Commit Graph

41108 Commits

Author SHA1 Message Date
Michael Achenbach
798076b1af Revert "[CQ] Temporarily exclude broken bot from CQ"
This reverts commit 0d910860c9.

Reason for revert: Bot is fixed again.

Original change's description:
> [CQ] Temporarily exclude broken bot from CQ
> 
> TBR=neis@chromium.org
> 
> Change-Id: I59903a40c1ca47cce3e5744c51a2abda93e45dad
> Reviewed-on: https://chromium-review.googlesource.com/567931
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46580}

TBR=machenbach@chromium.org,neis@chromium.org

Bug: chromium:741505
Change-Id: I47068e6364e8b417b75ffd687e7758c41fc0ed0f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/569738
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46616}
2017-07-13 07:30:26 +00:00
Peter Marshall
d11da5891f [builtins] Allow TypedArray constructor to accept big negative numbers.
Previously we enforced that all lengths for ArrayLike objects must
be within Smi range, but all negative numbers should actually be first
converted to +0.

Bug: chromium:740372
Change-Id: If50de9ce0eeb7cb09e14b8e8803f434350d00508
Reviewed-on: https://chromium-review.googlesource.com/566867
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46615}
2017-07-13 06:43:53 +00:00
Ben Noordhuis
de3a85d1c1 Fix v8::Value::IsExternal() map check.
Insertion into a collection changes the map because of the addition of
the hash value property.  Check the root map, not the current map.

Fixes: https://github.com/nodejs/node/issues/14139
Change-Id: Iabcea5337323b9b6deffa1a06892c1cb749f2065
Reviewed-on: https://chromium-review.googlesource.com/566833
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46614}
2017-07-13 06:37:13 +00:00
v8-autoroll
815741eee3 Update V8 DEPS.
Rolling v8/build: 7e59b44..f64cb20

Rolling v8/buildtools: 1dcd1bd..c2827ae

Rolling v8/third_party/catapult: 08d8c9f..1286055

Rolling v8/tools/clang: 4dc63de..f6f6b65

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I98b37d30910e31eed44072520b817ebec95c0f98
Reviewed-on: https://chromium-review.googlesource.com/569407
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46613}
2017-07-13 03:45:01 +00:00
agrieve
19ffed65ba Add js-perf-test to exercise v8_inspector::String16
BUG=chromium:738469

Review-Url: https://codereview.chromium.org/2962213002
Cr-Commit-Position: refs/heads/master@{#46612}
2017-07-13 00:22:02 +00:00
Sathya Gunasekaran
ea632716d7 [d8] Fix stack overflow when importing modules
Bug: chromium:740694
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ib23bca1942c25d8a9f32e12be3f7b50fc3ab55c8
Reviewed-on: https://chromium-review.googlesource.com/568222
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46611}
2017-07-12 23:39:51 +00:00
Adam Klein
293d84c737 Reorder VariableMode enums to slightly simplify IsLexicalVariableMode()
Change-Id: I0f4756efdaa9468bcbd88949ddb2e2d7cae3ce06
Reviewed-on: https://chromium-review.googlesource.com/568917
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46610}
2017-07-12 22:59:30 +00:00
Adam Klein
935b4e838b [cleanup] Remove unused "last" values from VariableMode and VariableKind
Change-Id: Id46a9007021c8f1508a9a737b1e35d12bffd872b
Reviewed-on: https://chromium-review.googlesource.com/568254
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46609}
2017-07-12 22:56:50 +00:00
Ross McIlroy
aa69a48f78 Disable StringConcat bytecode.
Didn't seem to help and caused a couple of regressions.

BUG=v8:6243,chromium:740124

Change-Id: I72887ba245a524211dbf181c77d0cdc6d917d090
Reviewed-on: https://chromium-review.googlesource.com/568480
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46608}
2017-07-12 21:51:20 +00:00
Adam Klein
b56c0f7a7e [scope] Null out rare_data_ when aborting preparsing
When we abort preparsing, we have to reset the Scope state, to ensure
re-parsing will leave us in the proper Zone. Resetting of rare_data_
was missing, causing this to fail in some cases.

Bug: chromium:740803
Change-Id: I7ce70f9c4670eaf1b76745ae8231eb95625b0f4b
Reviewed-on: https://chromium-review.googlesource.com/568784
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46607}
2017-07-12 20:26:10 +00:00
Adam Klein
53fa87354e [tests] Skip slow test debug-step-prefix-bytecodes in debug mode
It's been regularly timing out on the Linux debug bot.

TBR=machenbach@chromium.org

Change-Id: I250fc55acb5d714c7060edb691eb9759a7d38a15
Reviewed-on: https://chromium-review.googlesource.com/568794
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46606}
2017-07-12 20:22:04 +00:00
Karl Schimpf
e1ab347dac Remove is_sync counter flag from module_decoder.cc
This turns on collection of function size bytes, and decode time for functions in all cases (both background and foreground).

Bug: v8:6361
Change-Id: I5d982ec4452596210b3ea9858126820ad0c3eacf
Reviewed-on: https://chromium-review.googlesource.com/568781
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46605}
2017-07-12 20:18:00 +00:00
Jaideep Bajwa
fa4ec9fdbe [date] Refactor PosixTimezoneCache for different OS
Follow up on https://codereview.chromium.org/2740353002. Created
PosixDefaultTimezoneCache which is a subclass of PosixTimezoneCache
containing definition of LocalTimezone and LocalTimeOffset which is
separate for different OS.

R=littledan@chromium.org, ulan@chromium.org

BUG=v8:6578
LOG=N

Change-Id: I58342893aeefe79ac50e1df041d614fc473f15bf
Reviewed-on: https://chromium-review.googlesource.com/568686
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#46604}
2017-07-12 19:42:10 +00:00
Camillo Bruni
36421dc467 [literals] Disable double lazy boilerplate for literals containing Arrays
By creating the boilerplate only on the second instantiation we cannot
propagate back the elements transitions early enough. The resulting literals
would change the initial ElementsKind one step too late and already pollute
ICs that went to monomorphic state.

- Disable lazy AllocationSites for literals containing arrays
- Introduce new ComplexLiteral class to share code between ObjectLiteral
  and ArrayLiteral
- RegexpLiteral now no longer needs a depth_ field

Bug: v8:6517, v8:6519, v8:6211
Change-Id: Ia88d1878954e8895c3d00a7dda8d71e95bba005c
Reviewed-on: https://chromium-review.googlesource.com/563305
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46603}
2017-07-12 19:11:04 +00:00
Camillo Bruni
34874b3b19 Reland "[mjsunit] Improve mjsunit stracktrace readability"
This is a reland of f720d024dc
Original change's description:
> [mjsunit] Improve mjsunit stracktrace readability
> 
> Format the function name and file-position into proper columns to easily spot
> where the test code ends and the mjsunit framework code starts.
> 
> BEFORE:
> Stack: Error
>     at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
>     at failWithMessage (test/mjsunit/mjsunit.js:310:11)
>     at fail (test/mjsunit/mjsunit.js:327:12)
>     at assertEquals (test/mjsunit/mjsunit.js:398:7)
>     at closure (test/mjsunit/regress/regress-4121.js:20:7)
>     at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
>     at test (test/mjsunit/regress/regress-4121.js:37:5)
>     at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
>     at test/mjsunit/regress/regress-4121.js:49:6
>     at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
>     throw new MjsUnitAssertionError(message);
> 
> AFTER:
> Stack: MjsUnitAssertionError
>     at assertEquals          test/mjsunit/mjsunit.js 398:7
>     at closure               test/mjsunit/regress/regress-4121.js 20:7
>     at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
>     at test                  test/mjsunit/regress/regress-4121.js 37:5
>     at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
>     at                       test/mjsunit/regress/regress-4121.js 49:6
>     at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
>     throw new MjsUnitAssertionError(message);
> 
> 
> Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
> Reviewed-on: https://chromium-review.googlesource.com/563627
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46589}

Change-Id: I44bf07f7be4114369315605542cafd17345b4397
Reviewed-on: https://chromium-review.googlesource.com/567063
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46602}
2017-07-12 19:01:21 +00:00
Adam Klein
873d51673a Propagate exceptions from JSFunction::SetName as needed
JSFunction::SetName can fail if it tries to create a string with
length > String::kMaxLength (either by prepending "set "/"get " or
by surrounding a Symbol descriptor with "["/"]").

This patch propagates that exception to the surrounding code rather
than CHECK-failing.

Bug: chromium:740398
Change-Id: I394943af481f3147387dd82ec5862d7071d57827
Reviewed-on: https://chromium-review.googlesource.com/566092
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46601}
2017-07-12 18:32:39 +00:00
Alexandre Talon
42c8df3f46 [Turbofan] Fixed a reducer returning Changed() instead of NoChange()
The JSTypedLowering reducer was returning Changed(node) when it
did not change the node, in case the node was a speculative number
comparison node.

Bug: 
Change-Id: I2082e4c2e45078b343e427f54d61d4e0a323a64f
Reviewed-on: https://chromium-review.googlesource.com/568036
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Alexandre Talon <alexandret@google.com>
Cr-Commit-Position: refs/heads/master@{#46600}
2017-07-12 17:18:19 +00:00
Clemens Hammacher
a52b9cd887 Define symbols properly
The problem popped up when passing the constants by reference
(https://chromium-review.googlesource.com/c/565141).
It's a bit ugly, but, the C++11 standard requires a definition
additionally to the existing declaration in the body of the class:

9.4.2/4: If a static data member is of const literal type, its
  declaration in the class definition can specify a
  brace-or-equal-initializer in which every initializer-clause that is
  an assignment-expression is a constant expression. A static data
  member of literal type can be declared in the class definition with
  the constexpr specifier; if so, its declaration shall specify a
  brace-or-equal-initializer in which every initializer-clause that i
  an assignment-expression is a constant expression. [Note: In both
  these cases, the member may appear in constant expressions. — end
  note] The member shall still be defined in a namespace scope if it is
  odr-used (3.2) in the program and the namespace scope definition shall
  not contain an initializer.

Drive-by: Make the static constants constexpr.

R=bmeurer@chromium.org

Change-Id: Idc3d20bf2adf31d874c23ff8bfec52437789160a
Reviewed-on: https://chromium-review.googlesource.com/567506
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46599}
2017-07-12 17:16:49 +00:00
Mythri
2ea3b16cad [TurboFan] In branch-elimination create ControlPathConditions only if needed
In branch elimination phase, control paths are updated when visiting
the nodes. We first create a control path and then check if it is
same as the exisiting one. If it is the same we discard the newly
created one. Since these are created in the zone memory the memory
will not be released till the entire pass is over. This cl changes
it to first check if the control path has changed and create a new
path only if it has changed.

Bug: chromium:725664,v8:6150
Change-Id: I67fbea13036f85999c7ed366c571f8dc1c17a023
Reviewed-on: https://chromium-review.googlesource.com/563406
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46598}
2017-07-12 17:02:29 +00:00
Ulan Degenbaev
5c9e5814dc [heap] Add worklist tracing in concurrent marker.
BUG=chromium:694255

Change-Id: I49618ccb7e7c87dfd8ba8b2359c4384198fd1c30
Reviewed-on: https://chromium-review.googlesource.com/568306
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46597}
2017-07-12 16:11:27 +00:00
Daniel Clifford
1f9734d5d7 Disambiguate DCHECKs from CHECKs in their output message
This makes it possible for automated tests to distinguish between CHECK
failures and DCHECK failures, the latter of which will continue to run
in release builds after the assertion failure point.

Change-Id: Ie26978c0342d401a8c85f3261749739195087579
Reviewed-on: https://chromium-review.googlesource.com/565515
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46596}
2017-07-12 14:54:34 +00:00
Michael Starzinger
9f5593b843 [compiler] Leave stack space for job finalization.
This makes sure we leave some gap on the stack whenever compilation jobs
are being finalized. Such a finalization can trigger assembling back on
the main thread, hence requiring a non-negligible amount of stack. This
is in sync with other {Runtime_CompileFoo} methods.

R=ishell@chromium.org
BUG=chromium:740400,chromium:741599

Change-Id: I96fbd524c3cd443a1f5a8e22925b92407fadfb63
Reviewed-on: https://chromium-review.googlesource.com/568142
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46595}
2017-07-12 14:31:44 +00:00
Camillo Bruni
6b34496034 [literals] Reuse InitializeAllocationMemento in FastCloneShallowObject
- Update InitializeAllocationMemento to use newer CSA helper
- Fix AllocateJSArray to create AllocationMementos for empty arrays as well

Bug: v8:6211
Change-Id: I8731b04cdd500b877a54dee67f00f2899d91d86d
Reviewed-on: https://chromium-review.googlesource.com/566810
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46594}
2017-07-12 14:10:44 +00:00
Georg Neis
c7e8f23754 [compiler] Move the wasm pipeline's code assembly pass into the background.
R=ahaas@chromium.org, bmeurer@chromium.org

Bug: v8:6048
Change-Id: I5641cb1036fb0c6bf0803de3df9ddeb5787a93de
Reviewed-on: https://chromium-review.googlesource.com/563308
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46593}
2017-07-12 14:06:24 +00:00
Georg Neis
c86ad81b5b Revert "[mjsunit] Improve mjsunit stracktrace readability"
This reverts commit f720d024dc.

Reason for revert: Bot failure at
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/15690

Original change's description:
> [mjsunit] Improve mjsunit stracktrace readability
> 
> Format the function name and file-position into proper columns to easily spot
> where the test code ends and the mjsunit framework code starts.
> 
> BEFORE:
> Stack: Error
>     at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
>     at failWithMessage (test/mjsunit/mjsunit.js:310:11)
>     at fail (test/mjsunit/mjsunit.js:327:12)
>     at assertEquals (test/mjsunit/mjsunit.js:398:7)
>     at closure (test/mjsunit/regress/regress-4121.js:20:7)
>     at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
>     at test (test/mjsunit/regress/regress-4121.js:37:5)
>     at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
>     at test/mjsunit/regress/regress-4121.js:49:6
>     at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
>     throw new MjsUnitAssertionError(message);
> 
> AFTER:
> Stack: MjsUnitAssertionError
>     at assertEquals          test/mjsunit/mjsunit.js 398:7
>     at closure               test/mjsunit/regress/regress-4121.js 20:7
>     at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
>     at test                  test/mjsunit/regress/regress-4121.js 37:5
>     at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
>     at                       test/mjsunit/regress/regress-4121.js 49:6
>     at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
>     throw new MjsUnitAssertionError(message);
> 
> 
> Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
> Reviewed-on: https://chromium-review.googlesource.com/563627
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46589}

TBR=machenbach@chromium.org,cbruni@chromium.org,ishell@chromium.org

Change-Id: I631cec7f318637ce2f60500e2bf0ab7fe1f6d09e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/567062
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46592}
2017-07-12 14:02:36 +00:00
Yang Guo
bc16cd0cf8 No longer disable double field tracking for serialized isolates.
Previously, the serializer would share mutable heap numbers between
contexts. The workaround was to disable double field tracking entirely
during bootstrapping of isolates preparing to be serialized.

This does not cover custom scripts run between bootstrapping and
serialization, and can cause race conditions when writing to the flag.

This no longer seems necessary since we can correctly tell mutable and
immutable heap numbers apart by instance type now.

Bug: v8:6585
Change-Id: I7a59ffaad9d96f1c2b08813e19505f4fda95e555
Reviewed-on: https://chromium-review.googlesource.com/566861
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46591}
2017-07-12 13:48:04 +00:00
jgruber
645a1ea5dd [coverage] Move source ranges out of AST
This CL moves collected source range information out of AST nodes
and into a side table stored on ParseInfo. The side table is only 
created if block coverage is enabled, so there's almost no memory
overhead in the standard case.

Change-Id: I41871b8425ebbc6217d82d3ad26b5fc9e5d68ecb
Reviewed-on: https://chromium-review.googlesource.com/566808
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46590}
2017-07-12 13:36:24 +00:00
Camillo Bruni
f720d024dc [mjsunit] Improve mjsunit stracktrace readability
Format the function name and file-position into proper columns to easily spot
where the test code ends and the mjsunit framework code starts.

BEFORE:
Stack: Error
    at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
    at failWithMessage (test/mjsunit/mjsunit.js:310:11)
    at fail (test/mjsunit/mjsunit.js:327:12)
    at assertEquals (test/mjsunit/mjsunit.js:398:7)
    at closure (test/mjsunit/regress/regress-4121.js:20:7)
    at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
    at test (test/mjsunit/regress/regress-4121.js:37:5)
    at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
    at test/mjsunit/regress/regress-4121.js:49:6
    at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
    throw new MjsUnitAssertionError(message);

AFTER:
Stack: MjsUnitAssertionError
    at assertEquals          test/mjsunit/mjsunit.js 398:7
    at closure               test/mjsunit/regress/regress-4121.js 20:7
    at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
    at test                  test/mjsunit/regress/regress-4121.js 37:5
    at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
    at                       test/mjsunit/regress/regress-4121.js 49:6
    at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
    throw new MjsUnitAssertionError(message);


Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
Reviewed-on: https://chromium-review.googlesource.com/563627
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46589}
2017-07-12 13:30:24 +00:00
Maya Lekova
7280d03b98 Implement micro-benchmark for Proxy call and construct
Bug: v8:6558, v8:6557
Change-Id: Ife58f78d00bfd53d6b904e838cbd028f039945b4
Reviewed-on: https://chromium-review.googlesource.com/567501
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46588}
2017-07-12 13:27:54 +00:00
Daniel Ehrenberg
cad3c5a166 [parser] Disallow async functions as destructuring targets
This patch teaches the parser that async functions are not valid
destructuring targets so that it can cleanly exit with a SyntaxError.
Previously, async functions used in the wrong position would lead
to a check failure.

Bug: chromium:740366
Change-Id: Ie5b0cf50326c3f96174c6b29d0ccedb5da4f75a2
Reviewed-on: https://chromium-review.googlesource.com/567002
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46587}
2017-07-12 13:21:54 +00:00
Clemens Hammacher
869dd9b36e [utils] Make Abs return an unsigned value
In most cases, this does not matter, especially if assigning to the
source variable again:
x = Abs(x)

But there are cases where it matters, e.g. when being used as argument
to a template function:
DCHECK_EQ(x, Abs(x));
which would currently *not* fail for x==kMinInt.

R=tebbi@chromium.org

Change-Id: Ia5abfe164db602b80a34548e0bf9b22033b77c6e
Reviewed-on: https://chromium-review.googlesource.com/568028
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46586}
2017-07-12 13:18:24 +00:00
Michael Starzinger
0a4ad44050 [turbofan] Fix inline JSGeneratorObject allocation.
This makes sure the inline allocation of generator objects only shrinks
initial maps when slack tracking is actually in progress. Shrinking all
unused properties unconditionally is bogus because instances using them
might have become unreachable and collected by the GC.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-741078
BUG=chromium:741078

Change-Id: Iaf2f08a4fa82c820a945bf012d24c760a6b4f514
Reviewed-on: https://chromium-review.googlesource.com/567982
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46585}
2017-07-12 12:47:22 +00:00
Daniel Ehrenberg
8345cd3e09 [tests] Fix timezone dependence in an intl test
In certain timezones, being at noon UTC doesn't guarantee that
you'll be the same day in local time. This patch fixes that
false assumption. Thanks to Holmes He for reporting the issue.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I7432c0eb1e13fdf11c665e59dabaebeb79bff8c8
Reviewed-on: https://chromium-review.googlesource.com/568021
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46584}
2017-07-12 12:23:22 +00:00
Ulan Degenbaev
5e724050da [heap] Replace marking deque with marking worklist.
Change-Id: Id73c2c3a8b19c3e398d7de760dffe95e0e8b49a4
Reviewed-on: https://chromium-review.googlesource.com/566836
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46583}
2017-07-12 12:01:42 +00:00
Georg Neis
97f5e1fad0 Reland "[compiler] Move the main pipeline's code assembly pass into the background."
This is a reland of 66b54ab152
Original change's description:
> [compiler] Move the main pipeline's code assembly pass into the background.
> 
> R=bmeurer@chromium.org
> 
> Bug: v8:6048
> Change-Id: I60bc35c02b5460416c3b0e2872fc72ebf9b808a5
> Reviewed-on: https://chromium-review.googlesource.com/563386
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46499}

TBR=bmeurer@chromium.org

Bug: v8:6048
Change-Id: Ifcdd660dd69c6c4c1bc628961f4180a0b6ea4d9f
Reviewed-on: https://chromium-review.googlesource.com/567061
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46582}
2017-07-12 10:46:02 +00:00
Georg Neis
c97c01b2bc [assembler] Don't look at max_old_generation_size when growing buffer.
TF will instantiate the Assembler when we're already on a background
thread, so it's not safe to read out the heap's max_old_generation_size
(it can change). This CL simply removes the use of that value from the
assembler. If the buffer gets too large we will fail when creating the
actual code object.

Bug: v8:6048
Change-Id: Ifb8a64c90222e4516117d237b001779fae060d28
Reviewed-on: https://chromium-review.googlesource.com/567921
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46581}
2017-07-12 10:07:22 +00:00
Michael Achenbach
0d910860c9 [CQ] Temporarily exclude broken bot from CQ
TBR=neis@chromium.org

Change-Id: I59903a40c1ca47cce3e5744c51a2abda93e45dad
Reviewed-on: https://chromium-review.googlesource.com/567931
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46580}
2017-07-12 10:03:31 +00:00
Pierre Langlois
2b551661ae [arm] Handle 32 and 128 bit FP stack moves.
It seems there was a typo which meant we didn't generate any code for 32 and 128
bit slot to slot moves.

Bug: 
Change-Id: Ia6982ec92471d16541d8ee873e1de33e4f46e77a
Reviewed-on: https://chromium-review.googlesource.com/566812
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#46579}
2017-07-12 08:57:46 +00:00
Michael Lippautz
b1eecfd527 [heap] Scavenger fixes
Various Scavenger fixes for smaller issues that accumulated over the
last years.

Bug: chromium:738865
Change-Id: I7573e438eba030944b99c65807944c662526a171
Reviewed-on: https://chromium-review.googlesource.com/567190
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46578}
2017-07-12 08:42:36 +00:00
Michael Lippautz
f6f86e7401 [heap] Worklist: Avoid false sharing for Segment access
Bug: chromium:738865
Change-Id: Iffa80389def41cf03719c01b56f7971612367660
Reviewed-on: https://chromium-review.googlesource.com/567154
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46577}
2017-07-12 08:37:37 +00:00
Michael Lippautz
5fe5cbf808 [heap] Scavenger: Update counters locally
Bug: chromium:738865
Change-Id: I53f82a459a82057486dcba26696fadebf7befcf7
Reviewed-on: https://chromium-review.googlesource.com/567156
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46576}
2017-07-12 08:36:31 +00:00
Michael Starzinger
4a4bcda388 [turbofan] Introduce upper limit for table switch size.
This introduces 2^16 as an upper limit for the allowed value range of a
table switch on all architectures. It also fixes several overflows in
the table size calculation.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-736633
BUG=chromium:736633

Change-Id: I931bd226c99eb8a1ae1770c159fc314ff650bf57
Reviewed-on: https://chromium-review.googlesource.com/566829
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46575}
2017-07-12 08:35:26 +00:00
jgruber
3c260762da [string] Handle two-byte contents in String.p.toLowerCase
Previously (since f0e95769), this toLowerCase fast-path assumed
it would only see one-byte flat contents. Unfortunately, it's 
possible to have a one-byte sliced string that has a two-byte parent.

This CL ensures that String.p.toLowerCase handles such cases
correctly.

BUG=chromium:736451

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Iae056b3db5535bb5665439a5cc8282a51571a548
Reviewed-on: https://chromium-review.googlesource.com/565559
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46574}
2017-07-12 06:25:26 +00:00
Alexey Kozyatinskiy
292e96709c [inspector] catch exception during object.toString() call for console
Console methods should never throw an exception.

R=jgruber@chromium.org

Bug: chromium:736302
Change-Id: I05791b366d46a43b2a78825cbb8a82bb049110e6
Reviewed-on: https://chromium-review.googlesource.com/567434
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46573}
2017-07-12 06:01:42 +00:00
v8-autoroll
3d2698906c Update V8 DEPS.
Rolling v8/build: 6ada47b..7e59b44

Rolling v8/third_party/catapult: b708a0d..08d8c9f

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I8dd5b454dae8273252f2b8404db2f25da71ef9c8
Reviewed-on: https://chromium-review.googlesource.com/567707
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46572}
2017-07-12 03:29:32 +00:00
Adam Klein
ee629440af [csa] Update CSA_ASSERT in StoreFixedArrayElement to accept PropertyArrays
Change-Id: I48adcad748a84dccbd542739f436dccfd6adca1d
Reviewed-on: https://chromium-review.googlesource.com/567725
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46571}
2017-07-12 01:18:08 +00:00
Adam Klein
5562f6a276 Make ArrayList::Elements() static in order to be GC-safe
NOTREECHECKS=true

Change-Id: I4ebd05d41d524ac0583b507fcdf7d4c15136d3b8
Reviewed-on: https://chromium-review.googlesource.com/567548
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46570}
2017-07-12 00:15:52 +00:00
Sathya Gunasekaran
892d49a695 [runtime] Introduce PropertyArray
This patch changes the backing store of slow properties to be a
new instance type called PropertyArray.

Currently the only difference between this and a FixedArray is
the map. A future patch will change the length property to store
the hash code.

Bug: v8:5717, v8:6404
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iaebc98f42e6d93c1392772e6f837787beb64afec
Reviewed-on: https://chromium-review.googlesource.com/539028
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46569}
2017-07-11 22:48:54 +00:00
Camillo Bruni
86a9b4e17f [cleanup] CSA: Use CStringConstant helper
Change-Id: Id3989d09f6adfb934842a9b0761d811117d69993
Reviewed-on: https://chromium-review.googlesource.com/567003
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46568}
2017-07-11 21:11:32 +00:00
Michael Achenbach
c917ecfe4e Revert "[inspector] doesn't run user code to stringify console method arg"
This reverts commit 82451d45a7.

Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16923

Original change's description:
> [inspector] doesn't run user code to stringify console method arg
> 
> Otherwise user code can produce an exception and we will crash.
> 
> R=​jakob@chromium.org
> 
> Bug: chromium:736302
> Change-Id: I078150909b0348a63e8c375b508e34fc4751b4ab
> Reviewed-on: https://chromium-review.googlesource.com/565628
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46566}

TBR=kozyatinskiy@chromium.org,jgruber@chromium.org,jakob@chromium.org

Change-Id: I6d7e06fad2ab6c1c894c199fe7b3b6afb2930734
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:736302
Reviewed-on: https://chromium-review.googlesource.com/567060
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46567}
2017-07-11 19:27:49 +00:00