Commit Graph

17853 Commits

Author SHA1 Message Date
Igor Sheludko
7a159da151 [runtime] Cleanup Map fields and bit fields definitions.
Bug: v8:7109
Change-Id: I9766d28998fca49b0d3e6dc9aca3cc19f0b42124
Reviewed-on: https://chromium-review.googlesource.com/809244
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49925}
2017-12-07 11:55:56 +00:00
Clemens Hammacher
9a91669f40 [Liftoff] Fix cache state initialization
Ensure that the type is always stored correctly.

R=titzer@chromium.org

Bug: v8:6600, chromium:791810
Change-Id: Id3a3c20b14f8730b9550c548dec49ac47121e691
Reviewed-on: https://chromium-review.googlesource.com/811188
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49924}
2017-12-07 10:51:46 +00:00
Michael Achenbach
d6fe8479ba [test] Skip flaky tests in minor_mc variant
TBR=mlippautz@chromium.org
NOTRY=true

Change-Id: I01fc2f77bb7df0b9ef7355c9910ca6d7423e46ca
Reviewed-on: https://chromium-review.googlesource.com/813614
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49918}
2017-12-07 07:38:25 +00:00
jing.bao
2995a890ac [ia32][wasm] Add F32x4 Eq/Ne/Lt/Le
Bug: 
Change-Id: I68e3f62612d9e6e7c915931c1c6f810d59df31eb
Reviewed-on: https://chromium-review.googlesource.com/810524
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#49916}
2017-12-07 01:48:15 +00:00
Karl Schimpf
0d5de9ad9b [wasm] First step of refactoring trap handling to be per module.
The previous code assumed that trap handling was a global concept, defined
by function trap_handler::UseTrapHandler(). This CL does the first step
in changing the decision to be specifiable at a module level.

Therefore trap_handler::UseTrapHandler() is replaced by
trap_handler::IsTrapHandlerEnabled(), and communicates if compilation
supports the use of trap handlers (but still allowing the use of
bounds checking on memory accesses).

It then refactors the classes ModuleEnv and WasmCompiledModule to have
a field "use_trap_handler" that specifies if traps should be used for
the memory accesses in the module being compiled.

Bug: v8:7143
Change-Id: I9844842d5721c86c2dd55e911b42bf8b9922cf63
Reviewed-on: https://chromium-review.googlesource.com/802322
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49915}
2017-12-07 01:00:55 +00:00
Alexei Filippov
14ac02c49c [cpu-profiler] Clear code entries when no observers are present.
Performed manual testing as well by making 20 CPU profile recordings of
loading http://meduza.io page. Without the patch the page renderer memory size
grows beyond 300MB. With the patch it remains below 200MB.

BUG=v8:6623

Change-Id: Ifce541b84bb2aaaa5175520f8dd49dbc0cb5dd20
Reviewed-on: https://chromium-review.googlesource.com/798020
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49914}
2017-12-06 22:58:05 +00:00
Alexey Kozyatinskiy
27cff23c4d [inspector] avoid running gc before reporting scripts
It will help us to preserve some scripts for user.

R=alph@chromium.org
TBR=jgruber@chromium.org

Bug: chromium:655701
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I6d42434148c2d9eb41c3a2af906e8c14ccf8d9a9
Reviewed-on: https://chromium-review.googlesource.com/806741
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49913}
2017-12-06 20:02:22 +00:00
Jakob Kummerow
0bcb1d6f2d [flags] Introduce --disallow-code-generation-from-strings
Exposing the existing Context::AllowCodeGenerationFromStrings(false) API
to the command line.

Bug: v8:7134
Change-Id: I062ccff0b03c5bcf6878c41c455c0ded37a1d743
Reviewed-on: https://chromium-review.googlesource.com/809631
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49911}
2017-12-06 19:10:33 +00:00
Clemens Hammacher
b1e725791c [wasm] Make trace flags read only in release builds
This saves us 14.2kB binary size in libv8.so (in release mode), and
probably also improves performance a little bit.

R=titzer@chromium.org

Bug: v8:7109
Change-Id: I345a48369aaf054572a4fd4368bf5cd526ed146a
Reviewed-on: https://chromium-review.googlesource.com/797270
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49905}
2017-12-06 16:49:26 +00:00
Ulan Degenbaev
ac5b4223ad [heap] Add regression test for 791582.
Bug: chromium:791582
Change-Id: Ic2b4289431a4bd7b4b5a37437d25ebccd493497a
Reviewed-on: https://chromium-review.googlesource.com/809130
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49903}
2017-12-06 16:19:26 +00:00
Igor Sheludko
2b08723c53 [ic] Prototype-only dictionaries, step 1.
- When a global object changes, invalidate its validity cell.
- The global object prototypes don't need to be gathered into an array in InitPrototypeChecks.

Bug: v8:7159
Change-Id: I3621c914d08b83e49e8a391800a92eb53ba19feb
Reviewed-on: https://chromium-review.googlesource.com/808588
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49901}
2017-12-06 16:08:55 +00:00
Georg Neis
75002114db [bigint] Enable test262's BigInt tests.
Bug: v8:6791
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I4a8aebe68617a75fa5ab9778bfa1f2ca561e9aef
Reviewed-on: https://chromium-review.googlesource.com/756841
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49900}
2017-12-06 16:02:55 +00:00
peterwmwong
1d17438905 [js-perf-test] Add Array.p.findIndex microbenchmarks
Bug: chromium:791045, v8:1956, v8:7165
Change-Id: I03f26bbbe65217cedf663af59ef5eb63a5dcf039
Reviewed-on: https://chromium-review.googlesource.com/810039
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49899}
2017-12-06 15:57:05 +00:00
Georg Neis
793dbfd9b9 [bigint,compiler] Fix typed-lowering of JSStrictEqual.
R=jarin@chromium.org

Bug: v8:6791
Change-Id: I9d3787f670d44d68cc2c6474621b6c6a25642e5a
Reviewed-on: https://chromium-review.googlesource.com/803434
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49896}
2017-12-06 14:46:25 +00:00
Clemens Hammacher
61493f5bdd [wasm] Add test case for narrowing store
When implementing Liftoff I realized that these are not tested at all
in our cctests.

R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I9f4da9bb93580f556bc67ebe8b79427373e656ba
Reviewed-on: https://chromium-review.googlesource.com/808385
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49894}
2017-12-06 13:27:39 +00:00
Tobias Tebbi
2290ad8b55 [turbofan] do not remove speculative Number operations when they can deopt
We cannot remove a speculative operation when it's type relies on it to deopt.
Fix this by only relying on the lowering to remove operations.

Bug: chromium:786521
Change-Id: I2cf45e8d45b76cfeb06e6329f323cade74719124
Reviewed-on: https://chromium-review.googlesource.com/793043
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49882}
2017-12-06 09:16:58 +00:00
jing.bao
3cc75409ce [ia32][wasm] Add F32x4 Splat/ExtractLane/ReplaceLane.
Add vshufps, vmovaps, insertps/vinsertps

Bug: 
Change-Id: I178cde529b5309a5221086ab916e5485a8b67d5a
Reviewed-on: https://chromium-review.googlesource.com/802999
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Jing Bao <jing.bao@intel.com>
Cr-Commit-Position: refs/heads/master@{#49880}
2017-12-06 02:55:26 +00:00
Jakob Kummerow
b4470ea4cf Reland "[bigint] Fix early-return in asIntN"
For "top digit" (of the result) comparison to be applicable, we must
also check that there are no further digits in the source.

The included regression test flushes out another bug in "TruncateToNBits",
so that gets fixed here too (in contrast to the first landing attempt).

This reverts commit cb9e7af4e5.

Bug: v8:7150
Change-Id: Id631b1ae79e60b8e85ed4667e246a64c46765f2b
Reviewed-on: https://chromium-review.googlesource.com/807348
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49877}
2017-12-05 17:31:58 +00:00
Mircea Trofin
355e2f0888 [wasm] s/wasm-heap/wasm-code-manager
Rename to better capture what the files contain.

Removed includes of wasm-code-manager.h from .h files to improve
build time.

Bug: 
Change-Id: I0f0108cfb00b061c4433b6ff9670e9c4cae9c699
Reviewed-on: https://chromium-review.googlesource.com/807368
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49875}
2017-12-05 16:30:06 +00:00
Daniel Clifford
6f6ca7301a Fix OOB access in Array.prototype.slice
Bug: chromium:791345
Change-Id: I81e5e23e2ddfc5e78a4ca922ceffda28516277c3
Reviewed-on: https://chromium-review.googlesource.com/806097
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49871}
2017-12-05 14:34:17 +00:00
Jaroslav Sevcik
f8834852a9 [turbofan] Temporarily disable write barrier elimination for stores of small integers.
The proper fix would be to make TruncatingUseInfoFromRepresentation
respect tagged signed use representation, but requires extra work
to refine typing for all values that are stored into Smi fields.

Bug: chromium:791245
Change-Id: I83965bcc18a836d2c758a6a8b1477a4aa2c6133d
Reviewed-on: https://chromium-review.googlesource.com/808866
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49870}
2017-12-05 14:26:46 +00:00
Georg Neis
7ffc331d64 [compiler] Add regression test exhibiting int64 deopt literals.
R=jarin@chromium.org

Bug: chromium:791958
Change-Id: I483558270f4dfa845dff4ff88076be27bb15cc8e
Reviewed-on: https://chromium-review.googlesource.com/808804
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49867}
2017-12-05 14:04:41 +00:00
Martyn Capewell
b6c334d568 [arm64] Fix cctests that require unaligned sp
Fix cctests to maintain an aligned stack pointer, and delete a couple
that don't make sense if only an aligned stack pointer is allowed.

Bug: v8:6644
Change-Id: Ib825df0f93515ec408169018eb97ab587f1f14b6
Reviewed-on: https://chromium-review.googlesource.com/808386
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#49866}
2017-12-05 14:00:51 +00:00
peterwmwong
e0e1a5e564 [js-perf-test] Add Array.p.find microbenchmarks
Bug: chromium:791045, v8:1956, v8:7165
Change-Id: I5c5cf74376f61f71591a8c67fbc9d1584a2b9128
Reviewed-on: https://chromium-review.googlesource.com/807748
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49864}
2017-12-05 13:43:51 +00:00
Marja Hölttä
85230f7b8a [ic] Prototype-only dictionaries, step 0.
- When a dictionary mode prototype changes, invalidate the validity cell.
- The dictionary mode prototypes don't need to be gathered into an array in InitPrototypeChecks.

Bug: v8:7159
Change-Id: I1c7bbaf4b20556f44df18be1463d38fa4fbabe05
Reviewed-on: https://chromium-review.googlesource.com/793732
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49857}
2017-12-05 10:20:25 +00:00
Benedikt Meurer
3ef6e45ee3 [turbofan] Properly type the OrderedHashTableHealIndex builtin result.
This unblocks the checks in the SimplifiedLowering that whenever we
store something as TaggedSigned, the input type should at least be
Type::SignedSmall.

Bug: chromium:791245
Change-Id: Ice6e55c2c6584c0ff60c1e033ba755c8863af32a
Reviewed-on: https://chromium-review.googlesource.com/808104
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49856}
2017-12-05 09:51:15 +00:00
Michael Achenbach
897416af7f Revert "[turbofan] Make sure TruncatingUseInfoFromRepresentation respects Smi representation."
This reverts commit cc07ac73a4.

Reason for revert: Breaks benchmarks:
http://shortn/_POjH6zA7tp

Original change's description:
> [turbofan] Make sure TruncatingUseInfoFromRepresentation respects Smi representation.
> 
> Eventually, we want to fix this also for tagged pointers (tracking bug: https://crbug.com/v8/7162).
> 
> Bug: chromium:791245
> Change-Id: I93d6deff36cedcc9a4665fab0abe6fffdae9b61b
> Reviewed-on: https://chromium-review.googlesource.com/806457
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49850}

TBR=jarin@chromium.org,bmeurer@chromium.org

Change-Id: I0ff571b161ec40ba1f32ee048f8255c42414d8d2
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:791245
Reviewed-on: https://chromium-review.googlesource.com/807985
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49853}
2017-12-05 08:27:35 +00:00
peterwmwong
99b5f699ab [builtins] Port Array.p.{find,findIndex} to CSA
- Removes JS implementation and InnerArrayFind/InnerArrayFindIndex
- Adds TFJ, with TFS for slow continuation path

Some quick benchmarks show ~2x improvement for unoptimized code
and up to 16% improvement against optimized code (diminishes with
larger arrays as iterating dominates).

https://github.com/peterwmwong/v8-perf/blob/master/array-find-findIndex/README.md

Bug: chromium:791045, v8:1956, v8:5049, v8:7165
Change-Id: Ie16252ed495bbd91fe548b16d5ef6764de791a50
Reviewed-on: https://chromium-review.googlesource.com/804704
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49851}
2017-12-05 07:23:13 +00:00
Jaroslav Sevcik
cc07ac73a4 [turbofan] Make sure TruncatingUseInfoFromRepresentation respects Smi representation.
Eventually, we want to fix this also for tagged pointers (tracking bug: https://crbug.com/v8/7162).

Bug: chromium:791245
Change-Id: I93d6deff36cedcc9a4665fab0abe6fffdae9b61b
Reviewed-on: https://chromium-review.googlesource.com/806457
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49850}
2017-12-05 06:00:57 +00:00
Eric Holk
5fb4b176fa [wasm] Move wasm objects from Isolate to new WasmEngine object
This is a small refactoring that moves the WasmCodeManager and
CompilationManager from being a part of the Isolate directly to living in a new
WasmEngine object. This makes it easier to change Wasm components without
rebuilding so much of V8, and also enables future changes to Wasm without
affecting unrelated parts of V8.

Bug: v8:7109
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic89bfc3974483aa909d12556d1386e18785a1d71
Reviewed-on: https://chromium-review.googlesource.com/804824
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49848}
2017-12-05 01:32:21 +00:00
Michael Achenbach
cb9e7af4e5 Revert "[bigint] Fix early-return in asIntN"
This reverts commit e110b59cc7.

Reason for revert: Breaks arm debug on chromebook hardware:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/5335

Original change's description:
> [bigint] Fix early-return in asIntN
> 
> For "top digit" (of the result) comparison to be applicable, we must
> also check that there are no further digits in the source.
> 
> Bug: v8:7150
> Change-Id: I6ad317f6f600e11fef59b9907da1055e5586a3a8
> Reviewed-on: https://chromium-review.googlesource.com/804639
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49846}

TBR=jkummerow@chromium.org,neis@chromium.org

Change-Id: I5dae82696d3ecb9602f73a2ff4760ed7bbcef1c5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7150
Reviewed-on: https://chromium-review.googlesource.com/806838
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49847}
2017-12-04 22:07:17 +00:00
Jakob Kummerow
e110b59cc7 [bigint] Fix early-return in asIntN
For "top digit" (of the result) comparison to be applicable, we must
also check that there are no further digits in the source.

Bug: v8:7150
Change-Id: I6ad317f6f600e11fef59b9907da1055e5586a3a8
Reviewed-on: https://chromium-review.googlesource.com/804639
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49846}
2017-12-04 20:31:19 +00:00
Jaroslav Sevcik
9a6f4422c6 [deoptimizer] Fix materialization of iterators.
Bug: chromium:787301
Change-Id: If32310f9f2f3f04daa5bdaa9779302f4a012d397
Reviewed-on: https://chromium-review.googlesource.com/806223
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49843}
2017-12-04 17:57:45 +00:00
Caitlin Potter
52ff3ae48b [builtins] implement RunMicrotasks pump as a code stub
- Implement RunMicrotasks in CSA to prevent a potentially large number
  of jumps between C++ and JS code while consuming te queue. Appears to
  provide a ~60% speedup in microtask-heavy code, which from limited
  testing appears to scale linearly.

  The code-stub microtask pump bails out to the old C++ microtask pump
  if it encounters a CallHandlerInfo microtask, and remains in C++ for
  the remainder of the queue (returning to the JS/stub implementation
  after the bailed out queue is exhausted).

- Add a variation of JSEntryStub which enters the new RunMicrotasks code
  stub.

- Add a new RunMicrotasks helper to Execution, which uses the
  RunMicrotasks entry stub.

Bug: 
Change-Id: I4667d4dd633d24455ea5d7cef239da0af1a7365e
Reviewed-on: https://chromium-review.googlesource.com/650486
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49842}
2017-12-04 17:55:29 +00:00
Ulan Degenbaev
fd554885a8 [heap] Add background GC tracing infrastructure.
A background task can now use GCTracer::BackgroundScope to
trace the time spent in the task. The time shows up in
--trace-gc-nvp output and in the runtime call stats for GC.

The destructor of GCTracer::BackgroundScope increments the
corresponding counter in heap()->tracer()->background_counter_,
which is protected by a mutex.

The GCTracer::Stop function fetches background_counter_ items
into the global scope and into the runtime call stats.

Bug: chromium:758183
Change-Id: Id7bcd5089ba6c027fe9a57eb3f7db1cb5092aec5
Reviewed-on: https://chromium-review.googlesource.com/801694
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49841}
2017-12-04 17:28:41 +00:00
Mircea Trofin
e4c97c8249 [wasm] W^X mechanism for WasmCodeManager.
This enables the invariant that a NativeModule's code may either be
executable or writable, but never both at the same time.

Bug: v8:7105
Change-Id: If2abfce6796a365bb675a82140f32e8f45bb923f
Reviewed-on: https://chromium-review.googlesource.com/804208
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49840}
2017-12-04 17:22:31 +00:00
Jaroslav Sevcik
104a2db3c7 Revert "[deoptimizer] Staged materialization of objects."
This reverts commit e71b802279.

Reason for revert: Need to have a back-mergeable fix.

Original change's description:
> [deoptimizer] Staged materialization of objects.
> 
> The existing object materialization in the deoptimizer has the following problems:
> 
> - Objects do not necessarily verify during materialization (because during the
>   depth first walk we might have inconsistent objects).
> 
> - Stack can overflow (because we just materialize using recursive calls).
> 
> - We generalize object fields.
> 
> 
> This CL re-implements the materialization algorithm to solve this problem. The
> new implementation creates the objects in two steps:
> 
> 1. We allocate space for all the objects. In general, we allocate ByteArrays
>    of the right size. For leaf objects that cannot participate in cycles,
>    we build and initialize the materialized objects completely.
> 
>    For JS objects, we insert markers into the byte array at the positions
>    where unboxed doubles are expected.
> 
> 2. We initialize all the objects with the proper field values and change the
>    map from the ByteArray map to the correct map. This requires some sync
>    with the concurrent marker (Heap::NotifyObjectLayoutChange).
> 
>    When initializing the JS object fields, we make sure that we respect
>    the unboxed double marker.
> 
> Bug: chromium:770106, v8:3836
> Change-Id: I1ec466a9d19db9538df4ba915516d4c3ca825632
> Reviewed-on: https://chromium-review.googlesource.com/777559
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49821}

TBR=ulan@chromium.org,mstarzinger@chromium.org,jarin@chromium.org

Change-Id: I0657fb75330700dd7883c600dacb25676ebb47f9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:770106, v8:3836
Reviewed-on: https://chromium-review.googlesource.com/806160
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49834}
2017-12-04 16:02:21 +00:00
Georgia Kouveli
74d339e1dc [cctest] Small refactoring of code generator tests.
This is to avoid calling AssembleTailCallBeforeGap and AssembleTailCallAfterGap
directly where possible (so making the tests less dependent on the code generator
interface when we're not directly testing it). It also makes sure that the
instruction we pass to AssembleTailCallBeforeGap and AssembleTailCallAfterGap is
indeed a tail call, with the immediate argument that specifies the stack delta.

This is to prepare for padding arguments for arm64 JSSP removal. We will need to
store padding in AssembleTailCallAfterGap, which will need the information from
a TailCall instruction.

Bug: v8:6644
Change-Id: Ia5485412a4244c7b2a133aa0541b9f8285680de4
Reviewed-on: https://chromium-review.googlesource.com/806117
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#49833}
2017-12-04 15:53:38 +00:00
Michal Majewski
68c5d01ad6 Reland "Reland "[test] Creating command before execution phase.""
This is a reland of 3b06511052
Original change's description:
> Reland "[test] Creating command before execution phase."
> 
> This is a reland of 98cc9e862f
> Original change's description:
> > [test] Creating command before execution phase.
> > 
> > Immutable command class with shell, flags and
> > environment.
> > 
> > Command creation moved from worker to the main
> > process. Because of that there is no need to send
> > test cases beyond process boundaries and load test
> > suites in worker processes.
> > 
> > Bug: v8:6917
> > Change-Id: Ib6a44278095b4f7141eb9b96802fe3e8117678a6
> > Reviewed-on: https://chromium-review.googlesource.com/791710
> > Commit-Queue: Michał Majewski <majeski@google.com>
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#49746}
> 
> Bug: v8:6917
> Change-Id: I49c29a8db813c47909f2cc45070ac7721a447c7a
> Reviewed-on: https://chromium-review.googlesource.com/800370
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michał Majewski <majeski@google.com>
> Cr-Commit-Position: refs/heads/master@{#49756}

Bug: v8:6917
Change-Id: Ia39010a0a0f63537ad12490dfab17897d70d4930
Reviewed-on: https://chromium-review.googlesource.com/806034
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michał Majewski <majeski@google.com>
Cr-Commit-Position: refs/heads/master@{#49830}
2017-12-04 13:40:29 +00:00
Georg Neis
fb54e570e1 Enable clang's -Wunreachable-code warning.
The motivation is to avoid bugs such as the one fixed in
https://chromium-review.googlesource.com/c/v8/v8/+/800270.

Bug: v8:7109
Change-Id: I82a55f4a78d289d00ae7bafe78b45d92bab07a6b
Reviewed-on: https://chromium-review.googlesource.com/800291
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49829}
2017-12-04 13:09:25 +00:00
Camillo Bruni
5275c3c41c [api] Mark SetNamedPropertyHandler as soon to be deprecated
Eventually we should migrate to new new-style callbacks which take Names
instead of Strings as first arguments everywhere. Internally we don't really
handler NamedPropertyCallbackXX differently from the newer
GenericNamedPropertyCallbackXX.

Bug: v8:7109
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I827182f447427c222d5144f1a3e27bf543226e51
Reviewed-on: https://chromium-review.googlesource.com/803340
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49824}
2017-12-04 11:06:50 +00:00
Pierre Langlois
77021584fe [arm64] Generate TBNZ for 32-bit '(x & (1 << N)) == (1 << N)'
Add support for matching '(x & mask) == mask' when mask has a single bit set,
and translate this into a tbnz instruction. This patch only does this for 32-bit
operations, we can port it to 64-bit operations as a follow-up if we find
matches.

This transformation mostly touches the snapshot where we get ~120 hits. This pattern can
also show up in JavaScript when introduced by the EffectControlLinearizer pass.

Bug: 
Change-Id: Ib37c6e0bd3831b7c17709357b00ca53735621605
Reviewed-on: https://chromium-review.googlesource.com/803272
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#49822}
2017-12-04 10:23:25 +00:00
Jaroslav Sevcik
e71b802279 [deoptimizer] Staged materialization of objects.
The existing object materialization in the deoptimizer has the following problems:

- Objects do not necessarily verify during materialization (because during the
  depth first walk we might have inconsistent objects).

- Stack can overflow (because we just materialize using recursive calls).

- We generalize object fields.


This CL re-implements the materialization algorithm to solve this problem. The
new implementation creates the objects in two steps:

1. We allocate space for all the objects. In general, we allocate ByteArrays
   of the right size. For leaf objects that cannot participate in cycles,
   we build and initialize the materialized objects completely.

   For JS objects, we insert markers into the byte array at the positions
   where unboxed doubles are expected.

2. We initialize all the objects with the proper field values and change the
   map from the ByteArray map to the correct map. This requires some sync
   with the concurrent marker (Heap::NotifyObjectLayoutChange).

   When initializing the JS object fields, we make sure that we respect
   the unboxed double marker.

Bug: chromium:770106, v8:3836
Change-Id: I1ec466a9d19db9538df4ba915516d4c3ca825632
Reviewed-on: https://chromium-review.googlesource.com/777559
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49821}
2017-12-04 09:23:03 +00:00
Andreas Haas
d3dc8b32cd [wasm] Update spec tests
R=bradnelson@chromium.org

Change-Id: I100f33a7c0da2f86aea78cf645b7a784a920596b
Reviewed-on: https://chromium-review.googlesource.com/805241
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49819}
2017-12-04 09:09:54 +00:00
Andreas Haas
96ece3f8a0 [cleanup][wasm] Use ArrayVector in streaming-decoder-unittests.cc
Bug: v8:7109
Change-Id: Id71f85a38e6c4f37176e1a70bf5c1e584ee08c56
Reviewed-on: https://chromium-review.googlesource.com/803345
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49818}
2017-12-04 09:01:04 +00:00
Andreas Haas
08ded3735f [cleanup] Move d8 mjsunit tests into the d8 directory
Since we have this d8 directory now, we can also use it.

R=machenbach@chromium.org

Bug: v8:7109
Change-Id: I595ceb30e1c9350ad00d5cfaf998e40294602103
Reviewed-on: https://chromium-review.googlesource.com/803214
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49817}
2017-12-04 08:59:44 +00:00
Mathias Bynens
822be9b238 Normalize casing of hexadecimal digits
This patch normalizes the casing of hexadecimal digits in escape
sequences of the form `\xNN` and integer literals of the form
`0xNNNN`.

Previously, the V8 code base used an inconsistent mixture of uppercase
and lowercase.

Google’s C++ style guide uses uppercase in its examples:
https://google.github.io/styleguide/cppguide.html#Non-ASCII_Characters

Moreover, uppercase letters more clearly stand out from the lowercase
`x` (or `u`) characters at the start, as well as lowercase letters
elsewhere in strings.

BUG=v8:7109
TBR=marja@chromium.org,titzer@chromium.org,mtrofin@chromium.org,mstarzinger@chromium.org,rossberg@chromium.org,yangguo@chromium.org,mlippautz@chromium.org
NOPRESUBMIT=true

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I790e21c25d96ad5d95c8229724eb45d2aa9e22d6
Reviewed-on: https://chromium-review.googlesource.com/804294
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49810}
2017-12-02 01:24:40 +00:00
Deepti Gandluri
ec8e7e65b0 [wasm] Add Atomic Load, Store Ops to the interpreter
Bug: v8:6532
Change-Id: I2ae9c2a2d2b6a02826a50cd150cb8008841f55e4
Reviewed-on: https://chromium-review.googlesource.com/804212
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49807}
2017-12-01 23:03:02 +00:00
Michael Achenbach
d3a8dec257 Revert "Reland "[test] Creating command before execution phase.""
This reverts commit 3b06511052.

Reason for revert: Broke fuzzers:
https://build.chromium.org/p/client.v8.clusterfuzz/builders/V8%20Deopt%20Fuzzer/builds/384

Original change's description:
> Reland "[test] Creating command before execution phase."
> 
> This is a reland of 98cc9e862f
> Original change's description:
> > [test] Creating command before execution phase.
> > 
> > Immutable command class with shell, flags and
> > environment.
> > 
> > Command creation moved from worker to the main
> > process. Because of that there is no need to send
> > test cases beyond process boundaries and load test
> > suites in worker processes.
> > 
> > Bug: v8:6917
> > Change-Id: Ib6a44278095b4f7141eb9b96802fe3e8117678a6
> > Reviewed-on: https://chromium-review.googlesource.com/791710
> > Commit-Queue: Michał Majewski <majeski@google.com>
> > Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#49746}
> 
> Bug: v8:6917
> Change-Id: I49c29a8db813c47909f2cc45070ac7721a447c7a
> Reviewed-on: https://chromium-review.googlesource.com/800370
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michał Majewski <majeski@google.com>
> Cr-Commit-Position: refs/heads/master@{#49756}

TBR=machenbach@chromium.org,sergiyb@chromium.org,majeski@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6917
Change-Id: I4938642c4396366be1e13daf6998c4b8538b688b
Reviewed-on: https://chromium-review.googlesource.com/804254
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49805}
2017-12-01 20:44:50 +00:00
Erik Luo
d9806cec94 DevTools: also use default label for console.count
Aligns console.count() behavior with spec, which says the default label
should be "default" when the label provided is not defined.

Bug: chromium:700624
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ie58af210d300ef3151082b23187dd18e356f5de8
Reviewed-on: https://chromium-review.googlesource.com/780620
Commit-Queue: Erik Luo <luoe@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49804}
2017-12-01 20:17:20 +00:00