Commit Graph

847 Commits

Author SHA1 Message Date
rmcilroy
27204d6e05 [Interpreter] Push BytecodeArray onto interpreted stack frames.
Replaces the push of the dispatch table on the interpreted stack frame with a
push of the bytecode array. This enables the debugger to replace the bytecode
array with a patched version containing breakpoints.

BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1699013002

Cr-Commit-Position: refs/heads/master@{#34032}
2016-02-16 12:36:16 +00:00
rmcilroy
84a225d1e4 [Turbofan] Save and restore lr in OutOfLineRecordWrite when frame is elided.
Fixes a bug in Ignition on Arm64 where lr gets trashed in StaContextSlot
which causes the stack walker to get confused and crash.

BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1694263002

Cr-Commit-Position: refs/heads/master@{#34016}
2016-02-16 07:49:16 +00:00
oth
e768bcca24 [interpreter] Support for ES6 super keyword.
Adds support for ES6 super keyword and performing loads, stores, and
calls to super class members.

Implements SetHomeObject and enables ThisFunctionVariable.

BUG=v8:4280,v8:4682
LOG=N

Review URL: https://codereview.chromium.org/1689573004

Cr-Commit-Position: refs/heads/master@{#33977}
2016-02-15 08:19:07 +00:00
jarin
5418896400 Make the frame inspector use TranslatedState rather than the full deoptimizer.
This is mostly preparation for allowing the function closure to be materialized.

As a drive-by fix, I have added ignition source position support to the frame inspector (this fixed some ignition test failures).

Review URL: https://codereview.chromium.org/1698743002

Cr-Commit-Position: refs/heads/master@{#33975}
2016-02-15 07:36:57 +00:00
oth
47c08f5f71 [interpreter] Add bytecodes for JumpIfNotHole with constant
Adds JumpIfNotHoleConstant and JumpIfNotHoleConstantWide bytecodes
and removes JumpIfHole bytecode.

In situations with large numbers of constants, the generator would
fail because an 8-bit constant could not be reserved for
JumpIfHole/JumpIfNotHole and so a 16-bit constant would be reserved.
Then when patching the bytecode the patcher would discover there was
no wide constant variant of the emitted jump.

BUG=v8:4280,v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1697473002

Cr-Commit-Position: refs/heads/master@{#33952}
2016-02-12 15:24:43 +00:00
machenbach
cca0c545e2 [test] Skip test for gc stress and turbofan.
BUG=v8:4754
LOG=n
NOTRY=true
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1693823002

Cr-Commit-Position: refs/heads/master@{#33944}
2016-02-12 12:39:32 +00:00
jarin
78971c5ee2 Re-enable the mjsunit/block-conflicts.js test in Turbofan.
Review URL: https://codereview.chromium.org/1689573008

Cr-Commit-Position: refs/heads/master@{#33941}
2016-02-12 11:46:30 +00:00
rmcilroy
14fa0fa831 [Interpreter] Remove some Ignition skips from mjsunit and cctest
Remove some Ignition skips in mjsunit and cctest, and replace a few
others with fails now that the there is more debugger support.

BUG=v8:4680
LOG=N

Review URL: https://codereview.chromium.org/1689993002

Cr-Commit-Position: refs/heads/master@{#33932}
2016-02-12 09:35:18 +00:00
Michael Achenbach
2cfa0e8906 [test] Fix expectations.
Cr-Commit-Position: refs/heads/master@{#33929}
2016-02-12 08:01:51 +00:00
Benedikt Meurer
6d03f9e842 [tests] Skip mjsunit/es6/block-conflicts in GC stress mode.
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1694443003 .

Cr-Commit-Position: refs/heads/master@{#33928}
2016-02-12 07:28:47 +00:00
ishell
d12dbab466 [es6] More efficient way of marking AST call expressions in tail positions.
Instead of doing a full function body traversal we collect return expressions and mark them after function parsing.

And since we rewrite do-expressions so that the result is explicitly assigned to a result variable the statements marking will never hit so I removed it from the AST.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1693523002

Cr-Commit-Position: refs/heads/master@{#33911}
2016-02-11 17:40:16 +00:00
bradnelson
879d254d54 Enable asm-wasm mjsunit tests (skip on arm).
Landing this again, excluding arm as it fail and arm64
out of caution that other wasm arm64 tests are also disabled.

BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1694493002

Cr-Commit-Position: refs/heads/master@{#33910}
2016-02-11 17:05:56 +00:00
machenbach
82434b1bd1 Revert of Enable asm-wasm mjsunit tests. (patchset id:1 of https://codereview.chromium.org/1687813003/ )
Reason for revert:
[Sheriff] Breaks chromebooks with arm:
https://build.chromium.org/p/client.v8/builders/V8%20Arm/builds/4397

You can reland, but please keep it skipped for arm.

Original issue's description:
> Enable asm-wasm mjsunit tests.
>
> BUG= https://code.google.com/p/v8/issues/detail?id=4203
> TEST=mjsunit/asm-wasm
> R=aseemgarg@chromium.org,titzer@chromium.org
> LOG=N
>
> Committed: https://crrev.com/46728d4d9576585bceaa66b8362755c29d3e54bd
> Cr-Commit-Position: refs/heads/master@{#33883}

TBR=aseemgarg@chromium.org,titzer@chromium.org,bradnelson@google.com,bradnelson@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://code.google.com/p/v8/issues/detail?id=4203

Review URL: https://codereview.chromium.org/1689113003

Cr-Commit-Position: refs/heads/master@{#33905}
2016-02-11 15:36:36 +00:00
yangguo
9249890124 [interpreter, debugger] implement bytecode break location iterator.
R=rmcilroy@chromium.org, vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1682853004

Cr-Commit-Position: refs/heads/master@{#33904}
2016-02-11 15:31:20 +00:00
ishell
e519e6fadf [es6] Further fixing of tail Calls.
1) Update profiling counters in Full codegen.
2) Call Runtime::kTraceTailCall when tracing is on

test/mjsunit/es6/tail-call-simple.js is disabled for now, because Turbofan does not fully support TCO yet.

BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1670133002

Cr-Commit-Position: refs/heads/master@{#33886}
2016-02-11 10:27:10 +00:00
bradnelson
46728d4d95 Enable asm-wasm mjsunit tests.
BUG= https://code.google.com/p/v8/issues/detail?id=4203
TEST=mjsunit/asm-wasm
R=aseemgarg@chromium.org,titzer@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1687813003

Cr-Commit-Position: refs/heads/master@{#33883}
2016-02-11 08:25:56 +00:00
yangguo
e0d0c96a53 [regexp] experimental implementation for \p property class.
Currently we only support general categories for property classes.

R=erik.corry@gmail.com, erikcorry@chromium.org, littledan@chromium.org
BUG=v8:4743
LOG=N

Review URL: https://codereview.chromium.org/1685593002

Cr-Commit-Position: refs/heads/master@{#33872}
2016-02-10 16:24:05 +00:00
rmcilroy
fe58118597 [Interpreter] Group Ignition mjsunit test failures by error.
Also replace SKIPS by FAIL to ensure tests are reenabled once they work.

BUG=v8:4680
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_arm64_dbg,v8_linux_arm_dbg

Review URL: https://codereview.chromium.org/1667323002

Cr-Commit-Position: refs/heads/master@{#33821}
2016-02-08 15:49:51 +00:00
mythria
90721a51a3 [Interpreter] Adds support for const/let variables to interpreter.
Adds implementation and tests to support const/let variables in the
interpreter.

BUG=v8:4280,v8:4679
LOG=N

Review URL: https://codereview.chromium.org/1634153002

Cr-Commit-Position: refs/heads/master@{#33819}
2016-02-08 14:14:57 +00:00
mvstanton
3f36e658c8 Revert of Type Feedback Vector lives in the closure (patchset id:40001 of https://codereview.chromium.org/1668103002/ )
Reason for revert:
Must revert for now due to chromium api natives issues.

Original issue's description:
> Type Feedback Vector lives in the closure
>
> (RELAND: the problem before was a missing write barrier for adding the code
> entry to the new closure. It's been addressed with a new macro instruction
> and test. The only change to this CL is the addition of two calls to
> __ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
> Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
> And Benedikt reviewed it as well.
>
> TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org
>
> BUG=
>
> Committed: https://crrev.com/bb31db3ad6de16f86a61f6c7bbfd3274e3d957b5
> Cr-Commit-Position: refs/heads/master@{#33741}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1670813005

Cr-Commit-Position: refs/heads/master@{#33766}
2016-02-05 10:48:35 +00:00
mvstanton
bb31db3ad6 Type Feedback Vector lives in the closure
(RELAND: the problem before was a missing write barrier for adding the code
entry to the new closure. It's been addressed with a new macro instruction
and test. The only change to this CL is the addition of two calls to
__ RecordWriteCodeEntryField() in the platform CompileLazy builtin.)

We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...
Also, Yang has had a look at the debugger changes already and approved 'em. So he is TBR style too.
And Benedikt reviewed it as well.

TBR=hpayer@chromium.org, yangguo@chromium.org, bmeurer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1668103002

Cr-Commit-Position: refs/heads/master@{#33741}
2016-02-04 15:41:23 +00:00
mstarzinger
76bfc16bea [interpreter] Switch context during stack unwinding.
This implements proper context switching while unwinding the stack due
to an exception being handled in interpreted code. The context under
which the handler is scoped is being preserved in a dedicated register
while the try-block is running. Both, the stack unwinding machinery as
well as the graph builder, restore the context from that register.

R=rmcilroy@chromium.org,bmeurer@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1665833002

Cr-Commit-Position: refs/heads/master@{#33733}
2016-02-04 13:43:55 +00:00
rmcilroy
1ce720f2a4 [Interpreter] Add explicit StackCheck bytecodes on function entry and back branches.
Moves the stack check from the function entry trampoline to instead be
after function activation using an explicit StackCheck bytecode. Also
add stack checks on back edges of loops.

BUG=v8:4280,v8:4678
LOG=N

Review URL: https://codereview.chromium.org/1665853002

Cr-Commit-Position: refs/heads/master@{#33730}
2016-02-04 12:33:48 +00:00
mythria
8d3e1ca357 [Interpreter] Adds support for with statement to interpreter.
Adds implementation and tests for with statement to interprter.

BUG=v8:4280,v8:4684
LOG=N

Review URL: https://codereview.chromium.org/1656863002

Cr-Commit-Position: refs/heads/master@{#33705}
2016-02-03 14:41:37 +00:00
neis
a973f73465 Expect JSReceiver in Runtime_DeleteLookupSlot, not just JSObject.
BUG=chromium:583260
LOG=n

Review URL: https://codereview.chromium.org/1664683002

Cr-Commit-Position: refs/heads/master@{#33697}
2016-02-03 09:49:22 +00:00
rmcilroy
d81edba721 [Interpreter] Set bytecode array in Runtime_SetCode.
Set the bytecode array correctly in Runtime_SetCode.
This fixes issues with building the snapshot with ignition enabled.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1647913002

Cr-Commit-Position: refs/heads/master@{#33638}
2016-02-01 12:13:21 +00:00
yangguo
835b038331 [debugger] correctly find function context.
In the debugger we are interested in getting the context for the
current frame, which is usually a function context. To do that,
we used to call Context::declaration_context, which may also
return a block context. This is wrong and can lead to crashes.
Instead, we now use a newly introduced Context::closure_context,
which skips block contexts. This works fine for the debugger,
since we have other means to find and materialize block contexts.

R=rossberg@chromium.org
BUG=chromium:582051
LOG=N

Review URL: https://codereview.chromium.org/1648263002

Cr-Commit-Position: refs/heads/master@{#33627}
2016-02-01 07:03:44 +00:00
mstarzinger
8bfa1ea33a [interpreter] Translate exception handlers into graph.
This translates the exception handler table attached to a bytecode array
correctly into exceptional projections within the TurboFan graph. We
perform an abstract simulation of handlers that are being entered and
exited by the bytecode iteration to track the correct handler for each
node.

R=oth@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1641723002

Cr-Commit-Position: refs/heads/master@{#33580}
2016-01-28 12:18:24 +00:00
mvstanton
a702785156 Revert of Type Feedback Vector lives in the closure (patchset id:20001 of https://codereview.chromium.org/1642613002/ )
Reason for revert:
Bug: failing to use write barrier when writing code entry into closure.

Original issue's description:
> Reland of Type Feedback Vector lives in the closure
>
> (Fixed a bug found by nosnap builds.)
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
>
> TBR=hpayer@chromium.org
> BUG=
>
> Committed: https://crrev.com/d984b3b0ce91e55800f5323b4bb32a06f8a5aab1
> Cr-Commit-Position: refs/heads/master@{#33548}

TBR=bmeurer@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1643533003

Cr-Commit-Position: refs/heads/master@{#33556}
2016-01-27 15:05:38 +00:00
mvstanton
d984b3b0ce Reland of Type Feedback Vector lives in the closure
(Fixed a bug found by nosnap builds.)

We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...

TBR=hpayer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1642613002

Cr-Commit-Position: refs/heads/master@{#33548}
2016-01-27 12:53:42 +00:00
sigurds
e41c62a8ff [turbofan] Improve iteration order in escape object analysis
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1631333002

Cr-Commit-Position: refs/heads/master@{#33542}
2016-01-27 11:05:51 +00:00
yangguo
a2baaaac93 [regexp] implement case-insensitive unicode regexps.
BUG=v8:2952
LOG=N

Review URL: https://codereview.chromium.org/1599303002

Cr-Commit-Position: refs/heads/master@{#33538}
2016-01-27 08:25:38 +00:00
mvstanton
e2e7dc32ef Revert of Type Feedback Vector lives in the closure (patchset id:260001 of https://codereview.chromium.org/1563213002/ )
Reason for revert:
FAilure on win32 bot, need to investigate webkit failures.

Original issue's description:
> Type Feedback Vector lives in the closure
>
> We get less "pollution" of type feedback if we have one vector per native
> context, rather than one for the whole system. This CL moves the vector
> appropriately.
>
> We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
> vector actually lives in the first slot of the literals array (indeed there is
> great commonality between those arrays, they can be thought of as the same
> thing). So we make greater effort to ensure there is a valid literals array
> after compilation.
>
> This meant, for performance reasons, that we needed to extend
> FastNewClosureStub to support creating closures with literals. And ultimately,
> it drove us to move the optimized code map lookup out of FastNewClosureStub
> and into the compile lazy builtin.
>
> The heap change is trivial so I TBR Hannes for it...
>
> TBR=hpayer@chromium.org
>
> BUG=
>
> Committed: https://crrev.com/a5200f7ed4d11c6b882fa667da7a1864226544b4
> Cr-Commit-Position: refs/heads/master@{#33518}

TBR=bmeurer@chromium.org,akos.palfi@imgtec.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1632993003

Cr-Commit-Position: refs/heads/master@{#33520}
2016-01-26 15:02:29 +00:00
mvstanton
a5200f7ed4 Type Feedback Vector lives in the closure
We get less "pollution" of type feedback if we have one vector per native
context, rather than one for the whole system. This CL moves the vector
appropriately.

We rely more heavily on the Optimized Code Map in the SharedFunctionInfo. The
vector actually lives in the first slot of the literals array (indeed there is
great commonality between those arrays, they can be thought of as the same
thing). So we make greater effort to ensure there is a valid literals array
after compilation.

This meant, for performance reasons, that we needed to extend
FastNewClosureStub to support creating closures with literals. And ultimately,
it drove us to move the optimized code map lookup out of FastNewClosureStub
and into the compile lazy builtin.

The heap change is trivial so I TBR Hannes for it...

TBR=hpayer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1563213002

Cr-Commit-Position: refs/heads/master@{#33518}
2016-01-26 14:21:08 +00:00
rmcilroy
8476397f44 [Interpreter] Add back one more skip for an mjsunit test failing on Arm64 on Ignition.
BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1633133002

Cr-Commit-Position: refs/heads/master@{#33517}
2016-01-26 14:12:11 +00:00
oth
19df7a20f0 [interpreter] Wide register support.
This increases the size of register operands to be 16-bit.

Not all bytecodes have wide register variants, so when they are
needed a register translator will copy them into a small area
reserved at the top of the 8-bit register range and these registers
are supplied as arguments to the bytecode with 8-bit operands.

This is non-intrusive for typical bytecode where the number of
registers is less than 120. For bytecodes with wide register
operands (above the window) their index needs to be translated
to avoid the reserved translation window.

Enables splay.js to run in Octane and a handful of mjsunit tests.

BUG=v8:4280,v8:4675
LOG=NO

Review URL: https://codereview.chromium.org/1613163002

Cr-Commit-Position: refs/heads/master@{#33516}
2016-01-26 13:56:17 +00:00
sigurds
a59653a2bf [turbofan] Disable test
This CL disables a test that takes too long in debug mode when
escape analysis is enabled in turbofan.

R=machenbach@chromium.org
BUG=v8:4586
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1636593004

Cr-Commit-Position: refs/heads/master@{#33514}
2016-01-26 13:41:40 +00:00
rmcilroy
32eade634f [Interpreter] Fix deopting from inline functions.
Rename IntepreterExceptionEntryHandler builtin to InterpreterEnterBytecodeDispatch
and use it as the return address when building interpreter frames during deopt.
This ensures that we restart execution of the outer frame at the correct
bytecode.

BUG=v8:4280,v8:4678
LOG=N

Review URL: https://codereview.chromium.org/1633633002

Cr-Commit-Position: refs/heads/master@{#33512}
2016-01-26 12:23:02 +00:00
rmcilroy
befe61fa3e [Interpreter] Add native function literal support.
Adds support for calling native function literals. Moves the logic for building
the native function's SharedFunctionInfo out of full-codegen into compiler.cc
to allow it to be shared between fullcodegen and Ignition.

BUG=v8:4686
LOG=N

Review URL: https://codereview.chromium.org/1635553002

Cr-Commit-Position: refs/heads/master@{#33510}
2016-01-26 11:30:46 +00:00
ishell
ac03ef02d6 Also check new_target_is_base() bit when comparing two maps for equivalence.
BUG=chromium:580506
LOG=N

Review URL: https://codereview.chromium.org/1631673002

Cr-Commit-Position: refs/heads/master@{#33497}
2016-01-25 16:44:01 +00:00
mstarzinger
21b6e077fa [interpreter] Fix lookup of overlapping handler ranges.
This fixes corner cases where the start offsets of exception handler
regions within the handler table fall together. This assumption was
based on full-codegen code and no longer holds with the interpreter.
The tables however are still well nested and code has been added to
verify that in debug mode.

R=rmcilroy@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1633573002

Cr-Commit-Position: refs/heads/master@{#33495}
2016-01-25 16:18:53 +00:00
mstarzinger
b707ca4b54 [interpreter] Deprecate --ignition-fallback-on-catch flag.
The current support for try-catch in the interpreter can handle most of
the cases appearing in our test suite. Also the flag in question did not
detect try-finally constructs. This removes the flag and instead extends
the test expectations.

R=rmcilroy@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1631593003

Cr-Commit-Position: refs/heads/master@{#33494}
2016-01-25 15:57:51 +00:00
rmcilroy
9602f4b2d2 [Interpreter] Remove skips which have been fixed with Exceptions and For...Of.
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1627943003

Cr-Commit-Position: refs/heads/master@{#33489}
2016-01-25 12:23:38 +00:00
mstarzinger
00b0a53685 [interpreter] Re-enable some tests that pass by now.
These tests have been disabled while support for try-finally was work in
progress. By now control flow is connected properly and the tests pass.

R=oth@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1626503002

Cr-Commit-Position: refs/heads/master@{#33474}
2016-01-22 17:11:17 +00:00
ishell
13a7676145 Disable tests that are known to be non-deterministic in --verify-predictable mode.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1621523003

Cr-Commit-Position: refs/heads/master@{#33457}
2016-01-22 09:04:47 +00:00
machenbach
25e63b2329 [test] Skip test for gcov coverage.
BUG=v8:4696
LOG=N
NOTRY=true
TBR=rossberg, nickie

Review URL: https://codereview.chromium.org/1617803004

Cr-Commit-Position: refs/heads/master@{#33445}
2016-01-21 19:02:59 +00:00
mstarzinger
0b3066b8f5 [interpreter] First implementation of stack unwinding.
This implements a first prototype of stack unwinding for interpreted
frames. The unwinding machinery performs a range-based lookup in the
given handler table and potentially continues dispatching at the handler
offset. Note that this does not yet correctly restore the context to the
correct value when the handler is being entered.

R=rmcilroy@chromium.org,oth@chromium.org
BUG=v8:4674
LOG=n

Review URL: https://codereview.chromium.org/1605633003

Cr-Commit-Position: refs/heads/master@{#33414}
2016-01-20 18:10:40 +00:00
mythria
232e28d65e [Interpreter] Marks that 'throw' has returned a value.
This is to fix some of the failing test262 tests with ignition flag.
In few test262 tests, there is a throw from the script scope. Rewriter::Rewrite
pass converts expression statements into assignment statements in script scope.
This causes interpreter to fail because assignment expression expects a result
in accumulator but throw statement does not return a value. To fix this, we
now mark that accumulator contains a value when visiting throw statement.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1523423003

Cr-Commit-Position: refs/heads/master@{#33408}
2016-01-20 13:49:18 +00:00
rmcilroy
43c02e49d8 [Interpreter] Change ignition fallback flag to only fallback on catch, not eval.
Now that we support eval in Ignition, remove the fallback for eval checks
and make the flag only fallback on catch blocks.

BUG=v8:4280,v8:4676
LOG=N

Review URL: https://codereview.chromium.org/1595223004

Cr-Commit-Position: refs/heads/master@{#33384}
2016-01-19 11:33:50 +00:00
Ben L. Titzer
2e16d9862a [wasm] Disable asm-wasm test (requires SSE 4.1).
R=jkummerow@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1603683002 .

Cr-Commit-Position: refs/heads/master@{#33375}
2016-01-18 18:47:35 +00:00
titzer
60d9733a57 [wasm] Enable WASM JavaScript API tests.
LOG=Y
BUG=chromium:575167

Review URL: https://codereview.chromium.org/1576953002

Cr-Commit-Position: refs/heads/master@{#33372}
2016-01-18 17:19:56 +00:00
mythria
8ae9fb69c2 [Interpreter] Fixes VisitObjectLiteral to reserve consecutive registers in innerscope.
VisitObjectLiteral has two parts. First it creates a literal and then
sets properties or accessor properties. Setting properties requires a
runtime call and it expects the literal object which was created in the
first part is contiguous with other registers it allocates. Since these
are allocated in a different scope they are not always contiguous.
This causes problems with mjsunit/setter-on-constructor-prototype.js.
This cl fixes by allocating contiguous registers in the inner scope.
Literal value is copied into the newly allocated register so that all
the required registers are always contiguous.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1588903002

Cr-Commit-Position: refs/heads/master@{#33371}
2016-01-18 17:18:52 +00:00
cbruni
c86f1897ac [runtime] Throw exception for derived constructors in correct context.
When derived constructors return a non-object (or not undefined) we
currently throw an exception directly in the callee context. This was
achieved by desugaring the return statement for derived classes. To
be spec compliamnt a separate ConstructStubForDerived is introduced.
Instead of trowing directly, the desugared return statement inside
a derived constructor only returns an integer to indicate an incompatible
result.

BUG=v8:4509
LOG=n

Review URL: https://codereview.chromium.org/1593553002

Cr-Commit-Position: refs/heads/master@{#33336}
2016-01-15 15:31:28 +00:00
rmcilroy
8a9927c351 [Interpreter] Skip regress-2249 on Arm Ignition which is still failing
BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1582273005

Cr-Commit-Position: refs/heads/master@{#33331}
2016-01-15 13:53:29 +00:00
rmcilroy
be2210bcc4 [Interpreter] Remove Ignition skips fixed by 48a3227b
Remove ignition skips which are fixed by 48a3227b7d.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1590513003

Cr-Commit-Position: refs/heads/master@{#33322}
2016-01-15 11:26:24 +00:00
adamk
bcde4e271e Propagate the "calls eval" bit from ScopeInfo to lazily-compiled arrow functions
This avoids generating different scopes on the two compilation passes, which
results in various delirious side-effects.

There's some cleanup to be done in lazy arrow function parsing, but I'd
rather do that in a separate patch, with this one targeted at fixing the
particular crash.

BUG=chromium:572589
LOG=n

Review URL: https://codereview.chromium.org/1575333004

Cr-Commit-Position: refs/heads/master@{#33311}
2016-01-14 19:21:24 +00:00
rmcilroy
ef21fb2de6 [Interpreter] Ensure we always have an outer register allocation scope.
Split RegisterAllocationScope out of ExpressionResult and allocate one
for each statement. This ensures that we always have an outer register
allocation scope for statement code (used in CountOperation and
RegisterExecutionResult). Also refactored the register allocator code to
move it to it's own file and rename from TemporaryRegisterScope to
BytecodeRegisterAllocator.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1587033002

Cr-Commit-Position: refs/heads/master@{#33296}
2016-01-14 13:43:40 +00:00
ishell
405c7a68ab Generalize all representations when reconfiguring a property of a strict Function subclass.
BUG=chromium:575080
LOG=N

Review URL: https://codereview.chromium.org/1579603002

Cr-Commit-Position: refs/heads/master@{#33288}
2016-01-14 10:45:34 +00:00
mythria
eccbdde041 [Interpreter] Removes assignment hazard scope.
Removes assignment hazard scope. Reverts back to the naive scheme of
allocating a temporary for every variable load. It was decided to revert it
because the current implementation does not handle logical expressions,
ternary operators, visiting objects in named/keyed loads. Also, we wanted
to evaluate alternate approaches and choose one when we have a mechanism
to measure performance.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1576403004

Cr-Commit-Position: refs/heads/master@{#33269}
2016-01-13 15:41:31 +00:00
machenbach
e0f23ea76a [test] Skip tests for ignition.
NOTRY=true
TBR=rmcilroy@chromium.org, neis@chromium.org

Review URL: https://codereview.chromium.org/1574343002

Cr-Commit-Position: refs/heads/master@{#33247}
2016-01-12 19:00:05 +00:00
neis
96ec06efb0 Reland of "[Proxies] Ship Proxies + Reflect."
Failing chromium layout tests were marked for rebaselining.

Addition to original CL (https://codereview.chromium.org/1580693002/):
Skip some more ignition tests.

BUG=v8:3931,v8:1543
LOG=Y
R=hablich@chromium.org
CC=verwaest@chromium.org, rossberg@chromium.org,rmcilroy, oth

Review URL: https://codereview.chromium.org/1580783002

Cr-Commit-Position: refs/heads/master@{#33244}
2016-01-12 17:19:52 +00:00
rmcilroy
9b52c52845 [Interpreter] Add StackCheck node to BytecodeGraphBuilder graphs.
This fixes a number of crashes where other code was assuming there would
be at least one deopt point in all optimized functions (i.e., the
StackCheck) but we weren't producing any.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1572333002

Cr-Commit-Position: refs/heads/master@{#33243}
2016-01-12 17:08:27 +00:00
machenbach
284010c8b3 Revert of [Proxies] Ship Proxies + Reflect (patchset id:20001 of https://codereview.chromium.org/1580693002/ )
Reason for revert:
[Sheriff] Breaks layout tests. Please fix upstream first.

https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2032/builds/3587
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3873

Original issue's description:
> [Proxies] Ship Proxies + Reflect
>
> BUG=v8:3931,v8:1543
> LOG=Y
> R=verwaest@chromium.org, rossberg@chromium.org
>
> Committed: https://crrev.com/9ce5162fd2a36daf318e0ec3838cd90f4e179168
> Cr-Commit-Position: refs/heads/master@{#33234}

TBR=rossberg@chromium.org,verwaest@chromium.org,hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3931,v8:1543

Review URL: https://codereview.chromium.org/1579573004

Cr-Commit-Position: refs/heads/master@{#33236}
2016-01-12 13:08:18 +00:00
hablich
9ce5162fd2 [Proxies] Ship Proxies + Reflect
BUG=v8:3931,v8:1543
LOG=Y
R=verwaest@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1580693002

Cr-Commit-Position: refs/heads/master@{#33234}
2016-01-12 11:51:01 +00:00
littledan
2bd9bdbe62 TypedArray and ArrayBuffer support for @@species
This patch improves ArrayBuffer and TypedArray subclassing by adding
support for @@species and constructing outputs to certain methods
by creating an instance of the constructor determined by the
SpeciesConstructor algorithm, rather than fixed to a superclass or
naively the constructor. The new behavior is enabled by the
--harmony-species flag. Care is taken to not significantly change the
observable behavior when the flag is off. Previously, TypedArrays
already supported subclassing by reading the constructor of the
receiver, but ArrayBuffers did not, and this old behavior is
preserved and tested for, to avoid a multi-stage upgrade path and keep
things simple for users.

R=adamk
BUG=v8:4093
LOG=Y

Review URL: https://codereview.chromium.org/1574903004

Cr-Commit-Position: refs/heads/master@{#33223}
2016-01-12 06:07:59 +00:00
littledan
ee9d7acafc Partial rollback of Promise error checking
As V8 becomes more and more spec-compliant, Promise polyfill libraries
like core.js expect fully correct. However, our Promises do not yet
support Symbol.species. Therefore, a case like

```
var test = new Promise(function(){});
test.constructor = function(){};
Promise.resolve(test)
```

would lead to an unhandled Promise rejection, whereas it should not
because test.constructor[Symbol.species] is undefined, so test.then
should end up constructing %Promise% as a fallback, rather than
calling test.constructor as if it were a constructor, which leads
this error checking code to throw.

For now, this patch removes the error checking code (which was not
present until recently). In an interactive test using core.js, the
error message on the console goes away with this patch. When @@species
support is in place, this patch can be reverted. A regression test
is added which checks for the same thing.

Partially reverted patch was originally out for review at
https://codereview.chromium.org/1531073004

BUG=v8:4633
LOG=Y
R=adamk,caitp88@gmail.com

Review URL: https://codereview.chromium.org/1578893002

Cr-Commit-Position: refs/heads/master@{#33217}
2016-01-11 22:42:11 +00:00
littledan
23235b5fdb Reland of Ship ES2015 sloppy-mode function hoisting, let, class (patchset id:1 of https://codereview.chromium.org/1565263002/ )
Reason for revert:
Crash fixed by https://codereview.chromium.org/1564923007

Original issue's description:
> Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset  id:120001 of https://codereview.chromium.org/1551443002/ )
>
> Reason for revert:
> Causes frequent crashes in Canary: chromium:537816
>
> Original issue's description:
> > Ship ES2015 sloppy-mode function hoisting, let, class
> >
> > This patch doesn't ship all features of ES2015 variable/scoping
> > changes, notably omitting the removal of legacy const. I think
> > function hoisting, let and class in sloppy mode can stand to
> > themselves as a package, and the legacy const change is much
> > riskier and more likely to be reverted, so my intention is to
> > pursue those as a separate, follow-on patch.
> >
> > R=adamk@chromium.org
> > BUG=v8:4285,v8:3305
> > LOG=Y
> > CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
> >
> > Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> > Cr-Commit-Position: refs/heads/master@{#33133}
>
> TBR=adamk@chromium.org
> # Not skipping CQ checks because original CL landed more than 1 days ago.
> BUG=v8:4285,v8:3305,chromium:537816
> LOG=Y
>
> Committed: https://crrev.com/adac5956c6216056a211cfaa460a00ac1500d8f8
> Cr-Commit-Position: refs/heads/master@{#33162}

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4285,v8:3305,chromium:537816

Review URL: https://codereview.chromium.org/1571793002

Cr-Commit-Position: refs/heads/master@{#33189}
2016-01-08 17:34:59 +00:00
littledan
adac5956c6 Revert of Ship ES2015 sloppy-mode function hoisting, let, class (patchset id:120001 of https://codereview.chromium.org/1551443002/ )
Reason for revert:
Causes frequent crashes in Canary: chromium:537816

Original issue's description:
> Ship ES2015 sloppy-mode function hoisting, let, class
>
> This patch doesn't ship all features of ES2015 variable/scoping
> changes, notably omitting the removal of legacy const. I think
> function hoisting, let and class in sloppy mode can stand to
> themselves as a package, and the legacy const change is much
> riskier and more likely to be reverted, so my intention is to
> pursue those as a separate, follow-on patch.
>
> R=adamk@chromium.org
> BUG=v8:4285,v8:3305
> LOG=Y
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/fcff8588a5a01587643d6c2507c7b882c78a2957
> Cr-Commit-Position: refs/heads/master@{#33133}

TBR=adamk@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4285,v8:3305,chromium:537816
LOG=Y

Review URL: https://codereview.chromium.org/1565263002

Cr-Commit-Position: refs/heads/master@{#33162}
2016-01-07 20:23:21 +00:00
rmcilroy
306f195d1e [Interpreter] Add two more Ignition skips for mjsunit/compiler on Arm.
BUG=v8:4280
LOG=N
TBR=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1568533005

Cr-Commit-Position: refs/heads/master@{#33150}
2016-01-07 09:58:39 +00:00
rmcilroy
13626e97e0 [Interpreter] Enable most of the mjsunit/compiler tests for Ignition.
BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1567633002

Cr-Commit-Position: refs/heads/master@{#33148}
2016-01-07 09:00:11 +00:00
littledan
6e96223750 Add Array support for @@species and subclassing
This patch implements @@species, guarded behind the --harmony-species
flag, on Arrays. Methods which return an Array will instead return
the appropriate instance based on the ArraySpeciesCreate algorithm.
The algorithm is implemented in C++ to get access to realm information
and to implement some Array methods in C++, but it is also accessed
from JavaScript through a new runtime function. A couple interactive
Octane runs show no performance regression with the flag turned off,
but turning --harmony-species on will surely have a significant
regression, as Array methods now heavily use ObjectDefineProperty.

BUG=v8:4093
LOG=Y
R=adamk,cbruni

Review URL: https://codereview.chromium.org/1560763002

Cr-Commit-Position: refs/heads/master@{#33144}
2016-01-07 02:30:01 +00:00
littledan
fcff8588a5 Ship ES2015 sloppy-mode function hoisting, let, class
This patch doesn't ship all features of ES2015 variable/scoping
changes, notably omitting the removal of legacy const. I think
function hoisting, let and class in sloppy mode can stand to
themselves as a package, and the legacy const change is much
riskier and more likely to be reverted, so my intention is to
pursue those as a separate, follow-on patch.

R=adamk@chromium.org
BUG=v8:4285,v8:3305
LOG=Y
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1551443002

Cr-Commit-Position: refs/heads/master@{#33133}
2016-01-06 02:03:07 +00:00
caitpotter88
e4af5cdbf9 [promise] Make Promise.reject match spec, and validate promise capabilities
Correctly validate promise capabilities in NewPromiseCapabilities() and in
GetCapabilitiesExtractor(). Also explicitly follows Promise.race step 2 and
similar cases in the spec, rather than passing tests asserting these steps
are taken in NewPromiseCapability

Also changes Promise.reject to match specification.

Fixes the following test262 tests:

- built-ins/Promise/all/capability-executor-called-twice.js
- built-ins/Promise/all/capability-executor-not-callable.js
- built-ins/Promise/prototype/then/capability-executor-called-twice.js
- built-ins/Promise/prototype/then/capability-executor-not-callable.js
- built-ins/Promise/reject/capability-executor-called-twice.js
- built-ins/Promise/reject/capability-executor-not-callable.js
- built-ins/Promise/resolve/capability-executor-called-twice.js
- built-ins/Promise/resolve/capability-executor-not-callable.js
- built-ins/Promise/race/capability-executor-called-twice.js
- built-ins/Promise/race/capability-executor-not-callable.js
- built-ins/Promise/reject/S25.4.4.4_A3.1_T1.js
- built-ins/Promise/race/S25.4.4.3_A3.1_T2.js

Per v8:3641, mjsunit/es6/debug-promises/throw-with-undefined-reject.js becomes invalid. The exception is thrown before the chain handler is ever invoked, and is caught externally by d8's own handler --- thus evading the uncaught exception event.

BUG=v8:4633, v8:4631, v8:4243, v8:3641
LOG=N
R=littledan@chromium.org, cbruni@chromium.org

Review URL: https://codereview.chromium.org/1531073004

Cr-Commit-Position: refs/heads/master@{#33128}
2016-01-05 22:19:34 +00:00
bradnelson
0e8b7ec8b1 Remove wasm compile time option and enable wasm behind a runtime flag.
Deferring enabling of tests to separate per platform CLs.

R=machenbach@chromium.org,titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1553083003

Cr-Commit-Position: refs/heads/master@{#33123}
2016-01-05 18:06:54 +00:00
sigurds
3b473d7aad [turbofan] Deopt support for escape analysis
Deopt support is added on two levels. On the IR level,
a new ObjectState node is added, which represenents an
object to be materialized. ObjectState nodes appear as
inputs of FrameState and StateValues nodes. On the
instruction select/code-generation level, the
FrameStateDescriptor class handles the nesting
introduced by ObjectState, and ensures that deopt code
with CAPTURED_OBJECT/DUPLICATED_OBJECT entries are
generated similarly to what crankshaft's escape
analysis does.

Two unittests test correctness of the IR level implementation.

Correctness for instruction selection / code generation
is tested by mjsunit tests.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1485183002

Cr-Commit-Position: refs/heads/master@{#33115}
2016-01-05 13:31:02 +00:00
rmcilroy
5b4626ad19 [Interpreter] Enable TurboFan for Ignition variant tests.
Adds --turbo to the set of flags run with ignition (making the
configuration pure Ignition+TurboFan except for fallbacks to
full-codegen for catch / eval). Also changes the default
--ignition-filter to allow everything, rather than omit everything.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1537433003

Cr-Commit-Position: refs/heads/master@{#33090}
2016-01-04 17:33:08 +00:00
jarin
964964541d [turbofan] Fix turbofan-enabling conditions.
This restricts turbofan to turbofan-supported subset for the shipping
configuration ("use asm" and features unsupported by Crankshaft).

Without this, we compile with Turbofan even when there is
try-catch-finally as long as the function is "use asm" or
it contains a feature unsupported by crankshaft but supported
by turbofan (e.g., 'with' statement).

BUG=

Review URL: https://codereview.chromium.org/1552233002

Cr-Commit-Position: refs/heads/master@{#33085}
2016-01-04 14:53:07 +00:00
bmeurer
fed2c416df Use JSObjectVerify instead of trying to reimplement parts of it.
R=verwaest@chromium.org
BUG=chromium:573857
LOG=n

Review URL: https://codereview.chromium.org/1551333002

Cr-Commit-Position: refs/heads/master@{#33083}
2016-01-04 13:50:06 +00:00
Benedikt Meurer
5f6bcdaf12 [test] Blacklist mjsunit/regress/regress-417709a while Jaro is working on it.
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/1555053002 .

Cr-Commit-Position: refs/heads/master@{#33080}
2016-01-04 12:29:24 +00:00
Benedikt Meurer
2d997d8659 [turbofan] Blacklist test case which needs investigation.
TBR=jarin@chromium.org

Review URL: https://codereview.chromium.org/1557833002 .

Cr-Commit-Position: refs/heads/master@{#33077}
2016-01-04 09:29:14 +00:00
littledan
797d1090ae Reland "Clean up promises and fix an edge case bug (patchset id:60001 of https://codereview.chromium.org/1488783002/ )"
This patch relands a change to ES2015 Promises which brings us closer to
spec compliance. In this new version, a bug which would lose async callstack
data was fixed.

R=adamk
CC=rossberg,caitp
LOG=Y
BUG=v8:3641
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1538663002

Cr-Commit-Position: refs/heads/master@{#33065}
2015-12-30 20:47:37 +00:00
bmeurer
2fcf3aa62c Only verify in-object fields in fast properties case.
This matches the behavior of JSObject::JSObjectVerify() and seems to be
the current contract for --verify-heap.

BUG=chromium:572590
LOG=n

Review URL: https://codereview.chromium.org/1553463002

Cr-Commit-Position: refs/heads/master@{#33056}
2015-12-29 11:20:52 +00:00
mythria
e7373f4285 [Interpreter] Allocates new temporary register outside the reservation for consecutive registers.
Consecutive registers are allocated in two passes. First we "reserve"
a set of registers and these get allocated when we actually use them.
If we request for a temporary register before we use all the consecutive
registers, the earlier implementation does not gaurantee that it allocates
outside the reservation for consecutive registers. This could cause problems
for example, in call_func(a, b++, c). This cl fixes
TemporaryRegisterScope::NewRegister, to return a new temporary register
outside the reservation for consecutive registers.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1531273002

Cr-Commit-Position: refs/heads/master@{#33005}
2015-12-22 09:26:25 +00:00
machenbach
2a09d7f9b5 Revert of Remove wasm compile time option and enable wasm behind a runtime flag. (patchset id:1050001 of https://codereview.chromium.org/1516753007/ )
Reason for revert:
[Sheriff] Some build failures, e.g.:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/7502

Original issue's description:
> Remove wasm compile time option and enable wasm behind a runtime flag.
>
> R=titzer@chromium.org
> BUG=
>
> Committed: https://crrev.com/153f2bd47cce9d5dfa74074dda34c02731d96924
> Cr-Commit-Position: refs/heads/master@{#32955}

TBR=titzer@chromium.org,bradnelson@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1531073003

Cr-Commit-Position: refs/heads/master@{#32957}
2015-12-17 17:59:00 +00:00
bradnelson
153f2bd47c Remove wasm compile time option and enable wasm behind a runtime flag.
R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1516753007

Cr-Commit-Position: refs/heads/master@{#32955}
2015-12-17 16:04:57 +00:00
Benedikt Meurer
5bd4832492 [es6] Correct Function.prototype.apply, Reflect.construct and Reflect.apply.
Introduce a new Apply builtin that forms a correct and optimizable
foundation for the Function.prototype.apply, Reflect.construct and
Reflect.apply builtins (which properly does the PrepareForTailCall
as required by the ES2015 spec).

The new Apply builtin avoids going to the runtime if it is safe to
just access the backing store elements of the argArray, i.e. if you
pass a JSArray with no holes, or an unmapped, unmodified sloppy or
strict arguments object.

mips/mips64 ports by Balazs Kilvady <balazs.kilvady@imgtec.com>

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
BUG=v8:4413, v8:4430
LOG=n
R=yangguo@chromium.org

Committed: e4d2538911

Review URL: https://codereview.chromium.org/1523753002 .

Cr-Commit-Position: refs/heads/master@{#32929}
2015-12-17 08:41:19 +00:00
mvstanton
6540e736f3 Bugfix: Make sure not to overwrite the empty optimized code map root.
BUG=chromium:568765
LOG=N
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1534453002

Cr-Commit-Position: refs/heads/master@{#32910}
2015-12-16 16:28:02 +00:00
mstarzinger
00f24ba7a0 [turbofan] Disable one more failing mjsunit test.
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1526983002

Cr-Commit-Position: refs/heads/master@{#32870}
2015-12-15 15:18:10 +00:00
mstarzinger
1e385a832a [interpreter] Use interpreter on all function literals.
This fixes a path in the compilation pipeline that side-stepped the
interpreter when a function literal was eagerly compiled. This caused
the interpreter to miss some test coverage.

R=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1528853002

Cr-Commit-Position: refs/heads/master@{#32867}
2015-12-15 14:12:51 +00:00
yangguo
bead244884 [debugger] remove frame argument for prepare step.
The third argument optionally specifies the frame from which to step.
This feature is not used and not well tested.

R=jkummerow@chromium.org
BUG=chromium:569835
LOG=N

Review URL: https://codereview.chromium.org/1525993002

Cr-Commit-Position: refs/heads/master@{#32865}
2015-12-15 13:37:20 +00:00
yangguo
a227a6b6de Revert of [debugger] re-enable step in frame test. (patchset id:1 of https://codereview.chromium.org/1518403004/ )
Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20gc%20stress/builds/4780/steps/Mjsunit/logs/debug-step-4-in-frame

Original issue's description:
> [debugger] re-enable step in frame test.
>
> Issue has long been fixed.
>
> R=jkummerow@chromium.org
> BUG=v8:2921
> LOG=N
>
> Committed: https://crrev.com/f27105b17a23a64faeae33b939555840e388136e
> Cr-Commit-Position: refs/heads/master@{#32862}

TBR=jkummerow@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:2921

Review URL: https://codereview.chromium.org/1522333003

Cr-Commit-Position: refs/heads/master@{#32863}
2015-12-15 12:45:40 +00:00
yangguo
f27105b17a [debugger] re-enable step in frame test.
Issue has long been fixed.

R=jkummerow@chromium.org
BUG=v8:2921
LOG=N

Review URL: https://codereview.chromium.org/1518403004

Cr-Commit-Position: refs/heads/master@{#32862}
2015-12-15 12:12:02 +00:00
yangguo
6d8a2611c0 [debugger] flood function for stepping on throw.
We used to flood the handler when preparing for stepping,
even if we may not throw. Instead, we now flood the
handler only when we actually throw.

This also solves an issue with step-next when we throw and
leave the function unexpectedly. In combination with
microtasks, this could cause a crash.

R=mstarzinger@chromium.org
BUG=chromium:568477
LOG=N

Review URL: https://codereview.chromium.org/1527593002

Cr-Commit-Position: refs/heads/master@{#32856}
2015-12-15 09:33:39 +00:00
Benedikt Meurer
18b22e3249 [ignition] Blacklist crashing test regress/regress-347914.
R=machenbach@chromium.org
TBR=rmcilroy@chromium.org

Review URL: https://codereview.chromium.org/1522343002 .

Cr-Commit-Position: refs/heads/master@{#32851}
2015-12-15 07:54:19 +00:00
jkummerow
0e2ea6a508 [proxies] [tests] Un-skip proxies-with-unscopables, delete proxies-symbols
- proxies-with-unscopables needed updating of trap names
- proxies-symbols doesn't make sense any more: it tested symbol fitering/
  blacklisting, but Proxies interact with Symbols just fine according to
  the current spec.

BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1529473002

Cr-Commit-Position: refs/heads/master@{#32844}
2015-12-14 16:37:53 +00:00
neis
1596b015ff [proxies] Support proxies in JSON.parse and JSON.stringify.
This CL tries to correctly support the following:
- stringifying a proxy,
- stringifying with a proxy as replacer (callable or arraylike),
- stringifying with a replacer that returns a proxy,
- parsing with a callable proxy as reviver,
- parsing with a reviver that inserts proxies into the object,
- and whatever else you can imagine.

This also fixes some bugs observable without proxies.

BUG=v8:3139,v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1515133002

Cr-Commit-Position: refs/heads/master@{#32843}
2015-12-14 15:12:12 +00:00
machenbach
a8e4eecf61 [test] Skip some tests on the coverage bot.
BUG=chromium:568949
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1520163003

Cr-Commit-Position: refs/heads/master@{#32840}
2015-12-14 14:38:19 +00:00
sigurds
3161c17126 [turbofan] Stabilize escape analysis (without deopt)
Bugfixes and improvements in escape analysis include:

* Handling of ObjectIsSmi (non-escaping)
* Handling of nested phi replacements
* Handling of phis with arity > 2
* Resilience against effectful nodes dangling from start
* Allocations escape now, if non-const load/store is performed
* Fixed a bug where non-allocated objects where tracked
* Allow fixed double arrays to be tracked

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1510973006

Cr-Commit-Position: refs/heads/master@{#32833}
2015-12-14 13:14:17 +00:00
cbruni
df2a92972b [proxy] fixing for-in for proxies, fixing harmony/proxy.js tests, improving error messages and some drive-by fixes
BUG=v8:1543
LOG=n

patch from issue 1519473002 at patchset 1 (http://crrev.com/1519473002#ps1)

Review URL: https://codereview.chromium.org/1516843002

Cr-Commit-Position: refs/heads/master@{#32801}
2015-12-11 14:56:00 +00:00
titzer
4c5b3609fd Initial import of v8-native WASM.
As discussed in person, this adds the code from v8-native-prototype into
V8 proper, guarded by GYP flags that do not build the code by default.
Passing wasm=on to 'make' or setting v8_wasm as a GYP flag activates
building of this code.

An additional header file is added to and exported from the compiler
directory, src/compiler/wasm-compiler.h. This exposes a limited interface
with opaque Node and Graph types to the decoder to build TF graphs, as
well as functions to compile WASM graphs.

The mjsunit tests added are blacklisted because they fail without the
WASM object exposed to JS, which is also disabled by the build config
option.

This corresponds closely to 5981e06ebc, with some formatting fixes and moving some files into src/compiler.

R=mstarzinger@chromium.org, bradnelson@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1504713014

Cr-Commit-Position: refs/heads/master@{#32794}
2015-12-11 12:27:05 +00:00
adamk
eb67f85439 Fix FuncNameInferrer usage in ParseAssignmentExpression
Without this fix, AssignmentExpressions that happen to be arrow functions
would lead to unbalanced Enter/Leave calls on the fni_, causing thrashing
while trying to infer function names. Symptoms include slow parsing
or OOM (when we create too many AstConsStrings).

To try to keep this from happening in the future, added an RAII helper
class to handle Entering/Leaving FNI state.

The included regression test crashes on my workstation without the patch.
Note that it's too slow in debug mode (as well as under TurboFan),
so I've skipped it there.

BUG=v8:4595
LOG=y

Review URL: https://codereview.chromium.org/1507283003

Cr-Commit-Position: refs/heads/master@{#32768}
2015-12-10 19:19:35 +00:00
neis
a5380fe9ed JSON.parse: properly deal with reviver result
When the reviver returns undefined, the property in question must be deleted
even for arrays.  So far this only happened for non-array objects.

Also change the property enumeration to be spec-conformant, which is observable when the reviver modifies its "this" object directly.  There are a few further issues that need to be addressed in a separate CL.

R=yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1506933003

Cr-Commit-Position: refs/heads/master@{#32750}
2015-12-10 12:49:06 +00:00
yangguo
e110a2a8f3 Make mjsunit/random-bit-correlations more predictable.
R=machenbach@chromium.org
BUG=v8:4588
LOG=N

Review URL: https://codereview.chromium.org/1508583002

Cr-Commit-Position: refs/heads/master@{#32730}
2015-12-09 21:05:07 +00:00
cbruni
a2d5641bc4 [runtime] [proxy] implement [[Construct]]
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1509603005

Cr-Commit-Position: refs/heads/master@{#32718}
2015-12-09 14:55:33 +00:00
machenbach
14613c16a2 [Test] Skip tests too slow for ignition on arm.
NOTRY=true
TBR=rmcilroy, Hablich

Review URL: https://codereview.chromium.org/1510003002

Cr-Commit-Position: refs/heads/master@{#32683}
2015-12-08 20:48:54 +00:00
sigurds
5b5821142b [turbofan] Improve escape analysis
This patch improves escape analysis and fixes bugs
triggered by clusterfuzz. Impovements include:
* Handling of LoadElement/StoreElement if index is a
  constant
* Handling of JSStoreProperty: invalidate all information,
  as the store could have altered any field.
* Treat phis that use an allocation as escaping
* Improve resolution of replacements

R=mstarzinger@chromium.org
BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1499143002

Cr-Commit-Position: refs/heads/master@{#32656}
2015-12-07 13:29:06 +00:00
neis
4e2c0dd7a9 [proxies] Make Object.{freeze,seal} behave correctly for proxies.
- Add JSReceiver::SetIntegrityLevel, with a fast path for regular objects.
- Make Object.{freeze,seal} call this via %Object{Freeze,Seal}, thus no longer
  using broken or deprecated functions from v8natives.js.
- Add JSReceiver::OwnPropertyKeys convenience function.
- Reenable harmony/proxies-hash.js test.

R=rossberg
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1489423002

Cr-Commit-Position: refs/heads/master@{#32651}
2015-12-07 11:01:35 +00:00
jochen
086d459847 [crankshaft] Loads and stores to typed arrays have to reference the backing store holder
The backing store is only held alive indirectly via the array buffer
referenced by the holder (typed array), so it's not enough to keep the
elements alive (or even just the external pointer loaded from the
elements).

R=mstarzinger@chromium.org,bmeurer@chromium.org
LOG=n
BUG=v8:1827

Review URL: https://codereview.chromium.org/1493983004

Cr-Commit-Position: refs/heads/master@{#32644}
2015-12-07 08:37:42 +00:00
machenbach
0f2ed07f45 Revert of Clean up promises and fix an edge case bug (patchset id:60001 of https://codereview.chromium.org/1488783002/ )
Reason for revert:
[Sheriff] Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/3266

Please request rebase upstream first.

Original issue's description:
> Clean up promises and fix an edge case bug
>
> This patch builds on previous Promise spec compliance work by
> cleaning out some old code which existed to support
> Promise.prototype.chain, rephrasing some code to correspond more
> closely to the specification, and removing some incorrect brand
> checking. A test is added for a bug in an edge case which was fixed.
>
> R=rossberg
> BUG=v8:3641
> LOG=Y
>
> Committed: https://crrev.com/1deb89c8fd3cb69714ae0a24e3b5a4e78f6b73b4
> Cr-Commit-Position: refs/heads/master@{#32627}

TBR=rossberg@chromium.org,caitpotter88@gmail.com,littledan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3641

Review URL: https://codereview.chromium.org/1501763004

Cr-Commit-Position: refs/heads/master@{#32629}
2015-12-05 08:51:20 +00:00
littledan
1deb89c8fd Clean up promises and fix an edge case bug
This patch builds on previous Promise spec compliance work by
cleaning out some old code which existed to support
Promise.prototype.chain, rephrasing some code to correspond more
closely to the specification, and removing some incorrect brand
checking. A test is added for a bug in an edge case which was fixed.

R=rossberg
BUG=v8:3641
LOG=Y

Review URL: https://codereview.chromium.org/1488783002

Cr-Commit-Position: refs/heads/master@{#32627}
2015-12-04 18:56:17 +00:00
cbruni
747f455b07 [runtime] [proxy] removing JSFunctionProxy and related code.
BUG=v8:1543
LOG=N

Review URL: https://codereview.chromium.org/1496503002

Cr-Commit-Position: refs/heads/master@{#32616}
2015-12-04 13:49:24 +00:00
neis
384ec6dc92 [proxies] Adapt and reenable harmony/proxies-for.js test.
R=rossberg
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1491863002

Cr-Commit-Position: refs/heads/master@{#32579}
2015-12-03 17:41:40 +00:00
machenbach
3e021da8f8 [test] Disable flaky test.
BUG=v8:4588
LOG=n
TBR=yangguo@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1496863002

Cr-Commit-Position: refs/heads/master@{#32541}
2015-12-03 08:24:41 +00:00
sigurds
aa0ddf7db4 [turbofan] Initial support for escape analysis.
This is the first part of escape analysis for turbofan.
At the moment, there is no deopt support, and support
for loops is partial (only binary Phis are handled).

The CL includes 4 unittests.

There are also 8 new mjsunit tests, some of which are
skiped as they require features not yet implemented.

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1457683003

Cr-Commit-Position: refs/heads/master@{#32498}
2015-12-02 10:53:50 +00:00
mstarzinger
9090c6b012 Use new.target in favor of %_IsConstructCall intrinsic (2).
This switches all remaining builtin methods to use the ES6 new.target
value when determined whether being called as a constructor or not. This
is prepatory work for fully deprecating the aforementioned intrinsic.

R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1474343002

Cr-Commit-Position: refs/heads/master@{#32447}
2015-12-01 10:50:30 +00:00
jkummerow
f7a0ecb0ca [test+presubmit] Remove duplicate test status file entries
And add a presubmit check to guard against future duplicates.

R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1477403002

Cr-Commit-Position: refs/heads/master@{#32380}
2015-11-27 15:04:49 +00:00
mstarzinger
69227cc192 [turbofan] Test has been outsmarted by optimization.
The fast-prototype test has been outsmarted by constructor inlining
because the instantiation is been correctly optimized away. Internal
state introspection about prototype turning fast was upset by that.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1474763007

Cr-Commit-Position: refs/heads/master@{#32338}
2015-11-26 14:04:09 +00:00
mstarzinger
45c52ddfdd [turbofan] Enable debugger tests that no longer fail.
R=yangguo@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1478683003

Cr-Commit-Position: refs/heads/master@{#32318}
2015-11-26 09:24:44 +00:00
machenbach
95f9f7732f [Ignition] Skip another test.
Started failing after https://codereview.chromium.org/1469313002

NOTRY=true
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1476603003

Cr-Commit-Position: refs/heads/master@{#32270}
2015-11-25 13:18:03 +00:00
ishell
ebf8ec5c51 Fix JSFunction's in-object properties initialization.
BUG=v8:4572
LOG=Y

Review URL: https://codereview.chromium.org/1481493003

Cr-Commit-Position: refs/heads/master@{#32268}
2015-11-25 12:42:14 +00:00
machenbach
ec3548aea7 [test] Skip flaky test.
BUG=v8:4572
LOG=n
NOTRY=true
TBR=rossberg@chromium.org, adamk@chromium.org

Review URL: https://codereview.chromium.org/1475943002

Cr-Commit-Position: refs/heads/master@{#32251}
2015-11-25 08:18:10 +00:00
machenbach
5686e48b96 [Ignition] Skip more tests.
Test failures after https://codereview.chromium.org/1478533002

TBR=rossberg@chromium.org, littledan@chromium.org, rmcilroy@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1470173004

Cr-Commit-Position: refs/heads/master@{#32250}
2015-11-25 08:06:37 +00:00
yangguo
912314be27 Correctly handlify Dictionary::CollectKeysTo.
'this' is a raw pointer and can be invalidated through GC, even
though the rest of the code is correctly handlified.

R=cbruni@chromium.org, jkummerow@chromium.org
BUG=v8:4570
LOG=N

Review URL: https://codereview.chromium.org/1475633002

Cr-Commit-Position: refs/heads/master@{#32208}
2015-11-24 13:43:59 +00:00
yangguo
a19f2d7eca Blacklist mjsunit/harmony/reflect-own-keys for gc-stress.
TBR=ulan@chromium.org
BUG=v8:4570
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1466373003

Cr-Commit-Position: refs/heads/master@{#32204}
2015-11-24 12:21:22 +00:00
mstarzinger
279f2aad93 [turbofan] Fix deoptimization from array literal spread.
This fixes the array literal expression stack tracking in the presence
of spread expressions. Deoptimization within a spread expression was
borked.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-deopt-in-array-literal-spread

Review URL: https://codereview.chromium.org/1455953002

Cr-Commit-Position: refs/heads/master@{#32079}
2015-11-18 11:45:41 +00:00
mstarzinger
f8a7236119 [turbofan] Fix several OSR entries within literals.
With do-expressions any expression used within literals can turn into an
OSR entry-point. This means the literal object being constructed is then
renamed to an OSR value and needs to be reloaded from the environment.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-literal

Review URL: https://codereview.chromium.org/1451423002

Cr-Commit-Position: refs/heads/master@{#32047}
2015-11-17 14:25:30 +00:00
danno
ff283f7ded [turbofan] Better and more sane support for tail calls
* Limit triggering of tail calls to explicit use of a new inline runtime
  function %_TailCall. %_TailCall works just like %_Call except for using
  tail-calling mechanics (currently only in TF).
* Remove hack that recognized some specific usages of %_Call and converted them
  into tail calls.
* Support tail calls for all calls where the number of callee stack parameters
  is less than or equal to the number of caller stack parameters.
* Use the gap resolver to swizzle parameters and registers to tail calls.

BUG=v8:4076
LOG=n

Review URL: https://codereview.chromium.org/1439613003

Cr-Commit-Position: refs/heads/master@{#31987}
2015-11-13 16:08:30 +00:00
mstarzinger
c42f188ce2 [turbofan] Fix OSR entry in case label.
With do-expressions any expression used as a case label can turn into an
OSR entry-point. This means the value being switched over is renamed to
an OSR value and needs to be reloaded from the environment at each case.

R=rossberg@chromium.org
TEST=mjsunit/regress/regress-osr-in-case-label

Review URL: https://codereview.chromium.org/1438123007

Cr-Commit-Position: refs/heads/master@{#31986}
2015-11-13 16:05:28 +00:00
cbruni
24e058d0ed [runtime] support new Proxy() instead of Proxy.create and install getPrototypeOf trap
LOG=N
BUG=v8:1543

Review URL: https://codereview.chromium.org/1417063011

Cr-Commit-Position: refs/heads/master@{#31983}
2015-11-13 14:14:07 +00:00
mstarzinger
11d5d09ce1 [turbofan] Initial support for constructor call inlining.
This implements a first version of support for constructor call inlining
in the inlining machinery. For now we can only inline calls where the
actual constructor and the original constructor coincide (i.e. no super
constructor calls). Note that the target of a super constructor call is
loaded with a runtime call, so there is no way for it to be constant
promoted at the moment.

R=bmeurer@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1435873002

Cr-Commit-Position: refs/heads/master@{#31954}
2015-11-12 08:51:28 +00:00
rmcilroy
0609ed27a0 [Interpreter] Disable Arm/Arm64 tests on release as well as debug for ignition.
BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1423803009

Cr-Commit-Position: refs/heads/master@{#31923}
2015-11-10 17:39:48 +00:00
rmcilroy
6e599ce9d8 [Interpreter] Disable mjsunit/array-sort on Arm/Arm64
BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1410883009

Cr-Commit-Position: refs/heads/master@{#31920}
2015-11-10 16:55:50 +00:00
rmcilroy
1820acb9c9 [Interpreter] Skip some more tests on Arm64 for Ignition.
Skips some more tests which started failing after https://codereview.chromium.org/1414183006 landed.

BUG=v8:4280
LOG=N
NOTRY=True

Review URL: https://codereview.chromium.org/1412343009

Cr-Commit-Position: refs/heads/master@{#31919}
2015-11-10 15:21:57 +00:00
rmcilroy
aca03dfca1 [Interpreter] Disable mjsunit/readonly test on ignition due to flakes.
BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1438463002

Cr-Commit-Position: refs/heads/master@{#31900}
2015-11-09 20:46:21 +00:00
rmcilroy
8b5a010242 [Interpreter] Skip failing tests on arm.debug in Ignition.
BUG=v8:4280
LOG=N
NOTRY=True
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1424263004

Cr-Commit-Position: refs/heads/master@{#31894}
2015-11-09 17:13:56 +00:00
rmcilroy
fd6c005982 [Ignition] Skip another failing mjsunittest on ignition.
Skips regress-446389.

BUG=v8:4280
LOG=N
NOTRY=true
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1412313010

Cr-Commit-Position: refs/heads/master@{#31891}
2015-11-09 16:23:42 +00:00
rmcilroy
cdc1fe5c3f [Ignition] Fix typo in ignition mjsunit status.
BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1429423002

Cr-Commit-Position: refs/heads/master@{#31889}
2015-11-09 14:56:07 +00:00
rmcilroy
aa858ffbbd [Ignition] Skip some more mjsunit and test262 tests on ignition.
BUG=v8:4280
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1415143009

Cr-Commit-Position: refs/heads/master@{#31886}
2015-11-09 14:16:26 +00:00
rmcilroy
fb9ad89fea [Interpreter]: Add ignition blacklist to mjsunit.status and test262.status.
Adds a blacklist of tests which are currently unsupported or broken in Ignition to
the mjsunit and test262 test status.

Also removes --ignition-script-filter flag, and adds a
--ignition_fallback_on_eval_and_catch flag which fallsback to fullcodegen for
functions which call eval or contain a catch block.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1420963009

Cr-Commit-Position: refs/heads/master@{#31864}
2015-11-06 18:52:51 +00:00
cbruni
83f60ab5ac [crankshaft] Do not optimize ClassConstructor calls and apply.
LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1425293007

Cr-Commit-Position: refs/heads/master@{#31839}
2015-11-05 19:21:20 +00:00
cbruni
ab84025977 [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
Cr-Commit-Position: refs/heads/master@{#31786}

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31790}
2015-11-04 14:30:09 +00:00
cbruni
f1bb688e80 Revert of [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor. (patchset id:370001 of https://codereview.chromium.org/1418623007/ )
Reason for revert:
failing build bot

Original issue's description:
> [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
>
> The current implementation of classes throws the TypeError at the wrong
> point, after activating a new context when directly calling a class
> constructor. According to the spec, the TypeError has to be thrown
> in the caller context.
>
> LOG=N
> BUG=v8:4428
>
> Committed: https://crrev.com/6a06bc0a774933719f62009d81b3f1686d83bb90
> Cr-Commit-Position: refs/heads/master@{#31786}

TBR=bmeurer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4428

Review URL: https://codereview.chromium.org/1415783006

Cr-Commit-Position: refs/heads/master@{#31787}
2015-11-04 13:56:44 +00:00
cbruni
6a06bc0a77 [runtime] Fix ES6 9.2.1 [[Call]] when encountering a classConstructor.
The current implementation of classes throws the TypeError at the wrong
point, after activating a new context when directly calling a class
constructor. According to the spec, the TypeError has to be thrown
in the caller context.

LOG=N
BUG=v8:4428

Review URL: https://codereview.chromium.org/1418623007

Cr-Commit-Position: refs/heads/master@{#31786}
2015-11-04 13:24:09 +00:00
mstarzinger
f89286f5a2 [turbofan] Re-enable mjsunit tests that no longer fail.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1405963011

Cr-Commit-Position: refs/heads/master@{#31784}
2015-11-04 13:00:59 +00:00
mstarzinger
124efdd3e8 Remove obsolete 'arguments' local variable handling.
This removes special casing for the 'f.arguments' property accessor. Any
local 'arguments' variable should not be allowed to influence the value
returned by the indirect 'f.arguments' property. That property creates a
new object with a separate identity everytime it is read. This is by now
consistent with other browsers.

R=rossberg@chromium.org
TEST=mjsunit/arguments-indirect

Review URL: https://codereview.chromium.org/1408983006

Cr-Commit-Position: refs/heads/master@{#31776}
2015-11-04 10:36:07 +00:00
jkummerow
b4d46bc5a0 Fix accessor map transitions vs. Object.defineProperty
BUG=v8:4534
LOG=n
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1413723011

Cr-Commit-Position: refs/heads/master@{#31750}
2015-11-03 14:41:53 +00:00
yangguo
e9a8d6ef09 Skip mjsunit/accessor-map-sharing on GC stress.
R=machenbach@chromium.org
BUG=v8:4534
LOG=N

Review URL: https://codereview.chromium.org/1426453005

Cr-Commit-Position: refs/heads/master@{#31737}
2015-11-03 10:06:46 +00:00
yangguo
2200c3898a Skip mjsunit/debug-references in gc-stress.
R=machenbach@chromium.org
BUG=v8:3079
LOG=N

Review URL: https://codereview.chromium.org/1406293010

Cr-Commit-Position: refs/heads/master@{#31734}
2015-11-03 08:20:48 +00:00
mstarzinger
e45b90bbe5 [turbofan] Re-enable mjsunit/tools/profviz test for GC stress.
R=bmeurer@chromium.org
TEST=mjsunit/tools/profviz
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419333003

Cr-Commit-Position: refs/heads/master@{#31572}
2015-10-26 15:01:27 +00:00
verwaest
34143f09d2 Revert of Ignore test failure for mjsunit/for-in-opt in gc stress. (patchset id:1 of https://codereview.chromium.org/1295513004/ )
Reason for revert:
This test should work.

Original issue's description:
> Ignore test failure for mjsunit/for-in-opt in gc stress.
>
> TBR=hablich@chromium.org
> BUG=v8:4381
>
> Committed: https://crrev.com/22cf0b591968b7b305094d386d6b10e6c0e723cc
> Cr-Commit-Position: refs/heads/master@{#30245}

TBR=hablich@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4381
LOG=n

Review URL: https://codereview.chromium.org/1419823009

Cr-Commit-Position: refs/heads/master@{#31559}
2015-10-26 12:15:46 +00:00
mstarzinger
e121aabe39 [turbofan] Fix representation type for JSArray::length.
This fixes the representation type for values in JSArray::length fields
when JSNativeContextSpecialization lowers loads. Only arrays with fast
elements kind are guaranteed to have a Smi represented length.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-4515
BUG=v8:4515, v8:4493, v8:4470
LOG=n

Review URL: https://codereview.chromium.org/1410393006

Cr-Commit-Position: refs/heads/master@{#31558}
2015-10-26 12:04:16 +00:00
chunyang.dai
a02d0e96b8 Reland: X87: disable the regress-undefined-nan test case for x87.
The reason is when native_context_specialization flag is ture, X87 turbofan
      will hit the known issue that X87 will change a sNaN to qNaN by default. And
      then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

   reland https://codereview.chromium.org/1414733004/.

BUG=

Review URL: https://codereview.chromium.org/1419573007

Cr-Commit-Position: refs/heads/master@{#31552}
2015-10-26 10:27:48 +00:00
chunyang.dai
e8ff5181d3 Revert of X87: disable the regress-undefined-nan test case for x87. (patchset id:1 of https://codereview.chromium.org/1414733004/ )
Reason for revert:
because of merge mistake, "regress/" is missed when skipping one test case for X87.

 "regress/" will be added when relanding it.

Original issue's description:
> X87: disable the regress-undefined-nan test case for x87.
>
>   The reason is when native_context_specialization flag is ture, X87 turbofan
>   will hit the known issue that X87 will change a sNaN to qNaN by default. And
>   then it will fail when bit-comparing the source (sNaN) and the result (qNaN).
>
> BUG=
>
> Committed: https://crrev.com/b3c719ebbad6c87afefa33a7d0b3f412b2e304db
> Cr-Commit-Position: refs/heads/master@{#31530}

TBR=bmeurer@chromium.org,weiliang.lin@intel.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1417303005

Cr-Commit-Position: refs/heads/master@{#31543}
2015-10-26 04:42:36 +00:00
chunyang.dai
b3c719ebba X87: disable the regress-undefined-nan test case for x87.
The reason is when native_context_specialization flag is ture, X87 turbofan
  will hit the known issue that X87 will change a sNaN to qNaN by default. And
  then it will fail when bit-comparing the source (sNaN) and the result (qNaN).

BUG=

Review URL: https://codereview.chromium.org/1414733004

Cr-Commit-Position: refs/heads/master@{#31530}
2015-10-23 15:48:35 +00:00
mvstanton
21724d6799 Re-enable accessor-map-sharing test
It doesn't fail on tip of tree, we'll investigate if it recurs.

R=mstarzinger@chromium.org
BUG=v8:4493
LOG=N

Review URL: https://codereview.chromium.org/1416453004

Cr-Commit-Position: refs/heads/master@{#31489}
2015-10-23 06:14:36 +00:00
bmeurer
b7985aaeb7 [test] Re-enable mjsunit/constant-folding-2 test that no longer fails.
R=jarin@chromium.org
BUG=v8:4506
LOG=n

Review URL: https://codereview.chromium.org/1413503006

Cr-Commit-Position: refs/heads/master@{#31455}
2015-10-22 08:46:11 +00:00
jarin
14ba9c3dea Introduce a reference to the code object of inlined functions in CompilationInfo.
The newly introduced root makes sure that we do not flush the
optimized code while the function is being compiled.

BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1415133002

Cr-Commit-Position: refs/heads/master@{#31444}
2015-10-21 15:05:32 +00:00
mstarzinger
d9a5add017 [turbofan] Fix liveness analysis for let variable in TDZ.
This makes sure that initializing assignments of let-declared variables
perform an environment lookup and hence keep the variable alive. This is
needed because full-codegen contains debug code verifying the variable
is still inside the TDZ at the initializing assignment.

R=jarin@chromium.org
TEST=mjsunit/compiler/regress-variable-liveness-let
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1420573002

Cr-Commit-Position: refs/heads/master@{#31437}
2015-10-21 12:23:06 +00:00
machenbach
7e5d330917 [test] Disable two more failing tests.
TBR=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1413223007

Cr-Commit-Position: refs/heads/master@{#31425}
2015-10-20 19:59:17 +00:00
mstarzinger
2607e2b06b [turbofan] Disable two more failing tests.
R=jarin@chromium.org
NOTREECHECKS=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412573005

Cr-Commit-Position: refs/heads/master@{#31423}
2015-10-20 16:52:36 +00:00
bmeurer
2abd768e87 [turbofan] Respect effect input when lowering JSToBoolean for string inputs.
This allows us to re-enable the mjsunit/tools/profile test case.

R=jarin@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1418643002

Cr-Commit-Position: refs/heads/master@{#31416}
2015-10-20 15:24:26 +00:00
mstarzinger
a64d387ad2 [turbofan] Disable failing mjsunit/harmony/reflect test.
R=bmeurer@chromium.org
TEST=mjsunit/harmony/reflect --exhaustive-variants
NOTREECHECKS=true
NOTRY=true
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414263002

Cr-Commit-Position: refs/heads/master@{#31412}
2015-10-20 14:16:53 +00:00
bmeurer
58befc9b81 [test] Differentiate between exhaustive and default testing variants.
Review URL: https://codereview.chromium.org/1402353006

Cr-Commit-Position: refs/heads/master@{#31409}
2015-10-20 13:16:51 +00:00
bmeurer
d5847622f9 [turbofan] Stage --turbo-inlining behind --turbo flag.
This stages the general purpose inlining mechanism in TurboFan and
also disables the remaining tests that still fail. We do this to get
test coverage early and to avoid regressing inlining as we go along.

R=jarin@chromium.org,mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1419623002

Cr-Commit-Position: refs/heads/master@{#31406}
2015-10-20 10:57:02 +00:00
Benedikt Meurer
063e2316d7 Revert "[turbofan] Stage --turbo-inlining behind --turbo flag." and "[turbofan] Skip more tests that fail with --turbo-inlining."
This reverts commit 019f9408dc,
6ed05f44af and
e34c343d2a.

TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1413183004 .

Cr-Commit-Position: refs/heads/master@{#31393}
2015-10-20 06:23:02 +00:00
Benedikt Meurer
019f9408dc [turbofan] Skip more tests that fail with --turbo-inlining.
TBR=mstarzinger@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1414173002 .

Cr-Commit-Position: refs/heads/master@{#31389}
2015-10-20 04:44:46 +00:00
mstarzinger
e34c343d2a [turbofan] Stage --turbo-inlining behind --turbo flag.
This stages the general purpose inlining mechanism in TurboFan and also
disables the remaining tests that still fail. We do this to get test
coverage early and to avoid regressing inlining as we go along.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1412703002

Cr-Commit-Position: refs/heads/master@{#31386}
2015-10-20 03:54:12 +00:00
jarin
f9a9c6be0e [turbofan] Introduce lazy bailout, masked as a call.
This introduces an explicit lazy bailout. It is wrapped in the call
node, mostly because the lazy deoptimization processing is married
to the call processing in the instruction selector and the code generator.

It is still a terrible hack.

R=bmeurer@chromium.org,mstarzinger@chromium.org
BUG=chromium:543994,v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1412443003

Cr-Commit-Position: refs/heads/master@{#31353}
2015-10-19 06:21:26 +00:00
machenbach
5831a243dc [test] Skip flaky test on windows.
BUG=v8:4495
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1410723002

Cr-Commit-Position: refs/heads/master@{#31324}
2015-10-16 07:11:14 +00:00
mstarzinger
2aba89e336 Remove bogus flags from call-counts.js test.
The runtime flag in question makes no sense, because the feature cannot
be disabled without keeping the snapshot in sync. We should avoid having
the flag in our "mjsunit" test suite, so that CluserFuzz doesn't pick it
up. The test in question is already skipped, the change will not affect
test results on our waterfall.

R=mvstanton@chromium.org
TEST=mjsunit/call-counts
BUG=v8:4458
LOG=n

Review URL: https://codereview.chromium.org/1409533003

Cr-Commit-Position: refs/heads/master@{#31302}
2015-10-15 13:31:57 +00:00
mstarzinger
e6a923ab56 [turbofan] Fix various issues with --turbo-inlining enabled.
This is in preparation to enabling --turbo-inlining by default, fixing
various issues when general purpose inlining is running against our
entire test suite.

R=bmeurer@chromium.org
BUG=v8:4493
LOG=n

Review URL: https://codereview.chromium.org/1407533004

Cr-Commit-Position: refs/heads/master@{#31294}
2015-10-15 12:02:06 +00:00
mlippautz
5a3929ea4f Reland "Add bailout for large objects when allocating arrays in optimized code."
This reverts commit dc0adc5668.

NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1392853009

Cr-Commit-Position: refs/heads/master@{#31284}
2015-10-15 09:54:49 +00:00
ishell
77faf5d0f1 Do not run mjsunit/compare-known-objects-slow in GC-stress mode.
NOTRY=true

Review URL: https://codereview.chromium.org/1393713004

Cr-Commit-Position: refs/heads/master@{#31155}
2015-10-07 14:57:00 +00:00
Benedikt Meurer
30f1b0e1e2 [turbofan] Disable failing test due to try...catch and lazy deopts.
This seems to be triggered now with global object specialization.

TEST=mjsunit/regress/regress-crbug-450960
TBR=mstarzinger@chromium.org
BUG=v8:4195
LOG=n

Review URL: https://codereview.chromium.org/1388403002 .

Cr-Commit-Position: refs/heads/master@{#31147}
2015-10-07 12:08:38 +00:00
ishell
aa6a654a0f Temporarily disable mjsunit/call-counts test until --vector-stores is prermanently enabled.
BUG=v8:4458
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1387533002

Cr-Commit-Position: refs/heads/master@{#31067}
2015-10-02 09:29:10 +00:00
machenbach
366dc81143 [Swarming] Presort tests - slowest first.
Swarming won't support an incremental data file. By just
sorting the lowest hanging fruits to the beginning we
already get a big bang for the buck (>80% of the improvement
we get otherwise).

This will require semi-regular manual updates of the
slowest tests.

BUG=chromium:535160
LOG=n

Review URL: https://codereview.chromium.org/1385443002

Cr-Commit-Position: refs/heads/master@{#31061}
2015-10-01 19:19:17 +00:00
dusan.m.milosavljevic
8bd431de92 MIPS64: Add big-endian support for mips64.
TEST=
BUG=

Review URL: https://codereview.chromium.org/1334793004

Cr-Commit-Position: refs/heads/master@{#31011}
2015-09-29 17:23:55 +00:00
jkummerow
afa60ff604 [field type tracking] Fix handling of cleared WeakCells
Whenever a generalization is computed, the inputs must be checked for being cleared, and if they are, the generalization must be Type::Any.

Hopefully this fixes Chromium issue 527994 as well.

BUG=v8:4325,chromium:527994
LOG=n

Review URL: https://codereview.chromium.org/1361103002

Cr-Commit-Position: refs/heads/master@{#30887}
2015-09-23 12:35:36 +00:00
ishell
f5dc276a2c Exclude test/mjsunit/regress/regress-4121.js from GC stress testing.
NOTRY=true

Review URL: https://codereview.chromium.org/1364583003

Cr-Commit-Position: refs/heads/master@{#30885}
2015-09-23 11:15:58 +00:00
ishell
3d964e0b83 Disable tests that are known to be non-deterministic in --verify-predictable mode.
Review URL: https://codereview.chromium.org/1352803002

Cr-Commit-Position: refs/heads/master@{#30799}
2015-09-17 13:02:10 +00:00
mstarzinger
5e15679809 [turbofan] Disable test that started to timeout.
The two tests in question got a lot slower and started to timeout now
that the C++ fallback implementation of the %Arguments intrinsics is
composable with respect to inlining.

R=bmeurer@chromium.org,machenbach@chromium.org

Review URL: https://codereview.chromium.org/1330203003

Cr-Commit-Position: refs/heads/master@{#30674}
2015-09-10 10:39:17 +00:00
machenbach
44a93bcbea [test] Skip slow test on no18n bot.
TBR=hablich@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1321063004

Cr-Commit-Position: refs/heads/master@{#30466}
2015-08-31 11:15:10 +00:00
Benedikt Meurer
eceaaf7d19 [test] Fix wrong mjsunit.status line.
TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1325453002 .

Cr-Commit-Position: refs/heads/master@{#30437}
2015-08-28 10:22:19 +00:00
Benedikt Meurer
03541141b9 [test] Properly disable test that doesn't work in GC stress.
The magic "print(i)" work-around was no longer work-arounding correctly,
so we do the right thing instead now.

TBR=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1306843004 .

Cr-Commit-Position: refs/heads/master@{#30436}
2015-08-28 10:20:46 +00:00
Ben Smith
14495ba64a Re-enable regress-crbug-501711 and regress-4279 for --isolates tests
BUG=v8:4378
TBR=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1305583002 .

Cr-Commit-Position: refs/heads/master@{#30258}
2015-08-19 20:59:59 +00:00
Ben Smith
7d706b6b74 Remove regress-crbug-518748. It's too hard to make this non-flaky
BUG=chromium:518748
R=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1297403002 .

Cr-Commit-Position: refs/heads/master@{#30257}
2015-08-19 18:58:20 +00:00
Ben Smith
8f441181a5 Disable regress-crbug-518748. It is failing/flaking on many bots
BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1306443002 .

Cr-Commit-Position: refs/heads/master@{#30256}
2015-08-19 17:48:49 +00:00
yangguo
22cf0b5919 Ignore test failure for mjsunit/for-in-opt in gc stress.
TBR=hablich@chromium.org
BUG=v8:4381

Review URL: https://codereview.chromium.org/1295513004

Cr-Commit-Position: refs/heads/master@{#30245}
2015-08-19 10:03:50 +00:00
Ben Smith
f644b71e75 Disable regress-crbug-518748 on ARM
BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1290683004 .

Cr-Commit-Position: refs/heads/master@{#30238}
2015-08-18 18:55:58 +00:00
Ben Smith
49d1004bfb Disable regress-crbug-518748 on debug
Seems to fail only on V8 Linux - debug - code serializer
(See http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20code%20serializer/builds/3762)

BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1294163003 .

Cr-Commit-Position: refs/heads/master@{#30233}
2015-08-18 18:16:29 +00:00
yangguo
54f18db864 Skip regress-4279 for --isolates tests.
R=hablich@chromium.org
BUG=v8:4378
LOG=N

Review URL: https://codereview.chromium.org/1290383004

Cr-Commit-Position: refs/heads/master@{#30223}
2015-08-18 14:36:13 +00:00
yangguo
1ecc6715bb Skip regress-crbug-501711 for --isolates tests.
TBR=hablich@chromium.org
BUG=v8:4378
LOG=N

Review URL: https://codereview.chromium.org/1295813006

Cr-Commit-Position: refs/heads/master@{#30216}
2015-08-18 11:14:43 +00:00
Adam Klein
eeb1149df9 Try turning object-observe test back on in gc-stress
Also remove obsolete reference to harmony/object-observe in deopt fuzzer
skip section.

BUG=chromium:478788
LOG=n
TBR=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1272193004 .

Cr-Commit-Position: refs/heads/master@{#30037}
2015-08-05 21:26:32 +00:00
yangguo
6a2d3ad606 Remove serializer-specific hash table size heuristic.
The heuristic can cause weird behavior when bootstrapping.
The memory savings is not worth this hassle.

Committed: https://crrev.com/fc80f29a582b758d14aae864232624ca45e47ddc
Cr-Commit-Position: refs/heads/master@{#30019}

Review URL: https://codereview.chromium.org/1265983006

Cr-Commit-Position: refs/heads/master@{#30026}
2015-08-05 12:51:49 +00:00
binji
053b8434f0 [d8] Fix tsan bugs
script_executed and last_run are read/written by multiple threads. Also
externalized_shared_contents_ is modified by multiple threads.

BUG=4306
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1252623003

Cr-Commit-Position: refs/heads/master@{#29912}
2015-07-30 08:20:51 +00:00
yangguo
30392b5ea5 Blacklist regress-3960 from turbofan.
TBR=adamk@chromium.org
BUG=v8:4325,chromium:513160
LOG=N

Review URL: https://codereview.chromium.org/1259863003

Cr-Commit-Position: refs/heads/master@{#29863}
2015-07-27 08:32:20 +00:00
dusan.milosavljevic
82339644b2 MIPS: Fix missing falthru handling for some branch cases in TF.
TEST=mjsunit/asm/embenchen/zlib
BUG=

Review URL: https://codereview.chromium.org/1232313007

Cr-Commit-Position: refs/heads/master@{#29735}
2015-07-17 15:59:40 +00:00
mstarzinger
bdd2be879d [turbofan] Disable one failing debugger test.
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1242023003

Cr-Commit-Position: refs/heads/master@{#29707}
2015-07-16 15:12:41 +00:00
binji
3ec841f2b5 Disable d8-worker-sharedarraybuffer test (fails on TSAN)
See http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/4695/steps/Check%20%28flakes%29/logs/d8-worker-sharedarray..

BUG=v8:4306
R=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
LOG=n

Review URL: https://codereview.chromium.org/1241713003

Cr-Commit-Position: refs/heads/master@{#29664}
2015-07-14 23:34:35 +00:00
binji
4073657ec8 Reland of d8 workers: make sure Shell::Quit is only called once (patchset id:1 of https://codereview.chromium.org/1235083004/)
Reason for revert:
Looks like the failure is unrelated to my change (still fails after the revert). See http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/856/steps/webkit_unit_tests/logs/stdio

Original issue's description:
> Revert of d8 workers: make sure Shell::Quit is only called once (patchset  id:80001 of https://codereview.chromium.org/1230403003/)
>
> Reason for revert:
> Breaks webkit_unit_tests. See http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Win/builds/853/steps/webkit_unit_tests/logs/stdio
>
> Original issue's description:
> > d8 workers: make sure Shell::Quit is only called once
> >
> > When running with isolates, Quit can be called simultaneously by two threads.
> > If this happens, then both threads try to clean up the Workers, which could
> > crash.
> >
> > BUG=v8:4279
> > R=jarin@chromium.org
> > R=machenbach@chromium.org
> > LOG=n
> >
> > Committed: https://crrev.com/76184292b392d107609f21662a949b58bb1e258c
> > Cr-Commit-Position: refs/heads/master@{#29654}
>
> TBR=jarin@chromium.org,machenbach@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4279
>
> Committed: https://crrev.com/6b2c6eb75678747afca59b4a78ace597e218145d
> Cr-Commit-Position: refs/heads/master@{#29656}

TBR=jarin@chromium.org,machenbach@chromium.org,adamk@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4279

Review URL: https://codereview.chromium.org/1224203004

Cr-Commit-Position: refs/heads/master@{#29663}
2015-07-14 23:04:32 +00:00