Commit Graph

46862 Commits

Author SHA1 Message Date
Alexey Kozyatinskiy
7a2c371383 [debug] introduced runtime side effect check
This CL demonstrates minimum valuable addition to existing debug evaluate
without side effects mechanism.
With this CL user can evaluate expressions like:
[a,b] // create any kind of temporary array literals
[a,b].reduce((x,y) => x + y, 0); // use reduce method
[1,2,3].fill(2); // change temporary arrays

The core idea: any change of the object created during evaluation without
side effects is side effect free. As soon as we try to store this temporary
object to object existed before evaluation we will terminate execution.

Implementation:
- track all objects allocated during evaluation and mark them as temporary,
- patch all bytecodes which change objects.

A little more details (including performance analysis): [1].

[1] https://docs.google.com/document/d/10qqAtZADspPnpYa6SEdYRxrddfKIZJIzbLtGpsZQkRo/edit#

Bug: v8:7588
Change-Id: I69f7b96e1ebd7ad0022219e8213211c7be72a111
Reviewed-on: https://chromium-review.googlesource.com/972615
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52370}
2018-04-04 21:59:10 +00:00
Ross McIlroy
3a0419a635 [Compiler] Split up Unoptimized/Optimized CompilationInfo and CompilationJobs
With the Ignition + Turbofan pipeline there is very little overlap between the data
needed for unoptimized compilation and optimized compilation. As a result, it is
cleaner to split up the CompilationInfo into UnoptimizedCompilationInfo and
OptimizedCompilationInfo.

Doing so also necessitate splitting up CompilationJob into UnoptimizedCompilationJob
and OptimizedCompilationJob - again there is not much overlap so this seems cleaner.

Change-Id: I1056ad520937b7f8582e4fc3ca8f4910742de30a
Reviewed-on: https://chromium-review.googlesource.com/995895
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52369}
2018-04-04 21:09:01 +00:00
Eric Holk
f56e2a022f [wasm] enable StoreMem_offset_oob_i64 test with trap handlers
The first part of this change updates StoreMem_offset_oob_i64 to use one page of
Wasm memory, rather than just a few bytes. Using less than a page was out of
spec for Wasm anyway, so this is better.

This required a small change in the test runner to set and clear the
thread_in_wasm flag around Wasm calls. This was accomplished by a
ThreadInWasmScope convenience class.

The majority of the changes are because the cctest environment does not support
runtime exceptions. In the code generator, where we used to throw a
WasmMemOutOfBounds exception, we now need to call out to the test hook instead
if runtime exceptions are not supported. This involved plumbing the
runtime_exception_support flag down to the code generator. Rather than adding
and shuffling around extra parameters everywhere, this CL packages the previous
protected instruction list in a new WasmCompilationData object that now includes
the runtime_exception_support flag as well.

Bug: v8:5277
Change-Id: Ic9c9e5a53a07a7773b58c0aee7c26bbd2ddf82f3
Reviewed-on: https://chromium-review.googlesource.com/989017
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52368}
2018-04-04 20:13:40 +00:00
Erik Luo
6da12d420a [debug] expose SideEffectType for whitelisting embedder callbacks
This exposes new flags to allow embedders to whitelist callbacks as
side-effect-free during evaluation with throwOnSideEffect.

Accessors and Functions/FunctionTemplates can take a new param on:
- v8::Object::SetNativeDataProperty
- v8::Object::SetLazyDataProperty
- v8::Object::SetAccessor
- v8::FunctionTemplate::New
- v8::FunctionTemplate::NewWithCache
- v8::Function::New

While Interceptors can be created with an additional flag:
PropertyHandlerFlag::kHasNoSideEffect

Bug: v8:7515
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I14823316bdd6de6d362a1104b65f13504d0db056
Reviewed-on: https://chromium-review.googlesource.com/994550
Commit-Queue: Erik Luo <luoe@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52367}
2018-04-04 20:08:00 +00:00
Ulan Degenbaev
96e83b78d4 [wasm] Use two-pass phantom callbacks for managed objects.
The phantom handle API requires that the first pass callback does not
invoke any V8 API. The current code breaks this requirement by invoking
AdjustAmountOfExternalAllocatedMemory, which can cause GC.

This patch splits the existing callback into two parts. The first part
only resets the handle and the second part performs native delete.

Bug: chromium:827806
Change-Id: I01eed09f94f5499cb9d13397066f4f908a0aa668
Reviewed-on: https://chromium-review.googlesource.com/995796
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52366}
2018-04-04 18:11:21 +00:00
Georgia Kouveli
125f8c81f5 [wasm] Avoid manual relocation of target address
In PatchTrampolineAndStubCalls, use a second iterator over the original
relocation info, to avoid having to reconstruct the original target of
the branch by manually applying the delta between the old and new code.

This way, we do not need to make assumptions regarding how code targets are
encoded.


Change-Id: I551ad8a3a654ead63ea88c8ce1d8c9e1927436b0
Reviewed-on: https://chromium-review.googlesource.com/995442
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#52365}
2018-04-04 17:44:30 +00:00
Ben Titzer
8adb94fc81 Revert "[wasm] Merge the WasmContext into WasmInstanceObject"
This reverts commit 57bf0bfefb.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [wasm] Merge the WasmContext into WasmInstanceObject
> 
> This change makes lifetime management of WasmCode much simpler.
> By using the WasmInstanceObject as the context for WASM code execution,
> including the pointer to the memory base and indirect function tables,
> this keeps the instance alive when WASM code is on the stack, since
> the instance object is passed as a parameter and spilled onto the stack.
> This is in preparation of sharing the code between instances and
> isolates.
> 
> Bug: v8:7424
> 
> Change-Id: Ic2e4b7bcc2feb20001d0553a615a8a9dff36317e
> Reviewed-on: https://chromium-review.googlesource.com/958520
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52361}

TBR=mstarzinger@chromium.org,titzer@chromium.org,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I653e27b46dbc43ad773eda4292d521a508f42d79
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7424
Reviewed-on: https://chromium-review.googlesource.com/995418
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52364}
2018-04-04 17:08:02 +00:00
Igor Sheludko
b6021b983d [runtime] Make Map::GetOrCreatePrototypeChainValidityCell() return smi instead of empty handle.
Bug: v8:5988
Change-Id: I6f62199f062ea32e66903f5385fc109e47fed374
Reviewed-on: https://chromium-review.googlesource.com/970822
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52363}
2018-04-04 17:00:50 +00:00
Sathya Gunasekaran
314517106a Reland "Reland "[test] Add JSTest benchmark for object literal spread""
This reverts commit 99c0410b10.

TBR=bmeurer@chromium.org

Bug: v8:7611
Change-Id: I3f75631e1d15173d2679a3bd37ef05e56e4a28e2
Reviewed-on: https://chromium-review.googlesource.com/995581
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52362}
2018-04-04 16:41:10 +00:00
Ben L. Titzer
57bf0bfefb [wasm] Merge the WasmContext into WasmInstanceObject
This change makes lifetime management of WasmCode much simpler.
By using the WasmInstanceObject as the context for WASM code execution,
including the pointer to the memory base and indirect function tables,
this keeps the instance alive when WASM code is on the stack, since
the instance object is passed as a parameter and spilled onto the stack.
This is in preparation of sharing the code between instances and
isolates.

Bug: v8:7424

Change-Id: Ic2e4b7bcc2feb20001d0553a615a8a9dff36317e
Reviewed-on: https://chromium-review.googlesource.com/958520
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52361}
2018-04-04 16:34:50 +00:00
Clemens Hammacher
f81f301f7e [wasm] Fix BinOp tests for big endian systems
R=ahaas@chromium.org

Bug: v8:6600
Change-Id: I0f82f60dae124167d5dfb05b3ecb6f8b0be7c2f4
Reviewed-on: https://chromium-review.googlesource.com/995458
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52360}
2018-04-04 16:31:49 +00:00
Igor Sheludko
7aa7c5dd24 [ic] Fix performance regression caused by LoadGlobalIC refactoring.
Bug: chromium:798372
Change-Id: I76d7317ef66dd5005250a10961d6732c39d4d108
Reviewed-on: https://chromium-review.googlesource.com/995445
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52359}
2018-04-04 15:57:18 +00:00
Clemens Hammacher
77b076d10a [wasm] Return MaybeHandle where allocation might fail
We sometimes allow allocation to fail and return a null Handle in that
case (e.g. for grow_memory). This refactors this code to return a
MaybeHandle instead, to document that allocation might fail and to force
the caller to handle this.

R=mstarzinger@chromium.org

Change-Id: Ia3ba65f840cfb1cf93e8dbd508a17375c19bae58
Reviewed-on: https://chromium-review.googlesource.com/995438
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52358}
2018-04-04 14:36:05 +00:00
Clemens Hammacher
b7d9672aa6 [wasm] Trigger GC two times before reporting OOM
The first GC will collect dead JSArrayBuffers, but the release of the
underlying JSArrayBuffer::Allocations might be delayed. Hence, a second
GC might be needed.

R=ulan@chromium.org

Bug: v8:7621
Change-Id: Iee714f05cb939bb084d064be6d31dfbab32ff4ba
Reviewed-on: https://chromium-review.googlesource.com/995533
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52357}
2018-04-04 14:16:34 +00:00
Sigurd Schneider
58b503c291 [turbofan] Migrate collections to JSCallReducer
Bug: v8:7340, v8:7250
Change-Id: I57f78fa5ad261f041b66986918c427821a57a6e1
Reviewed-on: https://chromium-review.googlesource.com/995472
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52356}
2018-04-04 14:12:24 +00:00
Michael Starzinger
bffeab32e2 [wasm] Make {CompilationState} independent of module.
R=clemensh@chromium.org

Change-Id: I90992ca98765c22f918a612671b718bdd4b9a764
Reviewed-on: https://chromium-review.googlesource.com/995535
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52355}
2018-04-04 14:10:44 +00:00
Dan Elphick
86d84f5fd2 Reland "[heap] fix Sweeper::kNumberOfSweepingSpaces"
This is a reland of 12420537c8

Original change's description:
> [heap] fix Sweeper::kNumberOfSweepingSpaces
> 
> When indexing into vectors of sweeping spaces, convert the
> AllocationSpace to an index (by subtracting FIRST_GROWABLE_PAGED_SPACE)
> to avoid wasted space at the start.
> 
> Change-Id: Ia23fe6dae42d5accea9f7fe7ec5c3b303ef857b4
> Reviewed-on: https://chromium-review.googlesource.com/978242
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52320}

Change-Id: Ic8ea2d58b9d4cfe97eb8efec93df101b734d5ddd
Reviewed-on: https://chromium-review.googlesource.com/994214
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52354}
2018-04-04 13:57:25 +00:00
Ivo Markovic
dae028ca28 Mips[64] Remove code targets from realocation apply mask.
Code targets are not PC relative encoded on MIPS and are
removed from RelocInfo::kApplyMask.

Change-Id: Ie893626f38bfb7457693df34a22f5cb6bca2cd4c
Reviewed-on: https://chromium-review.googlesource.com/995435
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52353}
2018-04-04 13:02:15 +00:00
jgruber
e42ce2005d [coverage] Fix invalid coverage block transformation
Before reporting coverage data, we attempt to reduce clutter by
merging nested and consecutive ranges. Nested ranges are merged, if
the child range has the same execution count as the parent range.
Sibling ranges are merged, if one sibling begins where the other ends
and execution counts are identical.

This allowed an invalid transformation in which a range with an
execution count of 1 would be merged into the parent change, but the
sibling range with identical start and end points and a count of 0
would remain, effectively deleting the covered range.

For example:

{start: 0, end: 10, count: 1},
{start: 5, end:  8, count: 1},  // It's invalid to remove this.
{start: 5, end:  8, count: 0}

The fix is to separate the parent and sibling merge passes, and
removing duplicate ranges in-between.

Bug: chromium:827530
Change-Id: Ic35eae1d4a106746570ce9cb412ed6710ef6da53
Reviewed-on: https://chromium-review.googlesource.com/992114
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52352}
2018-04-04 12:46:24 +00:00
Clemens Hammacher
53eb8c51bd [Liftoff] Implement i64.add and i64.sub
This adds support for i64 addition and subtraction.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: If7ed762091b0ebd688eb2a8cac84e59b91c8a322
Reviewed-on: https://chromium-review.googlesource.com/992316
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52351}
2018-04-04 12:40:54 +00:00
Sigurd Schneider
e8e74c5ed9 [debugger] Improve unittest
Bug: v8:7584
Change-Id: I03ee3332960bf733a79f95a6cbe8563212cbaa1d
Reviewed-on: https://chromium-review.googlesource.com/995453
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52350}
2018-04-04 12:16:14 +00:00
Igor Sheludko
139fe2db1c [ic] Implement TransitionArray lookup in CSA.
Drive-by cleanup: remove megamorphic stub cache lookup support from generic property
store code. This lookup is no longer necessary because
1) fast stores to existing properties get all the information from the map,
2) transitioning store targets are taken directly from the transition array,
so in both cases there's no point in doing a store handler lookup.

Bug: v8:5988
Change-Id: I95c0a08e7d1a76bb0f4475a9bd685e4e11e16a48
Reviewed-on: https://chromium-review.googlesource.com/983921
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52349}
2018-04-04 11:56:21 +00:00
Michael Starzinger
10273e5b32 [wasm] Remove redundant weak link in CompilationState.
This removes the redundant weak link to the {WasmCompiledModule} from
the {CompilationState} class and instead replaces it with a normal C++
pointer back to the associated {NativeModule}. This reduces the number
of weak links back into the garbage collected heap, such links are
costly for the GC, hard to understand and maintain, and should be kept
at a minimum. Simply explicitly encoding the one-to-one relationship
between the {NativeModule} and the {CompilationState} is easier.

R=clemensh@chromium.org

Change-Id: Ib7f79bc3a89fe463f548615a918f3fa4c9feea59
Reviewed-on: https://chromium-review.googlesource.com/995274
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52348}
2018-04-04 11:55:15 +00:00
Sergiy Byelozyorov
99c0410b10 Revert "Reland "[test] Add JSTest benchmark for object literal spread""
This reverts commit 2ade52e93b.

Reason for revert: still breaks internal bots, e.g. https://uberchromegw.corp.google.com/i/internal.client.v8/builders/v8_nexus7_perf

Original change's description:
> Reland "[test] Add JSTest benchmark for object literal spread"
> 
> This reverts commit cd1dd34f20.
> 
> Patchset 1 is the original CL that was reverted. Patchset 2 has the
> fix.
> 
> TBR=bmeurer@chromium.org
> 
> Bug: v8:7611
> Change-Id: I15291175ab894ef667c001e1b21b8b220e1f9b48
> Reviewed-on: https://chromium-review.googlesource.com/993995
> Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
> Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52337}

TBR=gsathya@chromium.org,bmeurer@chromium.org

Change-Id: Ie7da3a02df16df716293d0104f1f7d16208f1baf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7611
Reviewed-on: https://chromium-review.googlesource.com/995294
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52347}
2018-04-04 10:57:58 +00:00
Michael Achenbach
f49a1a67f5 Revert "[runtime] Remove the construct_stub field of the SFI"
This reverts commit 63ecddc814.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20internal%20snapshot/builds/14773

Original change's description:
> [runtime] Remove the construct_stub field of the SFI
> 
> Don't dispatch based on the construct_stub field anymore. Rather than
> read it out and jump to the construct stub, we can switch on the
> builtin_id.
> 
> Builtins will always have builtin_id as a Smi, so this signals we need
> to jump to JSBuiltinsConstructStub. The only exception is for uncompiled
> functions, which will have kCompileLazy as the builtin_id, but need to
> jump to the generic stub instead.
> 
> API function calls will have a FunctionTemplateInfo in the SFI
> function_data field, and need to go to the builtins stub as well.
> 
> The final case is everything else, which should go to the generic stub.
> 
> Bug: v8:7503
> Change-Id: I14790a5f9784dc0d940bf10a05f5310026e1d482
> Reviewed-on: https://chromium-review.googlesource.com/980941
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52345}

TBR=petermarshall@chromium.org,leszeks@chromium.org,bmeurer@chromium.org

Change-Id: I2031913ab5a12018ad932f920792aa1f6faa5e22
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7503
Reviewed-on: https://chromium-review.googlesource.com/995293
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52346}
2018-04-04 10:34:10 +00:00
Peter Marshall
63ecddc814 [runtime] Remove the construct_stub field of the SFI
Don't dispatch based on the construct_stub field anymore. Rather than
read it out and jump to the construct stub, we can switch on the
builtin_id.

Builtins will always have builtin_id as a Smi, so this signals we need
to jump to JSBuiltinsConstructStub. The only exception is for uncompiled
functions, which will have kCompileLazy as the builtin_id, but need to
jump to the generic stub instead.

API function calls will have a FunctionTemplateInfo in the SFI
function_data field, and need to go to the builtins stub as well.

The final case is everything else, which should go to the generic stub.

Bug: v8:7503
Change-Id: I14790a5f9784dc0d940bf10a05f5310026e1d482
Reviewed-on: https://chromium-review.googlesource.com/980941
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52345}
2018-04-04 10:12:29 +00:00
Michael Achenbach
0ea290a32b Revert "Enable cfi-icall on the v8 CFI bots"
This reverts commit 9a7e9cf2a7.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20cfi/builds/14341

Original change's description:
> Enable cfi-icall on the v8 CFI bots
> 
> BUG=v8:7164
> 
> Change-Id: I7522ba6ac2bde89c84bcd49bc116a432091a2938
> Reviewed-on: https://chromium-review.googlesource.com/990802
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52343}

TBR=machenbach@chromium.org,clemensh@chromium.org,vtsyrklevich@chromium.org

Change-Id: Id979a20d28445e05c6c2266614bb6ea1d6560ef6
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7164
Reviewed-on: https://chromium-review.googlesource.com/995292
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52344}
2018-04-04 10:11:20 +00:00
Vlad Tsyrklevich
9a7e9cf2a7 Enable cfi-icall on the v8 CFI bots
BUG=v8:7164

Change-Id: I7522ba6ac2bde89c84bcd49bc116a432091a2938
Reviewed-on: https://chromium-review.googlesource.com/990802
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52343}
2018-04-04 09:51:49 +00:00
Andreas Haas
fe5f5d4da2 [wasm] Disable test-run-wasm/I64ShlOnDifferentRegisters test
The tests are flaky at the moment.

CC=clemensh@chromium.org
R=machenbach@chromium.org

No-Try: true
Change-Id: Ifc56116ebbe44d92c726c973e2beb8a1ec996379
Reviewed-on: https://chromium-review.googlesource.com/995092
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52342}
2018-04-04 08:22:04 +00:00
Sigurd Schneider
370d95dc36 [turbofan] Enable Promise constructor inlining by default
Bug: v8:7584
Change-Id: I7443c28c74676ee1f27550674c8f712594e21cc7
Reviewed-on: https://chromium-review.googlesource.com/992314
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52341}
2018-04-04 08:17:49 +00:00
Sigurd Schneider
1cee01960b [promises/deoptimizer] Support "catching" builtin continuations
This CL allows builtin continuations to handle pending exceptions.
This implements exception handling for the promise constructor in
case of deoptimization.

Bug: v8:7584


Change-Id: Ib5df5eb6606abb3f9690f294397981858dbdbf25
Reviewed-on: https://chromium-review.googlesource.com/983912
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52340}
2018-04-04 07:30:59 +00:00
Andrey Lushnikov
1637818671 DevTools: Runtime.callFunctionOn should allow evals
This patch teaches Runtime.callFunctionOn to run evals inside its
task. This is aligned with how Runtime.evaluate works.

R=kozy

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I3189beebc9020703d2b2e23a7c828a2394d43910
Reviewed-on: https://chromium-review.googlesource.com/994070
Commit-Queue: Andrey Lushnikov <lushnikov@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52339}
2018-04-04 00:50:41 +00:00
Clemens Hammacher
965edc0e2e Revert "Implement a new spec for timezone offset calculation"
This reverts commit dbdede0101.

Reason for revert: Fails webkit_tests, blocks roll: https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064

Original change's description:
> Implement a new spec for timezone offset calculation
> 
> https://github.com/tc39/ecma262/pull/778 was recently merged
> to Ecma 262.
> 
> It changes the way to convert between "local time" and UTC in such
> a way that it'd work for all timezones whether or not there has
> been any change in the timezone offset of the standard time. For
> instance, Europe/Moscow and some parts of US state of Indiana have
> changed the standard (non-DST) timezone offset a few times. The
> previous spec assumes that the the standard timezone offset is
> constant, but the new spec take into account the offset change
> history.
> 
> In addition, it specifies a new way to calculate the timezone
> offset during a timezone transition (either in and
> out of DST or timezone offset shift).
> 
> During a negative transition (e.g.  fall backward / getting
> out of DST), repeated times are to be interpreted as if the
> offset before the transition is in effect.
> 
> During a positive transition (e.g. spring forward / getting
> into DST), skipped times are to be treated similarly. That
> is, they are to be interpreted as if the offset before the
> transition is in effect.
> 
> With icu-timezone-data, v8 is compliant to the new spec for the
> past and the future as well as now whether or not the standard
> timezone offset of a given timezone has changed over time
> (e.g. Europe/Moscow, Pacific/Apia). With icu-timezone-data,
> Australia/Lord_Howe (30 minute DST change) also works per spec.
> 
> Without icu-timezone-data, it works only for timezones of which
> the standard timezone offset is the same as the current offset
> (e.g. most North American timezones other than parts of Indiana)
> and of which the DST shift is an hour. For instance, it doesn't work
> for Europe/Moscow in 2010 when the standard timezone offset was
> +4h because the current (2018) standard timezone offset is +3h. Neither
> does it for Lord Howe in Australia with the DST shift of 0.5 hr.
> 
> This CL used to require one of the two ICU CLs below, but not
> any more.
> 
>   https://chromium-review.googlesource.com/c/chromium/deps/icu/+/572652
>   https://chromium-review.googlesource.com/851265  (a proposed CL to the
>   upstream ICU).
> 
> Bug: v8:3547,chromium:417640,v8:5714
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ib162295da5bee31b2390bd0918157014aebd3e33
> Reviewed-on: https://chromium-review.googlesource.com/572148
> Commit-Queue: Jungshik Shin <jshin@chromium.org>
> Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52332}

TBR=adamk@chromium.org,littledan@chromium.org,mlippautz@chromium.org,jshin@chromium.org

Change-Id: I6b3bf4427c761b106280d565a3912cd8e25cf87e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:3547, chromium:417640, v8:5714
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/994192
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52338}
2018-04-03 22:07:32 +00:00
Sathya Gunasekaran
2ade52e93b Reland "[test] Add JSTest benchmark for object literal spread"
This reverts commit cd1dd34f20.

Patchset 1 is the original CL that was reverted. Patchset 2 has the
fix.

TBR=bmeurer@chromium.org

Bug: v8:7611
Change-Id: I15291175ab894ef667c001e1b21b8b220e1f9b48
Reviewed-on: https://chromium-review.googlesource.com/993995
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52337}
2018-04-03 22:03:00 +00:00
Nico Weber
d8840043fb Remove pragma optimize from v8.
This instance of `pragma optimize` was from long ago when we built with
frame pointers disabled. We always build with frame pointers on these
days.

(Also, clang-cl ignores this pragma and will warn about it.)

Bug: chromium:505314
Change-Id: Ia125c9c54e6ec486247241102de1cb62c72d268b
Reviewed-on: https://chromium-review.googlesource.com/993423
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52336}
2018-04-03 21:23:14 +00:00
Ben Smith
2e197ba64e [wasm] Implement WebAssembly.Global object
This change implements the WebAssembly.Global object and constructor,
but none of the accessors or functions.

There is a new flag to enable this: --experimental-wasm-mut-global.

Change-Id: Ifeb270d57392d7ca0900c80c0038932c96ee8b61
Reviewed-on: https://chromium-review.googlesource.com/989296
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52335}
2018-04-03 20:59:10 +00:00
Eric Holk
76e79f0f20 Revert "[wasm] Always enable guard regions on 64-bit platforms"
This reverts commit 0cd7468b86.

Reason for revert: Blocks v8 roll into chromium: https://crbug.com/828499

Original change's description:
> [wasm] Always enable guard regions on 64-bit platforms
> 
> This change makes full 8 GiB guard regions always enabled on 64-bit
> platforms.
> 
> Additionally, since all Wasm memory allocation paths have some form of
> guard regions, this removes and simplifies most of the logic around
> whether to enable guard regions.
> 
> R=​gdeepti@chromium.org
> 
> Change-Id: Idf3fbcc11ac70ea2ee7eb88c2173d6a1410395e1
> Reviewed-on: https://chromium-review.googlesource.com/985142
> Commit-Queue: Eric Holk <eholk@chromium.org>
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52310}

TBR=bradnelson@chromium.org,gdeepti@chromium.org,eholk@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I126b5afe283a4fe08adfa301e637d2641c29cccd
Reviewed-on: https://chromium-review.googlesource.com/993160
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52334}
2018-04-03 18:43:31 +00:00
Ulan Degenbaev
cf52c1018d [heap] Optimize for memory usage near OOM.
This patch enables ShouldOptimizeForMemoryUsage if the old generation
size is within 1/8th of the max old generation size.

This patch also passes the reduce-memory flag to incremental marking
whenever ShouldOptimizeForMemoryUsage is enabled.

Bug: chromium:824214
Change-Id: I5cfc0566ca0e23dfa1b8c0439a4e67424ddc852d
Reviewed-on: https://chromium-review.googlesource.com/973524
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52333}
2018-04-03 18:12:59 +00:00
Jungshik Shin
dbdede0101 Implement a new spec for timezone offset calculation
https://github.com/tc39/ecma262/pull/778 was recently merged
to Ecma 262.

It changes the way to convert between "local time" and UTC in such
a way that it'd work for all timezones whether or not there has
been any change in the timezone offset of the standard time. For
instance, Europe/Moscow and some parts of US state of Indiana have
changed the standard (non-DST) timezone offset a few times. The
previous spec assumes that the the standard timezone offset is
constant, but the new spec take into account the offset change
history.

In addition, it specifies a new way to calculate the timezone
offset during a timezone transition (either in and
out of DST or timezone offset shift).

During a negative transition (e.g.  fall backward / getting
out of DST), repeated times are to be interpreted as if the
offset before the transition is in effect.

During a positive transition (e.g. spring forward / getting
into DST), skipped times are to be treated similarly. That
is, they are to be interpreted as if the offset before the
transition is in effect.

With icu-timezone-data, v8 is compliant to the new spec for the
past and the future as well as now whether or not the standard
timezone offset of a given timezone has changed over time
(e.g. Europe/Moscow, Pacific/Apia). With icu-timezone-data,
Australia/Lord_Howe (30 minute DST change) also works per spec.

Without icu-timezone-data, it works only for timezones of which
the standard timezone offset is the same as the current offset
(e.g. most North American timezones other than parts of Indiana)
and of which the DST shift is an hour. For instance, it doesn't work
for Europe/Moscow in 2010 when the standard timezone offset was
+4h because the current (2018) standard timezone offset is +3h. Neither
does it for Lord Howe in Australia with the DST shift of 0.5 hr.

This CL used to require one of the two ICU CLs below, but not
any more.

  https://chromium-review.googlesource.com/c/chromium/deps/icu/+/572652
  https://chromium-review.googlesource.com/851265  (a proposed CL to the
  upstream ICU).

Bug: v8:3547,chromium:417640,v8:5714
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ib162295da5bee31b2390bd0918157014aebd3e33
Reviewed-on: https://chromium-review.googlesource.com/572148
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52332}
2018-04-03 17:56:25 +00:00
Igor Sheludko
ef01379e0b [builtins] Fix fast path of Function.prototype.bind.
Bug: chromium:827013
Change-Id: I07a04cbe278b35dcd822d71d0a39a19aa9b46eb3
Reviewed-on: https://chromium-review.googlesource.com/993053
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52331}
2018-04-03 17:49:05 +00:00
Ben Smith
fae8a588e8 [wasm] Reloc external refs when deserializing
This is a follow-up to https://chromium-review.googlesource.com/981687.

When a wasm function has a large stack frame, the x64 code generator
performs the stack overflow check before constructing the frame. This
requires the use of the `address_of_real_stack_limit` external
reference.

This reference is thread local, so if it is not relocated the stack
overflow check will always fail.

Bug: chromium:808848
Change-Id: I0edf3fe5a006242fc50d0bff44cd9dd0e7d85bd9
Reviewed-on: https://chromium-review.googlesource.com/982906
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52330}
2018-04-03 17:42:45 +00:00
Clemens Hammacher
229ce29a84 [Liftoff] Add test for binops on different registers
This adds a systematic test for binary operations on different sets of
registers. By loading a number of values from memory to locals, we
create a cache state where all registers are used to hold local
variables. We then pick two of them and perform a binary operation on
them.

R=titzer@chromium.org

Bug: v8:7589, v8:6600
Change-Id: I2a4855810bb5c39247688c43cbe9d12d64fbc181
Reviewed-on: https://chromium-review.googlesource.com/992412
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52329}
2018-04-03 17:21:55 +00:00
Erik Luo
ce06603212 [debug] use flag to decide whether CallHandlerInfo has side effect
Makes CallHandlerInfo its own instance type, with an additional
map to distinguish side-effect-free handlers. In a followup, we
can expose an API flag to set the map.

This CL does not support whitelisting calls to ObjectTemplates
that use SetCallAsFunctionHandler().

Bug: v8:7515
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Ie32fe144046a9fae3e3b1ea5602b0da3db8a5616
Reviewed-on: https://chromium-review.googlesource.com/965741
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Erik Luo <luoe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52328}
2018-04-03 17:14:26 +00:00
Clemens Hammacher
c83af36f69 [Liftoff][ia32] Avoid register overwrite on 64 bit shift
On ia32, the implementation of 64-bit shifts first moved {src} into
{dst}, then {amount} into {ecx}. This fails if {dst} overlaps {amount},
because {amount} would be overwritten before being used. Just changing
the order to these two moves would also not be correct, since {src} can
contain {ecx}.
Thus, implement this via a general parallel register move, which
resolves cycles automatically.

R=titzer@chromium.org

Bug: v8:7589, v8:6600
Change-Id: I2556b9aa66a89a067372b7713dbbb3d71d2f923f
Reviewed-on: https://chromium-review.googlesource.com/981134
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52327}
2018-04-03 15:53:29 +00:00
Sergiy Byelozyorov
80d587d7ea [tools] Whitespace CL
TBR=sergiyb@chromium.org

Bug: chromium:773297
Change-Id: Icbff53ed84b72d74f1db9884b3b846b8ff72686b
No-Try: true
No-Presubmit: true
Reviewed-on: https://chromium-review.googlesource.com/992317
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52326}
2018-04-03 14:24:26 +00:00
Ulan Degenbaev
68be89090b [wasm] Fix phantom handle clearing in destructors.
The destructor of the owner of a phantom handle must clear the phantom
handle first before calling any function that can trigger GC.

Bug: chromium:827806
Change-Id: I20141d0d710c486aec3d92e729d76a53069e16fd
Reviewed-on: https://chromium-review.googlesource.com/992093
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52325}
2018-04-03 11:49:31 +00:00
Ivica Bogosavljevic
9a882c7e59 MIPS[64]: Rewrite floating point conditional branches
Summary of work done:
* Simplify complicated CompareAndBranch instructions
* Mark BC1EQZ and BC1NEZ as compact branches in simulator
* Remove unneeded nops for BC1EQZ and BC1NEZ
* Block trampolines for delay slot of BC1T and BC1F

Change-Id: I86f3a497e6e9ac73075bb51653c2d4c6ab8454b9
Reviewed-on: https://chromium-review.googlesource.com/986260
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Sreten Kovacevic <sreten.kovacevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#52324}
2018-04-03 11:48:21 +00:00
Sigurd Schneider
4b46522aca Revert "[heap] fix Sweeper::kNumberOfSweepingSpaces"
This reverts commit 12420537c8.

Reason for revert: MSAN complains
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/20527

Original change's description:
> [heap] fix Sweeper::kNumberOfSweepingSpaces
> 
> When indexing into vectors of sweeping spaces, convert the
> AllocationSpace to an index (by subtracting FIRST_GROWABLE_PAGED_SPACE)
> to avoid wasted space at the start.
> 
> Change-Id: Ia23fe6dae42d5accea9f7fe7ec5c3b303ef857b4
> Reviewed-on: https://chromium-review.googlesource.com/978242
> Reviewed-by: Hannes Payer <hpayer@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#52320}

TBR=hpayer@chromium.org,delphick@chromium.org

Change-Id: I9894dc10f122c9fab409e08b2a45389f1f51748f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/992152
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52323}
2018-04-03 11:17:14 +00:00
Sigurd Schneider
122ece2d70 [deoptimizer] Change layout of builtin continuation frames
Builtin continuation frames know their height now. This is prework
to allow UnwindAndFindHandler to reconstructor the stack pointer for
the ContinueToBuiltin trampoline.

Bug: v8:7584
Change-Id: If1361f5bbac130c284cd46c0d39cc81e2df613d3
Reviewed-on: https://chromium-review.googlesource.com/983633
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52322}
2018-04-03 10:52:11 +00:00
Yang Guo
4b09b0d557 Add tests for v8::ScriptCompiler::kEagerCompile.
R=leszeks@chromium.org

Bug: v8:7591
Change-Id: Idcd2d586ab279dc070d2cfb2558298ebdd3ce33b
Reviewed-on: https://chromium-review.googlesource.com/991873
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#52321}
2018-04-03 10:46:52 +00:00