Commit Graph

36337 Commits

Author SHA1 Message Date
marja
64d9352a54 Preparsing inner funcs: be less pessimistic about maybe_assigned.
BUG=v8:5501, v8:5678

Review-Url: https://codereview.chromium.org/2539123002
Cr-Commit-Position: refs/heads/master@{#41645}
2016-12-12 14:45:16 +00:00
hablich
1e70454f73 Revert of [heap] Initialize the owner on each page after lospace allocation (patchset #2 id:20001 of https://codereview.chromium.org/2565713002/ )
Reason for revert:
Tree closer: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/12409

Original issue's description:
> [heap] Initialize the owner on each page after lospace allocation
>
> The least two bits of the owner field of a Page are used to determine
> whether the Page is part of a large object. If these bits are not equal
> to 0x11, the page is part of a large object and needs special handling
> e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
> belongs to.
>
> This CL fixes an issue in which the store buffer overflows after
> a large object space allocation but before the object has been fully
> initialized. Store buffer overflow handling attempts to look up the
> chunk of a page, but fails to do so correctly since the page's owner
> field has not yet been initialized.
>
> This CL ensures that the owner field of all pages belonging to a large
> object allocation are initialized to a value that is interpreted
> correctly.
>
> BUG=chromium:672041
>
> Committed: https://crrev.com/9b6808bfb5366beebe3af30a06f9851edb2039d4
> Cr-Commit-Position: refs/heads/master@{#41641}

TBR=mlippautz@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:672041

Review-Url: https://codereview.chromium.org/2562273004
Cr-Commit-Position: refs/heads/master@{#41644}
2016-12-12 14:37:44 +00:00
bradnelson
626d620d4d [wasm][asm.js] Require a number for fround literals.
BUG=673240
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2565343002
Cr-Commit-Position: refs/heads/master@{#41643}
2016-12-12 13:51:25 +00:00
clemensh
c4057d4645 [wasm] Provide correct eval origin for asm.js code
This CL moves all methods related to scripts and eval origin (HasScript,
GetScript, IsEval, GetEvalOrigin) from JSStackFrame to StackFrameBase,
because it also applies to WasmFrames.
This makes the AppendFileLocation method append the same information to
WasmStackFrames and AsmJsWasmStackFrames than to JSStackFrames.

R=titzer@chromium.org, mstarzinger@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2557923005
Cr-Commit-Position: refs/heads/master@{#41642}
2016-12-12 13:31:37 +00:00
jgruber
9b6808bfb5 [heap] Initialize the owner on each page after lospace allocation
The least two bits of the owner field of a Page are used to determine
whether the Page is part of a large object. If these bits are not equal
to 0x11, the page is part of a large object and needs special handling
e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
belongs to.

This CL fixes an issue in which the store buffer overflows after
a large object space allocation but before the object has been fully
initialized. Store buffer overflow handling attempts to look up the
chunk of a page, but fails to do so correctly since the page's owner
field has not yet been initialized.

This CL ensures that the owner field of all pages belonging to a large
object allocation are initialized to a value that is interpreted
correctly.

BUG=chromium:672041

Review-Url: https://codereview.chromium.org/2565713002
Cr-Commit-Position: refs/heads/master@{#41641}
2016-12-12 13:19:07 +00:00
clemensh
222541dff5 [wasm] Generate correct locations for error messages
The current logic in Isolate::GetLocationFromStackTrace just ignores
wasm frames, making the computed location point to the first javascript
frame, like this:

test.js:17: RuntimeError: divide by zero
module.exports.main();
               ^
RuntimeError: divide by zero
    at main (<WASM>[1]+5)
    at test.js:17:16

This CL not only fixes the location to point to the top-most wasm
frame, but also exposes to the embedder that the script of that location
is a wasm script, allowing for custom printing of wasm locations.
The Shell::ReportException method now checks for this flag, and prints
wasm locations like this:

<WASM>[0]+5: RuntimeError: divide by zero
RuntimeError: divide by zero
    at main (<WASM>[0]+5)
    at test/message/wasm-trap.js:15:16

R=titzer@chromium.org, yangguo@chromium.org
BUG=chromium:613110

Review-Url: https://codereview.chromium.org/2563673002
Cr-Commit-Position: refs/heads/master@{#41640}
2016-12-12 12:46:02 +00:00
clemensh
c69b48adc4 [wasm] Handle potentially null callee-pc
This only happens if there is a asm.js-wasm-frame on top of the stack
trace, which was not covered by our tests so far. The regression test
create a stack overflow in asm.js code, triggering this case.

R=mstarzinger@chromium.org
CC=titzer@chromium.org, bradnelson@chromium.org
BUG=chromium:673241

Review-Url: https://codereview.chromium.org/2562333002
Cr-Commit-Position: refs/heads/master@{#41639}
2016-12-12 12:30:39 +00:00
bradnelson
7659728be2 [wasm][asm.js] Forbid function declaration replacing variable declaration.
BUG=673240
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2568773002
Cr-Commit-Position: refs/heads/master@{#41638}
2016-12-12 12:27:14 +00:00
danno
94fb89040b [turbofan] Fix source position integration with Linux perf
Review-Url: https://codereview.chromium.org/2558283002
Cr-Commit-Position: refs/heads/master@{#41637}
2016-12-12 12:25:56 +00:00
petermarshall
291ab70f4b [Turbofan] Add CallConstructWithSpread JSOperator.
Add the operator in preparation for actual perf work. The operator is replaced
by the same runtime call as before, during lowering.

The CallConstructWithSpreadParameters is a bit silly at the moment, but will
hold more once we add feedback.

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2561103003
Cr-Commit-Position: refs/heads/master@{#41636}
2016-12-12 10:44:31 +00:00
neis
80567914c7 [parsing] Fix context allocation for async functions.
For generator-based functions (e.g. async functions) we force variables to be
context-allocated.  Due to a bug in the parser, this didn't always work
correctly.  For instance, in "async function foo([a]) { ... }" the variable "a"
could become stack-allocated due to context allocation being forced on the wrong
scope.

Besides fixing this, I'm also cleaning up some related code in the async parsing
setup and adding some guards.

R=adamk@chromium.org, littledan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2561093002
Cr-Commit-Position: refs/heads/master@{#41635}
2016-12-12 09:57:28 +00:00
jarin
d024df4d22 [turbofan] Fix representation change from bit to tagged pointer.
BUG=chromium:673244

Review-Url: https://codereview.chromium.org/2568053002
Cr-Commit-Position: refs/heads/master@{#41634}
2016-12-12 09:36:47 +00:00
petermarshall
375fc067b0 [Ignition] Fix incorrect arg evaluation order for some super calls.
The evaluation order of this argument was accidentally changed when the
special-case was added for super calls with a final spread argument.

Review-Url: https://codereview.chromium.org/2563423002
Cr-Commit-Position: refs/heads/master@{#41633}
2016-12-12 08:46:01 +00:00
jarin
522815a63b [turbofan] Stage escape analysis to continue getting some coverage.
Review-Url: https://codereview.chromium.org/2566933002
Cr-Commit-Position: refs/heads/master@{#41632}
2016-12-12 08:21:16 +00:00
v8-autoroll
46eb778df1 Update V8 DEPS.
Rolling v8/build: 15a6efa..7321edc

Rolling v8/third_party/icu: dda089a..73e2473

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2569653002
Cr-Commit-Position: refs/heads/master@{#41631}
2016-12-12 04:25:57 +00:00
franzih
9c9c945f18 [interpreter] Add check for max number of operands.
BUG=

Review-Url: https://codereview.chromium.org/2565093003
Cr-Commit-Position: refs/heads/master@{#41630}
2016-12-11 17:11:37 +00:00
v8-autoroll
5561c17ac7 Update V8 DEPS.
Rolling v8/build: ca0069e..15a6efa

Rolling v8/third_party/catapult: 707aaac..19565fd

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2562213002
Cr-Commit-Position: refs/heads/master@{#41629}
2016-12-11 04:24:40 +00:00
v8-autoroll
b20c80df2d Update V8 DEPS.
Rolling v8/build: 50196c9..ca0069e

Rolling v8/third_party/catapult: 0b7222f..707aaac

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2560373002
Cr-Commit-Position: refs/heads/master@{#41628}
2016-12-10 04:21:05 +00:00
gsathya
1f34eb0ab1 [debugger] use abortjs to quit
--asan test config passes --omit-quit which breaks this test on
  failure.

Review-Url: https://codereview.chromium.org/2546093002
Cr-Commit-Position: refs/heads/master@{#41627}
2016-12-10 04:00:08 +00:00
bjaideep
33e651e513 PPC/s390: [x86] Also deal with holey arrays in the Apply builtin.
Port d4f01b8a65

Original Commit Message:

    Add fast paths for holey smi and object arrays to
    Function.prototype.apply, Reflect.apply and Reflect.construct.

R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2566793002
Cr-Commit-Position: refs/heads/master@{#41626}
2016-12-10 01:24:02 +00:00
ulan
a6976211d1 [heap] Relax condition for forced finalization of incremental marking.
Forcing finalization after reaching allocation limit regresses gc pause
time in benchmarks as we have to do a lot of non-incremental marking work.

This patch allows overshoot of the limit by some margin.

BUG=chromium:670675,chromium:671994
TBR=mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2554423005
Cr-Commit-Position: refs/heads/master@{#41625}
2016-12-09 16:23:06 +00:00
bradnelson
25189ffc36 [wasm][asm.js] Check that property keys are literals for imports.
BUG=672785
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2566683002
Cr-Commit-Position: refs/heads/master@{#41624}
2016-12-09 15:58:40 +00:00
mstarzinger
50c5ac57de [deoptimizer] Fix Deoptimizer::GetDeoptInfo for last entry.
This fixes the corner-case where the method in question failed to lookup
the very last deoptimization bailout without subsequent entries within
the relocation info. Also enable a test covering this.

R=tebbi@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2565733002
Cr-Commit-Position: refs/heads/master@{#41623}
2016-12-09 15:06:26 +00:00
bradnelson
89e10055e4 [wasm][asm.js] Allow true/false in int binary ops.
Because the parser optimizes !123 -> false,
we allow booleans in expressions (but not parameter annotations).
Allow this in asm-wasm-builder.
Turn on an early out case in asm-typer that is fine.

BUG=672784
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2561193003
Cr-Commit-Position: refs/heads/master@{#41622}
2016-12-09 15:01:30 +00:00
titzer
768acf683b [wasm] Only do SIMD lowering if SIMD is present in the graph.
R=bradnelson@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2568493002
Cr-Commit-Position: refs/heads/master@{#41621}
2016-12-09 14:57:14 +00:00
yangguo
c9f8e23bbc Switch to std::is_fundamental<>.
Thanks for pointing this out to me!

R=clemensh@chromium.org
BUG=v8:5731

Review-Url: https://codereview.chromium.org/2565743002
Cr-Commit-Position: refs/heads/master@{#41620}
2016-12-09 14:54:32 +00:00
yangguo
75f5200508 [perf-prof] fix crash when logging.
Logging for --perf-prof is not GC safe. Now, we are going to
emit source position info for optimized code when we are
profiling, logging, or debugging, and under the same condition,
pre-compute the line ends array for line number computation.

R=tebbi@chromium.org
BUG=v8:5730

Review-Url: https://codereview.chromium.org/2562973002
Cr-Commit-Position: refs/heads/master@{#41619}
2016-12-09 14:30:38 +00:00
tandrii
5c49df2da6 Whitespace.
NOTRY=True
NOPRESUBMIT=True
TBR=machenbach@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2567513004
Cr-Commit-Position: refs/heads/master@{#41618}
2016-12-09 14:17:43 +00:00
clemensh
0868b76bb1 [wasm] Remove declared but undefined methods
We should really think about having a static analysis to check for
such errors, and a bot executing it regularly.
This is not the first time I encounter declared functions that are
never defined.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2561333002
Cr-Commit-Position: refs/heads/master@{#41617}
2016-12-09 14:01:29 +00:00
mstarzinger
75128636f3 [wasm] Remove obsolete %IsNotAsmWasmCode predicate.
By now the predicate in question is an exact negation of %IsAsmWasmCode
as the name intuitively implies. The need for two separate test methods
no longer exists and one of the two can be removed.

R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2562003002
Cr-Commit-Position: refs/heads/master@{#41616}
2016-12-09 11:56:05 +00:00
jgruber
e127ec00c2 [tools] Fix printed chrome command in callstats
Review-Url: https://codereview.chromium.org/2559723002
Cr-Commit-Position: refs/heads/master@{#41615}
2016-12-09 11:49:10 +00:00
mstarzinger
9fde10ebed [wasm] Cleanup %IsAsmWasmCode testing predicate.
By now the compiler pipeline will not produce optimized code for asm.js
functions unless validation failed (even when --always-opt is enabled).
The related workaround in the testing predicate can be removed.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2549463002
Cr-Commit-Position: refs/heads/master@{#41614}
2016-12-09 11:30:10 +00:00
clemensh
890d28f361 [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- the StackFrame::State struct now also holds the callee_pc_address,
  which is set in ComputeCallerState. The WASM frame uses this
  information to determine whether the callee frame is WASM_TO_JS, and
  whether that frame is at the ToNumber conversion call.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
Review-Url: https://codereview.chromium.org/2555243002
Cr-Original-Commit-Position: refs/heads/master@{#41599}
Cr-Commit-Position: refs/heads/master@{#41613}
2016-12-09 10:30:19 +00:00
jarin
5465651800 [turbofan] Turn off escape analysis.
Too many crashes in Canary.

Review-Url: https://codereview.chromium.org/2554423004
Cr-Commit-Position: refs/heads/master@{#41612}
2016-12-09 10:15:17 +00:00
mstarzinger
5dcda5bb17 [parser] Ensure asm.js modules always allocate context.
The deserialization of the {Scope::asm_module} predicate relies on a
context being present for such modules. This ensures we always allocate
such a context, even in cases where no variables are allocated in it.

R=neis@chromium.org
TEST=cctest/test-parsing/AsmModuleFlag
BUG=v8:5653

Review-Url: https://codereview.chromium.org/2561103004
Cr-Commit-Position: refs/heads/master@{#41611}
2016-12-09 10:12:40 +00:00
yangguo
44c7611931 [debugger] remove remaining uses of the debug command processor.
R=jgruber@chromium.org
BUG=v8:5510

Review-Url: https://codereview.chromium.org/2557043005
Cr-Commit-Position: refs/heads/master@{#41610}
2016-12-09 08:26:35 +00:00
mtrofin
dd10d9b100 [turbofan] regalloc: avoid more redundant intersections
Same idea as in the previous change. In addition, explicitly limited to non-aliased
registers, because the logic there needs to take account of, well, alias IDs. Left a
TODO for that part.

BUG=v8:5644

Review-Url: https://codereview.chromium.org/2565593002
Cr-Commit-Position: refs/heads/master@{#41609}
2016-12-09 06:59:44 +00:00
v8-autoroll
dec3941b72 Update V8 DEPS.
Rolling v8/build: 53448a6..50196c9

Rolling v8/third_party/catapult: 11d3d44..0b7222f

Rolling v8/tools/clang: caccf42..53bdedc

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2563933002
Cr-Commit-Position: refs/heads/master@{#41608}
2016-12-09 06:58:33 +00:00
gsathya
d778b36f0c [promisehook] Add is_promisehook_enabled
This will be used in CSA to check if any promisehook is set.

-- Adds a is_promisehook_enabled_ field to the isolate and helper methods.
-- Adds this field to the ExternalReference table.
-- Adds a helper method to access this from CSA

Note -- this patch doesn't actually add the ability to attach the hook
yet.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2566483002
Cr-Commit-Position: refs/heads/master@{#41607}
2016-12-09 06:57:22 +00:00
zhengxing.li
007a18656e X87: Store OSR'd optimized code on the native context.
port 378b6b22fb (r41554)

  original commit message:
  Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo.
  This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.

BUG=

Review-Url: https://codereview.chromium.org/2559083002
Cr-Commit-Position: refs/heads/master@{#41606}
2016-12-09 06:56:10 +00:00
neis
bb309a6998 [ast] Make --print-scopes indicate a scope's forced context allocation.
R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2552373004
Cr-Commit-Position: refs/heads/master@{#41605}
2016-12-08 23:04:45 +00:00
nverne
5d51583c0c Changes api logging for FunctionTemplate_NewWithCache.
https://codereview.chromium.org/2405213002/ introduced FunctionTemplate::NewWithCache in src/api.cc, but used LOG_API(..., NewWithFastHandler)

BUG=667237

Review-Url: https://codereview.chromium.org/2559643003
Cr-Commit-Position: refs/heads/master@{#41604}
2016-12-08 22:31:01 +00:00
gdeepti
0061089aa0 [wasm] Update WasmMemoryObject correctly when module memory is exported.
BUG=chromium:670683

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2548223002
Cr-Commit-Position: refs/heads/master@{#41603}
2016-12-08 20:30:54 +00:00
mtrofin
43e7d05125 [turbofan] regalloc: avoid redundant range intersections
When finding conflicts, there's no reason to keep looking for registers that are clearly
not going to be available to a candidate live range.

BUG=v8:5644

Review-Url: https://codereview.chromium.org/2559733002
Cr-Commit-Position: refs/heads/master@{#41602}
2016-12-08 19:16:30 +00:00
clemensh
d3d125417d Revert of [wasm] Fix location for error in asm.js ToNumber conversion (patchset #5 id:80001 of https://codereview.chromium.org/2555243002/ )
Reason for revert:
gc-stress failures

Original issue's description:
> [wasm] Fix location for error in asm.js ToNumber conversion
>
> In the asm.js code translated to wasm, we call imported functions via a
> WASM_TO_JS stub, which first calls the function and then calls ToNumber
> on the return value. Exceptions can happen in both calls.
> We were only ever reporting the location of the function call, whereas
> asm.js code executed via turbofan reported the location of the type
> coercion operator ("+" on "+foo()" or "|" on "foo()|0").
>
> This CL implements the same behaviour for asm.js code translated to
> wasm. The following is changed:
> - the AsmWasmBuilder records the parent node when descending on a binary
>   operator (also "+foo()" is represented by a binary operation).
> - it stores not one location per call in the source position side
>   table, but two (one for the call, one for the parent which does the
>   type coercion).
> - the wasm compiler annotates the source positions "0" and "1" to the
>   two calls in the WASM_TO_JS wrapper (only if the module origin is
>   asm.js).
> - during stack trace generation (in the StackTraceIterator), when we
>   move from the WASM_TO_JS frame to the WASM frame, we remember at which
>   call inside the WASM_TO_JS wrapper we are, and encode this information
>   in the generated caller state, used for the WASM frame.
> - the same information is also stored in the FrameArray which is used
>   to reconstruct the stack trace later.
>
> R=titzer@chromium.org, bradnelson@chromium.org
> CC=jgruber@chromium.org
> BUG=v8:4203,v8:5724
>
> Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
> Cr-Commit-Position: refs/heads/master@{#41599}

TBR=bradnelson@chromium.org,mstarzinger@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4203,v8:5724

Review-Url: https://codereview.chromium.org/2563613003
Cr-Commit-Position: refs/heads/master@{#41601}
2016-12-08 17:36:14 +00:00
jochen
6595e74057 Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
we can use them as an index into an array, instead of using a
WeakFixedArray where we have to do a linear scan.

Hooking up liveedit is a bit more involved, see
https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
for an overview

BUG=v8:5589
R=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2547483002
Cr-Commit-Position: refs/heads/master@{#41600}
2016-12-08 17:07:11 +00:00
clemensh
94cd46b55e [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- during stack trace generation (in the StackTraceIterator), when we
  move from the WASM_TO_JS frame to the WASM frame, we remember at which
  call inside the WASM_TO_JS wrapper we are, and encode this information
  in the generated caller state, used for the WASM frame.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Review-Url: https://codereview.chromium.org/2555243002
Cr-Commit-Position: refs/heads/master@{#41599}
2016-12-08 16:48:08 +00:00
franzih
987f63865d [TypeFeedbackVector] Delete unused DummySlot.
BUG=

Review-Url: https://codereview.chromium.org/2557333002
Cr-Commit-Position: refs/heads/master@{#41598}
2016-12-08 15:48:30 +00:00
marja
f36497d2c9 AstValueFactory: add a cache for one-character strings.
Lowercase 1 character strings occur frequently in minified code. Add a
cache for them, so that we don't need to compute the hash + do the hash
table lookup for each occurrence.

BUG=

Review-Url: https://codereview.chromium.org/2541353002
Cr-Commit-Position: refs/heads/master@{#41597}
2016-12-08 15:40:04 +00:00
Ilija.Pavlovic
e8f5adbed2 MIPS[64]: Fix MIPS: Improve Float(32|64)(Max|Min).
Fix 7a6f294ffe.

The first correction enables correct execution DoMathMinMax when two
input registers are the same register.
The second correction adds NOP instructions after branch instructions
in tests macro_float_minmaxf(32|64).

TEST=cctest/test-macro-assembler-mips[64]/macro_float_minmax_f32
     cctest/test-macro-assembler-mips[64]/macro_float_minmax_f64
     mjsunit/regress/math-min
BUG=

Review-Url: https://codereview.chromium.org/2556793003
Cr-Commit-Position: refs/heads/master@{#41596}
2016-12-08 14:57:07 +00:00