Commit Graph

56603 Commits

Author SHA1 Message Date
Mike Stanton
648ff5627e [turbofan] JSHeapBroker logging respects --trace-turbo-filter
As a component of the wider Turbofan logging scheme, it makes sense
for JSHeapBroker logging to come through flags specified in the
OptimizedCompilationInfo class, which uses --trace-turbo-filter
to control which functions are logged.

Bug: v8:7790
Change-Id: I3b068d8be78867ab0bd9607dda9eca4123b9d7b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655297
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62111}
2019-06-12 11:02:38 +00:00
Leszek Swirski
510f4f2c12 Revert "[ic] Fix typo in Runtime_CloneObjectIC_Miss."
This reverts commit 823795fc2b.

Reason for revert: Breaks mjsunit/es9/regress/regress-904167 on bots (https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/26342)

Original change's description:
> [ic] Fix typo in Runtime_CloneObjectIC_Miss.
> 
> https://chromium-review.googlesource.com/1649554 introduced a typo into
> Runtime_CloneObjectIC_Miss, where it wouldn't update the IC state UNLESS
> the source map is deprecated, which is the wrong way around of course.
> 
> Bug: chromium:973045, v8:7611, v8:9114, v8:9183, v8:9343
> Change-Id: I7d6e0709e66ce4aaaf4a628d64ab801b84c8993c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655291
> Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62106}

TBR=bmeurer@chromium.org,verwaest@chromium.org

Change-Id: Ie651523c556b220e57ec5e11e37b0a67936bb291
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:973045, v8:7611, v8:9114, v8:9183, v8:9343
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655299
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62110}
2019-06-12 09:15:43 +00:00
Benedikt Meurer
ea4206556e [counters] Introduce proper bottleneck for FunctionCallback.
API calls made via the CallApiCallback builtin, which is used from the
ICs and optimized code, are currently misattributed to the wrong counter
InvokeFunctionCallback instead of FunctionCallback. In addition we don't
use the C trampoline when only runtime call stats are enabled, but the
Chrome DevTools profiler is not active, which means that these calls
will not be attrituted properly at all, and that had to be worked around
using all kinds of tricks (i.e. disabling fast-paths in ICs when RCS is
active and not inlining calls/property accesses into optimized code
depending on the state of RCS).

All of this was really brittle and only due to the fact that the central
builtin didn't properly check for RCS (in addition to checking for the
CDT profiler). With this fix it's now handled in a central place and
attributed to the correct category, so user code doesn't need to worry
about RCS anymore and can just call straight into the fast-path.

Drive-by-fix: Do the same for AccessorInfo getter calls, which share the
core hand-written native code with the API callback logic.

Bug: v8:9183
Change-Id: Id0cd99d3dd676635fe3272b67cd76a19a9a9cea4
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1651470
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62109}
2019-06-12 09:04:38 +00:00
Nico Weber
c6e6c2c6c5 win: Make v8 build with /Zc:twoPhase, and improve a comment.
The C++ standard says that template functions should be parsed immediately,
and only type-dependent things should be deferred.

cl.exe (MSVC's compiler) instead deferred parsing of all template functions
until the end of the translation unit, and unreferenced template functions
are not parsed at all. clang-cl emulates cl.exe's behavior.

Recently, cl.exe (and clang-cl) grew a /Zc:twoPhase flag that opts in to the
standards-conforming behavior, and system headers are now clean enough
to build with this flag set.

This cleans up v8 to also build with this flag. There was just a single issue:
RecyclingZoneAllocator() is unused and contains invalid code: It calls
the superclass ctor using `ZoneAllocator(nullptr, nullptr)`, when it should
be doing `ZoneAllocator<T>(nullptr, nullptr)`. With /Zc:twoPhase, this is
now a parsing error. However, since the RecyclingZoneAllocator() default
constructor isn't used anywhere, just delete it.

Finally, improve the comment for ZoneAllocator's default constructor to
explain why it's needed on Windows.

Bug: chromium:969702
Change-Id: I7a516afde67fe090a512d7c7214a3c6932754aca
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652503
Auto-Submit: Nico Weber <thakis@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62108}
2019-06-12 08:56:58 +00:00
Igor Sheludko
0ebc2b6d76 [ptr-compr][cleanup] Remove ROOT_PARAM, ROOT_VALUE and friends
... in favor of Isolate*. It seems that it's better to be uniform in
using Isolate* or isolate root value, so if we decide to pass isolate
root value instead of Isolate* it should better be done everywhere and
it will be a separate CL anyway.

Regarding the "optionality" of the isolate parameter - C++ compilers
are smart enough to optimize it away during inlining.

Bug: v8:9353
Change-Id: Idf86a792476f49393041ced1c54b8671f5b1794a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653121
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62107}
2019-06-12 08:46:48 +00:00
Benedikt Meurer
823795fc2b [ic] Fix typo in Runtime_CloneObjectIC_Miss.
https://chromium-review.googlesource.com/1649554 introduced a typo into
Runtime_CloneObjectIC_Miss, where it wouldn't update the IC state UNLESS
the source map is deprecated, which is the wrong way around of course.

Bug: chromium:973045, v8:7611, v8:9114, v8:9183, v8:9343
Change-Id: I7d6e0709e66ce4aaaf4a628d64ab801b84c8993c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655291
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62106}
2019-06-12 08:45:38 +00:00
Frank Tang
1945392a4e [Intl] Fix RegExp [\W] with i flag
Add special condiction in
ecma262 #sec-runtime-semantics-canonicalize-ch Step 3.g-h.

Bug: chromium:971636
Change-Id: Id533beb66749af6e38ee114cf79f995a1156df20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652795
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62105}
2019-06-12 06:18:08 +00:00
v8-ci-autoroll-builder
de93514575 Update V8 DEPS.
Rolling v8/build: aeede42..4b9a126

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/ace1f8b..4d6b614

Rolling v8/third_party/depot_tools: fd919c8..374a128

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: Ie258068eb50ca488b2bbc7a247a5e1d22bd8094d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1654522
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62104}
2019-06-12 03:23:48 +00:00
Guanzhong Chen
beaf1073bd [wasm] use standard WebAssembly stack trace format
Currently, in wasm-function stack traces, v8 displays the decimal offset
from the start of the function. However, the WebAssembly WebAPI
specification says that it should be a hex offset into the module.

This change makes the stack trace display with hex module offsets, as
well as fixing all the unit tests that depended on the old behaviour.

R=fgm@chromium.org, titzer@chromium.org, yangguo@chromium.org

Bug: v8:9172
Change-Id: I73737a319a42dd665521ab8a4b825199ae11c87f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646846
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Guanzhong Chen <gzchen@google.com>
Cr-Commit-Position: refs/heads/master@{#62103}
2019-06-11 18:03:24 +00:00
Johannes Henkel
af927dac49 [DevTools] Remove V8InspectorSession::stateJSON().
https://chromium.googlesource.com/v8/v8.git/+/refs/heads/7.6-lkgr/include/v8-inspector.h
has the V8_DEPRECATED method.

And looks like
https://chromium.googlesource.com/v8/v8.git/+/refs/heads/7.7.1
has been cut, so this is no longer needed.

Change-Id: I9db414df4900fc24cd6789708464f9d90bfb64f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649344
Reviewed-by: Alexei Filippov <alph@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Johannes Henkel <johannes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62102}
2019-06-11 17:39:56 +00:00
Z Nguyen-Huu
f4d2ccc3df add micro-benchmark for Proxy with PreventExtensions trap
Bug: v8:6664
Change-Id: Iaef787b3b0c2a24de57b7c3a5c4e75e5a723228e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652061
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62101}
2019-06-11 17:27:36 +00:00
Georg Schmid
f8ec0ac5a1 [csa] Enable more early CSA optimizations
R=tebbi@chromium.org

Change-Id: Iab4b0a69028386e79b9abdbcaee7fdb10871042f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653119
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62100}
2019-06-11 16:09:38 +00:00
Caitlin Potter
750e48ea67 Remove always-enabled --harmony-hashbang flag
It was a good flag, but it's time to say goodbye. Let us take a moment
to remember the good times we've had during its short time on earth.

It shipped in Chrome 74.

BUG=v8:8523
R=adamk@chromium.org, mathias@chromium.org, gsathya@chromium.org

Change-Id: I37e58360614c0bb3582b8bbfac795d5ed3e5a149
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1641205
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#62099}
2019-06-11 15:47:08 +00:00
Georg Schmid
b536240340 Re-enable double const store check under v8_enable_test_features flag
R=machenbach@chromium.org, tebbi@chromium.org

Change-Id: I99a5d5200ef7e0e812a2bf1e22a5f8ff813a1ca6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653117
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#62098}
2019-06-11 14:56:15 +00:00
Jose Dapena Paz
3b8c624bda GCC: explicitely instantiate JSObject::ApplyAttributesToDictionary for NumberDictionary
elements.cc invokes ApplyAttributesToDictionary using NumberDictionary as its template
parameter. But the declaration of the template method is in js-object.cc, so nobody
can actually compile the version for number dictionary. This is fixed requesting
explicit instantiation for NumberDictionary.

This was breaking GCC build.

Bug: chromium:819294
Change-Id: I685ddc5b97e129d1a534dbdb04025c0932bc5ecd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649565
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: José Dapena Paz <jose.dapena@lge.com>
Cr-Commit-Position: refs/heads/master@{#62097}
2019-06-11 14:36:05 +00:00
Z Nguyen-Huu
bf3202c8b8 Optimize hasOwnProperty for sealed, frozen objects.
Extend CodeStubAssembler::TryLookupElement() to handle frozen/sealed elements.
Also add some tests.

~2x perf improvement in micro-benchmark ObjectFreeze
Before:
TaggedTemplate
TaggedTemplate-Numbers(Score): 2.43
HasOwnProperty
HasOwnProperty-Numbers(Score): 2.94

After:
TaggedTemplate
TaggedTemplate-Numbers(Score): 4.77
HasOwnProperty
HasOwnProperty-Numbers(Score): 4.68

Bug: v8:6831
Change-Id: I6ce057fd812cd6a01e627125a51eefa439710274
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1650633
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62096}
2019-06-11 14:18:05 +00:00
Joyee Cheung
d2ccc599c7 [snapshot] print reference stack for JSFunctions in the isolate snapshot
This helps debugging incorrect usage of the SnapshotCreator API in
debug mode.

Change-Id: Ibd9db76a5f460cdf7ea6d14e865592ebaf69aeef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648240
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62095}
2019-06-11 13:52:15 +00:00
Dan Elphick
081e5070f0 [wasm] Use builtin addresses directly for Wasm conversions
Changes calls to conversion builtins in Wasm wrappers to use the builtin
address directly rather than going via the Code object which results in
the trampoline being unnecessarily executed.

Bug: v8:9338
Change-Id: I74593dbda3c8bd308be65bc98ce85213a98f78b5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648274
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62094}
2019-06-11 13:33:35 +00:00
Z Nguyen-Huu
0db46e6a41 add new micro-benchmark of HasOwnProperty for frozen objects
Bug: v8:6831
Change-Id: I906dcc363620fda97f00cb02b68c3e393471076d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1651144
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62093}
2019-06-11 13:28:25 +00:00
Simon Zünd
aff3e0fbd7 [torque] Lint errors for unused macros
This CL adds lint errors for unused Torque macros. To prevent lots of
noisy warnings, the check is rather narrow. Macros declared as "extern"
or marked with "@export" are ignored. Also macros starting with "Convert",
"Cast" or "FromConstexpr" are not checked.

Drive-by: Removing some unused macros.

Bug: v8:7793
Change-Id: Ie0d2e445f8882a9b0ebbda45876b342abf341248
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645312
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62092}
2019-06-11 13:14:08 +00:00
Dan Elphick
99f8850294 Revert "Enable lazy source positions by default"
This reverts commit 69fafb5fe3.

Reason for revert: V8 Linux64 GC Stress - custom snapshot
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/26291

Original change's description:
> Enable lazy source positions by default
> 
> Also adds a compile time flag which allows the default to be configured
> so node can disable it since it hangs the node cpu profiler tests.
> 
> Bug: v8:8510
> Change-Id: Idf4785036dc6242769410091518a67ac9179b718
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1491491
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62089}

TBR=rmcilroy@chromium.org,delphick@chromium.org

Change-Id: I92a64ddc63e36ec326e6d8ba1a5b68af38e3134b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8510
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653112
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62091}
2019-06-11 13:12:57 +00:00
Jakob Gruber
d766d6d5a3 [error] Use prepareStackTrace from error's realm
An error object's 'stack' property is lazily formatted once the
property is first read. It is thus possible that lazy formatting
happens in a different realm than where the error object was
constructed.

In this case, we should use the origin-realm's prepareStackTrace
function to format the stack trace.

This CL implements that behavior by fetching prepareStackTrace from
the given error object's context's error function.

Bug: v8:7848
Change-Id: Ibc383cf24f2c0dab2fd8bb7bc740f1488d9954a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1113438
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62090}
2019-06-11 13:02:45 +00:00
Dan Elphick
69fafb5fe3 Enable lazy source positions by default
Also adds a compile time flag which allows the default to be configured
so node can disable it since it hangs the node cpu profiler tests.

Bug: v8:8510
Change-Id: Idf4785036dc6242769410091518a67ac9179b718
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1491491
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62089}
2019-06-11 12:29:52 +00:00
Igor Sheludko
4672bea51f [ptr-compr] Pass Isolate to JSObject::[Try]MigrateInstance()
Bug: v8:9353
Change-Id: If184e02eef8cda459a3aa02ef8bee5c337177d30
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648264
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62088}
2019-06-11 12:10:41 +00:00
Dan Elphick
e34a236259 Fix BytecodeArrayVerify with lazy source positions
Add exception to possible type for the source position table.

Bug: v8:8510
Change-Id: Ia97bba2b88d80ca572be21f236ad85448b6dd6f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1653110
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62087}
2019-06-11 11:54:10 +00:00
Simon Zünd
71d1f5e33c [cleanup] Narrow types for StackFrameInfo and StackTraceFrame
This CL changes the types of some fields on StackFrameInfo and
StackTraceFrame from the generic 'tagged' value, to more specific
types. This improves the auto-generated object verifiers.

Bug: v8:8742
Change-Id: Ica7f34a61798fb7ab0655ffa269ba86afe8a52fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649788
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62086}
2019-06-11 11:40:40 +00:00
Simon Zünd
da6543108d [torque] Add lint error for 'let' bindings that can be 'const'
This CL adds a lint error for variables that are unnecessarily bound
with 'let' when they could be bound using 'const. This test is skipped
for struct types. For struct types, the "constness" also depends on
the struct methods called and whether these methods write to the struct
or not. This is not straight-forward to detect.

Drive-by: Fix all the newly introduced lint errors.

Bug: v8:7793
Change-Id: I0522ffcc4321350eef2e9573b8430bc78200ddce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645322
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62085}
2019-06-11 11:29:21 +00:00
Igor Sheludko
7304d116d3 [ptr-compr] Pass Isolate to JSObject::NormalizeProperties()
Bug: v8:9353
Change-Id: Iefeaa8820d3fcccafd92af1ea5e95001fc8ab951
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648262
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62084}
2019-06-11 11:11:10 +00:00
Benedikt Meurer
12e2f1ac4c [ic] Various cleanups to the IC class.
This includes a bunch of individual changes:

 - Refactor IC::OnFeedbackChanged() and remove the now unused
   GetHostFunction().
 - Remove constant_pool, pc and fp from the IC, since it was
   only used for --trace-ic by now, and here we can now use the
   JavaScriptFrameIterator instead.
 - Use FLAG_max_polymorphic_map_count consistently instead of having a
   separate kMaxKeyedPolymorphism constant in some cases.
 - Remove dead IC::TraceHandlerCacheHitStats() method.
 - Remove the unused maybe_handler_ field.

Bug: v8:9183
Change-Id: I29680519ab84b2790c73f50fca966a66918a7e31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649567
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62083}
2019-06-11 10:43:22 +00:00
Igor Sheludko
d0d877067e [ptr-compr] Pass Isolate to JSObject::MigrateToMap() and friends
Tbr: ulan@chromium.org
Bug: v8:9353
Change-Id: I99533e21fd186f6d0191f4f500d1a3055a0f92c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648260
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62082}
2019-06-11 09:58:36 +00:00
Simon Zünd
4d70d33c27 [cleanup] Move GlobalContext constructor to new .cc file
This CL creates global-context.cc and moves the GlobalContext
constructor impl to this new file. Preparatory refactoring for import
syntax.

This CL also removes one unused static method from GlobalContext
and changes two use-sites where Get() was used together with a static
accessor.

Drive-by: "Include what you use" for global-context.h

Bug: v8:9183
Change-Id: Iafd877d03af9ad65b1c99ebd9743be64192f45c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649790
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62081}
2019-06-11 09:38:46 +00:00
Simon Zünd
b69a48e1fe [torque] Introduce 'import' syntax
This CL introduces an 'import' statement. It does not produce any AST
node. The AST contextual directly collects what source id imports what other
source id.

Currently the import map is unused. In the future, import syntax will be
used to implement partial compilation.

Bug: v8:7793
Change-Id: I5f09e6254d7ca2e7bc1a93d2e2d82e202cafc8ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649357
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62080}
2019-06-11 09:33:06 +00:00
Benedikt Meurer
0226a00880 [cleanup] Make ChangeNumberToFloat64() require TNode<Number>.
This addresses a TODO and makes the CAST explicit at the use sites,
which in turn makes it easier to understand the implications there.

Bug: v8:9183
Change-Id: I5b285a5a0ba6b754b4de9d60ff6e18c2e807bf98
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649569
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62079}
2019-06-11 09:31:16 +00:00
Simon Zünd
0381794b8c Add tests for accessing Error.stack on error objects in dictionary mode
This CL adds two mjsunit tests that transition an error object to
dictionary mode before and after Error.stack is formatted and verify
that the custom 'stack' property accessor works as intended.

Bug: v8:8742
Change-Id: I4beb52c75b94533c10fac007f41117ab8915fac8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649789
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62078}
2019-06-11 09:16:43 +00:00
Maya Lekova
06930f7420 Revert "Add Crash Keys support"
This reverts commit 02103b276b.

Reason for revert: Speculative revert for breakage on roll:
https://chromium-review.googlesource.com/c/chromium/src/+/1650264

Failing build in breakpad:
https://ci.chromium.org/p/chromium/builders/try/linux_chromium_asan_rel_ng/298512

Original change's description:
> Add Crash Keys support
> 
> This adds crash keys containing the isolate address and addresses of
> the read_only, map, and code spaces to crash report minidumps.
> When not compiling V8 with Chrome, a noop implementation is used.
> 
> Bug: v8:9323
> Change-Id: I8523630e7a4ff792855163c06bf76dab35b1b9e5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1641326
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#62059}

TBR=jkummerow@chromium.org,tmrts@chromium.org,irinayat@microsoft.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9323
Change-Id: I29138292dd474cf60e2bf3cc9b0629a085abd31c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649787
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62077}
2019-06-11 08:49:52 +00:00
Simon Zünd
05611feb34 [stack-trace] Always return lazy wrapper objects from CaptureStackTrace
This CL is the starting point to convert all FrameArray users to
use StackTraceFrame objects instead.

Bug: v8:8742
Change-Id: I7bd0081dfd428e9914dedebd5065ac262aacec0b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627332
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62076}
2019-06-11 08:35:09 +00:00
Simon Zünd
ef2ba53449 Append short strings by copying in string builder
This CL changes IncrementalStringBuilder to write short strings
directly to {current_part_} instead of shortening {current_part},
allocating a new part and concatenate everything using ConsString.

This optimization requires the IncrementalStringBuilder to either
use two byte encoding, or the incoming string is flat with one byte
representation.

This CL improves stack trace serialization micro benchmarks up to 10%.

Bug: v8:8742
Change-Id: I5cc8339be8035c42438381883544d108591fb945
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647696
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62075}
2019-06-11 08:06:16 +00:00
Oliver Dunk
563290194f Add quotes around unexpected token SyntaxError
Quotes have been added around the token to make the message clearer.

Bug: chromium:943636
Change-Id: Ic38f3e6d307157af2c0146e69fb611a2cfb46564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1593307
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62074}
2019-06-11 06:11:58 +00:00
v8-ci-autoroll-builder
d1b6d7221f Update V8 DEPS.
Rolling v8/build: bc47a86..aeede42

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/93cd912..ace1f8b

Rolling v8/third_party/depot_tools: e30736f..fd919c8

Rolling v8/third_party/googletest/src: 31200de..076b7f7

Rolling v8/tools/clang: 7789751..fe6c647

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: Ibf4480540dff2019e4b28a27a18cd771f419442e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1652116
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62073}
2019-06-11 03:39:18 +00:00
Yu Yin
6a912adb8a [mips][lite] Allocate FeedbackCell arrays for create closures in lite mode
port https://crrev.com/c/1339866
     https://crrev.com/c/1511274

Change-Id: Iea6bd86cfeb4230316ff3416d744fa9f4598a75f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649260
Auto-Submit: Yu Yin <xwafish@gmail.com>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#62072}
2019-06-11 01:38:55 +00:00
Z Nguyen-Huu
659010ec71 Handle IC store with sealed elements
The path for sealed elements is handled by using the same path for SmiOrObjectElementKind, just need to extend a DCHECK in CodeStubAssembler::IsFixedArrayWithKind.
The only special case is when we write to a hole in holey sealed elements. Since we can not write in that case, just bail out.

Bug: chromium:967101
Change-Id: Ibf837ae053fe609bca83da432f298ef056f3aced
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632830
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62071}
2019-06-10 19:54:17 +00:00
Z Nguyen-Huu
c9c914f954 Reland: Extend IsExtensible proxy trap fast path for Reflect.isExtensible
This is reland of Ib1c3f78d1f1a44c6628d351fed3bcdc91ca08cb5
Just fix lint error for unused arguments in Torque.

> Original commit message:

> The fast path for IsExtensible proxy trap is already implemented, we just need to use this for ReflectIsExtensible.
Now, ReflectIsExtensible is now a Torque builtin (previously CPP). Other cases will fall back to runtime.

> Bug: v8:6664
> Change-Id: Ib1c3f78d1f1a44c6628d351fed3bcdc91ca08cb5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1645438
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Tamer Tas <tmrts@chromium.org>
> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#62031}

Bug: v8:6664
Change-Id: If44ac321ce712a969b3f5076411573eb3968cc14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1646900
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62070}
2019-06-10 18:24:27 +00:00
Samuel Huang
29a40cac8e Revert "Reland "Enable lazy feedback allocation""
This reverts commit 333615cfc2.

Reason for revert: Likely culprit for browser_tests netinfo/gc-unused-listeners.html failure for "Win10 Tests x64".

Original change's description:
> Reland "Enable lazy feedback allocation"
> 
> This is a reland of 8c10501be5.
> Reland after fixing test failures.
> 
> Original change's description:
> > Enable lazy feedback allocation
> >
> > Bug: v8:8394
> > Change-Id: I29ffd38725bdcaa9dd11221045dba681eb0d567b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643430
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Commit-Queue: Mythri Alle <mythria@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61991}
> 
> Bug: v8:8394
> Change-Id: Icc9e276ab22ca6455b775f3c27e0d43c3f08b887
> TBR: rmcilroy@chromium.org
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647161
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62018}

TBR=rmcilroy@chromium.org,mythria@chromium.org,delphick@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8394
Change-Id: Id977275f4d53a39c2372f289f2b0471efae241b3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1650275
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62069}
2019-06-10 13:29:43 +00:00
v8-ci-autoroll-builder
5d0880de50 Update V8 DEPS.
Rolling v8/build: a9a3ecc..bc47a86

Rolling v8/tools/clang: 7ee072e..7789751

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: Ibdb327d012a1551f1c0a4da95b3d4e1cf772da13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1650278
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62068}
2019-06-10 03:44:45 +00:00
v8-ci-autoroll-builder
5200c5797e Update V8 DEPS.
Rolling v8/build: d39a2f6..a9a3ecc

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/fafbed9..93cd912

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I51012040d44d452249562eac18ef8a335058d314
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648673
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62067}
2019-06-09 23:58:05 +00:00
v8-ci-autoroll-builder
7253732015 Update wasm-spec.
Rolling v8/test/wasm-js/data: 41747be..7940fa4

[test] Fix unintended errors in negative tests (#1034) (Erik McClure)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/7940fa4

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I4bb02e1314966f9526dcfb5fdf75fc6b55c0e711
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1651161
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62066}
2019-06-09 23:56:55 +00:00
Benedikt Meurer
848379c34f [cleanup] Remove obsolete comment.
The introduction of the FeedbackVector solved the problem of
inconsistent feedback between ICs in unoptimized and optimized
code.

Bug: v8:2029, v8:9183
Tbr: jkummerow@chromium.org
Change-Id: Id61033c1661e5a2efb740988552de76f7f148d0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649566
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62065}
2019-06-08 17:57:02 +00:00
Benedikt Meurer
92c6af8a2d [interpreter] Do ToObject implicitly as part of CloneObject.
The CloneObject bytecode was only able to handle objects, null and
undefined, and explicit bytecode had to be generated to perform the
ToObject outside the bytecode (unlike the other IC bytecodes that
just perform the ToObject implicitly). That means the simplest possible
object cloning would also generate a sequence of 5 bytecodes (at least):

```
   Mov <register>, a0
   JumpIfNull @1
   JumpIfUndefined @1
   ToObject <register>
1: CloneObject <register>
```

That is quite wasteful and unnecessary, since the core logic in the
runtime already does the ToObject properly anyways. This change
refactors the CloneObjectIC slightly to behave more like the other ICs
and do the ToObject implicitly when necessary.

Bug: v8:7611, v8:9114, v8:9183, v8:9343
Change-Id: I11973e90bf875f154a5a7739287bee17041e4a7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649554
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62064}
2019-06-08 17:42:12 +00:00
Ben Smith
8bf9ba4e7c [wasm] Add unittest for PrintWasmText
PrintWasmText is used for disassembling wasm code in DevTools, but many
instructions are not implemented. This test should make it easier to
remember to implement this when adding new instructions.

Change-Id: I6030a70113320f11a1ac0436bf0d220b5c41e6d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647475
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62063}
2019-06-08 12:39:07 +00:00
Jakob Kummerow
05e3b64132 [ubsan] Fix a few double-to-float casts
The DoubleToFloat32 helper takes care of everything, so use it
consistently.

Bug: chromium:969498
Change-Id: If71e5374684b89615006548cb0329f4d4cb7fd6d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1648253
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Auto-Submit: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62062}
2019-06-08 12:38:02 +00:00