Commit Graph

23742 Commits

Author SHA1 Message Date
bmeurer
7a675e0e3b [x64] Fix instruction selection for Word64Equal(Word64And, 0).
This fixes a slight inconsistency in the InstructionSelector that
basically disabled the optimization for things like ObjectIsSmi.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1206773002

Cr-Commit-Position: refs/heads/master@{#29250}
2015-06-24 09:15:31 +00:00
jacob.bramley
48d726cd6f Reland r21101: "ARM64: use jssp for stack slots"
The original implementation assumed that LPushArguments and
LInvoke/Call* could be assumed to be exclusively sequential. However,
this isn't always the case. For example, GenerateCallFunction pushes
some arguments and then selects between HInvokeFunction and
HCallFunction.

This fixed implementation resets a pushed_arguments_ counter based on
the argument_count() of the preceeding basic block, then tracks it
per-instruction as before (except that now we maintain a count rather
than a boolean flag).

At the same time, since we now track exactly how many arguments have
been pushed onto the stack, I was able to adjust the offset accordingly
and use jssp for stack slots even when arguments have been pushed.

BUG=

Review URL: https://codereview.chromium.org/1038363002

Cr-Commit-Position: refs/heads/master@{#29249}
2015-06-24 06:47:42 +00:00
danno
c019d7f498 Use big-boy Types to annotate interface descriptor parameters
- Thread Type::FunctionType through stubs and the TF pipeline.
- Augment Typer to decorate parameter nodes with types from
  a Type::FunctionType associated with interface descriptors.
- Factor interface descriptors into platform-specific and
  platform-independent components so that all descriptors share
  a common Type::FunctionType for all platforms.

Review URL: https://codereview.chromium.org/1197703002

Cr-Commit-Position: refs/heads/master@{#29248}
2015-06-24 06:22:04 +00:00
bbudge
b7f4981c16 Expand ToBoolean stub so it can handle more types.
SIMD values will require their own type code for conversion to boolean.

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1202973003

Cr-Commit-Position: refs/heads/master@{#29247}
2015-06-24 06:10:59 +00:00
binji
3e2c6a2eb7 Fix ReferenceError of Worker in regress-crbug-503578
Worker is not defined on the V8 Shared bots.

BUG=chromium:503578
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1202763004

Cr-Commit-Position: refs/heads/master@{#29246}
2015-06-24 05:36:20 +00:00
machenbach
d70419e474 [android] Completly move path logic to gyp config.
BUG=chromium:502176
LOG=n

Review URL: https://codereview.chromium.org/1203653002

Cr-Commit-Position: refs/heads/master@{#29245}
2015-06-24 05:35:14 +00:00
binji
10b6af71b8 Fix cluster-fuzz found regression in d8 when deserializing ArrayBuffer
BUG=503578
R=jarin@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1204753002

Cr-Commit-Position: refs/heads/master@{#29244}
2015-06-24 04:23:58 +00:00
mstarzinger
5e2a114102 [turbofan] Remove stale control-reducer.cc file.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1197793005

Cr-Commit-Position: refs/heads/master@{#29243}
2015-06-24 03:50:24 +00:00
arv
6181ec9c28 Date() should not depend on Date.prototype.toString
We used to call toString as a method which is not safe.

BUG=v8:4225
LOG=Y
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1200033003

Cr-Commit-Position: refs/heads/master@{#29242}
2015-06-23 23:18:40 +00:00
adamk
3164aa7483 Revert "Keep a canonical list of shared function infos."
Speculative revert in the hopes of fixing serializer crashes seen in canary.

This reverts commit c166945083, as well as
followup change "Do not look for existing shared function info when compiling a new script."
(commit 7c43967bb7).

BUG=chromium:503552,v8:4132
TBR=yangguo@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1207583002

Cr-Commit-Position: refs/heads/master@{#29241}
2015-06-23 22:59:30 +00:00
mathias
57306b59e8 Avoid built-ins in Date.prototype.toISOString
TEST=mjsunit/date
BUG=v8:4226
LOG=N

Review URL: https://codereview.chromium.org/1203733002

Cr-Commit-Position: refs/heads/master@{#29240}
2015-06-23 18:43:08 +00:00
titzer
2c979b96f1 Add mjsunit tests for optimization of float min/max.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1199053011

Cr-Commit-Position: refs/heads/master@{#29239}
2015-06-23 17:26:25 +00:00
dslomov
8196c28a94 Do not add extra argument for new.target
JSConstructStub for subclass constructors instead locates new.target in
a known location on the stack.

R=arv@chromium.org,adamk@chromium.org
BUG=v8:3886
LOG=N

Review URL: https://codereview.chromium.org/1196193014

Cr-Commit-Position: refs/heads/master@{#29238}
2015-06-23 16:50:57 +00:00
adamk
df47224028 Expose Map/Set methods through the API
Map: get, set, has, delete, clear
Set: add, has, delete, clear

All except clear are implemented as calls into collection.js.

Note that some of these shadow methods of v8::Object. It's unclear
how confusing that's going to be: on the one hand, it seems likely
that most operations you would want to do on a Map or Set are these.
On the other, generic code could get confused if it somehow gets
ahold of a variable that happens to be C++-typed as a v8::Map or v8::Set.

BUG=v8:3340
LOG=y

Review URL: https://codereview.chromium.org/1204623002

Cr-Commit-Position: refs/heads/master@{#29237}
2015-06-23 15:14:17 +00:00
ishell
bcb276c6f7 Fixed exception handling in Realm.create().
BUG=chromium:501711
LOG=N

Review URL: https://codereview.chromium.org/1207453002

Cr-Commit-Position: refs/heads/master@{#29236}
2015-06-23 15:08:50 +00:00
jochen
93d6216099 Let GC select the collector when the external memory allocation limit is reached
BUG=none
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1201993002

Cr-Commit-Position: refs/heads/master@{#29235}
2015-06-23 15:02:16 +00:00
mbrandy
b76cf1f802 PPC: [turbofan] Fix implementation of Float64Min.
The optimized instruction sequences for floating-point min/max do not
have the same behaviour as TurboFan's Float(32|64)(Min|Max) functions
(incorrect handling for NaN operands).

R=dstence@us.ibm.com, michael_dawson@ca.ibm.com
BUG=

Review URL: https://codereview.chromium.org/1193843015

Cr-Commit-Position: refs/heads/master@{#29234}
2015-06-23 14:56:57 +00:00
verwaest
c49659b008 Don't insert elements transitions into normalized maps
BUG=chromium:499790
LOG=n

Review URL: https://codereview.chromium.org/1203653003

Cr-Commit-Position: refs/heads/master@{#29233}
2015-06-23 14:33:11 +00:00
verwaest
dee4895d0a Cleanup adding elements and in particular dictionary elements
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1196163005

Cr-Commit-Position: refs/heads/master@{#29232}
2015-06-23 13:35:12 +00:00
mstarzinger
7f5a2d9ed5 [turbofan] Make global variable loads and stores explicit.
This is a precursor to using specialized LoadIC and StoreIC stubs for
global variable access. It also removes the need to keep track of the
global object in the type system, hence freeing up one bit.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1205473004

Cr-Commit-Position: refs/heads/master@{#29231}
2015-06-23 13:34:06 +00:00
bmeurer
78e9a2dff2 [turbofan] NaN is never truish.
BUG=v8:4207
LOG=y
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1198993009

Cr-Commit-Position: refs/heads/master@{#29230}
2015-06-23 12:24:54 +00:00
jacob.bramley
d783b76362 [arm64][turbofan] Fix implementation of Float64Min.
ARM64's `fmin` and `fmax` instructions don't have the same behaviour as
TurboFan's Float(32|64)(Min|Max) functions.

BUG=4206
LOG=N

Review URL: https://codereview.chromium.org/1200123004

Cr-Commit-Position: refs/heads/master@{#29229}
2015-06-23 11:58:58 +00:00
verwaest
17b26fd2a5 Fix regexp perf: Only increase array size if needed
BUG=chromium:503457
LOG=n

Review URL: https://codereview.chromium.org/1198993008

Cr-Commit-Position: refs/heads/master@{#29228}
2015-06-23 11:41:47 +00:00
verwaest
359142c330 Merge AddFastElement and AddFastDoubleElement
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1198343004

Cr-Commit-Position: refs/heads/master@{#29227}
2015-06-23 11:35:57 +00:00
ishell
47421760f4 Map::ReconfigureProperty() should mark map as unstable when it returns a different map.
BUG=chromium:502930
LOG=N

Review URL: https://codereview.chromium.org/1200003002

Cr-Commit-Position: refs/heads/master@{#29226}
2015-06-23 11:30:58 +00:00
Benedikt Meurer
64d6ab455d [turbofan] Run DeadCodeElimination together with the advanced reducers.
This will immediately remove dead code from the graph once any of
the advanced reducers inserts it. Also changes the GraphReducer to
use the canonical Dead node for ReplaceWithValue.

R=jarin@chromium.org

Committed: https://crrev.com/88a40c5fb381924b1c0b2403dc582bceb2abe5da
Cr-Commit-Position: refs/heads/master@{#29217}

Review URL: https://codereview.chromium.org/1206533002.

Cr-Commit-Position: refs/heads/master@{#29225}
2015-06-23 11:22:12 +00:00
ishell
5c4aae390f Global handle leak in Realm.create() fixed.
BUG=chromium:501808
LOG=N

Review URL: https://codereview.chromium.org/1197403002

Cr-Commit-Position: refs/heads/master@{#29224}
2015-06-23 11:04:21 +00:00
titzer
deb5dcea5c [turbofan] Make an OptionalOperator for MachineOperatorBuilder.
This makes usage of the MachineOperatorBuilder more robust, as it will be
an error to request an unsupported operator.

Along the way, I noticed that all 7 platforms support Float32Abs and
Float64Abs. Should make them non-optional in another CL?

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1128133003

Cr-Commit-Position: refs/heads/master@{#29223}
2015-06-23 10:35:43 +00:00
verwaest
046e91dd1a Move SetFastElementsCapacity into GrowCapacityAndConvert
BUG=v8:4137
LOG=n

Review URL: https://codereview.chromium.org/1197133003

Cr-Commit-Position: refs/heads/master@{#29222}
2015-06-23 09:44:28 +00:00
jochen
22b691ba0e [test] Teach test runner about whether novfp3 is on or off
BUG=none
R=machenbach@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1204643003

Cr-Commit-Position: refs/heads/master@{#29221}
2015-06-23 09:43:21 +00:00
bmeurer
a5af5127ec Revert of [turbofan] Run DeadCodeElimination together with the advanced reducers. (patchset #1 id:1 of https://codereview.chromium.org/1206533002/)
Reason for revert:
Looks like this breaks Tests262.

Original issue's description:
> [turbofan] Run DeadCodeElimination together with the advanced reducers.
>
> This will immediately remove dead code from the graph once any of
> the advanced reducers inserts it. Also changes the GraphReducer to
> use the canonical Dead node for ReplaceWithValue.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/88a40c5fb381924b1c0b2403dc582bceb2abe5da
> Cr-Commit-Position: refs/heads/master@{#29217}

TBR=jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1200983004

Cr-Commit-Position: refs/heads/master@{#29220}
2015-06-23 09:39:23 +00:00
mvstanton
e9445d7d48 Vector ICs: Additional Turbofan support
Lowering of stores need the vector and slot if --vector-stores is true.

BUG=

Review URL: https://codereview.chromium.org/1193313002

Cr-Commit-Position: refs/heads/master@{#29219}
2015-06-23 09:09:19 +00:00
hpayer
8b9924f6ef Fix wrong DCHECK in Heap::FindAllocationMemento where bump pointer overflow points to the currently used new space page.
BUG=chromium:501693
LOG=n

Review URL: https://codereview.chromium.org/1200833003

Cr-Commit-Position: refs/heads/master@{#29218}
2015-06-23 09:07:29 +00:00
bmeurer
88a40c5fb3 [turbofan] Run DeadCodeElimination together with the advanced reducers.
This will immediately remove dead code from the graph once any of
the advanced reducers inserts it. Also changes the GraphReducer to
use the canonical Dead node for ReplaceWithValue.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1206533002

Cr-Commit-Position: refs/heads/master@{#29217}
2015-06-23 08:48:37 +00:00
mstarzinger
4ab2a18094 [turbofan] Avoid embedding type feedback vector into code.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1198263004

Cr-Commit-Position: refs/heads/master@{#29216}
2015-06-23 08:27:33 +00:00
verwaest
6c6a238004 Also check for access checks and indexed interceptors before allowing fast moving of elements
BUG=

Review URL: https://codereview.chromium.org/1200053002

Cr-Commit-Position: refs/heads/master@{#29215}
2015-06-23 07:32:17 +00:00
jarin
de62b486e3 [turbofan] Factor out the function specific part from the frame state operator.
This also threads through the parameter count and local count to the instruction selector. This will be later used to allow merging of various StateValues vector (and prepare for differential encoding which will not distinguish between parameters, locals and expression stack).

BUG=

Review URL: https://codereview.chromium.org/1191243003

Cr-Commit-Position: refs/heads/master@{#29214}
2015-06-23 07:17:25 +00:00
chunyang.dai
771eb49171 X87: Built-in apply() performance benefits from an uninitialized IC.
port 2a3b057587 (r29175).

original commit message:

   Built-in apply() performance benefits from an uninitialized IC.

BUG=

Review URL: https://codereview.chromium.org/1199913007

Cr-Commit-Position: refs/heads/master@{#29213}
2015-06-23 06:56:10 +00:00
chunyang.dai
4960fc0b24 X87: Vector ICs: Turbofan vector store ic support
port 17c8ffeaa3 (r29173)

original commit message:

    Vector ICs: Turbofan vector store ic support

    Turbofan needs to pass vector slots around for named and keyed stores.
    Also, the CL addresses a missing slot for ClassLiterals.

BUG=

Review URL: https://codereview.chromium.org/1195793007

Cr-Commit-Position: refs/heads/master@{#29212}
2015-06-23 06:55:04 +00:00
bmeurer
f2ac852015 [date] Use explicit control flow to replace %_ThrowIfNotADate.
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1191283003

Cr-Commit-Position: refs/heads/master@{#29211}
2015-06-23 06:43:40 +00:00
v8-autoroll
902387b7ef Update V8 DEPS.
Rolling v8/third_party/android_tools to 21f4bcbd6cd927e4b4227cfde7d5f13486be1236

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1203633004

Cr-Commit-Position: refs/heads/master@{#29210}
2015-06-23 03:27:47 +00:00
littledan
325fbd0e24 Re-ship Harmony Array/TypedArray methods
Turning the --harmony-array flag on has been delayed behind
unrelated test failures. Now that those tests are disabled,
land the changes.

This patch fixes WebKit tests based on the new change.

R=adamk
LOG=Y
BUG=v8:3578
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199113003

Cr-Commit-Position: refs/heads/master@{#29209}
2015-06-23 00:41:58 +00:00
arv
b5adc2f6b4 Remove usage of S.p.charCodeAt from uri.js
We were using both String.prototype.charCodeAt and
String.prototype.charAt.

BUG=v8:4224
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1204483003

Cr-Commit-Position: refs/heads/master@{#29208}
2015-06-22 23:43:24 +00:00
littledan
29c4904c0a Disable a flaky test
This test starts failing when the --harmony-array flag is turned on,
but the failure does not directly have to do with that flag. Disabling
the test in debug mode to unblock the release.

BUG=v8:4237
LOG=n
R=adamk,erikcorry

Review URL: https://codereview.chromium.org/1202523005

Cr-Commit-Position: refs/heads/master@{#29207}
2015-06-22 22:37:49 +00:00
arv
81f2c44047 Fix HTML string methods to not depend on replace method
Before this we were using String.prototype.replace. Now
we call the internal StringReplace instead.

BUG=v8:4221
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1199933005

Cr-Commit-Position: refs/heads/master@{#29206}
2015-06-22 21:55:56 +00:00
Adam Klein
1c575e917a Add an informative comment on regress-1132 ASAN suppression
TBR=arv@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1199053002.

Cr-Commit-Position: refs/heads/master@{#29205}
2015-06-22 21:06:11 +00:00
verwaest
55a6a49777 Remove duplicate isolate
BUG=

Review URL: https://codereview.chromium.org/1196533004

Cr-Commit-Position: refs/heads/master@{#29204}
2015-06-22 19:57:56 +00:00
adamk
97a887c530 Use CHECK_LT in CheckHandleCountVisitor for better error message
Review URL: https://codereview.chromium.org/1201773005

Cr-Commit-Position: refs/heads/master@{#29203}
2015-06-22 19:18:35 +00:00
arv
6b268bce6a Fix string HTML methods to call ToString
Before this we were using + which calls valueOf which is not correct
for these methods.

BUG=v8:4222
LOG=N
R=adamk, littledan
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1194173004

Cr-Commit-Position: refs/heads/master@{#29202}
2015-06-22 19:07:24 +00:00
littledan
7ebf6fc965 Disable regress-1132 on ASAN runs
This test appears to trigger some bug in either ASAN or V8 when
accompanied by an increase in JS code size. Disabling the test
on ASAN runs to unblock adding new JS code.

BUG=v8:4236
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1203523002

Cr-Commit-Position: refs/heads/master@{#29201}
2015-06-22 18:57:06 +00:00