Commit Graph

56330 Commits

Author SHA1 Message Date
Georg Schmid
85f257f4c9 Reland "Make LoadElimination aware of const fields (Part 2; stores)"
This is a reland of e588ff10e5

The only change over the original CL is found in JSCreateLowering::AllocateFastLiteral. We now guard against boilerplate values for unboxed double fields that *look* like legitimate initial values, but should really be kHoleNanInt64 instead.

The underlying problem certainly existed before, but an invariant added to LoadElimination in this CL caused a Chromium layout test to fail. The change in this reland is therefore a workaround, the root cause remains to be fixed. Specifically, we find that a pointer to the undefined value oddball is sometimes reinterpreted as a double and assigned as a boilerplate value. @jarin suspects that this stems from in-place map updates.

Original change's description:
> Make LoadElimination aware of const fields (Part 2; stores)
>
> Adds const information to store field accesses and uses it in load elimination
>
> Change-Id: I00765c854c95c955dabd78557463267b95f75eef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611543
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Schmid <gsps@google.com>
> Cr-Commit-Position: refs/heads/master@{#61796}

Change-Id: Ie388754890024a3ca7d10c9d4d7391442655b426
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630676
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#61838}
2019-05-27 09:06:33 +00:00
Jakob Kummerow
ffc7075260 [cleanup] Drop some dead (Macro)Assembler code
Drive-by: fix an #include that the gcov bot is missing

Bug: v8:9183
Change-Id: I35d1b4e346a56799a5f49b7059a658d5ccfe75ac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627548
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61837}
2019-05-27 08:53:28 +00:00
Yang Guo
24a51e1eee Move unittest files
R=sigurds@chromium.org

Bug: v8:9247
Change-Id: I25743f048e3e6cd22a18e003e77c8b78f147b630
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630680
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61836}
2019-05-27 08:52:23 +00:00
Simon Zünd
dbf02624c8 [array] Properly handle COW arrays in Array#sort
COW arrays were previously handled in the C++ pre-processing runtime
function.  The Torque version forgot a "EnsureWritableFastElements".
This CL fixes that.

Bug: chromium:967254
Change-Id: Ifbf89e57cfe724e61316b8abc226f7e8a262fce2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630675
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61835}
2019-05-27 08:51:05 +00:00
Maya Lekova
30cd215651 [async-await] Remove await optimization flag
This CL removes the await-optimization-flag, that is no longer needed,
since the feature is considered web compatible.

Bug: v8:8267, chromium:893469
Change-Id: I046f003f9ed6853d713b825c436fe5f0a1e5a0a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630677
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61834}
2019-05-27 08:45:53 +00:00
Benedikt Meurer
3f07c825b0 [vim] Update CrBuild to use autoninja.
Bug: v8:9183
Change-Id: Id2ae3ee0a53133eaf41e28fcadc681edf5ffb382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630673
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61833}
2019-05-27 06:27:29 +00:00
Z Nguyen-Huu
e846ad9fa5 Implement spec change in some Proxy traps
Pass test262 change in Proxy: defineProperty, deleteProperty, getOwnPropertyDescriptor.

Bug: v8:9228
Change-Id: Id9a2c8dcbfcf68ed2837eb6d5042abcbce7ab0ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1626474
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61832}
2019-05-27 05:04:19 +00:00
Sergiy Belozorov
be47fd1c37 Whitespace CL
TBR=tmrts@chromium.org

No-Try: true
Change-Id: I9a7a7bd623399575f8c31b9566744f7510648775
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630147
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61831}
2019-05-25 03:51:18 +00:00
Yang Guo
f9a88acbc9 Move remaining files in src/
TBR=mvstanton@chromium.org,neis@chromium.org,ahaas@chromium.org

Bug: v8:9247
Change-Id: I5433c863a54f3412d73df0d38aba3fdbcfac7ebe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627973
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61830}
2019-05-24 18:24:36 +00:00
Frank Tang
3846fc3a2e [Intl] Fix Null-der READ IsValidExtension<icu_64::Calendar>
Consider the case that uloc_toLegacyType may return nullptr while
the specified keyword value cannot be mapped to a well-formed legacy type.

Bug: chromium:966285
Change-Id: I40511c54e4835599c002f1c678121341276a4e58
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627902
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61829}
2019-05-24 16:32:09 +00:00
Sigurd Schneider
628431b214 [torque] Generate non-object field accessors from torque
Bug: v8:7793
Change-Id: Ic485dc953c80d055ff190b8be2a5434e5cdbeb5d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624214
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61828}
2019-05-24 12:21:46 +00:00
Simon Zünd
843b6646b1 Reland "[array] Move Array#sort pre-processing to Torque"
This is a reland of 2b0ac2fb9f

The layout test that caused this revert was fixed with:
https://crrev.com/c/1627386

Original change's description:
> [array] Move Array#sort pre-processing to Torque
>
> This CL removes the "PrepareElementsForSort" runtime function, and
> replaces it with a simpler version in Torque. The biggest difference
> is that certain sparse configurations no longer have a fast-path.
>
> The Torque pre-processing step replaces the existing Torque mechanism that
> copied already pre-processed elements into the "work" FixedArray. The Torque
> compacting works as follows:
>   - Iterate all elements from 0 to {length}
>     - If the element is the hole: Do nothing.
>     - If the element is "undefined": Increment undefined counter.
>     - In all other cases, push the element into the "work" FixedArray.
>
> Then the "work" FixedArray is sorted as before. Writing the elements from
> the "work" array back into the receiver, after sorting, has three steps:
>   1. Copy the sorted elements from the "work" FixedArray to the receiver.
>   2. Add previously counted number of "undefined" to the receiver.
>   3. Depending on the backing store either delete properties or
>      set them to the Hole up to {length}.
>
> Bug: v8:8714
> Change-Id: I14eccb7cfd2e4618bce2a85cba0689d7e0380ad2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619756
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61812}

TBR: jgruber@chromium.org
Bug: v8:8714
Change-Id: If7613f6e5f37c5e0d649e8192195594bc6c32100
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627977
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61827}
2019-05-24 12:13:17 +00:00
Simon Zünd
9609ebf3a9 [torque] Fix crash when declaring a variable without type
This CL fixes a crash when "constexpr" is infered from the intializer
expression of a variable declaration.

R=sigurds@chromium.org

Bug: v8:7793
Change-Id: I0ec51280fa145d874424e885905bbf79c93b3904
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627983
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61826}
2019-05-24 12:02:56 +00:00
Sigurd Schneider
15aa022aad [torque] Warn about untagged arguments to Torque builtins
Torque only supports TFS linkage, which requires all arguments to be
tagged. This CL issues a warning if a Torque-defined builtin tries to
declare untagged arguments.

Change-Id: Ibc186b4fce05541e768f4bb673e9ea64a45b0e01
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627971
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61825}
2019-05-24 11:54:26 +00:00
Andreas Haas
cfcb5f98fc [wasm] Delete legacy comment in test
Deleting this comment addresses feedback of https://crrev.com/c/1627348.
I changed the comment in gerrit but forgot to publish the change.

NOTRY=true
TBR=mstarzinger@chromium.org

Change-Id: Ia76a1fa6dc6c593e559626c9bf9a564f3f09f777
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627986
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61824}
2019-05-24 11:52:07 +00:00
Andreas Haas
d964a1b10e [wasm] Allow initialization of anyref tables
New spec changes allow anyref tables to be initialized with function
references.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I59596e1e383408114b974fa10529ae15b8cf7a15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627348
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61823}
2019-05-24 11:39:56 +00:00
Andreas Haas
50ec11f157 [wasm][gc] Finish current GC only once per isolate shutdown
R=clemensh@chromium.org

Also-By: clemensh@chromium.org
Bug: v8:9288, v8:8217
Change-Id: I1b4b7b5f06c49a6047d98a3a5db8bfa0c277be09
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627981
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61822}
2019-05-24 10:57:56 +00:00
Igor Sheludko
cca5e7ff9c [iwyu] Fix failing header include checks for gcc build
Bug: v8:9290, v8:7490, v8:9183
Change-Id: Iac5cdf0d96c1fdbb7e6461ea435c1ff32c6a701e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627543
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61821}
2019-05-24 10:52:20 +00:00
Santiago Aboy Solanes
8306b26a40 [ptr-compr][turbofan] Adding Phi reductions to DecompressionElimination
This reduction replaces the Phi's input decompressions with their parent
node, if and only if all of the Phi's inputs are Decompress nodes.

Also, if we have different Decompress nodes as inputs, we need to use
a conservative decompression after the Phi.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I8cc0264f9d08fe5ad25364f18c9f305afc54529c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624785
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61820}
2019-05-24 10:02:53 +00:00
Tobias Tebbi
d47db12666 Reland^2 "[torque] move class tests to unittests"
This is a reland of c33a1ef227

It seems the revert was based on a flake.

Original change's description:
> Reland "[torque] move class tests to unittests"
>
> This is a reland of f589d56101
>
> Now with an ASAN-container-overflow false positive workaround:
> Somehow ASAN was unhappy about a simple
> std::vector<std::string>::push_back.
> Increasing the std::vector capacity before doing the push_back
> strangely fixes the problem.
>
> Original change's description:
> > [torque] move class tests to unittests
> >
> > This avoids the generation of fake external classes.
> >
> > Bug: v8:7793
> > Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> > Reviewed-by: Simon Zünd <szuend@chromium.org>
> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61778}
>
> TBR: szuend@chromium.org, sigurds@chromium.org
> Bug: v8:7793
> Change-Id: Ifa1958e4d6e850ba27632aa95c7efaf5ca4bfefa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627970
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61807}

Bug: v8:7793
Change-Id: Ia403f1b784500c0903172f13e74c0b325e82599f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627980
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61819}
2019-05-24 09:52:53 +00:00
Jaroslav Sevcik
64d18ccef8 [turbofan] Bailout from polymorphic inlining if target becomes monomorphic.
Bug: chromium:958717
Change-Id: Ib0f12cc7ec9cca12c7859bf838e536fb330c5e9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627537
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61818}
2019-05-24 09:03:52 +00:00
Sigurd Schneider
c875a64377 [turbofan] Reduce consecutive machine additions with constants
This adds optimizations that apply the reductions
  (x + Int32Constant(a)) + Int32Constant(b)) => x + Int32Constant(a + b)
  (x + Int64Constant(a)) + Int64Constant(b)) => x + Int64Constant(a + b)
to the TurboFan graph.

This helps reducing awkward sequences like
  leaq r12,[r9*8+0x8]
  movq r12,[rbx+r12*1-0x1]
to
  movq r12,[rax+r9*8+0x7]


Change-Id: Iaa3a1cb9136a3f905ba33c62e16c3cb3c117605c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627544
Auto-Submit: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61817}
2019-05-24 08:45:59 +00:00
Santiago Aboy Solanes
35b611e017 [ptr-compr][CSA] Enabling the DecompressionElimination AdvancedReducer
Also adding a pair of valid compress/decompress that was missing.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703, chromium:963759
Change-Id: I668c26e636996e1c7621a23743df33b73e18ae89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624787
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61816}
2019-05-24 08:19:45 +00:00
Michael Starzinger
8e71afad97 [cleanup] Remove safepoint table register support.
This removes dead and obsolete support for batch-saved register from the
safepoint table. We no longer spill the entire register window (either
double or general-purpose) from optimized code. All spills happen as
part of the normal spill-slots on the stack by now.

R=clemensh@chromium.org,jarin@chromium.org
BUG=v8:9183

Change-Id: I5a2be7a543fa3e44d71ab1a35c722da0d458765c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627531
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61815}
2019-05-24 08:14:44 +00:00
Simon Zünd
70eeb22d1c Revert "[array] Move Array#sort pre-processing to Torque"
This reverts commit 2b0ac2fb9f.

Reason for revert: Breaks scrollingcoordinator/non-fast-scrollable-region-nested.html layout test on https://ci.chromium.org/p/v8/builders/ci/V8-Blink%20Linux%2064/32241 

Original change's description:
> [array] Move Array#sort pre-processing to Torque
> 
> This CL removes the "PrepareElementsForSort" runtime function, and
> replaces it with a simpler version in Torque. The biggest difference
> is that certain sparse configurations no longer have a fast-path.
> 
> The Torque pre-processing step replaces the existing Torque mechanism that
> copied already pre-processed elements into the "work" FixedArray. The Torque
> compacting works as follows:
>   - Iterate all elements from 0 to {length}
>     - If the element is the hole: Do nothing.
>     - If the element is "undefined": Increment undefined counter.
>     - In all other cases, push the element into the "work" FixedArray.
> 
> Then the "work" FixedArray is sorted as before. Writing the elements from
> the "work" array back into the receiver, after sorting, has three steps:
>   1. Copy the sorted elements from the "work" FixedArray to the receiver.
>   2. Add previously counted number of "undefined" to the receiver.
>   3. Depending on the backing store either delete properties or
>      set them to the Hole up to {length}.
> 
> Bug: v8:8714
> Change-Id: I14eccb7cfd2e4618bce2a85cba0689d7e0380ad2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619756
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61812}

TBR=peter.wm.wong@gmail.com,jgruber@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: If1c1bc07f38dfbd4bf6b6ce8f9d70714e7526877
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8714
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627976
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61814}
2019-05-24 07:24:27 +00:00
Clemens Hammacher
b851d753c9 Revert "Make LoadElimination aware of const fields (Part 2; stores)"
This reverts commit e588ff10e5.

Reason for revert: consistently crashes layout tests: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/32225

Original change's description:
> Make LoadElimination aware of const fields (Part 2; stores)
> 
> Adds const information to store field accesses and uses it in load elimination
> 
> Change-Id: I00765c854c95c955dabd78557463267b95f75eef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611543
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Georg Schmid <gsps@google.com>
> Cr-Commit-Position: refs/heads/master@{#61796}

TBR=jarin@chromium.org,neis@chromium.org,tebbi@chromium.org,bmeurer@chromium.org,gsps@google.com

Change-Id: Ia299c36b197c2aad7cfd953b06de06f4536ddb74
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627975
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61813}
2019-05-24 06:28:17 +00:00
Simon Zünd
2b0ac2fb9f [array] Move Array#sort pre-processing to Torque
This CL removes the "PrepareElementsForSort" runtime function, and
replaces it with a simpler version in Torque. The biggest difference
is that certain sparse configurations no longer have a fast-path.

The Torque pre-processing step replaces the existing Torque mechanism that
copied already pre-processed elements into the "work" FixedArray. The Torque
compacting works as follows:
  - Iterate all elements from 0 to {length}
    - If the element is the hole: Do nothing.
    - If the element is "undefined": Increment undefined counter.
    - In all other cases, push the element into the "work" FixedArray.

Then the "work" FixedArray is sorted as before. Writing the elements from
the "work" array back into the receiver, after sorting, has three steps:
  1. Copy the sorted elements from the "work" FixedArray to the receiver.
  2. Add previously counted number of "undefined" to the receiver.
  3. Depending on the backing store either delete properties or
     set them to the Hole up to {length}.

Bug: v8:8714
Change-Id: I14eccb7cfd2e4618bce2a85cba0689d7e0380ad2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619756
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61812}
2019-05-24 06:18:45 +00:00
Simon Zünd
afb0d4bcad Add missing header to fix Linux64 gcov bot
Linux64 gcov bot currently fails to compile:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20gcov%20coverage/18582

Introducing CL: https://crrev.com/c/1624216

TBR=jgruber@chromium.org

Bug: v8:9103
Change-Id: Ic5dbfca99a9893d64ba73f878824b48b0f83e4af
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627972
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61811}
2019-05-24 06:16:44 +00:00
Simon Zünd
ae954a4c7f Revert "Update V8 DEPS."
This reverts commit 03994e5709.

Reason for revert: Overcautious revert for
https://ci.chromium.org/p/v8/builders/ci/Mac%20V8%20FYI%20Release%20(Intel)/5377

Original change's description:
> Update V8 DEPS.
> 
> Rolling v8/build: 97564df..ae3ffb0
> 
> Rolling v8/buildtools: 6884242..0218c0f
> 
> Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4d346fb..63ab0c8
> 
> Rolling v8/third_party/depot_tools: 181e44c..a541b28
> 
> TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org
> 
> Change-Id: I5e372a33baf38c0b127b77568976b983ab546bc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628115
> Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/master@{#61809}

TBR=machenbach@chromium.org,sergiyb@chromium.org,v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com,tmrts@chromium.org

Change-Id: I95159172ea8114477cc52413edb5b8f740bd69e1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627974
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61810}
2019-05-24 05:58:37 +00:00
v8-ci-autoroll-builder
03994e5709 Update V8 DEPS.
Rolling v8/build: 97564df..ae3ffb0

Rolling v8/buildtools: 6884242..0218c0f

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4d346fb..63ab0c8

Rolling v8/third_party/depot_tools: 181e44c..a541b28

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I5e372a33baf38c0b127b77568976b983ab546bc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628115
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61809}
2019-05-24 03:43:44 +00:00
Francis McCabe
0ef1982ff5 Revert "Reland "[torque] move class tests to unittests""
This reverts commit c33a1ef227.

Reason for revert: fails win32 test:
https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20nosnap%20-%20shared/33658

Original change's description:
> Reland "[torque] move class tests to unittests"
> 
> This is a reland of f589d56101
> 
> Now with an ASAN-container-overflow false positive workaround:
> Somehow ASAN was unhappy about a simple
> std::vector<std::string>::push_back.
> Increasing the std::vector capacity before doing the push_back
> strangely fixes the problem.
> 
> Original change's description:
> > [torque] move class tests to unittests
> >
> > This avoids the generation of fake external classes.
> >
> > Bug: v8:7793
> > Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> > Reviewed-by: Simon Zünd <szuend@chromium.org>
> > Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61778}
> 
> TBR: szuend@chromium.org, sigurds@chromium.org
> Bug: v8:7793
> Change-Id: Ifa1958e4d6e850ba27632aa95c7efaf5ca4bfefa
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627970
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61807}

TBR=sigurds@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: I079e3ccf2c7a4778e3e6aabee85313ab5a070ee3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1626834
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61808}
2019-05-23 21:38:23 +00:00
Tobias Tebbi
c33a1ef227 Reland "[torque] move class tests to unittests"
This is a reland of f589d56101

Now with an ASAN-container-overflow false positive workaround:
Somehow ASAN was unhappy about a simple
std::vector<std::string>::push_back.
Increasing the std::vector capacity before doing the push_back
strangely fixes the problem.

Original change's description:
> [torque] move class tests to unittests
>
> This avoids the generation of fake external classes.
>
> Bug: v8:7793
> Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61778}

TBR: szuend@chromium.org, sigurds@chromium.org
Bug: v8:7793
Change-Id: Ifa1958e4d6e850ba27632aa95c7efaf5ca4bfefa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627970
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61807}
2019-05-23 20:57:11 +00:00
Jaroslav Sevcik
00be36ec7c [test] Add missing resources to the ObjectFreeze perf test
Bug: chromium:963925
Change-Id: I92c6899ac188e0f3248e1cee93b1a7e28001e29b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627540
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61806}
2019-05-23 18:19:41 +00:00
Francis McCabe
2451ea88ca Revert "[torque] move class tests to unittests"
This reverts commit f589d56101.

Reason for revert: failing win64 asan
https://ci.chromium.org/p/v8/builders/ci/V8%20Win64%20ASAN/8653

Original change's description:
> [torque] move class tests to unittests
> 
> This avoids the generation of fake external classes.
> 
> Bug: v8:7793
> Change-Id: I9744b299d3ec474d72b298b4f6143f95e345d1d9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625991
> Reviewed-by: Simon Zünd <szuend@chromium.org>
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61778}

TBR=sigurds@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: I762f29a0d3212d2eabfafa48c0e46940d0e6f835
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7793
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625863
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61805}
2019-05-23 17:48:04 +00:00
Igor Sheludko
ae348e30ed [ptr-compr] Introduce StrongTaggedValue and TaggedValue
... which represent potentially compressed Object and MaybeObject
values respectively. They provide methods for checking the smi/weak
tags which don't require decompression and conversion to Smi/HeapObject
combined with tag checks.

The new classes should help to write a bit more efficient runtime (C++)
code for the cases when we don't need the full decompressed value
immediately.

Drive-by-fix: fix ptr-compr build after Object::operator->() removal.

Bug: v8:7703
Change-Id: I7a3d747ab6679120a2cca14e45b0d8bcf33fc496
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624786
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61804}
2019-05-23 17:43:12 +00:00
Ross McIlroy
a3a18a736e [Android] Don't apply offset to library start address for libs mapped from APK.
On Android, we mmap the .so directly from the APK, therefore the file offset
in this case refers to the offset of the .so in the APK, not the offset in
the .so file itself. As such, moving the start position of the library based
on this gives incorrect results when later symbolizing the addresses based on
the .so.

TBR=ulan@chromium.org

Change-Id: I16f78c91106dc85334a8b0034c96b19442af7b05
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627545
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61803}
2019-05-23 16:56:24 +00:00
Jaroslav Sevcik
a7e5504d83 [cleanup] Stop using the now-unused deopt_count from feedback vector.
Unfortunately, we still have to keep the field because GC mole and Torque
do not support platform specific padding well
(see http://crbug.com/v8/9287).

Bug: v8:9183
Change-Id: I2210be4b8174c97bc82145605f9b862aac3bdc37
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624791
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61802}
2019-05-23 16:34:54 +00:00
Michael Lippautz
aa1b81b697 [heap] Fix global memory scheduling
Rework limit computation:
- Model controller as static classes based on traits.
- Compute growing factors for both controllers and pick the
  larger growing factor for both controllers.
- Factor out limit computation in its own function.

Bug: chromium:948807
Change-Id: Id466a66d7aa573de91ad388ea9218e9f6721d19a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627534
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61801}
2019-05-23 16:20:24 +00:00
Clemens Hammacher
e448740e2a [wasm] Use PRIxPTR for printing addresses
Avoid casting to {void*} just for printing with "%p". Instead, use the
standard "PRIxPTR", prefixed with "0x". This allows to directly print
addresses.

Drive-by: Remove other unneeded pointer casts; "%p" accepts any pointer
          type.

R=mstarzinger@chromium.org

Bug: v8:9183
Change-Id: I38c9575babaf04689fbd4568c90d593c5a591540
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627339
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61800}
2019-05-23 16:06:46 +00:00
Peter Marshall
9a2e4693a0 [tracing] Add a perfetto consumer base class
Split the JSONConsumer into a base case and subclass so that we can
implement different consumers without needing to repeat the code that
deals with the finished semaphore and endpoint setters/getters.

This makes it possible to add a test consumer that just holds the trace
events in memory in a later CL.

This CL re-uses the existing perfetto-consumer.h file to some extent,
but it was accidentally leftover from a previous CL where we stopped
using it and switched to the JSON consumer instead.

Cq-Include-Trybots: luci.v8.try:v8_linux64_perfetto_dbg_ng
Bug: v8:8339
Change-Id: I56c305833c8937da76a8e6defbe7a52c59b25106
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1621938
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61799}
2019-05-23 15:52:46 +00:00
Clemens Hammacher
93526b8543 [wasm][gc] Lower limit to trigger GC
Since we currently require at least 1 MB of code to be potentially
dead, we will never trigger GC for small modules.
This CL lowers the threshold to 64 kB (plus 10% of committed code
space), which has basically no effect on large modules, but ensures
that we also run GCs on small modules.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: Ie76787af5ec7deb2e335303c2a98b81aeae6d4ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627341
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61798}
2019-05-23 15:31:36 +00:00
Frederik Gossen
0eae59594f [wasm-hints] Add tool to inject compilation hints into Wasm modules
The python script allows to inject hints into a Wasm module. Hints are
injected into a newly created custom section named "compilationHints"
that is used by the compiler to determine its compilation strategy. The
section is placed after the functions section and before the code
section.

Bug: v8:9003
Change-Id: I531c57e4269ff9ae42b95be3515d2409627d6fb9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619865
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61797}
2019-05-23 15:16:46 +00:00
Georg Schmid
e588ff10e5 Make LoadElimination aware of const fields (Part 2; stores)
Adds const information to store field accesses and uses it in load elimination

Change-Id: I00765c854c95c955dabd78557463267b95f75eef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1611543
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Schmid <gsps@google.com>
Cr-Commit-Position: refs/heads/master@{#61796}
2019-05-23 15:06:47 +00:00
Clemens Hammacher
cf138bd3d4 [wasm][gc] Reset dead code counter when triggering GC
The {new_potentially_dead_code_size_} counter is used to decide when to
trigger the next GC. Without resetting, we will trigger lots of GCs
once the counter hits the limit, see
"V8.WasmModuleNumberOfCodeGCsTriggered" counter.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: I046b84d1f67f8cadb02fd3f876bb8c645e24edee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627340
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61795}
2019-05-23 15:02:46 +00:00
Andreas Haas
5cf5992a56 [wasm] Initialize IFT only for table 0
The indirect function table only exists for table 0 at the moment.
Therefore we should initialize it only for table 0.

R=mstarzinger@chromium.org

Bug: chromium:964607
Change-Id: I88a3a5cb5ebec7f0456adc2cebdf5cc499b22761
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624804
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61794}
2019-05-23 14:55:46 +00:00
Milad Farazmand
157b9181f4 s390: [cleanup] Avoid {Object::operator->}
Port 878ccb33bd

Original Commit Message:

    This CL was generated by an automatic clang AST rewriter using this
    matcher expression:

      callExpr(
        callee(
          cxxMethodDecl(
            hasName("operator->"),
            ofClass(isSameOrDerivedFrom("v8::internal::Object"))
          )
        ),
        argumentCountIs(1)
      )

    The "->" at the expression location was then rewritten to ".".

R=clemensh@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Ibe92f0332da0e478f213880462b4d3460f8260c0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627569
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#61793}
2019-05-23 14:47:16 +00:00
Michael Starzinger
32e48cf510 [wasm] Support {WebAssembly.Function} object construction.
This makes the WebAssembly function constructor return a proper function
object. Note that the returned object is not yet callable, only the
prototype structure is in place.

R=jkummerow@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: If6a3d0ae7078b5526606eef1b8fd4815353b850b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627343
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61792}
2019-05-23 14:32:44 +00:00
Clemens Hammacher
be62dcc2c0 [wasm] Publish Liftoff code before starting TurboFan
The previous logic published whenever a TurboFan function was
*finished*. Since we compile big functions first, the first TurboFan
compilation can take quite some time, and we will only publish
previously compiled Liftoff functions once that first TurboFan
compilation is done.
This CL changes that logic to publish all previous results *before*
starting a TurboFan compilation.

Drive-by: Add some trace events for interesting events.

R=ahaas@chromium.org

Bug: v8:8916, chromium:966351, chromium:944755
Change-Id: I669d6ea16bdc3f29685df153a7ed45875c28a843
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627532
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61791}
2019-05-23 14:22:24 +00:00
Yang Guo
dec3298d9c Move utility code to src/utils
NOPRESUBMIT=true
TBR=mstarzinger@chromium.org

Bug: v8:9247
Change-Id: I4cd6b79a1c2cba944f6f23caed59d4f1a4ee358b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1624217
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61790}
2019-05-23 14:13:34 +00:00
Michaël Zasso
f89e555956 [api] Fix compilation issue with macOS
Fixes the following error caught by the Node.js CI:

../deps/v8/src/api.cc:8943:10:
  error: no viable conversion from returned value of type
  'unique_ptr<v8::internal::MicrotaskQueue, default_delete<v8::internal::MicrotaskQueue>>'
  to function return type
  'unique_ptr<v8::MicrotaskQueue, default_delete<v8::MicrotaskQueue>>'

  return microtask_queue;
         ^~~~~~~~~~~~~~~

Change-Id: Ic09dab46bb8f87a2b3b59f5836e0883bfe0e9681
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627533
Commit-Queue: Michaël Zasso <mic.besace@gmail.com>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61789}
2019-05-23 13:54:14 +00:00