BailoutId points to the next bytecode in the bytecode array. Code offset
is set to one less than the bail out id. This would point to the end of the
current instruction. Since we use it only for summarizing the frame and to
compute the source position, it should be safe to set it to the end of current
instruction.
BUG=v8:4280, v8:4689
LOG=N
Review URL: https://codereview.chromium.org/1763783003
Cr-Commit-Position: refs/heads/master@{#34580}
This is a pure refactoring and renaming of methods in the compiler API
with the goal to increase readability. Also the compiler API is moved to
the top of the file, as it is the central piece in that file.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/1766623004
Cr-Commit-Position: refs/heads/master@{#34579}
This adds sanitizer-coverage compilation, test-runner
features and post processing.
Sanitizer coverage is expected to be used together with
asan.
During test runner execution, the produced sancov files
are disambiguated and match the pattern:
<executable name>.test.<test id>.sancov.
Two additional scripts are added for merging raw sancov
files and for generating json data containing all
instrumented lines + all covered lines from merged sancov
files. Both scripts use multiprocessing for speed.
The json data will later be uploaded to google storage
for further use, e.g. to show coverage data in rietveld.
Sancov documentation:
http://clang.llvm.org/docs/SanitizerCoverage.html
BUG=chromium:568949
LOG=n
NOTRY=true
TEST=python -m unittest sancov_formatter_test
TEST=python -m unittest sancov_merger_test
Review URL: https://codereview.chromium.org/1737263003
Cr-Commit-Position: refs/heads/master@{#34578}
This changes the compiler API that finalizes a previously queued
optimization job on the main thread, to not deal with code objects
directly. This is in sync with the rest of the API now.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/1773663003
Cr-Commit-Position: refs/heads/master@{#34577}
Before this CL, various code stubs used different techniques
for marking their frames to enable stack-crawling and other
access to data in the frame. All of them were based on a abuse
of the "standard" frame representation, e.g. storing the a
context pointer immediately below the frame's fp, and a
function pointer after that. Although functional, this approach
tends to make stubs and builtins do an awkward, unnecessary
dance to appear like standard frames, even if they have
nothing to do with JavaScript execution.
This CL attempts to improve this by:
* Ensuring that there are only two fundamentally different
types of frames, a "standard" frame and a "typed" frame.
Standard frames, as before, contain both a context and
function pointer. Typed frames contain only a minimum
of a smi marker in the position immediately below the fp
where the context is in standard frames.
* Only interpreted, full codegen, and optimized Crankshaft and
TurboFan JavaScript frames use the "standard" format. All
other frames use the type frame format with an explicit
marker.
* Typed frames can contain one or more values below the
type marker. There is new magic macro machinery in
frames.h that simplifies defining the offsets of these fields
in typed frames.
* A new flag in the CallDescriptor enables specifying whether
a frame is a standard frame or a typed frame. Secondary
register location spilling is now only enabled for standard
frames.
* A zillion places in the code have been updated to deal with
the fact that most code stubs and internal frames use the
typed frame format. This includes changes in the
deoptimizer, debugger, and liveedit.
* StandardFrameConstants::kMarkerOffset is deprecated,
(CommonFrameConstants::kContextOrFrameTypeOffset
and StandardFrameConstants::kFrameOffset are now used
in its stead).
LOG=N
Review URL: https://codereview.chromium.org/1696043002
Cr-Commit-Position: refs/heads/master@{#34571}
Rolling v8/build/gyp to 61259d585ce99d9de8b35188cd0025bdbcb58411
Rolling v8/tools/clang to 7f949627a42e2b8b229522ab74de5b1b6a1ced3e
TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
Review URL: https://codereview.chromium.org/1768263003
Cr-Commit-Position: refs/heads/master@{#34568}
When possible (non-Proxy receiver, expecting only String-names), walk the instance_descriptors() array rather than performing [[OwnPropertyKeys]]. If the map changes during a call to an accessor property, resort to a slower property lookup.
For now, the fast path is not taken if the object contains any element keys.
Offers a measurable improvement over the existing version, in select situations.
BUG=v8:4663
LOG=N
R=cbruni@chromium.org, verwaest@chromium.org, adamk@chromium.org
Review URL: https://codereview.chromium.org/1751643003
Cr-Commit-Position: refs/heads/master@{#34567}
In case when F tail calls G we should also remove the potential arguments adaptor frame for F.
This CL introduces two new machine instructions ArchTailCallCodeObjectFromJSFunction and ArchTailCallJSFunctionFromJSFunction which (unlike existing ArchTailCallCodeObject and ArchTailCallJSFunction) also drop arguments adaptor frame if it exists right before jumping to the target function.
BUG=v8:4698
LOG=N
Review URL: https://codereview.chromium.org/1702423002
Cr-Commit-Position: refs/heads/master@{#34566}
Local declarations were previously encoded as an optional set of
4 uint16 values as part of the function declaration. This CL
implements the current design of moving these declarations to
a list of pairs of (type, count) that is part of the body.
R=bradnelson@chromium.org,binji@chromium.org
BUG=
Review URL: https://codereview.chromium.org/1763433002
Cr-Commit-Position: refs/heads/master@{#34564}
Simply call InitializeForOfStatement (split out from InitializeForEachStatement)
instead, which already has all the necessary logic.
As part of this, trade one bool arg (is_destructuring) for an int
(iterable_pos).
Review URL: https://codereview.chromium.org/1740293002
Cr-Commit-Position: refs/heads/master@{#34561}
This avoids a minor unnecessary inefficiency (GetRoot) in setting up the LookupIterator.
BUG=
Review URL: https://codereview.chromium.org/1767123002
Cr-Commit-Position: refs/heads/master@{#34560}
Since we record slots for weak list fields, there is no need to iterate over
them after evacuation. We just need to update the roots for which we didn't
record slots.
This speeds up the evacuate_update_pointers_weak phase by ~2.5x.
BUG=
Review URL: https://codereview.chromium.org/1772803002
Cr-Commit-Position: refs/heads/master@{#34555}
This moves the post-instantiation work performed on newly allocated
JSFunction objects into the Compiler class. The aim is to eventually
have all decisions how to compile functions be centralized within the
compiler pipeline.
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/1764023003
Cr-Commit-Position: refs/heads/master@{#34550}
The ES2015 specification requires that String.prototype.startsWith,
String.prototype.endsWith and String.prototype.includes use the IsRegExp
internal algorithm to determine whether to throw a TypeError to prevent
a RegExp from being accidentally cast to a String for those methods.
That internal algorithm checks the presence/truthiness of Symbol.match
to make its determination. This patch switches the builtins to use
this correct test, rather than checking for the [[RegExpMatcher]]
internal slot as the builtins previously did.
R=yangguo
Review URL: https://codereview.chromium.org/1762183002
Cr-Commit-Position: refs/heads/master@{#34547}
I64Shl is lowered to a new turbofan operator, WasmWord64Shl. The new
operator takes 3 inputs, the low-word input, the high-word input, and
the shift, and produces 2 output, the low-word output and the high-word
output.
At the moment I implemented the lowering only for ia32, but I think the
CL is already big enough. I will add the other platforms in separate
CLs.
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/1756863002
Cr-Commit-Position: refs/heads/master@{#34546}
The CL #34376 (https://codereview.chromium.org/1740073002 ) added the Inlining test case and X87 failed at it.
The reason is:
For TEST(Inlining) test case, when level3 function is inlined, the key optimized crankshaft code will like below code normally:
............
0x21d53b7f 63 ff571b call [edi+0x1b] <----------- should call action() here
;;; <@32,#27> lazy-bailout
;;; <@36,#31> ---- B3 ----
;;; <@37,#31> gap
0x21d53b82 66 89c1 mov ecx,eax <----------- Both the inlined function’s pc_offset from DeoptimizationInputData and the pc_offset from sample stack points to here, the same pc address
............
So the TEST(Inlining) test case can get the expected inlined code entry and pass..
In fact, the exact code sequence should like the following in crankshaft:
............
0x21d53b7f 63 ff571b call [edi+0x1b] <----------- should call action()
0xxxxxxxxx xxxx GenerateBodyInstructionPost() <----------- the pc_offset from sample stack points to here
;;; <@32,#27> lazy-bailout
;;; <@36,#31> ---- B3 ----
;;; <@37,#31> gap
0x21d53b82 66 89c1 mov ecx,eax <----------- the inlined function’s pc_offset from DeoptimizationInputData points to here.
............
For most of architectures in V8, the GenerateBodyInstructionPost() is empty, so both the inlined function’s pc_offset from DeoptimizationInputData and the pc_offset from sample stack points to the same pc address .
But if some architecture has special requirement and need to put some instruction after call instruction, the GenerateBodyInstructionPost() will do that work and generate instructions, the inlined function’s pc_offset from DeoptimizationInputData and The pc_offset from sample stack will points to the different pc address, the TEST(Inlining) test case can’t get the expected inlined code entry and failed.
For all current architectures in v8, only x87 have this requirement.
After communicated with Alexei Filippov <alph@chromium.org> in E-mail, we decided to disable the Inlining test case for x87 now and try to find a solution.
BUG=
Review URL: https://codereview.chromium.org/1766263002
Cr-Commit-Position: refs/heads/master@{#34544}
HInvokeFunction and HApplyArguments instructions now support tail calling.
Inlining of calls at tail position is not supported yet and therefore still disabled.
The tail-call-megatest was modified so that the usages of "arguments" object do not disable Crankshaft.
TBR=bmeurer@chromium.org
BUG=v8:4698
LOG=N
Review URL: https://codereview.chromium.org/1760253003
Cr-Commit-Position: refs/heads/master@{#34542}
Now that the embedder side supports v8::kGCCallbackFlagCollectAllAvailableGarbage,
this CL removes the old v8::kGCCallbackFlagForced from Heap::CollectAllAvailableGarbage.
BUG=591463
LOG=Y
Review URL: https://codereview.chromium.org/1769893002
Cr-Commit-Position: refs/heads/master@{#34539}
