Commit Graph

15700 Commits

Author SHA1 Message Date
jgruber
542b41a7cc [gn] Enable stricter build flags
Default to the chromium-internal build config (instead of the more
permissive no_chromium_code config).

BUG=v8:5878

Review-Url: https://codereview.chromium.org/2758563002
Cr-Commit-Position: refs/heads/master@{#43909}
2017-03-17 15:18:18 +00:00
Wiktor Garbacz
54db0236ce [parser] Parse tasks: make them pass all tests.
Parse tasks are still WIP so there is really no benefit turning them on.

Turn off irrelevant tests.
Fix duplicate parameters inverted logic.
Fix use_counts tracking.
Fix language mode, super_property, evals.
Fix modules and stack overflow.

BUG=v8:6093

Change-Id: I8567b36eef7b9de6799789e7520810bde9c86e5b
Reviewed-on: https://chromium-review.googlesource.com/455916
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43903}
2017-03-17 14:06:24 +00:00
titzer
72e539360e [rename] Rename internal field to embedder field.
This CL renames all occurrences of "internal field" to "embedder field"
to prevent confusion. As it turns out, these fields are not internal to
V8, but are actually embedder provided fields that should not be mucked
with by the internal implementation of V8.

Note that WASM does use these fields, and it should not.

BUG=v8:6058

Review-Url: https://codereview.chromium.org/2741683004
Cr-Commit-Position: refs/heads/master@{#43900}
2017-03-17 13:26:05 +00:00
Michael Starzinger
22372f5aa8 [turbofan] Prototype of property access early lowering.
This is a first stab at extending the existing early lowering approach
to property access operations. Currently we only handle the case where
named property loads are lowered to a soft deoptimize operation, due to
insufficient type feedback.

R=jarin@chromium.org

Change-Id: I779ffb99978023237da5ad9eaf0241fe74243882
Reviewed-on: https://chromium-review.googlesource.com/456316
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43899}
2017-03-17 13:21:41 +00:00
Marja Hölttä
ab4233e38a [parser|cleanup] Add tests for duplicate parameters.
There are at least 3 mechanisms for detecting duplicate parameters.
- ExpressionClassifier
- Scope::DeclareParameter checking IsDeclaredParameter
- PatternRewriter::VisitVariableProxy failing to declare a duplicate parameter

The conditions for when duplicate parameters are allowed and when not are pretty
involved too. They are allowed when
- the function is not an arrow function and not a concise method *and*
- when the parameter list is simple *and*
- we're in sloppy mode (incl. the function doesn't declare itself strict).

In addition, we don't recognize some of the early errors, and it's 
non-trivial to see which ones are recognized and which not (see bug
v8:6108). E.g., (dup, dup) => {}; is recognized but (dup, [dup]) => {} is
not. And (dup, [dup]) => 1; is.

We do have tests for some aspects of duplicate parameters (e.g., arrow function
duplicate parameters are included in arrow function tests), but it's hard to see
whether all combinations of the relevant conditions are tested.

This CL adds more structured tests which hopefully enables reducing the
duplicate parameter detection mechanisms to 2 or maybe even to 1.

BUG=v8:6092

Change-Id: Idd3db43b380aae4b9a89be5f1ed0755d39bfb36d
Reviewed-on: https://chromium-review.googlesource.com/456336
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43895}
2017-03-17 12:10:35 +00:00
neis
94b088ca3c Disentangle assembler from isolate.
This is a first step towards moving Turbofan code generation off the main thread.

Summary of the changes:
- AssemblerBase no longer has a pointer to the isolate. Instead, its
  constructor receives the few things that it needs from the isolate (on most
  architectures this is just the serializer_enabled flag).
- RelocInfo no longer has a pointer to the isolate. Instead, the functions
  that need it take it as an argument.  (There are currently still a few that
  implicitly access the isolate through a HeapObject.)
- The MacroAssembler now explicitly holds a pointer to the isolate (before, it
  used to get it from the Assembler).
- The jit_cookie also moved from AssemblerBase to the MacroAssemblers, since
  it's not used at all in the Assemblers.
- A few architectures implemented parts of the Assembler with the help
  of a Codepatcher that is based on MacroAssembler.  Since the Assembler no
  longer has the isolate, but the MacroAssembler still needs it, this doesn't
  work anymore.  Instead, these Assemblers now use a new PatchingAssembler.

BUG=v8:6048

Review-Url: https://codereview.chromium.org/2732273003
Cr-Commit-Position: refs/heads/master@{#43890}
2017-03-17 11:18:06 +00:00
Andreas Haas
87354ade6b [wasm] Remove the WasmTrapHelper
Since TrapIf has been implemented on all platforms, there is no need
anymore for the old WasmTrapHelper code. This CL also removes
TrapIf-specific tests.

R=titzer@chromium.org, clemensh@chromium.org

Change-Id: Ic069598441b7bd63bde2e66f4e536abea5ecebe6
Reviewed-on: https://chromium-review.googlesource.com/452380
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43887}
2017-03-17 10:30:31 +00:00
jgruber
ad75ded221 [cctest] Fix invalid assumption in test-unboxed-doubles
test-unboxed-doubles/WriteBarrierObjectShiftFieldsRight recently started
failing on arm64-nosnapshot builds due to a broken CHECK.

# Fatal error in ../../test/cctest/test-unboxed-doubles.cc, line 1417
# Check failed: heap->InNewSpace(*obj_value).

It expects the result of Factory::NewJSArray() to be in new
space; but NewJSArray encapsulates two allocations so the return value can
actually be in old space. Fix it by ensuring only one allocation occurs.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2759433002
Cr-Commit-Position: refs/heads/master@{#43886}
2017-03-17 10:16:54 +00:00
neis
877d9758eb [compiler] Add more tests for monotonicity of typing.
R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2753543009
Cr-Commit-Position: refs/heads/master@{#43885}
2017-03-17 09:17:10 +00:00
littledan
3fa2633841 [intl] Fix debug-evaluate-no-side-effect-builtins test
String case conversion is known to debug-evaluate to not have a side
effect in noi18n mode, but debug-evaluate thinks it has a side effect
in i18n mode. Update the tests accordingly.

Verified locally that the test passes in i18n and noi18n mode (not sure
whether the noi18n trybot executes this test).

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Review-Url: https://codereview.chromium.org/2750403004
Cr-Commit-Position: refs/heads/master@{#43882}
2017-03-17 07:18:07 +00:00
gdeepti
1fce7d604a [wasm] Fix DetachArrayBuffer for WebAssembly.Memory on grow
DetachArrayBuffer makes incorrect assumptions about the state of the ArrayBuffer. It assumes that that the ArrayBuffer is internal to wasm unless guard pages are enabled, this is not the case as the ArrayBuffer can be externalized outside of wasm, in this case through gin.

BUG=chromium:700384

Review-Url: https://codereview.chromium.org/2754153002
Cr-Commit-Position: refs/heads/master@{#43880}
2017-03-17 01:12:07 +00:00
allada
3e1e90dec2 [Devtools] Add stacktrace to protocol for scriptParsed event
Stacktrace data is now passed when scriptParsed event is triggered.

R=kozyatinskiy@chromium.org,dgozman
BUG=chromium:646849

Review-Url: https://codereview.chromium.org/2755863002
Cr-Commit-Position: refs/heads/master@{#43879}
2017-03-16 23:34:11 +00:00
titzer
3bbd81afbc [testing] Add the notion of a wait count to allow tests to robustly wait on asynchronous tasks.
Note that this also modifies mjsunit.js to allow the {failWithMessage} method to be monkey-patched by a test. This is necessary because assertions which fail in a promise's then-clause would normally only throw an exception, which is swallowed by the promise, causing the test to silently pass. Instead, patching this {failWithMessage} functionality allows then clauses to use the full assertion machinery of mjsunit.js.

R=ulan@chromium.org, gsathya@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2752043002
Cr-Commit-Position: refs/heads/master@{#43875}
2017-03-16 18:20:19 +00:00
bradnelson
4c3217e132 [wasm][asm.js] Adding custom asm.js lexer.
Adding a custom lexer for asm.js parsing.
It takes advantage of a number of asm.js properties to simply things:
* Assumes 'use asm' is the only string.
* Does not handle unicode for now (tools don't emit it).
* Combines global + local string table with lexer.

R=marja@chromium.org,vogelheim@chromium.org,kschimpf@chromium.org

BUG=v8:4203
BUG=v8:6090

Review-Url: https://codereview.chromium.org/2751693002
Cr-Commit-Position: refs/heads/master@{#43874}
2017-03-16 18:10:45 +00:00
yangguo
cd640d225b [debug] whitelist Object and Symbol builtins for debug-evaluate.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2747243006
Cr-Commit-Position: refs/heads/master@{#43871}
2017-03-16 17:10:34 +00:00
cwhan.tunz
da1bddcd75 [typedarrays] Implement %TypedArray%.prototype.lastIndexOf in C++
- Implement C++ builtins and ElementsAccessor for
  %TypedArray%.prototype.lastIndexOf
- Remove TypedArrayLastIndexOf in src/js/typedarray.js
- Combine InnerArrayLastIndexOf and ArrayLastIndexOf in src/js/array.js

BUG=v8:5929

Review-Url: https://codereview.chromium.org/2744283002
Cr-Commit-Position: refs/heads/master@{#43870}
2017-03-16 16:28:00 +00:00
franzih
947a043766 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

For now, has a test that compares the stdout of --type-profile in test/message. We
will remove this test when --type-profile is fully integrated in
the debugger protocol. Adding
the test in test/inspector does not work, because the inspector
test itself consists of JavaScript code that would convolute the
output and be non-deterministic under stress.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43866}
2017-03-16 15:01:31 +00:00
bbudge
11f69171c3 [WASM] Fix SIMD test that fails on ARM hardware.
- Change test to avoid adding denormalized numbers. This flushes to
  zero on ARM hardware when using Neon.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2754543007
Cr-Commit-Position: refs/heads/master@{#43864}
2017-03-16 14:06:49 +00:00
Clemens Hammacher
783f68c53b [wasm] [interpreter] Throw exception on trap
This behaviour was missing before. If a trap is encountered in the
interpreter, we now throw the right error. With test.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5822

Change-Id: I09c23d15fcde32ec586fb6d3094a5ec49155a9a2
Reviewed-on: https://chromium-review.googlesource.com/453839
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43859}
2017-03-16 12:01:15 +00:00
Clemens Hammacher
f3aeb762ae [wasm] [interpreter] Implement calling imported functions
When instantiating the wasm interpreter for debugging, we unwrap all
wasm-to-js wrappers and store the callable objects. The handles are
stored in a DeferredHandleScope and deleted when the InterpreterHandle
(store in WasmDebugInfo) is freed.
A call to an imported function reads the arguments from the stack,
converts them to JS objects, calls the callable, converts back the
return value and pushes it onto the stack.
Reentering the interpreter from the calles JS code is not permitted
yet, but will be in a follow-up CL.
Also, indirect calls to imported functions will have to follow.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5822

Change-Id: I66c35053bccb6cf8d416606e4f840d888ccb3b65
Reviewed-on: https://chromium-review.googlesource.com/453838
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43855}
2017-03-16 10:57:16 +00:00
franzih
79ccd3a693 Revert of Collect type profile for DevTools. (patchset #41 id:770001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
Still flaky

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Original-Commit-Position: refs/heads/master@{#43804}
> Committed: 6cf880f4b8
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43846}
> Committed: 5c32287390
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43849}
> Committed: 18c35e4958

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2745413006
Cr-Commit-Position: refs/heads/master@{#43852}
2017-03-16 09:59:20 +00:00
jgruber
10500cb79c [csa] Replace remaining old-style GetProperty calls
Change

Node* name = HeapConstant(name_string);
Callable callable = CodeFactory::GetProperty(isolate);
CallStub(callable, context, receiver, name);

to

GetProperty(context, receiver, name_string);

BUG=

Review-Url: https://codereview.chromium.org/2751363002
Cr-Commit-Position: refs/heads/master@{#43850}
2017-03-16 09:33:30 +00:00
franzih
18c35e4958 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#43791}
Committed: 0332bebde9
Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Original-Commit-Position: refs/heads/master@{#43804}
Committed: 6cf880f4b8
Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43846}
Committed: 5c32287390
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43849}
2017-03-16 09:25:23 +00:00
franzih
9e827c2384 Revert of Collect type profile for DevTools. (patchset #40 id:750001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
Flaky under stress. Fix first.

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43804}
> Committed: 6cf880f4b8
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43846}
> Committed: 5c32287390

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2747383004
Cr-Commit-Position: refs/heads/master@{#43847}
2017-03-16 08:49:08 +00:00
franzih
5c32287390 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Original-Commit-Position: refs/heads/master@{#43791}
Committed: 0332bebde9
Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43804}
Committed: 6cf880f4b8
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43846}
2017-03-16 08:42:40 +00:00
bmeurer
9224d5d1bc [csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.
The fast-path for Array.prototype.indexOf first checks whether the
receiver is a fast-mode JSArray (and there are no elements in the
prototype chain in case of holey arrays), then loads the known
JSArray::length, and afterwards calls ToInteger on the fromIndex.

But this ToInteger(fromIndex) call can cause arbitrary side effects if
the fromIndex is a JSReceiver, in particular it can invalidate the
assumptions about the fast-mode of the receiver and the length. In the
worst case this leads to OOB memory access.

Quick-fix is to bailout to the runtime if the fromIndex is neither a Smi
nor undefined, which represents the common cases.

R=jarin@chromium.org
BUG=chromium:702058

Review-Url: https://codereview.chromium.org/2756663002
Cr-Commit-Position: refs/heads/master@{#43843}
2017-03-16 06:53:09 +00:00
bbudge
365492f17e [WASM] Implement Simd128 Load/Store on ARM.
- Adds new load/store opcodes (0xc0, 0xc1) for S128 type.
- Implements these for ARM.
- Enables more WASM SIMD tests, and adds new LoadStoreLoad test.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2745853002
Cr-Commit-Position: refs/heads/master@{#43841}
2017-03-15 23:34:53 +00:00
Toon Verwaest
c2a53d2574 [ic] Cleanup accessor handling, fix cached property on global, remove cache-on-prototype support
BUG=v8:5561

Change-Id: I425ad7e670b8e9c701ff284ab1be3638a975a6d3
Reviewed-on: https://chromium-review.googlesource.com/455832
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43836}
2017-03-15 16:42:51 +00:00
Clemens Hammacher
69da6fcd2a [wasm] Fix wasm to js wrapper on ia32 for i64 return
When generating the code for an illegal (non-js-compliant) wrapper for
a js function, we were generating a zero constant of the return type.
This failed on ia32 if the return type is i64.
The correct thing to do is to return two i32 zero constants.

R=titzer@chromium.org
BUG=v8:6104, v8:6096

Change-Id: Idc0dd8d3eef901c22d5278d97f1879b000a18588
Reviewed-on: https://chromium-review.googlesource.com/455857
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43835}
2017-03-15 16:14:19 +00:00
Jochen Eisinger
9d0f248201 Store the FunctionTemplateInfo used to create remote objects in the map
That way, we don't need to create a context-less constructor function.
Instead, we use the constructor_or_backpointer (or null) field, and
rename it to constructor_or_fti_or_backpointer so nobody is confused.

Note that technically, we still have JSFunctions without contexts, as
they're temporarily created in the deoptimizer.

BUG=v8:6084
R=dcheng@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

Change-Id: I084f052533c317f2cbfb9c35e1acf40263c6257b
Reviewed-on: https://chromium-review.googlesource.com/454636
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43834}
2017-03-15 15:57:38 +00:00
Ross McIlroy
3db32e064f [Interpreter / TurboFan] Add TestTypeof bytecode.
Adds a TestTypeof bytecode to deal with comparisons of the form:
  typeof(object) === 'string';

Also adds support to Turbofan to perform these comparisons without
inserting checkpoints.

BUG=v8:4280,v8:5267

Change-Id: Ib5cc1c6816dfe70a4120838d8eada2fc0267750f
Reviewed-on: https://chromium-review.googlesource.com/454837
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43832}
2017-03-15 14:05:51 +00:00
leszeks
2b1ed94464 [test] Fix mjsunit/getters-on-elements to reset function state
The function "foo" in "base_getter_test" was picking up a left-over
optimised code object from foo's code map, the third time that
base_getter_test was run, instead of optimising it itself. This
broke the assumptions of the test, that each case was functionally
independent from the others, and had started off with empty feedback
and no optimised code.

This breaks the test though, so we have to blacklist it pending a fix
to the root cause (http://crbug.com/v8/6101).

Review-Url: https://codereview.chromium.org/2750623004
Cr-Commit-Position: refs/heads/master@{#43828}
2017-03-15 13:31:01 +00:00
gdeepti
16796914cb Add Int32x4 Wasm Simd Binops, compare ops, select
- Added: Int32x4Mul, Int32x4Min, Int32x4Max, Int32x4Equal, Int32x4NotEqual
 Uint32x4Min, Uint32x4Max
 - Fix I32x4Splat

R=bbudge@chromium.org, bradnelson@chromium.org, mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2719953002
Cr-Commit-Position: refs/heads/master@{#43827}
2017-03-15 13:24:54 +00:00
Michael Starzinger
a148861c52 [turbofan] Handle equality comparison in early lowering.
This handles non-strict equality comparison operations having number
feedback during the early type-hint lowering (i.e. during graph
construction).

R=jarin@chromium.org

Change-Id: I1db67e78312934bbb20aee775979797420ff2581
Reviewed-on: https://chromium-review.googlesource.com/455796
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43824}
2017-03-15 12:53:17 +00:00
Wiktor Garbacz
bb927eb439 [parser] Fix template escapes in preparser
BUG=v8:6100

Change-Id: Ib8729b2688bbaf6fb397737ccf1b1c086698ab93
Reviewed-on: https://chromium-review.googlesource.com/455876
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43822}
2017-03-15 12:44:41 +00:00
Clemens Hammacher
3e6873abcb [wasm] Fix wasm to js wrapper for illegal signature
When compiling a wasm to js wrapper for a signature which is not JS
compatible, we generate a runtime call to throw a type error and return
immediately afterwards. We were using the return value of the runtime
call as return value for the wrapper.
This worked for integer return values, since the same registers are
used for tagged values and integer values. For float values, however,
it failed, since the return value needs to be stored in another
register.

R=titzer@chromium.org
BUG=v8:6096

Change-Id: I8f39ea132cd150c3044673d25fa3c3588b4266bf
Reviewed-on: https://chromium-review.googlesource.com/455816
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43821}
2017-03-15 12:19:08 +00:00
Marja Hölttä
beacd656f2 [iwyu|arm64] Pre-work for removing the illegal include macro-assembler.h -> assembler-inl.h
BUG=v8:5294

Change-Id: I6214c50c7d1344210a80763b066e5ec56df1265a
Reviewed-on: https://chromium-review.googlesource.com/453460
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43820}
2017-03-15 12:08:50 +00:00
Michael Achenbach
6e376b6c5b [test] Mark slow tests
Mark slow tests discovered by manual audit of reported durations.

Slow tests will run first, which will lead to higher test runner throughput.

Also some tests have flaky timeouts occasionally.

BUG=chromium:601468

Change-Id: If9aeb5422e79ff25b867b01c50386a5fdebeb494
Reviewed-on: https://chromium-review.googlesource.com/455736
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43819}
2017-03-15 12:05:12 +00:00
Toon Verwaest
afeb560c84 [ic] Remove ICUseVector and some access compiler cleanup
BUG=

Change-Id: I1fd0ae3dcb0e644e9f2a56c242720b4def4bb579
Reviewed-on: https://chromium-review.googlesource.com/454836
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43818}
2017-03-15 11:53:47 +00:00
Michael Starzinger
6fca2cfae2 [turbofan] Elide redundant {IfSuccess} control projections.
This changes the IR to no longer require single {IfSuccess} projection
nodes unless there is a corresponding {IfException} node that links the
potentially throwing call to an exception handler. This reduces graph
size as well as compilation time when exception handlers aren't present.

The new invariant for potentially throwing nodes is: Nodes that can
potentially throw either have both IfSuccess/IfException projections as
the only control uses and no direct control uses, or no projections at
all and solely direct control uses.

R=jarin@chromium.org

Change-Id: I3d9cd816d74ad5af13e0673da7ec7a98f1ecdc7e
Reviewed-on: https://chromium-review.googlesource.com/449715
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43814}
2017-03-15 09:26:18 +00:00
jarin
5790aad425 [turbofan] Fix typing for NumberMin and NumberMax to handle uninhabited types.
BUG=chromium:700883

Review-Url: https://codereview.chromium.org/2751513006
Cr-Commit-Position: refs/heads/master@{#43812}
2017-03-15 07:46:25 +00:00
jarin
8c114d1737 [turbofan] Handle Smi -> Float32 conversion in representation changer.
BUG=chromium:693425

Review-Url: https://codereview.chromium.org/2749193003
Cr-Commit-Position: refs/heads/master@{#43811}
2017-03-15 07:44:59 +00:00
jing.bao
d598386db8 [ia32] Add minps/maxps and AVX v_ps/v_pd for add/sub/mul/div/min/max
Also use vinstr for vps/vpd/vss/vsd

BUG=

Review-Url: https://codereview.chromium.org/2747103002
Cr-Commit-Position: refs/heads/master@{#43809}
2017-03-15 02:01:05 +00:00
Eric Holk
2e002b9e20 [wasm] Enable cctests when out of bounds trap handler is enabled
Change-Id: I47f0d5578a7c26aa7a30c97175eefc1a9c935d77
Reviewed-on: https://chromium-review.googlesource.com/455318
Commit-Queue: Eric Holk <eholk@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43808}
2017-03-15 01:40:09 +00:00
Ross McIlroy
b7648be7ec [Flags] Remove --ignition-staging flag.
Removes the --ignition-staging flag since it is no longer used
by anything and won't be a shipping configuration. Also removes
ignition_turbo variant from testrunner, since it is now 
the same as the turbofan variant.

BUG=v8:4280

Change-Id: I3b96e986879fc70b8e202fe9496334828acdd0ba
Reviewed-on: https://chromium-review.googlesource.com/452621
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43806}
2017-03-14 23:07:09 +00:00
franzih
14d0930d40 Revert of Collect type profile for DevTools. (patchset #40 id:750001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
gcc bot is now flaky https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/11863

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43804}
> Committed: 6cf880f4b8

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2754573002
Cr-Commit-Position: refs/heads/master@{#43805}
2017-03-14 21:32:32 +00:00
franzih
6cf880f4b8 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43791}
Committed: 0332bebde9
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43804}
2017-03-14 21:08:56 +00:00
bradnelson
8c1af20baf [wasm][asm.js] Fix asm.js in tests to be more strictly valid.
These tests fail with the new asm.js parser, because they are invalid under
a more strict reading of the spec.

NOTE: These also fail to validate when run in Firefox.

BUG=v8:4203
BUG=v8:6090
R=aseemgarg@chromium.org,eholk@chromium.org

Review-Url: https://codereview.chromium.org/2745393002
Cr-Commit-Position: refs/heads/master@{#43803}
2017-03-14 20:17:04 +00:00
caitp
e08289d0ed [test] remove unnecessary whitelisted builtins from test-debug.cc
BUG=chromium:691875
R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2747733002
Cr-Commit-Position: refs/heads/master@{#43800}
2017-03-14 17:02:27 +00:00
machenbach
c92f41d00a Revert of Collect type profile for DevTools. (patchset #39 id:730001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
gcc bot has problems with this: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/11858

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org,franzih@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2749673003
Cr-Commit-Position: refs/heads/master@{#43798}
2017-03-14 16:41:02 +00:00
yangguo
62b6dd1942 [debugger] correctly find inner function scope.
Nested arrow functions can have the same end positions, so
the end position is unsuitable to decide whether a scope is
an inner function scope.

BUG=chromium:696202
R=jgruber@chromium.org, kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2751573003
Cr-Commit-Position: refs/heads/master@{#43797}
2017-03-14 16:35:19 +00:00
bbudge
a75f7cd344 [ARM] Implement more NEON permutation instructions.
- Implements vuzp, vtrn instructions for q-registers.
- Refactors vmvn, vswp to use common unary op helper fn.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2739033002
Cr-Commit-Position: refs/heads/master@{#43795}
2017-03-14 16:28:45 +00:00
Clemens Hammacher
0a4c5c4411 [wasm] Cleanup wasm interpreter
This is a cleanup in preparation to implement calling imported
functions via the wasm interpreter.
For imported functions, we do not create entries in the
interpreter_code_ vector any more.

I also simplified the interface and removed unused or redundant return
values. More things are now DCHECKed instead of bailing out.

Also, we previously had two PushFrame methods: One is supposed to
initialize the interpreter from external code (i.e. adds the first
frame to the stack), the other one is used to push new frames on the
frame stack for called functions. This CL renames the first to
InitFrame, and makes it use the second one. The other remaining user is
the DoCall method.

R=titzer@chromium.org
BUG=v8:5822

Change-Id: Id09ff1e3256428fbd8c955e4664507a0c3167e53
Reviewed-on: https://chromium-review.googlesource.com/453482
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43793}
2017-03-14 16:18:18 +00:00
franzih
0332bebde9 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43791}
2017-03-14 16:11:56 +00:00
Jochen Eisinger
f5a508f31f Disable other background modules while testing the CompilerDispatcher
R=rmcilroy@chromium.org,mlippautz@chromium.org
BUG=v8:6069

Change-Id: Iea0134ef3a0252f5a6f4ae2154218776dc6ff96d
Reviewed-on: https://chromium-review.googlesource.com/453960
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43786}
2017-03-14 14:01:03 +00:00
jkummerow
d0e604bf26 FunctionEntryHook: require no-snapshot build
When a FunctionEntryHook parameter was passed to isolate creation,
we ignored any existing snapshots anyway. Since the ability to
bootstrap from scratch will be removed from snapshot builds, the
FunctionEntryHook feature must depend on a no-snapshot build.

BUG=v8:6055

Review-Url: https://codereview.chromium.org/2733203002
Cr-Commit-Position: refs/heads/master@{#43779}
2017-03-14 12:31:03 +00:00
Michael Achenbach
a0077f222b [test] Skip slow tests
BUG=chromium:682617
TBR=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: If121a5d01bba113374bc1673780fc713997e54a9
Reviewed-on: https://chromium-review.googlesource.com/454618
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43776}
2017-03-14 11:43:01 +00:00
Michael Starzinger
3b597bb701 [runtime] Fix KeyAccumulator for non-internalized keys.
This fixes a corner-case in {KeyAccumulator::CollectOwnJSProxyKeys}
where the keys returned by {JSReceiver::OwnPropertyKeys} for an array
are not internalized and hence have a diverging identity from keys
returned by the "ownKeys" trap of a proxy.

R=cbruni@chromium.org
TEST=mjsunit/regress/regress-crbug-700678
BUG=chromium:700678

Change-Id: I5efd012eade14bd45c69e4abb0aeda684baf38f0
Reviewed-on: https://chromium-review.googlesource.com/452979
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43775}
2017-03-14 11:19:28 +00:00
Clemens Hammacher
7f460012c6 [wasm] Show interpreted frames on captured stack traces
In Isolate::CaptureSimpleStackTrace, we were ignoring interpreter entry
frames so far. This CLs changes this to gets the interpreted stack from
the wasm interpreter and add the frames to the FrameArray.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5822

Change-Id: I705909532ff28af412ff809da94522866eaa1c0d
Reviewed-on: https://chromium-review.googlesource.com/452378
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43772}
2017-03-14 10:23:20 +00:00
Michael Achenbach
9f4188c252 [test] Fix fullcode and ignition testing variants
BUG=chromium:682617
R=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org

Change-Id: Id0c904e080bb09e4ac1a127a02b110459442f7f3
Reviewed-on: https://chromium-review.googlesource.com/452484
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43771}
2017-03-14 09:59:04 +00:00
Jochen Eisinger
2cd2f5feff Remove experimental fast accessor builder API
As the code isn't used, but would have to be ported from hand-written
assembly to CodeStubAssembler anyways, I propose to remove it and
restore it if we decide that we actually need it.

R=vogelheim@chromium.org
BUG=

Change-Id: Iffd7fc6ec534b1dd7a9144da900424355c8a7a02
Reviewed-on: https://chromium-review.googlesource.com/453461
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43763}
2017-03-14 08:14:48 +00:00
jing.bao
97254b0d23 [ia32] Supplement shift instructions for SIMD
psll/rl/raw(xmm, imm)
psrad(xmm, imm)
vpsll/rl/raw(xmm, xmm, imm)
vpsll/rl/rad(xmm, xmm, imm)

BUG=

Review-Url: https://codereview.chromium.org/2747783004
Cr-Commit-Position: refs/heads/master@{#43762}
2017-03-14 08:01:20 +00:00
jing.bao
3800ba6cc7 [ia32] Add some SSE2, SSE4 instructions and AVX version for SIMD
Add instructions in following format:
instr(xmm, xmm/mem)
vinstr(xmm, xmm, xmm/mem)

BUG=

Review-Url: https://codereview.chromium.org/2744643004
Cr-Commit-Position: refs/heads/master@{#43760}
2017-03-14 02:00:13 +00:00
eholk
118c376fcb [wasm] Initial signal handler
This is basically the minimum viable signal handler for Wasm bounds checks.
It includes the TLS check and the fine grained instructions checks. These
two checks provide most of the safety for the signal handler. Future CLs will
add code range and data range checks for more robustness.

The trap handling code and data structures are all in src/trap-handler, with
the code that actually runs in the signal handler confined to
src/trap-handler/signal-handler.cc.

This changes adds a new V8 API that the embedder should call from a signal
handler that will give V8 the chance to handle the fault first. For hosts that
do not want to implement their own signal handler, we include the option to
install a simple one. This simple handler is also used for the tests.

When a Wasm module is instantiated, information about each function is passed
to the trap handler, which is used to classify faults. These are removed during
the instance finalizer.

Several future enhancements are planned before turning this on by default.
Obviously, the additional checks will be added to MaybeHandleFault. We are
also planning to add a two-level CodeObjectData table that is grouped by
isolates to make cleanup easier and also reduce potential for contending on
a single data structure.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2371833007
Cr-Original-Original-Commit-Position: refs/heads/master@{#43523}
Committed: a5af7fe9ee
Review-Url: https://codereview.chromium.org/2371833007
Cr-Original-Commit-Position: refs/heads/master@{#43755}
Committed: 338622d7ca
Review-Url: https://codereview.chromium.org/2371833007
Cr-Commit-Position: refs/heads/master@{#43759}
2017-03-13 22:12:23 +00:00
binji
65200967b7 Reland moving Atomics builtins to C++
This reverts the previous revert, commit
5a04f4fd68.

Previously reverted changes:

>    Revert "[SAB] Move Atomics builtins to C++"
>
>     This reverts commit 2b9840d86f.
>
>     Revert "[SAB] Remove unreachable Uint8Clamped atomics paths"
>
>     This reverts commit d1160fb14f.
>
>     Revert "Remove tiny unit test for MinSimple/MaxSimple"
>
>     This reverts commit 837760ecb7.
>
>     Revert "Remove infrastructure for experimental JS natives"
>
>     This reverts commit 8cfe45b6f1.

These changes were reverted to improve a perf regression on a Chrome
bot. Since then, the regression has reappeared, then disappeared again
all from seemingly unrelated changes.

BUG=v8:6033
TBR=adamk@chromium.org,hpayer@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2732213005
Cr-Commit-Position: refs/heads/master@{#43758}
2017-03-13 20:59:15 +00:00
eholk
aba151b92f Revert of [wasm] Initial signal handler (patchset #60 id:1170001 of https://codereview.chromium.org/2371833007/ )
Reason for revert:
ASAN breakage, such as https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/19111/steps/Check/logs/grow-memory

Original issue's description:
> [wasm] Initial signal handler
>
> This is basically the minimum viable signal handler for Wasm bounds checks.
> It includes the TLS check and the fine grained instructions checks. These
> two checks provide most of the safety for the signal handler. Future CLs will
> add code range and data range checks for more robustness.
>
> The trap handling code and data structures are all in src/trap-handler, with
> the code that actually runs in the signal handler confined to
> src/trap-handler/signal-handler.cc.
>
> This changes adds a new V8 API that the embedder should call from a signal
> handler that will give V8 the chance to handle the fault first. For hosts that
> do not want to implement their own signal handler, we include the option to
> install a simple one. This simple handler is also used for the tests.
>
> When a Wasm module is instantiated, information about each function is passed
> to the trap handler, which is used to classify faults. These are removed during
> the instance finalizer.
>
> Several future enhancements are planned before turning this on by default.
> Obviously, the additional checks will be added to MaybeHandleFault. We are
> also planning to add a two-level CodeObjectData table that is grouped by
> isolates to make cleanup easier and also reduce potential for contending on
> a single data structure.
>
> BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277
>
> Review-Url: https://codereview.chromium.org/2371833007
> Cr-Original-Commit-Position: refs/heads/master@{#43523}
> Committed: a5af7fe9ee
> Review-Url: https://codereview.chromium.org/2371833007
> Cr-Commit-Position: refs/heads/master@{#43755}
> Committed: 338622d7ca

TBR=ahaas@chromium.org,bradnelson@google.com,hpayer@chromium.org,jochen@chromium.org,mark@chromium.org,mseaborn@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2744383002
Cr-Commit-Position: refs/heads/master@{#43757}
2017-03-13 20:03:25 +00:00
eholk
338622d7ca [wasm] Initial signal handler
This is basically the minimum viable signal handler for Wasm bounds checks.
It includes the TLS check and the fine grained instructions checks. These
two checks provide most of the safety for the signal handler. Future CLs will
add code range and data range checks for more robustness.

The trap handling code and data structures are all in src/trap-handler, with
the code that actually runs in the signal handler confined to
src/trap-handler/signal-handler.cc.

This changes adds a new V8 API that the embedder should call from a signal
handler that will give V8 the chance to handle the fault first. For hosts that
do not want to implement their own signal handler, we include the option to
install a simple one. This simple handler is also used for the tests.

When a Wasm module is instantiated, information about each function is passed
to the trap handler, which is used to classify faults. These are removed during
the instance finalizer.

Several future enhancements are planned before turning this on by default.
Obviously, the additional checks will be added to MaybeHandleFault. We are
also planning to add a two-level CodeObjectData table that is grouped by
isolates to make cleanup easier and also reduce potential for contending on
a single data structure.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2371833007
Cr-Original-Commit-Position: refs/heads/master@{#43523}
Committed: a5af7fe9ee
Review-Url: https://codereview.chromium.org/2371833007
Cr-Commit-Position: refs/heads/master@{#43755}
2017-03-13 19:14:35 +00:00
kozyatinskiy
c418902be4 [inspector] don't make v8::debug::Call for breakProgram.
We emulate break by callling breakProgramCallback function in debugger context, we can just use HandleDebugBreak.
It allows us to move all stepping logic to debug.cc later and remove one usage of debugger context.
+ two minor issues fixed, see tests.

BUG=v8:5510
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2738503006
Cr-Commit-Position: refs/heads/master@{#43750}
2017-03-13 14:59:43 +00:00
littledan
01cc4f9fbb test262 roll
A couple infrastructure changes went into this patch:
- test262 changed from expecting $ to $262
- upstream-local-tests.sh gets a command-line parameter for ease of use
- Fixed up the FAIL_SLOPPY infrastructure, which seems to have bit-rotted
- Inserted a terrible hack to get around test262 tests with a $ in the name

Drive-by fix for the length of Intl.DateTimeFormat.prototype.format

R=adamk

Review-Url: https://codereview.chromium.org/2733843002
Cr-Commit-Position: refs/heads/master@{#43749}
2017-03-13 14:33:07 +00:00
Michael Achenbach
8e4be1a2e3 [test] Fix typo in testing variant name
This makes it possible to directly request testing noturbofan_stress on the command line.

BUG=chromium:682617
TBR=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: I6ba9a022c4ef24fb5abe6878d3f2f972e8461eb8
Reviewed-on: https://chromium-review.googlesource.com/453180
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43748}
2017-03-13 14:21:15 +00:00
Peter Marshall
06fef85bdd [builtins] Port TypedArrayConstructByArrayBuffer to CodeStubAssembler.
Part of the performance and refactoring work to move the TypedArray
constructors into CSA. This CL moves ConstructByArrayBuffer from JS
to CSA.

BUG=v8:5977

Change-Id: I0a200e6b3f6261ea2372ea9c3d3ca98e313cf2c5
Reviewed-on: https://chromium-review.googlesource.com/451620
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43747}
2017-03-13 14:04:37 +00:00
Ilija.Pavlovic
d9bcc067ca [turbofan] Fix regress-694088.js for big endian.
Test regress-694088.js is adapted for execution on big endian platforms.

TEST=test/mjsunit/compiler/regress-694088.js
BUG=

Review-Url: https://codereview.chromium.org/2739403002
Cr-Commit-Position: refs/heads/master@{#43746}
2017-03-13 12:59:48 +00:00
yangguo
09de9969cc [debugger] fix switch block source positions.
The switch statement itself is part of the switch block.
However, the source position of the statement is outside of
the block. This leads to confusion for the debugger, if the
switch block pushes a block context: the current context is
a block context, but the scope analysis based on the current
source position tells the debugger that we should be outside
the scope, so we should have the function context.

R=marja@chromium.org
BUG=v8:6085

Review-Url: https://codereview.chromium.org/2744213003
Cr-Commit-Position: refs/heads/master@{#43744}
2017-03-13 12:47:48 +00:00
Caitlin Potter
326d4f436d [builtins] add exception predictions for AsyncFromSyncIterator methods
Add a mechanic to set these Builtin exception predictions per-Isolate
rather than per-Context in the Bootstrapper.

Also add Debugger tests which would fail without these prediction
modes set.

Does not yet test for AsyncFromSyncIteratorPrototypeReturn, as this
requires AsyncGenerators and `yield*` to be hit.

BUG=chromium:691875
R=yangguo@chromium.org, jgruber@chromium.org, gsathya@chromium.org

Change-Id: Ic2d2aba3870cce2f7321080f4278875edf253c76
Reviewed-on: https://chromium-review.googlesource.com/451967
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#43742}
2017-03-13 11:10:38 +00:00
yangguo
07ee0b175c [debugger] correctly annotate scripts with debug id.
Previously, we would incorrectly not assign any debug id to scripts
deserialized from the code cache.

R=jgruber@chromium.org
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2742713003
Cr-Commit-Position: refs/heads/master@{#43740}
2017-03-13 09:13:43 +00:00
shiyu.zhang
78199ce5e0 [turbofan] Enable complex memory operands for binops on ia32/x64
With this change, on ia32 and x64, a load from memory into a register can be replaced by a memory operand for integer binops if it makes sense.

BUG=

Review-Url: https://codereview.chromium.org/2728533003
Cr-Commit-Position: refs/heads/master@{#43739}
2017-03-13 08:50:54 +00:00
Michael Achenbach
384fe54e02 [test] Mark slow msan tests
TBR=mstarzinger@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: I355953b0b24a64e3c5e1a43cdeaa8ec2650b0988
Reviewed-on: https://chromium-review.googlesource.com/453459
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43737}
2017-03-13 08:17:54 +00:00
bmeurer
9bee8f1065 [turbofan] Fix lowering of Number.isNaN().
BUG=v8:6082
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2743183003
Cr-Commit-Position: refs/heads/master@{#43735}
2017-03-13 07:00:59 +00:00
Sathya Gunasekaran
36a22fe775 [debug] Add exception predictions to builtins where missing.
This fixes the catch predictions for the following builtins --
AsyncFunctionAwaitCaught
AsyncFunctionAwaitUncaught
PromiseResolveClosure
ResolvePromise
PromiseResolve

Added tests for each.

Added whitelist for builtins behind a flag.

BUG=chromium:691875

Change-Id: I816cafdb69f0c9f1eefc440a0a44c36713d0b7dc
Reviewed-on: https://chromium-review.googlesource.com/450894
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43725}
2017-03-10 17:44:51 +00:00
kozyatinskiy
fb147b0ef1 [inspector] merged IsSubjectToDebugging and IsBlackboxed and fixed issue
- additionally doesn't deoptimize function in HandleDebugBreak for debugger statements inside of blackboxed code.

BUG=none
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2742843003
Cr-Commit-Position: refs/heads/master@{#43724}
2017-03-10 17:44:35 +00:00
Michael Starzinger
f2ad990f41 Fix bogus implication from --turbo to --crankshaft.
Now that the --turbo flag is on by default, this implication makes it
impossible to disable the runtime profiler to prevent functions from
being considered hot. Essentially the --nocrankshaft flag was borked.

R=machenbach@chromium.org

Change-Id: I698008b4b69038e8bfab6d8ec3ccf57e2fd71701
Reviewed-on: https://chromium-review.googlesource.com/452619
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43720}
2017-03-10 11:37:24 +00:00
Camillo Bruni
53d67fe45d [tools] Show more entries in the ticks-processor
- lower the cutoff-threshold for bottom up graphs to 1%
- show all builtins/stubs/ics by default

R=jkummerow@chromium.org

Change-Id: I522173155b817ae20a37c40ecf411f2b55d82105
Reviewed-on: https://chromium-review.googlesource.com/452482
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43717}
2017-03-10 10:34:11 +00:00
yangguo
faf5f52627 [debugger,api] deprecate everything in v8-debug.h
R=clemensh@chromium.org, jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2727393003
Cr-Commit-Position: refs/heads/master@{#43714}
2017-03-10 07:06:25 +00:00
yangguo
62b0fa2ee9 Allow C++11 in unittests.
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2741573003
Cr-Commit-Position: refs/heads/master@{#43712}
2017-03-10 06:35:51 +00:00
yangguo
c827075993 [inspector] do not translate offset to line/column for coverage.
R=caseq@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2741653003
Cr-Commit-Position: refs/heads/master@{#43710}
2017-03-10 05:19:04 +00:00
jing.bao
b9614d4bd1 Add several SIMD opcodes to IA32
CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
Int32x4Add, Int32x4Sub

Also add paddd, psubd, vpaddd, vpsubd, pinsrw to ia32-assembler

BUG=

Review-Url: https://codereview.chromium.org/2695613004
Cr-Original-Commit-Position: refs/heads/master@{#43483}
Committed: 4deb9ffdec
Review-Url: https://codereview.chromium.org/2695613004
Cr-Commit-Position: refs/heads/master@{#43708}
2017-03-10 02:40:06 +00:00
danno
e466744da5 [interpreter] Create custom call opcodes for specific argument counts
Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
and CallProperty2. Also share the bytecode handler code between between
equivalent CallX and CallPropertyX handlers.

Review-Url: https://codereview.chromium.org/2684993002
Cr-Original-Commit-Position: refs/heads/master@{#43290}
Committed: 00d6f1f80a
Review-Url: https://codereview.chromium.org/2684993002
Cr-Commit-Position: refs/heads/master@{#43700}
2017-03-09 14:40:02 +00:00
bmeurer
18be5d7057 [turbofan] Revert invalid optimization of flooring division.
The optimization

  NumberFloor(NumberDivide(lhs, rhs))

to

  NumberToInt32(NumberDivide(lhs, rhs))

for potentially negative lhs is not valid, since Math.floor rounds
towards -infinity, whereas ToInt32 truncates.

BUG=chromium:699282
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2743673002
Cr-Commit-Position: refs/heads/master@{#43699}
2017-03-09 13:41:39 +00:00
Michael Achenbach
f58177dd92 [test] Switch future/no-turbo perf configs for js-tests
BUG=chromium:682617
NOTRY=true
R=mvstanton@chromium.org,petermarshall@chromium.org

Change-Id: I5902c4ac3c8fb4230142896addbb75a9e7d28fbb
Reviewed-on: https://chromium-review.googlesource.com/451378
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43694}
2017-03-09 13:38:02 +00:00
Igor Sheludko
fa7b88fddd [json] Fix error reporting when parsing an internalized one-byte string.
BUG=chromium:686010

Change-Id: I7bd4ab48f90a1013132bf037fd352ab55747189c
Reviewed-on: https://chromium-review.googlesource.com/451377
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43691}
2017-03-09 12:28:17 +00:00
yangguo
f2408624c9 [json] use OrderedHashSet for replacer property list.
R=ishell@chromium.org
BUG=v8:6071

Review-Url: https://codereview.chromium.org/2740073002
Cr-Commit-Position: refs/heads/master@{#43690}
2017-03-09 12:27:46 +00:00
Igor Sheludko
c03c7b7387 [runtime] Prototype const-to-mutable field migrations without deprecating maps.
It depends on constant field tracking and currently disabled.

BUG=v8:5495

Change-Id: I6202cddfc2d32b5a06c5ab00c42caa6e276a3eb1
Reviewed-on: https://chromium-review.googlesource.com/451639
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43687}
2017-03-09 12:26:12 +00:00
jgruber
5002a4a961 [regexp] Properly flatten string during initialization
This fixes an incorrect usage of String::Flatten in EscapeRegExpSource.

It also adds %ConstructConsString (to easily and reliably construct cons
strings in tests) and Factory::NewConsString (to enable guaranteed cons
string construction without preemptive flattening attempts).

BUG=chromium:698790

Review-Url: https://codereview.chromium.org/2736383003
Cr-Commit-Position: refs/heads/master@{#43686}
2017-03-09 12:25:19 +00:00
bbudge
cbfd9f5ede [WASM] Make F32x4 Tests pass on ARM hardware.
- Changes input filtering to test NaNs, but skip very large or very
  small inputs, which may cause imprecision on some platforms.
- Changes expected result filtering to only skip NaNs.

LOG=N
BUG=6020

Review-Url: https://codereview.chromium.org/2738703006
Cr-Commit-Position: refs/heads/master@{#43681}
2017-03-09 00:07:03 +00:00
hpayer
b643bb7713 [heap] Add atomics to mark bit operations.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2492263002
Cr-Commit-Position: refs/heads/master@{#43679}
2017-03-08 16:31:18 +00:00
Michael Starzinger
fb887b8192 [zone] Fix propagation of OOM in Zone::NewSegment.
This fixes various allocator methods to properly propagate {nullptr} to
callers without accidentally dereferencing it. We also disable one test
case for stress mode as it runs out of memory due to inlining limits
being lifted in the stress mode.

R=bmeurer@chromium.org
TEST=mjsunit/array-natives-elements
BUG=v8:6061

Change-Id: Id0a7b826a8612d00b4f4ae8aa0bea011c50890ca
Reviewed-on: https://chromium-review.googlesource.com/451365
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43672}
2017-03-08 13:26:55 +00:00
bmeurer
6560707945 [ia32] Fix invalid DCHECK on cmpw with immediate.
The immediate passed to cmpw can be either a signed 16-bit or an
unsigned 16-bit integer, but the DCHECK was testing for signed 16-bit
values only.

R=mstarzinger@chromium.org
BUG=v8:6063

Review-Url: https://codereview.chromium.org/2735363002
Cr-Commit-Position: refs/heads/master@{#43671}
2017-03-08 13:04:45 +00:00
cwhan.tunz
5fc1bd5b32 [typedarrays] check byte offset for fast typedarray sort
BUG=v8:5953

Review-Url: https://codereview.chromium.org/2733393002
Cr-Commit-Position: refs/heads/master@{#43666}
2017-03-08 12:01:19 +00:00
Michael Lippautz
efd4b2d3af [heap] Bail out for page promotion tests when feature is disabled
BUG=chromium:651354

Change-Id: Iaa2be2504474842d101f19fa2f6c15baa88544c6
Reviewed-on: https://chromium-review.googlesource.com/451497
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43665}
2017-03-08 12:01:10 +00:00
yangguo
77165eb4df [debug] change coverage API to use offset instead of line/column.
R=caseq@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2733783002
Cr-Commit-Position: refs/heads/master@{#43662}
2017-03-08 07:23:21 +00:00
jarin
18f169d46c [turbofan] Propagate minus-zero truncation in representation inference.
This introduces a new truncation bit for truncation of minus-zero to zero.

At the moment it is only used to handle the limit cases of deopt, such as the
one in the Google maps workload (see simplified version below), where the -q
(which is desugared to q * -1.0) currently deoptimizes because the result would
produce minus zero. To handle this situation, we exploit the knowledge that
righthand side of + cannot be -0, so even if lefthand side was -0, the result
would still be 0 (so the + operation cannot distinguish between left hand side
0 and -0).

function f(q) {
  q -= 4;
  return (-q) + q;
}

f(10);
f(10);
%OptimizeFunctionOnNextCall(f);
f(4);

Review-Url: https://codereview.chromium.org/2734253002
Cr-Commit-Position: refs/heads/master@{#43661}
2017-03-08 06:11:37 +00:00
bbudge
78382d7272 [WASM] Implement remaining F32x4 operations for ARM.
- Implements Float32x4 Mul, Min, Max for ARM.
- Implements Float32x4 relational ops for ARM.
- Implements reciprocal, reciprocal square root estimate/refinement ops for ARM.
- Reorganizes tests to eliminate need for specialized float ref fns in tests.
- Rephrases Gt, Ge in terms of Lt, Le, and eliminates the redundant machine
  operators.
- Renames test-run-wasm-simd test names to match instructions.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2729943002
Cr-Commit-Position: refs/heads/master@{#43658}
2017-03-08 00:01:36 +00:00
kozyatinskiy
e502665d34 [inspector] added createContextGroup for tests
BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2737603006
Cr-Commit-Position: refs/heads/master@{#43657}
2017-03-07 22:30:05 +00:00
kozyatinskiy
07ada64a57 [inspector] added length for scriptParsed notification
BUG=none
R=caseq@chromium.org

Review-Url: https://codereview.chromium.org/2740623002
Cr-Commit-Position: refs/heads/master@{#43656}
2017-03-07 22:01:37 +00:00
Ross McIlroy
f774d8c56f [Flags] Add negation implications for --turbo negative so --no-turbo works.
Once we enabled --turbo by default we need to turn all the implications
off with --no-turbo as well. Chrome sets flags in V8 using SetFlagFromString,
which enforces the implications each time it is called. Therefore, if --turbo
is enabled by default, and an unrelated flag is set, the turbo implications are
enabled but not later disabled if we set --no-turbo. To fix this, add negative
implications as well.

BUG=chromium:692409

Change-Id: Iadb0ca542f49ba65c7419cda8c7a03636a8d5ba9
Reviewed-on: https://chromium-review.googlesource.com/451320
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43655}
2017-03-07 20:41:12 +00:00
clemensh
6cf8f54d90 [wasm] Fix interpreter entry for i64 return type
Fix two issues in the interpreter entry for 64 bit return values on
32 bit platforms. First, the effect chain was slightly incorrect, second
the order of the returned values was wrong.

Also add a test case for this.
Tested on x64, ia32 and s390.

Plus drive-by fix in Int64Lowering to reuse global constants for
big-endian/little-endian disambiguation.

R=titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2731713002
Cr-Commit-Position: refs/heads/master@{#43654}
2017-03-07 18:03:08 +00:00
bbudge
b23f6a462e [WASM] Fix failing F32x4 Equal, NotEqual tests.
- Fix typo, compare operand diff should be a float.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2734173003
Cr-Commit-Position: refs/heads/master@{#43651}
2017-03-07 17:52:08 +00:00
jkummerow
c478a2298d SnapshotCreator: start from existing snapshot if we have one
This requires serialized data to track the number of API-provided
external references separately.
And it flushes out a case of serialized data corruption (stored "length"
field too large) that we didn't handle without crashing.

BUG=v8:6055

Review-Url: https://codereview.chromium.org/2736923002
Cr-Commit-Position: refs/heads/master@{#43649}
2017-03-07 16:36:51 +00:00
bjaideep
7c0f3f0623 AIX: Work around for malloc(0) behavior
malloc(0) returning 0 is expected behavior on AIX but
compiling with -D_LINUX_SOURCE_COMPAT, malloc(0) should
return a valid pointer (which we do define for AIX). However,
including cstdlib resets the behaviour of _LINUX_SOURCE_COMPAT.
GCC bug: 79839

R=jochen@chromium.org, titzer@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2732743002
Cr-Commit-Position: refs/heads/master@{#43647}
2017-03-07 15:49:20 +00:00
hpayer
6517b4477c [heap] Do not clear mark bits of left trimmed old object start.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2731363002
Cr-Commit-Position: refs/heads/master@{#43645}
2017-03-07 15:16:49 +00:00
Toon Verwaest
7bc196d2a5 [interpreter] Mark known immutable context slots as immutable
BUG=

Change-Id: I85f9619e0ecb7d0ebee9523e3b4c44ab7f091cfb
Reviewed-on: https://chromium-review.googlesource.com/451380
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43644}
2017-03-07 14:56:05 +00:00
ahaas
040fa762df [arm64][turbofan] Do not use ubfx for shr+and combination for mask=0.
R=titzer@chromium.org, v8-arm-ports@googlegroups.com
BUG=v8:6046

Review-Url: https://codereview.chromium.org/2737493002
Cr-Commit-Position: refs/heads/master@{#43643}
2017-03-07 14:54:05 +00:00
bmeurer
f0e7a3174e [turbofan] Extend optimization of flooring integer division.
So far we only recognize the special

  NumberFloor(NumberDivide(lhs, rhs))

subgraph when both lhs and rhs are in the Unsigned32 range, and the
result is a PlainNumber. Extend this pattern matching to also cover

  NumberFloor(SpeculativeNumberDivide(lhs, rhs))

and to replace the NumberFloor with NumberToInt32 truncation if the
lhs value is in Signed32 range and the rhs is in Unsigned32 range.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2739573004
Cr-Commit-Position: refs/heads/master@{#43642}
2017-03-07 14:46:10 +00:00
Marja Hölttä
f489f7ab44 [parser] Skipping inner funcs: collect data needed for allocation, not the allocation result.
This pretty much rewrites the preparsed scope data collection. We used to store
the allocation result, but it's faster to just store the raw data which is
needed for deciding it later. (This way we don't need to run the allocation
algorithm for just getting this data.)

For each variable: is_used, maybe_assigned,
has_forced_context_allocation, and for each scope:
inner_scope_calls_eval_.

In addition, this CL moves data handling out of Scope and into
PreParsedScopeData where it belongs and simplifies the API for
PreParsedScopeData.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Ia5a4fa52f585cd4f483ce9a92f2dd7d9754f34ed
Reviewed-on: https://chromium-review.googlesource.com/451273
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43641}
2017-03-07 14:23:14 +00:00
ulan
dab18fb0bb Make idle tasks optional in the default platform.
BUG=v8:6056

Review-Url: https://codereview.chromium.org/2737743002
Cr-Commit-Position: refs/heads/master@{#43640}
2017-03-07 13:37:41 +00:00
mvstanton
15bed19495 Adjust some tests to prepare enabling Ignition+TurboFan
BUG=v8:5267, chromium:692409

Review-Url: https://codereview.chromium.org/2720713003
Cr-Commit-Position: refs/heads/master@{#43638}
2017-03-07 13:27:55 +00:00
Michael Starzinger
aa894affc8 Remove dead handling of Token::NE from all backends.
The parser already changes all negative equality comparison operations
to their positive pendants in {ParserBase::ParseBinaryExpression}. No
other source of the Token::NE exists in the system. We can remove all
handling from the compiler and interpreter backends.

R=bmeurer@chromium.org

Change-Id: I58722c08dd8e498f20c65886fce86b8172737b10
Reviewed-on: https://chromium-review.googlesource.com/449716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43627}
2017-03-07 09:18:24 +00:00
Peter Marshall
ead3656cbd [builtins] Port TypedArrayConstructByLength to CodeStubAssembler.
Part of the performance and refactoring work to move the TypedArray
constructors into CSA. This CL moves ConstructByLength from JS
to CSA.

There are still other callers to typed_array_initialize in
typedarray.js, so we share the implementation using DoInitialize.

In a later CL we can split apart DoInitialize once we have more
TA constructors written in CSA, so that we can reuse specific
parts more easily.

BUG=v8:5977

Change-Id: Ia51e8363970e9a025a82933e56a7baaf82cb1eec
Reviewed-on: https://chromium-review.googlesource.com/448220
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43626}
2017-03-07 09:15:17 +00:00
Ross McIlroy
dba45fde81 [IdentityMap] Remove ability to delete entries during iteration.
Deletion can cause collisions to be moved in the map which breaks iteration.
For now just remove this support. Also add some additional collision tests
to the test.

BUG=v8:5203

Change-Id: I54a0a4af51da08b3f963dc1d7661dba291e4efea
Reviewed-on: https://chromium-review.googlesource.com/445900
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43621}
2017-03-06 21:15:20 +00:00
yangguo
5e0c178fe6 [debugger] remove default count for top-level functions.
If the top-level function cannot be found, we previously assumed an
invocation count of 1. This is wrong when we expect the invocation
counts to be reset for precise coverage.

TBR=jgruber@chromium.org
R=caseq@chromium.org,pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2723003007
Cr-Commit-Position: refs/heads/master@{#43620}
2017-03-06 20:49:11 +00:00
kozyatinskiy
562da35614 [inspector] added type of break location into getPossibleBreakpoints output
This CL provide type with each break location, type could be: call, return or debugger statement.

BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2728563002
Cr-Commit-Position: refs/heads/master@{#43619}
2017-03-06 20:47:55 +00:00
ulan
a3923ce210 [heap] Implement simple marking in the concurrent marking thread.
The concurrent marker uses ObjectVisitor to iterate pointers in objects
and local marking bitmaps to keep track of visited objects.

To keep it simple for now, I removed support for multiple tasks
and canceling unfinished tasks.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2732053002
Cr-Commit-Position: refs/heads/master@{#43618}
2017-03-06 20:46:41 +00:00
kozyatinskiy
47276d3db3 [inspector] introduced Debugger.scheduleStepIntoAsync
This method could be called on pause and will do stepInto next scheduled callback if any will happen until next break.
First implementation support only callbacks chained by Promise.prototype.then.

BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2723273002
Cr-Commit-Position: refs/heads/master@{#43616}
2017-03-06 16:28:21 +00:00
ulan
e96b5ed423 [heap] Implement concurrent marking boilerplate.
This patch adds a trivial ConcurrentMarking class that can start
background tasks.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2728363002
Cr-Commit-Position: refs/heads/master@{#43615}
2017-03-06 15:19:36 +00:00
Clemens Hammacher
7d8a3028dd [wasm] Fix code specialization for empty memory buffer
From asm.js code we might get an empty ArrayBuffer as heap memory. In
this case, both the old memory start and the new memory start will be
nullptr. The size however has to be patched from default_size to 0.

This CL changes code specialization to be able to either patch memory
references, or patch memory sizes or both.

R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:698587

Change-Id: I4d9d811d75cb83842f23df317e8e7fc02aeb5146
Reviewed-on: https://chromium-review.googlesource.com/450257
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43613}
2017-03-06 13:39:54 +00:00
bmeurer
1e4a2725b8 [turbofan] Teach escape analysis about ObjectIsNaN.
BUG=chromium:698607
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2735633003
Cr-Commit-Position: refs/heads/master@{#43612}
2017-03-06 12:55:28 +00:00
jarin
fe704477d6 [deoptimizer] When deoptimizing code, unlink all functions referring to that code.
Drive by: remove two unused methods in optimized code visitor.

Review-Url: https://codereview.chromium.org/2730323002
Cr-Commit-Position: refs/heads/master@{#43611}
2017-03-06 12:22:05 +00:00
hpayer
bb31612af1 [heap] Remove Marking::BlackToWhite and Marking::GreyToWhite.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2737483002
Cr-Commit-Position: refs/heads/master@{#43609}
2017-03-06 12:10:05 +00:00
addaleax
de1461b7ef Drop UniqueId from include/v8.h
It's unused since March 2 2017 (https://chromium-review.googlesource.com/448539).
This removes it assuming that leaving it in the header was an oversight.

BUG=v8:5828

Review-Url: https://codereview.chromium.org/2732803002
Cr-Commit-Position: refs/heads/master@{#43605}
2017-03-06 10:58:01 +00:00
jarin
fcce4797bc [profiler] Graphical front-end for tick processor.
Improvements:
- top-down call tree.
- interactive restriction to time interval.

Review-Url: https://codereview.chromium.org/2696903002
Cr-Commit-Position: refs/heads/master@{#43599}
2017-03-04 13:04:58 +00:00
bakkot
baa74e89b6 [parser] Correctly handle invalid escapes in adjacent template tokens.
A previous patch lifting the restriction on invalid escape sequences in
tagged templates had a bug when two template tokens appeared immediately
adject to each other. This moves invalid escape information from the
tokenizer state proper into the TokenDesc, preventing the overwriting
which caused this issue.

Previous CL is at
https://codereview.chromium.org/2665513002

BUG=v8:6029,v8:5546

Review-Url: https://codereview.chromium.org/2724003006
Cr-Commit-Position: refs/heads/master@{#43596}
2017-03-03 22:08:57 +00:00
luoe
3a20c322bb [inspector] remove iterators and for...of loops from injected-script-source
BUG=chromium:686003

Review-Url: https://codereview.chromium.org/2705533002
Cr-Commit-Position: refs/heads/master@{#43595}
2017-03-03 19:30:40 +00:00
bmeurer
9ef1e35bc6 [turbofan] Drop obsolete unused JSStrictNotEqual operator.
We don't need the JSStrictNotEqual operator in the compiler, because
this is never generated by the BytecodeGraphBuilder, and the code in
the AstGraphBuilder was dead code. Also remove the backing builtin
StrictNotEqual.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2727003006
Cr-Commit-Position: refs/heads/master@{#43594}
2017-03-03 17:59:21 +00:00
Ross McIlroy
8ec7144e0f [Compiler] Process multiple jobs in background compiler dispatcher task.
Spinning up a new background task is expensive, and many times an existing
task will finish it's work before a new task starts work on a job, so enable
the existing tasks to do more than one background job.

BUG=v8:5203

Change-Id: Ibbef317c8bb3921c36a096fed88d244716be9c42
Reviewed-on: https://chromium-review.googlesource.com/441706
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43593}
2017-03-03 17:28:39 +00:00
Marja Hölttä
5178fa0e76 [parser] Skipping inner funcs: add tests.
BUG=v8:5516
R=verwaest@chromium.org

Change-Id: Ica04f74788a4812128bce1297aeee23f8c3bec3d
Reviewed-on: https://chromium-review.googlesource.com/449675
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43591}
2017-03-03 15:01:12 +00:00
Peter Marshall
5f79c9231a [builtins] Ensure length is within Smi range in TypedArray constructor.
The callsite in ConstructByArrayBuffer could have a length that is
above Smi range if the buffer had such a length. Check this before
calling. Add a test too.

BUG=v8:5977, chromium:698201

Change-Id: Ic22046a31607f1f85642c8caf7f5ed064edb3110
Reviewed-on: https://chromium-review.googlesource.com/449813
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43589}
2017-03-03 14:42:34 +00:00
tebbi
e61ff99104 [turbofan] compute arguments length in deoptimizer
Following the design of https://codereview.chromium.org/2692753004, also compute the arguments length in the deoptimizer sucht that it does not have to be computed in optimized code.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2729163002
Cr-Commit-Position: refs/heads/master@{#43587}
2017-03-03 13:43:40 +00:00
hpayer
b7944a5cd5 [heap] Remove Marking::AnyToGrey and change its callers to use simple marking functions.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2728113002
Cr-Commit-Position: refs/heads/master@{#43586}
2017-03-03 13:31:52 +00:00
clemensh
eb36a7dbcf [wasm] Fix importing wasm functions which are being debugged
If the imported wasm function is being debugged (i.e. redirects to the
interpreter), call it via the JS_TO_WASM stub, such that we can disable
the breakpoint later by patching the exported function.

This also contains a drive-by fix in wasm-translation.cc (for the case
that all known positions are bigger than the requested one).

R=titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5971, v8:5822

Review-Url: https://codereview.chromium.org/2720813002
Cr-Commit-Position: refs/heads/master@{#43583}
2017-03-03 12:38:41 +00:00
Peter Marshall
1a6487fd65 Fix incorrect side-effect ordering in TypedArray constructor.
We should throw a RangeError for offset % elementSize before
length.toPrimitive is observable. Adds a test that checks this, too.

BUG=v8:6037

Change-Id: Ie9f2551c8e8fb0018b508762ac93cdc470e15dde
Reviewed-on: https://chromium-review.googlesource.com/449792
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43582}
2017-03-03 12:34:55 +00:00
clemensh
7f68cbbffa [wasm] Prepare WasmCompilationUnit for lazy compilation
In lazy compilation, we only compile one function at a time, and we
might not have the wire bytes of the whole module available.
This CL prepares the WasmCompilationUnit for this setting.
It will also be helpful for streaming compilation.

Also, the ErrorThrower (which might heap-allocate) is not stored in the
WasmCompilationUnit any more. Instead, it is passed to the
FinishCompilation method which is allowed to heap-allocate.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5991

Review-Url: https://codereview.chromium.org/2726553003
Cr-Commit-Position: refs/heads/master@{#43573}
2017-03-03 09:47:39 +00:00
bmeurer
de52562d8e [turbofan] Introduce dedicated ObjectIsNaN operator.
We can compile a !== a and Number.isNaN(a) to ObjectIsNaN. The former is
commonly used to check for NaN, i.e. in case of equals in AngularJS.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2722483003
Cr-Commit-Position: refs/heads/master@{#43572}
2017-03-03 09:08:14 +00:00
kozyatinskiy
0832bae354 [inspector] fixed endLine in Debugger.scriptParsed event
BUG=chromium:698077
R=lushnikov@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2730813002
Cr-Commit-Position: refs/heads/master@{#43567}
2017-03-03 06:58:11 +00:00
loorongjie
dbac977011 Reland Migrate Object.prototype.valueOf to CSA
Original issue: https://codereview.chromium.org/2724833002/

BUG=v8:6005
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel
R=bmeurer@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2725053007
Cr-Commit-Position: refs/heads/master@{#43566}
2017-03-03 06:30:26 +00:00
aseemgarg
8b130a8495 [wasm] Implement simd lowering for F32x4 and I32x4 compare ops
R=bbudge@chromium.org,titzer@chromium.org,gdeepti@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2728823005
Cr-Commit-Position: refs/heads/master@{#43562}
2017-03-03 02:31:44 +00:00
aseemgarg
81ad6b521f [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions
This fixes and relands https://codereview.chromium.org/2718323003.

R=bbudge@chromium.org,titzer@chromium.org,ahaas@chromium.org,machenbach@chromium.org,bradnelson@chromium.org
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2724973003
Cr-Commit-Position: refs/heads/master@{#43561}
2017-03-03 02:04:07 +00:00
Adam Klein
fb16583179 Retain source order when hoisting sloppy block functions
This involved adding a count_ member to SloppyBlockFunctionMap, so
to avoid making DeclarationScope larger, this patch makes the
creation of the map lazy, thus reducing the size of DeclarationScope
by several words in the process.

BUG=chromium:688567

Change-Id: If9a9eb2ccc01690fe10edadb3aa9625454ff4a19
Reviewed-on: https://chromium-review.googlesource.com/448701
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43558}
2017-03-02 21:06:00 +00:00
bbudge
386e5a1149 Implement remaining Boolean SIMD operations on ARM.
- Implements Select instructions using a single ARM vbsl instruction.
- Renames boolean machine operators to match renamed S1xN machine types.
- Implements S1xN vector logical ops, AND, OR, XOR, NOT for ARM.
- Implements S1xN AnyTrue, AllTrue ops for ARM.
- Eliminates unused SIMD op categories in opcodes.h.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2711863002
Cr-Commit-Position: refs/heads/master@{#43556}
2017-03-02 19:50:33 +00:00
ahaas
91cd070769 [arm64][turbofan] Tst instructions can have a shifted operand.
This CL fixes a bug in the implementation of the code generation of
kArm64Tst32, where the shift input operand of kArm64Tst32 was ignored.
Please take a special look at the fix in kArm64Tst. I applied the fix
there as well, but because of differences in the instruction selector
I was not able to write a test for it.

R=v8-arm-ports@googlegroups.com
BUG=v8:6028

Review-Url: https://codereview.chromium.org/2729853003
Cr-Commit-Position: refs/heads/master@{#43555}
2017-03-02 19:46:09 +00:00
Michael Lippautz
78867ad870 Remove object grouping
Enbedders should switch to EmbedderHeapTracer API.

BUG=v8:5828

Change-Id: I82f2bc583d246617865a17f5904e02cd35f92fec
Reviewed-on: https://chromium-review.googlesource.com/448539
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43551}
2017-03-02 17:53:07 +00:00
ulan
2e00025038 [inspector] Enable debugger/pause-on-oom test with larger heap limit.
BUG=v8:6018

Review-Url: https://codereview.chromium.org/2729843002
Cr-Commit-Position: refs/heads/master@{#43550}
2017-03-02 17:49:15 +00:00
Peter Marshall
ff8b1abb1a [builtins] Reland of Port TypedArrayInitialize to CodeStubAssembler.
Turbofan is a lot slower than Crankshaft at constructing TypedArrays,
because we always go to the C++ builtin. Port the builtin to CSA
to improve performance, and to clean up the implementation, which is
split across multiple files and pieces at the moment.

This CL increases the performance with --future to roughly the same
as with crankshaft.

BUG=v8:5977

Change-Id: Id0d91a4592de41a3a308846d79bd44a608931762
Reviewed-on: https://chromium-review.googlesource.com/448537
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43548}
2017-03-02 14:31:18 +00:00
machenbach
d7cb3cfc91 Revert of Migrate Object.prototype.valueOf to CSA (patchset #4 id:80001 of https://codereview.chromium.org/2724833002/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13900

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Migrate Object.prototype.valueOf to CSA
>
> BUG=v8:6005
>
> Review-Url: https://codereview.chromium.org/2724833002
> Cr-Commit-Position: refs/heads/master@{#43539}
> Committed: f93b27e639

TBR=bmeurer@chromium.org,yangguo@chromium.org,loorongjie@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6005

Review-Url: https://codereview.chromium.org/2730573004
Cr-Commit-Position: refs/heads/master@{#43547}
2017-03-02 14:26:45 +00:00
loorongjie
f93b27e639 Migrate Object.prototype.valueOf to CSA
BUG=v8:6005

Review-Url: https://codereview.chromium.org/2724833002
Cr-Commit-Position: refs/heads/master@{#43539}
2017-03-02 12:57:21 +00:00
clemensh
fa8dba0e86 [wasm] Several unrelated cleanups
Most are minor performance optimizations that aggregated while implementing
other changes. Those fixes will probably not be visible in perf graphs, but
they bothered me anyway.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2714373003
Cr-Commit-Position: refs/heads/master@{#43535}
2017-03-02 10:42:22 +00:00
bbudge
f3d26d3d55 [WASM] Fix failing Wasm SIMD F32x4 tests.
- Perform lane checks using FP compare instead of reinterpret casts. 0 and -0
will be different under I32 compare.
- Some arithmetic operations can generate NaN results, such as adding -Inf
and +Inf. Skip these tests until we have a way to do more sophisticated
FP comparisons in the SIMD tests.
- Eliminate a redundant F32x4 parameter for FP SIMD vector checking. We will only have this one FP type.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2594043002
Cr-Original-Commit-Position: refs/heads/master@{#42154}
Committed: 5560bbb498
Review-Url: https://codereview.chromium.org/2594043002
Cr-Commit-Position: refs/heads/master@{#43528}
2017-03-01 23:31:47 +00:00
Marja Hölttä
12c2c15310 [parser] Skipping inner funcs: arrow functions now work too.
BUG=v8:5516
R=verwaest@chromium.org

Change-Id: I1bb88e981b81fec85ba6da314e3be927085e6e76
Reviewed-on: https://chromium-review.googlesource.com/447438
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43526}
2017-03-01 20:21:06 +00:00
bmeurer
0b3e554e03 Revert of [wasm] Initial signal handler (patchset #56 id:1090001 of https://codereview.chromium.org/2371833007/ )
Reason for revert:
Breaks tree, i.e. https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/18928/steps/Check/logs/grow-memory

Original issue's description:
> [wasm] Initial signal handler
>
> This is basically the minimum viable signal handler for Wasm bounds checks.
> It includes the TLS check and the fine grained instructions checks. These
> two checks provide most of the safety for the signal handler. Future CLs will
> add code range and data range checks for more robustness.
>
> The trap handling code and data structures are all in src/trap-handler, with
> the code that actually runs in the signal handler confined to
> src/trap-handler/signal-handler.cc.
>
> This changes adds a new V8 API that the embedder should call from a signal
> handler that will give V8 the chance to handle the fault first. For hosts that
> do not want to implement their own signal handler, we include the option to
> install a simple one. This simple handler is also used for the tests.
>
> When a Wasm module is instantiated, information about each function is passed
> to the trap handler, which is used to classify faults. These are removed during
> the instance finalizer.
>
> Several future enhancements are planned before turning this on by default.
> Obviously, the additional checks will be added to MaybeHandleFault. We are
> also planning to add a two-level CodeObjectData table that is grouped by
> isolates to make cleanup easier and also reduce potential for contending on
> a single data structure.
>
> BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277
>
> Review-Url: https://codereview.chromium.org/2371833007
> Cr-Commit-Position: refs/heads/master@{#43523}
> Committed: a5af7fe9ee

TBR=ahaas@chromium.org,bradnelson@google.com,hpayer@chromium.org,jochen@chromium.org,mark@chromium.org,mseaborn@chromium.org,titzer@chromium.org,eholk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2723133003
Cr-Commit-Position: refs/heads/master@{#43525}
2017-03-01 19:47:27 +00:00
eholk
a5af7fe9ee [wasm] Initial signal handler
This is basically the minimum viable signal handler for Wasm bounds checks.
It includes the TLS check and the fine grained instructions checks. These
two checks provide most of the safety for the signal handler. Future CLs will
add code range and data range checks for more robustness.

The trap handling code and data structures are all in src/trap-handler, with
the code that actually runs in the signal handler confined to
src/trap-handler/signal-handler.cc.

This changes adds a new V8 API that the embedder should call from a signal
handler that will give V8 the chance to handle the fault first. For hosts that
do not want to implement their own signal handler, we include the option to
install a simple one. This simple handler is also used for the tests.

When a Wasm module is instantiated, information about each function is passed
to the trap handler, which is used to classify faults. These are removed during
the instance finalizer.

Several future enhancements are planned before turning this on by default.
Obviously, the additional checks will be added to MaybeHandleFault. We are
also planning to add a two-level CodeObjectData table that is grouped by
isolates to make cleanup easier and also reduce potential for contending on
a single data structure.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2371833007
Cr-Commit-Position: refs/heads/master@{#43523}
2017-03-01 18:02:13 +00:00
Eric Holk
d6808c0f9c [wasm] compile fuzzer: initialize temporary before filling.
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=697191

Change-Id: I01ddd6824b1a79d86944ac766f5c2070e9b0c244
Reviewed-on: https://chromium-review.googlesource.com/448317
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43522}
2017-03-01 17:33:29 +00:00
Peter Marshall
a8e15e8fc5 Revert "[builtins] Port TypedArrayInitialize to CodeStubAssembler."
This reverts commit b23b2c107b.

Reason for revert: Makes Linux debug bot sad

Original change's description:
> [builtins] Port TypedArrayInitialize to CodeStubAssembler.
> 
> Turbofan is a lot slower than Crankshaft at constructing TypedArrays,
> because we always go to the C++ builtin. Port the builtin to CSA
> to improve performance, and to clean up the implementation, which is
> split across multiple files and pieces at the moment.
> 
> This CL increases the performance with --future to roughly the same
> as with crankshaft.
> 
> BUG=v8:5977
> 
> Change-Id: I5a4c4b544a735a56290b85bf33c2f3718df7e2b8
> Reviewed-on: https://chromium-review.googlesource.com/445717
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43518}

TBR=cbruni@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5977

Change-Id: I5d5bc8b4677a405c716d78e688af80ae9c737b4a
Reviewed-on: https://chromium-review.googlesource.com/448558
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43520}
2017-03-01 15:55:51 +00:00
hpayer
c45d065edc [heap] Remove Marking::MarkBlack and some minor cleanups.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2720133005
Cr-Commit-Position: refs/heads/master@{#43519}
2017-03-01 14:53:20 +00:00
Peter Marshall
b23b2c107b [builtins] Port TypedArrayInitialize to CodeStubAssembler.
Turbofan is a lot slower than Crankshaft at constructing TypedArrays,
because we always go to the C++ builtin. Port the builtin to CSA
to improve performance, and to clean up the implementation, which is
split across multiple files and pieces at the moment.

This CL increases the performance with --future to roughly the same
as with crankshaft.

BUG=v8:5977

Change-Id: I5a4c4b544a735a56290b85bf33c2f3718df7e2b8
Reviewed-on: https://chromium-review.googlesource.com/445717
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43518}
2017-03-01 14:28:23 +00:00
Michael Starzinger
6ec735e08b [compiler] Fix {UseTurboFan} for disabled optimization.
This fixes a corner-case in the above predicate that was introduced to
allow fully disabling optimization using %NeverOptimizeFunction. This
property of a function is a transient property (i.e. changes over time),
whereas {UseTurboFan} is designed to be a static property (i.e. gives
same answer over time). Violating this led to cases where functions got
optimization disabled for other reasons would suddenly be baselined.
The correct place to check transient properties is when optimization is
requested.

R=jarin@chromium.org
TEST=mjsunit/never-baseline

Change-Id: I37eb0c70d2b39704be29fd4bda76975bfbede66b
Reviewed-on: https://chromium-review.googlesource.com/447937
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43514}
2017-03-01 12:53:59 +00:00
Andreas Haas
c77622318d [runtime] Fix flattening of ConsStrings with empty first parts.
String::SlowFlatten assumed that ConsStrings with empty first parts have
flattened strings as their second part. TurboFan, however, can create
ConsStrings with empty first parts and arbitrary second parts. With
this CL we call String::Flatten on the second part of a ConsString if
the first part is empty, but only when String::Flatten would not call
String::SlowFlatten.

R=jkummerow@chromium.org

BUG=chromium:696651

Change-Id: I9acb681de1be695e1ec2f6f6d28b9e4dc4344e98
Reviewed-on: https://chromium-review.googlesource.com/448457
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43513}
2017-03-01 12:50:32 +00:00
machenbach
88c240bda5 Revert of [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions (patchset #2 id:20001 of https://codereview.chromium.org/2718323003/ )
Reason for revert:
breaks nosse4:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/13871

Original issue's description:
> [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions
>
> BUG=v8:4124
> R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org
>
> Review-Url: https://codereview.chromium.org/2718323003
> Cr-Commit-Position: refs/heads/master@{#43510}
> Committed: f75748cf4c

TBR=bbudge@chromium.org,bradnelson@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org,aseemgarg@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2723943003
Cr-Commit-Position: refs/heads/master@{#43512}
2017-03-01 12:39:48 +00:00
Ilija.Pavlovic
d0e1de1705 Fix unused lambda captures for big endian targets.
This CL fixes unused lambda captures for big endian targets when Clang
is used for build V8.

TEST=
BUG=

Review-Url: https://codereview.chromium.org/2725613002
Cr-Commit-Position: refs/heads/master@{#43511}
2017-03-01 12:16:09 +00:00
aseemgarg
f75748cf4c [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2718323003
Cr-Commit-Position: refs/heads/master@{#43510}
2017-03-01 11:39:10 +00:00
aseemgarg
a727f9e8c0 [wasm]implement simd lowering for simple F32x4 and I32x4 unops
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2726453003
Cr-Commit-Position: refs/heads/master@{#43509}
2017-03-01 11:13:00 +00:00
Igor Sheludko
e003d21d4a [runtime] Properly handle null constructor case when feeding back normalization.
BUG=chromium:697017

Change-Id: Ibb7165387a983987dcd04be330591b6bb70ff991
Reviewed-on: https://chromium-review.googlesource.com/448217
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43507}
2017-03-01 10:02:14 +00:00
Georg Neis
78d9d5b51a [ast] Fix bug in deserialization of catch scopes.
The maybe-assigned flag of the catch variable was not preserved.

BUG=v8:5636,chromium:696332

Change-Id: I9c55e1b1312bdebc53bc45bc3ca1c982bdbe9846
Reviewed-on: https://chromium-review.googlesource.com/447680
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43506}
2017-03-01 08:45:46 +00:00
aseemgarg
e6b9f07d43 [wasm]disable F32x4 and I32x4 cross ops test for arm as they break chromebook build
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2723823002
Cr-Commit-Position: refs/heads/master@{#43504}
2017-02-28 21:53:05 +00:00
kozyatinskiy
9c385f0405 [inspector] added reconnect method for tests
This method enables test of agent::restore methods.
Bonus: forbid setCustomObjectFormatterEnabled on disabled agent.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2713023004
Cr-Commit-Position: refs/heads/master@{#43502}
2017-02-28 20:22:24 +00:00
Georg Neis
1c578f2477 Fix completion value of class declarations.
BUG=v8:6022

Change-Id: I54205cb3ecc2dd31ed62e55726f0ec5fcd202c30
Reviewed-on: https://chromium-review.googlesource.com/446349
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43500}
2017-02-28 19:36:45 +00:00
Adam Klein
fc023664bd Accurately record eval calls in arrow parameter lists
Previously, we over-approximated Scope::scope_calls_eval_ in
arrow functions: if either the outer scope or the arrow function
parameters had a direct eval call, we marked both scopes as calling
eval. This over-approximation kept getting us into trouble, though,
especially when eager or lazy parsing would disagree about the
"calls eval" bit.

This patch instead tracks eval calls accurately, using a boolean on
Scope::Snapshot that is reset as appropriately depending on whether
a particular AssignmentExpression turned out to be an arrow parameter
list or not.

BUG=chromium:691687

Change-Id: I527dc59b4d32a2797805ff26dc9f70b1311377b2
Reviewed-on: https://chromium-review.googlesource.com/446094
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43499}
2017-02-28 19:15:09 +00:00
Georg Neis
ae66dcbec0 [modules] Make Module::Evaluate return the completion value.
This is more useful than always returning undefined.

BUG=v8:1569,v8:5978

Change-Id: Id10cf87f7865db1a85de412460eaead4e4bf3b62
Reviewed-on: https://chromium-review.googlesource.com/446846
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43498}
2017-02-28 19:02:32 +00:00
Georg Neis
59c9e6ff69 [modules] Fix bug in Module::Instantiate.
The order in which things were done wasn't quite correct and lead
to wrong behaviour for certain circular module graphs.

BUG=v8:1569,chromium:694566

Change-Id: I291186e261268c853a30ad891ff362904e0b28ef
Reviewed-on: https://chromium-review.googlesource.com/447399
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43497}
2017-02-28 19:00:58 +00:00
yangguo
a813525a07 [regexp] fix /\W/ui wrt \u017f and \u212a.
R=jgruber@chromium.org
BUG=v8:5080

Review-Url: https://codereview.chromium.org/2725583002
Cr-Commit-Position: refs/heads/master@{#43496}
2017-02-28 18:28:42 +00:00
Igor Sheludko
1c7f83980e [runtime] Mark old JSGlobalProxy's map as unstable when an iframe navigates away.
This CL also introduces Realm.navigate(i).

BUG=chromium:683667

Change-Id: I9227292ea3a575f34367e82fc6297d234d3eecae
Reviewed-on: https://chromium-review.googlesource.com/447638
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43494}
2017-02-28 17:05:51 +00:00
kozyatinskiy
497dff7809 [inspector] restore provisional breakpoints smarter
For breakpoints which are set by setBreakpointByUrl(url:..) backend calculates source hint on first related breakpoints resolved event and then uses this hint to adjust breakpoint position in later arrived scripts with the same url or on page reload.

Doc: https://docs.google.com/a/google.com/document/d/1VtWo_-jelzEXSNbjESGTtruZngzXgbHLexfTzxNlnjE/edit?usp=sharing

BUG=chromium:688776
R=pfeldman@chromium.org, alph@chromium.org

Review-Url: https://codereview.chromium.org/2671193002
Cr-Commit-Position: refs/heads/master@{#43493}
2017-02-28 16:14:27 +00:00
mvstanton
bfa425cc08 Remove shared-function-tier-up-default.js
It tests a pipeline configuration we are removing.

BUG=v8:5778

Review-Url: https://codereview.chromium.org/2715153005
Cr-Commit-Position: refs/heads/master@{#43491}
2017-02-28 15:31:08 +00:00
Marja Hölttä
14ac291a03 [parser] Skipping inner funcs: simplify rest parameter handling.
With the params (a, b, ...c) the param / variable declaration order used to be
"temp, temp, c, a, b". Now it is "temp, temp, a, b, c" as you'd expect. This
makes it easier for PreParser to match the parameter order of Parser.

R=verwaest@chromium.org
BUG=v8:5516

Change-Id: I79da04ef3f812bf52c032bed6263c009fecb7988
Reviewed-on: https://chromium-review.googlesource.com/447677
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43490}
2017-02-28 15:08:31 +00:00
machenbach
a6b20adbf9 Revert of Add several SIMD opcodes to IA32 (patchset #9 id:160001 of https://codereview.chromium.org/2695613004/ )
Reason for revert:
Fails with nosse4:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/13853

Original issue's description:
> Add several SIMD opcodes to IA32
>
> CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
> Int32x4Add, Int32x4Sub
>
> Also add paddd and psubd to ia32-assembler
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2695613004
> Cr-Commit-Position: refs/heads/master@{#43483}
> Committed: 4deb9ffdec

TBR=bbudge@chromium.org,gdeepti@chromium.org,bmeurer@chromium.org,jing.bao@intel.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2717423003
Cr-Commit-Position: refs/heads/master@{#43489}
2017-02-28 14:54:28 +00:00
littledan
a48d7ce226 Reland of [test] Speculatively remove local-tests from archive (patchset #1 id:1 of https://codereview.chromium.org/2640223003/ )
Reason for revert:
With the Windows bots fixed in https://chromium-review.googlesource.com/445786 , this should be good to reland. Thanks, Michael!

Original issue's description:
> Revert of [test] Speculatively remove local-tests from archive (patchset #2 id:20001 of https://codereview.chromium.org/2643983002/ )
>
> Reason for revert:
> Breaks all windows bots:
> https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/6811
>
> Original issue's description:
> > [test] Remove local-tests from test262 archive and add to .isolate
> >
> > This might help fix the bots, which are broken in e.g.,
> > https://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/builds/14011
> >
> > The archive was added in order to transmit test262 tests more rapidly.
> > It doesn't serve much of a purpose for local-tests. I naively added
> > local-tests there out of symmetry. However, the BUILD.gn file does not
> > regenerate an archive when files are only deleted and not added or
> > changed. Since the performance concern is not present for the small
> > volume of local-tests, this patch reverts to the more normal mechanism
> > for sending over dependencies, with test262.isolate.
> >
> > R=adamk
> >
> > Review-Url: https://codereview.chromium.org/2643983002
> > Cr-Commit-Position: refs/heads/master@{#42485}
> > Committed: 9f545ea96f
>
> TBR=adamk@chromium.org,littledan@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2640223003
> Cr-Commit-Position: refs/heads/master@{#42491}
> Committed: 4ffe0850db

TBR=adamk@chromium.org,machenbach@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2725643002
Cr-Commit-Position: refs/heads/master@{#43488}
2017-02-28 14:43:15 +00:00
yangguo
a35616e324 [debug] add more tests for side-effect free debug-evaluate.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2720013003
Cr-Commit-Position: refs/heads/master@{#43487}
2017-02-28 14:23:09 +00:00
yangguo
a5dfa06213 [unibrow] remove mongolian vowel separator as white space.
Unibrow is currently at Unicode version 7.0.0, which does not
include mongolian vowel separator (\u180E) as white space. In
order to appease test262 at the time however we kept it as a
whitespace.

Test262 has since then been updated. And while this is not an
update of unibrow, we are removing \u180E as white space here.

R=jshin@chromium.org, littledan@chromium.org
BUG=v8:5155

Review-Url: https://codereview.chromium.org/2720953003
Cr-Commit-Position: refs/heads/master@{#43485}
2017-02-28 13:42:29 +00:00
jing.bao
4deb9ffdec Add several SIMD opcodes to IA32
CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
Int32x4Add, Int32x4Sub

Also add paddd and psubd to ia32-assembler

BUG=

Review-Url: https://codereview.chromium.org/2695613004
Cr-Commit-Position: refs/heads/master@{#43483}
2017-02-28 13:35:22 +00:00
Michael Achenbach
63afdb0075 [test] Work-around for checking test262 archives on bots
This relaxes the check if the test262 archive should be unpacked or not.
A bug in the swarming isolate processor for windows makes the old check for the data directory pass and not unpack.
With this work-around we actually start running tests on windows.

This also fixes the regexp for exception extraction and handles the windows drive letter.
It also strips whitespace to fix a case where a carriage return was included on windows.

BUG=v8:5872

Change-Id: I363925665b0bad7530a1f93a2ea8f39b056d4174
Reviewed-on: https://chromium-review.googlesource.com/445786
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43482}
2017-02-28 13:33:13 +00:00
Marja Hölttä
fc8922e448 [iwyu|arm] Pre-work for removing unallowed include macro-assembler.h -> assembler-inl.h
The x64 side is included in https://chromium-review.googlesource.com/c/444226/

BUG=v8:5294

Change-Id: Ie255604c5e38c72e3c2b76e1ca3557a5fde108ee
Reviewed-on: https://chromium-review.googlesource.com/446394
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43481}
2017-02-28 13:31:30 +00:00
Michael Starzinger
08d84f6d23 [string] Fix error message in String.prototype.repeat.
R=yangguo@chromium.org
TEST=message/regress/regress-crbug-691194
BUG=chromium:691194

Change-Id: I72198e087f88abf89cdd38b99c19e10cbebda08d
Reviewed-on: https://chromium-review.googlesource.com/445942
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43480}
2017-02-28 12:48:39 +00:00
Michael Starzinger
09a07038f2 [turbofan] Fix lowering of %_GetSuperConstructor intrinsic.
The above intrinsic by now has to perform a check whether the prototype
of a derived constructor is actually a constructor function itself. This
is done as part of the {JSGetConstructorCall} operator. The intrinsic
should just reduce down to the operator to maintain correct semantics.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-696622
BUG=chromium:696622

Change-Id: Ia19c188f17ad16b12248db1f01a01b8d7258499b
Reviewed-on: https://chromium-review.googlesource.com/447716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43479}
2017-02-28 12:47:37 +00:00
tebbi
9881b6c740 [turbofan] extend escape analysis to reduce CheckMaps
R=bmeurer@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2680973013
Cr-Original-Commit-Position: refs/heads/master@{#43163}
Committed: f01c8a6e4b
Review-Url: https://codereview.chromium.org/2680973013
Cr-Commit-Position: refs/heads/master@{#43478}
2017-02-28 12:44:01 +00:00
jarin
3c36aacc87 [turbofan] Fix handling of typed array loads in load elimination.
BUG=chromium:694088

Review-Url: https://codereview.chromium.org/2725593002
Cr-Commit-Position: refs/heads/master@{#43477}
2017-02-28 12:20:19 +00:00
tebbi
7467f16d73 [turbofan] escape analysis supports arguments object and rest elements
The new NewUnmappedArgumentsElements node now takes two inputs:
- the frame holding the arguments (current frame or arguments adaptor frame)
- the length of the suffix of passed arguments to be copied into the backing store

These inputs are computed with two new node types:
ArgumentsFrame()
ArgumentsLength[formal_parameter_count,is_rest_length](Node* arguments_frame)
The node type NewRestParameterElements can now be expressed with NewUnmappedArgumentsElements and an appropriate length and is thus not needed anymore.

In escape analysis, we lower loads from the length field of NewUnmappedArgumentsElements with its length input and if we find out that no write access to the arguments elements exists, we replace element loads with direct stack access and replace the NewUnmappedArgumentsElements node with a node of the new node type ArgumentsElementsState. This corresponds to an ObjectState node and gets translated into a deoptimizer instruction to allocate the backing store. Together with the already existing deoptimizer support for the actual arguments object/rest parameters, this allows to remove all allocations for arguments objects/rest parameters in this case.
In the deoptimizer, we read the actual parameters from the stack while transforming the static deopt info into TranslatedValue objects.

If escape analysis cannot remove the backing store allocation, NewUnmappedArgumentsElements gets lo

BUG=v8:5726

Review-Url: https://codereview.chromium.org/2692753004
Cr-Commit-Position: refs/heads/master@{#43475}
2017-02-28 11:16:27 +00:00
Michael Starzinger
4d7e7acdf2 Fix test to not teach ClusterFuzz ugly tricks.
R=bradnelson@chromium.org
TEST=mjsunit/wasm/asm-with-wasm-off
BUG=chromium:696655

Change-Id: I9375d8ac2f111009233dc480529fd0f0e00fe811
Reviewed-on: https://chromium-review.googlesource.com/447398
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43472}
2017-02-28 10:25:50 +00:00
yangguo
7c39a838ba [debugger] add more tests to side-effect free debug evaluate.
Add tests for local variables in function scopes and async features.

R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2707043003
Cr-Commit-Position: refs/heads/master@{#43468}
2017-02-28 08:20:00 +00:00
aseemgarg
048a0a13e7 Revert "Revert of [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator (patchset #8 id:140001 of https://codereview.chromium.org/2711473002/ )"
This reverts commit 2362f869a4.

BUG=v8:4614

Review-Url: https://codereview.chromium.org/2720133004
Cr-Commit-Position: refs/heads/master@{#43467}
2017-02-28 03:31:39 +00:00
jbroman
6543519977 ValueSerializer: Add an explicit tag for host objects.
This makes it no longer necessary to ensure that V8 and Blink have non-colliding
tags, which makes it easier for them to evolve independently, and also makes
the wire format more suitable for other V8 embedders, who would not
necessarily be surveyed before V8 introduced a new tag that might collide
with theirs.

BUG=chromium:686159

Review-Url: https://codereview.chromium.org/2709023003
Cr-Commit-Position: refs/heads/master@{#43466}
2017-02-28 02:16:30 +00:00
aseemgarg
7f5701507d [wasm]implement simd lowering for F32x4 and I32x4 binops
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2713613005
Cr-Commit-Position: refs/heads/master@{#43465}
2017-02-27 23:45:03 +00:00
littledan
2362f869a4 Revert of [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator (patchset #8 id:140001 of https://codereview.chromium.org/2711473002/ )
Reason for revert:
The tree is closed due to an msan violation (use of uninitialized value) in the arm64 simulator soon after this patch landed; this seems related

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/13607/steps/Check/logs/simulator_invalidate_..

Original issue's description:
> [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator
>
> BUG=v8:4614
> R=binji@chromium.org
>
> Review-Url: https://codereview.chromium.org/2711473002
> Cr-Commit-Position: refs/heads/master@{#43461}
> Committed: a2a2c1b9ee

TBR=binji@chromium.org,jarin@chromium.org,jacob.bramley@arm.com,aseemgarg@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review-Url: https://codereview.chromium.org/2720133003
Cr-Commit-Position: refs/heads/master@{#43463}
2017-02-27 22:47:14 +00:00
binji
5a04f4fd68 This is a speculative chain of reverts to improve a Chrome
perf regression. See crbug.com/695653 for more info.

Revert "[SAB] Move Atomics builtins to C++"

This reverts commit 2b9840d86f.

Revert "[SAB] Remove unreachable Uint8Clamped atomics paths"

This reverts commit d1160fb14f.

Revert "Remove tiny unit test for MinSimple/MaxSimple"

This reverts commit 837760ecb7.

Revert "Remove infrastructure for experimental JS natives"

This reverts commit 8cfe45b6f1.

BUG=695653
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2715223003
Cr-Commit-Position: refs/heads/master@{#43462}
2017-02-27 22:26:27 +00:00
aseemgarg
a2a2c1b9ee [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator
BUG=v8:4614
R=binji@chromium.org

Review-Url: https://codereview.chromium.org/2711473002
Cr-Commit-Position: refs/heads/master@{#43461}
2017-02-27 22:12:17 +00:00
Eric Holk
f348e573c0 [wasm] Update JS API tests to version 1
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=694954

Change-Id: I07d7eeccca716028e1151db3df7ebee81d4a9ef2
Reviewed-on: https://chromium-review.googlesource.com/446707
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43460}
2017-02-27 21:27:09 +00:00
kozyatinskiy
bbeb6dc15d [inspector] added master test for break locations
BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2710903003
Cr-Commit-Position: refs/heads/master@{#43459}
2017-02-27 20:20:39 +00:00
kozyatinskiy
c63e83c1e9 [inspector] added step-into test to cover most stepInto cases
This test helps to prevent regressions during work on new break locations.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2719763002
Cr-Commit-Position: refs/heads/master@{#43458}
2017-02-27 18:58:55 +00:00
kozyatinskiy
4d7fa10c2b [inspector] added restrictToFunction flag for getPossibleBreakpoints
BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2710953004
Cr-Commit-Position: refs/heads/master@{#43457}
2017-02-27 16:53:03 +00:00
Toon Verwaest
0e21a147db [runtime] Feed back normalization to constructors (behind flag)
When an instance of a constructor goes dictionary mode, this changes the initial map
of that constructor to also be in dictionary mode. This avoids spurious hidden class
creation, that also results in IC misses.

BUG=

Change-Id: I0e70f822ac345d0224f2092ec473621a603d4cc5
Reviewed-on: https://chromium-review.googlesource.com/446361
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43452}
2017-02-27 13:56:14 +00:00
Igor Sheludko
9760851789 [ic] KeyedStoreIC should use a slow stub when a prototype chain contains dictionary elements.
BUG=chromium:688734

Change-Id: If5dd370971cb02c4463fa20a489d0fa60b0423c4
Reviewed-on: https://chromium-review.googlesource.com/446845
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43451}
2017-02-27 13:41:11 +00:00
Michael Starzinger
0a3060fa59 [turbofan] Extend typer for number comparison ops.
This extends the existing typer for JS-level comparisons to also be
applied on simplified-level number comparisons. Now that nodes having
such operators are introduced early during graph construction, precise
type information has become more important.

R=jarin@chromium.org
TEST=unittests/TyperTest

Change-Id: Ibcfda36cadf72381b3c63138dd8ad2f6b1f7fbba
Reviewed-on: https://chromium-review.googlesource.com/445879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43447}
2017-02-27 12:11:38 +00:00
Choongwoo Han
cd3a76d56f [typedarrays] Fix Out of Bound Access in TypedArraySortFast
Compare function for std::sort should satisfy strict weak ordering
relation.

BUG=chromium:696251

Change-Id: I1c07e3bb1b012fd203bc059a21a75ae0fc61f5ac
Reviewed-on: https://chromium-review.googlesource.com/447036
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43446}
2017-02-27 11:41:25 +00:00
Michael Starzinger
1ed1622ef2 [turbofan] Remove obsolte value input to {Throw} nodes.
Nodes having the {Throw} operator are just used as terminators for
control-flow leaving the function body with an exception completion,
they turn into basic-block terminators within the schedule. Actually
raising an exception is done solely via runtime calls. Hence {Throw}
nodes no longer need any value input.

R=bmeurer@chromium.org

Change-Id: Id6d8e46b12c4b84f4e7a8ac96623c8efb1f27b26
Reviewed-on: https://chromium-review.googlesource.com/446501
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43445}
2017-02-27 11:23:06 +00:00
Yang Guo
e3ae7ad9c7 [regexp] fix regexp lookbehind with back reference on ARM.
BUG=chromium:695416

Change-Id: Ied3a389d0dfb0132c798bc85e10f7b1fd4432eb4
Reviewed-on: https://chromium-review.googlesource.com/446343
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43435}
2017-02-27 06:29:47 +00:00
kozyatinskiy
64a563c97f [inspector] move coverage related methods to profiler
R=dgozman@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2715833003
Cr-Commit-Position: refs/heads/master@{#43426}
2017-02-25 02:44:56 +00:00
kozyatinskiy
6b7650f039 [inspector] disable debugger/pause-on-oom test before further fix
It looks like https://codereview.chromium.org/2705293004 changes available space in heap on OOM notification and it produces crash on one of the ports try bot [1].
This test should be more reliable.

[1] https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug

BUG=v8:6018
TBR=dgozman@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2714253002
Cr-Commit-Position: refs/heads/master@{#43425}
2017-02-25 00:43:05 +00:00
kozyatinskiy
0ccb028121 [test262] skip two Intl.NumberFormat tests
Currently try bots [1] are failing on these tests and no CLs can be landed to V8. It looks like these tests were added recently.
Based on https://bugs.chromium.org/p/v8/issues/detail?id=6015, it's known issue in V8 implementation, so mark them as needs investigation.

[1] https://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng_triggered/builds/16490/steps/Test262%20-%20no%20variants

BUG=v8:6015,v8:6016
TBR=adamk@chromium.org,littledan@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2717773002
Cr-Commit-Position: refs/heads/master@{#43423}
2017-02-24 23:41:23 +00:00
caitp
0423341034 [async-iteration] implement Async-from-Sync Iterator
Introduce a new Object to allow GetIterator("async") to function when the
iterable does not have a Symbol.asyncIterator method.

This patch has been split out from https://codereview.chromium.org/2622833002/
and incorporates test cases.

BUG=v8:5855, v8:4483
R=jgruber@chromium.org, rmcilroy@chromium.org, neis@chromium.org
TBR=hpayer@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2645313003
Cr-Commit-Position: refs/heads/master@{#43419}
2017-02-24 17:48:49 +00:00
adamk
8cfe45b6f1 Remove infrastructure for experimental JS natives
Now that no harmony-flagged features are implemented in experimental
JS, most of this is simply dead code.

As PostExperimentals() is no longer needed, I also removed the use of
Import() in the debug context, allowing the deletion of PostDebug()
along with PostExperimentals(); cleanup code is moved to the
end of PostNatives.

Also gets rid of some longer-dead code in prologue.js related to
TypedArrays, and some duplicate code for setting up SharedArrayBuffer
builtins.

Review-Url: https://codereview.chromium.org/2705293004
Cr-Commit-Position: refs/heads/master@{#43418}
2017-02-24 17:43:28 +00:00
franzih
0ba513f056 [api] Fix DescriptorInterceptor with access check.
The DescriptorInterceptor should intercept all
Object.getOwnPropertyDescriptor calls. This CL fixes
the interceptor's behavior if the iterator state is
ACCESS_CHECK.

BUG=

Review-Url: https://codereview.chromium.org/2707263002
Cr-Commit-Position: refs/heads/master@{#43417}
2017-02-24 16:34:02 +00:00
dcheng
e5f89fa5ae Don't mark remote contexts as callable or constructible.
Marking it as callable makes typeof return 'function' instead of
'object' when invoked on a remote context or object.

BUG=chromium:527190

Review-Url: https://codereview.chromium.org/2715593002
Cr-Commit-Position: refs/heads/master@{#43416}
2017-02-24 16:08:11 +00:00
neis
42ded33b5b [compiler] Speculate a little more in SpeculativeShiftRightLogical.
If the RHS is 0 and we have Smi feedback, speculate that the result (the LHS)
will continue to be in the Unsigned31 range.  This helps us avoid converting
the result to double when merging with Signed32.

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2709423002
Cr-Commit-Position: refs/heads/master@{#43415}
2017-02-24 14:39:38 +00:00
Peter Marshall
45dfd76a9c [Test] Add perf tests for TypedArray constructors.
Adds a perf test for constructing a TypedArray from a regular array,
and from a pre-made ArrayBuffer. Runs both new tests with default and
future configurations for comparison.

BUG=v8:5977

Change-Id: Idd132ca879702c54b2947a0e57ed8fe782f2767f
Reviewed-on: https://chromium-review.googlesource.com/446342
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43412}
2017-02-24 13:06:10 +00:00
Marja Hölttä
6b5ab92315 [parser] Skipping inner funcs: omit uninteresting scopes in the data.
This is also needed so that PreParser doesn't need to gather more data for arrow
function params in order to create the uninteresting varblock scopes matching
the scopes created in Parser::BuildParameterInitializationBlock.

This cancels the changes in https://chromium-review.googlesource.com/c/444747
which make PreParser create uninteresting scopes for the normal (non-arrow)
function "eval in default param" case.

R=vogelheim@chromium.org
BUG=v8:5516

Change-Id: I8957ac0796d8738c63492f7928bca6f00e4b4241
Reviewed-on: https://chromium-review.googlesource.com/446339
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43411}
2017-02-24 12:20:25 +00:00
yangguo
9db139e120 [inspector] fix coverage test flakiness.
TBR=kozyatinskiy@chromium.org
BUG=chromium:695631

Review-Url: https://codereview.chromium.org/2718543005
Cr-Commit-Position: refs/heads/master@{#43406}
2017-02-24 09:17:56 +00:00
shiyu.zhang
bd74f1cf57 [turbofan] Relax limitation for using BaseWithIndexAndDisplacement for load/stores
Enable using BaseWithIndexAndDisplacement addressing mode for an address
used by multiple load/stores. It can reduce one instruction to calculate
the address and one register to store the address.

BUG=

Review-Url: https://codereview.chromium.org/2620293004
Cr-Commit-Position: refs/heads/master@{#43402}
2017-02-24 06:38:14 +00:00
kozyatinskiy
59eb62d483 [inspector] use BREAK_POSITION_ALIGNED for breakpoints
With inline breakpoints DevTools are ready for break position aligned breakpoints instead of statement aligned.

BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2709263002
Cr-Original-Commit-Position: refs/heads/master@{#43385}
Committed: 2fed7a0090
Review-Url: https://codereview.chromium.org/2709263002
Cr-Commit-Position: refs/heads/master@{#43400}
2017-02-24 02:01:26 +00:00
machenbach
bdd23acd92 Revert of [inspector] use BREAK_POSITION_ALIGNED for breakpoints (patchset #7 id:120001 of https://codereview.chromium.org/2709263002/ )
Reason for revert:
breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13747

which blocks rolling. See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [inspector] use BREAK_POSITION_ALIGNED for breakpoints
>
> With inline breakpoints DevTools are ready for break position aligned breakpoints instead of statement aligned.
>
> BUG=chromium:695236
> R=dgozman@chromium.org,yangguo@chromium.org
>
> Review-Url: https://codereview.chromium.org/2709263002
> Cr-Commit-Position: refs/heads/master@{#43385}
> Committed: 2fed7a0090

TBR=dgozman@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:695236

Review-Url: https://codereview.chromium.org/2709313003
Cr-Commit-Position: refs/heads/master@{#43395}
2017-02-23 20:27:08 +00:00
adamk
837760ecb7 Remove tiny unit test for MinSimple/MaxSimple
The source code of those functions is simple a ternary operator, and
the test seems to have been designed as a "regression" test for the
previous implementation (which used a macro, and thus evaluated its
arguments multiple times).

I don't think the test is worth the weight of supporting importing
JS natives from tests.

This patch removes the last test that depends on JS natives.

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2711833002
Cr-Commit-Position: refs/heads/master@{#43394}
2017-02-23 18:19:16 +00:00
adamk
184e80a60d Remove a regression test that depended on utils.ImportNow()
The test itself was for an issue that's handled statically since
https://codereview.chromium.org/1302313013 (we were missing some
instance types in a switch statement).

This leaves us with only a single test that depends on the JS
native import system.

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2707133005
Cr-Commit-Position: refs/heads/master@{#43393}
2017-02-23 17:31:51 +00:00
neis
c0651535d5 [interpreter] Teach --print-bytecode the names of runtime functions and intrinsics.
This changes the bytecode decoder such that --print-bytecode will print

    ... CallRuntime [GeneratorGetResumeMode] ...
    ... InvokeIntrinsic [CreateIterResultObject] ...

instead of

    ... CallRuntime [762] ...
    ... InvokeIntrinsic [2] ...

The printing of CallJSRuntime remains unchanged.

R=gsathya@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2712943002
Cr-Commit-Position: refs/heads/master@{#43391}
2017-02-23 14:25:45 +00:00
Marja Hölttä
2a2fc69221 [parser] Skipping inner funcs: enable more strict mode tests.
Non-simple parameters are only disallowed when a function declares itself
strict, but they're otherwise ok in strict mode.

Enabling these tests will expose more problems when scope data for arrow
functions is tested (in a future CL).

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I839ad37d46305975a56aff20e8ca70505c16bf1d
Reviewed-on: https://chromium-review.googlesource.com/446497
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43389}
2017-02-23 12:53:32 +00:00
Marja Hölttä
83849da70f [iwyu] Pre-work for removing unallowed include macro-assembler.h -> assembler-inl.h
BUG=v8:5294

Change-Id: If45f25aae8de526027b7851cb4efe0ccf4a7c4b1
Reviewed-on: https://chromium-review.googlesource.com/444226
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43388}
2017-02-23 12:10:21 +00:00
kozyatinskiy
2fed7a0090 [inspector] use BREAK_POSITION_ALIGNED for breakpoints
With inline breakpoints DevTools are ready for break position aligned breakpoints instead of statement aligned.

BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2709263002
Cr-Commit-Position: refs/heads/master@{#43385}
2017-02-23 00:05:26 +00:00
bakkot
18e4c46de5 [parser] Lift template literal invalid escape restriction
This implements the proposal at
https://github.com/tc39/proposal-template-literal-revision
staged behind a flag --harmony-template-escapes. The proposal allows
invalid octal, unicode, and hexadecimal escape sequences to appear in
tagged template literals, instead of being a syntax error. These have
a 'cooked' value of 'undefined', but are still accessible through the
'raw' property.

BUG=v8:5546

Review-Url: https://codereview.chromium.org/2665513002
Cr-Commit-Position: refs/heads/master@{#43384}
2017-02-22 21:20:32 +00:00
titzer
6a09a41622 [wasm] Remove support for experimental version 0xD.
R=mtrofin@chromium.org
BUG=chromium:575167,chromium:694657

Review-Url: https://codereview.chromium.org/2709753003
Cr-Original-Commit-Position: refs/heads/master@{#43368}
Committed: c8329253ea
Review-Url: https://codereview.chromium.org/2709753003
Cr-Commit-Position: refs/heads/master@{#43383}
2017-02-22 21:02:39 +00:00
Michael Starzinger
beb94c5e87 [turbofan] Fix Object.prototype.__proto__ getter reduction.
This fixes a corner-case where the call reduction of the aforementioned
getter did not simulate the {ToObject} conversion of the receiver value
as required by the spec. This caused the wrong prototype to be constant
promoted (i.e. {null} instead of wrapper object prototype).

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-694709
BUG=chromium:694709

Change-Id: Idf3a37071949d9ddaf5ef43974570c06fd31c0c9
Reviewed-on: https://chromium-review.googlesource.com/445818
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43376}
2017-02-22 15:07:49 +00:00
machenbach
5004748868 Revert of [wasm] Remove support for experimental version 0xD. (patchset #3 id:40001 of https://codereview.chromium.org/2709753003/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13730

Original issue's description:
> [wasm] Remove support for experimental version 0xD.
>
> R=mtrofin@chromium.org
> BUG=chromium:575167,chromium:694657
>
> Review-Url: https://codereview.chromium.org/2709753003
> Cr-Commit-Position: refs/heads/master@{#43368}
> Committed: c8329253ea

TBR=ahaas@chromium.org,mtrofin@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167,chromium:694657

Review-Url: https://codereview.chromium.org/2706303004
Cr-Commit-Position: refs/heads/master@{#43373}
2017-02-22 13:59:23 +00:00
Ross McIlroy
38262dde22 Revert "[Compiler] Use IdentityMap to store jobs in CompilerDispatcher."
This reverts commit 087e95ba63.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [Compiler] Use IdentityMap to store jobs in CompilerDispatcher.
> 
> Stores jobs in an IdentityMap keyed by their SharedFunctionInfo to enable
> fast checking of whether a job is enqueued.
> 
> BUG=v8:5203
> 
> Change-Id: I6c37972093515a27077f79594cad27e32e1a4e7c
> Reviewed-on: https://chromium-review.googlesource.com/444768
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43370}

TBR=rmcilroy@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203

Change-Id: I5d1101bdae6939378dad595b26698fe2aaaad35e
Reviewed-on: https://chromium-review.googlesource.com/446357
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43372}
2017-02-22 13:46:33 +00:00
yangguo
4a655cbe0c [debugger] extend side effect free debug-evaluate to Array builtins.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2695933005
Cr-Commit-Position: refs/heads/master@{#43371}
2017-02-22 13:29:40 +00:00
Ross McIlroy
087e95ba63 [Compiler] Use IdentityMap to store jobs in CompilerDispatcher.
Stores jobs in an IdentityMap keyed by their SharedFunctionInfo to enable
fast checking of whether a job is enqueued.

BUG=v8:5203

Change-Id: I6c37972093515a27077f79594cad27e32e1a4e7c
Reviewed-on: https://chromium-review.googlesource.com/444768
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43370}
2017-02-22 12:35:33 +00:00
titzer
c8329253ea [wasm] Remove support for experimental version 0xD.
R=mtrofin@chromium.org
BUG=chromium:575167,chromium:694657

Review-Url: https://codereview.chromium.org/2709753003
Cr-Commit-Position: refs/heads/master@{#43368}
2017-02-22 12:06:09 +00:00
Andreas Haas
73d45c9630 [wasm] Use builtins wrappers for traps
With this CL the out-of-line code of TrapIf will call a builtin instead
of doing a direct runtime call, which is cheaper. In the best case, the
out-of-line code now consists of a single call instruction. The builtin
will load the trapID and then call the runtime to throw a trap.

R=titzer@chromium.org, clemensh@chromium.org

Change-Id: I8a75ba09f40236a3d5cbdc17c1317baf0a3c915a
Reviewed-on: https://chromium-review.googlesource.com/445937
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43366}
2017-02-22 12:01:02 +00:00
yangguo
901c29eb1c [inspector] extend protocol for code coverage.
R=jgruber@chromium.org, kozyatinskiy@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2700743002
Cr-Commit-Position: refs/heads/master@{#43363}
2017-02-22 10:21:57 +00:00
Ross McIlroy
e2de1b8696 Add support to IdentityMap for deletion, iteration and AllocationPolicy.
In order to use the IdentityMap in the CompilerDispatcher the following
support is added:
 - Support for deleting entries
 - Support for iterating through the entries.
 - Support for AllocationPolicy to enable non-zone allocation of backing
   stores.
 - Also refactors the code a bit.

BUG=v8:5203

Change-Id: I8b616cba8ae9dc22a7f4d76070fbb318c4edc80d
Reviewed-on: https://chromium-review.googlesource.com/444409
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43362}
2017-02-22 10:20:15 +00:00
dcheng
96eda1f7d1 Fix receiver checks for v8::Function on a remote context receiver.
v8 allows the embedder to specify a global template to use when
creating a new context. However, v8 does not use the supplied
template directly when creating the global proxy: it creates a
unique template for each global proxy. However, this is problematic
for remote contexts: functions cannot use strict receiver checks
with the remote context, as the global template will never match
the global proxy.

To fix this, remote contexts now also include a remote global
object in the prototype chain that is instantiated with the global
template. This mirrors the way the global proxy is configured for a
full v8 context, and allows strict receiver checks to work.

BUG=527190

Review-Url: https://codereview.chromium.org/2677653002
Cr-Commit-Position: refs/heads/master@{#43361}
2017-02-22 10:13:24 +00:00
yangguo
3f303da292 [debugger] remove debugger statement support from FCG/CS.
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2650193002
Cr-Original-Commit-Position: refs/heads/master@{#42892}
Committed: eef855a1dc
Review-Url: https://codereview.chromium.org/2650193002
Cr-Commit-Position: refs/heads/master@{#43360}
2017-02-22 08:45:09 +00:00
Caitlin Potter
4cd8a8b784 [builtins] fix slow-path handling of -Infinity in ArrayIncludes
This is a speculative fix, but I believe it might work.

Idea is to keep `start_from` as a double while establishing an appropriate
index to begin iteration. This should keep -Infinity intact rather than
converting it to a positive high value, which would break the algorithm.
This is similar to what had been implemented on the fast path before it was
changed to send non-Smis to the slow path.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org, machenbach@chromium.org, adamk@chromium.org

Change-Id: I9965fd2e75a8972f3f1c7a18e51bd580030a66ea
Reviewed-on: https://chromium-review.googlesource.com/445857
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43358}
2017-02-21 23:31:39 +00:00
binji
8235558bd0 [SAB] Test262 Agent harness
Review-Url: https://codereview.chromium.org/2658933004
Cr-Commit-Position: refs/heads/master@{#43357}
2017-02-21 19:59:05 +00:00
clemensh
e6819ee286 [wasm] Test argument passing in the interpreter entry
Test the wasm interpreter entry stub by creating two wasm functions A
and B, make A pass arguments to B, then redirect B to be executed in the
interpreter.
Test different number and types or arguments.

BUG=v8:5822
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2651793003
Cr-Commit-Position: refs/heads/master@{#43353}
2017-02-21 18:21:31 +00:00
clemensh
cc805e42af [wasm] Enforce module size limit early enough
The limit needs to be checked before casting the length to int in
ModuleWireBytes.

R=titzer@chromium.org
BUG=694433

Review-Url: https://codereview.chromium.org/2705233002
Cr-Commit-Position: refs/heads/master@{#43352}
2017-02-21 18:13:02 +00:00
mtrofin
caa1d4b262 [wasm] Managed<T> ensures T's lifetime does not leak past Isolate's
Native resources allocated by v8, as internal implementation detail,
and held by a Foreign object, must be released when the Isolate is
torn down. Example: wasm::WasmModule allocated by wasm compile, and
held throughout the lifetime of the WebAssembly.Module object.

This change:
- Extends Managed<CppType> with a mechanism for doing just that
- Separates the role of Managed<CppType> to be strictly an owner of
the lifetime of the native resource. For cases where that's not
desirable, we can polymorphically use Foregin.
- moves managed.h out of wasm, since it's not wasm-specific.

BUG=680065

Review-Url: https://codereview.chromium.org/2676513008
Cr-Commit-Position: refs/heads/master@{#43350}
2017-02-21 17:23:38 +00:00
bbudge
9fe0b4c708 [V8] Implement SIMD Boolean vector types to allow mask registers.
- Adds new machine types SimdBool4/8/16 for the different boolean vector types.
- Adds a kSimdMaskRegisters flag for each platform. These are all false for now.
- Removes Create, ExtractLane, ReplaceLane, Equal, NotEqual, Swizzle and Shuffle
  opcodes from the Boolean types. These are unlikely to be well supported natively,
  and can be synthesized using Select.
- Changes the signature of Relational opcodes to return boolean vectors.
- Changes the signature of Select opcodes to take boolean vectors.
- Updates the ARM implementation of Relational and Select opcodes.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2700813002
Cr-Commit-Position: refs/heads/master@{#43348}
2017-02-21 16:45:30 +00:00
Michael Starzinger
875ccb48ff [turbofan] Fix missing name check for keyed global load.
This fixes a missing name check for keyed property loads targeting the
global object where the feedback was warmed up with a single name. This
affects {JSLoadProperty} nodes only, syntactic global property loads via
the {JSLoadGlobal} operator are not affected.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-694416
BUG=chromium:694416

Change-Id: I54aa3f27eaa72630539f02602ec7642b04835b27
Reviewed-on: https://chromium-review.googlesource.com/445224
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43344}
2017-02-21 14:51:07 +00:00
mtrofin
b40d44ecc1 [wasm] Embedder can control what buffers wasm compilation works on.
Two controls, one for instantiation and one for compilation. They allow
the embedder (e.g. Chrome) check properties of the parameters of those
two operations, and decide if they are allowed to continue.

For example, Chrome may now decline compilation of certain size buffers,
in synchronous cases; same for instantiation (where the buffer size
refers to the size of the buffer containing wasm wire bytes)

BUG=v8:5981

Review-Url: https://codereview.chromium.org/2699843003
Cr-Original-Commit-Position: refs/heads/master@{#43295}
Committed: d9bc0ffb16
Review-Url: https://codereview.chromium.org/2699843003
Cr-Commit-Position: refs/heads/master@{#43336}
2017-02-21 03:43:14 +00:00
littledan
2b9840d86f [SAB] Move Atomics builtins to C++
This patch refactors the Atomics builtins so that they are implemented
as C++ builtins rather than experimental JS builtins. Previously, each
of these functions called out to a runtime function, so no significant
change in performance is anticipated. The goal of this patch is to
remove the last user of experimental JS builtins so that the mechanism
can be removed, for performance reasons. The patch includes a drive-by
fix of a check-fail. For the most part, the patch is just moving code
without modification from runtime-atomics.cc to
builtins-sharedarraybuffer.cc .

BUG=v8:5880

Review-Url: https://codereview.chromium.org/2698813004
Cr-Commit-Position: refs/heads/master@{#43335}
2017-02-20 22:08:52 +00:00
titzer
7f672535e6 [wasm] Move decoding constants out of wasm-module.h and into module-decoder.h
R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2703243002
Cr-Commit-Position: refs/heads/master@{#43332}
2017-02-20 17:42:02 +00:00
Marja Hölttä
7a457c711b [parser] Skipping inner funcs: params part 5
Handle eval in default parameters.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Ib6543a4aef9a3cc9636e65d0337bc269c8a079dc
Reviewed-on: https://chromium-review.googlesource.com/444747
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43328}
2017-02-20 16:37:24 +00:00
dusan.simicic
38affafd35 MIPS[64]: Skip float-constant-folding tests
qNaN and sNaN values have different binary representation on MIPS
compared to ARM/x86 architectures. We are skipping these tests because
we can't provide specific NaNs encodings from ARM/x86 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2702213003
Cr-Commit-Position: refs/heads/master@{#43327}
2017-02-20 16:21:49 +00:00
Caitlin Potter
6746227291 [builtins] fix incorrect return value in ArrayIncludes
Take runtime path if startIndex parameter requires a ToInteger() call,
which can modify the elements kind of the receiver.

This removes a stub call from the builtin, and simplifies code slightly.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org

Change-Id: Id238a81ab8ba28621858004b34d00a4356b8037f
Reviewed-on: https://chromium-review.googlesource.com/445006
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#43323}
2017-02-20 14:41:25 +00:00
yangguo
46290669d1 [serializer] allow duplicate API external references.
Due to link-time optimizations functions with same code
can be folded into one, resulting in duplicate references.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2707903002
Cr-Commit-Position: refs/heads/master@{#43317}
2017-02-20 12:52:53 +00:00
jgruber
3acc00a017 [regexp] Fix smi receiver in stack accessors
info.This returns a Local<Object>, which results in a call to
Utils::OpenHandle<JSReceiver>.  Casting to a Local<Value> first uses the
correct OpenHandle<Object> overload.

BUG=chromium:693500

Review-Url: https://codereview.chromium.org/2706833002
Cr-Commit-Position: refs/heads/master@{#43314}
2017-02-20 11:48:10 +00:00
titzer
9dae92066e [wasm] Fix fuzzer size calculation
R=ahaas@chromium.org, mythria@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2702123003
Cr-Commit-Position: refs/heads/master@{#43312}
2017-02-20 11:06:50 +00:00
Marja Hölttä
6b5f7d23dc [parser] Skipping inner funcs: add tests for strict mode.
BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I7a39e49cc569b87064e5ac6764f4e3a65b2c6d11
Reviewed-on: https://chromium-review.googlesource.com/444765
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43311}
2017-02-20 10:56:12 +00:00
titzer
df834f3ff2 [wasm] Split the compilation and instantiation API into sync and async methods.
This makes it easier to implement asynchronous compilation by hiding all the implementation details of both synchronous and asynchronous compilation within wasm-module.cc, whereas before the code in wasm-js.cc actually implemented asynchronous compilation in terms of synchronous.

BUG=

Review-Url: https://codereview.chromium.org/2695813005
Cr-Commit-Position: refs/heads/master@{#43310}
2017-02-20 10:41:57 +00:00
dcheng
db624fc4d7 Always early return from HandleApiCallHelper on access check failure.
BUG=693695

Review-Url: https://codereview.chromium.org/2702123002
Cr-Commit-Position: refs/heads/master@{#43309}
2017-02-20 10:07:05 +00:00
danno
1b3c4afcad Revert of [interpreter] Create custom call opcodes for specific argument counts (patchset #13 id:240001 of https://codereview.chromium.org/2684993002/ )
Reason for revert:
Due to arm64 failures

Original issue's description:
> [interpreter] Create custom call opcodes for specific argument counts
>
> Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
> and CallProperty2. Also share the bytecode handler code between between
> equivalent CallX and CallPropertyX handlers.
>
> Review-Url: https://codereview.chromium.org/2684993002
> Cr-Commit-Position: refs/heads/master@{#43290}
> Committed: 00d6f1f80a

TBR=rmcilroy@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2709533002
Cr-Commit-Position: refs/heads/master@{#43308}
2017-02-20 09:51:19 +00:00
dcheng
40b74d04da Make CreationContext() not crash when there is no creation context.
Remote objects don't have a creation context.

BUG=527190

Review-Url: https://codereview.chromium.org/2693203003
Cr-Commit-Position: refs/heads/master@{#43306}
2017-02-20 09:47:14 +00:00
Igor Sheludko
c6b57edc04 [crankshaft][turbofan] Compilers' part of constant field tracking.
The constant field tracking is still disabled.

BUG=v8:5495

Change-Id: I543fe50b82e2255bbf200ea785ec53e3623e30cb
Reviewed-on: https://chromium-review.googlesource.com/440924
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43304}
2017-02-20 09:05:55 +00:00
hablich
1bbbfb42d5 Revert of [wasm] Embedder can control what buffers wasm compilation works on. (patchset #3 id:60001 of https://codereview.chromium.org/2699843003/ )
Reason for revert:
Introduces a new test failure/flake: https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/16427

Original issue's description:
> [wasm] Embedder can control what buffers wasm compilation works on.
>
> Two controls, one for instantiation and one for compilation. They allow
> the embedder (e.g. Chrome) check properties of the parameters of those
> two operations, and decide if they are allowed to continue.
>
> For example, Chrome may now decline compilation of certain size buffers,
> in synchronous cases; same for instantiation (where the buffer size
> refers to the size of the buffer containing wasm wire bytes)
>
> BUG=v8:5981
>
> Review-Url: https://codereview.chromium.org/2699843003
> Cr-Commit-Position: refs/heads/master@{#43295}
> Committed: d9bc0ffb16

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5981

Review-Url: https://codereview.chromium.org/2701413002
Cr-Commit-Position: refs/heads/master@{#43303}
2017-02-20 08:01:01 +00:00
Georg Neis
8686368321 [interpreter] When generating bytecode, properly track current scope.
The bytecode generator did not necessarily know for which scope, and
thus language mode, it was generating code, because it only tracked
scopes that have a context.  This led to wrong behavior in some
examples involving class expressions (which are always in strict
mode).

With this CL, the bytecode generator explicitly tracks the current
scope, independent of whether it has a context.

BUG=v8:5927

Change-Id: Ifa6b3ee5e13e07b63d00e74c7f557a328633c88b
Reviewed-on: https://chromium-review.googlesource.com/444785
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43300}
2017-02-19 13:08:19 +00:00
vabr
6302753e2f Fix typeof optimization for undetectable
Currently, typeof o, where o is an undetectable
callable object (such as document.all), returns 'function' if
optimised. It should, however, return 'undefined'.

This CL excludes undetectable objects from the optimization
resulting in type 'function' and renames the related code to
reflect that.

BUG=v8:5972
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2697063002
Cr-Commit-Position: refs/heads/master@{#43298}
2017-02-18 12:43:37 +00:00
mtrofin
d9bc0ffb16 [wasm] Embedder can control what buffers wasm compilation works on.
Two controls, one for instantiation and one for compilation. They allow
the embedder (e.g. Chrome) check properties of the parameters of those
two operations, and decide if they are allowed to continue.

For example, Chrome may now decline compilation of certain size buffers,
in synchronous cases; same for instantiation (where the buffer size
refers to the size of the buffer containing wasm wire bytes)

BUG=v8:5981

Review-Url: https://codereview.chromium.org/2699843003
Cr-Commit-Position: refs/heads/master@{#43295}
2017-02-18 01:08:36 +00:00
gsathya
18ad0f13af [ESnext] Implement Promise.prototype.finally
Adds five new TF builtins for the spec defined functions/closures. This follows
mechanism similar to promise resolving functions approach where we store the
closure variables in a custom context.

Adds a new --harmony-promise-finally flag.

BUG=v8:5967

Review-Url: https://codereview.chromium.org/2695753002
Cr-Commit-Position: refs/heads/master@{#43294}
2017-02-17 22:10:28 +00:00
binji
4dfd5e5ee2 Make regress-crbug-514081 less flaky by having max serialization size
BUG=v8:5906
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2697723004
Cr-Commit-Position: refs/heads/master@{#43292}
2017-02-17 18:55:54 +00:00
danno
00d6f1f80a [interpreter] Create custom call opcodes for specific argument counts
Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
and CallProperty2. Also share the bytecode handler code between between
equivalent CallX and CallPropertyX handlers.

Review-Url: https://codereview.chromium.org/2684993002
Cr-Commit-Position: refs/heads/master@{#43290}
2017-02-17 17:57:22 +00:00
eholk
3e1db847b3 [wasm] Syntax- and Type-aware Fuzzer
This is the beginning of a new fuzzer that generates
correct-by-construction Wasm modules. This should allow us to better
exercise the compiler and correctness aspects of fuzzing. It is based off
of ahaas' original Wasm fuzzer.

At the moment, it can generate expressions made up of most binops, and
also nested blocks with unconditional breaks. Future CLs will add
additional constructs, such as br_if, loops, memory access, etc.

The way the fuzzer works is that it starts with an array of arbitrary
data provided by libfuzzer. It uses the data to generate an expression.
Care is taken to make use of the entire string. Basically, the
generator has a bunch of grammar-like rules for how to construct an
expression of a given type. For example, an i32 can be made by adding
two other i32s, or by wrapping an i64. The process then continues
recursively until all the data is consumed.

We generate an expression from a slice of data as follows:
* If the slice is less than or equal to the size of the type (e.g. 4
  bytes for i32), then it will emit the entire slice as a constant.
* Otherwise, it will consume the first 4 bytes of the slice and use
  this to select which rule to apply. Each rule then consumes the
  remainder of the slice in an appropriate way. For example:
  * Unary ops use the remainder of the slice to generate the argument.
  * Binary ops consume another four bytes and mod this with the length
    of the remaining slice to split the slice into two parts. Each of
    these subslices are then used to generate one of the arguments to
    the binop.
  * Blocks are basically like a unary op, but a stack of block types is
    maintained to facilitate branches. For blocks that end in a break,
    the first four bytes of a slice are used to select the break depth
    and the stack determines what type of expression to generate.
The goal is that once this generator is complete, it will provide a one
to one mapping between binary strings and valid Wasm modules.

Review-Url: https://codereview.chromium.org/2658723006
Cr-Commit-Position: refs/heads/master@{#43289}
2017-02-17 17:06:29 +00:00
Igor Sheludko
76c65af808 [csa] Rename GotoUnless to GotoIfNot.
BUG=

Change-Id: Ifc441739ef730a0b2278be0b662413c223631a72
Reviewed-on: https://chromium-review.googlesource.com/444190
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43288}
2017-02-17 17:04:18 +00:00
Igor Sheludko
a85f27d8a4 [ic] Introduce StoreOwnIC.
... which is used for initializing properties with non compile time values.

Currently we use StoreOwnIC only for storing properties that already exist
in the boilerplate therefore we can reuse StoreIC dispatcher.
The proper StoreOwnIC dispatcher will be implemented in a separate CL.

BUG=v8:5495, v8:4414

Change-Id: I9c33fdb8499ec5be2c7fce1ecb6ce7aa285e5844
Reviewed-on: https://chromium-review.googlesource.com/443588
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43285}
2017-02-17 15:55:33 +00:00
ulan
9e187ea91b [heap] Remove Heap::TracePath* functions.
The functions do not work correctly with concurrent sweeper and they
do not take weak references into account.

The latter is a fundamental problem for this tracing approach.

BUG=

Review-Url: https://codereview.chromium.org/2707433002
Cr-Commit-Position: refs/heads/master@{#43284}
2017-02-17 15:06:58 +00:00
Michael Lippautz
a84b23399e Remove some unused flags
BUG=

Change-Id: I7542ada0eb557b5b813396f7d250549abb880f91
Reviewed-on: https://chromium-review.googlesource.com/444408
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43283}
2017-02-17 14:46:51 +00:00
addaleax
3b15d950ee ValueSerializer: Add SetTreatArrayBufferViewsAsHostObjects() flag
Add `ValueSerializer::SetTreatArrayBufferViewsAsHostObjects()` which
instructs the `ValueSerializer` to treat ArrayBufferView objects as
host objects.

BUG=v8:5926

Review-Url: https://codereview.chromium.org/2696133007
Cr-Commit-Position: refs/heads/master@{#43281}
2017-02-17 14:19:39 +00:00
Camillo Bruni
3a43be9b78 [elements] Check if the backing store has been neutered for indexOf
BUG=691323

Change-Id: I84f2c90355982567c421639e115745eadd5fcb21
Reviewed-on: https://chromium-review.googlesource.com/441964
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43279}
2017-02-17 12:49:21 +00:00
Marja Hölttä
3ee21f289b [parser] Skipping inner funcs: params part 4
Add some tests which already pass.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Icf5cf5e40010deb2efb69dea750661854b055566
Reviewed-on: https://chromium-review.googlesource.com/444744
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43278}
2017-02-17 12:19:35 +00:00
vabr
454816f08f Report unexpected lexical decl also without destructuring
https://codereview.chromium.org/2694003002/ introduced
"SyntaxError: Lexical declaration cannot appear in a single-statement context"
for the case when let + desctructuring from a list happen.

As was pointed out in https://codereview.chromium.org/2694003002/#msg18, the
case without destructuring would also benefit from a better message: if a
single statement is expected and "let identifier = ..." is seen, the error is
indeed again that the lexical declaration is not a statement. However, the current
error is "Unexpected identifier", because the parser tries to accept "let" as
an identifier in an expression statement, and then gives up seeing the other
identifier after "let".

This CL ensures that the parser recognises the error properly and reports
accordingly. It also renames the existing test, which contains destructuring,
and adds the one with a non-destructuring lexical declaration.

BUG=v8:5686

Review-Url: https://codereview.chromium.org/2697193007
Cr-Commit-Position: refs/heads/master@{#43275}
2017-02-17 10:57:32 +00:00
Toon Verwaest
0a8de761ff Remove unused Box type
BUG=

Change-Id: Ie7a8327fac62a0608b60cf9f0f072f979ac4fd76
Reviewed-on: https://chromium-review.googlesource.com/443528
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@google.com>
Cr-Commit-Position: refs/heads/master@{#43269}
2017-02-17 10:06:22 +00:00
dcheng
c5ccae970d Remove a few unnecssary scopers from unit tests.
TestWithIsolate and TestWithContext already instantiate the scopers.

BUG=none

Review-Url: https://codereview.chromium.org/2690303009
Cr-Commit-Position: refs/heads/master@{#43268}
2017-02-17 09:51:07 +00:00
dcheng
692cccce26 Make instance checks understand remote contexts.
https://crrev.com/2500363002 updated FunctionTemplate::HasInstance to
follow the hidden prototype chain of a global proxy to the global
object. However, remote contexts don't have a global object to check;
instead, teach the instance check knows about the conventions of
global proxy setup and have it also check the constructor's prototype.

Similarly, also teach Object::FindInstanceInPrototypeChain about the
unusual conventions for remote contexts.

BUG=527190

Review-Url: https://codereview.chromium.org/2698683003
Cr-Commit-Position: refs/heads/master@{#43263}
2017-02-16 21:46:15 +00:00
jwolfe
d1d4b9ce51 Implement new Function.prototype.toString --harmony-function-tostring
For functions declared in source code, the .toString() representation
will be an excerpt of the source code.
* For functions declared with the "function" keyword, the excerpt
  starts at the "function" or "async" keyword and ends at the final "}".
  The previous behavior would start the excerpt at the "(" of the
  parameter list, and prepend a canonical `"function " + name` or
  similar, which would discard comments and formatting surrounding the
  function's name. Anonymous functions declared as function expressions
  no longer get the name "anonymous" in their toString representation.
* For methods, the excerpt starts at the "get", "set", "*" (for
  generator methods), or property name, whichever comes first.
  Previously, the toString representation for methods would use a
  canonical prefix before the "(" of the parameter list. Note that any
  "static" keyword is omitted.
* For arrow functions and class declarations, the excerpt is unchanged.

For functions created with the Function, GeneratorFunction, or
AsyncFunction constructors:
* The string separating the parameter text and body text is now
  "\n) {\n", where previously it was "\n/*``*/) {\n" or ") {\n".
* At one point, newline normalization was required by the spec here,
  but that was removed from the spec, and so this CL does not do it.

Included in this CL is a fix for CreateDynamicFunction parsing. ')'
and '`' characters in the parameter string are no longer disallowed,
and Function("a=function(", "}){") is no longer allowed.

BUG=v8:4958, v8:4230

Review-Url: https://codereview.chromium.org/2156303002
Cr-Commit-Position: refs/heads/master@{#43262}
2017-02-16 20:19:24 +00:00
Daniel Clifford
bd21c2bd04 [ignition] Optimize reloading of registers before Dispatch
Before this patch, the registers needed for bytecode dispatch in interpreter
handlers were inconsistently stored in the interpreter frame and/or kept in
values that remained live across calls.

After this patch, these registers are explicitly reloaded after calls, making it
possible to elide the spills of those registers before the call in many cases.

Some highlights from the CL:

* Added methods to the CSA and InterpreterAssembler to efficiently store and
  load Smis values and Smi interpreter registers on x64 without explicit
  tagging/untagging.

* Created Variables for all of the interpreter-internal values that need to be
  reloaded before bytecode dispatch at the end of an interpreter handler.

* The bytecode offset can be written out early in a handler by marking it
  has having a call along it's critical path. By moving this early in a
  handler, it becomes possible to use memory operands for pushes used to
  marshall parameters when making calls.

Change-Id: Icf8d7798789f88a4489e06a7092616bbbb881577
Reviewed-on: https://chromium-review.googlesource.com/442566
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43260}
2017-02-16 19:30:39 +00:00
vabr
94bf354af5 Raise SyntaxError on let [ starting an ExpressionStatement
ES2017 forbids the sequence of tokens "let [" in in expression statements [1].

This CL makes ParserBase report those instances as SyntaxError. It also adds a
customised error message for that, because the standard "Unexpected token" is
not applicable: "let" itself is not forbidden in those context, only the
sequence of "let [".

[1] https://tc39.github.io/ecma262/#sec-expression-statement

BUG=v8:5686

Review-Url: https://codereview.chromium.org/2694003002
Cr-Commit-Position: refs/heads/master@{#43258}
2017-02-16 17:37:21 +00:00
gsathya
7ee77b9be6 [mjsunit] Exit on hitting unreachable code instead of throwing
Errors are swallowed by promises, so just exit with stack trace.

Review-Url: https://codereview.chromium.org/2693383004
Cr-Commit-Position: refs/heads/master@{#43254}
2017-02-16 14:46:55 +00:00
mvstanton
ae8f28208f This is a workaround for the fact that %SetCode can "lose" the script for a js native. If the js native is re-initialized (for a Realm or something), then the source SharedFunctionInfo won't have a script anymore. Nonetheless, we may want to optimize the function. If we've compiled bytecode, then we can compile optimized code without a script.
Here, we carve out a special exception for this case, so that we can turn on the --mark-shared-functions-for-tier-up.

BUG=v8:5946
R=leszeks@chromium.org

Review-Url: https://codereview.chromium.org/2684033007
Cr-Original-Commit-Position: refs/heads/master@{#43240}
Committed: 4123a3dd79
Review-Url: https://codereview.chromium.org/2684033007
Cr-Commit-Position: refs/heads/master@{#43252}
2017-02-16 14:39:17 +00:00
rossberg
e2b83fbbfd [wasm] Inspect right control frames for unreachable flag
We were looking at the unreachable flag or stack_depth of the target frame
instead of the current one in a couple of places (most notably BreakTo).
This change fixes these bugs and makes us pass the latest spec tests for
br_table validation. Also need to ensure that br_table targets have consistent
types, which is not implied if the stack is polymorphic.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2696813002
Cr-Commit-Position: refs/heads/master@{#43250}
2017-02-16 14:12:01 +00:00
jbroman
8990399dc7 ValueDeserializer: Only allow valid keys when deserializing object properties.
The serializer won't ever write a more complex object. Not validating this
allows other things to be used as keys, and converted to string when the
property set actually occurs. It turns out this gives an opportunity to trigger
OOM by giving an object a key which is a very large sparse array (whose string
representation is very large).

This case is now rejected by the deserializer.

BUG=chromium:686511

Review-Url: https://codereview.chromium.org/2697023002
Cr-Commit-Position: refs/heads/master@{#43249}
2017-02-16 13:59:56 +00:00
Andreas Haas
5f1661aad7 [turbofan] For Word32Shl optimizations only consider the last 5 bits of the shift
One optimization in the machine-operator-reducer did not consider that
that word32 shift left instructions only consider the last 5 bits of
the shift input.

The issue only occurs for WebAssembly because in JavaScript we always
add a "& 0xf" on the shift value to the TurboFan graph.

For additional background: The JavaScript and WebAssembly spec both
say that only the last 5 bits of the shift value are used in the
word32-shift-left operation. This means that an "x << 0x29", in the
code is actually executed as "x << 0x09". Therefore the changes in
this CL are okay because they mask the last 5 bit of the shift value.

BUG=chromium:689450

Change-Id: Id92f298ed6d7f1714b109b3f4fbcecd5ac6d30f7
Reviewed-on: https://chromium-review.googlesource.com/439312
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43245}
2017-02-16 12:09:32 +00:00
jgruber
e9f5e1e99e [debug] Handle OOM events in debugger tests
Map OOM breaks generated by inspector to DebugEvent.OOM.
This avoids generating unintentional DebugEvent.Break events.

Also be more future-proof in event categorization.

On a related note, this CL also fixes a DCHECK in
Runtime::GetFrameDetails.

The receiver needs to be grabbed from the inlined frame, not
the outer optimized frame. Optimized frames only provide the
receiver on a best-effort basis.

BUG=v8:5950

Review-Url: https://codereview.chromium.org/2696173002
Cr-Commit-Position: refs/heads/master@{#43244}
2017-02-16 11:48:22 +00:00
Andreas Haas
140ec9d7cc [wasm][fuzzer] Small fixes in the correctness fuzzer result comparison.
R=eholk@chromium.org

Change-Id: Ieb88f807275e1cc31cc7715270e316c427b212d4
Reviewed-on: https://chromium-review.googlesource.com/442425
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43243}
2017-02-16 11:23:29 +00:00
machenbach
4d942ac741 Revert of Allow a ParseInfo without a script for %SetCode users (patchset #5 id:220001 of https://codereview.chromium.org/2684033007/ )
Reason for revert:
Please remove the file in status file too. Breaks presubmit:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20presubmit/builds/14754

Or lets call it post-submit :(

Original issue's description:
> This is a workaround for the fact that %SetCode can "lose" the script for a js native. If the js native is re-initialized (for a Realm or something), then the source SharedFunctionInfo won't have a script anymore. Nonetheless, we may want to optimize the function. If we've compiled bytecode, then we can compile optimized code without a script.
>
> Here, we carve out a special exception for this case, so that we can turn on the --mark-shared-functions-for-tier-up.
>
> BUG=v8:5946
> R=leszeks@chromium.org
>
> Review-Url: https://codereview.chromium.org/2684033007
> Cr-Commit-Position: refs/heads/master@{#43240}
> Committed: 4123a3dd79

TBR=leszeks@chromium.org,mstarzinger@chromium.org,marja@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5946

Review-Url: https://codereview.chromium.org/2703553002
Cr-Commit-Position: refs/heads/master@{#43242}
2017-02-16 10:39:58 +00:00
Marja Hölttä
712800a636 [parser] Skipping inner funcs: params part 3
Produce the same scopes / variables for parameters (part 3).

This CL fixes the ordering + variable types in PreParser when there are
simple parameters + a rest parameter. In that case, Parser declares
unnamed temporaries for the non-rest params, then the rest param, then
the named variables (which are not parameters) for the non-rest params.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I9b006595039c8002b0508d1d2a200aa9a0f3eae0
Reviewed-on: https://chromium-review.googlesource.com/443527
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43241}
2017-02-16 10:24:52 +00:00
mvstanton
4123a3dd79 This is a workaround for the fact that %SetCode can "lose" the script for a js native. If the js native is re-initialized (for a Realm or something), then the source SharedFunctionInfo won't have a script anymore. Nonetheless, we may want to optimize the function. If we've compiled bytecode, then we can compile optimized code without a script.
Here, we carve out a special exception for this case, so that we can turn on the --mark-shared-functions-for-tier-up.

BUG=v8:5946
R=leszeks@chromium.org

Review-Url: https://codereview.chromium.org/2684033007
Cr-Commit-Position: refs/heads/master@{#43240}
2017-02-16 10:23:59 +00:00
littledan
d31c5410c4 [builtins] Apply ES2016 conditional default timezone semantics
ES2016 changed the default timezone of dates to be conditional on
whether a time is included. The semantics were a compromise approach
based on web compatibility feedback from V8, but until now, we have been
shipping ES5.1 default timezone semantics. This patch implements the
new semantics, following ChakraCore and SpiderMonkey (though JSC
implements V8's previous semantics).

BUG=chromium:589858

Review-Url: https://codereview.chromium.org/2648603002
Cr-Commit-Position: refs/heads/master@{#43239}
2017-02-16 10:02:01 +00:00
Marja Hölttä
d21621cf35 [parser] No need to collect literal counts.
Patch adopted from mvstanton@ ( https://codereview.chromium.org/2657413002/ )

BUG=

Change-Id: I4296b3d5694116e250a6bb88296fbed0f0c444e6
Reviewed-on: https://chromium-review.googlesource.com/443246
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43238}
2017-02-16 09:58:45 +00:00
Michael Starzinger
9d53d16bcf [turbofan] Handle arithmetic addition in early lowering.
This handles arithmetic addition operations during the early type-hint
lowering (i.e. during graph construction). The string addition case is
still handled by {JSTypedLowering} as it needs static type information.

R=bmeurer@chromium.org

Change-Id: I9df47dfc5bf7613c51f6d803ab43d5d3f6c21be8
Reviewed-on: https://chromium-review.googlesource.com/443185
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43235}
2017-02-16 09:32:32 +00:00
jgruber
c0fe56e63d [regexp] Correct lastIndex behavior in RegExp.prototype[@@replace]
@@replace has a pretty complex implementation, taking different paths
for various situations (e.g.: global/nonglobal regexp, functional/string
replace argument, etc.). Each of these paths must implement similar
logic for calling into the RegExpBuiltinExec spec operation, and many
paths get this subtly wrong.

This CL fixes a couple of issues related to the way @@replace handles lastIndex:
* All paths now respect lastIndex when calling into exec (some used to assume 0).
* lastIndex is now advanced after a successful match for sticky regexps.
* lastIndex is now only reset to 0 on failure for sticky regexps.

BUG=v8:5361

Review-Url: https://codereview.chromium.org/2685183003
Cr-Commit-Position: refs/heads/master@{#43234}
2017-02-16 09:21:37 +00:00
yangguo
c39123dd53 [debugger] implement inspector-facing API for code coverage.
The inspector uses V8's API handles and should not access
V8 internals. This change makes sure it can use the coverage
data in an encapsulated way.

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2696163002
Cr-Commit-Position: refs/heads/master@{#43231}
2017-02-16 08:36:12 +00:00
caitp
76ab55e3d3 [async-iteration] add support for for-await-of loops in Async Functions
When --harmony-async-iteration is enabled, it is now possible to
use the for-await-of loop, which uses the Async Iteration protocol
rather than the ordinary ES6 Iteration protocol.

the Async-from-Sync Iterator object is not implemented in this CL,
and so for-await-of loops will abort execution if the iterated object
does not have a Symbol.asyncIterator() method. Async-from-Sync
Iterators are implemented seperately in https://codereview.chromium.org/2645313003/

BUG=v8:5855, v8:4483
R=neis@chromium.org, littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/2637403008
Cr-Commit-Position: refs/heads/master@{#43224}
2017-02-15 19:39:06 +00:00
Peter Marshall
817e0358e3 [builtins] Convert the hole to undefined when pushing spread arguments.
The mips64 implementation always ended up in the slowpath due to some
loads that were the wrong width, so that is also fixed here.

BUG=v8:5974

Change-Id: Ie448a1fab5b7fca87597c5a1bf75443864e30c28
Reviewed-on: https://chromium-review.googlesource.com/443247
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43222}
2017-02-15 18:32:16 +00:00
bbudge
717c8f2c76 [HEAP] Remove SIMD 128 bit alignment from heap.
LOG=N
BUG=v8:4124, v8:5948

Review-Url: https://codereview.chromium.org/2694063005
Cr-Commit-Position: refs/heads/master@{#43219}
2017-02-15 15:42:27 +00:00
Michael Starzinger
67d087d577 [turbofan] Handle some arithmetic ops in early lowering.
This handles all arithmetic binary operations except addition during the
early type-hint lowering (i.e. during graph construction). We still use
static type information to potentially further reduce the speculative
operations down to pure operations during the typed lowering phase.

R=bmeurer@chromium.org

Change-Id: I8b93fd7c46ec8e5b81234a49624d503520c3d082
Reviewed-on: https://chromium-review.googlesource.com/443105
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43218}
2017-02-15 15:10:02 +00:00
cwhan.tunz
693b741f6d [tests] Add js-perf-test for %TypedArray%.prototype.sort
- Add benchmark for sorting of Float64Array
- Rename existing typedarray.js to copywithin.js

BUG=v8:5953
R=bmeurer@chromium.org, caitp@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2691423003
Cr-Commit-Position: refs/heads/master@{#43217}
2017-02-15 14:48:42 +00:00
caitp
dc302c74be Reland [typedarrays] move %TypedArray%.prototype.copyWithin to C++
- Removes shared InnerArrayCopyWithin JS builtin from src/js/array.js
- Implements %TypedArray%.prototype.copyWithin as a C++ builtin, which
relies on std::memmove rather than accessing individual eleements.
- Fixes the case where copyWithin is invoked on a TypedArray with a
detached buffer.
- Add tests to ensure that +/-Infinity (for all 3 parameters) is handled
  correctly by the
algorithm

The C++ version gets through the benchmark more than 25000 times as
quickly as the JS implementation.

BUG=v8:5925, v8:5929, v8:4648
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2697593002
Cr-Commit-Position: refs/heads/master@{#43213}
2017-02-15 14:21:18 +00:00
Igor Sheludko
fdc78d294e [ic] Cleanup vector-based IC clearing.
... and don't clear ICs during GC. The IC clearing used to prevent memory
leaks but it's not necessary anymore because all the handlers that need
to embed objects already use weak cells.

This CL unblocks inlining of IC dispatchers into bytecode handlers.

BUG=v8:5917

Change-Id: I229b9ba8dba44f431dfbe8ac5370d855e3e84dd6
Reviewed-on: https://chromium-review.googlesource.com/442127
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43209}
2017-02-15 13:01:11 +00:00
Michael Starzinger
d0b9062432 [turbofan] Implement early lowering based on type hints.
This allows part of typed lowering that is solely based on type-hints to
run as part of the graph construction. The lowering in question does not
inspect types and hence doesn't require the typer to have run before. We
insert the speculative simplied-level operations in favor of the generic
JavaScript-level variants.

R=bmeurer@chromium.org

Change-Id: I5f0549fc1e4ff607622ee9059e6232a32f77db2e
Reviewed-on: https://chromium-review.googlesource.com/442584
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43208}
2017-02-15 12:18:42 +00:00
ishell@chromium.org
65f0e958f6 [runtime][tests] More *TypeFeedbackVector* -> *FeedbackVector* renamings.
BUG=

Change-Id: I859fef6b18e51cca80343a89e2b6f38eee95d408
Reviewed-on: https://chromium-review.googlesource.com/442428
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43206}
2017-02-15 08:53:51 +00:00
vabr
e3d761d94b ParserBase should accept ESCAPED_STRICT_RESERVED_WORD as an identifier
ParserBase::is_any_identifier currently does not recognise
Token::ESCAPED_STRICT_RESERVED_WORD as an identifier. This seems different
from what ParserBase::ParseIdentifierName does, and also prevents
"l\u0065t", unlike "let", from becoming a label.

This CL extends is_any_identifier to also accept ESCAPED_STRICT_RESERVED_WORD.

BUG=v8:5692

Review-Url: https://codereview.chromium.org/2695973003
Cr-Commit-Position: refs/heads/master@{#43204}
2017-02-15 02:35:12 +00:00
eholk
c7eabee422 [wasm] include JS conformance tests in Wasm mjsunit tests
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5507

Review-Url: https://codereview.chromium.org/2660903003
Cr-Original-Commit-Position: refs/heads/master@{#42821}
Committed: eb9b5edffb
Review-Url: https://codereview.chromium.org/2660903003
Cr-Commit-Position: refs/heads/master@{#43201}
2017-02-14 18:25:32 +00:00
ahaas
2f8ad11f2b [arm64] A shift of 0 is not allowed in ubfx.
R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com
BUG=v8:5951

Review-Url: https://codereview.chromium.org/2685943003
Cr-Original-Commit-Position: refs/heads/master@{#43090}
Committed: c46ccef921
Review-Url: https://codereview.chromium.org/2685943003
Cr-Commit-Position: refs/heads/master@{#43199}
2017-02-14 17:40:51 +00:00
vabr
0559fd7082 NumberFormat: default mnsd value is 1
CreateNumberFormat of src/js/i18n.js implements
http://www.ecma-international.org/ecma-402/1.0/#sec-11.1.1.1, but has a typo
in step 33a. The spec says that the default value for minimumSignificantDigits
should be 1, while the script set it to 0.

This CL fixes that typo and adds a test for that.

BUG=v8:5554

Review-Url: https://codereview.chromium.org/2694673003
Cr-Commit-Position: refs/heads/master@{#43197}
2017-02-14 17:12:49 +00:00
vabr
566e05c11e Provide default month for Date.UTC
After https://github.com/tc39/ecma262/pull/642, Date.UTC no longer requires
the month argument to be specified. The spec provides 0 as its default value.

This CL updates the builtins-date.cc code to reflect that and drops the test
suppression for test262/built-ins/Date/UTC/return-value.

BUG=v8:5534

Review-Url: https://codereview.chromium.org/2689173003
Cr-Commit-Position: refs/heads/master@{#43193}
2017-02-14 15:14:01 +00:00
Georg Neis
a68dcff45b [test] Add some more tests for async functions.
BUG=

Change-Id: I4a5db9bc045a63e710d0115523ab23b98e7c7ae6
Reviewed-on: https://chromium-review.googlesource.com/442504
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43189}
2017-02-14 14:49:45 +00:00
mstarzinger
e432f07db4 [unittests] Remove redundant checkpoint in JSTypedLoweringTest.
R=bmeurer@chromium.org
TEST=unittests/JSTypedLoweringTest

Review-Url: https://codereview.chromium.org/2694063003
Cr-Commit-Position: refs/heads/master@{#43186}
2017-02-14 13:36:37 +00:00
vabr
b478e9c11c Fix TypeError message for Reflect.construct
If the Reflect.construct receives an argument expected to be a constructor,
and the argument is not a constructor, V8 currently declares that
Reflect.construct is not a function. It should instead say that the offending
argument is not a constructor.

This is the case for all ports of builtins
(Builtins::Generate_ReflectConstruct). All of them make an
attempt to at least pass the right argument to the TypeError parametrised
message, calling out the offending Reflect.construct argument. However,
Runtime::kThrowCalledNonCallable extracts the callsite from those arguments,
discarding the precise information.

This CL adds Runtime::kNotConstructor, which reports the arguments passed
to it, and the CL also modifies the ports of builtins to make use of
Runtime::kNotConstructor

BUG=v8:5671

Review-Url: https://codereview.chromium.org/2688393003
Cr-Commit-Position: refs/heads/master@{#43182}
2017-02-14 11:21:34 +00:00
gsathya
a09157033b [tests] make the function expression, an iife to run the test
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2690163004
Cr-Commit-Position: refs/heads/master@{#43180}
2017-02-14 10:15:21 +00:00
clemensh
be1a5f7551 [asm] Fix lots of invalid asm.js tests
I identified lots of asm.js tests that are actually not valid according
to the spec, hence they execute in default-javascript-mode.
This CL fixes most of them by adding additional type annotations.

The atomic tests are totally non-spec-compliant by expecting a fourth
argument, and infinite-loops-taken expects a function-type parameter,
so I did not fix those.
I also did not fix the regression tests.

R=titzer@chromium.org, bradnelson@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2663243002
Cr-Commit-Position: refs/heads/master@{#43179}
2017-02-14 09:26:52 +00:00
clemensh
0b287bd4ea [asm-wasm] Fix continue target of do-while loops
See associated bug: A continue if a do-while loop did jump back to the
loop header, instead of jumping to the condition.
This CL fixes this and adds a test case.

R=bradnelson@chromium.org, titzer@chromium.org
BUG=v8:5912

Review-Url: https://codereview.chromium.org/2693993002
Cr-Commit-Position: refs/heads/master@{#43178}
2017-02-14 08:57:35 +00:00
bbudge
deabb19abc Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43169}
Committed: a9b59a11f1
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43176}
2017-02-14 06:57:25 +00:00
yangguo
033d3b577b [debugger] change coverage format to nested, with function name.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2694623003
Cr-Commit-Position: refs/heads/master@{#43175}
2017-02-14 06:47:58 +00:00
franzih
a386eb4f04 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
Breaks Node integration build.

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,v8:5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Original-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43169}
> Committed: a9b59a11f1

TBR=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,machenbach@chromium.org,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,v8:5948

Review-Url: https://codereview.chromium.org/2695653005
Cr-Commit-Position: refs/heads/master@{#43170}
2017-02-13 21:33:46 +00:00
bbudge
a9b59a11f1 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43169}
2017-02-13 20:43:08 +00:00
bbudge
11f88ef53f [Turbofan] Add more non-arithmetic SIMD operations.
- Renames select, swizzle, and shuffle to be consistent with the S128 and
  existing S32x4 ops, and reflect that these aren't arithmetic.
  e.g. I16x8Swizzle -> S16x8Swizzle.
- Implements S16x8 and S8x16 Select operations and tests.
- Implements S128And, Or, Xor, Not operations and tests.
- Implements Swizzle for 32x4 formats.
- Refactors test macros that generate SIMD code.

TEST=cctest/test-run-wasm-simd/*

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2683713003
Cr-Commit-Position: refs/heads/master@{#43168}
2017-02-13 20:24:43 +00:00
jyan
2dab40ccda s390: use new mul instruction
R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com, danno@chromium.org, bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2691893002
Cr-Commit-Position: refs/heads/master@{#43166}
2017-02-13 18:50:35 +00:00
bradnelson
43fc15bb79 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
red

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
> (notry since trybots can't patch directory deletes)
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9

TBR=bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,5948

Review-Url: https://codereview.chromium.org/2692933002
Cr-Commit-Position: refs/heads/master@{#43164}
2017-02-13 18:12:14 +00:00
bbudge
d170c57ab9 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
(notry since trybots can't patch directory deletes)
NOTRY=true

Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43162}
2017-02-13 15:59:22 +00:00
Marja Hölttä
2d9b9faf17 [iwyu, wasm] Remove unallowed includes to objects-inl.h from wasm.
R=mstarzinger@chromium.org
BUG=v8:5294

Change-Id: If2cdb4d38829e69ddd8aecb99c99c3a03050f57c
Reviewed-on: https://chromium-review.googlesource.com/441824
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43158}
2017-02-13 15:05:37 +00:00
Marja Hölttä
8c449e39b5 [parsing/test] Skipping inner funcs: add more (structured tests).
Test both cases where the interesting constructs occur at the
laziness boundary and cases where they occur deeper.

BUG=v8:5501
R=vogelheim@chromium.org

Change-Id: I99e32cb0c829616011bf7d1f389a8d309b54d67e
Reviewed-on: https://chromium-review.googlesource.com/441844
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43157}
2017-02-13 15:04:34 +00:00
Marja Hölttä
cb7e3d39fd Disable flaky debugger/debug/harmony/modules-debug-scopes1
BUG=v8:5950
NOTRY=true

Change-Id: I735e9be997167aa9f7252ad592c0881f6f5f621d
Reviewed-on: https://chromium-review.googlesource.com/441726
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43156}
2017-02-13 14:44:55 +00:00
vabr
1dd803f9d3 Fix error message for invalid buffer offset
The constructor for TypedArray in js/typedarray.js emitted
kInvalidTypedArrayAlignment if the array offset exceeded the size of the
underlying buffer. This seems like a typo introduced in
https://codereview.chromium.org/2090353003.

The error message to be emitted instead coincides with the already existing
kInvalidDataViewOffset. The message string is independent of whether the
object in question is a DataView or a typed array, so this CL:
  (1) renames kInvalidDataViewOffset to just kInvalidOffset, and
  (2) uses kInvalidOffset instead of kInvalidTypedArrayAlignment for cases
      when the TypedArray is constructed with an offset exceeding the buffer
      size.

BUG=v8:5733
TEST=Run d8, execute "new Uint8Array(new ArrayBuffer(1),2)", see the error message mention the invalid offset 2.

Review-Url: https://codereview.chromium.org/2692753002
Cr-Commit-Position: refs/heads/master@{#43151}
2017-02-13 10:28:34 +00:00
vabr
e08f85fcfe Unify TypeError messages
This CL fixes some nits in TypeError messages, unifying the form of
kDefineDisallowed and kObjectNotExtensible to match what is used by the
majority of the other messages:
  * "Cannot" vs. "Can't" -> choose "Cannot"
  * "property:%" -> "property %"
  * omit the full-stop at the end of the message

BUG=v8:5673

Review-Url: https://codereview.chromium.org/2686233008
Cr-Commit-Position: refs/heads/master@{#43150}
2017-02-13 10:27:03 +00:00
Michael Starzinger
6ee0b6cec6 [turbofan] Correct lazy deopt by {JSCreate} operation.
This adds support for deoptimizing into the JSConstructStub after the
receiver instantiation but before the actual constructor invocation.
Such a deoptimization point is needed for cases where instantiation
might be observed (e.g. when new.target is a proxy) and hence might
trigger a deopt.

We use this new deoptimization point for the "after" frame-state the
inliner attaches to {JSCreate} nodes being inserted when constructor
calls are being inlined.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-5638b
BUG=v8:5638

Change-Id: I7c72c807ee8fb76d12e0e9ccab86d970ab1a0efd
Reviewed-on: https://chromium-review.googlesource.com/440125
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43149}
2017-02-13 10:14:54 +00:00
Marja Hölttä
d1055c1fbd [iwyu] Remove unallowed include arguments.h -> objects-inl.h
After this, only 2 illegal includes to objects-inl.h remain (some wasm stuff).

R=​mstarzinger@chromium.org
BUG=v8:5294

Change-Id: I18682f42f0d2a7cc29a0a0be76f8e4eea26aafd9
Reviewed-on: https://chromium-review.googlesource.com/441744
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43147}
2017-02-13 10:06:48 +00:00
ahaas
94c9a4fafd [fuzzer] Format README.md
NOTRY=true
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2692443002
Cr-Original-Commit-Position: refs/heads/master@{#43138}
Committed: a3de4726c3
Review-Url: https://codereview.chromium.org/2692443002
Cr-Commit-Position: refs/heads/master@{#43140}
2017-02-13 08:42:26 +00:00
ahaas
68bcaf9be3 Revert of [fuzzer] Format README.md (patchset #2 id:20001 of https://codereview.chromium.org/2692443002/ )
Reason for revert:
Found another mistake

Original issue's description:
> [fuzzer] Format README.md
>
> NOTRY=true
> R=hablich@chromium.org
>
> Review-Url: https://codereview.chromium.org/2692443002
> Cr-Commit-Position: refs/heads/master@{#43138}
> Committed: a3de4726c3

TBR=hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2693863002
Cr-Commit-Position: refs/heads/master@{#43139}
2017-02-13 08:39:55 +00:00
ahaas
a3de4726c3 [fuzzer] Format README.md
NOTRY=true
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2692443002
Cr-Commit-Position: refs/heads/master@{#43138}
2017-02-13 08:37:47 +00:00
bmeurer
1a2362089c [es2015] Remove the @@hasInstance protector cell.
We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
TBR=ulan@chromium.org
BUG=v8:5958

Review-Url: https://codereview.chromium.org/2684033012
Cr-Commit-Position: refs/heads/master@{#43137}
2017-02-13 07:16:27 +00:00
littledan
4530f0dc0c Revert of [typedarrays] move %TypedArray%.prototype.copyWithin to C++ (patchset #6 id:100001 of https://codereview.chromium.org/2671233002/ )
Reason for revert:
Due to security issue described in review thread.

Original issue's description:
> [typedarrays] move %TypedArray%.prototype.copyWithin to C++
>
> - Removes shared InnerArrayCopyWithin JS builtin from src/js/array.js
> - Implements %TypedArray%.prototype.copyWithin as a C++ builtin, which
> relies on std::memmove rather than accessing individual eleements.
> - Fixes the case where copyWithin is invoked on a TypedArray with a
> detached buffer.
> - Add tests to ensure that +/-Infinity (for all 3 parameters) is handled correctly by the
> algorithm
>
> The C++ version gets through the benchmark more than 25000 times as
> quickly as the JS implementation.
>
> BUG=v8:5925, v8:5929, v8:4648
> R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org
>
> Review-Url: https://codereview.chromium.org/2671233002
> Cr-Commit-Position: refs/heads/master@{#42975}
> Committed: 0f1c626d55

TBR=cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org,cwhan.tunz@gmail.com,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5925, v8:5929, v8:4648

Review-Url: https://codereview.chromium.org/2693753002
Cr-Commit-Position: refs/heads/master@{#43132}
2017-02-12 21:16:18 +00:00
cwhan.tunz
48dff523f7 Throw when a holey property is set in Array.sort
Do not allow that holey properties are defined in Array sort.
Throw a type error if the array is not extensible and there are holey
properties in the middle of the array.

BUG=v8:4888

Review-Url: https://codereview.chromium.org/2664173002
Cr-Commit-Position: refs/heads/master@{#43126}
2017-02-11 13:00:40 +00:00
Ross McIlroy
96009d28dc [Compiler] Avoid stepping a job in EnqueueAndStep if job is already enqueued.
If a job was already enqueued, EnqueueAndStep would still step the job one
more step. However, since it didn't take the job out of the
pending_background_jobs pool, the job could get picked up by a background
thread which would try to step it, but it the job is now at a step which
can't be run on the background.

BUG=v8:5203,chromium:685515

Change-Id: I2cee2a33625ba455aca49a8037601be9ff8bb73f
Reviewed-on: https://chromium-review.googlesource.com/441084
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43121}
2017-02-10 22:40:24 +00:00
jwolfe
9675811a60 Heuristic for eager parsing works for async functions
The heuristic checks for "(function", and now it also checks for
"(async function".

BUG=v8:4230

Review-Url: https://codereview.chromium.org/2682173005
Cr-Commit-Position: refs/heads/master@{#43120}
2017-02-10 20:55:57 +00:00
littledan
91b79fb789 test262 roll
This roll includes the SharedArrayBuffer tests (skipping for now)
but doesn't include the $ renaming.

This is a reland; previously, I reverted because I was confused about why
the rename of $ to $262 didn't break tests; it now seems that the
previous patch left it as an alias. This patch does not do the renaming
yet, as the renaming usage has not landed upstream yet.

R=adamk

Review-Url: https://codereview.chromium.org/2685603003
Cr-Commit-Position: refs/heads/master@{#43118}
2017-02-10 19:05:55 +00:00
rmcilroy
53c11006e5 [Compiler] Avoid blocking on inner function parallel compilation.
Don't block on inner function compilation before competing outer function
compilation. Instead wait for the compilation to complete when the function
is called.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2686673002
Cr-Commit-Position: refs/heads/master@{#43116}
2017-02-10 18:46:31 +00:00
Leszek Swirski
2bfd8a7cb7 [ignition] Remove handles from bytecode generation
Removes handles from bytecode generation, instead storing
un-internalized AstValues (and other, similar values such as Scopes and
AstRawStrings) in the constant array builder.

This will allow us in the future to generate the bytecode before
internalizing the AST.

BUG=v8:5832

Change-Id: I3b8be8f7329a484eb1e5d12808b001d3475239da
Reviewed-on: https://chromium-review.googlesource.com/439326
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43115}
2017-02-10 17:52:39 +00:00
yangguo
588ed4b3c4 [debugger] expose side-effect free evaluate to inspector.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2685483002
Cr-Original-Commit-Position: refs/heads/master@{#43049}
Committed: 1a989bdeef
Review-Url: https://codereview.chromium.org/2685483002
Cr-Commit-Position: refs/heads/master@{#43114}
2017-02-10 17:06:22 +00:00
rmcilroy
10e628eb1f [Compiler] Ensure we enter the correct context for compiler-dispatcher jobs.
When running main-thread compiler-dispatcher jobs, ensure that we enter the
correct Context. Also adds a test for compiling an extension in the compiler
dispatcher to ensure that idle tasks enter the correct context before
finalizing the compilation.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2679193004
Cr-Commit-Position: refs/heads/master@{#43111}
2017-02-10 16:01:38 +00:00
jarin
36ed494784 Count closures using the feedback vector cell map, specialize if count==1.
This introduces new maps to track whether we have created at most one
closure. If we have created just one closure, Turbofan will
specialize the code to its context.

Review-Url: https://codereview.chromium.org/2680313002
Cr-Commit-Position: refs/heads/master@{#43108}
2017-02-10 15:19:19 +00:00
rmcilroy
0a9d4a3b0c Reland: [Compiler] Enable handles created during parsing and scope analysis to be deferred.
In order to compile eager inner functions on a background thread we need to
keep the handles created during parsing and scope analysis alive until the
background compilation is complete. In order to do that, we allocate the
handles in a deferred handle scope and keep the deferred handles alive with
a shared_ptr in the ParseInfo and CompileInfo respectively.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2650883002
Cr-Commit-Position: refs/heads/master@{#43107}
2017-02-10 15:01:29 +00:00
Marja Hölttä
bfd65a54fa [parser] Skipping inner funcs: produce the same scopes / variables for parameters (part 2).
This CL covers simple ("simple") rest param cases.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I254c2eb81d759eb2ea2a3d5e7c46bcdc2ccef707
Reviewed-on: https://chromium-review.googlesource.com/440984
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43106}
2017-02-10 14:59:59 +00:00
rmcilroy
e8422597a8 Revert of [arm64] A shift of 0 is not allowed in ubfx. (patchset #2 id:20001 of https://codereview.chromium.org/2685943003/ )
Reason for revert:
Reverting due to causing Word64AndWithImmediateWithWord64Sh to fail locally (but not on the bot).

BUG=v8:5956

Original issue's description:
> [arm64] A shift of 0 is not allowed in ubfx.
>
> R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com
> BUG=v8:5951
>
> Review-Url: https://codereview.chromium.org/2685943003
> Cr-Commit-Position: refs/heads/master@{#43090}
> Committed: c46ccef921

TBR=bmeurer@chromium.org,v8-arm-ports@googlegroups.com,martyn.capewell@arm.com,ahaas@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5951

Review-Url: https://codereview.chromium.org/2687373002
Cr-Commit-Position: refs/heads/master@{#43105}
2017-02-10 14:54:25 +00:00
caitp
39642fa2be [async-await] (simpler) fix for Return in try/finally in async functions
Alternative approach to https://codereview.chromium.org/2667983004/, which
does not depend on implicit control flow changes from
https://codereview.chromium.org/2664083002

- Remove handling for `async function` from Parser::RewriteReturn(). This functionality
is moved to BytecodeGenerator::BuildAsyncReturn(). This ensures that promise resolution
is deferred until all finally blocks are evaluated fully.

- Add a new deferred command (CMD_ASYNC_RETURN), which instructs ControlScope to
generate return code using BuildAsyncReturn rather than BuildReturn.

- Parser has a new `NewReturnStatement()` helper which determines what type of return
statement to generate based on the type of function.

BUG=v8:5896, v8:4483
R=littledan@chromium.org, neis@chromium.org, rmcilroy@chromium.org, adamk@chromium.org, gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2685683002
Cr-Commit-Position: refs/heads/master@{#43104}
2017-02-10 14:38:58 +00:00
mlippautz
504d0e5979 [heap] Fix address space leak in Unmapper
BUG=v8:5945

Review-Url: https://codereview.chromium.org/2689683002
Cr-Commit-Position: refs/heads/master@{#43102}
2017-02-10 14:26:04 +00:00
mstarzinger
6c12d57ead [crankshaft] Fix Smi overflow in {HMaybeGrowElements}.
This fixes the case where the index passed to {HMaybeGrowElements} used
to derive the new capacity for the elements backing store does not fit
into Smi range. Such an overflow would fail the capacity check and cause
growing to be skipped. Subsequent keyed stores would potentially go out
of bounds.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-686427
BUG=chromium:686427

Review-Url: https://codereview.chromium.org/2686263002
Cr-Commit-Position: refs/heads/master@{#43101}
2017-02-10 14:20:55 +00:00
neis
6d1c114c72 [test] Add some more tests for top-level maybe-assigned.
Also make them use the helpers that I introduced recently.

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2684343004
Cr-Commit-Position: refs/heads/master@{#43100}
2017-02-10 13:48:33 +00:00
neis
a450d3aea2 [parsing] Fix maybe-assigned for top-level class declarations.
Move the logic into Scope::DeclareVariable to be more robust.

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2685293003
Cr-Commit-Position: refs/heads/master@{#43098}
2017-02-10 13:24:49 +00:00
jgruber
fc1af41dad Disable flaky generators-debug-scopes test
This test is flaky when run with --optimize-for-size.

BUG=v8:5950

Review-Url: https://codereview.chromium.org/2689603003
Cr-Commit-Position: refs/heads/master@{#43097}
2017-02-10 13:23:30 +00:00
ahaas
79570f87a1 [wasm] Do not use setjmp/longjmp in cctests.
The use of setjmp/longjmp makes the cctests in test-run-wasm and
test-run-wasm-64 flaky on Windows, and I think that it is better not
to use it. With this CL I replace it as follows:

Similar to the setjmp/longjmp implementation we still call a C
function when a trap happens. However, instead of calling longjmp in
this C function we just set a flag which indicates that a trap
happened and then return. After we return from the C function we leave
the frame of the current wasm function and return with a RET
instruction. At the end of a test the wasm test runner checks the flag
to see if a trap happened.

Please take a special look at the LeaveFrame function on arm64.

R=titzer@chromium.org, clemensh@chromium.org, v8-arm-ports@googlegroups.com
CC=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2685583003
Cr-Commit-Position: refs/heads/master@{#43095}
2017-02-10 13:11:40 +00:00
rmcilroy
fa4f0347c1 Revert of [Compiler] Enable handles created during parsing and scope analysis to be deferred. (patchset #9 id:180001 of https://codereview.chromium.org/2650883002/ )
Reason for revert:
Issue on arm64:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim/builds/5752

Original issue's description:
> [Compiler] Enable handles created during parsing and scope analysis to be deferred.
>
> In order to compile eager inner functions on a background thread we need to
> keep the handles created during parsing and scope analysis alive until the
> background compilation is complete. In order to do that, we allocate the
> handles in a deferred handle scope and keep the deferred handles alive with
> a shared_ptr in the ParseInfo and CompileInfo respectively.
>
> BUG=v8:5203
>
> Review-Url: https://codereview.chromium.org/2650883002
> Cr-Commit-Position: refs/heads/master@{#43091}
> Committed: 9346cd9b4c

TBR=marja@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203

Review-Url: https://codereview.chromium.org/2687973003
Cr-Commit-Position: refs/heads/master@{#43093}
2017-02-10 12:30:26 +00:00
ahaas
fd8ef3b630 [fuzzer] Create a README for libfuzzer fuzzers.
NOTRY=true
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2688133002
Cr-Commit-Position: refs/heads/master@{#43092}
2017-02-10 12:13:09 +00:00
rmcilroy
9346cd9b4c [Compiler] Enable handles created during parsing and scope analysis to be deferred.
In order to compile eager inner functions on a background thread we need to
keep the handles created during parsing and scope analysis alive until the
background compilation is complete. In order to do that, we allocate the
handles in a deferred handle scope and keep the deferred handles alive with
a shared_ptr in the ParseInfo and CompileInfo respectively.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2650883002
Cr-Commit-Position: refs/heads/master@{#43091}
2017-02-10 11:46:13 +00:00
ahaas
c46ccef921 [arm64] A shift of 0 is not allowed in ubfx.
R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com
BUG=v8:5951

Review-Url: https://codereview.chromium.org/2685943003
Cr-Commit-Position: refs/heads/master@{#43090}
2017-02-10 10:16:29 +00:00
rmcilroy
1fc93f2e2d [Compiler] Enable use of seperate zones for parsing and compiling.
In order to allow parallel compilation of eager inner functions, we need to
seperate the zone used for parsing (which will be shared between all the
parallel compile jobs) and the zone used for compilation. This CL changes
CompilationInfo to require a zone (which can be different from the zone in
ParseInfo). We then seal the ParseInfo zone after parsing and analysis is done
to prevent any further allocation in that zone, so that it can be shared
(read-only) with the parallel compile jobs.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2645403002
Cr-Commit-Position: refs/heads/master@{#43089}
2017-02-10 09:55:22 +00:00
Peter Marshall
88df7dcaf4 [Test] Add TypedArray constructor benchmarks.
Add a simple benchmark for a TypedArray constructor. Run once with the
default pipeline and once with turbofan so that we can compare the
performance.

Also fixes a typo in the Regex for the result of the CopyWithin
benchmark which stopped the results showing up in the perf
dashboard.

BUG=

Change-Id: Ic2eb0bd1e02b458c1163e97130abd0e7531c2e1c
Reviewed-on: https://chromium-review.googlesource.com/440225
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43087}
2017-02-10 09:30:28 +00:00
Marja Hölttä
82e43bfed8 [parser] Skipping inner funcs: produce the same scopes / variables for parameters (part 1).
This CL covers only the very simple cases.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Ib6ddc90cbcf1c923a7b72493cfd029cfa835462b
Reviewed-on: https://chromium-review.googlesource.com/440246
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43086}
2017-02-10 09:18:40 +00:00
yangguo
8422e25bb2 [debugger] add precise mode for code coverage.
Collecting precise invocation counts need to be explicitly
enabled. Once enabled, we disable optimization (optimized
code does not increment invocation count, and may inline
callees), and make sure feedback vectors interesting for
code coverage is not garbage-collected.

R=hpayer@chromium.org, jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2686063002
Cr-Commit-Position: refs/heads/master@{#43082}
2017-02-10 08:21:03 +00:00
ishell
a4f4c74050 [runtime][ic] Constant field tracking support.
This CL includes runtime and IC parts of the tracking. It is controlled by
compile-time flag FLAG_constant_field_tracking and currently disabled.

Transition from kConst to kMutable still involves map deprecation.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2598543003
Cr-Commit-Position: refs/heads/master@{#43081}
2017-02-10 08:05:25 +00:00
yukishiino
d014b47fe5 Fixes Object::SetAccessor to return false if the prop is unconfigurable.
http://www.ecma-international.org/ecma-262/7.0/#sec-validateandapplypropertydescriptor
says that [[DefineProperty]] should return false if the property is
already defined and it's unconfigurable (exactly speaking, the condition
in the spec is more complicated, but roughly speaking, it's when the
property is unconfigurable).

BUG=chromium:670651

Review-Url: https://codereview.chromium.org/2680353004
Cr-Commit-Position: refs/heads/master@{#43080}
2017-02-10 05:56:00 +00:00
titzer
4f4da1f87d [wasm] Refactoring: move bytecode operands into wasm-decoder-impl.h
R=bradnelson@chromium.org,clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2682943007
Cr-Commit-Position: refs/heads/master@{#43077}
2017-02-10 01:16:37 +00:00
yangguo
058d7ab7f4 [debugger] implement per-function code coverage.
Collect code coverage from the available invocation counts.
The granularity is at function level, and invocation counts may
be lost to GC.

Coverage::Collect returns a std::vector of Coverage::ScriptData.
Each ScriptData contains a script ID and a std::vector of
Coverage::RangeEntry.
Each RangeEntry consists of a end position and the invocation
count. The start position is implicit from the end position of
the previous RangeEntry, or 0 if it's the first RangeEntry.

R=jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2689493002
Cr-Commit-Position: refs/heads/master@{#43072}
2017-02-09 19:00:49 +00:00
mstarzinger
eb5915b428 Fix test to not teach ClusterFuzz ugly tricks.
R=ishell@chromium.org
TEST=mjsunit/regress/regress-5902
BUG=chromium:688837

Review-Url: https://codereview.chromium.org/2682203003
Cr-Commit-Position: refs/heads/master@{#43068}
2017-02-09 16:46:06 +00:00
jgruber
b798b5212a [regexp] Update lastIndex semantics in RegExpBuiltinExec
Updated according to the recent spec change at
https://github.com/tc39/ecma262/pull/798.

BUG=v8:5949

Review-Url: https://codereview.chromium.org/2681323002
Cr-Commit-Position: refs/heads/master@{#43062}
2017-02-09 14:54:05 +00:00
yangguo
93c1e73d06 [debugger] extend whitelist for side-effect free debug-evaluate.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2680163005
Cr-Commit-Position: refs/heads/master@{#43061}
2017-02-09 14:40:29 +00:00
machenbach
3186653665 Revert of [debugger] expose side-effect free evaluate to inspector. (patchset #3 id:40001 of https://codereview.chromium.org/2685483002/ )
Reason for revert:
Speculative revert. Seems to block the roll:
https://codereview.chromium.org/2685933005/

Original issue's description:
> [debugger] expose side-effect free evaluate to inspector.
>
> R=jgruber@chromium.org, kozyatinskiy@chromium.org
> BUG=v8:5821
>
> Review-Url: https://codereview.chromium.org/2685483002
> Cr-Commit-Position: refs/heads/master@{#43049}
> Committed: 1a989bdeef

TBR=jgruber@chromium.org,kozyatinskiy@chromium.org,pfeldman@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2687013003
Cr-Commit-Position: refs/heads/master@{#43060}
2017-02-09 11:49:36 +00:00
yangguo
d0d4189dc0 [debugger] implement legacy debug event listeners via debug delegate.
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2682593003
Cr-Commit-Position: refs/heads/master@{#43059}
2017-02-09 11:31:48 +00:00
jgruber
1d3317ff05 [regexp] Ensure IrregexpExecRaw is passed a flat string
BUG=v8:5943

Review-Url: https://codereview.chromium.org/2681123002
Cr-Commit-Position: refs/heads/master@{#43058}
2017-02-09 11:24:08 +00:00
Marja Hölttä
e425079b1d [iwyu] Remove include debug.h -> arguments.h
arguments.h is one of the headers including objects-inl.h. Files needing
objects-inl.h used to innocently pull in debug.h, so that needs to be fixed now
too.

BUG=v8:5294
R=mstarzinger@chromium.org

Change-Id: I8ce671c533ed757103ef9a3b0bf0a0509230fdd8
Reviewed-on: https://chromium-review.googlesource.com/439287
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43054}
2017-02-09 09:19:23 +00:00
bmeurer
cd9724d4b4 [turbofan] Utilize the fact that empty string is canonicalized.
Since the empty string is canonical HeapObject now, we can use
this fact to optimize

  - strict equality comparisons with the empty string to a
    simple ReferenceEqual operation, and
  - optimize ToBoolean to avoid instance type checks completely.

Drive-by-fix: Allow InternalizedString for Type::HeapConstant
in the type system. This is safe, since InternalizedStrings
can be compared to other heap constants by reference (except
for non-InternalizedStrings, which are excluded from the
HeapConstant type).

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2681273002
Cr-Commit-Position: refs/heads/master@{#43050}
2017-02-09 07:23:08 +00:00
yangguo
1a989bdeef [debugger] expose side-effect free evaluate to inspector.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2685483002
Cr-Commit-Position: refs/heads/master@{#43049}
2017-02-09 06:43:34 +00:00
titzer
fa7d1f8f75 [wasm] Accept version 0x1 binaries.
R=rossberg@chromium.org,bradnelson@chromium.org
BUG=chromium:575167, chromium:690281

Review-Url: https://codereview.chromium.org/2681993003
Cr-Commit-Position: refs/heads/master@{#43048}
2017-02-09 02:09:47 +00:00
Marja Hölttä
9b35d8f575 [parsing] Produce same Scopes in Parser and PreParser when the params are not simple.
E.g.,
{ function lazy_inner(b = somevar) { let somevar; } }

If we don't produce the same scopes, PreParser thinks that the unresolved
variable inside the default parameter resolves into the variable declared inside
the function. Thus, it's not correctly recorded as a free variable.

One part is already done by https://codereview.chromium.org/2638333002 . But at
the laziness boundary, we still produced different scopes.

Unlike previously thought, this is also needed for lazy inner function
correctness, not only for "preparser scope analysis" (ie., skipping inner
functions).

BUG=v8:5938

Change-Id: I047cd43ef16478bb0f18d1f114845e7d1ab8c5f2
Reviewed-on: https://chromium-review.googlesource.com/439345
Commit-Queue: Marja Hölttä <marja@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43044}
2017-02-08 17:14:30 +00:00
jbroman
c8910f3539 Clear pending message during Isolate::CancelScheduledExceptionFromTryCatch.
Without doing this, a JSMessageObject can be kept alive by the isolate, which
in turn keeps the context alive, until the message is cleared.

BUG=v8:5941

Review-Url: https://codereview.chromium.org/2675203005
Cr-Commit-Position: refs/heads/master@{#43043}
2017-02-08 16:12:59 +00:00
Peter Marshall
2237106ae2 [turbo] Reduce CallWithSpread where iteration is not observable.
Where the arguments have already been inlined, we can replace these
calls with a direct call. We have to make sure that the iteration over
the arguments is not observable.

Also factor out the large chunk of logic shared with
ReduceJSConstructWithSpread.

BUG=v8:5932

Change-Id: I6c4fac670028fbd8ca82c4474d4392231573bc49
Reviewed-on: https://chromium-review.googlesource.com/439329
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43039}
2017-02-08 14:17:59 +00:00
Jochen Eisinger
30224360c1 Cut down memory usage of array-functions-prototype-misc.js by 10x
It used to require >1GB of memory which leads to flaky test failures on
machines with less memory when executing multiple variants in parallel

R=cbruni@chromium.org,ulan@chromium.org
BUG=v8:5706

Change-Id: Id8c6f49cbfa51f2d443991c1493f225810efb18f
Reviewed-on: https://chromium-review.googlesource.com/439310
Commit-Queue: Camillo Bruni <cbruni@google.com>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43038}
2017-02-08 13:39:12 +00:00
Michael Achenbach
bbf32e83f0 [test] Skip slow test in stress mode
TBR=yangguo@chromium.org
NOTRY=true

Change-Id: I2138299e93f5790118d1b28ddf7f4c8219f5831d
Reviewed-on: https://chromium-review.googlesource.com/439564
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43037}
2017-02-08 12:52:34 +00:00
ahaas
ed6e28d2ad [arm64][turbofan] Fix add+shr for big shift values.
Arm64 compiles "x +_64 (y >> shift)" into a single instruction if
"shift" is a constant. The code generator expects that "shift" is a
32 bit constant. however, TurboFan can also pass in a 64 bit constant,
which caused a crash in the code generator.

With this CL we cast the constant of TurboFan to an int in the
instruction selector and thereby satisfy the assumption of the code
generator. This should be correct since the code generator anyways cast
the "shift" to an int5 or int6 eventually.

R=v8-arm-ports@googlegroups.com
BUG=v8:5923

Review-Url: https://codereview.chromium.org/2669203005
Cr-Commit-Position: refs/heads/master@{#43036}
2017-02-08 11:52:16 +00:00
franzih
0c137304e6 [runtime] Skip vector config for interceptors.
Do not preinitialize the feedback vector slot if
the lookup iterator is an interceptor, because it is not
guaranteed that the iterator has a PropertyCell.

If the HandlerConfiguration has a non-masking
intercepting setter,
the iterator does not have a valid PropertyCell.

BUG=chromium:656648

Review-Url: https://codereview.chromium.org/2674103002
Cr-Commit-Position: refs/heads/master@{#43034}
2017-02-08 11:49:58 +00:00
ishell@chromium.org
0190a00f96 [ic] Rename FeedbackSlotKind values to better reflect reality.
BUG=v8:5917

Change-Id: I9611ace4ba73f18cb90f95f9c81eeb19c74e06f4
Reviewed-on: https://chromium-review.googlesource.com/439327
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43032}
2017-02-08 10:49:58 +00:00
Marja Hölttä
8cbe27e7ae [parser] Turn off FLAG_lazy_inner_functions.
(Minimal change to support easy backmerging.)

BUG=v8:5938

Change-Id: Icad35c90d9c2451cd63a4ab7e495d9b5252da693
Reviewed-on: https://chromium-review.googlesource.com/439170
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43031}
2017-02-08 10:39:31 +00:00
Andreas Haas
59bb18867a [x64] Consider both operands when emitting the REX prefix for testb.
The testb instruction requires the REX prefix when either of its
operands uses a register with the high bit set. The existing code only
considered the register operand. In the test case the REX prefix was not
emitted because the testb instruction had the register operand RAX which
does not have the high bit set. The REX prefix was necessary though
because the memory operand used R8, which has the high bit set.

R=bmeurer@chromium.org
BUG=chromium:688876

Change-Id: Ib214bebbe75965664f2aea530e29afa95a54f44f
Reviewed-on: https://chromium-review.googlesource.com/439145
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43030}
2017-02-08 10:27:45 +00:00
jochen
72bad21c8b React immediately to memory pressure on foreground threads
R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2682033002
Cr-Commit-Position: refs/heads/master@{#43027}
2017-02-08 09:38:50 +00:00
yangguo
c78d7fa1ae Link type feedback vectors to the shared function info.
Previously, both type feedback vector and the shared function info
of a function points to the matching type feedback metadata. This
makes finding the shared function info of a type feedback vector
difficult.

Instead, we now point the type feeback vector to the shared function
info, and find the metadata through the shared function info.

Also remove the obsolete empty type feedback vector.

R=hpayer@chromium.org, mvstanton@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2672363002
Cr-Commit-Position: refs/heads/master@{#43026}
2017-02-08 08:33:33 +00:00
bmeurer
d9c091dd60 [turbofan] Remove for-in support from the AstGraphBuilder.
The AstGraphBuilder is used for asm.js only and for-in is not allowed in
valid asm.js, so we can just disable optimization for asm.js functions
that contain for-in loops. This way we only need to support for-in via
the BytecodeGraphBuilder in TurboFan now, which will make optimizations
way easier.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2679913004
Cr-Commit-Position: refs/heads/master@{#43024}
2017-02-08 06:41:42 +00:00
kozyatinskiy
56bf7dbdaf [inspector] support for nested scheduled breaks
In current implementation we don't support nested scheduled break at all. If one break was scheduled inside another and second one doesn't produce actual break (execution was in blackboxed code or no JavaScript was executed) then second one will clear first scheduled break even if any not blackboxed JavaScript will be executed later.

Ambiguous break reason is added for the case when we have more then one scheduled reason. "auxData" in this case contains object with array of { reason: reason, auxData: auxData } objects for each reason in 'reasons' property.

BUG=chromium:632405

Review-Url: https://codereview.chromium.org/2678313002
Cr-Commit-Position: refs/heads/master@{#43021}
2017-02-08 01:42:54 +00:00
littledan
4d7856d9ed Revert of test262 roll (patchset #1 id:1 of https://codereview.chromium.org/2681833003/ )
Reason for revert:
Oops, looks like the patch to change the name of $ to $262 isn't merged yet. Not sure why this didn't cause a bunch of failures--need to investigate. Reverting for now.

Original issue's description:
> test262 roll
>
> This patch changes tests right up until the SharedArrayBuffer
> tests.
>
> R=adamk
>
> Review-Url: https://codereview.chromium.org/2681833003
> Cr-Commit-Position: refs/heads/master@{#43019}
> Committed: 9588a0de5a

TBR=adamk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2683753003
Cr-Commit-Position: refs/heads/master@{#43020}
2017-02-07 23:33:08 +00:00
littledan
9588a0de5a test262 roll
This patch changes tests right up until the SharedArrayBuffer
tests.

R=adamk

Review-Url: https://codereview.chromium.org/2681833003
Cr-Commit-Position: refs/heads/master@{#43019}
2017-02-07 23:17:38 +00:00
kozyatinskiy
5870529de5 [inspector] introduced debug::GeneratorObject
- removed getGeneratorObjectLocation from debugger-script.js,
- one more step to remove all debugger context usages in inspector.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2678143002
Cr-Commit-Position: refs/heads/master@{#43018}
2017-02-07 23:09:02 +00:00
raphael.kubo.da.costa
e7b78ac229 Expose more %ArrayPrototype% functions to the public API.
In addition to Array.prototype.values() which is already exposed, Blink
needs access to entries(), forEach() and keys() to properly set the
corresponding functions in value iterators for WebIDL conformance.

Add a few new entries to NATIVE_CONTEXT_IMPORTED_FIELDS and expand
V8_INTRINSICS_LIST, as well as some API tests for all these new exposed
functions.

BUG=chromium:632935
R=caitp@igalia.com,jochen@chromium.org,verwaest@chromium.org,yukishiino@chromium.org

Review-Url: https://codereview.chromium.org/2670833008
Cr-Commit-Position: refs/heads/master@{#43017}
2017-02-07 21:42:06 +00:00
cbruni
029a145fdb [builtins] fix String.prototype.indexOf with negative indices
BUG=689078

Review-Url: https://codereview.chromium.org/2679173002
Cr-Commit-Position: refs/heads/master@{#43016}
2017-02-07 21:30:58 +00:00
hablich
395dfc073e Reland of land: [Parse] ParseInfo owns the parsing Zone. (patchset #1 id:1 of https://codereview.chromium.org/2683733002/ )
Reason for revert:
False alarm, bot hiccup

Original issue's description:
> Revert of Reland: [Parse] ParseInfo owns the parsing Zone. (patchset #7 id:140001 of https://codereview.chromium.org/2632123006/ )
>
> Reason for revert:
> Speculative revert because of revert needed for https://codereview.chromium.org/2632123006
>
> Original issue's description:
> > Reland: [Parse] ParseInfo owns the parsing Zone.
> >
> > Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
> > in preperation for enabling background compilation jobs for inner functions
> > share the AST in the outer-function's parse zone memory (read-only), with the
> > and zone being released when all compilation jobs have completed.
> >
> > BUG=v8:5203,v8:5215
> >
> > Review-Url: https://codereview.chromium.org/2632123006
> > Cr-Original-Commit-Position: refs/heads/master@{#42993}
> > Committed: 14fb337200
> > Review-Url: https://codereview.chromium.org/2632123006
> > Cr-Commit-Position: refs/heads/master@{#42996}
> > Committed: 9e7d5a6065
>
> TBR=marja@chromium.org,mstarzinger@chromium.org,ahaas@chromium.org,verwaest@chromium.org,rmcilroy@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:5203,v8:5215
>
> Review-Url: https://codereview.chromium.org/2683733002
> Cr-Commit-Position: refs/heads/master@{#43008}
> Committed: 9fe08ec067

TBR=marja@chromium.org,mstarzinger@chromium.org,ahaas@chromium.org,verwaest@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2679303003
Cr-Commit-Position: refs/heads/master@{#43015}
2017-02-07 20:46:47 +00:00
Michael Hablich
0e129692bd Revert "Revert "[parser/test] Simplify test-preparser/PreParserScopeAnalysis.""
This reverts commit 8ee52241e2.

Reason for revert: False alarm, bot hiccup

Original change's description:
> Revert "[parser/test] Simplify test-preparser/PreParserScopeAnalysis."
> 
> This reverts commit 4d8bde0cd6.
> 
> Reason for revert: needed for this revert: https://codereview.chromium.org/2679263002/
> 
> Original change's description:
> > [parser/test] Simplify test-preparser/PreParserScopeAnalysis.
> > 
> > BUG=v8:5516
> > R=​neis@chromium.org
> > 
> > Change-Id: Iabc8d942ffb8107c5284cc51654792a9e2872d0a
> > Reviewed-on: https://chromium-review.googlesource.com/439325
> > Commit-Queue: Marja Hölttä <marja@chromium.org>
> > Reviewed-by: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#43001}
> 
> TBR=marja@chromium.org,neis@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:5516
> 
> Change-Id: Ia205be1f43fc447119ccc00b16078a968c7b18d1
> Reviewed-on: https://chromium-review.googlesource.com/439147
> Commit-Queue: Michael Hablich <hablich@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43009}

TBR=marja@chromium.org,neis@chromium.org,hablich@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5516

Change-Id: Ie8f9ba2925b6b05a2945a9ce435c4c41205feddd
Reviewed-on: https://chromium-review.googlesource.com/439444
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43014}
2017-02-07 20:44:14 +00:00
hablich
5f9c89af70 Reland of [parsing] Fix maybe-assigned for loop variables. (patchset #1 id:1 of https://codereview.chromium.org/2679263002/ )
Reason for revert:
False alarm, bot hiccup

Original issue's description:
> Revert of [parsing] Fix maybe-assigned for loop variables. (patchset #3 id:40001 of https://codereview.chromium.org/2673403003/ )
>
> Reason for revert:
> Speculative revert because of https://codereview.chromium.org/2679163002/.
>
> Original issue's description:
> > [parsing] Fix maybe-assigned for loop variables.
> >
> > Due to hoisting, the value of a 'var'-declared variable may actually change even
> > if the code contains only the "initial" assignment, namely when that assignment
> > occurs inside a loop.  For example:
> >
> >   let i = 10;
> >   do { var x = i } while (i--):
> >
> > As a simple and very conservative approximation of this, we explicitly mark
> > as maybe-assigned any non-lexical variable whose "declaration" does not
> > syntactically occur in the function scope.  (In the example above, it
> > occurs in a block scope.)
> >
> > BUG=v8:5636
> >
> > Review-Url: https://codereview.chromium.org/2673403003
> > Cr-Commit-Position: refs/heads/master@{#42989}
> > Committed: a33fcd663b
>
> TBR=marja@chromium.org,adamk@chromium.org,neis@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:5636
>
> Review-Url: https://codereview.chromium.org/2679263002
> Cr-Commit-Position: refs/heads/master@{#43010}
> Committed: f3ae5ccf57

TBR=marja@chromium.org,adamk@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2686663002
Cr-Commit-Position: refs/heads/master@{#43013}
2017-02-07 20:43:17 +00:00
hablich
96e4f6145b Reland of Thread maybe-assigned through the bytecodes. (patchset #1 id:1 of https://codereview.chromium.org/2680923003/ )
Reason for revert:
False alarm, bot hiccup

Original issue's description:
> Revert of Thread maybe-assigned through the bytecodes. (patchset #5 id:80001 of https://codereview.chromium.org/2655733003/ )
>
> Reason for revert:
> needed for properly reverting f3ae5ccf57
>
> Original issue's description:
> > Thread maybe-assigned through the bytecodes.
> >
> > This introduces LoadImmutableContextSlot and LoadImmutableCurrentContextSlot
> > bytecodes, which are emitted when reading from never-assigned context slot.
> >
> > There is a subtlety here: the slot are not immutable, the meaning is
> > actually undefined-or-hole-or-immutable.
> >
> > Review-Url: https://codereview.chromium.org/2655733003
> > Cr-Commit-Position: refs/heads/master@{#43000}
> > Committed: 17c2dd3886
>
> TBR=rmcilroy@chromium.org,bmeurer@chromium.org,neis@chromium.org,jarin@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2680923003
> Cr-Commit-Position: refs/heads/master@{#43011}
> Committed: ece4e54a31

TBR=rmcilroy@chromium.org,bmeurer@chromium.org,neis@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2679953003
Cr-Commit-Position: refs/heads/master@{#43012}
2017-02-07 20:42:03 +00:00
hablich
ece4e54a31 Revert of Thread maybe-assigned through the bytecodes. (patchset #5 id:80001 of https://codereview.chromium.org/2655733003/ )
Reason for revert:
needed for properly reverting f3ae5ccf57

Original issue's description:
> Thread maybe-assigned through the bytecodes.
>
> This introduces LoadImmutableContextSlot and LoadImmutableCurrentContextSlot
> bytecodes, which are emitted when reading from never-assigned context slot.
>
> There is a subtlety here: the slot are not immutable, the meaning is
> actually undefined-or-hole-or-immutable.
>
> Review-Url: https://codereview.chromium.org/2655733003
> Cr-Commit-Position: refs/heads/master@{#43000}
> Committed: 17c2dd3886

TBR=rmcilroy@chromium.org,bmeurer@chromium.org,neis@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2680923003
Cr-Commit-Position: refs/heads/master@{#43011}
2017-02-07 20:19:24 +00:00
hablich
f3ae5ccf57 Revert of [parsing] Fix maybe-assigned for loop variables. (patchset #3 id:40001 of https://codereview.chromium.org/2673403003/ )
Reason for revert:
Speculative revert because of https://codereview.chromium.org/2679163002/.

Original issue's description:
> [parsing] Fix maybe-assigned for loop variables.
>
> Due to hoisting, the value of a 'var'-declared variable may actually change even
> if the code contains only the "initial" assignment, namely when that assignment
> occurs inside a loop.  For example:
>
>   let i = 10;
>   do { var x = i } while (i--):
>
> As a simple and very conservative approximation of this, we explicitly mark
> as maybe-assigned any non-lexical variable whose "declaration" does not
> syntactically occur in the function scope.  (In the example above, it
> occurs in a block scope.)
>
> BUG=v8:5636
>
> Review-Url: https://codereview.chromium.org/2673403003
> Cr-Commit-Position: refs/heads/master@{#42989}
> Committed: a33fcd663b

TBR=marja@chromium.org,adamk@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2679263002
Cr-Commit-Position: refs/heads/master@{#43010}
2017-02-07 19:40:24 +00:00
Michael Hablich
8ee52241e2 Revert "[parser/test] Simplify test-preparser/PreParserScopeAnalysis."
This reverts commit 4d8bde0cd6.

Reason for revert: needed for this revert: https://codereview.chromium.org/2679263002/

Original change's description:
> [parser/test] Simplify test-preparser/PreParserScopeAnalysis.
> 
> BUG=v8:5516
> R=​neis@chromium.org
> 
> Change-Id: Iabc8d942ffb8107c5284cc51654792a9e2872d0a
> Reviewed-on: https://chromium-review.googlesource.com/439325
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43001}

TBR=marja@chromium.org,neis@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5516

Change-Id: Ia205be1f43fc447119ccc00b16078a968c7b18d1
Reviewed-on: https://chromium-review.googlesource.com/439147
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43009}
2017-02-07 19:38:56 +00:00
hablich
9fe08ec067 Revert of Reland: [Parse] ParseInfo owns the parsing Zone. (patchset #7 id:140001 of https://codereview.chromium.org/2632123006/ )
Reason for revert:
Speculative revert because of revert needed for https://codereview.chromium.org/2632123006

Original issue's description:
> Reland: [Parse] ParseInfo owns the parsing Zone.
>
> Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
> in preperation for enabling background compilation jobs for inner functions
> share the AST in the outer-function's parse zone memory (read-only), with the
> and zone being released when all compilation jobs have completed.
>
> BUG=v8:5203,v8:5215
>
> Review-Url: https://codereview.chromium.org/2632123006
> Cr-Original-Commit-Position: refs/heads/master@{#42993}
> Committed: 14fb337200
> Review-Url: https://codereview.chromium.org/2632123006
> Cr-Commit-Position: refs/heads/master@{#42996}
> Committed: 9e7d5a6065

TBR=marja@chromium.org,mstarzinger@chromium.org,ahaas@chromium.org,verwaest@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2683733002
Cr-Commit-Position: refs/heads/master@{#43008}
2017-02-07 19:35:56 +00:00
cbruni
d0bccc9c6a [key] Fix for-in with trailing shadowing keys with dict-mode receiver
BUG=688307

Review-Url: https://codereview.chromium.org/2686513002
Cr-Commit-Position: refs/heads/master@{#43006}
2017-02-07 17:55:21 +00:00
bbudge
04568c5216 [Turbofan] Add more integer SIMD operations for ARM.
- Adds logical and arithmetic shifts for all integer types.
- Adds min and max for all integer types.
- Adds saturating add and subtract for small integer types.
- Removes lane operations from the MachineOperatorCache.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2668013003
Cr-Commit-Position: refs/heads/master@{#43005}
2017-02-07 17:33:37 +00:00
Peter Marshall
de700757ff [Test] Fix typo so that SixSpeed/SpreadLiteral/Babel is actually run.
BUG=v8:5940

Change-Id: Ibf4061244fbde2fabf2a13307a8f646258c9efc6
Reviewed-on: https://chromium-review.googlesource.com/439309
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43004}
2017-02-07 16:40:05 +00:00
ishell@chromium.org
878a3df75e Rename FeedbackVectorSlot[Kind] -> FeedbackSlot[Kind].
BUG=

Change-Id: I31b8da09f4728d55c2da91966edcad49528b554b
Reviewed-on: https://chromium-review.googlesource.com/439146
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43003}
2017-02-07 16:38:47 +00:00
Marja Hölttä
4d8bde0cd6 [parser/test] Simplify test-preparser/PreParserScopeAnalysis.
BUG=v8:5516
R=neis@chromium.org

Change-Id: Iabc8d942ffb8107c5284cc51654792a9e2872d0a
Reviewed-on: https://chromium-review.googlesource.com/439325
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43001}
2017-02-07 15:37:46 +00:00
jarin
17c2dd3886 Thread maybe-assigned through the bytecodes.
This introduces LoadImmutableContextSlot and LoadImmutableCurrentContextSlot
bytecodes, which are emitted when reading from never-assigned context slot.

There is a subtlety here: the slot are not immutable, the meaning is
actually undefined-or-hole-or-immutable.

Review-Url: https://codereview.chromium.org/2655733003
Cr-Commit-Position: refs/heads/master@{#43000}
2017-02-07 14:54:22 +00:00
ishell@chromium.org
32971301ea Rename TypeFeedbackVector to FeedbackVector.
... and TypeFeedbackMetadata to FeedbackMetadata.

BUG=

Change-Id: I2556d1c2a8f37b8cf3d532cc98d973b6dc7e9e6c
Reviewed-on: https://chromium-review.googlesource.com/439244
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42999}
2017-02-07 14:46:36 +00:00
franzih
3df821c24e [test] Make CHECK_EQ calls in cctest consistent.
Cleanup CHECK_EQ order and simplify CHECK_EQ(true/false).
Cleanup callorder for negative numbers
Cleanup callorder order for capital letter constants.
Cleanup callorder for test.x checks.

BUG=

Review-Url: https://codereview.chromium.org/2677183002
Cr-Commit-Position: refs/heads/master@{#42997}
2017-02-07 14:20:02 +00:00
rmcilroy
9e7d5a6065 Reland: [Parse] ParseInfo owns the parsing Zone.
Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
in preperation for enabling background compilation jobs for inner functions
share the AST in the outer-function's parse zone memory (read-only), with the
and zone being released when all compilation jobs have completed.

BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2632123006
Cr-Original-Commit-Position: refs/heads/master@{#42993}
Committed: 14fb337200
Review-Url: https://codereview.chromium.org/2632123006
Cr-Commit-Position: refs/heads/master@{#42996}
2017-02-07 14:04:43 +00:00
jochen
8f4c4233dc Revert of Reland: [Parse] ParseInfo owns the parsing Zone. (patchset #6 id:120001 of https://codereview.chromium.org/2632123006/ )
Reason for revert:
doesn't compile on ToT

Original issue's description:
> Reland: [Parse] ParseInfo owns the parsing Zone.
>
> Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
> in preperation for enabling background compilation jobs for inner functions
> share the AST in the outer-function's parse zone memory (read-only), with the
> and zone being released when all compilation jobs have completed.
>
> BUG=v8:5203,v8:5215
>
> Review-Url: https://codereview.chromium.org/2632123006
> Cr-Commit-Position: refs/heads/master@{#42993}
> Committed: 14fb337200

TBR=marja@chromium.org,mstarzinger@chromium.org,ahaas@chromium.org,verwaest@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2685543003
Cr-Commit-Position: refs/heads/master@{#42994}
2017-02-07 13:02:48 +00:00
rmcilroy
14fb337200 Reland: [Parse] ParseInfo owns the parsing Zone.
Moves ownership of the parsing Zone to ParseInfo with a shared_ptr. This is
in preperation for enabling background compilation jobs for inner functions
share the AST in the outer-function's parse zone memory (read-only), with the
and zone being released when all compilation jobs have completed.

BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2632123006
Cr-Commit-Position: refs/heads/master@{#42993}
2017-02-07 12:34:53 +00:00
neis
a33fcd663b [parsing] Fix maybe-assigned for loop variables.
Due to hoisting, the value of a 'var'-declared variable may actually change even
if the code contains only the "initial" assignment, namely when that assignment
occurs inside a loop.  For example:

  let i = 10;
  do { var x = i } while (i--):

As a simple and very conservative approximation of this, we explicitly mark
as maybe-assigned any non-lexical variable whose "declaration" does not
syntactically occur in the function scope.  (In the example above, it
occurs in a block scope.)

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2673403003
Cr-Commit-Position: refs/heads/master@{#42989}
2017-02-07 11:45:09 +00:00
petermarshall
bc6b87cf0d [Test] Add SixSpeed tests for spread literals.
This will give us a baseline for upcoming perf work.

BUG=v8:5940

Review-Url: https://codereview.chromium.org/2680763002
Cr-Commit-Position: refs/heads/master@{#42987}
2017-02-07 11:25:21 +00:00
marja
009e8b11e2 [parser/test] Move cctest/PreParserScopeAnalysis into a new file.
BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2683573002
Cr-Commit-Position: refs/heads/master@{#42986}
2017-02-07 10:11:01 +00:00
petermarshall
f4739ea863 [builtins] Fix crash on stack overflow in CheckSpreadAndPushToStack.
For x64, ia32 and x87 we would pop the return address before the stack
overflow check. This meant the stack couldn't be unwound properly if
it was going to overflow. This CL moves the pop of the return address
to after the stack overflow check.

Also adds a regression test to check that a RangeError is thrown.

BUG=689016

Review-Url: https://codereview.chromium.org/2681643004
Cr-Commit-Position: refs/heads/master@{#42984}
2017-02-07 09:58:19 +00:00
marja
44a381ad99 [parser] Skipping inner funcs: produce the same scopes / variables for this expressions.
BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2683563002
Cr-Commit-Position: refs/heads/master@{#42983}
2017-02-07 09:14:54 +00:00
ishell
ef4e2ab7bd [ic] Encode LoadGlobalIC's typeof mode in slot kind instead of code object's flags.
BUG=v8:5917

Review-Url: https://codereview.chromium.org/2673383002
Cr-Commit-Position: refs/heads/master@{#42982}
2017-02-07 09:03:16 +00:00
mstarzinger
e34f536620 [turbofan] Mark {JSCreate} as potentially throwing.
This correctly marks the {JSCreate} operator as potentially throwing,
since it might trigger a property access of the 'prototype' property
during instantiation. This is observable, can throw (not kNoThrow),
might have side-effects (not kNoWrite), or even trigger a lazy deopt
event (not kNoDeopt). The inlining logic has been adapted to wire up
control projections accordingly.

Note that this does not yet take care of the "after" frame-state which
is associated with the {JSCreate} node introduced by the inliner. We
still might re-evaluate the property access upon lazy deoptimization.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-5638
BUG=v8:5638

Review-Url: https://codereview.chromium.org/2671203003
Cr-Commit-Position: refs/heads/master@{#42981}
2017-02-07 09:00:18 +00:00
kozyatinskiy
6e17719e79 [inspector] introduced v8::debug::EntriesPreview for inspector
- entries preview available even if debugger agent is disabled,
- less deprecated mirrors usage in debugger-script.js
- no usage of debugger context - zero probability of leaking it.
- better test coverage.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,alph@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2672213002
Cr-Commit-Position: refs/heads/master@{#42978}
2017-02-07 07:46:21 +00:00
caitp
0f1c626d55 [typedarrays] move %TypedArray%.prototype.copyWithin to C++
- Removes shared InnerArrayCopyWithin JS builtin from src/js/array.js
- Implements %TypedArray%.prototype.copyWithin as a C++ builtin, which
relies on std::memmove rather than accessing individual eleements.
- Fixes the case where copyWithin is invoked on a TypedArray with a
detached buffer.
- Add tests to ensure that +/-Infinity (for all 3 parameters) is handled correctly by the
algorithm

The C++ version gets through the benchmark more than 25000 times as
quickly as the JS implementation.

BUG=v8:5925, v8:5929, v8:4648
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2671233002
Cr-Commit-Position: refs/heads/master@{#42975}
2017-02-06 17:45:14 +00:00
ahaas
7517e68202 [wasm] With possible nondeterminism the fuzzer should not check traps
The non-determinism of NaNs does not only affect the result of the test
function, it also affects the traps that are thrown.

R=titzer@chromium.org, eholk@chromium.org
BUG=v8:5924

Review-Url: https://codereview.chromium.org/2671813004
Cr-Commit-Position: refs/heads/master@{#42973}
2017-02-06 17:19:53 +00:00
franzih
a495fc92da [test] Cleanup CHECK_EQ order.
Keep the order in CHECK_EQ calls consistent as
(expected, actual).

Simplify CHECK_EQ(true, expected) to CHECK(expected) and
CHECK_EQ(false, expected) to CHECK(!expected).

BUG=

Review-Url: https://codereview.chromium.org/2677133002
Cr-Commit-Position: refs/heads/master@{#42964}
2017-02-06 12:51:53 +00:00
petermarshall
54a14005fd [Test] Update 'default' SixSpeed benchmark to use different processes.
The results are unreliable as-is, because es5 and es6 run in the same d8
process consecutively. The graph also shows a huge amount of noise,
which seems to be mostly resolved with this change.

Review-Url: https://codereview.chromium.org/2675263002
Cr-Commit-Position: refs/heads/master@{#42961}
2017-02-06 11:51:35 +00:00
petermarshall
d6f76908c8 [Test] Enable turbofan for spread call SixSpeed tests.
In preparation for more perf work in turbofan, so that we can actually
see the results on the graph.

BUG=v8:5932

Review-Url: https://codereview.chromium.org/2676263002
Cr-Commit-Position: refs/heads/master@{#42960}
2017-02-06 11:16:05 +00:00
jochen
b049d1a598 Ensure we align zone memory at 8 byte boundaries on all platforms
BUG=v8:5668
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2672203002
Cr-Commit-Position: refs/heads/master@{#42959}
2017-02-06 11:14:56 +00:00
marja
01c2b45560 [parser] Skipping inner funcs: produce the same scopes / variables for loops.
BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2673313003
Cr-Commit-Position: refs/heads/master@{#42957}
2017-02-06 10:40:00 +00:00
petermarshall
b69b24a2a2 [Test] Update all SixSpeed tests to run in separate processes.
BUG=v8:5922

Review-Url: https://codereview.chromium.org/2674873002
Cr-Commit-Position: refs/heads/master@{#42954}
2017-02-06 10:19:24 +00:00
mvstanton
aea3ce3df3 [TypeFeedbackVector] Root feedback vectors at function literal site.
TypeFeedbackVectors are strongly rooted by a closure. However, in modern
JavaScript closures are created and abandoned more freely. An important
closure may not be present in the root-set at time of garbage collection,
even though we've cached optimized code and use it regularly. For
example, consider leaf functions in an event dispatching system. They may
well be "hot," but tragically non-present when we collect the heap.

Until now, we've relied on a weak root to cache the feedback vector in
this case. Since there is no way to signal intent or relative importance,
this weak root is as susceptible to clearing as any other weak root at
garbage collection time.

Meanwhile, the feedback vector has become more important. All of our
ICs store their data there. Literal and regex boilerplates are stored there.
If we lose the vector, then we not only lose optimized code built from
it, we also lose the very feedback which allowed us to create that optimized
code. Therefore it's vital to express that dependency through the root
set.

This CL does this by creating a strong link to a feedback
vector at the instantiation site of the function closure.
This instantiation site is in the code and feedback vector
of the outer closure.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2674593003
Cr-Commit-Position: refs/heads/master@{#42953}
2017-02-06 10:18:05 +00:00
Michael Achenbach
f3aa32d971 [test] Skip flaky cpu-profiler tests.
BUG=v8:5193
NOTRY=true
TBR=alph@chromium.org,yangguo@chromium.org

Change-Id: I9740f4504c855d9526c7b6b446965996f7c50c0c
Reviewed-on: https://chromium-review.googlesource.com/438344
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42952}
2017-02-06 10:15:37 +00:00
jgruber
9576d08c92 [string] Don't tail-call into runtime with adaptor frames
TailCallRuntime currently does not seem to handle adaptor frames
correctly.

BUG=chromium:688690

Review-Url: https://codereview.chromium.org/2675133003
Cr-Commit-Position: refs/heads/master@{#42950}
2017-02-06 09:47:55 +00:00
ishell
52555c86b7 [ic] Encode [Keyed]StoreIC's language mode in slot kind instead of code object's flags.
BUG=v8:5917

Review-Url: https://codereview.chromium.org/2676583002
Cr-Commit-Position: refs/heads/master@{#42949}
2017-02-06 09:31:52 +00:00
hablich
a0b7db1b0c [Tests] Add microbenchmark for defaults
R=franzih@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2676773004
Cr-Commit-Position: refs/heads/master@{#42946}
2017-02-06 07:03:20 +00:00
caitp
d36f14a73d [tests] add microbenchmark for %TypedArray%.prototype.copyWithin
Add a simple microbenchmark for calling copyWithin on a moderately large
Float64Array with 10,000 elements.

BUG=v8:5925, v8:5929, v8:4648
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2676193002
Cr-Commit-Position: refs/heads/master@{#42944}
2017-02-06 04:20:09 +00:00
kozyatinskiy
7c79736019 Revert of [debugger] remove debugger statement support from FCG/CS. (patchset #5 id:80001 of https://codereview.chromium.org/2650193002/ )
Reason for revert:
Fails on chromium leak bot:
https://uberchromegw.corp.google.com/i/chromium.webkit/builders/WebKit%20Linux%20Trusty%20Leak/builds/2007

Original issue's description:
> [debugger] remove debugger statement support from FCG/CS.
>
>
> R=mstarzinger@chromium.org
>
> Review-Url: https://codereview.chromium.org/2650193002
> Cr-Commit-Position: refs/heads/master@{#42892}
> Committed: eef855a1dc

TBR=mstarzinger@chromium.org,yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2672823007
Cr-Commit-Position: refs/heads/master@{#42942}
2017-02-04 18:11:10 +00:00
franzih
29e8d49f56 [runtime] Fix use of attributes if intercepted.
The property details of a LookupIterator are not accessible,
if the iterator state is interceptor. Instead, use the
property attributes.

Fixes a crash in Node.js tests in Debug mode, see
c2c6ae52ea

BUG=

Review-Url: https://codereview.chromium.org/2675993002
Cr-Commit-Position: refs/heads/master@{#42941}
2017-02-04 16:30:05 +00:00
kozyatinskiy
39afa5af06 [inspector] fixed taskHeapSnapshot on pause
Blink uses access checks to be sure that objects from one context doesn't access objects in another. Heap profiler uses current context to call this checks, we need to be sure that current context is empty to allow heap profiler collect all objects without crash.

BUG=chromium:661223
R=alph@chromium.org,ulan@chromium.org

Review-Url: https://codereview.chromium.org/2669393002
Cr-Commit-Position: refs/heads/master@{#42939}
2017-02-04 01:21:58 +00:00
kozyatinskiy
6b6ed60155 [inspector] return meaningful error on Debug.setScriptSource for ES module
BUG=v8:1569
R=dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2669713002
Cr-Commit-Position: refs/heads/master@{#42935}
2017-02-03 22:10:04 +00:00
petermarshall
98ca77a0e1 [Test] Reconfigure SuperSpread benchmarks to run in separate processes.
BUG=v8:5922

Review-Url: https://codereview.chromium.org/2669223002
Cr-Commit-Position: refs/heads/master@{#42929}
2017-02-03 14:07:16 +00:00
bmeurer
c21d1281d9 [turbofan] Properly ensure that deoptimization is enabled.
We cannot optimize global proxy access unless deoptimization is enabled.

BUG=chromium:687990
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2675793002
Cr-Commit-Position: refs/heads/master@{#42928}
2017-02-03 14:06:06 +00:00
danno
5205b9db06 [builtins] TurboFan version of Array.prototype.forEach including fast path for FAST_ELEMENTS
BUG=v8:5269, v8:1956
LOG=N
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2663033003
Cr-Commit-Position: refs/heads/master@{#42926}
2017-02-03 13:16:19 +00:00
yangguo
b963cb2351 Add test case for built-in objects' property mode.
R=jgruber@chromium.org
BUG=v8:5902

Review-Url: https://codereview.chromium.org/2669423002
Cr-Commit-Position: refs/heads/master@{#42922}
2017-02-03 12:19:21 +00:00
ahaas
f3ae77ffe9 [wasm] Do not fold f32-to-f64 and f64-to-f32 conversions.
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2669753002
Cr-Commit-Position: refs/heads/master@{#42920}
2017-02-03 12:05:29 +00:00
ahaas
ac187c0323 [wasm] Refactor the non-determinism detection in the interpreter.
Apparently it happens quite easily that different NaNs are produced in
the interpreter than in the execution of the compiled code. This
non-determinism caused problems for the fuzzer which compares the
equality of the results of the interpreter and the compiled code.

I decided therefore to refactor the detection of non-determinism in the
interpreter. Instead of tracking whether potentially non-deterministic
NaNs were produced, I track now whether potentially non-deterministic
NaNs could have been observed. The only way the NaN non-determinism can
be observed is by observing the non-deterministic bit pattern of the
NaN. AFAICT the only way to observe the bit pattern is with a
I(32|64)_REINTERPRET_F(32|64) instruction or with a F(32|64)_STORE
followed by a load. Therefore I flag an execution as potentially
non-deterministic when either a NaN is reinterpreted to an int, or when
a NaN is stored to memory.

R=titzer@chromium.org, eholk@chromium.org
BUG=682180

Review-Url: https://codereview.chromium.org/2671803002
Cr-Commit-Position: refs/heads/master@{#42917}
2017-02-03 09:51:04 +00:00
tebbi
994d906ec3 [turbofan] fix wrong materialization of arguments object
R=jarin@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2664423003
Cr-Commit-Position: refs/heads/master@{#42916}
2017-02-03 09:25:16 +00:00
Andreas Haas
832ab45bf1 [wasm] Change the initial memory size in the fuzzer testcase
The wasm module we generate for the test case actually has an initial
memory size of 16. In the mjsunit test we generate, however, we set the
initial memory size to 32. This CL changes the initial memory size in
the mjsunit test now to 16.

R=eholk@chromium.org

Change-Id: I5d3a30a97c3b0ba3105a8cf17d4c088a8fb9c8b7
Reviewed-on: https://chromium-review.googlesource.com/436544
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42915}
2017-02-03 09:03:05 +00:00
marja
dec6112752 [parser] Skipping inner funcs: produce the same scopes / variables for sloppy block funcs.
BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2670633003
Cr-Commit-Position: refs/heads/master@{#42913}
2017-02-03 08:16:07 +00:00
kozyatinskiy
9c7da663f9 [inspector] added experimental is_module flag for script parsed events
This flag is true when compiled script is ES6 module.

BUG=v8:1569
R=dgozman@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2663973002
Cr-Commit-Position: refs/heads/master@{#42910}
2017-02-03 07:17:09 +00:00
marja
b04d1d0ec6 [parser] Skipping inner funcs: produce the same scopes / variables for (some) loops.
Turns out is_hidden is not the right condition for "scope should be present in
the preparse data". For now, replaced it with "is hidden leaf scope" (i.e.,
doesn't contain any non-hidden scopes). That's probably not the right condition
either; will be fixed once there's more data to decide what the right condition
is.

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2669163002
Cr-Commit-Position: refs/heads/master@{#42909}
2017-02-03 07:14:48 +00:00
kozyatinskiy
3a4f5fafe0 [inspector] V8DebuggerAgent cleanup
V8DebuggerAgentImpl::m_skipAllPaused is moved to V8Debugger.
V8DebuggerAgentImpl::didPaused doesn't return shouldBreak flag and called only when break is required and stack trace presented.
V8DebuggerAgentImpl doesn't store paused context.
Logic of conversion step-next at return into step-in is moved to debug.cc.

BUG=none
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2668763003
Cr-Commit-Position: refs/heads/master@{#42907}
2017-02-03 07:09:11 +00:00
titzer
a9b8a56758 [wasm] Implement polymorphic checking, matching the reference interpreter.
R=rossberg@chromium.org, bradnelson@chromium.org
BUG=chromium:682659

Review-Url: https://codereview.chromium.org/2670673002
Cr-Commit-Position: refs/heads/master@{#42904}
2017-02-02 23:06:21 +00:00
kozyatinskiy
a62322aadb [inspector] added missing test for console methods
- and removed ":" from the output of console.count without argument.

BUG=none
R=luoe@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2674583002
Cr-Commit-Position: refs/heads/master@{#42903}
2017-02-02 23:05:11 +00:00
ahaas
1b116567dd [wasm] Remove -0 -x = -x folding because of signalling NaNs.
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2662363003
Cr-Commit-Position: refs/heads/master@{#42902}
2017-02-02 22:34:52 +00:00
mtrofin
b0e58a9cee [turbofan] more regalloc fixes
BUG=v8:5911

Review-Url: https://codereview.chromium.org/2667963004
Cr-Commit-Position: refs/heads/master@{#42900}
2017-02-02 22:33:40 +00:00
yangguo
8ae463d736 [debugger] remove mirror cache and v8::Debug::GetMirror.
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2670823002
Cr-Commit-Position: refs/heads/master@{#42893}
2017-02-02 14:22:15 +00:00
yangguo
eef855a1dc [debugger] remove debugger statement support from FCG/CS.
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2650193002
Cr-Commit-Position: refs/heads/master@{#42892}
2017-02-02 14:21:03 +00:00
bmeurer
2baea747de [stubs] Remove obsolete CALL_IC code kind.
We don't need Code::CALL_IC for anything now that the CallICStub is
migrated and no longer hooks into the traditional IC system.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2669193002
Cr-Commit-Position: refs/heads/master@{#42890}
2017-02-02 13:33:26 +00:00
yangguo
c126d604c9 Skip crashing test on win64.
R=machenbach@chromium.org
BUG=v8:5920
NOTRY=true

Review-Url: https://codereview.chromium.org/2671713002
Cr-Commit-Position: refs/heads/master@{#42888}
2017-02-02 13:16:24 +00:00
yangguo
318b78d43c Add test to check for initial objects.
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2671703002
Cr-Commit-Position: refs/heads/master@{#42886}
2017-02-02 12:38:51 +00:00
jgruber
cb19ecd610 [string] Migrate String.prototype.{split,replace} to TF
BUG=

Review-Url: https://codereview.chromium.org/2663803002
Cr-Original-Commit-Position: refs/heads/master@{#42881}
Committed: 65ad1e35d9
Review-Url: https://codereview.chromium.org/2663803002
Cr-Commit-Position: refs/heads/master@{#42883}
2017-02-02 11:31:01 +00:00
machenbach
2517b79cd6 Revert of [string] Migrate String.prototype.{split,replace} to TF (patchset #12 id:220001 of https://codereview.chromium.org/2663803002/ )
Reason for revert:
Breaks win64 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/14967

Original issue's description:
> [string] Migrate String.prototype.{split,replace} to TF
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2663803002
> Cr-Commit-Position: refs/heads/master@{#42881}
> Committed: 65ad1e35d9

TBR=bmeurer@chromium.org,ishell@chromium.org,yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2671673003
Cr-Commit-Position: refs/heads/master@{#42882}
2017-02-02 11:10:26 +00:00
jgruber
65ad1e35d9 [string] Migrate String.prototype.{split,replace} to TF
BUG=

Review-Url: https://codereview.chromium.org/2663803002
Cr-Commit-Position: refs/heads/master@{#42881}
2017-02-02 10:09:10 +00:00
ahaas
864799d3eb [wasm] Decoding the names section should stop if there is a problem with locals.
First discovery by the names section fuzzer I think. During the decoding
of the names of locals only ok() of the outer decoder was checked, not
the ok() of the actual names section decoder.

R=tizer@chromium.org
BUG=chromium:684855

Review-Url: https://codereview.chromium.org/2648383007
Cr-Commit-Position: refs/heads/master@{#42880}
2017-02-02 08:38:34 +00:00
yangguo
d9399cc36b [debugger] account for inlined functions when stepping.
- Remove obsolete BreakLocatorType.
- Perform PrepareStepOnThrow after OnException event, in case stepping
  was scheduled in the exception event.
- Use frame count instead of frame pointer for stepping. Frame pointer
  is not reliable due to possible deopts.
- Consistently check for inlined functions in inlined frames.
- Use SharedFunctionInfo in FloodWithOneshot and EnsureDebugInfo.

R=jgruber@chromium.org
BUG=v8:5901

Review-Url: https://codereview.chromium.org/2664793002
Cr-Commit-Position: refs/heads/master@{#42878}
2017-02-02 07:31:09 +00:00
jbroman
591cc0b4cc ValueSerializer: Share string encoding code with String and RegExp objects.
This avoids the need to pull in the UTF-8 encoding code from the public API,
and allows it to take advantage of any supported way that i::String can be
encoded (one- or two-byte).

Backward compatibility is maintained, but this is the behavior beginning
with this version.

BUG=chromium:686159

Review-Url: https://codereview.chromium.org/2665653004
Cr-Commit-Position: refs/heads/master@{#42872}
2017-02-01 22:27:02 +00:00
binji
aa3422b671 [SAB] Fix crash in Atomics.wake w/ infinite count.
Also if the count is not specified, it should wake all waiters.

BUG=v8:4777

Review-Url: https://codereview.chromium.org/2659083004
Cr-Commit-Position: refs/heads/master@{#42871}
2017-02-01 21:47:22 +00:00
bbudge
b7df78f363 [ARM] Add Neon saturating add and subtract instructions.
- Adds vqadd.s/u, vqsub.s/u for all integer lane sizes.
- Refactors disassembler and simulator, using switches instead
of long if-else chains.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2649323012
Cr-Commit-Position: refs/heads/master@{#42865}
2017-02-01 18:56:28 +00:00
ahaas
dd51dd926e [wasm] Change the default lowering of stores.
The int64-lowering only lowered store instructions with a word64 store
representation. For all other stores the default lowering applied. The
default lowering replaces all input nodes with both their replacement
nodes, which can change the number of input nodes of the lowered node.

In WebAssembly there exist stores which take an I64 input and store it
with a different representation, e.g. I32. In TurboFan this translates
to a store node with word32 store representation and a word64 value
input. The default lowering replaces the word64 value input to become
two word32 value inputs, which makes the number of inputs of the store
node invalid. This CL discards the high word replacement of the value
input so that the number of input nodes of a store node does not change
in the default lowering.

R=titzer@chromium.org
CC=rossberg@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2668023004
Cr-Commit-Position: refs/heads/master@{#42860}
2017-02-01 16:27:12 +00:00
ishell
93f181b6b9 [ic] Introduce IsXyzIC() predicates.
This is a step towards encoding all the necessary information in
the feedback slot kind instead of storing it in the IC dispatcher's
code object flags.

BUG=v8:5849, v8:5917

Review-Url: https://codereview.chromium.org/2662113005
Cr-Commit-Position: refs/heads/master@{#42859}
2017-02-01 16:22:03 +00:00
neis
5020db7f9c [promises] Fix .arguments on builtin function.
Using .caller, one can get access to the internal function that invokes the
handler passed to Promise.prototype.then.  This internal function is a TF
builtin that was set up as non-native and without an argument adaptor.  As a
consequence of this, when accessing .arguments on it, the frame-walking logic in
the .arguments accessor thinks the number of arguments is -1 and we try to
allocate an array of size -1.

This CL marks the builtin function as native (making its .arguments be null),
along with a few others that may have been incorrect in the same way.

BUG=chromium:682349

Review-Url: https://codereview.chromium.org/2672453002
Cr-Commit-Position: refs/heads/master@{#42855}
2017-02-01 14:06:38 +00:00
bmeurer
58611d0115 [tools] Fix RegExp for ticksprocessor.
Properly attribute all builtins, bytecode handlers and other stubs to
the calling function unless --separate-ic is passed.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2668953002
Cr-Original-Commit-Position: refs/heads/master@{#42849}
Committed: 42011d2997
Review-Url: https://codereview.chromium.org/2668953002
Cr-Commit-Position: refs/heads/master@{#42852}
2017-02-01 12:32:53 +00:00
ahaas
3b2301650e [wasm] Do float constant folding if the origin is not wasm
I removed some constant folding optimizations for float instruction in
https://codereview.chromium.org/2647353007 because they were incorrect
if the input was a signalling NaN. Removing these optimizations, however
had an unexpectedly big impact on asm.js performance. With this CL I
restore the optimizations again when the source origin is not wasm. In
JavaScript signalling NaNs are not observable and therefore the
optimizations are correct.

R=titzer@chromium.org
BUG=chromium:686654

Review-Url: https://codereview.chromium.org/2666903002
Cr-Commit-Position: refs/heads/master@{#42850}
2017-02-01 11:51:59 +00:00
neis
68a8cb532e [turbofan] Mark loads of a module (from a module context) immutable.
This is sound because the slot never changes, and it enables optimization by
JSContextSpecialization.

R=mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2662093004
Cr-Commit-Position: refs/heads/master@{#42848}
2017-02-01 10:51:20 +00:00
petermarshall
cd85a88d78 [turbo] Rename CallFunction* JSOperators to Call*.
Review-Url: https://codereview.chromium.org/2666783007
Cr-Commit-Position: refs/heads/master@{#42847}
2017-02-01 10:45:10 +00:00
neis
ed3d888df6 [test] Remove bogus --crankshaft flag from a modules test.
The function being tested is forced to go through Turbofan anyway (since it references a module variable).

Adding --turbo explicitly just to make a check happy.

BUG=

Review-Url: https://codereview.chromium.org/2664393003
Cr-Commit-Position: refs/heads/master@{#42844}
2017-02-01 10:36:09 +00:00
jgruber
c67dc7e243 Store correct String.prototype map on the context
The String.prototype was altered after snapshot time (during
experimental natives setup), invalidating the stored map used for
fast-path checks.

BUG=

Review-Url: https://codereview.chromium.org/2663303003
Cr-Commit-Position: refs/heads/master@{#42842}
2017-02-01 09:29:50 +00:00
petermarshall
a7ba61fdb5 [Ignition] Rename New and NewWithSpread bytecodes.
Rename to Construct and ConstructWithSpread, to match the names of
the JSOperators used.

Unfortunately, I can't find a way for auto-formatting to stay happy unless we
change the indentation for the whole BYTECODE_LIST macro.

Review-Url: https://codereview.chromium.org/2663963003
Cr-Commit-Position: refs/heads/master@{#42840}
2017-02-01 09:04:04 +00:00
jgruber
d52ec9e6cf [regexp] Store named captures on the regexp result
This implements storing named captures on the regexp result object.
For instance, /(?<a>.)/u.exec("b") will return a result such that:

result.group.a  // "b"

https://tc39.github.io/proposal-regexp-named-groups/

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#42532}
Committed: 70000946eb
Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Original-Commit-Position: refs/heads/master@{#42570}
Committed: ee94fa11ed
Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Commit-Position: refs/heads/master@{#42676}
Committed: 8bf52534f6
Review-Url: https://codereview.chromium.org/2630233003
Cr-Commit-Position: refs/heads/master@{#42838}
2017-02-01 08:54:38 +00:00
jgruber
0c3a507b3a [heap] Fix GrowAndShrinkNewSpace heap test
BUG=

Review-Url: https://codereview.chromium.org/2659573002
Cr-Commit-Position: refs/heads/master@{#42837}
2017-02-01 08:20:31 +00:00
gsathya
d08fd93ba6 [ESnext] Disallow using new with import()
Throw a syntax error on "new import(1)"  expression. Adds a new error msg as well.

BUG=v8:5785

Review-Url: https://codereview.chromium.org/2661113002
Cr-Commit-Position: refs/heads/master@{#42827}
2017-02-01 00:32:34 +00:00
jwolfe
ea96fdec68 Enable --harmony-trailing-commas
Also updated some tests due to the change. The general pattern is when a
trailing comma is expected to cause a SyntaxError, an additional comma was
added.

BUG=v8:5051
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2638513002
Cr-Commit-Position: refs/heads/master@{#42826}
2017-01-31 23:30:57 +00:00
marja
639bf4aa9c [parser] Skipping inner funcs: add some more test cases which already pass.
BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2661173003
Cr-Commit-Position: refs/heads/master@{#42825}
2017-01-31 21:41:40 +00:00
marja
c03783f5f0 [parser] Skipping inner funcs: make preparser scope analysis test work w/ destructuring declarations.
If hidden scopes are ignored, the scopes and variable produced by the PreParser
already matched the scopes and variables produced by the Parser.

BUG=v8:5516
R=vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2663043003
Cr-Commit-Position: refs/heads/master@{#42824}
2017-01-31 21:08:48 +00:00
machenbach
c2e4eb29cc Revert of [wasm] include JS conformance tests in Wasm mjsunit tests (patchset #5 id:80001 of https://codereview.chromium.org/2660903003/ )
Reason for revert:
http://crbug.com/687279

Original issue's description:
> [wasm] include JS conformance tests in Wasm mjsunit tests
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2660903003
> Cr-Commit-Position: refs/heads/master@{#42821}
> Committed: eb9b5edffb

TBR=mtrofin@chromium.org,titzer@chromium.org,bradnelson@chromium.org,eholk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2663063005
Cr-Commit-Position: refs/heads/master@{#42823}
2017-01-31 19:59:30 +00:00
binji
bfcc65d675 [SAB] Handle non-numerics in Atomics.isLockFree
BUG=v8:4741

Review-Url: https://codereview.chromium.org/2658143003
Cr-Commit-Position: refs/heads/master@{#42822}
2017-01-31 19:33:46 +00:00
eholk
eb9b5edffb [wasm] include JS conformance tests in Wasm mjsunit tests
BUG=

Review-Url: https://codereview.chromium.org/2660903003
Cr-Commit-Position: refs/heads/master@{#42821}
2017-01-31 19:28:12 +00:00
gsathya
e791ded4cd [ESnext] Parse dynamic import expression
Rewrites import expression into a runtime call. Uses peekahead to
determine if parsing an import declaration or import expression.

The runtime call doesn't actually do the import yet, will be added in
follow on patch.

Adds a new --harmony-dynamic-import flag.

Adds a ignore_error_msg parameter to the test runner to ignore the
discrepancy in the error messages while parsing import expression with
parser and pre parser. This discrepancy will actually never happen in
real code.

BUG=v8:5785

Review-Url: https://codereview.chromium.org/2661933003
Cr-Commit-Position: refs/heads/master@{#42820}
2017-01-31 18:58:53 +00:00
marja
c41f5f2de6 [parser] Add more tests for preparser variable tracking.
BUG=v8:5501

Review-Url: https://codereview.chromium.org/2661233002
Cr-Commit-Position: refs/heads/master@{#42819}
2017-01-31 16:10:36 +00:00
neis
32842802b5 [ast/parsing] Pessimistically assume all top-level variables will be assigned.
A previous CL (https://codereview.chromium.org/2634123002) did that for
let-declared variables.  This CL also does it for var- and function-declared
variables.

BUG=v8:5636

Review-Url: https://codereview.chromium.org/2656753003
Cr-Commit-Position: refs/heads/master@{#42813}
2017-01-31 13:35:52 +00:00
petermarshall
bfc8dc12e9 Revert of [Test] Do a set number of runs to trigger optimisation for SuperSpread. (patchset #1 id:1 of https://codereview.chromium.org/2669523002/ )
Reason for revert:
Causes test timeouts.

Original issue's description:
> [Test] Do a set number of runs to trigger optimisation for SuperSpread.
>
> BUG=v8:5895
>
> Review-Url: https://codereview.chromium.org/2669523002
> Cr-Commit-Position: refs/heads/master@{#42811}
> Committed: d4c22c3084

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5895

Review-Url: https://codereview.chromium.org/2669553002
Cr-Commit-Position: refs/heads/master@{#42812}
2017-01-31 12:52:29 +00:00
petermarshall
d4c22c3084 [Test] Do a set number of runs to trigger optimisation for SuperSpread.
BUG=v8:5895

Review-Url: https://codereview.chromium.org/2669523002
Cr-Commit-Position: refs/heads/master@{#42811}
2017-01-31 09:51:01 +00:00
bmeurer
64eae6eff2 [turbofan] Remove over-restrictive DCHECKs.
The KeyedStoreMode that we get out of the FeedbackNexus doesn't
necessarily need to apply when we have "static knowledge" about
the receiver, i.e. when the receiver is a known JSTypedArray, but
the KEYED_STORE_IC has seen only JSArray instances so far. The
DCHECK was too restrictive in this case, since we can just ignore
the KEYED_STORE_IC mode (like we ignore the maps).

BUG=chromium:685050
R=ishell@chromium.org

Review-Url: https://codereview.chromium.org/2668643002
Cr-Commit-Position: refs/heads/master@{#42810}
2017-01-31 09:00:55 +00:00
bmeurer
68ae57ce1e [turbofan] Introduce ChangeTaggedToTaggedSigned operator.
We were missing a case for Tagged->TaggedSigned conversions when the
input type is known to be Type::SignedSmall.

BUG=chromium:687029
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2666863002
Cr-Commit-Position: refs/heads/master@{#42809}
2017-01-31 08:55:56 +00:00
bmeurer
b8df954993 [turbofan] Don't eliminate unused CheckFloat64Hole.
We cannot eliminate unused CheckFloat64Hole nodes, since loading from a
holey array can have side-effects, i.e. triggering getters in the
prototype chain.

R=mvstanton@chromium.org
BUG=chromium:686737

Review-Url: https://codereview.chromium.org/2665123002
Cr-Commit-Position: refs/heads/master@{#42806}
2017-01-31 08:30:55 +00:00
jkummerow
daad4319c9 Put ThinStrings behind a flag (off by default)
Review-Url: https://codereview.chromium.org/2663713002
Cr-Commit-Position: refs/heads/master@{#42804}
2017-01-31 06:41:14 +00:00
gdeepti
bc57081795 [wasm] Enable grow_memory tests on gc_stress
R=bradnelson@chromium.org, ahaas@chromium.org

BUG=5553

Review-Url: https://codereview.chromium.org/2662153002
Cr-Commit-Position: refs/heads/master@{#42801}
2017-01-31 02:12:45 +00:00
jbroman
6f1639ed16 ValueSerializer: Distinguish between 'undefined' and an absent property.
Dealing with this case requires a wire format change. It is possible that an
element can be absent even in an array where the dense format was chosen
(because the array initially had no holes), if the elements are modified while
they are being serialized. In this case, a new tag for the "hole" is emitted.

The logic to treat undefined in dense arrays as an absent property is restricted
to versions of the wire format that this tag did not exist.

BUG=chromium:686159,chromium:665820

Review-Url: https://codereview.chromium.org/2660093002
Cr-Original-Commit-Position: refs/heads/master@{#42784}
Committed: dc85f4c833
Review-Url: https://codereview.chromium.org/2660093002
Cr-Commit-Position: refs/heads/master@{#42800}
2017-01-31 01:54:26 +00:00
kozyatinskiy
d6db11fd18 [inspector] added test infrastructure and test for es6 modules
Test just checks that all basic features are working correctly with modules.

BUG=v8:1569
R=dgozman@chromium.org,alph@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2663743002
Cr-Commit-Position: refs/heads/master@{#42796}
2017-01-31 00:19:41 +00:00
gdeepti
3901e247b3 [wasm] Enable wasm imported memory tests on gc_stress
Issues with instance wrapper allocation and JS Api errata have been fixed over the last few weeks, test in the bug no longer fails - enabling tests for imported memory.

BUG=5683

R=bradnelson@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2666763002
Cr-Commit-Position: refs/heads/master@{#42795}
2017-01-30 23:48:52 +00:00
vogelheim
10bb974ec3 [scanner] Regression test for Utf-8 BOM handling (crbug.com/685618).
The existing unit test explicitly checked for this case, but was - under
the right circumstances - defeated by the optimization to not re-run the
whole position search if we were close enough.

BUG=chromium:685618

Review-Url: https://codereview.chromium.org/2663883002
Cr-Commit-Position: refs/heads/master@{#42794}
2017-01-30 23:21:03 +00:00
machenbach
b861a84009 Revert of ValueSerializer: Distinguish between 'undefined' and an absent property. (patchset #2 id:20001 of https://codereview.chromium.org/2660093002/ )
Reason for revert:
Seems to break layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13146

https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> ValueSerializer: Distinguish between 'undefined' and an absent property.
>
> Dealing with this case requires a wire format change. It is possible that an
> element can be absent even in an array where the dense format was chosen
> (because the array initially had no holes), if the elements are modified while
> they are being serialized. In this case, a new tag for the "hole" is emitted.
>
> The logic to treat undefined in dense arrays as an absent property is restricted
> to versions of the wire format that this tag did not exist.
>
> BUG=chromium:686159,chromium:665820
>
> Review-Url: https://codereview.chromium.org/2660093002
> Cr-Commit-Position: refs/heads/master@{#42784}
> Committed: dc85f4c833

TBR=jkummerow@chromium.org,jbroman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:686159,chromium:665820

Review-Url: https://codereview.chromium.org/2667553003
Cr-Commit-Position: refs/heads/master@{#42788}
2017-01-30 19:35:28 +00:00
jochen
d651ce314c Add a test for OptimizingCompileDispatcher::Flush's non-blocking behavior
R=mtrofin@chromium.org,verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2662883003
Cr-Commit-Position: refs/heads/master@{#42787}
2017-01-30 19:27:00 +00:00
jbroman
dc85f4c833 ValueSerializer: Distinguish between 'undefined' and an absent property.
Dealing with this case requires a wire format change. It is possible that an
element can be absent even in an array where the dense format was chosen
(because the array initially had no holes), if the elements are modified while
they are being serialized. In this case, a new tag for the "hole" is emitted.

The logic to treat undefined in dense arrays as an absent property is restricted
to versions of the wire format that this tag did not exist.

BUG=chromium:686159,chromium:665820

Review-Url: https://codereview.chromium.org/2660093002
Cr-Commit-Position: refs/heads/master@{#42784}
2017-01-30 18:43:38 +00:00
jkummerow
7438304229 ThinStrings: fix Factory::NewProperSubString
BUG=chromium:685504

Review-Url: https://codereview.chromium.org/2660823002
Cr-Commit-Position: refs/heads/master@{#42783}
2017-01-30 18:24:16 +00:00
jkummerow
9ea3e56bd9 ThinStrings: fix CodeStubAssembler::SubString
BUG=chromium:685965

Review-Url: https://codereview.chromium.org/2660123002
Cr-Commit-Position: refs/heads/master@{#42782}
2017-01-30 18:17:52 +00:00
gdeepti
930142e877 [wasm] Update table bounds when module is instantiated with a table import
When WebAssembly.Table initial size is greater than the declared initial size, table size references should be updated on instantiate for functions to be called at indices greater than the declared initial size.

R=bradnelson@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2661773002
Cr-Commit-Position: refs/heads/master@{#42781}
2017-01-30 18:10:32 +00:00
kozyatinskiy
3903817e0e [inspector] introduced memory size limit for console message storage
Without this CL we have only limit for amount of console messages and if user are dumping a huge messages we pretty soon run out of memory.
So let's introduce limit for memory consumption it would help chromium and Node.js as well.

BUG=chromium:671489
R=dgozman@chomium.org,alph@chromium.org, hpayer@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/2653293003
Cr-Commit-Position: refs/heads/master@{#42780}
2017-01-30 17:05:58 +00:00
jochen
1fc5ca85fc Fix --noopt to not optimize
BUG=v8:5904,chromium:639217
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2660103002
Cr-Commit-Position: refs/heads/master@{#42777}
2017-01-30 14:41:29 +00:00
petermarshall
f87ce44f52 [Test] Perform warmup first on SixSpeed super_spread benchmarks.
The graphs don't show any performance bump for
https://codereview.chromium.org/2659623002, which I do see a much better result for
locally. I suspect the function isn't being optimized in turbofan when the
benchmarks run. Maybe this warmup flag will trigger that.

BUG=v8:5895

Review-Url: https://codereview.chromium.org/2664783002
Cr-Commit-Position: refs/heads/master@{#42776}
2017-01-30 13:58:57 +00:00
mvstanton
93f05b64ae [TypeFeedbackVector] Combine the literals array and the feedback vector.
They have the same lifetime. It's a match!

Both structures are native context dependent and dealt with (creation,
clearing, gathering feedback) at the same time. By treating the spaces used
for literal boilerplates as feedback vector slots, we no longer have to keep
track of the materialized literal count elsewhere.

A follow-on CL removes even more parser infrastructure related to this count.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2655853010
Cr-Commit-Position: refs/heads/master@{#42771}
2017-01-30 12:31:35 +00:00
tebbi
8b6fa9d519 [turbofan] escape analysis reducer no longer confused by TypeGuards it introduced itself
R=bmeurer@chromium.org

BUG=chromium:682570

Review-Url: https://codereview.chromium.org/2664683003
Cr-Commit-Position: refs/heads/master@{#42769}
2017-01-30 11:51:22 +00:00
bmeurer
b912851650 [turbofan] Don't constant-fold ACCESSOR properties.
R=ishell@chromium.org
BUG=chromium:686102

Review-Url: https://codereview.chromium.org/2662793002
Cr-Commit-Position: refs/heads/master@{#42767}
2017-01-30 11:15:02 +00:00
petermarshall
409d018005 [turbofan] Reduce CallConstructWithSpread where iteration is not observable.
Where the arguments have already been inlined, we can replace these calls with a
direct call to construct. We have to make sure that the iteration over the arguments is not observable.

BUG=v8:5895

Review-Url: https://codereview.chromium.org/2659623002
Cr-Commit-Position: refs/heads/master@{#42765}
2017-01-30 10:29:05 +00:00
neis
5ed733737e [modules] Update a test and status file to reflect recent spec changes.
R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2657773006
Cr-Commit-Position: refs/heads/master@{#42763}
2017-01-30 09:41:15 +00:00
marja
0307bbb2a0 [parser] Skipping inner funcs: add tests for variables called "arguments"
These tests pass without further changes.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2654163008
Cr-Commit-Position: refs/heads/master@{#42762}
2017-01-30 09:09:38 +00:00
machenbach
a8638789c2 [test] Skip flaky test
BUG=v8:5906
NOTRY=true
TBR=binji@chromium.org

Review-Url: https://codereview.chromium.org/2659273002
Cr-Commit-Position: refs/heads/master@{#42759}
2017-01-29 12:52:05 +00:00
bradnelson
437735ed34 [wasm][asm.js] Make asm.js->wasm return a regular object.
Return a regular JSObject in the asm.js -> wasm case.

BUG=v8:5877
R=mtrofin@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2664493002
Cr-Commit-Position: refs/heads/master@{#42757}
2017-01-28 23:15:58 +00:00
jarin
6cd2d4ba41 [turbofan] Only use Tagged machine representation for tagged state values.
This avoids using kTaggedSigned and kTaggedPointer because the
semantic information of those type could be invalid in unreachable
code.

For example, SmiCheck(0.1) has representation TaggedSigned, but it is
later compiled to DeoptimizeUnless(ObjectIsSmi(0.1)) with the constant
0.1 directly connected to the uses. If the use is state-values, which
recorded the TaggedSigned representation of CheckSmi, the code
generator will be confused because it will see constant 0.1 that
claims to be TaggedSigned value.

BUG=chromium:675704

Review-Url: https://codereview.chromium.org/2656243004
Cr-Commit-Position: refs/heads/master@{#42756}
2017-01-28 17:25:46 +00:00
jbroman
bf511b426e ValueSerializer: Support efficiently reading and writing one-byte strings.
memcpy is faster than UTF-8 encoding/decoding. This yields 10-20% wins on
serializing and deserializing long ASCII strings, according to
blink_perf.bindings -- and these are already in a fast path where the entire
string is known to be ASCII (but this has to be checked). The win may be
larger for strings in Latin-1 but not ASCII (though I suspect this is an
uncommon case).

A change is also made to make ValueSerializerTest.EncodeTwoByteStringUsesPadding
survive wire format version number changes.

This is the first of a series of wire format changes from the previous Blink
format. The deserializer continues to be able to read the old format, but
Chromium M56 will no longer be able to read the messages written by this, in M58.

BUG=chromium:686159

Review-Url: https://codereview.chromium.org/2658793004
Cr-Commit-Position: refs/heads/master@{#42753}
2017-01-28 05:52:05 +00:00
binji
966355585b [d8] Use ValueSerializer for postMessage (instead of ad-hoc serializer)
Review-Url: https://codereview.chromium.org/2643723010
Cr-Commit-Position: refs/heads/master@{#42749}
2017-01-27 20:15:37 +00:00
marja
53667c89b0 [parser] Skipping inner funcs: produce correct data for var redeclarations.
This unifies the behavior of Scope::DeclareVariableName with
Scope::DeclareVariable.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2658063005
Cr-Commit-Position: refs/heads/master@{#42744}
2017-01-27 16:33:36 +00:00
ivica.bogosavljevic
2f728bd9a0 MIPS[64]: Prevent multiple instances of tests that require a lot of memory
Some tests require a lot of memory and they fail on buildbots if they run
in parallel with other tests of the same kind.
We try to limit this by disabling multiple vairants of the same tests,
assuming this would stop the failures in most of the cases.

BUG=

Review-Url: https://codereview.chromium.org/2653603002
Cr-Commit-Position: refs/heads/master@{#42741}
2017-01-27 14:15:59 +00:00
marja
92f36954bb [iwyu] Include handles.h less.
These headers only need forward declarations.

BUG=v8:5294

Review-Url: https://codereview.chromium.org/2654253002
Cr-Commit-Position: refs/heads/master@{#42740}
2017-01-27 13:53:13 +00:00
marja
2dac4588ee [parser] Skipping inner funcs: make basic variable declarations work.
BUG=v8:5516

Review-Url: https://codereview.chromium.org/2659053002
Cr-Commit-Position: refs/heads/master@{#42739}
2017-01-27 13:24:26 +00:00
tebbi
c1a43ff996 [turbofan] No longer ignore FrameState input to Call
R=mstarzinger@chromium.org

BUG=chromium:683566

Review-Url: https://codereview.chromium.org/2653953010
Cr-Commit-Position: refs/heads/master@{#42737}
2017-01-27 12:40:05 +00:00
bmeurer
b975441e77 [turbofan] Introduce dedicated StringIndexOf operator.
The StringIndexOf operation is pure on the JS level, but the actual stub
call must be in the effect chain later so that the Scheduler doesn't
place it inside some allocation region (The %StringIndexOf runtime
function may trigger a GC for string flattening).

BUG=chromium:685580
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2657243002
Cr-Commit-Position: refs/heads/master@{#42736}
2017-01-27 12:02:42 +00:00
ishell
c5644146bc [tests] Fix assertUnoptimized() when --deopt-every-n-times flag is used.
Basically, with --deopt-every-n-times flag all bets are off since
the functions can be optimized and deoptimized at any time.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2655263004
Cr-Commit-Position: refs/heads/master@{#42735}
2017-01-27 11:58:47 +00:00
danno
5344571580 Make enabling of CSA verifier a build-time flag
BUG=chromium:685561

Review-Url: https://codereview.chromium.org/2650273006
Cr-Commit-Position: refs/heads/master@{#42734}
2017-01-27 11:32:27 +00:00
danno
7046c14d35 [csa] Make argc parameter to CodeStubArguments constructor use ParameterMode
Review-Url: https://codereview.chromium.org/2661483002
Cr-Commit-Position: refs/heads/master@{#42733}
2017-01-27 11:20:07 +00:00
ishell
4a5446fb2b [tests] Make assertOptimized()/assertUnoptimized() great again.
The mentioned asserts did not work properly with interpreted and turbofanned functions.

To fix this issue %GetOptimizationStatus() now returns a set of flags instead of a single value.

This CL also adds more helper functions to mjsunit, like isNeverOptimize(), isAlwaysOptimize(),
isOptimized(fun), etc.

BUG=v8:5890

Review-Url: https://codereview.chromium.org/2654733004
Cr-Original-Commit-Position: refs/heads/master@{#42703}
Committed: d1ddec7857
Review-Url: https://codereview.chromium.org/2654733004
Cr-Commit-Position: refs/heads/master@{#42731}
2017-01-27 10:13:53 +00:00
clemensh
e29a2cd529 [wasm] Interpreter: Don't pause on invalid position
Always execute the implicit return if we fell off the function bytes.
This is not considered an additional "step" as it is not executing a
wasm instruction.
Otherwise, we might pause at an invalid position (one after the
function bytes).

R=titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2650293003
Cr-Commit-Position: refs/heads/master@{#42730}
2017-01-27 09:48:08 +00:00
clemensh
b7947f8cd7 [wasm] Add inspector test for stepping
This also fixes bugs found by the new test. It only tests stepping
inside of wasm code. Wasm to JS and vice versa will follow in another
CL.

R=yangguo@chromium.org, titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2651043004
Cr-Commit-Position: refs/heads/master@{#42729}
2017-01-27 08:50:50 +00:00
yangguo
3f47c63ded [liveedit] reimplement frame restarting.
Previously, when restarting a frame, we would rewrite all frames
between the debugger activation and the frame to restart to squash
them, and replace the return address with that of a builtin to
leave that rewritten frame, and restart the function by calling it.

We now simply remember the frame to drop to, and upon returning
from the debugger, we check whether to drop the frame, load the
new FP, and restart the function.

R=jgruber@chromium.org, mstarzinger@chromium.org
BUG=v8:5587

Review-Url: https://codereview.chromium.org/2636913002
Cr-Commit-Position: refs/heads/master@{#42725}
2017-01-27 07:31:03 +00:00
clemensh
c6663ef1c1 [inspector] Expose GetPossibleBreakpoints for wasm
and add an inspector test for it. Also test that a breakpoint can be
set on each reported position, and that it is also hit during
execution.
This CL also fixes two little things which were uncovered by the new
test.

R=yangguo@chromium.org, titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2655653003
Cr-Commit-Position: refs/heads/master@{#42722}
2017-01-27 07:20:09 +00:00
alph
c99c25a988 [profiler] Fix a memory leak of CodeEvent objects
BUG=v8:5753

Review-Url: https://codereview.chromium.org/2655963003
Cr-Commit-Position: refs/heads/master@{#42720}
2017-01-27 01:12:53 +00:00
ahaas
2a78f2980b [x64] Do not compact constants with attached reloc info.
Reloc info often means that the constant will be patched later, and for
this patching we have to make sure that there is enough space in the
code for the new value.

R=bmeurer@chromium.org, titzer@chromium.org, gdeepti@chromium.org
BUG=chromium:684407
TEST=cctest/test-assembler-x64/Regression684407

Review-Url: https://codereview.chromium.org/2655213003
Cr-Commit-Position: refs/heads/master@{#42719}
2017-01-27 00:34:42 +00:00
gdeepti
e6d13999fd [wasm] Memory buffer should be detached after Memory.Grow
Memory.Grow should detach the ArrayBuffer associated with the Mem object after Grow. Currently, when guard pages are enabled protection is changed to make more of the buffer accessible. This does not work for when the buffer should be detached after grow, because the memory object has a reference to the same buffer befor/after grow.

R=titzer@chromium.org, eholk@chromium.org

Review-Url: https://codereview.chromium.org/2653183003
Cr-Commit-Position: refs/heads/master@{#42717}
2017-01-26 22:15:59 +00:00
kozyatinskiy
adc42c3a82 [inspector] take into account inlined frames in ::HasNonBlackboxedFrameOnStack
BUG=v8:5842, chromium:583193
R=yangguo@chromium.org,dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2656743003
Cr-Commit-Position: refs/heads/master@{#42715}
2017-01-26 21:32:53 +00:00
kozyatinskiy
0ac7970a60 [inspector] don't ignore uncaught exception if at least 1 frame isn't blackboxed
- and fixed test.

BUG=v8:5842, chromium:583193
R=yangguo@chromium.org,dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2651683005
Cr-Commit-Position: refs/heads/master@{#42714}
2017-01-26 20:57:03 +00:00