@{#41179}
2016-11-22 13:32:13 +00:00
verwaest
30d2fb6b50 [runtime] Always normalize prototype maps that aren't marked as 'should be fast' yet
This makes the test in the bug ~10x faster. It could inadvertently make other things slower, so revert eagerly if included in a range where performance tanks.

BUG=chromium:666852

Review-Url: https://codereview.chromium.org/2525573002
Cr-Commit-Position: refs/heads/master@{#41178}
2016-11-22 13:25:17 +00:00
jgruber
a0e9160066 [debug-wrapper] Implement StepFrame through runtime
StepFrame is a combination of StepIn/StepOut, e.g. it breaks to the next
frame change. This is not part of the public API, but we want to keep it
for internal tests.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2514303003
Cr-Commit-Position: refs/heads/master@{#41177}
2016-11-22 13:14:53 +00:00
jgruber
facd6b9a4a [debug-wrapper] Migrate more tests
* Fix setting script-scope variables through inspector by internalizing
  their names.
* Reconstruct values of Number, String, and Boolean classes.
* Adapt a couple of tests for API restrictions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2512963002
Cr-Commit-Position: refs/heads/master@{#41175}
2016-11-22 12:44:18 +00:00
titzer
5a1fbe24ba [d8] Do not try to verify zero-ness of failed virtual memory allocation.
BUG=chromium:667603
R=clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2519363002
Cr-Commit-Position: refs/heads/master@{#41174}
2016-11-22 12:36:37 +00:00
jarin
d7aae405c7 [turbofan] Fix representation changes for unsigned values used as checked-signed values.
BUG=chromium:664117

Review-Url: https://codereview.chromium.org/2522883002
Cr-Commit-Position: refs/heads/master@{#41173}
2016-11-22 12:07:45 +00:00
mstarzinger
ffe2fbf876 [test] Run module tests on the deopt fuzzer.
R=neis@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2523693002
Cr-Commit-Position: refs/heads/master@{#41171}
2016-11-22 11:36:16 +00:00
mstarzinger
a90671f1b9 [interpreter] Fix stack unwinding of deoptimized frames.
This fixes stack unwinding to always recompute the stack pointer for
interpreted frames. For frames materialized by the deoptimizer we elide
the handler frame in between, hence arguments being pushed on the stack
will no longer be pushed into the handler frame but into the interpreted
frame directly.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-662830
BUG=chromium:662830

Review-Url: https://codereview.chromium.org/2517203003
Cr-Commit-Position: refs/heads/master@{#41170}
2016-11-22 11:28:45 +00:00
bmeurer
84c9360b82 [turbofan] Fix broken effect chain for instanceof.
BUG=chromium:667689
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2518313002
Cr-Commit-Position: refs/heads/master@{#41169}
2016-11-22 11:05:35 +00:00
mtrofin
71144e5aa6 [turbofan] Use correct block when tracing pending assessments in regalloc verifier
The verifier needs to use the block and assessments in that block corresponding to
a predecessor of a "pending" assessment. Not doing that causes incorrect
assessments when 2 locations are swapped.

BUG=665402

Review-Url: https://codereview.chromium.org/2515803002
Cr-Commit-Position: refs/heads/master@{#41159}
2016-11-21 22:21:14 +00:00
eholk
d0fe942d23 [wasm] Throw a RangeError if Wasm memory could not be allocated.
This fixes a bug found by the fuzzer where we would attempt to
dereference a null handle if memory allocation failed. In this case,
the failure was because the amount of memory requested was above V8's
hardcoded limit.

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=666741

Review-Url: https://codereview.chromium.org/2514983002
Cr-Commit-Position: refs/heads/master@{#41158}
2016-11-21 21:58:53 +00:00
yangguo
a78a97eb0a [debug-wrapper] migrate debug-backtrace from DCP.
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2516343003
Cr-Commit-Position: refs/heads/master@{#41149}
2016-11-21 15:19:12 +00:00
mstarzinger
2e5a90fd02 [test] Run module tests in all variants.
By now the compilation pipeline is flexible enough to run module tests
against all variants, we should no longer choose unsupported compilers
for modules. It also fixes the predicate checking for functions being
"resumable" in the {AstNumberingVisitor} heuristic.

R=neis@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2517143002
Cr-Commit-Position: refs/heads/master@{#41144}
2016-11-21 14:18:28 +00:00
ishell
8ca50a8862 [ic] Ensure prototype validity cell guards global object's prototype changes for LoadGlobalIC.
BUG=chromium:666742, v8:5561

Review-Url: https://codereview.chromium.org/2512183002
Cr-Commit-Position: refs/heads/master@{#41136}
2016-11-21 12:46:44 +00:00
ishell
4513532f63 [ic] Don't check full prototype chain if name is a private symbol.
BUG=chromium:664974, chromium:664802, v8:5561

Review-Url: https://codereview.chromium.org/2513893003
Cr-Commit-Position: refs/heads/master@{#41133}
2016-11-21 11:21:43 +00:00
jgruber
1834ab7246 [debug-wrapper] Adapt tests, breakpoint.actual_location
Adapted various tests to restrictions of inspector protocol:

* osr-typing-debug-change: Don't set function variable value.
* debug-evaluate-locals: Add variable introduced by eval, run typeof
  inside evaluate().
* regress-419663: Don't set duplicate breakpoints.
* regress-crbug-465298: Compare against function name instead of value.
* regress-crbug-621361: Make evaluate return string results.
* debug-script: Various counts were off due to new way tests are called.
                Added new inspector script type.

Breakpoints now contain the actual break position, and remote object
reconstruction has been extended a bit.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2505363002
Cr-Commit-Position: refs/heads/master@{#41129}
2016-11-21 09:29:17 +00:00
machenbach
682f6500ee Revert of [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects. (patchset #10 id:180001 of https://codereview.chromium.org/2471883003/ )
Reason for revert:
Breaks gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/7114

Original issue's description:
> [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
>
> Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
>  - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
>  - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
>  - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
>  - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.
>
>  R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org
>
> Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
> Cr-Commit-Position: refs/heads/master@{#41121}

TBR=bradnelson@chromium.org,mtrofin@chromium.org,titzer@chromium.org,gdeepti@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2512323004
Cr-Commit-Position: refs/heads/master@{#41122}
2016-11-19 13:39:49 +00:00
gdeepti
30ef8e33f3 [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
 - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
 - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
 - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
 - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.

 R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2471883003
Cr-Commit-Position: refs/heads/master@{#41121}
2016-11-19 03:31:35 +00:00
littledan
06f8e87726 Fix function name inference corruption for async functions
The code which pushes and pops to the function name inference stack
generally checks if the stack is active with the IsOpen method. One
piece of code pertaining to async functions was missing that check.
This patch adds it.

BUG=chromium:658267
R=gsathya,caitp

Review-Url: https://codereview.chromium.org/2514893002
Cr-Commit-Position: refs/heads/master@{#41120}
2016-11-18 18:31:54 +00:00
caitp
e84f0adba9 [builtins] add context input to users of CreateKeyValueArray opcode
BUG=666622, v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2515683002
Cr-Commit-Position: refs/heads/master@{#41118}
2016-11-18 18:17:27 +00:00
marja
4a5b7e32c4 Remove FLAG_min_preparse_length.
It originates from the era where we used to run a separate preparse step
before parsing and store the function data. Now the usage of preparser
is something completely different, so this flag doesn't make sense any
more.

In addition, this way we get more test coverage for preparser (for small
scripts).

BUG=

Review-Url: https://codereview.chromium.org/2513563002
Cr-Commit-Position: refs/heads/master@{#41110}
2016-11-18 14:06:49 +00:00
verwaest
0c70f3729e [crankshaft] Don't inline the fast path for instanceof if the function has a non-instance .prototype
BUG=chromium:666308

Review-Url: https://codereview.chromium.org/2516603002
Cr-Commit-Position: refs/heads/master@{#41105}
2016-11-18 12:57:37 +00:00
franzih
f7795cbf6e [interpreter] Bytecode for StaDataPropertyInLiteral.
Add bytecode for defining data properties, which initially just calls the runtime function.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2510743002
Cr-Commit-Position: refs/heads/master@{#41101}
2016-11-18 12:13:47 +00:00
bmeurer
241c024c10 [turbofan] Properly optimize instanceof (even in the presence of @@hasInstance).
This is the TurboFan counterpart of http://crrev.com/2504263004, but it
is a bit more involved, since in TurboFan we always inline the appropriate
call to the @@hasInstance handler, and by that we can optimize a lot more
patterns of instanceof than Crankshaft, and even yield fast instanceof
for custom @@hasInstance handlers (which we can now properly inline as
well).

Also we now properly optimize Function.prototype[@@hasInstance], even if
the right hand side of an instanceof doesn't have the Function.prototype
as its direct prototype.

For the baseline case, we still rely on the global protector cell, but
we can address that in a follow-up as well, and make it more robust in
general.

TEST=mjsunit/compiler/instanceof
BUG=v8:5640
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511223003
Cr-Commit-Position: refs/heads/master@{#41092}
2016-11-18 06:31:42 +00:00
yangguo
5beb5ee7e6 [regexp] implement latest spec draft for property class.
See https://github.com/mathiasbynens/es-regexp-unicode-property-escapes

Changes:
- only allow General Category, binary properties, Script, and Script_Extensions.
- implement Script_Extensions.

R=littledan@chromium.org
BUG=v8:4743

Review-Url: https://codereview.chromium.org/2502933002
Cr-Commit-Position: refs/heads/master@{#41091}
2016-11-18 06:10:14 +00:00
eholk
eaed31c5f5 [wasm] Add guard regions to end of WebAssembly.Memory buffers
With this change, WebAssembly.Memory objects have backing stores allocated as an
8GB region where everything beyond the size of the Wasm heap is inaccessible.

GrowMemory is now implemented by changing the protection on the guard regions to
make the new portions of the heap accessible.

Guard pages are not enabled by default, but this change adds a flag and a test
variant to make sure we get test coverage on them.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2396433008
Cr-Commit-Position: refs/heads/master@{#41089}
2016-11-17 20:29:13 +00:00
vegorov
29745ee927 [regexp] Fix matching of regexps that are both sticky and anchored at end.
V8 was applying incorrect optimization to them advancing the start position.

This would cause /foo$/y too match "barfoo", which it should not.

BUG=

Review-Url: https://codereview.chromium.org/2510743003
Cr-Commit-Position: refs/heads/master@{#41077}
2016-11-17 13:59:00 +00:00
rossberg
e2563e947f Test that table object indexing does not interfere with backing table
BUG=
R=ahaas@chromium.or

Review-Url: https://codereview.chromium.org/2502383003
Cr-Commit-Position: refs/heads/master@{#41074}
2016-11-17 12:55:45 +00:00
ishell
937b8cb684 [ic] Support data handlers in LoadGlobalIC.
Also fixed handling of load non-existent handlers outside typeof.

BUG=v8:5561, chromium:662854

Review-Url: https://codereview.chromium.org/2511603002
Cr-Commit-Position: refs/heads/master@{#41073}
2016-11-17 12:18:40 +00:00
jgruber
2c8a4155aa [debug-wrapper] clearAllBreakPoints and several scripts functions
This adds clearAllBreakPoints functionality (which requires tracking set
breakpoints internally), and several script-related functions that rely
on runtime functions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2508853003
Cr-Commit-Position: refs/heads/master@{#41064}
2016-11-17 09:34:18 +00:00
jgruber
4fb4f3408c [debug-wrapper] LiveEdit, frame.restart(), breakpoints
This adds access to the LiveEdit API object, frame.restart(), and
various breakpoint setters. The LiveEdit API still depends on the JS
debugging context and blocks its removal; but it should be removed
once LiveEdit is rewritten in the midterm.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2503293002
Cr-Commit-Position: refs/heads/master@{#41062}
2016-11-17 08:43:59 +00:00
ishell
f718cd1309 [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
BUG=chromium:665886

Review-Url: https://codereview.chromium.org/2502393002
Cr-Commit-Position: refs/heads/master@{#41045}
2016-11-16 17:45:33 +00:00
marja
a19b9c8538 Preparsing inner functions: add regression tests for parameters.
Now that we consistently preparse the parameters of a preparsed
function, these no longer crash.

BUG=5501

Review-Url: https://codereview.chromium.org/2502333002
Cr-Commit-Position: refs/heads/master@{#41038}
2016-11-16 14:50:44 +00:00
rmcilroy
94e8417bb4 [Turbofan] Fix missing break on AstGraphBuilder VisitCall.
Fixes a bug in ast-graph-builder added in r40965

BUG=chromium:665680

Review-Url: https://codereview.chromium.org/2509643002
Cr-Commit-Position: refs/heads/master@{#41034}
2016-11-16 13:46:42 +00:00
mstarzinger
31a8ec7762 [turbofan] Fix bogus representation for {kCheckTaggedHole}.
The operator in question is guaranteed to produce a tagged value that is
not equal to the-hole, it however does not guarantee the value to be a
HeapObject. The correct representation hence is {kTagged}.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-665587
BUG=chromium:665587

Review-Url: https://codereview.chromium.org/2504183002
Cr-Commit-Position: refs/heads/master@{#41032}
2016-11-16 12:53:47 +00:00
ishell
446d6a0678 [turbofan] Always install code dependency when optimizing a store to global property.
The reason is that non-configurability still allows a writable property to become read-only.

BUG=chromium:663750

Review-Url: https://codereview.chromium.org/2508873002
Cr-Commit-Position: refs/heads/master@{#41029}
2016-11-16 12:03:01 +00:00
franzih
0188c3fba3 [test] Add tests for definitions in object literal.
Properties can be defined inside the object literal (ES6) or after
object creation. The behavior differes if there are accessors, interceptors
or proxies in the Object prototype chain.

These test cases assure we preserve correct behavior as we
improve performance of definitions in literals.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2501553002
Cr-Commit-Position: refs/heads/master@{#41024}
2016-11-16 11:00:36 +00:00
clemensh
c2db3b3898 [wasm] Fix imports with numbers as name
Object::GetProperty fails if the given name is a valid array index.
This CL switches to Object::GetPropertyOrElement for lookups of imports.
The new tests check that we now accept numbers as module name or
function name in FFI.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2503313002
Cr-Commit-Position: refs/heads/master@{#41022}
2016-11-16 10:37:10 +00:00
bmeurer
36e3af325a [turbofan] Don't check for neutered array buffers eagerly.
We don't need to check for neutered array buffers unless at least one
JSArrayBuffer has been neutered (i.e. detached in TC39 speak). For this
we introduce a protector cell that get's invalidated on first call to
the JSArrayBuffer::Neuter() method.

R=jarin@chromium.org,ulan@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2504163002
Cr-Commit-Position: refs/heads/master@{#41021}
2016-11-16 10:36:08 +00:00
jgruber
b06c4ce5a6 [debug-wrapper] Further extend the debug wrapper
This CL further extends the debug wrapper, migrates around 60 tests, and
removes a few tests that use functionality we will not support anymore.

In more detail:

* Removed tests that use:
  * enable/disable individual breakpoints
  * invocationText()
  * the ScriptCollected event
  * showBreakPoints
  * evalFromScript (and similar)
  * mirror.constructedBy and mirror.referencedBy
  * event_data.promise()
* Some frame.evaluate uses were adapted since due to differences between
  remote objects (inspector) and mirrors. For instance, exceptions are
  currently not recreated exactly, since the inspector protocol does not
  give us the stack and message separately. Other objects (such as
  'this' in debug-evaluate-receiver-before-super) need to be explicitly
  converted to a string before the test works correctly.
* Ensure that inspector stores the script before sending ScriptParsed and
  ScriptFailedToParse events in order to be able to use the script from
  within those events.
* Better remote object reconstruction (e.g. for undefined and arrays).
* New functionality in wrapper:
  * debuggerFlags().breakPointsActive.setValue()
  * scripts()
  * execState.setVariableValue()
  * execState.scopeObject().value()
  * execState.scopeObject().property()
  * execState.frame().allScopes()
  * eventData.exception()
  * eventData.script()
  * setBreakPointsActive()

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2497973002
Cr-Commit-Position: refs/heads/master@{#41019}
2016-11-16 08:34:44 +00:00
titzer
6e643f045c [wasm] Be more lenient on the names section.
R=clemensh@chromium.org,dschuff@chromium.org
BUG=v8:5632
LOG=Y

Review-Url: https://codereview.chromium.org/2501873003
Cr-Commit-Position: refs/heads/master@{#41011}
2016-11-15 20:55:55 +00:00
clemensh
32077e01fb [wasm] Allocate a single script per wasm module
Before, we allocated one script per function per instance, and each
script referenced the wasm instance and the function index. Now we only
allocate one script per compiled wasm module, so the script also only
references this WasmCompiledModule, which causes changes to many interfaces.

Instead of fixing the disassemble API only used via debug.js, I decided
to drop it for now. Some later CL will reintroduce it via
DebugInterface.

BUG=v8:5530,chromium:659715
R=yangguo@chromium.org, titzer@chromium.org
CC=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2493823003
Cr-Commit-Position: refs/heads/master@{#41004}
2016-11-15 17:05:39 +00:00
jgruber
e29fcbee9c [regexp] Move RegExp.prototype[@@search] to TF
Implements upcoming changes to @@search according to
https://github.com/tc39/ecma262/pull/627.

This also adds SameValue to CodeStubAssembler and extracts a part of
CSA::TruncateTaggedToFloat64.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2438683005
Cr-Commit-Position: refs/heads/master@{#41000}
2016-11-15 16:06:20 +00:00
petermarshall
a63eeb485a Fastpath some spread-call desugaring.
Avoid using the iterator for arrays with fast elements where the iterator has
not been modified.

Only deals with the case where there is a single spread argument.

Improves the six-speed "spread" benchmark to 1.5x slower than baseline es5 implementation, compared to 19x slower previously.

BUG=v8:5511

Review-Url: https://codereview.chromium.org/2465253011
Cr-Commit-Position: refs/heads/master@{#40998}
2016-11-15 14:42:00 +00:00
jarin
7ae7e84340 Reland of [turbofan] Fix deoptimization of boolean bit constants. (patchset #1 id:1 of https://codereview.chromium.org/2495243002)
This reverts commit 1c9528c4c4.

BUG=chromium:664490

Review-Url: https://codereview.chromium.org/2503763003
Cr-Commit-Position: refs/heads/master@{#40994}
2016-11-15 13:55:57 +00:00
jarin
1900760e8f [turbofan] Fix deopt check for storing into constant field.
BUG=chromium:626986

Review-Url: https://codereview.chromium.org/2503863002
Cr-Commit-Position: refs/heads/master@{#40990}
2016-11-15 13:17:13 +00:00
caitp
2a350ed457 [builtins] Take fast path in Array.prototype.keys() only if length is an Smi
Do not take the fast path for Array.prototype.keys() if the array length is not
guaranteed to be an Smi.

BUG=660925, v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2496323002
Cr-Commit-Position: refs/heads/master@{#40976}
2016-11-14 18:52:25 +00:00
caitp
372d905d73 [tests] skip es6/array-iterator-turbo on deopt_fuzzer
BUG=v8:5388
R=bmeurer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2496063003
Cr-Commit-Position: refs/heads/master@{#40974}
2016-11-14 17:16:59 +00:00
caitp
7f21e67b38 [builtins] implement JSBuiltinReducer for ArrayIteratorNext()
Adds a protector cell to prevent inlining (which will likely lead to deopt
loops) when a JSArrayIterator's array transitions from a fast JSArray to a
slow JSArray (such as, when the array is touched during iteration in a way
which triggers a map transition).

Also adds TODO comments relating to the spec update proposed by Dan at
https://github.com/tc39/ecma262/pull/724

BUG=v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org
TBR=hpayer@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/2484003002
Cr-Commit-Position: refs/heads/master@{#40970}
2016-11-14 15:59:47 +00:00
jgruber
1c1edda7db Skip flaky debug-scopes test
BUG=v8:5619,chromium:664490

Review-Url: https://codereview.chromium.org/2503463002
Cr-Commit-Position: refs/heads/master@{#40968}
2016-11-14 15:02:30 +00:00
neis
4e32419be4 [debug] Extend a test and fix some typos.
R=jgruber@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2493533003
Cr-Commit-Position: refs/heads/master@{#40966}
2016-11-14 14:06:05 +00:00
mstarzinger
79aee39f24 [builtins] Fix pointer comparison in ToString builtin.
This fixes the bogus {Word32Equal} comparison in the ToString builtin
implementing Object.prototype.toString to be a pointer-size {WordEqual}
comparison instead. Comparing just the lower half-word is insufficient
on 64-bit architectures.

R=jgruber@chromium.org
TEST=mjsunit/regress/regress-crbug-664506
BUG=chromium:664506

Review-Url: https://codereview.chromium.org/2496043003
Cr-Commit-Position: refs/heads/master@{#40963}
2016-11-14 12:44:29 +00:00
jarin
1c9528c4c4 Revert of [turbofan] Fix deoptimization of boolean bit constants. (patchset #1 id:1 of https://codereview.chromium.org/2495243002/ )
Reason for revert:
Seems to break GC stress.

Original issue's description:
> [turbofan] Fix deoptimization of boolean bit constants.
>
> BUG=chromium:664490

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:664490

Review-Url: https://codereview.chromium.org/2502613002
Cr-Commit-Position: refs/heads/master@{#40961}
2016-11-14 12:11:00 +00:00
bmeurer
5667280310 [turbofan] Properly allocate constant-folded string.
When constant-folding S[K], make sure to return a String, and not the
character code as Number.

BUG=chromium:664942
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2503433002
Cr-Commit-Position: refs/heads/master@{#40960}
2016-11-14 11:58:09 +00:00
jarin
297a969aad [turbofan] Fix deoptimization of boolean bit constants.
BUG=chromium:664490

Review-Url: https://codereview.chromium.org/2495243002
Cr-Commit-Position: refs/heads/master@{#40951}
2016-11-14 09:30:19 +00:00
verwaest
942604dfb2 Add test for making private symbols non-enumerable
BUG=chromium:664411

Review-Url: https://codereview.chromium.org/2498963002
Cr-Commit-Position: refs/heads/master@{#40950}
2016-11-14 09:17:07 +00:00
verwaest
135b9f9360 Make private symbols non-enumerable
Methods in the runtime that enumerate over properties should never deal with private symbols. Most commonly such methods only loop over enumerable properties. This fix avoids accidentally handling private symbols in methods that only deal with enumerable properties. Methods that need to look at non-enumerable properties as well still have to manually filter private symbols (e.g., the KeyAccumulator).

BUG=chromium:664411

Review-Url: https://codereview.chromium.org/2499593002
Cr-Commit-Position: refs/heads/master@{#40932}
2016-11-11 15:05:29 +00:00
leszeks
f6701a8cbd Reland: [compiler] Fix flipped boolean checks in marked tier-up
Fixes incorrect checks for handle validity when checking the compiled
code, as well as incorrect uses of tst in arm and ppc flag checking
code. Also adds a test that the tier-up works correctly.

Reland of https://codereview.chromium.org/2448933002

BUG=v8:5512

Review-Url: https://codereview.chromium.org/2497573003
Cr-Commit-Position: refs/heads/master@{#40930}
2016-11-11 14:17:00 +00:00
jkummerow
567904f1a7 [ic] Fix elements conversion in KeyedStoreGeneric
A SmiUntag() was missing when loading the old backing store's length.

BUG=chromium:664469

Review-Url: https://codereview.chromium.org/2492783004
Cr-Commit-Position: refs/heads/master@{#40921}
2016-11-11 13:02:10 +00:00
bmeurer
bad42b387f Revert of [compiler] Fix flipped boolean checks in marked tier-up (patchset #7 id:120001 of https://codereview.chromium.org/2478323002/ )
Reason for revert:
Breaks deopt fuzzer:
https://build.chromium.org/p/client.v8/builders/V8%20Deopt%20Fuzzer/builds/14872/steps/Deopt%20Fuzz%20on%20Ubuntu-12.04/logs/stdio

Original issue's description:
> [compiler] Fix flipped boolean checks in marked tier-up
>
> Fixes incorrect checks for handle validity when checking the compiled
> code, as well as incorrect uses of tst in arm and ppc flag checking
> code. Also adds a test that the tier-up works correctly.

TBR=rmcilroy@chromium.org,leszeks@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2492523007
Cr-Commit-Position: refs/heads/master@{#40919}
2016-11-11 12:40:17 +00:00
jgruber
b32ee40de8 [debug-wrapper] Conditional breaks, locals, evaluate, scopes
This CL adds support for:
* conditional breaks in setBreakpoint,
* locals in frame.local{Count,Name,Value},
* evaluation on a frame in frame.evaluate,
* and more detailed scope information in scopeObject.

Uses of several functions that are not covered by the
inspector protocol and are only used in tests have been removed.

Local handling has been modified to also include arguments as locals.
Inspector differs in this regard from our FrameDetails in that
arguments are always shown as locals. Argument-related functions
were removed.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2491543002
Cr-Commit-Position: refs/heads/master@{#40917}
2016-11-11 12:08:34 +00:00
leszeks
712a46cc3f [compiler] Fix flipped boolean checks in marked tier-up
Fixes incorrect checks for handle validity when checking the compiled
code, as well as incorrect uses of tst in arm and ppc flag checking
code. Also adds a test that the tier-up works correctly.

Review-Url: https://codereview.chromium.org/2478323002
Cr-Commit-Position: refs/heads/master@{#40915}
2016-11-11 11:57:54 +00:00
rmcilroy
f50f19eb19 [Interpreter] Fix logical-or/and to ensure it always visits the lhs.
BUG=chromium:664146

Review-Url: https://codereview.chromium.org/2495543002
Cr-Commit-Position: refs/heads/master@{#40904}
2016-11-10 16:31:00 +00:00
ishell
45b9f15f44 [runtime] Treat empty property cells properly when doing Object.freeze() on a global object.
BUG=chromium:663750, chromium:664123

Review-Url: https://codereview.chromium.org/2495563002
Cr-Commit-Position: refs/heads/master@{#40902}
2016-11-10 16:01:15 +00:00
ahaas
665a5d17ac [wasm] Imported WebAssembly function are never wrapped.
According to the spec, import wrappers are only generated for JavaScript
functions, not for WebAssembly function. If an imported WebAssembly
function does not have the expected type, then a type error is thrown.

R=titzer@chromium.org, rossberg@chromium.org
TEST=mjsunit/wasm/test-import-export-wrapper

Review-Url: https://codereview.chromium.org/2486943005
Cr-Commit-Position: refs/heads/master@{#40901}
2016-11-10 15:05:52 +00:00
jarin
c71e5e1294 [crankshaft] Always force number representation for increment.
BUG=chromium:664087

Review-Url: https://codereview.chromium.org/2491333002
Cr-Commit-Position: refs/heads/master@{#40900}
2016-11-10 14:51:18 +00:00
mstarzinger
25d2268ecc [crankshaft] Fix constant folding of HDiv instruction.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-662367
BUG=chromium:662367

Review-Url: https://codereview.chromium.org/2486923004
Cr-Commit-Position: refs/heads/master@{#40897}
2016-11-10 14:27:52 +00:00
jkummerow
cc2a2771a6 [stubs] Fix CodeStubAssembler::TrapAllocationMemento
to actually trap allocation mementos.

Review-Url: https://codereview.chromium.org/2487943005
Cr-Commit-Position: refs/heads/master@{#40895}
2016-11-10 13:47:41 +00:00
bmeurer
6d533403f9 [crankshaft] Not all HAdd instructions produce a number.
BUG=chromium:664084
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2494703002
Cr-Commit-Position: refs/heads/master@{#40894}
2016-11-10 13:11:28 +00:00
jkummerow
eca64a2a8c [ic] Drop TimerEventScopes from *IC_Miss runtime functions
This is mostly a performance experiment. If it provides no speedup,
it can be reverted to keep IC miss events in timeline plots.
Otherwise, the RuntimeCallStats system is the replacement tool for
investigating performance issues related to IC misses.

This effectively reverts 1f8adc15 / r21736.

Review-Url: https://codereview.chromium.org/2480343002
Cr-Commit-Position: refs/heads/master@{#40893}
2016-11-10 13:10:25 +00:00
mstarzinger
93c6595200 [turbofan] Advance bytecode offset after lazy deopt.
This changes {FrameState} nodes modeling "after" states to use bytecode
offsets pointing to the deoptimizing bytecode. This is in sync with the
normal execution, as the bytecode offset is advanced after operations
complete in regular bytecode handlers.

The change is necessary to ensure lazy deoptimized frames contain an
accurate bytecode offset while they are on the stack. Such frames can be
inspected by various stack walks. The continuation builtin will advance
the bytecode offset upon return.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-660379
BUG=chromium:660379

Review-Url: https://codereview.chromium.org/2487173002
Cr-Commit-Position: refs/heads/master@{#40887}
2016-11-10 11:35:22 +00:00
ishell
6aa16edf36 [runtime] Ensure Object.freeze() deoptimizes code that depends on global property cells.
BUG=chromium:663750

Review-Url: https://codereview.chromium.org/2488223002
Cr-Commit-Position: refs/heads/master@{#40882}
2016-11-10 10:37:26 +00:00
jgruber
3098e24909 [debug-wrapper] Add caught/uncaught to exception pauses
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2480293009
Cr-Commit-Position: refs/heads/master@{#40877}
2016-11-10 09:05:29 +00:00
ahaas
d91bed67d6 [wasm] Only immutable imported globals are valid initializer expressions
R=titzer@chromium.org
TEST=unittests/WasmModuleVerifyTest.DataSegmentWithImmutableGlobal, unittests/WasmModuleVerifyTest.DataSegmentWithMutableImportedGlobal, unittests/WasmModuleVerifyTest.DataSegmentWithImmutableImportedGlobal

Review-Url: https://codereview.chromium.org/2493433002
Cr-Commit-Position: refs/heads/master@{#40865}
2016-11-09 15:52:36 +00:00
bmeurer
82b315ce75 [turbofan] Add support for accessing Uint8ClampedArrays.
This adds a new NumberToUint8Clamped simplified operator that does the
round ties to even + clamping necessary to store to Uint8ClampedArrays.

BUG=v8:4470,v8:5267,v8:5615
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2489563004
Cr-Commit-Position: refs/heads/master@{#40861}
2016-11-09 13:34:02 +00:00
mstarzinger
62688795ab [turbofan] Stage escape analysis optimization.
This stages escape analysis by implying --turbo-escape by the --turbo
flag. It broadens the exposure of the optimization in question.

R=jarin@chromium.org
BUG=v8:4586,v8:5267

Review-Url: https://codereview.chromium.org/1992913005
Cr-Commit-Position: refs/heads/master@{#40859}
2016-11-09 12:52:33 +00:00
ahaas
4db05d405b [wasm] Indirect calls without function table cause validation errors.
The spec defines that indirect calls in WebAssembly code should cause a
validation error if no function table exists.

The CL contains the following changes:
1) Throw a validation error for indirect calls if the function table
   not exist.
2) Do not create TF nodes to throw a runtime error for indirect calls
   if the function table does not exist.
3) Fix existing unit tests by creating a dummy function table.
4) Add new a new test which tests that indirect calls without function
   table cause a validation error.

R=rossberg@chromium.org
CC=titzer@chromium.org

TEST=unittests/AstDecoderTest.IndirectCallsWithoutTableCrash

Review-Url: https://codereview.chromium.org/2484623002
Cr-Commit-Position: refs/heads/master@{#40852}
2016-11-09 08:37:44 +00:00
littledan
5975c47a6a Avoid calling out to JS during stack overflow
If an exception is thrown when there is a Promise being created, the Promise
catch prediction code would call into a part implemented in JavaScript to see if
the Promise has a catch handler. If it is not possible to call back into JS,
e.g., due to a stack overflow, then this would lead to a crash. This patch
"speculates" that, if it's impossible to call back into JavaScript, then the
error is unhandled, avoding the issue. In a future patch, the catch prediction
logic should be entirely written in C++, but this patch adds a minimal fix to
be more friendly to backports.

BUG=chromium:662935
R=jgruber

Review-Url: https://codereview.chromium.org/2487833002
Cr-Commit-Position: refs/heads/master@{#40851}
2016-11-09 07:53:08 +00:00
bradnelson
3f2db58c89 [wasm] [asm.js] Don't allow bad return types from a global constant
We recently allowed global constants in asm.js validated code.
When used in a return statement, these need to be of an allowed type.

BUG=660813
R=jpp@chromium.org,aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2481103002
Cr-Commit-Position: refs/heads/master@{#40850}
2016-11-08 23:32:04 +00:00
jkummerow
87332fdf67 [arm] Fix custom addition in MacroAssembler::[Fast]Allocate
Don't rely on carry flags you didn't set yourself.

BUG=chromium:663402

Review-Url: https://codereview.chromium.org/2484283002
Cr-Commit-Position: refs/heads/master@{#40848}
2016-11-08 18:19:30 +00:00
rmcilroy
ba5885cc8b [Interpreter] Ensure ValueOf is only called once for post-increment operations.
BUG=chromium:662418

Review-Url: https://codereview.chromium.org/2473223004
Cr-Commit-Position: refs/heads/master@{#40846}
2016-11-08 17:03:16 +00:00
jgruber
0cb3897179 [debugger] Basic scope functionality and exception events in wrapper
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2487673002
Cr-Commit-Position: refs/heads/master@{#40840}
2016-11-08 14:54:10 +00:00
jgruber
4d6ff7dfaa [debugger] Stepping and break-related functions in wrapper
This adds clearStepping plus the family of
{set,clear}BreakOn{,Uncaught}Exception functions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2482903002
Cr-Commit-Position: refs/heads/master@{#40834}
2016-11-08 13:54:37 +00:00
titzer
68fdaf6dea [wasm] Wrap start function in a JS->WASM wrapper before calling it during initialization.
BUG=v8:5599
R=ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2483193002
Cr-Commit-Position: refs/heads/master@{#40830}
2016-11-08 12:37:09 +00:00
jarin
5d89844130 [crankshaft] FIx for in deopt at the end of the loop.
We really should deopt before the for-in index increment.

BUG=chromium:662904

Review-Url: https://codereview.chromium.org/2476423003
Cr-Commit-Position: refs/heads/master@{#40828}
2016-11-08 12:33:56 +00:00
neis
cc3195abda [modules] Disable Crankshaft for functions referencing module variables.
Also add a primitive mjsunit test that uses such a function optimized by
Turbofan.

R=mstarzinger@chromium.org
CC=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2472143002
Cr-Commit-Position: refs/heads/master@{#40826}
2016-11-08 11:45:34 +00:00
jgruber
60d60fd716 [debugger] Migrate more debugger tests to inspector
This moves all tests currently working with the inspector debugger wrapper to
test/debugger.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2480223002
Cr-Commit-Position: refs/heads/master@{#40824}
2016-11-08 10:39:08 +00:00
gdeepti
625767df91 [wasm] Linear/Exported memory maximum property should be set when maximum is defined.
- When module bytes have a memory maximum defined, compiled module object should set maximum memory
 - Exported memory objects should set maximum value on the memory objects
 - Update tests to use declared maximum values.

R=ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2474333003
Cr-Commit-Position: refs/heads/master@{#40820}
2016-11-08 09:55:27 +00:00
jarin
7f801ff35b [crankshaft] Do not optimize argument access if any parameter is context-allocated.
Note: This CL might regress code that relies on such arguments access.
In that case, we could still optimize the access if it accesses at
constant index (and the argument at that index is not context-allocated).

If any code relies on a general access to context-allocated arguments,
we would need to analyze the function for assignment to the arguments - this
might be quite tricky.

BUG=chromium:662845

Review-Url: https://codereview.chromium.org/2484723002
Cr-Commit-Position: refs/heads/master@{#40813}
2016-11-07 19:10:15 +00:00