Commit Graph

22915 Commits

Author SHA1 Message Date
Mythri A
d22884ef02 [cleanup] Add %PrepareFunctionForOptimize in mjsunit tests
Bug: v8:8801, v8:8394, v8:9183
Change-Id: Ie2858af4863511d5f67b662ac6f6f79512f55e7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662307
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62223}
2019-06-17 16:28:50 +00:00
Jaroslav Sevcik
7d4b5893e1 Handlify bytecode array accessor's constant getters.
This in in preparation for generic (off-heap/on-heap) bytecode
array accessor.

Bug: v8:7790
Change-Id: Ib419831ba1db95ab938179723ef5f130f01ae0d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635895
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62222}
2019-06-17 16:13:30 +00:00
Ben L. Titzer
d05871bf08 [test-api] Extract arraybufs and typed arrays
Extract tests related to array buffers and typed arrays to their own
.cc files.

R=mstarzinger@chromium.org

Change-Id: Ic80205d02b62db1565670ecf2bb4c0dbe52fab49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662301
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62219}
2019-06-17 15:27:01 +00:00
Jakob Gruber
c7d57dd309 [regexp] Reduce public API surface
This further reduces the number of things declared in the public
regexp API file, currently still named jsregexp.h.

* Move JSRegExp::Flags convenience functions to regexp-compiler.h.
* Set RegExpImpl methods private if possible (these will later be
  moved to a new hidden impl class).
* Merge RegExpEngine::CompilationResult into RegExpCompileData.
* Move remaining RegExpEngine methods to RegExpImpl and delete
  RegExpEngine.
* Extract RegExpGlobalCache.
* Document a few data structures.

Upcoming CLs will rename RegExpImpl to RegExp and jsregexp.h to
regexp.h. This should then be the only header included from other
directories.

Bug: v8:9359
Change-Id: I78c8f4cca495a2b95735a48b6181583bc3310bdf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662294
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62218}
2019-06-17 15:10:24 +00:00
Maciej Goszczycki
8e53e4b2e3 [cleanup][heap] Improve heap iterator naming
Rename LargeObjectIterator to LargeObjectSpaceObjectIterator.
Rename SemiSpaceIterator to SemiSpaceObjectIterator.
Rename CombinedHeapIterator to CombinedHeapObjectIterator.
Rename ReadOnlyHeapIterator to ReadOnlyHeapObjectIterator.
Rename HeapIterator to HeapObjectIterator.
Rename HeapObjectIterator to PagedSpaceObjectIterator.
Rename PagedSpaces to PagedSpaceIterator.

Bug: v8:9183
Change-Id: If4bd65d81e50bb45d207a897baaca8b723e4f10b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645914
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#62217}
2019-06-17 14:38:02 +00:00
Mythri A
9b77a149a6 [test] Add %PrepareFunctionForOptimize in mjsunit tests
Bug: v8:8801, v8:8394, v8:9183
Change-Id: Ic31f97a1b591317a004dc52c8eee777dd6353487
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662299
Commit-Queue: Mythri Alle <mythria@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62216}
2019-06-17 14:13:02 +00:00
Ross McIlroy
994db73210 [cleanup] Add missing %PrepareFunctionForOptimize in mjsunit tests
Bug: v8:8801,v8:8394,v8:9183
Change-Id: I55027b3ba0c78f40d82aaf2d160aaf957d02cab5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662292
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62214}
2019-06-17 13:14:51 +00:00
Sigurd Schneider
81fc0c462e Revert "[arm64] Refactor constant pool implementation"
This reverts commit ac79b539ec.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim/18611

Original change's description:
> [arm64] Refactor constant pool implementation
> 
> This refactors the constant pool handling for arm64. The immediate goal
> is to allow 32bit compressed pointers in the pool. The mediate goal is
> to unify the implementation with the arm constant pool, which will be
> done in a follow-up CL.
> 
> Bug: v8:8054
> Change-Id: I74db4245e5e1025f2e4de4144090fa4ce25883ab
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645316
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62209}

TBR=mstarzinger@chromium.org,sigurds@chromium.org,jgruber@chromium.org,georgia.kouveli@arm.com

Change-Id: Iff03e81a2e70d125ef2c06b6ff3aff8d0e3688ef
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8054
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662293
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62211}
2019-06-17 11:50:13 +00:00
Michael Starzinger
f066d764cc [wasm] Support {WebAssembly.Function} in tables.
This adds preliminary support for storing constructed WebAssembly
functions in tables. Note that for now only tables at index #0 are
supported, extending it to other tables indexes will be done as a
follow-up.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I9aa07813e07f0ceb4eafe37af412b45c7d235722
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1640209
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62210}
2019-06-17 11:07:19 +00:00
Sigurd Schneider
ac79b539ec [arm64] Refactor constant pool implementation
This refactors the constant pool handling for arm64. The immediate goal
is to allow 32bit compressed pointers in the pool. The mediate goal is
to unify the implementation with the arm constant pool, which will be
done in a follow-up CL.

Bug: v8:8054
Change-Id: I74db4245e5e1025f2e4de4144090fa4ce25883ab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645316
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62209}
2019-06-17 10:53:39 +00:00
Georg Schmid
9681601bb8 Reland "[csa] Tweak CSA pipeline to eliminate more redundant checks"
This is a reland of a66e3e5744

Original change's description:
> [csa] Tweak CSA pipeline to eliminate more redundant checks
>
> - Lower LoadObjectField to LoadFromObject
> - Mark LoadFromObject and StoreToObject as non-allocating
> - Use optimizable BitcastTaggedSignedToWord in TaggedIsNotSmi check
>
> R=jarin@chromium.org, tebbi@chromium.org
>
> Change-Id: I42992d46597be795aee3702018f7efd93fcc6ebf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657926
> Commit-Queue: Georg Schmid <gsps@google.com>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62173}

R=tebbi@chromium.org

Change-Id: Id7ae13ba17a2083fd4109f34ce026030716ececb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660622
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62202}
2019-06-17 09:40:29 +00:00
Jakob Gruber
c51e4f3c66 [regexp] Rewrite certain Assertion sequences
RegExp assertions (e.g.: '^', '$', '\b', ...) sequences have certain
properties that this rewriter exploits:

1. They are zero-width and order-independent, thus one can remove all
duplicate assertions.
2. If a subsequence is guaranteed to fail, the entire sequence fails.
Any sequence always known to fail (e.g. containing both '\b' and '\B')
can be rewritten to a single node that triggers failure.

This CL generalizes the previous optimization for repeated assertions
to be order-independent, i.e. assertions only have to be in the same
sequence but not next to each other.

Bug: v8:6515, v8:6126
Change-Id: I3f92f081ce8a55ad8c34c269a09a6686e3b008f3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657925
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62201}
2019-06-17 09:21:58 +00:00
Ross McIlroy
d7a8170d2d [cleanup] Add missing %PrepareFunctionForOptimize in mjsunit tests
Bug: v8:8801,v8:8394,v8:9183
Change-Id: If482c6a14f389d54c6ca3891aa7b8475f7a1fce1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660617
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62192}
2019-06-14 17:03:41 +00:00
Mythri A
8cbbc2e809 [cleanup] Add missing %PrepareFunctionForOptimize in mjsunit tests
Bug: v8:8801,v8:8394,v8:9183
Change-Id: I88c0268b30d4b927f9856db7a3b054b74baf1923
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660608
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62189}
2019-06-14 15:54:35 +00:00
Daniel Vogelheim
b9342b7b5f Allow embedder to block or modify eval arguments.
This extends the existing Isolate::SetAllowCodeGenerationFromStringsCallback
mechanism, by adding SetModifyCodeGenerationFromStringCallback, which
can also modify the eval argument (it could e.g. add escaping).

Bug: chromium:940927
Change-Id: I2b72ec2e3b77a5a33f428a0db5cef3f9f8ed6ba2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593336
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62185}
2019-06-14 14:10:28 +00:00
Thibaud Michaud
490c41993b [cleanup] Add PrepareFunctionForOptimization
R=mythria@chromium.org

Bug: v8:9183
Change-Id: I3913ce4bb69895994a0e397f0f96c83813668ea4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660480
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62183}
2019-06-14 14:03:18 +00:00
Ross McIlroy
ac7c82f905 [cleanup] Add %PrepareForOptimization to some more mjsunit tests.
Bug: v8:8801,v8:8394,v8:9183
Change-Id: If6a4f39991f222337f1c49bd0439e9669d89b030
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660486
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62181}
2019-06-14 13:55:11 +00:00
Yang Guo
64daad8e7b Revert "[csa] Tweak CSA pipeline to eliminate more redundant checks"
This reverts commit a66e3e5744.

Reason for revert: Likely to have caused UBSAN issues: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/6671

Original change's description:
> [csa] Tweak CSA pipeline to eliminate more redundant checks
> 
> - Lower LoadObjectField to LoadFromObject
> - Mark LoadFromObject and StoreToObject as non-allocating
> - Use optimizable BitcastTaggedSignedToWord in TaggedIsNotSmi check
> 
> R=​jarin@chromium.org, tebbi@chromium.org
> 
> Change-Id: I42992d46597be795aee3702018f7efd93fcc6ebf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657926
> Commit-Queue: Georg Schmid <gsps@google.com>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62173}

TBR=jarin@chromium.org,tebbi@chromium.org,gsps@google.com

Change-Id: I0a1c0515a8a61d32f77a392f1efc0751b6aae2a1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660485
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62179}
2019-06-14 12:44:23 +00:00
Ross McIlroy
ab99a74ce8 [cleanup] Add %PrepareForOptimization to some more mjsunit tests.
Bug=v8:8801,v8:8394,v8:9183

Change-Id: I5bd3505938a49dab0299f1d1d022e8a31cc806c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660479
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62178}
2019-06-14 12:37:18 +00:00
Georg Schmid
a66e3e5744 [csa] Tweak CSA pipeline to eliminate more redundant checks
- Lower LoadObjectField to LoadFromObject
- Mark LoadFromObject and StoreToObject as non-allocating
- Use optimizable BitcastTaggedSignedToWord in TaggedIsNotSmi check

R=jarin@chromium.org, tebbi@chromium.org

Change-Id: I42992d46597be795aee3702018f7efd93fcc6ebf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657926
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62173}
2019-06-14 11:38:48 +00:00
Ross McIlroy
eab992fd40 [cleanup] Add %PrepareForOptimization to some more mjsunit tests.
Bug=v8:8801,v8:8394,v8:9183

Change-Id: I9d88d2aa2b261b0f8df83dd6075b68cbc626161f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660476
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62172}
2019-06-14 11:34:28 +00:00
Simon Zünd
f16f0bccad [stack-trace] Change column number for wasm frames to module offset
The CL https://crrev.com/c/1646846 changed column numbers for Wasm
frames in Error.stack traces. Instead of using the offset relative to
the beginning of the function, the absolute offset inside the module
is displayed as hex.

This CL propagates that change to the StackTrace C++ API, so
StackFrame::GetColumn() also returns the absolute offset. Note that the
StackFrame API historically uses "0" to signal "no information", so the
line and column numbers for Wasm frames are also adjusted to 1-based,
even though they signify function index and absolute offset
into the module.

This CL does not touch Script::PositionInfo.column. That field still
contains the offset relative to the function start.

Bug: v8:8742
Change-Id: If4fd37fa681c7ebd0823ce0d95eccc1335c35272
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655300
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62171}
2019-06-14 11:33:18 +00:00
Andreas Haas
76d33a174e [cleanup] Add PrepareFunctionForOptimization to regression tests(2)
R=mythria@chromium.org

Bug: v8:9183
Change-Id: Ia534816b460eaf005a0017afeb2d55ccb3402a37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660473
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62169}
2019-06-14 10:56:48 +00:00
Andreas Haas
054af8477c [cleanup] Add PrepareFunctionForOptimization to regression tests
R=mythria@chromium.org

Bug: v8:9183
Change-Id: Id7c29452ef6d643b59eb3252df188bf288e2de23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660469
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62168}
2019-06-14 09:59:20 +00:00
Jakob Kummerow
0d8945853a [wasm-c-api] Fix signature deserialization
Func::type() was broken for functions created with Func::make().

Change-Id: I2867bcf00d9e5c1488165a804598c9ca8081ff25
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655648
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62167}
2019-06-14 09:03:47 +00:00
Sathya Gunasekaran
beb88c0ad3 [Weakrefs] Fix incorrect check about previous/next weakref
When iterating over the holdings inside the cleanup callback,
we could potentially unregister the weakref which is next or
prev on the key list causing these checks to be incorrect.

Bug: v8:9360, v8:8179
Change-Id: I53ea12346eb4882b16a82677b64ba2c756d23a1c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658161
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62165}
2019-06-14 08:46:34 +00:00
Frank Tang
96984a91ad Roll test262
https://chromium.googlesource.com/external/github.com/tc39/test262/+log/a9abd4..49eee8b

Bug: v8:7834
Change-Id: I90de157926001b8db0c7992965b9c2ee762d78ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1656055
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62161}
2019-06-14 00:56:50 +00:00
Z Nguyen-Huu
0df0c8e3bc Optimize array.reduce, array.reduceRight to sealed, frozen object
Use FastJSArrayForRead pattern.
Add test of array.reduce, array.reduceRight for non-extensible, sealed, frozen objects similar to mjsunit/array-reduce.js

~3x perf improvement in JSTests/ObjectFreeze micro-benchmark
Before:
ArrayReduce
ArrayReduce-Numbers(Score): 0.0740
ArrayReduceRight
ArrayReduceRight-Numbers(Score): 0.0767

After:
ArrayReduce
ArrayReduce-Numbers(Score): 0.249
ArrayReduceRight
ArrayReduceRight-Numbers(Score): 0.261


Bug: v8:6831
Change-Id: I98f54f010256993fcd05bb24be968fb2d0f5c966
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1656851
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62158}
2019-06-13 19:23:50 +00:00
Z Nguyen-Huu
7bb31d9f8a add micro-benchmark of array.reduce, array.reduceRight for frozen object
Bug: v8:6831
Change-Id: I61d4080e11e354fb47d5c79c3c26076488f3fe13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1656852
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62156}
2019-06-13 18:36:55 +00:00
Dan Elphick
0cb3f5f5b8 Fix test for lazy source positions
Disable bytecode flushing for test as it messes up lazy source
positions and the flags aren't representative anyway.

Bug: v8:8510
Change-Id: I6d5bc8dcd174a9bfc48f682518e6c62d79acb691
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658152
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62155}
2019-06-13 16:45:18 +00:00
Jakob Gruber
d61a558a23 Reland "[regexp] Move AST-to-Node code to a dedicated file"
This is a reland of 811bfbbc56

Original change's description:
> [regexp] Move AST-to-Node code to a dedicated file
>
> Prior to this CL, jsregexp contains a bunch of things that are slightly
> related but would be cleaner in separate files, including: AST-to-Node
> transformations, the compiler implementation, and a debugging printer.
>
> This CL extracts AST-to-Node transformations.
>
> Bug: v8:9359
> Change-Id: I030cfca5c40cfd72e3a7abe2188e4654cfe2277c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655303
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62148}

Tbr: yangguo@chromium.org
Bug: v8:9359
Change-Id: I68a16086dc56c9a059547033ca8bc1e9de1080db
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658568
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62154}
2019-06-13 16:39:56 +00:00
Seth Brenith
a1462d9f07 [torque] Get rid of @noVerifier annotation on PromiseReactionJobTask
Include API-instantiated functions in the definition of Callable so
that PromiseReactionJobTask::handler can verify correctly. Also make
Callable verification stricter regarding JSProxy instances: they must
have the callable bit set.

Also update test-weak-references to use a different object type, since
FeedbackVector::optimized_code_weak_or_smi should never point to a
FixedArray.

Bug: v8:9311
Change-Id: I4242df993e381a75f5b53302fee8fd2b12e96d34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1650563
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62153}
2019-06-13 16:24:10 +00:00
Mythri A
ccb7ff7524 [ic] Turn megamorphic when storing into an array with readonly length
The store element handlers don't check if the array length is writable
before updating the length. Since this is not expected to be a common
case no need of handling this in the element handlers. Just moving to
megamorphic would be sufficient.

Bug: chromium:967104
Change-Id: I7a7f9ea768266b9ffd6289328d61d2297d455619
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658154
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62152}
2019-06-13 15:53:39 +00:00
Leszek Swirski
ee279dc223 Revert "[regexp] Move AST-to-Node code to a dedicated file"
This reverts commit 811bfbbc56.

Reason for revert: Breaks noi18n build (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/27201)

Original change's description:
> [regexp] Move AST-to-Node code to a dedicated file
> 
> Prior to this CL, jsregexp contains a bunch of things that are slightly
> related but would be cleaner in separate files, including: AST-to-Node
> transformations, the compiler implementation, and a debugging printer.
> 
> This CL extracts AST-to-Node transformations.
> 
> Bug: v8:9359
> Change-Id: I030cfca5c40cfd72e3a7abe2188e4654cfe2277c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655303
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62148}

TBR=yangguo@chromium.org,jgruber@chromium.org,petermarshall@chromium.org

Change-Id: I079e15b02d73d81aef806992f324f08d7008e367
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9359
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658160
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62149}
2019-06-13 15:05:01 +00:00
Jakob Gruber
811bfbbc56 [regexp] Move AST-to-Node code to a dedicated file
Prior to this CL, jsregexp contains a bunch of things that are slightly
related but would be cleaner in separate files, including: AST-to-Node
transformations, the compiler implementation, and a debugging printer.

This CL extracts AST-to-Node transformations.

Bug: v8:9359
Change-Id: I030cfca5c40cfd72e3a7abe2188e4654cfe2277c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655303
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62148}
2019-06-13 14:40:08 +00:00
Sigurd Schneider
df13503dd3 [mjsunit] Disable newly introduced flaking test
Bug: v8:9360
Notry: true
Change-Id: Ic598601d18149bcde5660ae268e81936a3954f3c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658151
Auto-Submit: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62147}
2019-06-13 14:10:52 +00:00
Toon Verwaest
e79e81cdf5 [runtime] Throw RangeError if we try to get too many values or entries
Bug: chromium:973363
Change-Id: Id2e46702f73e901df5f26b764d98fb3d4f681a98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1657914
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62143}
2019-06-13 12:28:02 +00:00
Sathya Gunasekaran
94498b45f0 [WeakRefs] Rename to KeepDuringJob, ClearKeptObjects
Align with the spec defined names.

Bug: v8:8179
Change-Id: I892a2627c7712112b47a87e7a658dc4066540482
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655654
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62136}
2019-06-13 08:57:39 +00:00
Sathya Gunasekaran
8665a710ca [WeakRefs] Make unregister spec compliant
- Return true or false, not undefined
- Check that unregister token is an object

Bug: v8:8179
Change-Id: I1a4ff7730158dba16efb552fb2f4892c8d31412c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653120
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62135}
2019-06-13 08:48:16 +00:00
Z Nguyen-Huu
8e0ef9b9a0 Add fast path for proxy with preventExtensions trap
ObjectPreventExtensions and ReflectPreventExtensions are now Torque builtins (previously CPP) and the Proxy path is implemented completely in Torque while everything else calls into runtime (and is thus a bit slower than previously).

Perf improvement in micro-benchmark JSTests/Proxies
Before:
PreventExtensionsWithoutTrap-Proxies(Score): 1978
PreventExtensionsWithTrap-Proxies(Score): 739

After:
PreventExtensionsWithoutTrap-Proxies(Score): 3017
PreventExtensionsWithTrap-Proxies(Score): 2044

Bug: v8:6664
Change-Id: I6505d730cea6b0d197f6f5d0540b39056c8b763d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652688
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62130}
2019-06-12 20:57:31 +00:00
Andrey Lushnikov
7b1f0c4f6c [heapprofiler] QueryObjects: do not return objects retained by feedback information
This was originally reported at https://github.com/GoogleChrome/puppeteer/issues/4545

R=ulan, alph

Change-Id: I5134506e56cd40e49b358cd47590913b81013b6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649473
Commit-Queue: Andrey Lushnikov <lushnikov@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62129}
2019-06-12 18:33:49 +00:00
Aleksei Koziatinskii
915aeab1b5 inspector: fix queryObjects when page contains JSModuleNamespace
JSModuleNamespace does not have well defined CreationContext: current
implementation of JSReceiver::GetCreationContext crashes on CHECK.

R=lushnikov@chromium.org,yangguo@chromium.org

Bug: none
Change-Id: Ie2c0bfa39117d42d81f9709c21376c177b18e5ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652559
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62128}
2019-06-12 18:27:19 +00:00
Z Nguyen-Huu
a26adb2b41 Optimize array.map for sealed, frozen objects
Extend same approach for FastJSArray to FastJSArrayForRead in ArrayMap builtin

~6x perf improvement in micro-benchmark JSTests/ObjectFreeze
Before:
ArrayMap
ArrayMap-Numbers(Score): 0.0887

After:
ArrayMap
ArrayMap-Numbers(Score): 0.531

Bug: v8:6831
Change-Id: I06cba44ca4c9198977c6da522b782b61f9df04fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653732
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62127}
2019-06-12 18:13:55 +00:00
Milad Farazmand
04936d0959 PPC: Fixing the EmptyFreeListCategoriesRemoved test on pLinux and AIX
Original commit: 303ca9ac26

Change-Id: I276bc68253fe4cedecdd2a77db0e8dbbc998c1a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652504
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62125}
2019-06-12 16:39:56 +00:00
Z Nguyen-Huu
aff557b61b add micro-benchmark of Array.map for frozen objects
Bug: v8:6831
Change-Id: I79cd1e25ddca17f0d5026bee737cd3fde0041e85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653733
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62124}
2019-06-12 16:37:07 +00:00
Sathya Gunasekaran
2f2657a6af [WeakRefs] Update cleanupSome to be spec compliant
Make sure to use the callback passed to cleanupSome

Bug: v8:8179
Change-Id: Ia5d90b56edf80e05bdaf0dc520b555c29042b64c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655306
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62122}
2019-06-12 16:10:35 +00:00
Georg Schmid
45bf9d8fa9 [torque] Add support for variable offset loads to CSA Load Elimination
R=jarin@chromium.org, tebbi@chromium.org

Change-Id: Iec887aec4ae0fc477176a7431a1bd0de0775c060
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645325
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62121}
2019-06-12 15:04:51 +00:00
Mathias Bynens
c6a16c10dd [test] Add %PrepareForOptimization to even more tests
With bytecode flushing and lazy feedback allocation, we need to call
%PrepareForOptimization before we call %OptimizeFunctionOnNextCall,
ideally after declaring the function.

Bug: v8:8801, v8:8394, v8:9183
Change-Id: I3fb257282a30f6526a376a3afdedb44786320d34
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648255
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62119}
2019-06-12 14:40:14 +00:00
Jakob Gruber
b0899cf8ab [regexp] Add wrapper header for arch-specific files
This adds regexp-macro-assembler-arch.h which contains the arch-specific
include dispatch.

Change-Id: Ibc2be8059d54b57afeed9b7ce244229ce1bd79bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655296
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62118}
2019-06-12 14:17:13 +00:00
Jakob Gruber
89ad50be1f [regexp] Rename interpreter files
bytecodes-irregexp.h -> regexp-bytecodes.h
interpreter-irregexp.{cc,h} -> regexp-interpreter.{cc,h}

Change-Id: I98ca9d5c3264ad0adbd280b93082aa3e01b45b67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655294
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62113}
2019-06-12 11:57:58 +00:00
Sigurd Schneider
4c0bf17eb5 [arm64,test] Generate code object in assembler tests
This is pre-work for a refactoring that changes how heap objects
are handled in the assembler: Currently, we put the handle location in
the constant pool, and replace these with the actual heap object when
we copy the code from the assembler's buffer to the heap.

In the future, we will put a small index in the constant pool, which
will ultimately enable 32bit constant pool slots for compressed heap
objects. This small index will be fixed up when we copy the code to
the heap.

This CL makes the assembler tests copy the code to the heap, which
ensures that the fix-up phase is actually run.

Change-Id: I80cd69dc57414a3bd0a27f8d558616aadcae05a2
Bug: v8:7703
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647166
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62112}
2019-06-12 11:44:28 +00:00
Mike Stanton
648ff5627e [turbofan] JSHeapBroker logging respects --trace-turbo-filter
As a component of the wider Turbofan logging scheme, it makes sense
for JSHeapBroker logging to come through flags specified in the
OptimizedCompilationInfo class, which uses --trace-turbo-filter
to control which functions are logged.

Bug: v8:7790
Change-Id: I3b068d8be78867ab0bd9607dda9eca4123b9d7b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655297
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62111}
2019-06-12 11:02:38 +00:00
Benedikt Meurer
ea4206556e [counters] Introduce proper bottleneck for FunctionCallback.
API calls made via the CallApiCallback builtin, which is used from the
ICs and optimized code, are currently misattributed to the wrong counter
InvokeFunctionCallback instead of FunctionCallback. In addition we don't
use the C trampoline when only runtime call stats are enabled, but the
Chrome DevTools profiler is not active, which means that these calls
will not be attrituted properly at all, and that had to be worked around
using all kinds of tricks (i.e. disabling fast-paths in ICs when RCS is
active and not inlining calls/property accesses into optimized code
depending on the state of RCS).

All of this was really brittle and only due to the fact that the central
builtin didn't properly check for RCS (in addition to checking for the
CDT profiler). With this fix it's now handled in a central place and
attributed to the correct category, so user code doesn't need to worry
about RCS anymore and can just call straight into the fast-path.

Drive-by-fix: Do the same for AccessorInfo getter calls, which share the
core hand-written native code with the API callback logic.

Bug: v8:9183
Change-Id: Id0cd99d3dd676635fe3272b67cd76a19a9a9cea4
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1651470
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62109}
2019-06-12 09:04:38 +00:00
Frank Tang
1945392a4e [Intl] Fix RegExp [\W] with i flag
Add special condiction in
ecma262 #sec-runtime-semantics-canonicalize-ch Step 3.g-h.

Bug: chromium:971636
Change-Id: Id533beb66749af6e38ee114cf79f995a1156df20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652795
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62105}
2019-06-12 06:18:08 +00:00
Guanzhong Chen
beaf1073bd [wasm] use standard WebAssembly stack trace format
Currently, in wasm-function stack traces, v8 displays the decimal offset
from the start of the function. However, the WebAssembly WebAPI
specification says that it should be a hex offset into the module.

This change makes the stack trace display with hex module offsets, as
well as fixing all the unit tests that depended on the old behaviour.

R=fgm@chromium.org, titzer@chromium.org, yangguo@chromium.org

Bug: v8:9172
Change-Id: I73737a319a42dd665521ab8a4b825199ae11c87f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646846
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Guanzhong Chen <gzchen@google.com>
Cr-Commit-Position: refs/heads/master@{#62103}
2019-06-11 18:03:24 +00:00
Z Nguyen-Huu
f4d2ccc3df add micro-benchmark for Proxy with PreventExtensions trap
Bug: v8:6664
Change-Id: Iaef787b3b0c2a24de57b7c3a5c4e75e5a723228e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652061
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62101}
2019-06-11 17:27:36 +00:00
Caitlin Potter
750e48ea67 Remove always-enabled --harmony-hashbang flag
It was a good flag, but it's time to say goodbye. Let us take a moment
to remember the good times we've had during its short time on earth.

It shipped in Chrome 74.

BUG=v8:8523
R=adamk@chromium.org, mathias@chromium.org, gsathya@chromium.org

Change-Id: I37e58360614c0bb3582b8bbfac795d5ed3e5a149
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1641205
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#62099}
2019-06-11 15:47:08 +00:00
Z Nguyen-Huu
bf3202c8b8 Optimize hasOwnProperty for sealed, frozen objects.
Extend CodeStubAssembler::TryLookupElement() to handle frozen/sealed elements.
Also add some tests.

~2x perf improvement in micro-benchmark ObjectFreeze
Before:
TaggedTemplate
TaggedTemplate-Numbers(Score): 2.43
HasOwnProperty
HasOwnProperty-Numbers(Score): 2.94

After:
TaggedTemplate
TaggedTemplate-Numbers(Score): 4.77
HasOwnProperty
HasOwnProperty-Numbers(Score): 4.68

Bug: v8:6831
Change-Id: I6ce057fd812cd6a01e627125a51eefa439710274
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1650633
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62096}
2019-06-11 14:18:05 +00:00
Z Nguyen-Huu
0db46e6a41 add new micro-benchmark of HasOwnProperty for frozen objects
Bug: v8:6831
Change-Id: I906dcc363620fda97f00cb02b68c3e393471076d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1651144
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62093}
2019-06-11 13:28:25 +00:00
Simon Zünd
aff3e0fbd7 [torque] Lint errors for unused macros
This CL adds lint errors for unused Torque macros. To prevent lots of
noisy warnings, the check is rather narrow. Macros declared as "extern"
or marked with "@export" are ignored. Also macros starting with "Convert",
"Cast" or "FromConstexpr" are not checked.

Drive-by: Removing some unused macros.

Bug: v8:7793
Change-Id: Ie0d2e445f8882a9b0ebbda45876b342abf341248
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645312
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62092}
2019-06-11 13:14:08 +00:00
Jakob Gruber
d766d6d5a3 [error] Use prepareStackTrace from error's realm
An error object's 'stack' property is lazily formatted once the
property is first read. It is thus possible that lazy formatting
happens in a different realm than where the error object was
constructed.

In this case, we should use the origin-realm's prepareStackTrace
function to format the stack trace.

This CL implements that behavior by fetching prepareStackTrace from
the given error object's context's error function.

Bug: v8:7848
Change-Id: Ibc383cf24f2c0dab2fd8bb7bc740f1488d9954a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1113438
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62090}
2019-06-11 13:02:45 +00:00
Simon Zünd
da6543108d [torque] Add lint error for 'let' bindings that can be 'const'
This CL adds a lint error for variables that are unnecessarily bound
with 'let' when they could be bound using 'const. This test is skipped
for struct types. For struct types, the "constness" also depends on
the struct methods called and whether these methods write to the struct
or not. This is not straight-forward to detect.

Drive-by: Fix all the newly introduced lint errors.

Bug: v8:7793
Change-Id: I0522ffcc4321350eef2e9573b8430bc78200ddce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645322
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62085}
2019-06-11 11:29:21 +00:00
Igor Sheludko
7304d116d3 [ptr-compr] Pass Isolate to JSObject::NormalizeProperties()
Bug: v8:9353
Change-Id: Iefeaa8820d3fcccafd92af1ea5e95001fc8ab951
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648262
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62084}
2019-06-11 11:11:10 +00:00
Igor Sheludko
d0d877067e [ptr-compr] Pass Isolate to JSObject::MigrateToMap() and friends
Tbr: ulan@chromium.org
Bug: v8:9353
Change-Id: I99533e21fd186f6d0191f4f500d1a3055a0f92c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648260
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62082}
2019-06-11 09:58:36 +00:00
Simon Zünd
b69a48e1fe [torque] Introduce 'import' syntax
This CL introduces an 'import' statement. It does not produce any AST
node. The AST contextual directly collects what source id imports what other
source id.

Currently the import map is unused. In the future, import syntax will be
used to implement partial compilation.

Bug: v8:7793
Change-Id: I5f09e6254d7ca2e7bc1a93d2e2d82e202cafc8ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649357
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62080}
2019-06-11 09:33:06 +00:00
Simon Zünd
0381794b8c Add tests for accessing Error.stack on error objects in dictionary mode
This CL adds two mjsunit tests that transition an error object to
dictionary mode before and after Error.stack is formatted and verify
that the custom 'stack' property accessor works as intended.

Bug: v8:8742
Change-Id: I4beb52c75b94533c10fac007f41117ab8915fac8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649789
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62078}
2019-06-11 09:16:43 +00:00
Simon Zünd
05611feb34 [stack-trace] Always return lazy wrapper objects from CaptureStackTrace
This CL is the starting point to convert all FrameArray users to
use StackTraceFrame objects instead.

Bug: v8:8742
Change-Id: I7bd0081dfd428e9914dedebd5065ac262aacec0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627332
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62076}
2019-06-11 08:35:09 +00:00
Oliver Dunk
563290194f Add quotes around unexpected token SyntaxError
Quotes have been added around the token to make the message clearer.

Bug: chromium:943636
Change-Id: Ic38f3e6d307157af2c0146e69fb611a2cfb46564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593307
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62074}
2019-06-11 06:11:58 +00:00
Z Nguyen-Huu
659010ec71 Handle IC store with sealed elements
The path for sealed elements is handled by using the same path for SmiOrObjectElementKind, just need to extend a DCHECK in CodeStubAssembler::IsFixedArrayWithKind.
The only special case is when we write to a hole in holey sealed elements. Since we can not write in that case, just bail out.

Bug: chromium:967101
Change-Id: Ibf837ae053fe609bca83da432f298ef056f3aced
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632830
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62071}
2019-06-10 19:54:17 +00:00
Benedikt Meurer
92c6af8a2d [interpreter] Do ToObject implicitly as part of CloneObject.
The CloneObject bytecode was only able to handle objects, null and
undefined, and explicit bytecode had to be generated to perform the
ToObject outside the bytecode (unlike the other IC bytecodes that
just perform the ToObject implicitly). That means the simplest possible
object cloning would also generate a sequence of 5 bytecodes (at least):

```
   Mov <register>, a0
   JumpIfNull @1
   JumpIfUndefined @1
   ToObject <register>
1: CloneObject <register>
```

That is quite wasteful and unnecessary, since the core logic in the
runtime already does the ToObject properly anyways. This change
refactors the CloneObjectIC slightly to behave more like the other ICs
and do the ToObject implicitly when necessary.

Bug: v8:7611, v8:9114, v8:9183, v8:9343
Change-Id: I11973e90bf875f154a5a7739287bee17041e4a7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649554
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62064}
2019-06-08 17:42:12 +00:00
Ben Smith
8bf9ba4e7c [wasm] Add unittest for PrintWasmText
PrintWasmText is used for disassembling wasm code in DevTools, but many
instructions are not implemented. This test should make it easier to
remember to implement this when adding new instructions.

Change-Id: I6030a70113320f11a1ac0436bf0d220b5c41e6d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647475
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62063}
2019-06-08 12:39:07 +00:00
Jakob Kummerow
05e3b64132 [ubsan] Fix a few double-to-float casts
The DoubleToFloat32 helper takes care of everything, so use it
consistently.

Bug: chromium:969498
Change-Id: If71e5374684b89615006548cb0329f4d4cb7fd6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648253
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62062}
2019-06-08 12:38:02 +00:00
Darius Mercadier
303ca9ac26 Makes sure FreeListCategories never contain empty elements
The linked lists of FreeLists could contain empty elements
(FreeListCategories whose `top()` is null). The code is carefuly
written so that this case won't break anything (probably just slow
things a little bit).  When `FreeList::FindNodeIn` (the fast path of
`FreeList::Allocate`) found such an empty `FreeListCategory`, it
removed it by calling `FreeList::RemoveCategory`, and looked in the
next `FreeListCategory` of the same size. However, on the slow path of
`FreeList::Allocate`, the functions that iterates the
`FreeListCategory` are `FreeList::TryFindNodeIn` and
`FreeListCategory::PickNodeFromList`, none of which removed empty
elements. Therefore, it could happen that a `FreeListCategory` "real"
first element could be used, but was never considered due to the top of
the linked list being empty. The behavior for the slow path should be
the same as for the fast path on that regard.

The problem was actually deeper than that: FreeListCategories were not
always in a consistent state, since they could have empty members. The
removal of those empty elements should be done as soon as they are
created, ie when allocating the last element.

This CL ensures that empty FreeListCategories are removed as soon as
they become empty.

Bug: v8:9329
Change-Id: Idda8096dc5978745894854a0405da59f7e8691a6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648476
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62058}
2019-06-07 17:49:25 +00:00
Darius Mercadier
05e98e56c4 Fix allocation of tiniest object in the tiny freelist
When trying to find a spot in the freelists for a tiniest object,
the tiny freelist was never searched.

This was fixed by modifying FreeList::Allocate in order to handle
that special case.
A test was added in cctest/heap/test-spaces.cc. It allocates a
Tiny object on a new page, then fills up the page, then frees the
first object, and finally tries to allocate a Tiniest
object. Before, this Tiniest object would go on a different page;
now it goes on the same one (which is what the test checks for).

Bug: v8:9329
Change-Id: Ia810726d1bfe1dae4ef2055a7f5b314b1514ee9c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647162
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62055}
2019-06-07 16:11:28 +00:00
Georg Schmid
94ae207bc7 [ptr-compr] Revisit transformed Phis in Decompression Elimination
Currently, decompression elimination may reduce phis by pushing decompressions in the value inputs of the phi "down" and replacing it by a single decompression following the phi node. Because of the way that the replacement is currently done, other reducers in the same phase will not generally get a chance to revisit the modified phi.

In the specific case of v8:9335 this blocked an additional optimization in CommonOperatorReducer from being applied, causing the overall load elimination test to fail.

This CL fixes the replacement behavior in decompression elimination to also allow for revisitations of the modified phi node.

Bug: v8:9335 v8:9336
Change-Id: I3ca5686dacb41a525160b08456905ba77cf28b39

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Change-Id: I3ca5686dacb41a525160b08456905ba77cf28b39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648238
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#62054}
2019-06-07 15:52:48 +00:00
Yang Guo
9bcacf60f8 Fix character ranges in case insensitive regexp
R=jgruber@chromium.org

Bug: chromium:971383
Change-Id: I39d26a63c0735f595a809959c06cb2ac1c141451
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648098
Commit-Queue: Frank Tang <ftang@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62044}
2019-06-07 00:09:17 +00:00
Frank Tang
9b02ce3310 Add regression test for v8:8866
Bug: v8:8866
Change-Id: I3a25c68fe4d8536596118352804daa3c6025da37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643466
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62042}
2019-06-06 21:54:10 +00:00
Frank Tang
041c009d9b Ship Intl.NumberFormat Unified API Proposal
DesignDoc: https://goo.gl/ZAtL1f
Chrome Status: https://www.chromestatus.com/feature/5430420699086848
I2I: http://shorturl.at/sE168
I2S: http://shorturl.at/qsHU9

Bug: v8:8518
Change-Id: Ib9d6ce4782c12745d3d44500991074646254621a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1639698
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62039}
2019-06-06 20:59:25 +00:00
Jakob Kummerow
6327579e7a [owners] Make test/ owned by COMMON_OWNERS
Adding and improving tests should have as little friction
as possible.

Change-Id: I61c09ccadf12b7367979fbf3b8cb97a64e0c70bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648243
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62038}
2019-06-06 20:56:09 +00:00
Swapnil Gaikwad
a096a6e18d Update iterator close to new spec
As per the new specs, when the exception is thrown by iterator's return method
while doing iterator close because it is not callable, the exception is
suppressed in the same way as if the return method is called and threw an exception.

https://github.com/tc39/ecma262/issues/1398

Bug: v8:9056
Change-Id: I21abd5fdd01d3a957c3c16d9d3aaab9091e43142
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648256
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Swapnil Gaikwad <swapnilgaikwad@google.com>
Cr-Commit-Position: refs/heads/master@{#62035}
2019-06-06 19:18:45 +00:00
Yang Guo
e77e65f159 Introduce v8::Context::ScriptExecutionCallback
Bug: chromium:965916
Change-Id: I2cb28a8c569c88631bc835b55a04e8629f56cb6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630684
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62034}
2019-06-06 19:17:40 +00:00
Ulan Degenbaev
8c9ca62a5e [heap] Introduce a min heap size and skip GCs below that threshold
If the embedder specifies an initial heap size, then we can take it
as a hint to skip full GCs below that threshold.

Bug: v8:9306
Change-Id: I42a4c597bf75c6ba9845ed7a6bd9946012979005
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646515
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62030}
2019-06-06 15:49:50 +00:00
Simon Zünd
0e53739c39 [torque] Add lint errors for unused variable and label bindings
This CL adds lint errors when 'let' bindings, arguments and labels
are not used. Note that errors for 'const' bindings will be added
later.

In cases where arguments are actually needed to match the signature,
the warning can be silenced by prefixing identifiers with "_". This
might be needed for generic specializations or builtins called from
TurboFan. Trying to use a variable or label that was marked with
"_" results in a compilation error.

Implicit arguments are not linted. They are implemented using exact
string matching. Prefixing an implicit argument with "_" in a callee
would break all callers as the names would no longer match.

Drive-by: Fix all new lint errors in the existing Torque code.

Bug: v8:7793
Change-Id: I68b3c59c76b956e9f88709e9388a40a19546ce52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645092
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62027}
2019-06-06 15:27:12 +00:00
Mythri A
35253de786 Fix a failing mjsunit test with lazy feedback allocation
Bug: v8:8394
Change-Id: I02551ff3d51e914f5a24f221186f23a8e3d2cc77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648096
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62026}
2019-06-06 14:57:38 +00:00
Leszek Swirski
5a39c2d6b4 [test] Fix string length in generate-bytecode-expectations
Change-Id: Ieed04203b400f33dcb05eebd42b74db322c0c833
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648097
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62023}
2019-06-06 14:11:28 +00:00
Georg Schmid
b3f3f28a51 Disable NumFuzz for load elimination const field test
Bug: v8:9314
Change-Id: I746dcdffe29ca7de144ad9c7d6310e479bff2434
Notry: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647164
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#62021}
2019-06-06 11:47:43 +00:00
Georg Schmid
0686e1ef70 Add very basic CsaLoadElimination phase
R=jarin@chromium.org, tebbi@chromium.org

TBR: machenbach@chromium.org

Change-Id: I82dd17b14eb086928f602395d80f0f2cf09770eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635449
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#62020}
2019-06-06 11:33:05 +00:00
Ulan Degenbaev
e423f00403 [api] Add a way to specify the max heap size in ResourceConstraints
The new API function is called ConfigureDefaultsFromHeapSize and
accepts two parameters: the initial and the maximum heap size.
Based on the given limits the function computes the default size
for the young and the old generation.

The patch also cleans up the existing functions to make them
consistent in terms of units and heap structure.

Bug: v8:9306
Change-Id: If2200a9cdb45b0b818a373207efe4e6426f7b688
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631593
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62017}
2019-06-06 10:22:56 +00:00
Nico Hartmann
ea79fa426d [js-perf-test] Performance benchmark for adding random BigInts
Bug: v8:9213
Change-Id: Iee04bfe25e37cfe639964f8ab31e6702d3750bfb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645319
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62016}
2019-06-06 10:05:16 +00:00
Mythri A
ea04708ee9 [mjsunit] Fix tests failing with lazy feedback allocation in gc stress
We need to hold onto the bytecode array so it doesn't get flushed.

Bug: v8:8394
Change-Id: Ia583a0a662740e369fcbc1c94041895e463be26e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645329
Commit-Queue: Mythri Alle <mythria@chromium.org>
Auto-Submit: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62011}
2019-06-06 06:16:37 +00:00
Z Nguyen-Huu
3167b3b600 Add fast path for proxy with isExtensible trap
ObjectIsExtensible is now a Torque builtin (previously CPP) and the Proxy path is implemented completely in Torque while everything else calls into runtime (and is thus a bit slower than previously).

Improvement in micro-benchmark
Before:
IsExtensibleWithoutTrap-Proxies(Score): 2228
IsExtensibleWithTrap-Proxies(Score): 917

After:
IsExtensibleWithoutTrap-Proxies(Score): 3683
IsExtensibleWithTrap-Proxies(Score): 3310

Bug: v8:6664
Change-Id: I1fbe1c51cb724a23d7a59fc8231bb3d1461a6add
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1637444
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62006}
2019-06-05 17:38:27 +00:00
Tobias Tebbi
437f680e19 [torque] generate files per Torque file instead of per namespace
TBR: yangguo@chromium.org

Bug: v8:7793
Change-Id: Ie680d72a1da23038d3136f82532496eabbd9c363
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632227
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62004}
2019-06-05 16:12:27 +00:00
Georg Schmid
2911a16fa6 Fix Load Elimination crash involving transitioning const stores in loops
R=tebbi@chromium.org

Bug: chromium:964833 chromium:970120
Change-Id: I0fc179aa1e8fc5c13279342501f8639fce9ee7d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645315
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#61995}
2019-06-05 10:47:58 +00:00
Nico Hartmann
91d49028df [js-perf-test] Performance benchmarks for addition of BigInts
Bug: v8:9213
Change-Id: I78e2e4b00c3dec92252adf3823138b14a7bc4a5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1640202
Commit-Queue: Nico Hartmann <nicohartmann@google.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61994}
2019-06-05 10:04:31 +00:00
Mathias Bynens
61ce45c9e2 [test] Add %PrepareForOptimization to more tests
With bytecode flushing and lazy feedback allocation, we need to call
%PrepareForOptimization before we call %OptimizeFunctionOnNextCall,
ideally after declaring the function.

Bug: v8:8801, v8:8394, v8:9183
Change-Id: I6bf119e726426df8527d97546b6ce806112c894d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643167
Auto-Submit: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61988}
2019-06-04 19:58:19 +00:00
Joey Gouly
f4b6f4af9c [arm64][windows] Ensure 64-bit values in unittest
On Windows, long is 32-bits, so the 'L' suffix shouldn't be used if a
64-bit value is needed. This caused a test failure in 'Int64MulWithImmediate'.

Change-Id: I93c43a1f166aa0e5bcd53aaf7a860fffd006fd0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627538
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61986}
2019-06-04 16:30:12 +00:00
Jakob Gruber
0564a99e76 [snapshot] Remove TEST natives
These were only used by test-log/EquivalenceOfLoggingAndTraversal,
which itself has been marked as failing since 2013. This CL removes
the test itself as well as the TEST natives kind.

Bug: v8:7624,v8:2857
Change-Id: Iedf2b1c94e31ccd1ea885d72bf1fac5d33defa90
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643467
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61984}
2019-06-04 15:05:52 +00:00
Leszek Swirski
43cd5d1054 [tracing] Speed up SharedFunctionInfo::TraceID
Avoid the linear lookup of function literal id when getting the shared
function info TraceID, by optionally passing through a FunctionLiteral.
Additionally, use the FunctionLiteralId helper when a FunctionLiteral is
not available, since it can also fast-path in some cases.

As a drive-by, allow using a ScriptIterator without an Isolate pointer
(e.g. manually creating a handle) to allow calling FunctionLiteralId
without an Isolate pointer.

Bug: v8:9325
Change-Id: Ibfa053f300d6d5005485c67174a848264a5d1372
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643429
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61983}
2019-06-04 15:02:03 +00:00
Joey Gouly
2e327e90d5 [arm64] Don't use x18 (platform register) in assembler tests
This fixes the assembler tests on Windows arm64, that were previously crashing.

Bug: v8:9235
Change-Id: I616e6eb00bb71d70195787f80f8b54a9ae33abe6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634919
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61981}
2019-06-04 14:25:20 +00:00
Maya Lekova
be060ec04f [test] Skip tests failing on gc fuzzer
The fix in https://chromium-review.googlesource.com/c/v8/v8/+/1627333
didn't seem to have worked, so disabling the tests again.

Bug: chromium:963411, v8:9114, v8:9183, v8:9267
Change-Id: Id080c16b1fe4c99c8ef980a15bc91668dbfe5c13

NOTRY=true
TBR=machenbach@chromium.org

Change-Id: Id080c16b1fe4c99c8ef980a15bc91668dbfe5c13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643428
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61980}
2019-06-04 14:22:16 +00:00
Maciej Goszczycki
8a437788b9 [roheap] Set owner_ to nullptr for read-only chunks
As it stands most of ReadOnlySpace class's method are unusable once it
has been sealed, since all of its pages are read-only. Set owner_ to null
to ensure nothing unintentionally uses it.

This also helps with separating the ReadOnlySpace from the Heap class in
the future as ReadOnlySpace might not inherit from Space.

Bug: v8:7464
Change-Id: I3b24f20c644d6f5e23647bc1de4d256a20a0eb19
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1637800
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#61979}
2019-06-04 12:06:12 +00:00
Gopesh Kumar Chaudhary
9c3546889c PPC/AIX : skip regex test case
Regex test cases fails on AIX debug due to stack-overflow.

R=miladfar@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com

Bug: 
Change-Id: I217ad3d61fa8d7572cc0c7e25efa63065552f99a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625836
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61976}
2019-06-04 07:20:08 +00:00
Z Nguyen-Huu
877257a8ac add micro-benchmark for Proxy with isExtensible trap
Bug: v8:6664
Change-Id: Ie320264cfba8c33c90405bb009f584b8e2b3d8ce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1637660
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61969}
2019-06-03 16:54:16 +00:00
Santiago Aboy Solanes
d938123934 [ptr-compr][CSA] Removing tests that used explicit (De)Compress functions
Following up on https://chromium-review.googlesource.com/c/v8/v8/+/1637879,
this CL removes the tests that used explicit Compress/Decompress functions
in CSA

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I063678a732545eb505fa752612242ceeb42be823
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1640206
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61962}
2019-06-03 11:58:27 +00:00
Simon Zünd
d121475bd6 [refactoring] Make Torque LS unittests more robust
This CL changes "MessageWriter" type to std::function instead of a
plain function pointer. This allows capturing lambdas, which in turn
are used to make unittests more robust.

R=sigurds@chromium.org

Bug: v8:8880
Change-Id: I9d71ddcac173af36e5b62852f2a9ec6dcfac9f78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1640201
Commit-Queue: Simon Zünd <szuend@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61958}
2019-06-03 09:37:01 +00:00
Frank Tang
6e558e9e09 [Intl] Add test cases for %%ALIAS locales
Bug: v8:9312, chromium:968269
Change-Id: I0e3d134cd4341c30277df62fead6386e344be0bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1636179
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61952}
2019-05-31 21:37:08 +00:00
Santiago Aboy Solanes
a31b36e0a1 [ptr-compr][turbofan][CSA] Adding the CompressedHeapConstant node
CompressedHeapConstant is used in the DecompressionElimination Reducer to
create compressed HeapConstant values. It won't appear in the graph
up until that point.

This CL enables back the disabled tests in DecompressionElimination, as
well as generating the CompressedHeapConstant in that reducer.

The RelocInfo has already been added for x64 but not for arm64. Therefore,
the x64 version is now doing the mov on 32 bits. The support for ARM will
come in a following CL, and for now it is doing the mov in 64 bits.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703, v8:9298
Change-Id: If0ca4f937cfa60501679e66f6fd5ded2df38f605
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632236
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61950}
2019-05-31 15:11:20 +00:00
Mythri A
3e90eee96b [turbofan] Allow polymorphic inlining for Array push / pop / shift
Array push / pop / shift were inlined if the elements kind of the
receiver maps is the same. This cl extends it by inlining these
builtins even when the receiver maps have different elements kinds.
It still limits it to only fast elements kinds. This is required to
prevent regressions in deltablue when lazy feedback allocation is
enabled. With lazy feedback allocation we may see polymorphic
feedback more often, since we don't have allocation site feedback
till the feedback vectors are allocated.

Bug: v8:9078
Change-Id: Id4a7b84be6305b125913b6ce0fb4f3eb3e3b15ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632239
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61949}
2019-05-31 14:35:08 +00:00
Ulan Degenbaev
b098074891 [heap] Simplify computation of max semi-space size.
The size is now computed as a fraction of the old space size:
- for low memory devices (<512MB) the fraction is 1 / 256.
- for all other devices the fraction is 1 / 128.

The values were chosen to minimize the difference between the new
and the old heuristics.

Bug: v8:9306

Change-Id: I3246fe2d6fc589af6220e2566e3f10fb13470b82
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632158
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61947}
2019-05-31 13:33:28 +00:00
Maciej Goszczycki
b5a0e7d942 [heap] Update HeapIterator and space iterator APIs to match other iterators
This makes the API more consistent and reduces the cognitive load of
switching between 'next' and 'Next'.

Bug: v8:9183
Change-Id: Ia81b874374626887d6af8c90f8ac185812f0573f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635689
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#61946}
2019-05-31 12:59:07 +00:00
Maciej Goszczycki
ad6bc4852d [cleanup] Remove unreachable code in PagedSpaces
counter_ could never be RO_SPACE. Make sure RO_SPACE and OLD_SPACE are
marked as unreachable.

Added tests for PagedSpaces and SpaceIterator.

Bug: v8:9183
Change-Id: I97bc2b4e0e5af37363a1c628ca7d69d2790a97b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635696
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61943}
2019-05-31 11:31:17 +00:00
Jaroslav Sevcik
8839d8f6e3 [turbofan] Rename Float64 truncation to OddballAndBigIntToNumber.
Truncation::Float64 is confusing; in reality, we mean that oddballs
and big-ints are identified with their ToNumber counterparts.

Bug: v8:9183
Change-Id: Ibcce990327ac7e01e36a2237ad39c374ac9922aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632224
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61937}
2019-05-31 08:20:20 +00:00
Irina Yatsenko
73ad21b139 (Reland) Torquefy a few more types
WeakFixedArray, WeakArrayList, JSFinalizationGroup, JSFinalizationGroupCleanupIterator, WeakCell, JSWeakRef, BytecodeArray, SourcePositionWithFrameCache

Note: SourcePositionTableWithFrameCache doesn't derive from Tuple2 anymore.
Bug: v8:8952

Original CL: https://chromium-review.googlesource.com/c/v8/v8/+/1504433

Change-Id: I13f102b445c9ff3e1ebabe0cdf013c62bb6d771d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559212
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61932}
2019-05-30 20:35:22 +00:00
Dan Elphick
d83e4999f6 [interpreter] Fix LookupNameOfBytecodeHandler
Fixes LookupNameOfBytecodeHandler so it actually returns non-nullptr
values with embedded builtins enabled. Also now correctly handles wide
and extra-wide bytecodes and always works regardless of whether
ENABLE_DISASSEMBLER is set.

Bug: v8:9215
Change-Id: I787134f2145d02daaf5b50ecb6c174dfc129a4fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635890
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61929}
2019-05-30 13:00:51 +00:00
Yang Guo
d64f582ae4 Add OWNERS files for src and test
Bug: v8:9247
Change-Id: Id6860e7b0f932990ac3cda39e369b0809e4f6a2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632072
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61928}
2019-05-30 04:51:21 +00:00
Michael Mclaughlin
348cc6f152 Improve toString(radix) for doubles near zero
Currently, Number.prototype.toString(radix) often fails to produce the
least significant bit for doubles near zero. For example, for the
minimum double, 5e-324, toString(2) produces "0". This means that a
user cannot reliably get the exact binary or hexdecimal value of a
double from JavaScript using toString.

This patch makes a slight amendment to the DoubleToRadixCString
function, so that doubles where the gap to the next double is 5e-324
(i.e. doubles less than 2**-1021), are represented exactly in binary and
other power-of-two bases, and close to exactly otherwise. It results
in Number.prototype.toString producing the correct binary value for all
doubles.

R=jkummerow@chromium.org, mathias@chromium.org, yangguo@chromium.org

Bug: v8:9294
Change-Id: I71506149b7c4c0eac8c38675a1ee15fb4f36f9ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631601
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61925}
2019-05-29 20:45:02 +00:00
Z Duong Nguyen-Huu
211b4e543a Freeze proxy from sealed elements-kind object can normalize elements
Bug: chromium:966460
Change-Id: I418eab656510fe3f799f552e75be10140d25bcab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625864
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61922}
2019-05-29 18:05:28 +00:00
Andreas Haas
32171b40bf [wasm][fuzzer] Enable anyref for the wasm-compile fuzzer
The newly introduced select-with-type instruction is only available when
anyref is enabled.

R=clemensh@chromium.org

Bug: chromium:967998
Change-Id: Idcb9ab447eedb93fe5374726da162ca1c79b3f16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634927
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61919}
2019-05-29 14:03:19 +00:00
Maya Lekova
731a370b1f Fix correctness issue in proxy set trap
According to the spec, in case where the property is non-configurable and
non-writable, the value passed to the set trap should be compared to the data.
Instead, the trap result was compared, because of the misleading name of the
CheckGetSetTrapResult parameter.

Regression was introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/1604071

Bug: chromium:966450
Change-Id: I77501980475da3aeb4f6153321da39e6fc2e6bd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632238
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61916}
2019-05-29 13:16:49 +00:00
Jakob Gruber
b114cb4c64 [regexp] Make the interpreter backtracking stack growable
The backtracking stack (which is actually a generic stack) used to be
statically sized. At 10k elements, it was fairly large, but still easy
to overflow on large subject strings. This CL changes it to a
std::vector-based implementation instead which grows on-demand.

Drive-by: Add braces to the BYTECODE cases to make clang-format
produce a nicer output.

Bug: v8:8776
Change-Id: If41a444fe3d05f6d5be1be019129788a86e6118b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634914
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61912}
2019-05-29 11:00:57 +00:00
Clemens Hammacher
cbc352983e [Liftoff] List unsupported opcodes explicitly
This removes two default switch cases for unsupported opcodes, and
replaces them by explicit lists. This makes it easy to see what is
currently not supported in Liftoff. In a follow-up CL, each bailout
will be associated with a category to track which features currently
cause Liftoff to bailout.
This change also makes Liftoff crash (in UNREACHABLE) if invoked with
asm.js code. Hence, change the asm.js tests to not test Liftoff. In
production, we do not invoke Liftoff for asm.js anyway.

R=mstarzinger@chromium.org

Change-Id: I971c6146ed325103d14008c0e67a973a47a35bc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634909
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61911}
2019-05-29 09:47:28 +00:00
Michael Starzinger
5b120949d2 Reland "[wasm] Store signature with {WebAssembly.Function} objects."
This is a reland of 8092acbe41

Original change's description:
> [wasm] Store signature with {WebAssembly.Function} objects.
> 
> This adds simple serialization and deserialization of the signature
> provided when a {WebAssembly.Function} object is constructed. For now
> this signature is only used by the {WebAssembly.Function.type} method,
> but will soon be used when importing such functions as well.
> 
> R=jkummerow@chromium.org
> TEST=mjsunit/wasm/type-reflection
> BUG=v8:7742
> 
> Change-Id: If4a687ea537d8c12f4f01a7d3ac5a795ceb999c6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632211
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61898}

Bug: v8:7742
Change-Id: I5d784165c460abd9d7b07f5cdafc746d5380ccd6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632159
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61910}
2019-05-29 08:59:08 +00:00
Georg Neis
b9d55654c8 [turbofan] Don't overwrite jump target serialization environment
A given target offset may already have an environment associated with
it (there can be multiple jumps to the same target). In that case we
used to throw away the previous environment. With this CL we merge the
environments instead.

Bug: v8:7790
Change-Id: I0c22182436fc48e29675e49627729a33cbeaaf4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631603
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61905}
2019-05-29 02:08:32 +00:00
Ross McIlroy
238dab8d2d [Tools] Update tickprocessor entry processing to work on Android symbols.
On Android libraries there are zero length entries within the ranged
symbols which break our range processing. This updates the logic to
only add entries for zero-length entries if they aren't within the range
of the previously added entry.

Change-Id: I511a6221817c535d967a50413948a29d9deb1e85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627985
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61903}
2019-05-28 17:04:07 +00:00
Michael Starzinger
d46d3570cb Revert "[wasm] Store signature with {WebAssembly.Function} objects."
This reverts commit 8092acbe41.

Reason for revert: Causes UBSan warnings:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/6436

Original change's description:
> [wasm] Store signature with {WebAssembly.Function} objects.
> 
> This adds simple serialization and deserialization of the signature
> provided when a {WebAssembly.Function} object is constructed. For now
> this signature is only used by the {WebAssembly.Function.type} method,
> but will soon be used when importing such functions as well.
> 
> R=​jkummerow@chromium.org
> TEST=mjsunit/wasm/type-reflection
> BUG=v8:7742
> 
> Change-Id: If4a687ea537d8c12f4f01a7d3ac5a795ceb999c6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632211
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61898}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org

Change-Id: I56ea9df5db3f95c05068186097e298cb73a3675d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7742
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632218
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61899}
2019-05-28 15:41:50 +00:00
Michael Starzinger
8092acbe41 [wasm] Store signature with {WebAssembly.Function} objects.
This adds simple serialization and deserialization of the signature
provided when a {WebAssembly.Function} object is constructed. For now
this signature is only used by the {WebAssembly.Function.type} method,
but will soon be used when importing such functions as well.

R=jkummerow@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: If4a687ea537d8c12f4f01a7d3ac5a795ceb999c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632211
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61898}
2019-05-28 14:31:45 +00:00
Yang Guo
f455f86d89 Move architecture dependent files
Bug: v8:9247
Change-Id: I2f999ed3a8cc0931e5092f2ac6e709b8ff3f9e42
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630678
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61896}
2019-05-28 14:02:15 +00:00
Georg Schmid
6e89adc80b Weaken representation tracking assertion in load elimination
Feedback pollution can create situations in which we statically see stores to the same field with incompatible representations; dynamically this should be impossible for a single TurboFan compilation unit. Instead of failing an assertion we produce Unreachable nodes.

R=tebbi@chromium.org

Bug: chromium:967434 chromium:967506
Change-Id: Id549ec84f28b4fed2d2e5ef05b40b48bc5b30e97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632169
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61894}
2019-05-28 13:43:05 +00:00
Santiago Aboy Solanes
b7744db7f9 [CSA] Updating machine verification of Compressed
There were some cases that were not yet contemplated on machine graph
verifier.

Also, there is some work to be done to create a Compressed HeapConstant.
Until that happens, we have to ignore HeapConstants for
DecompressionElimination's reductions.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703, v8:9298
Change-Id: I9de8dd4272866830807a8d88e625e863fb5f1d0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632209
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61892}
2019-05-28 13:37:55 +00:00
Tobias Tebbi
0ab6cc739f [torque] disable Windows ASAN unittests
Due to bug chromium:893437, Torque has ASAN disabled on Windows, which
makes it impossible to run unittests for Torque with ASAN being enabled
in the unittests. To fix this, this skips Torque unittests in the
unsupported configuration.

Bug: chromium:893437
Change-Id: I6c8eee1448c63223af4d7336954190e649d125e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632214
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61891}
2019-05-28 13:16:06 +00:00
Clemens Hammacher
0b14b8a134 [cleanup] Remove 'typedef struct' and 'typedef enum'
Just use standard C++ syntax to define structs and enums instead.

R=ahaas@chromium.org

Bug: v8:9183
Change-Id: Ibae1643bd1dc74267cdd14ec45a36fc65bf0ab4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631410
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61889}
2019-05-28 12:17:35 +00:00
Santiago Aboy Solanes
b53dffe6f0 [ptr-compr][turbofan] Reduction of Compress after Constant
Reduces compressions of constants, going from
     Constant <- Compress <- Child
to
     Compressed_Constant <- Child

This pattern commonly appeared when the Constant was being used as a
Store value (e.g StoreElement's value).

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I2e71f79ddd2a6fba42cdfe782cc89fff3a8d5ac1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627988
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61887}
2019-05-28 11:21:03 +00:00
Andreas Haas
d34178fd73 [wasm][anyref] Introduce the select_with_type instruction
The instruction is the same as the existing {select} instruction with
type. Both inputs must be in a sub-type relationship with the type
specified in the type instruction.

R=clemensh@chromium.org

Bug: v8:7581
Change-Id: Ibead6cd0253210828c8114336ea0942e6cbd6126
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631413
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61886}
2019-05-28 10:46:23 +00:00
Jakob Kummerow
f5ab7d38be [wasm-c-api] Add tests and fixes
In a new test suite: "wasm-api-tests", using a new binary "wasm_api_tests",
powered by gtest/gmock (like unittests).
Also fix a bunch of issues that these tests uncovered, mostly to ensure
that the stack is walkable.

Change-Id: I1d5604eea85da078ebecd4ebb7383647595f16ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627539
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61885}
2019-05-28 09:57:04 +00:00
Santiago Aboy Solanes
42ed37d015 [ptr-compr][cleanup] Removing the optimized map checks
The DecompressionElimination reducer can handle that case with the
comparison of Decompress vs HeapConstant. There is no need to do extra
work.

Reverts parts of https://chromium-review.googlesource.com/c/v8/v8/+/1518182.
The rest of that CL was reverted in a previous CL where the AccessBuilders
were updated.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I871577e49f9ccd95864af54bdd61884d34b7f223
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628792
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61883}
2019-05-28 09:39:23 +00:00
Georg Neis
72fbd957bd [turbofan] Fix serialization of resumables
This is a quick fix for the recent bailout-on-uninitialized feature of
the serializer, which does not work with resumables. For now, simply
treat the ResumeGenerator bytecode as if it was an exception handler
entry point. I want to revisit this later because the proper fix might
be to teach the serializer about the SwitchOnGeneratorState bytecode.

Bug: chromium:966560, v8:7790
Change-Id: I48bc6ba7299faa29802159cc7c36f4629667b5d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630670
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61877}
2019-05-28 09:30:23 +00:00
Clemens Hammacher
c6077bf1b8 [cleanup] Replace function typedefs by using declarations
Especially for function types, this increases readability significantly.
Also the style guide recommends for 'using' over 'typedef'.

R=mstarzinger@chromium.org

Bug: v8:9183
Change-Id: If2d17863de39383f5a35e089298d37408791ce4b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631415
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61872}
2019-05-28 08:35:08 +00:00
Tobias Tebbi
19d8bfa5a8 [torque] no longer generate assemblers per namespace
Instead of generating one CodeStubAssembler-like class per namespace,
Torque-generated macros are now free-standing functions not included
from CSA code, and explicitly exported macros become part of the new
TorqueGeneratedExportedMacrosAssembler, which CodeStubAssembler
inherits from, thus making them available to all CSA code.

Structs are now defined in a new header csa-types-tq.h as free-standing
types with the prefix "TorqueStruct".

This is a preparation for generating per Torque-file instead of per
namespace.

Change-Id: I60fadc493a63f85d1d340768ec6f11ae47be0cb8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628787
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61865}
2019-05-27 20:05:18 +00:00
Benedikt Meurer
70bd7cf0ef Reland "[typedarray] Move external/data pointer to JSTypedArray."
This is a reland of 4b86fea530 with
copy&paste typo in CodeStubAssembler::AllocateByteArray() fixed
(bug led to holes in new space, which was crashing reproducibly
on the ia32 bot).

Original change's description:
> [typedarray] Move external/data pointer to JSTypedArray.
>
> As the next step in supporting huge typed arrays in V8, this moves the
> external/data pointer from the FixedTypedArrayBase backing store to the
> JSTypedArray instance itself, and replaces the special backing stores
> with a plain ByteArray (removing all the code for the FixedTypedArrayBase
> class hierarchy). By doing so, we can drastically simplify the system
> around typed arrays.
>
> Note: Several places in the code base used to check the instance type
> of the elements backing store of a JSTypedArray instead of checking the
> elements kind on the JSTypedArray map directly. Those had to be fixed,
> since the backing store is now always a ByteArray.
>
> Drive-by-fix: Move all the typed elements access related code into the
> elements.cc file to properly encapsulate the accesses.
>
> Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
> Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
> Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
> Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61855}

Tbr: petermarshall@chromium.org
Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
Change-Id: I87fcdb28532c5f08cc227332a4d59546cb423810
Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel
Cq-Include-Trybots: luci.v8.try:v8_linux_shared_compile_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631592
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61864}
2019-05-27 17:44:06 +00:00
Z Nguyen-Huu
6e85742157 Optimize array clone for sealed, frozen objects
Improve micro-benchmark by ~5x
Before:
ApplySpreadLiteral
ApplySpreadLiteral-Numbers(Score): 279
SpreadCallSpreadLiteral
SpreadCallSpreadLiteral-Numbers(Score): 285

After:
ApplySpreadLiteral
ApplySpreadLiteral-Numbers(Score): 1074
SpreadCallSpreadLiteral
SpreadCallSpreadLiteral-Numbers(Score): 1009


Bug: v8:6831
Change-Id: Ifd676ca13d5b7e86afc1578636fdd4dc2733c474
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628244
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61862}
2019-05-27 17:26:06 +00:00
Peter Marshall
9a50c84fb6 [tracing] Add a test harness for perfetto tracing tests
Add test harness so that we can avoid all this boilerplate for common
tests in the future. Use it for the existing perfetto tracing test.

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: Iddc716aade3eef2431bcc7eaa8b8b6502edaaa00
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631418
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61857}
2019-05-27 15:05:12 +00:00
Clemens Hammacher
e4db146ac9 Revert "[typedarray] Move external/data pointer to JSTypedArray."
This reverts commit 4b86fea530.

Reason for revert: Fails on linux shared: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20shared/31045

Original change's description:
> [typedarray] Move external/data pointer to JSTypedArray.
> 
> As the next step in supporting huge typed arrays in V8, this moves the
> external/data pointer from the FixedTypedArrayBase backing store to the
> JSTypedArray instance itself, and replaces the special backing stores
> with a plain ByteArray (removing all the code for the FixedTypedArrayBase
> class hierarchy). By doing so, we can drastically simplify the system
> around typed arrays.
> 
> Note: Several places in the code base used to check the instance type
> of the elements backing store of a JSTypedArray instead of checking the
> elements kind on the JSTypedArray map directly. Those had to be fixed,
> since the backing store is now always a ByteArray.
> 
> Drive-by-fix: Move all the typed elements access related code into the
> elements.cc file to properly encapsulate the accesses.
> 
> Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
> Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
> Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
> Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61855}

TBR=ulan@chromium.org,yangguo@chromium.org,titzer@chromium.org,sigurds@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org,szuend@chromium.org

Change-Id: I0bc1f935de6063acf75a0f4bb8c0ba67428603fd
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
Cq-Include-Trybots: luci.chromium.try:linux-rel, win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631427
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61856}
2019-05-27 15:04:08 +00:00
Benedikt Meurer
4b86fea530 [typedarray] Move external/data pointer to JSTypedArray.
As the next step in supporting huge typed arrays in V8, this moves the
external/data pointer from the FixedTypedArrayBase backing store to the
JSTypedArray instance itself, and replaces the special backing stores
with a plain ByteArray (removing all the code for the FixedTypedArrayBase
class hierarchy). By doing so, we can drastically simplify the system
around typed arrays.

Note: Several places in the code base used to check the instance type
of the elements backing store of a JSTypedArray instead of checking the
elements kind on the JSTypedArray map directly. Those had to be fixed,
since the backing store is now always a ByteArray.

Drive-by-fix: Move all the typed elements access related code into the
elements.cc file to properly encapsulate the accesses.

Doc: http://doc/1Z-wM2qwvAuxH46e9ivtkYvKzzwYZg8ymm0x0wJaomow
Bug: chromium:951196, chromium:965583, v8:4153, v8:7881, v8:9183
Change-Id: I8cc06b190c53e34155000b4560f5f3ef40621646
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627535
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61855}
2019-05-27 14:43:46 +00:00
Peter Marshall
d365f62ec1 [tracing] Add a way to test perfetto traces.
Add a new abstract class TraceEventListener which is just an interface
for consuming trace events. This separates the V8-specific stuff that
an actual perfetto consumer needs to do e.g. handling the has_more flag
and signalling back to the controller with a semaphore.

This is a change from the previous plan of making the PerfettoConsumer
class sub-classable to implement custom consumption of trace events.
This will be difficult when the consumer is created outside of the
PerfettoTracingController as we can't hook up the
consumer_finished_semaphore_ that belongs to the controller.

Now the PerfettoTracingController is responsible for the Consumer life-
cycle and hides it entirely from callers. We add the
AddTraceEventListener() method to allow callers to register a listener
either for testing or a JSON listener for real tracing.

This lets us write tests that can store all the trace events in memory
without first converting them to JSON, letting us write test more
easily. There's an example test add to test-tracing - more tests using
this style will follow.

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: I2d2b0f408b1c7bed954144163e1968f40d772c1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628789
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61854}
2019-05-27 14:28:36 +00:00
Michael Starzinger
8c5d0e65c8 [wasm] Add preliminary {WebAssembly.Function.type} support.
This adds a reflective function to retrieve the function type of an
exported or constructed WebAssembly function object. Note that this
first implementation only supports exported functions for now, the
support for constructed functions will be done as a follow-up.

R=jkummerow@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I38a16972d8437521993992ca20887c47c7c6b99b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627989
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61851}
2019-05-27 13:16:28 +00:00
Clemens Hammacher
a335f2aeed [cleanup] Replace simple typedefs by using
This replaces all typedefs that define types and not functions by the
equivalent "using" declaration.

This was done mostly automatically using this command:
ag -l '\btypedef\b' src test | xargs -L1 \
     perl -i -p0e 's/typedef ([^*;{}]+) (\w+);/using \2 = \1;/sg'

Patchset 2 then adds some manual changes for typedefs for pointer types,
where the regular expression did not match.

R=mstarzinger@chromium.org
TBR=yangguo@chromium.org, jarin@chromium.org

Bug: v8:9183
Change-Id: I6f6ee28d1793b7ac34a58f980b94babc21874b78
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631409
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61849}
2019-05-27 12:39:49 +00:00
Toon Verwaest
f58b7e1727 [json] Strings can lie to us about representation, so check what's underneath
Bug: chromium:967151
Change-Id: I54a856cfcc4b4b17bd282dd3eabe5a915e617ca5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630683
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61846}
2019-05-27 10:56:44 +00:00
Simon Zünd
82f6179c63 [array] Prevent negative work array capacity when sorting
When allocating large arrays on 32-bit systems, the length conversion
caused the work array capacity to become negative. As the sort range
is currently clamped at kSmiMaxValue anyway, the fix is to also
clamp the work capacity to that value.

R=jgruber@chromium.org

Bug: chromium:967065
Change-Id: I9ea60464c5b7f3796c5389cbaf668b990eddecf6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630672
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61845}
2019-05-27 10:41:44 +00:00
Thibaud Michaud
bfc6ec999f [wasm] Compile import wrappers in parallel
R=ahaas@chromium.org
CC=​titzer@chromium.org

Bug: v8:9231
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Change-Id: I3de9c839ad43ab37c69b622ccf221dfc429c2e2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1605732
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61839}
2019-05-27 09:36:55 +00:00
Georg Schmid
85f257f4c9 Reland "Make LoadElimination aware of const fields (Part 2; stores)"
This is a reland of e588ff10e5

The only change over the original CL is found in JSCreateLowering::AllocateFastLiteral. We now guard against boilerplate values for unboxed double fields that *look* like legitimate initial values, but should really be kHoleNanInt64 instead.

The underlying problem certainly existed before, but an invariant added to LoadElimination in this CL caused a Chromium layout test to fail. The change in this reland is therefore a workaround, the root cause remains to be fixed. Specifically, we find that a pointer to the undefined value oddball is sometimes reinterpreted as a double and assigned as a boilerplate value. @jarin suspects that this stems from in-place map updates.

Original change's description:
> Make LoadElimination aware of const fields (Part 2; stores)
>
> Adds const information to store field accesses and uses it in load elimination
>
> Change-Id: I00765c854c95c955dabd78557463267b95f75eef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611543
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Schmid <gsps@google.com>
> Cr-Commit-Position: refs/heads/master@{#61796}

Change-Id: Ie388754890024a3ca7d10c9d4d7391442655b426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630676
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#61838}
2019-05-27 09:06:33 +00:00
Jakob Kummerow
ffc7075260 [cleanup] Drop some dead (Macro)Assembler code
Drive-by: fix an #include that the gcov bot is missing

Bug: v8:9183
Change-Id: I35d1b4e346a56799a5f49b7059a658d5ccfe75ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627548
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61837}
2019-05-27 08:53:28 +00:00
Yang Guo
24a51e1eee Move unittest files
R=sigurds@chromium.org

Bug: v8:9247
Change-Id: I25743f048e3e6cd22a18e003e77c8b78f147b630
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630680
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61836}
2019-05-27 08:52:23 +00:00
Simon Zünd
dbf02624c8 [array] Properly handle COW arrays in Array#sort
COW arrays were previously handled in the C++ pre-processing runtime
function.  The Torque version forgot a "EnsureWritableFastElements".
This CL fixes that.

Bug: chromium:967254
Change-Id: Ifbf89e57cfe724e61316b8abc226f7e8a262fce2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630675
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61835}
2019-05-27 08:51:05 +00:00
Z Nguyen-Huu
e846ad9fa5 Implement spec change in some Proxy traps
Pass test262 change in Proxy: defineProperty, deleteProperty, getOwnPropertyDescriptor.

Bug: v8:9228
Change-Id: Id9a2c8dcbfcf68ed2837eb6d5042abcbce7ab0ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1626474
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61832}
2019-05-27 05:04:19 +00:00
Yang Guo
f9a88acbc9 Move remaining files in src/
TBR=mvstanton@chromium.org,neis@chromium.org,ahaas@chromium.org

Bug: v8:9247
Change-Id: I5433c863a54f3412d73df0d38aba3fdbcfac7ebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627973
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61830}
2019-05-24 18:24:36 +00:00
Frank Tang
3846fc3a2e [Intl] Fix Null-der READ IsValidExtension<icu_64::Calendar>
Consider the case that uloc_toLegacyType may return nullptr while
the specified keyword value cannot be mapped to a well-formed legacy type.

Bug: chromium:966285
Change-Id: I40511c54e4835599c002f1c678121341276a4e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627902
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61829}
2019-05-24 16:32:09 +00:00
Simon Zünd
843b6646b1 Reland "[array] Move Array#sort pre-processing to Torque"
This is a reland of 2b0ac2fb9f

The layout test that caused this revert was fixed with:
https://crrev.com/c/1627386

Original change's description:
> [array] Move Array#sort pre-processing to Torque
>
> This CL removes the "PrepareElementsForSort" runtime function, and
> replaces it with a simpler version in Torque. The biggest difference
> is that certain sparse configurations no longer have a fast-path.
>
> The Torque pre-processing step replaces the existing Torque mechanism that
> copied already pre-processed elements into the "work" FixedArray. The Torque
> compacting works as follows:
>   - Iterate all elements from 0 to {length}
>     - If the element is the hole: Do nothing.
>     - If the element is "undefined": Increment undefined counter.
>     - In all other cases, push the element into the "work" FixedArray.
>
> Then the "work" FixedArray is sorted as before. Writing the elements from
> the "work" array back into the receiver, after sorting, has three steps:
>   1. Copy the sorted elements from the "work" FixedArray to the receiver.
>   2. Add previously counted number of "undefined" to the receiver.
>   3. Depending on the backing store either delete properties or
>      set them to the Hole up to {length}.
>
> Bug: v8:8714
> Change-Id: I14eccb7cfd2e4618bce2a85cba0689d7e0380ad2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619756
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61812}

TBR: jgruber@chromium.org
Bug: v8:8714
Change-Id: If7613f6e5f37c5e0d649e8192195594bc6c32100
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627977
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61827}
2019-05-24 12:13:17 +00:00
Simon Zünd
9609ebf3a9 [torque] Fix crash when declaring a variable without type
This CL fixes a crash when "constexpr" is infered from the intializer
expression of a variable declaration.

R=sigurds@chromium.org

Bug: v8:7793
Change-Id: I0ec51280fa145d874424e885905bbf79c93b3904
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627983
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61826}
2019-05-24 12:02:56 +00:00
Andreas Haas
cfcb5f98fc [wasm] Delete legacy comment in test
Deleting this comment addresses feedback of https://crrev.com/c/1627348.
I changed the comment in gerrit but forgot to publish the change.

NOTRY=true
TBR=mstarzinger@chromium.org

Change-Id: Ia76a1fa6dc6c593e559626c9bf9a564f3f09f777
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627986
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61824}
2019-05-24 11:52:07 +00:00
Andreas Haas
d964a1b10e [wasm] Allow initialization of anyref tables
New spec changes allow anyref tables to be initialized with function
references.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I59596e1e383408114b974fa10529ae15b8cf7a15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627348
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61823}
2019-05-24 11:39:56 +00:00
Santiago Aboy Solanes
8306b26a40 [ptr-compr][turbofan] Adding Phi reductions to DecompressionElimination
This reduction replaces the Phi's input decompressions with their parent
node, if and only if all of the Phi's inputs are Decompress nodes.

Also, if we have different Decompress nodes as inputs, we need to use
a conservative decompression after the Phi.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I8cc0264f9d08fe5ad25364f18c9f305afc54529c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624785
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61820}
2019-05-24 10:02:53 +00:00
Tobias Tebbi
d47db12666 Reland^2 "[torque] move class tests to unittests"
This is a reland of c33a1ef227

It seems the revert was based on a flake.

Original change's description:
> Reland "[torque] move class tests to unittests"
>
> This is a reland of f589d56101
>
> Now with an ASAN-container-overflow false positive workaround:
> Somehow ASAN was unhappy about a simple
> std::vector<std::string>::push_back.
> Increasing the std::vector capacity before doing the push_back
> strangely fixes the problem.
>
> Original change's description:
> > [torque] move class tests to unittests
> >
> > This avoids the generation of fake external classes.
> >
> > Bug: v8:7793
> > Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> > Reviewed-by: Simon Zünd <szuend@chromium.org>
> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61778}
>
> TBR: szuend@chromium.org, sigurds@chromium.org
> Bug: v8:7793
> Change-Id: Ifa1958e4d6e850ba27632aa95c7efaf5ca4bfefa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627970
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61807}

Bug: v8:7793
Change-Id: Ia403f1b784500c0903172f13e74c0b325e82599f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627980
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61819}
2019-05-24 09:52:53 +00:00
Sigurd Schneider
c875a64377 [turbofan] Reduce consecutive machine additions with constants
This adds optimizations that apply the reductions
  (x + Int32Constant(a)) + Int32Constant(b)) => x + Int32Constant(a + b)
  (x + Int64Constant(a)) + Int64Constant(b)) => x + Int64Constant(a + b)
to the TurboFan graph.

This helps reducing awkward sequences like
  leaq r12,[r9*8+0x8]
  movq r12,[rbx+r12*1-0x1]
to
  movq r12,[rax+r9*8+0x7]


Change-Id: Iaa3a1cb9136a3f905ba33c62e16c3cb3c117605c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627544
Auto-Submit: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61817}
2019-05-24 08:45:59 +00:00
Simon Zünd
70eeb22d1c Revert "[array] Move Array#sort pre-processing to Torque"
This reverts commit 2b0ac2fb9f.

Reason for revert: Breaks scrollingcoordinator/non-fast-scrollable-region-nested.html layout test on https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Linux%2064/32241 

Original change's description:
> [array] Move Array#sort pre-processing to Torque
> 
> This CL removes the "PrepareElementsForSort" runtime function, and
> replaces it with a simpler version in Torque. The biggest difference
> is that certain sparse configurations no longer have a fast-path.
> 
> The Torque pre-processing step replaces the existing Torque mechanism that
> copied already pre-processed elements into the "work" FixedArray. The Torque
> compacting works as follows:
>   - Iterate all elements from 0 to {length}
>     - If the element is the hole: Do nothing.
>     - If the element is "undefined": Increment undefined counter.
>     - In all other cases, push the element into the "work" FixedArray.
> 
> Then the "work" FixedArray is sorted as before. Writing the elements from
> the "work" array back into the receiver, after sorting, has three steps:
>   1. Copy the sorted elements from the "work" FixedArray to the receiver.
>   2. Add previously counted number of "undefined" to the receiver.
>   3. Depending on the backing store either delete properties or
>      set them to the Hole up to {length}.
> 
> Bug: v8:8714
> Change-Id: I14eccb7cfd2e4618bce2a85cba0689d7e0380ad2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619756
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61812}

TBR=peter.wm.wong@gmail.com,jgruber@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: If1c1bc07f38dfbd4bf6b6ce8f9d70714e7526877
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8714
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627976
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61814}
2019-05-24 07:24:27 +00:00
Clemens Hammacher
b851d753c9 Revert "Make LoadElimination aware of const fields (Part 2; stores)"
This reverts commit e588ff10e5.

Reason for revert: consistently crashes layout tests: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/32225

Original change's description:
> Make LoadElimination aware of const fields (Part 2; stores)
> 
> Adds const information to store field accesses and uses it in load elimination
> 
> Change-Id: I00765c854c95c955dabd78557463267b95f75eef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611543
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Schmid <gsps@google.com>
> Cr-Commit-Position: refs/heads/master@{#61796}

TBR=jarin@chromium.org,neis@chromium.org,tebbi@chromium.org,bmeurer@chromium.org,gsps@google.com

Change-Id: Ia299c36b197c2aad7cfd953b06de06f4536ddb74
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627975
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61813}
2019-05-24 06:28:17 +00:00
Simon Zünd
2b0ac2fb9f [array] Move Array#sort pre-processing to Torque
This CL removes the "PrepareElementsForSort" runtime function, and
replaces it with a simpler version in Torque. The biggest difference
is that certain sparse configurations no longer have a fast-path.

The Torque pre-processing step replaces the existing Torque mechanism that
copied already pre-processed elements into the "work" FixedArray. The Torque
compacting works as follows:
  - Iterate all elements from 0 to {length}
    - If the element is the hole: Do nothing.
    - If the element is "undefined": Increment undefined counter.
    - In all other cases, push the element into the "work" FixedArray.

Then the "work" FixedArray is sorted as before. Writing the elements from
the "work" array back into the receiver, after sorting, has three steps:
  1. Copy the sorted elements from the "work" FixedArray to the receiver.
  2. Add previously counted number of "undefined" to the receiver.
  3. Depending on the backing store either delete properties or
     set them to the Hole up to {length}.

Bug: v8:8714
Change-Id: I14eccb7cfd2e4618bce2a85cba0689d7e0380ad2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619756
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61812}
2019-05-24 06:18:45 +00:00
Francis McCabe
0ef1982ff5 Revert "Reland "[torque] move class tests to unittests""
This reverts commit c33a1ef227.

Reason for revert: fails win32 test:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20nosnap%20-%20shared/33658

Original change's description:
> Reland "[torque] move class tests to unittests"
> 
> This is a reland of f589d56101
> 
> Now with an ASAN-container-overflow false positive workaround:
> Somehow ASAN was unhappy about a simple
> std::vector<std::string>::push_back.
> Increasing the std::vector capacity before doing the push_back
> strangely fixes the problem.
> 
> Original change's description:
> > [torque] move class tests to unittests
> >
> > This avoids the generation of fake external classes.
> >
> > Bug: v8:7793
> > Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> > Reviewed-by: Simon Zünd <szuend@chromium.org>
> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61778}
> 
> TBR: szuend@chromium.org, sigurds@chromium.org
> Bug: v8:7793
> Change-Id: Ifa1958e4d6e850ba27632aa95c7efaf5ca4bfefa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627970
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61807}

TBR=sigurds@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: I079e3ccf2c7a4778e3e6aabee85313ab5a070ee3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1626834
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61808}
2019-05-23 21:38:23 +00:00
Tobias Tebbi
c33a1ef227 Reland "[torque] move class tests to unittests"
This is a reland of f589d56101

Now with an ASAN-container-overflow false positive workaround:
Somehow ASAN was unhappy about a simple
std::vector<std::string>::push_back.
Increasing the std::vector capacity before doing the push_back
strangely fixes the problem.

Original change's description:
> [torque] move class tests to unittests
>
> This avoids the generation of fake external classes.
>
> Bug: v8:7793
> Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61778}

TBR: szuend@chromium.org, sigurds@chromium.org
Bug: v8:7793
Change-Id: Ifa1958e4d6e850ba27632aa95c7efaf5ca4bfefa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627970
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61807}
2019-05-23 20:57:11 +00:00
Jaroslav Sevcik
00be36ec7c [test] Add missing resources to the ObjectFreeze perf test
Bug: chromium:963925
Change-Id: I92c6899ac188e0f3248e1cee93b1a7e28001e29b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627540
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61806}
2019-05-23 18:19:41 +00:00
Francis McCabe
2451ea88ca Revert "[torque] move class tests to unittests"
This reverts commit f589d56101.

Reason for revert: failing win64 asan
https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20ASAN/8653

Original change's description:
> [torque] move class tests to unittests
> 
> This avoids the generation of fake external classes.
> 
> Bug: v8:7793
> Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61778}

TBR=sigurds@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: I762f29a0d3212d2eabfafa48c0e46940d0e6f835
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625863
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61805}
2019-05-23 17:48:04 +00:00
Jaroslav Sevcik
a7e5504d83 [cleanup] Stop using the now-unused deopt_count from feedback vector.
Unfortunately, we still have to keep the field because GC mole and Torque
do not support platform specific padding well
(see http://crbug.com/v8/9287).

Bug: v8:9183
Change-Id: I2210be4b8174c97bc82145605f9b862aac3bdc37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624791
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61802}
2019-05-23 16:34:54 +00:00
Michael Lippautz
aa1b81b697 [heap] Fix global memory scheduling
Rework limit computation:
- Model controller as static classes based on traits.
- Compute growing factors for both controllers and pick the
  larger growing factor for both controllers.
- Factor out limit computation in its own function.

Bug: chromium:948807
Change-Id: Id466a66d7aa573de91ad388ea9218e9f6721d19a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627534
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61801}
2019-05-23 16:20:24 +00:00
Georg Schmid
e588ff10e5 Make LoadElimination aware of const fields (Part 2; stores)
Adds const information to store field accesses and uses it in load elimination

Change-Id: I00765c854c95c955dabd78557463267b95f75eef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611543
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#61796}
2019-05-23 15:06:47 +00:00
Andreas Haas
5cf5992a56 [wasm] Initialize IFT only for table 0
The indirect function table only exists for table 0 at the moment.
Therefore we should initialize it only for table 0.

R=mstarzinger@chromium.org

Bug: chromium:964607
Change-Id: I88a3a5cb5ebec7f0456adc2cebdf5cc499b22761
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624804
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61794}
2019-05-23 14:55:46 +00:00
Michael Starzinger
32e48cf510 [wasm] Support {WebAssembly.Function} object construction.
This makes the WebAssembly function constructor return a proper function
object. Note that the returned object is not yet callable, only the
prototype structure is in place.

R=jkummerow@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: If6a3d0ae7078b5526606eef1b8fd4815353b850b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627343
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61792}
2019-05-23 14:32:44 +00:00
Yang Guo
dec3298d9c Move utility code to src/utils
NOPRESUBMIT=true
TBR=mstarzinger@chromium.org

Bug: v8:9247
Change-Id: I4cd6b79a1c2cba944f6f23caed59d4f1a4ee358b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624217
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61790}
2019-05-23 14:13:34 +00:00
Peter Marshall
4861df10b8 [tracing] Fix perfetto tests
I accidentally broke this with the last CL because the FYI bot does not
block landing.

Add initialization of perfetto when building with perfetto enabled.

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: I10378b72bff731fac6caa75df37a355df4b804dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627345
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61783}
2019-05-23 12:30:59 +00:00
Peter Marshall
d5688b1f23 Reland "[tracing] Add a configurable output stream for perfetto tracing"
This is a reland of a03ed62679

Removed the added test which was failing on win32. The test was unrelated
to the CL; we can add it later.

Original change's description:
> [tracing] Add a configurable output stream for perfetto tracing
>
> Add the ability to provide perfetto with an output stream for the JSON
> consumer rather than hardcode it. D8 will use this interface exclusively
> once the old trace controller is removed.
>
> Also add a test for scope-managed trace events and their duration - this
> was leftover from a previous CL.
>
> Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
> Bug: v8:8339
> Change-Id: I1c45e17e528b549a4cfdaecabd33c7ac4ab4af77
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611801
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61753}

TBR=jgruber@chromium.org, ulan@chromium.org

Bug: v8:8339
Change-Id: I3442a4d111e12947c107e7d0c226ae934acd06e4
Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627334
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61780}
2019-05-23 11:35:07 +00:00
Tobias Tebbi
f589d56101 [torque] move class tests to unittests
This avoids the generation of fake external classes.

Bug: v8:7793
Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61778}
2019-05-23 11:00:31 +00:00
Benedikt Meurer
130f919217 [test] Make tests pass with the GC fuzzer.
The tests need to properly hold on to the original fast-mode map,
otherwise the GC might clear that, and so the NormalizedMapCache
lookup would fail due to that.

Bug: chromium:963411, v8:9114, v8:9183, v8:9267
Change-Id: Ic41ed363959a5c182c74097767dc14c366076e17
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627333
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61772}
2019-05-23 09:08:45 +00:00
Benedikt Meurer
5b46f5736f [cleanup] Remove the Map::IsDictionaryMap() method.
There's a `Map::IsDictionaryMap()` method in addition to the
`Map::is_dictionary_map()`, which apparently do very different things:
The former checks whether the instance type of the Map is in a certain
range (FIRST_DICTIONARY_TYPE to LAST_DICTIONARY_TYPE), while the latter
checks the `is_dictionary_map` bit (which means that the backing store
for the properties of a JSObject is in slow mode). To make matters worse
there's also `CodeStubAssembler::IsDictionaryMap()`, which does the bit
check similar to `Map::is_dictionary_map()`. And to make matters even
worse the FIRST_DICTIONARY_TYPE to LAST_DICTIONARY_TYPE range also
contains instance types for classes that aren't subclass of `Dictionary`
(despite a comment stating the opposite).

So in conclusion it's best to remove the confusing
`Map::IsDictionaryMap()` method, which is anyways wrong, and just test
explicitly for `NameDictionary`, `NumberDictionary` or
`GlobalDictionary` in the appropriate places.

Bug: v8:9183
Change-Id: If35f73261e3cc96938ebf499bf32be3ec725288b
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627330
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61770}
2019-05-23 09:02:26 +00:00
Yang Guo
a0c3797461 Move more relevant files to src/objects
TBR=bmeurer@chromium.org,leszeks@chromium.org

Bug: v8:9247
Change-Id: I8d14d0192ea8c705f8274e8e61a162531826edb6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624220
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61769}
2019-05-23 08:52:30 +00:00
Sigurd Schneider
9aa8b51704 [runtime] Remove explicit OneByte/TwoByte from InternalizeString
The type of the argument makes it clear what we're internalizing, and this
allows us to choose either one based on a template parameter.

Change-Id: I6d7865e7fdef364f6cf10ff9267034df182d7539
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624212
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61765}
2019-05-23 08:02:32 +00:00
Clemens Hammacher
878ccb33bd [cleanup] Avoid {Object::operator->}
This CL was generated by an automatic clang AST rewriter using this
matcher expression:

  callExpr(
    callee(
      cxxMethodDecl(
        hasName("operator->"),
        ofClass(isSameOrDerivedFrom("v8::internal::Object"))
      )
    ),
    argumentCountIs(1)
  )

The "->" at the expression location was then rewritten to ".".

R=jkummerow@chromium.org
TBR=mstarzinger@chromium.org,verwaest@chromium.org,yangguo@chromium.org

Bug: v8:9183, v8:3770
No-Try: true
No-Tree-Checks: true
Change-Id: I0a7ecabdeafe51d0cf427f5280af0c7cab96869e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624209
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61764}
2019-05-23 07:52:07 +00:00
Yang Guo
4c986c625f Move handles-related files to src/handles
Bug: v8:9247
Change-Id: I0023200c54fa6499ae4e2cf5e4c89407cc35f187
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624218
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61762}
2019-05-23 06:00:15 +00:00
Mathias Bynens
b17b72e0a3 Roll Test262 to update RegExp/Unicode tests
https://github.com/tc39/ecma262/issues/1530
https://github.com/tc39/test262/pull/2161

Bug: v8:7834, v8:9131
Change-Id: I9c5efe9d6eec6c5dabc120d1b1089341ed5b1088
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625992
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Auto-Submit: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61760}
2019-05-22 21:57:03 +00:00
Clemens Hammacher
2de2bc8838 Revert "[tracing] Add a configurable output stream for perfetto tracing"
This reverts commit a03ed62679.

Reason for revert: Fails on win32: https://ci.chromium.org/p/v8/builders/ci/V8%20Win32/21252

Original change's description:
> [tracing] Add a configurable output stream for perfetto tracing
> 
> Add the ability to provide perfetto with an output stream for the JSON
> consumer rather than hardcode it. D8 will use this interface exclusively
> once the old trace controller is removed.
> 
> Also add a test for scope-managed trace events and their duration - this
> was leftover from a previous CL.
> 
> Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
> Bug: v8:8339
> Change-Id: I1c45e17e528b549a4cfdaecabd33c7ac4ab4af77
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611801
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61753}

TBR=ulan@chromium.org,yangguo@chromium.org,jgruber@chromium.org,petermarshall@chromium.org

Change-Id: Ie7dbe4fc5f9e496fafc8e3ad2b05011b88c9e2c3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8339
Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625465
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61754}
2019-05-22 15:58:11 +00:00
Peter Marshall
a03ed62679 [tracing] Add a configurable output stream for perfetto tracing
Add the ability to provide perfetto with an output stream for the JSON
consumer rather than hardcode it. D8 will use this interface exclusively
once the old trace controller is removed.

Also add a test for scope-managed trace events and their duration - this
was leftover from a previous CL.

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: I1c45e17e528b549a4cfdaecabd33c7ac4ab4af77
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611801
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61753}
2019-05-22 15:25:31 +00:00
Andreas Haas
d56ee2e3df [wasm][anyref] Cache export wrappers per signature
Up until now, we cached export wrappers per export index. With the
anyref proposal potentially many more functions will need export
wrappers, e.g. any function that is stored in a table, and any
function accessed by the new ref.func instruction.

With this CL, we change the caching scheme an do the caching per
signature. Thereby we can guarantee that any export wrapper which
potentially exists can be stored in the cache.

For cctests which use wasm-run-utils, we don't know the size of the
cache anymore ahead of time. However, we assume that no more than
5 signatures will be used in any cctest. If this assumption is not
true, we can just adjust the number.

The cache is now accessed in all code paths where we need an export
wrapper.

Bug: chromium:962850

Change-Id: I32df60dfa7801d1e71f7d837da091f388198af1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1615247
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61752}
2019-05-22 14:59:50 +00:00
Andreas Haas
4088c521f6 [wasm] Update spec tests
The core spec tests need to be generated manually for now, because our
bots don't have an ocaml installation.

This CL was created automatically by running
./tools/wasm/update-wasm-spec-tests.sh.

R=adamk@chromium.org

Change-Id: I4c6199b51f30b29f150914a9bffe6009452c8c47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624794
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61751}
2019-05-22 14:58:45 +00:00
Santiago Aboy Solanes
af1b77b1a2 [ptr-compr][Turbofan] Adding the TypedStateValues decompress reduction
Decompressions before TypedStateValues can be safely skipped since
TypedStateValues always decompresses values.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: Ic3d43c21183c0decda123cb377706ee5c3c12f87
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1617939
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61738}
2019-05-22 12:25:52 +00:00
Santiago Aboy Solanes
b05ab0af10 [ptr-compr][Turbofan] Word64Equal reducing between decompress and constant
Adding the case of having a decompress and a constant (both HeapConstant
and Int64Constant).

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: Ic9475e9762575e7f6ca2937d832638f7c9897e1d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613253
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61736}
2019-05-22 11:50:03 +00:00
Michael Lippautz
880c3202e0 Reland "[heap] Add global memory controller"
Provide a global memory controller used to compute limits for combined
on-heap and embedder memory. The global controller uses the same
mechanism (gc speed, mutator speed) and growing factors as the regular
on-heap controller.

Rely on V8's mechanisms for configured state that stops shrinking the
limit.

Reland:
- API fixes with overrides and default versions.
- Fix of depending on uninitialized values when using the old API.
- GCTracer: Fixed issue in speed computation.
- GCTracer: Added unittests.

This reverts commit 5e043f2773.

Bug: chromium:948807
Change-Id: I0f81253b3e1a8b49a7ac107c012a15e33cb514d7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622852
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61735}
2019-05-22 11:32:55 +00:00
Tobias Tebbi
52636535fa [turbofan] fix deopt-loop for specuative Boolean to Number conversion
Bug: chromium:965513
Change-Id: I18ff91c98ad6106c5d4df260e6ead6a9e2425dbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622119
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61730}
2019-05-22 10:38:39 +00:00
Santiago Aboy Solanes
e8b5eb4698 [ptr-compr][turbofan] Adding tests in Word64Equal decompression when lhs == rhs
This is a border case that appeared in one of our tests. It seems a good
idea to test for it. It does not seem to be common enough to handle it
specifically (i.e replacing the Word64Equal with a true bool constant)

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I27e85a2493ab03b92591e788a185d6109904eef1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1613252
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61726}
2019-05-22 08:42:14 +00:00
Yang Guo
0fa243af70 Move relevant files to src/execution
Bug: v8:9247
Change-Id: I79e0553e8a0d6dac2aa16b94a6c0e05b6ccde4a1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1621934
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61725}
2019-05-22 08:36:33 +00:00
Michael Achenbach
90059ee5a0 [test] Skip slow test on ppc64
TBR=mythria@chromium.org
NOTRY=true

Bug: v8:9246
Change-Id: I18d6c22da5746d3af34c65ea22fd5ef80e4f13fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622850
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61721}
2019-05-22 06:56:53 +00:00
Andrew Comminos
245a5b38e7 [cpu-profiler] Remove redundant record_samples option
Now that we support a max_samples parameter, it isn't actually necessary
to have a record_samples flag (as it can just be modeled by 0).

Change-Id: I578ecc9f6ee73ecbe1f93d0d04ee8028a9a2716d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611015
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61717}
2019-05-22 06:12:24 +00:00
Clemens Hammacher
7a1f7e8861 Revert "Reland "[heap] Add global memory controller""
This reverts commit dac86be251.

Reason for revert: Still failing msan: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/26904

Original change's description:
> Reland "[heap] Add global memory controller"
> 
> Provide a global memory controller used to compute limits for combined
> on-heap and embedder memory. The global controller uses the same
> mechanism (gc speed, mutator speed) and growing factors as the regular
> on-heap controller.
> 
> Rely on V8's mechanisms for configured state that stops shrinking the
> limit.
> 
> This reverts commit 5e043f2773.
> 
> Tbr: ulan@chromium.org
> Bug: chromium:948807
> Change-Id: Id4f94e7dcb458d1d0d2f872194f8f3ea0959a73f
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622968
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61715}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: If30649f158a08fd185f2771a13b8e09cf53fb667
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:948807
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622849
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61716}
2019-05-22 06:10:45 +00:00
Michael Lippautz
dac86be251 Reland "[heap] Add global memory controller"
Provide a global memory controller used to compute limits for combined
on-heap and embedder memory. The global controller uses the same
mechanism (gc speed, mutator speed) and growing factors as the regular
on-heap controller.

Rely on V8's mechanisms for configured state that stops shrinking the
limit.

This reverts commit 5e043f2773.

Tbr: ulan@chromium.org
Bug: chromium:948807
Change-Id: Id4f94e7dcb458d1d0d2f872194f8f3ea0959a73f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622968
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61715}
2019-05-21 21:50:21 +00:00