Commit Graph

15700 Commits

Author SHA1 Message Date
Andreas Haas
6ad5ca59c9 [wasm] Check the result of Promise::Resolver
We check that if we do not get a result, or if we get a negative result,
then there has to be a scheduled exception.

R=clemensh@chromium.org
TEST=mjsunit/regress/wasm/regression-704127
BUG=chromium:704127

Change-Id: I3fef3cc02f685a9cbc3f10203e2a59b61b3702d5
Reviewed-on: https://chromium-review.googlesource.com/458282
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44144}
2017-03-27 12:06:41 +00:00
jgruber
80879b8c26 [regexp] Named capture support for callable replacements
This implements support for named captures in
RegExp.prototype[@@replace] for when the replaceValue is callable.

In that case, the result.groups object is passed to the replacer
function as the last argument.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2764343004
Cr-Commit-Position: refs/heads/master@{#44142}
2017-03-27 11:18:31 +00:00
Ross McIlroy
980448dfcd [Compiler] Remove CompileBaseline and three tier pipeline.
Since we no longer support the ignition-staging configuration 
any longer,  we can retire the three tier pipeline and the
CompileBaseline functionallity.

We still need support for JSFunction self healing due to
liveedit (which for --no-turbo might end up replacing a
forced Ignition function with a FCG function) - we can
remove this once we remove --no-turbo support.

BUG=v8:4280

Change-Id: I5482abd17785324654e022affd6bdb555b19b181
Reviewed-on: https://chromium-review.googlesource.com/452620
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44141}
2017-03-27 11:15:43 +00:00
Wiktor Garbacz
d5d43ae337 Make isolate explicit param of CompilationInfo ctor
A step towards removing isolate from ParseInfo.
Removing isolate from ParseInfo will make it easier to create and
execute parse tasks on background threads.

BUG=v8:6093

Change-Id: I25b23b3bf64502f84c28ce688ad2997c9665a069
Reviewed-on: https://chromium-review.googlesource.com/458003
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#44140}
2017-03-27 09:12:44 +00:00
Georg Neis
cb3174632e [test262] Update status file w.r.t. modules.
Bug: v8:1569, v8:5401
Change-Id: I6a223d20eb9e7e299712955a36c7b95762780604
Reviewed-on: https://chromium-review.googlesource.com/459601
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44138}
2017-03-27 06:58:54 +00:00
Sathya Gunasekaran
cd868618ea [parser] Use better error message to continue a non IterationStatement
BUG=v8:6142

Change-Id: Ia9dff3814fa9d802d94f1769d0f4b5db709a96df
Reviewed-on: https://chromium-review.googlesource.com/459436
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44133}
2017-03-25 22:04:15 +00:00
kschimpf
98ed1f9ca9 Hide WasmModule.origin field behind readable accessors.
Besides adding accessors get_origin() and set_origin(), it creates easier test
accessors is_wasm() and is_asm_js().

This allows the possibility of caching boolean flags for is_wasm() and
is_asm_js() without having to change any code except for the files containing
the class definition for WasmModule.

BUG= v8:6152
R=bbudge@chromium.org,mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2771803005
Cr-Commit-Position: refs/heads/master@{#44130}
2017-03-25 01:54:09 +00:00
loorongjie
a1f2239e0b Move Oddball/String to %Typearray%.prototype.fill fast path
ToNumber for Oddball/String has no side-effect, no need to go
through %Typearray%.prototype.fill slow path.

BUG=v8:5929,chromium:702902

Review-Url: https://codereview.chromium.org/2769673002
Cr-Commit-Position: refs/heads/master@{#44129}
2017-03-24 22:43:35 +00:00
kozyatinskiy
2beb56137f [inspector] exposed builtins for injected script source
Methods on Object can be overriden by user, we should be prepared.

BUG=chromium:595206
R=dgozman@chromium.org,luoe@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2772093002
Cr-Commit-Position: refs/heads/master@{#44128}
2017-03-24 22:08:35 +00:00
Adam Klein
efcf883eec Skip debug evaluate testing of Date.prototype.toLocale* on noi18n builds
TBR=yangguo@chromium.org

Change-Id: Iaed993ed1a61003e35bb40d1f9e0d78864979b2c
Reviewed-on: https://chromium-review.googlesource.com/459443
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44127}
2017-03-24 22:03:09 +00:00
mlippautz
79ac83e121 [heap] Enforce explicit MarkingState
Require the use of MarkingState when going through ObjectMarking
and friends.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2770253002
Cr-Commit-Position: refs/heads/master@{#44123}
2017-03-24 18:54:04 +00:00
kozyatinskiy
c72c90bc74 [inspector] run more tests with InspectorTest.setupInjectedScriptEnvironment
+ bonus: new version of get-properties.js test - good illustration of out progress in tests.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2774493002
Cr-Commit-Position: refs/heads/master@{#44121}
2017-03-24 18:43:22 +00:00
yangguo
f633c5f383 [debug] do not report unnecessary coverage data.
Only include function ranges for with non-0 counts or if the immediate outer function has non-0 count.

R=caseq@chromium.org, jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2764073004
Cr-Original-Commit-Position: refs/heads/master@{#44079}
Committed: a7577ede0b
Review-Url: https://codereview.chromium.org/2764073004
Cr-Commit-Position: refs/heads/master@{#44120}
2017-03-24 18:27:41 +00:00
Peter Marshall
14e01da1cf [builtins] Port TypedArrayConstructByArrayLike to CodeStubAssembler.
This helper is used directly when constructing from an object with
a length, as well as by ConstructByIterable and ByTypedArray.

BUG=v8:5977

Change-Id: I18a4829c2a22a6099cf3b0824ea1f698bfbf1917
Reviewed-on: https://chromium-review.googlesource.com/456707
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44116}
2017-03-24 17:40:22 +00:00
mvstanton
7e08a77deb [JSPerfTests] New tests for Array.prototype.filter and map.
BUG=

Review-Url: https://codereview.chromium.org/2769973005
Cr-Commit-Position: refs/heads/master@{#44115}
2017-03-24 17:39:34 +00:00
kozyatinskiy
6c2215325e [inspector] better isArrayLike for injected-script-source.js
We should never check existing of the property by typeof obj.name check.

BUG=chromium:693338
R=dgozman@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2767323002
Cr-Commit-Position: refs/heads/master@{#44113}
2017-03-24 17:38:20 +00:00
Toon Verwaest
885f0bc4a7 [csa] Support typed arrays in Has(Own)Property
BUG=chromium:703226

Change-Id: Ic71ae018c0090b2142f1d732bcf9c94c65e81f83
Reviewed-on: https://chromium-review.googlesource.com/458917
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44110}
2017-03-24 14:37:29 +00:00
Michael Starzinger
565829f580 [asm.js] Switch test coverage to --fast-validate-asm.
R=machenbach@chromium.org
BUG=v8:6127

Change-Id: I8681102a2eec42a55db8d98d2422faa69d4c193c
Reviewed-on: https://chromium-review.googlesource.com/459478
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44109}
2017-03-24 14:25:49 +00:00
Michael Achenbach
c9da660928 Revert "[asm.js] Switch test coverage to --fast-validate-asm."
This reverts commit 15898daf7c.

Reason for revert: Bunch of custom snapshot check failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/11887
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/13603

Original change's description:
> [asm.js] Switch test coverage to --fast-validate-asm.
> 
> R=​machenbach@chromium.org
> BUG=v8:6127
> 
> Change-Id: I65a6905e57ff47195503b37118c279d22f0baba0
> Reviewed-on: https://chromium-review.googlesource.com/459536
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44099}

TBR=bradnelson@chromium.org,machenbach@chromium.org,mstarzinger@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6127

Change-Id: Iecbd29d8ee31b49e553048c6f59670167cd22d9d
Reviewed-on: https://chromium-review.googlesource.com/459497
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44103}
2017-03-24 13:01:34 +00:00
Michael Starzinger
15898daf7c [asm.js] Switch test coverage to --fast-validate-asm.
R=machenbach@chromium.org
BUG=v8:6127

Change-Id: I65a6905e57ff47195503b37118c279d22f0baba0
Reviewed-on: https://chromium-review.googlesource.com/459536
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44099}
2017-03-24 12:23:26 +00:00
Michael Achenbach
dc00a1216f [test] Skip flaky test
Bug: v8:6132
NOTRY=true
TBR=jgruber@chromium.org,eholk@chromium.org

Change-Id: Idd706e5bb08f1890f6edc69792238114aadf220b
Reviewed-on: https://chromium-review.googlesource.com/459517
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44098}
2017-03-24 12:15:46 +00:00
Wiktor Garbacz
1ef7fcad8e Make isolate explicit param of DeclarationScope
A step towards removing isolate from ParseInfo.
Removing isolate from ParseInfo will make it easier to create and
execute parse tasks on background threads.

BUG=v8:6093

Change-Id: Iefd2fd01a700509f05d6f1a272cfa39cc545d39b
Reviewed-on: https://chromium-review.googlesource.com/458001
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#44096}
2017-03-24 11:53:14 +00:00
tebbi
0cfd2febce [turbofan] escape analysis: revisit of uses afer FinishRegion marked as escaped
BUG=chromium:699251
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2766383003
Cr-Commit-Position: refs/heads/master@{#44095}
2017-03-24 11:21:07 +00:00
yangguo
f764a5c8c0 [debug] extend debug-evaluate by Map builtins.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2772853003
Cr-Commit-Position: refs/heads/master@{#44092}
2017-03-24 10:54:55 +00:00
Igor Sheludko
16c38aa820 [ic] Split StoreIC into StoreGlobalIC and StoreIC.
The former will handle stores to global variables, lets and undeclared
variables. The latter will handle named stores to explicit receiver.

BUG=chromium:576312, v8:5561

Change-Id: I335fa21db47c3d001da8cc79fa8cb6f8abcbb7e2
Reviewed-on: https://chromium-review.googlesource.com/458639
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44085}
2017-03-24 07:45:14 +00:00
bradnelson
083a8d7209 [wasm][asm.js] Asm.js -> wasm custom parser.
Add the --fast-validate-asm option, which directs asm.js code
to a new parser + validator + wasm code generator,
which is then compiled using WebAssembly.

This parser takes advantage of asm.js structure to linearly parse
asm.js code, keeping a scope stack + a few additional tables to track
varibles.

BUG=v8:6090
BUG=v8:4203

R=mstarzinger@chromium.org,marja@chromium.org,vogelheim@chromium.org,kschimpf@chromium.org

Review-Url: https://codereview.chromium.org/2757693003
Cr-Commit-Position: refs/heads/master@{#44084}
2017-03-24 05:53:50 +00:00
kozyatinskiy
249001b4e9 [inspector] use same schedulePauseOnNextStatement strategy for Debugger.pause
+ added a test.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2743163002
Cr-Commit-Position: refs/heads/master@{#44082}
2017-03-24 02:44:25 +00:00
kozyatinskiy
2629f811ea [inspector] Increased chances of successful InjectedScriptSource compilation
- added InspectorTest.setupInjectedScriptEnvironment method which mutates current context,
- clear prototype of InjectedScript function and domAttributesWithObservableSideEffectOnGet.

Second point increases chances that injected-script-source would be successfully compiled.

BUG=chromium:693338
R=dgozman@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2770823003
Cr-Commit-Position: refs/heads/master@{#44081}
2017-03-24 01:33:12 +00:00
machenbach
4e9ca1031d Revert of [debug] do not report unnecessary coverage data. (patchset #4 id:60001 of https://codereview.chromium.org/2764073004/ )
Reason for revert:
breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/14438

Original issue's description:
> [debug] do not report unnecessary coverage data.
>
> Only include function ranges for with non-0 counts or if the immediate outer function has non-0 count.
>
> R=caseq@chromium.org, jgruber@chromium.org
> BUG=v8:5808
>
> Review-Url: https://codereview.chromium.org/2764073004
> Cr-Commit-Position: refs/heads/master@{#44079}
> Committed: a7577ede0b

TBR=caseq@chromium.org,jgruber@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2769063004
Cr-Commit-Position: refs/heads/master@{#44080}
2017-03-23 21:03:22 +00:00
yangguo
a7577ede0b [debug] do not report unnecessary coverage data.
Only include function ranges for with non-0 counts or if the immediate outer function has non-0 count.

R=caseq@chromium.org, jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2764073004
Cr-Commit-Position: refs/heads/master@{#44079}
2017-03-23 20:07:32 +00:00
Bradley.Meck
b123ee3411 Allow global prototype to be a Proxy
There was a security issue from allowing WindowProxy to have its prototype mutated in https://bugs.chromium.org/p/chromium/issues/detail?id=399951 . This has since been resolved by making `window`, `location`, and `Object.prototype.__proto__` immutable. This change was fixed in https://bugs.chromium.org/p/v8/issues/detail?id=5149 .

Reverts https://codereview.chromium.org/1529303003

R=littledan@chromium.org
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2671553006
Cr-Commit-Position: refs/heads/master@{#44078}
2017-03-23 18:33:38 +00:00
skyostil
9b152fdafd Enable deterministic random number generation
This patch makes Math.random() behave deterministically when a fixed
random seed is provided. This is done by re-seeding the random number
generator the first time a script requests a random number. Doing this
ensures Math.random() returns the same sequence across page loads and
across iframes.

BUG=chromium:696001

Review-Url: https://codereview.chromium.org/2760393002
Cr-Commit-Position: refs/heads/master@{#44076}
2017-03-23 18:14:38 +00:00
binji
fb52f5c55c [SAB] Implement SharedArrayBuffer.prototype.slice
BUG=v8:5897

Review-Url: https://codereview.chromium.org/2741413006
Cr-Commit-Position: refs/heads/master@{#44075}
2017-03-23 18:13:24 +00:00
yangguo
d71ef941ed [debug] introduce precise binary code coverage.
With precise binary code coverage, the reported count is either 0 or 1.
We only report 1 the first time we collect coverage data after the
function has been executed.

Since we do not care about the accurate execution count, we can optimize
the function once it has been executed once.

Also change best effort coverage to be implicitly binary.

R=caseq@chromium.org, jgruber@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2766573003
Cr-Commit-Position: refs/heads/master@{#44074}
2017-03-23 17:23:17 +00:00
jgruber
8c0f2315fc [regexp] Rename result.group to result.groups
This is just an update to reflect the current spec proposal.
https://tc39.github.io/proposal-regexp-named-groups/

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2769143002
Cr-Commit-Position: refs/heads/master@{#44067}
2017-03-23 15:42:07 +00:00
kozyatinskiy
03179ab375 [inspector] fixed compilation with gyp
BUG=none
TBR=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2773723002
Cr-Commit-Position: refs/heads/master@{#44064}
2017-03-23 15:39:41 +00:00
Michael Starzinger
118f09f121 [asm.js] Widen test coverage to all of mjsunit.
R=machenbach@chromium.org
BUG=v8:6127

Change-Id: Iced2bd9e71006077aca4bd1de8dd14b6c771ec86
Reviewed-on: https://chromium-review.googlesource.com/458222
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44062}
2017-03-23 14:25:36 +00:00
Clemens Hammacher
b8f8860161 [wasm] [interpreter] Implement indirect function calls
This CL adds support for indirect function calls to the interpreter. It
can indirectly call other wasm function in the same instance, which are
then executed in the interpreter, or call imported functions.

Implementing this required some refactoring:
- The wasm interpreter now unwraps import wrappers on demand, instead
  of unwrapping all of them on instantiation and storing a vector of
  handles. This also avoids the DeferredHandleScope completely, instead
  we just store two global handles in the code map.
- The interpreter gets the code table, function tables and signature
  tables directly from the attached wasm instance object. This ensures
  that the interpreter sees all updates to tables that might have been
  performed by external code.
- There is now common functionality for calling a code object. This is
  used for direct calls to imported functions and for all indirect
  calls. As these code objects can also be wasm functions which should
  be executed in the interpreter itself, I introduce a struct to hold
  the outcome of calling the code object, or a pointer to
  InterpreterCode to be called in the interpreter.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: I20fb2ea007e79e5fcff9afb4b1ca31739ebcb83f
Reviewed-on: https://chromium-review.googlesource.com/458417
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44059}
2017-03-23 10:54:58 +00:00
Wiktor Garbacz
90d28637dc Remove isolate param from DeserializeScopeChain.
It was removed so that Parser::DeserializeScopeChain does not have
 to get it from ParseInfo.
Only a small step in direction of removing isolate from ParseInfo.

BUG=v8:6093

Change-Id: Iaaf92dc6eb5ec9c4efc05ac73666fbc66e0ed8c1
Reviewed-on: https://chromium-review.googlesource.com/457999
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44057}
2017-03-23 09:28:48 +00:00
Michael Starzinger
8aa3459f20 [asm.js] Add stress mode for the asm.js validator.
This adds a --stress-validate-asm flag intended to stress test the
validator by running against every single function, independent of
whether a "use asm" directive is present. It mainly tests negative
cases because barely any function in our test corpus will be a valid
module according to the asm.js spec.

R=bradnelson@chromium.org
BUG=v8:6127

Change-Id: Id04b0440628134d4e81c9bb4d71039f940fc9a83
Reviewed-on: https://chromium-review.googlesource.com/457039
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44055}
2017-03-23 08:54:05 +00:00
mtrofin
78905107d3 [wasm] Skeleton WasmModuleObjectBuilder for streamed compilation
APIs and trivial implementation, to unblock Chrome side dev.

BUG=chromium:697028

Review-Url: https://codereview.chromium.org/2763413003
Cr-Commit-Position: refs/heads/master@{#44053}
2017-03-23 01:47:17 +00:00
Caitlin Potter
ff1a155a22 [parser] allow patterns within left/right branches of ConditionalExpr
The AssignmentExpressions can legally contain destructuring assignments.

BUG=v8:6098
R=marja@chromium.org, adamk@chromium.org

Change-Id: I99b3a0f4c8d103edfb1dda943ec3e2ab2a5969f7
Reviewed-on: https://chromium-review.googlesource.com/455221
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44049}
2017-03-22 21:39:29 +00:00
kozyatinskiy
786c64e8eb [inspector] description for weak collections should not contain size
These JS objects don't have size property.

BUG=none
R=dgozman@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2770583002
Cr-Commit-Position: refs/heads/master@{#44048}
2017-03-22 21:35:14 +00:00
gdeepti
9d8d4dfa7d Add pshufw instruction, fix inconsistencies with pextrw instruction.
Current implementation of the pextrw instruction is the legacy SSE2 instruction in the assembler (66 0F C5), and SSE4 implementation(66 0F 3A 15) in disasm-x64.cc, this causes incorrect instruction encodings to be printed when using --print-code flag for debug, in this case, causes over flow of bytes, and subsequent instructions to be incorrectly disassembled. Fixing to use SSE4 encodings in the assembler cosistent with pextrb, pextrd.

R=bbudge@chromium.org, mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2771513002
Cr-Commit-Position: refs/heads/master@{#44047}
2017-03-22 20:49:27 +00:00
bbudge
2747ab31ef [WASM] Fix failing WASM SIMD tests.
- Skips test when expected value is very small or large.
- Renames methods to make more sense.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2764413003
Cr-Commit-Position: refs/heads/master@{#44045}
2017-03-22 19:18:47 +00:00
kozyatinskiy
69ad35ac6b [inspector] follow up for e27d18c943
- renamed inspector-test methods,
- tuned comment in debug.h

BUG=v8:6118
TBR=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2766283002
Cr-Commit-Position: refs/heads/master@{#44043}
2017-03-22 18:07:12 +00:00
Caitlin Potter
9377fd1a46 [async-iteration] implement parsing for AsyncGenerators
Just the front-end side of
https://chromium-review.googlesource.com/c/446961/. Adds support for
parsing AsyncGeneratorExpression, AsyncGeneratorDeclaration, and
AsyncGeneratorMethod, as well as parser tests.

BUG=v8:5855
R=neis@chromium.org, marja@chromium.org, littledan@chromium.org

Change-Id: I70e1a9681f22573f29292eacb4b9f57f9a38e2b2
Reviewed-on: https://chromium-review.googlesource.com/447117
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#44040}
2017-03-22 17:38:27 +00:00
kozyatinskiy
5f8c0a1396 [inspector] added flag for injected-script-source debugging
With flag we can debug injected-script-source in inspector-test or from DevTools frontend as regular user code. We need this when working on new features or debugging issues, it's for internal purpose only and doesn't provide any benefits for end users.

Flag: --expose-inspector-scripts

BUG=none
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2767873002
Cr-Commit-Position: refs/heads/master@{#44039}
2017-03-22 17:36:55 +00:00
Clemens Hammacher
a2807f2a2a [wasm] [asm.js] Store function start position also for init function
The stack check at the beginning of each function maps to the wasm byte
offset 0. For asm.js functions, this byte offset is mapped further to an
asm.js source position. For most functions, we explicitly add an entry
to this side table for offset 0. This was missing for the start
function.

R=ahaas@chromium.org
BUG=v8:4203,chromium:703568

Change-Id: I05bc4a8cfa666864bb7a0b23f75186abe0be9bee
Reviewed-on: https://chromium-review.googlesource.com/458437
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44037}
2017-03-22 17:02:16 +00:00
jarin
798ffc9d67 [deoptimizer] Fill the single precision registers in the deoptimizer entry stub.
BUG=v8:6077

Review-Url: https://codereview.chromium.org/2765323002
Cr-Commit-Position: refs/heads/master@{#44035}
2017-03-22 16:56:03 +00:00
kozyatinskiy
760c56bddf [inspector] changed a way of preserving stepping between tasks
Indisputable profit:
- correct break location in next task (see tests),
- stepOver with async await never lands in random code (see related test and issue),
- inspector doesn't store current stepping state in debugger agent and completely trust V8 - step to new inspector-V8 design (I will finish design doc soon).
- willExecuteScript and didExecuteScript instrumentation could be removed from code base - reduce probability of future errors.
- finally - less code,
- stepping implementation in V8 makes another step to follow our stepping strategy (stepOut should do stepInto and break when exit current frame) (another one one page design doc based on @aandrey comment is coming),
- knowledge about existing of context groups is still inspector-only.

Disputable part is related to super rare scenario when in single isolate we have more then one context group id with enabled debugger agent:
- if one agent request break in own context (stepping, pause, e.t.c.) then we ignore all breaks in another agent. From one hand it looks like good: user clicks stepInto and they don't expect that execution could be paused by another instance of DevTools in unobservable from current DevTools way (second DevTools will get paused notification and run nested message loop). From another hand we shouldn't ignore breakpoints or debugger statement never. In general, I think that proposed behavior is rathe feature then issue.
- and disadvantage, on attempt to break in non-target context group id we just call StepOut until reach target context group id, step out call could deoptimize code in non related to current debugger agent context. But break could happens only in case of debugger stmt or breakpoint - sound like minor issue. Ignoring break on exception sounds like real issue but by module of rareness of this case I think we can ignore this.

Implementation details:
- when debugger agent request break for any reason it passes target context group id to V8Debugger - last agent requesting break is preferred.
- when V8Debugger gets BreakProgramRequested notification from V8, it checks current context group id against target context group id, if they match then just process break as usual otherwise makes StepOut action,
- debug.cc at the end of microtask if last_scheduled_action is StepOut, schedules StepIn and will break on first instruction in next task.

BUG=chromium:654022
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2748503002
Cr-Commit-Position: refs/heads/master@{#44034}
2017-03-22 16:20:54 +00:00
jarin
12d815b36e [profiler] Web UI: add summary of opts/deopts.
This adds optimization and deoptimization counts to the Web UI. Also, the function timeline
now shows optimization and deoptimization marks.

Review-Url: https://codereview.chromium.org/2753543006
Cr-Commit-Position: refs/heads/master@{#44033}
2017-03-22 16:02:25 +00:00
kozyatinskiy
e27d18c943 [debugger] tuned StepNext and StepOut at return position
Proposed behaviour:
- StepNext at return position go into next function call (no changes with current behavior, but implemented in v8::Debug instead of hack on inspector side);
- StepOut at return position go into next non-current function call.

We need this to have better stepping in cases with native functions, blackboxed functions and/or different embedder calls (e.g. event listeners).

New behavior could be illustrated with two examples (for more see stepping-with-natives-and-frameworks test):
- let's assume that we've blackboxed callAll function, this function just takes its arguments and call one after another:
var foo = () => 1;
callAll(foo, foo, () => 2);
If we break inside of first call of function foo. Then on..
..StepNext - we're able to reach second call of function foo,
..StepOut - we're able to reach () => 2 call.

- let's consider case with native function:
[1,2,3].map(x => x * 2)
If we break inside of first callback call, then with StepNext we can iterate through all calls of callback, with StepOut we go to next statement after .map call.

Implementation details:
- when we request break we schedule step-in function call for any step action at return position and for step-in at any position,
- when we request StepOut at return position - we mark current function as needed-to-be-ignored inside of PrepareStepIn(function) call,
- when we request StepOut at not return position - we set break at return position and ask debugger to just repeat last step action on next stepping-related break.

Design doc: https://docs.google.com/document/d/1ihXHOIhP_q-fJCA0e2EiXz_Zr3B08KMjaPifcaqZ60Q/edit

BUG=v8:6118,chromium:583193
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2758483002
Cr-Commit-Position: refs/heads/master@{#44028}
2017-03-22 14:16:18 +00:00
Clemens Hammacher
ee64674811 [wasm] Fix test utils and tests
Add a check to appendToTable to catch illegal input, and fix a test
case triggering this check.
Also removing unused variables and fix indentation.

R=ahaas@chromium.org

Change-Id: I0eaa48ab95ef710530a3cfbe94ed4dd419618cda
Reviewed-on: https://chromium-review.googlesource.com/458436
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44027}
2017-03-22 14:04:10 +00:00
Mythri
e6682554a8 [Interpreter] Introduce strict equality bytecode that does not collect feedback.
Some of the StrictEquality comparisons do not require feedback (for ex: in
try-finally, generators). This cl introduces StrictEqualityNoFeedback bytecode
to be used in such cases. With this change, we no longer have to check if the 
type feedback slot is valid in compare bytecode handlers.

This is the first step in reworking the compare bytecode handler to avoid
duplicate checks when collecting feedback and when performing the operation.

BUG=v8:4280

Change-Id: Ia650fd43c0466b8625d3ce98c39ed1073ba42a6b
Reviewed-on: https://chromium-review.googlesource.com/455778
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44020}
2017-03-22 12:31:11 +00:00
cwhan.tunz
008a09619b [mjsunit] PrettyPrint for TypedArrays
Review-Url: https://codereview.chromium.org/2760313002
Cr-Commit-Position: refs/heads/master@{#44017}
2017-03-22 12:25:31 +00:00
Michael Lippautz
66a5600505 [heap] Bail out of test that doesn't support --noflush-code
... when we run without code flushing.

BUG=

Change-Id: I956c53732598d805581388453010238c029fc3ba
Reviewed-on: https://chromium-review.googlesource.com/458199
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44016}
2017-03-22 12:23:56 +00:00
franzih
86c2db5e33 [type-profile] Handle returns correctly.
Handle fall-off returns and returns inside try blocks.

Store the type-profile feedback slot on the FunctionLiteral
rather than on every return statement.

Next steps:
* Store entries in nexus that can be identified as 'return' (rather than parameter or assignment)
* Collect types for parameters and assignments
* Distinguish multiple parameters and assignments correctly

R=mstarzinger@chromium.org
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2764113002
Cr-Commit-Position: refs/heads/master@{#44014}
2017-03-22 11:51:07 +00:00
franzih
71fe3dd8d2 [type-profile] Add test for fall-off return.
Add a test case as reminder for future work.

There is no return statement, therefore 'undefined' should be the type.

R=mstarzinger@chromium.org
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2768503002
Cr-Commit-Position: refs/heads/master@{#44009}
2017-03-22 10:16:43 +00:00
Michael Starzinger
37b9d653c2 [turbofan] Fix lowering of Function.prototype accesses.
This fixes a corner case where the "instance prototype" diverges from
the "non-instance prototype" that we store on the initial map of a
constructor function.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-703610
BUG=chromium:703610

Change-Id: I30a19ae621e10b512215ffb191ce00d030941440
Reviewed-on: https://chromium-review.googlesource.com/458396
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44008}
2017-03-22 10:12:23 +00:00
Peter Marshall
a6e6160e48 [Test] Fix the regex in array JSPerfTest.
The regex was slightly off, meaning the results would not
display properly.

Change-Id: Ie3b2bf54a50bffde9b64663d7b8b8c0ad39a1212
Reviewed-on: https://chromium-review.googlesource.com/458416
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44007}
2017-03-22 10:09:45 +00:00
franzih
5cd870b4ff [type-profile] Add test for return in try-finally.
Add a test case as reminder for future work.

The return statement is in a try
finally and is never used when returning. The type should
not be collected.

R=mstarzinger@chromium.org
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2765863002
Cr-Commit-Position: refs/heads/master@{#44006}
2017-03-22 10:08:36 +00:00
jgruber
c8e4c8b926 [regexp] Fold repeated assertions
For instance, /\b\b\b\B\B\B/ is folded into the equivalent /\b\B/.

BUG=v8:6126

Review-Url: https://codereview.chromium.org/2768443003
Cr-Commit-Position: refs/heads/master@{#44004}
2017-03-22 09:28:28 +00:00
mvstanton
da511d3349 Error in JSTests.json prevented uploads.
TBR=machenbach@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2770623002
Cr-Commit-Position: refs/heads/master@{#44003}
2017-03-22 09:07:47 +00:00
Michael Achenbach
07a43140d4 [test] Skip flaky tests
BUG=v8:5193,v8:6113,v8:6132,v8:6133
TBR=hablich@chromium.org
NOTRY=true

Change-Id: I2293a6978006e3b00cfd6a438ba81be23df2620d
Reviewed-on: https://chromium-review.googlesource.com/457997
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44001}
2017-03-22 08:02:06 +00:00
mtrofin
9dfa46395a Reland of [wasm] Transferrable modules (patchset #1 id:1 of https://codereview.chromium.org/2762163002/ )
Reason for revert:
Temporarily disabled tests on chromium side (https://codereview.chromium.org/2764933002)

Original issue's description:
> Revert of [wasm] Transferrable modules (patchset #13 id:280001 of https://codereview.chromium.org/2748473004/ )
>
> Reason for revert:
> Breaks layout tests:
> https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/14312
>
> See https://github.com/v8/v8/wiki/Blink-layout-tests
>
> Original issue's description:
> > [wasm] Transferrable modules
> >
> > We want to restrict structured cloning in Chrome to:
> > - postMessage senders and receivers that are co-located
> > in the same process
> > - indexedDB (just https).
> >
> > For context, on the Chrome side, we will achieve the postMessage part
> > by using a mechanism similar to transferrables: the
> > SerializedScriptValue will have a list of wasm modules, separate from
> > the serialized data stream; and this list won't be copied cross
> > process boundaries. The IDB part is achieved by explicitly opting in
> > reading/writing to the serialization stream. To block attack vectors
> > in IPC cases, the default for deserialization will be to expect data
> > in the wasm transfers list.
> >
> > This change is the V8 side necessary to enabling this design. We
> > introduce TransferrableModule, an opaque datatype exposed to the
> > embedder. Internally, TransferrableModules are just serialized data,
> > because we don't have a better mechanism, at the moment, for
> > de-contextualizing/re-contextualizing wasm modules (wrt Isolate and
> > Context).
> >
> > The chrome defaults will be implemented in the
> > serialization/deserialization delegates on that side. For the v8 side
> > of things, in the absence of a serialization delegate, the V8
> > serializer will write to serialization stream. In the absence of a
> > deserialization delegate, the deserializer won't work. This asymmetry
> > is intentional - it communicates to the embedder the need to make a
> > policy decision, otherwise wasm serialization/deserialization won't
> > work "out of the box".
> >
> > BUG=v8:6079
> >
> > Review-Url: https://codereview.chromium.org/2748473004
> > Cr-Commit-Position: refs/heads/master@{#43955}
> > Committed: 99743ad460
>
> TBR=jbroman@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:6079
>
> Review-Url: https://codereview.chromium.org/2762163002
> Cr-Commit-Position: refs/heads/master@{#43981}
> Committed: e538b70e1a

TBR=jbroman@chromium.org,bradnelson@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6079

Review-Url: https://codereview.chromium.org/2762273002
Cr-Commit-Position: refs/heads/master@{#43994}
2017-03-21 17:48:05 +00:00
danno
176a43fb86 [builtins] Implement Array.prototype.reduce in the CSA
BUG=v8:1956

Review-Url: https://codereview.chromium.org/2752273003
Cr-Commit-Position: refs/heads/master@{#43987}
2017-03-21 15:57:38 +00:00
machenbach
e538b70e1a Revert of [wasm] Transferrable modules (patchset #13 id:280001 of https://codereview.chromium.org/2748473004/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/14312

See https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [wasm] Transferrable modules
>
> We want to restrict structured cloning in Chrome to:
> - postMessage senders and receivers that are co-located
> in the same process
> - indexedDB (just https).
>
> For context, on the Chrome side, we will achieve the postMessage part
> by using a mechanism similar to transferrables: the
> SerializedScriptValue will have a list of wasm modules, separate from
> the serialized data stream; and this list won't be copied cross
> process boundaries. The IDB part is achieved by explicitly opting in
> reading/writing to the serialization stream. To block attack vectors
> in IPC cases, the default for deserialization will be to expect data
> in the wasm transfers list.
>
> This change is the V8 side necessary to enabling this design. We
> introduce TransferrableModule, an opaque datatype exposed to the
> embedder. Internally, TransferrableModules are just serialized data,
> because we don't have a better mechanism, at the moment, for
> de-contextualizing/re-contextualizing wasm modules (wrt Isolate and
> Context).
>
> The chrome defaults will be implemented in the
> serialization/deserialization delegates on that side. For the v8 side
> of things, in the absence of a serialization delegate, the V8
> serializer will write to serialization stream. In the absence of a
> deserialization delegate, the deserializer won't work. This asymmetry
> is intentional - it communicates to the embedder the need to make a
> policy decision, otherwise wasm serialization/deserialization won't
> work "out of the box".
>
> BUG=v8:6079
>
> Review-Url: https://codereview.chromium.org/2748473004
> Cr-Commit-Position: refs/heads/master@{#43955}
> Committed: 99743ad460

TBR=jbroman@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6079

Review-Url: https://codereview.chromium.org/2762163002
Cr-Commit-Position: refs/heads/master@{#43981}
2017-03-21 13:54:23 +00:00
Peter Marshall
0feed731d0 [Test] Add a perf test for TypedArray construct by typed array.
BUG=v8:5977

Change-Id: Ic756fd44a945f98d51c0914dcc6c3b82111d170d
Reviewed-on: https://chromium-review.googlesource.com/456419
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43978}
2017-03-21 12:01:28 +00:00
Ilija.Pavlovic
47da8de250 MIPS: Move ldc1/sdc1 to macro-assembler.
For MIPS32, instructions ldc1 and sdc1 are moved into macro-assembler
and renamed as Ldc1 and Sdc1. The reason for placing them into
macro-assembler is that they emmit two or three instructions.

TEST=test/cctest/test-assembler-mips,
     test/cctest/test-code-stubs-mips,
     test/cctest/test-macro-assembler-mips
BUG=

Review-Url: https://codereview.chromium.org/2751973002
Cr-Commit-Position: refs/heads/master@{#43977}
2017-03-21 11:35:40 +00:00
Clemens Hammacher
3214ccf39b [wasm] [interpreter] Allow different activations
This CL makes the interpreter reentrant by allowing different
activations to be live at the same time. The wasm interpreter keeps a
list of activations and stores the stack height at the start of each
activation. This information is used to unwind just one activation, or
show the right portion of the interpreter stack for each interpreter
entry frame.
The WasmDebugInfo object stores a mapping from frame pointer (of the
interpreter entry) to the activation id in order to identify the
activation based on the physical interpreter entry frame.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5822

Change-Id: Ibbf93f077f907213173a92e0a2f7f3556515e8eb
Reviewed-on: https://chromium-review.googlesource.com/453958
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43976}
2017-03-21 11:25:51 +00:00
jkummerow
f8c707305b [builtins] Move more files into v8_builtins_generators source set
BUG=v8:6055

Review-Url: https://codereview.chromium.org/2760953002
Cr-Commit-Position: refs/heads/master@{#43975}
2017-03-21 11:17:41 +00:00
yangguo
fa3f8c6fb0 [debug] refactor code coverage to use enum for mode.
This is in preparation of adding precise binary mode.

BUG=v8:5808

Review-Url: https://codereview.chromium.org/2765813002
Cr-Commit-Position: refs/heads/master@{#43974}
2017-03-21 11:08:36 +00:00
Michael Lippautz
173109b965 [heap] Introduce explicit marking state and instance for minor MC
BUG=chromium:651354

Change-Id: Idcd7780f53ad07b3d782a66455f9c60addc2418d
Reviewed-on: https://chromium-review.googlesource.com/457317
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43971}
2017-03-21 10:29:50 +00:00
neis
abfab00894 [compiler] Add yet more tests for monotonicity of typing.
R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2759133002
Cr-Commit-Position: refs/heads/master@{#43966}
2017-03-21 09:48:47 +00:00
mvstanton
1e03479c64 [builtins] Array.prototype.filter implemented as a TurboFan code stub.
BUG=

Review-Url: https://codereview.chromium.org/2680153005
Cr-Commit-Position: refs/heads/master@{#43965}
2017-03-21 08:56:56 +00:00
yangguo
ed93e7c27b [debug] use best effort coverage when enabling precise coverage.
We used to clear invocation counts when enabling precise coverage.
This is not necessary, and we could continue to use the existing
invocation counts on the heap. The old behavior can be achieved
by explicitly resetting the counts by polling coverage data.

R=jgruber@chromium.org,caseq@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2768453002
Cr-Commit-Position: refs/heads/master@{#43964}
2017-03-21 08:55:44 +00:00
franzih
de04df7412 [type profile] Collect return types.
Collect type information of return values.

Use *one* feedback slot per function for all its return
statements. For assignments, we currently use
several slots per function, because not all
assignments refer to the same variable.

Instead of the variable names, pass the
source location and print the function name.

Add an integration test for --type-profile that checks
for crashes.

Remove type feedback for assignments for now as it convolutes the output.

************ Function with 2 return statements ********
function testFunction(param, flag) {
  // We want to test 2 different return positions in one function.
  if (flag) {
    var first_var = param;
    return first_var;
  }
  var second_var = param;
  return second_var;
}

testFunction({});
testFunction(123, true);
testFunction('hello');
testFunction(undefined);
*******************************************************

************* Sample Output ***************************
Function: testFunction
424: Object
374: number
424: string
424: undefined
*******************************************************

Missing work:
* Handle fall-off returns
* Collect types for parameters
* Remove duplicates from the list of collected types and use a common base class.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2755973002
Cr-Commit-Position: refs/heads/master@{#43956}
2017-03-20 19:51:20 +00:00
mtrofin
99743ad460 [wasm] Transferrable modules
We want to restrict structured cloning in Chrome to:
- postMessage senders and receivers that are co-located
in the same process
- indexedDB (just https).

For context, on the Chrome side, we will achieve the postMessage part
by using a mechanism similar to transferrables: the
SerializedScriptValue will have a list of wasm modules, separate from
the serialized data stream; and this list won't be copied cross
process boundaries. The IDB part is achieved by explicitly opting in
reading/writing to the serialization stream. To block attack vectors
in IPC cases, the default for deserialization will be to expect data
in the wasm transfers list.

This change is the V8 side necessary to enabling this design. We
introduce TransferrableModule, an opaque datatype exposed to the
embedder. Internally, TransferrableModules are just serialized data,
because we don't have a better mechanism, at the moment, for
de-contextualizing/re-contextualizing wasm modules (wrt Isolate and
Context).

The chrome defaults will be implemented in the
serialization/deserialization delegates on that side. For the v8 side
of things, in the absence of a serialization delegate, the V8
serializer will write to serialization stream. In the absence of a
deserialization delegate, the deserializer won't work. This asymmetry
is intentional - it communicates to the embedder the need to make a
policy decision, otherwise wasm serialization/deserialization won't
work "out of the box".

BUG=v8:6079

Review-Url: https://codereview.chromium.org/2748473004
Cr-Commit-Position: refs/heads/master@{#43955}
2017-03-20 19:03:23 +00:00
Clemens Hammacher
bb7fc73dbc [mjsunit] Fix error message for assertEqualsDelta
Before:
Failure: expected <true> found <false>

After:
Failure: expected <0.4 +- 0.001> found <0.3>

R=ahaas@chromium.org

Change-Id: I304fd90112cb7131103863813e7b0920be2b5c04
Reviewed-on: https://chromium-review.googlesource.com/456284
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43950}
2017-03-20 17:00:18 +00:00
Clemens Hammacher
ec37d0b0f3 [wasm] [debug] Add support for global variables
When instantiating the wasm interpreter, pass the start address of the
global variables. This was nullptr before, leading to a crash if
debugging a program which accesses globals.
With test.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5822

Change-Id: I5f419790042ef9a00787df093a07e5e5835d55bd
Reviewed-on: https://chromium-review.googlesource.com/456219
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43948}
2017-03-20 16:49:10 +00:00
Clemens Hammacher
1f617767f9 [wasm] For wasm-interpret-all: Iterate code only once for patching
Before, we were redirecting each function to the interpreter by iterating all
code and patching all call sites using this one function. The runtime was
hence quadratic if all functions were redirected to the interpreter as
done by the --wasm-interpret-all flag.
This CL fixes this to only iterate the code once and redirecting an
arbitrary number of function.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5822

Change-Id: Ia4f2e94a2468f9bef3035b599e1f8a18acf309da
Reviewed-on: https://chromium-review.googlesource.com/455785
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43946}
2017-03-20 16:44:02 +00:00
Clemens Hammacher
198bab4ec0 [wasm] Identify interpreter entry as direct call target
This fixes a bug where an exported function is being specialized, but
the callsite inside the JS_TO_WASM function was patched to call an
interpreter entry instead. We would not identify the call site as the
one to be patched during specialization, and would thus fail a DCHECK.

R=ahaas@chromium.org
BUG=v8:5822, chromium:702839

Change-Id: I148d98333051c399a4cb11bd9620b396f4eb261d
Reviewed-on: https://chromium-review.googlesource.com/456282
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43942}
2017-03-20 14:58:55 +00:00
Yang Guo
64754cf2f5 [debug] collect coverage for functions on the stack when enabling.
BUG=v8:5808

Change-Id: I7bb3c3655e17271b44de881416e150ef51811154
Reviewed-on: https://chromium-review.googlesource.com/457336
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43939}
2017-03-20 14:39:47 +00:00
Clemens Hammacher
91852dffaa [wasm] [interpreter] Handle stack unwinding
If an exception is thrown and the wasm interpreter entry frame is
unwound, also the internal frames in the interpreter need to be unwound.
We did not do so before, leaving a corrupted internal state of the wasm
interpreter. Thus reusing it would fail.
This CL fixes this and adds a test which reenters a previously unwound
wasm interpreter. It checks that this works and the correct stack is
returned.
This test also requires support for calling an imported function which
throws, so this change is also included here.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5822

Change-Id: I12fb843f7a371a4e618b4ac63ed3299667a03a82
Reviewed-on: https://chromium-review.googlesource.com/453938
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43937}
2017-03-20 14:07:19 +00:00
Toon Verwaest
6f52dfd7f0 [ic] Fix 'prototype chain checks' where the holder is the receiver
We use LoadFromPrototype also for direct global loads. InitPrototypeChecks did not support this though, and would create a prototype chain check for objects beyond the direct global. This tries to ensure the property on the global itself doesn't exist, which is invalid.

Additionally this CL deletes duplicate code.

BUG=chromium:702798,v8:5561

Change-Id: I318a5b6cd5f7c3efdb3a003e34edd37d5d3f880b
Reviewed-on: https://chromium-review.googlesource.com/457369
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43935}
2017-03-20 13:55:33 +00:00
loorongjie
cb903e3173 Migrate %TypedArray%.prototype.fill to C++
BUG=v8:5929
R=adamk@chromium.org,bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2735563002
Cr-Commit-Position: refs/heads/master@{#43934}
2017-03-20 13:32:54 +00:00
franzih
3e0aabb62f [runtime] Add function for printing type profile.
Separate the function that prints type profile with
--type-profile from the one that collects type profile.

The name needs to be stored in the feedback vector as well. I'll make a
follow up CL that stores the relevant information, so it can
be printed later.

BUG=v8:5935
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2757993002
Cr-Commit-Position: refs/heads/master@{#43929}
2017-03-20 12:10:14 +00:00
ahaas
ab97fd76ef [wasm][arm] Emit MaybeCheckConstPool in the trap code generation
Without the check it happened that the builtin call in the trap code
was too far away from the constant pool and therefore crashed.

BUG=v8:6054
R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com

Review-Url: https://codereview.chromium.org/2738683003
Cr-Commit-Position: refs/heads/master@{#43928}
2017-03-20 09:52:04 +00:00
ahaas
086ec2bd8d [arm64] The ubfx instruction can be used with a mask-width=64
The code-generator used i.InputInt6 to get the mask-width from the
instruction. However, thereby 64 got wrapped to 0, which is an invalid
mask width. I changed the i.InputInt6 to an i.InputInt32, which should
be okay because the mask-width comes from base::bits::CountPopulation64.

BUG=v8:6122
R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com

Review-Url: https://codereview.chromium.org/2755373002
Cr-Commit-Position: refs/heads/master@{#43927}
2017-03-20 09:42:37 +00:00
Jochen Eisinger
515c7a4ea0 Relax conditions in compiler dispatcher test
Just ensure that all background and foreground tasks finished, then we
should be in a defined state

BUG=v8:6069
R=rmcilroy@chromium.org

Change-Id: Ie5bd11c61402dccb2c65cb8fe57fd1c0f550e9a7
Reviewed-on: https://chromium-review.googlesource.com/456418
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43926}
2017-03-20 09:06:45 +00:00
bmeurer
a93e5221d8 [turbofan] Properly handle IfException projections on JSForInNext.
Don't ignore IfException (and IfSuccess) projections on JSForInNext
nodes during JSTypedLowering::ReduceJSForInNext, but instead rewrire
the IfException projection to the ForInFilter stub call, which can
throw exceptions in case of proxies.

R=yangguo@chromium.org
BUG=v8:6121

Review-Url: https://codereview.chromium.org/2761703002
Cr-Commit-Position: refs/heads/master@{#43925}
2017-03-20 06:32:28 +00:00
Yang Guo
6803fd9ff6 [debug] extend debug-evaluate to Date, Boolean, global functions.
Also add tests for operators.

BUG=v8:5821

Change-Id: I76cfde94324c7f05de61cb60f26d5168da0a9aa5
Reviewed-on: https://chromium-review.googlesource.com/456500
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43922}
2017-03-18 08:45:57 +00:00
Jakob Kummerow
f89db5d24a Fix LoadGlobalIC for cleared WeakCells
BUG=chromium:702793

Change-Id: Ia52823968a757f8f7fc8802deab60f570ffdb58c
Reviewed-on: https://chromium-review.googlesource.com/456280
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43920}
2017-03-18 00:52:09 +00:00
aseemgarg
2bcd3cbb63 Revert of [wasm] re-enable simd-scalar-lowering tests (patchset #1 id:1 of https://codereview.chromium.org/2754393002/ )
Reason for revert:
Seems like this is breaking V8 Linux - arm64 - sim - MSAN

Original issue's description:
> [wasm] re-enable simd-scalar-lowering tests
>
> R=bbudge@chromium.org
> BUG=v8:6020
>
> Review-Url: https://codereview.chromium.org/2754393002
> Cr-Commit-Position: refs/heads/master@{#43918}
> Committed: 931714675b

TBR=bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2749023010
Cr-Commit-Position: refs/heads/master@{#43919}
2017-03-17 22:06:25 +00:00
aseemgarg
931714675b [wasm] re-enable simd-scalar-lowering tests
R=bbudge@chromium.org
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2754393002
Cr-Commit-Position: refs/heads/master@{#43918}
2017-03-17 20:46:04 +00:00
neis
42487a8410 [compiler] Add even more tests for monotonicity of typing.
BUG=

Review-Url: https://codereview.chromium.org/2754003007
Cr-Commit-Position: refs/heads/master@{#43916}
2017-03-17 19:14:21 +00:00
dusan.simicic
9c1a081d4c [wasm] Fix typo in F32x4Mul wasm SIMD test
BUG=

Review-Url: https://codereview.chromium.org/2759673002
Cr-Commit-Position: refs/heads/master@{#43915}
2017-03-17 18:57:39 +00:00
bbudge
771e86fdf2 Remove Factory::NewStringFromASCII method.
BUG=none

Review-Url: https://codereview.chromium.org/2759513002
Cr-Commit-Position: refs/heads/master@{#43913}
2017-03-17 17:52:50 +00:00
Jochen Eisinger
7bd0c1d5bb Next attempt to deflake CompilerDispatcherTest
BUG=v8:6069
R=rmcilroy@chromium.org

Change-Id: I0e1096e20fa96af0a4875704f3f90e8458750356
Reviewed-on: https://chromium-review.googlesource.com/456557
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43911}
2017-03-17 16:23:03 +00:00
jgruber
542b41a7cc [gn] Enable stricter build flags
Default to the chromium-internal build config (instead of the more
permissive no_chromium_code config).

BUG=v8:5878

Review-Url: https://codereview.chromium.org/2758563002
Cr-Commit-Position: refs/heads/master@{#43909}
2017-03-17 15:18:18 +00:00
Wiktor Garbacz
54db0236ce [parser] Parse tasks: make them pass all tests.
Parse tasks are still WIP so there is really no benefit turning them on.

Turn off irrelevant tests.
Fix duplicate parameters inverted logic.
Fix use_counts tracking.
Fix language mode, super_property, evals.
Fix modules and stack overflow.

BUG=v8:6093

Change-Id: I8567b36eef7b9de6799789e7520810bde9c86e5b
Reviewed-on: https://chromium-review.googlesource.com/455916
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43903}
2017-03-17 14:06:24 +00:00
titzer
72e539360e [rename] Rename internal field to embedder field.
This CL renames all occurrences of "internal field" to "embedder field"
to prevent confusion. As it turns out, these fields are not internal to
V8, but are actually embedder provided fields that should not be mucked
with by the internal implementation of V8.

Note that WASM does use these fields, and it should not.

BUG=v8:6058

Review-Url: https://codereview.chromium.org/2741683004
Cr-Commit-Position: refs/heads/master@{#43900}
2017-03-17 13:26:05 +00:00
Michael Starzinger
22372f5aa8 [turbofan] Prototype of property access early lowering.
This is a first stab at extending the existing early lowering approach
to property access operations. Currently we only handle the case where
named property loads are lowered to a soft deoptimize operation, due to
insufficient type feedback.

R=jarin@chromium.org

Change-Id: I779ffb99978023237da5ad9eaf0241fe74243882
Reviewed-on: https://chromium-review.googlesource.com/456316
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43899}
2017-03-17 13:21:41 +00:00
Marja Hölttä
ab4233e38a [parser|cleanup] Add tests for duplicate parameters.
There are at least 3 mechanisms for detecting duplicate parameters.
- ExpressionClassifier
- Scope::DeclareParameter checking IsDeclaredParameter
- PatternRewriter::VisitVariableProxy failing to declare a duplicate parameter

The conditions for when duplicate parameters are allowed and when not are pretty
involved too. They are allowed when
- the function is not an arrow function and not a concise method *and*
- when the parameter list is simple *and*
- we're in sloppy mode (incl. the function doesn't declare itself strict).

In addition, we don't recognize some of the early errors, and it's 
non-trivial to see which ones are recognized and which not (see bug
v8:6108). E.g., (dup, dup) => {}; is recognized but (dup, [dup]) => {} is
not. And (dup, [dup]) => 1; is.

We do have tests for some aspects of duplicate parameters (e.g., arrow function
duplicate parameters are included in arrow function tests), but it's hard to see
whether all combinations of the relevant conditions are tested.

This CL adds more structured tests which hopefully enables reducing the
duplicate parameter detection mechanisms to 2 or maybe even to 1.

BUG=v8:6092

Change-Id: Idd3db43b380aae4b9a89be5f1ed0755d39bfb36d
Reviewed-on: https://chromium-review.googlesource.com/456336
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43895}
2017-03-17 12:10:35 +00:00
neis
94b088ca3c Disentangle assembler from isolate.
This is a first step towards moving Turbofan code generation off the main thread.

Summary of the changes:
- AssemblerBase no longer has a pointer to the isolate. Instead, its
  constructor receives the few things that it needs from the isolate (on most
  architectures this is just the serializer_enabled flag).
- RelocInfo no longer has a pointer to the isolate. Instead, the functions
  that need it take it as an argument.  (There are currently still a few that
  implicitly access the isolate through a HeapObject.)
- The MacroAssembler now explicitly holds a pointer to the isolate (before, it
  used to get it from the Assembler).
- The jit_cookie also moved from AssemblerBase to the MacroAssemblers, since
  it's not used at all in the Assemblers.
- A few architectures implemented parts of the Assembler with the help
  of a Codepatcher that is based on MacroAssembler.  Since the Assembler no
  longer has the isolate, but the MacroAssembler still needs it, this doesn't
  work anymore.  Instead, these Assemblers now use a new PatchingAssembler.

BUG=v8:6048

Review-Url: https://codereview.chromium.org/2732273003
Cr-Commit-Position: refs/heads/master@{#43890}
2017-03-17 11:18:06 +00:00
Andreas Haas
87354ade6b [wasm] Remove the WasmTrapHelper
Since TrapIf has been implemented on all platforms, there is no need
anymore for the old WasmTrapHelper code. This CL also removes
TrapIf-specific tests.

R=titzer@chromium.org, clemensh@chromium.org

Change-Id: Ic069598441b7bd63bde2e66f4e536abea5ecebe6
Reviewed-on: https://chromium-review.googlesource.com/452380
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43887}
2017-03-17 10:30:31 +00:00
jgruber
ad75ded221 [cctest] Fix invalid assumption in test-unboxed-doubles
test-unboxed-doubles/WriteBarrierObjectShiftFieldsRight recently started
failing on arm64-nosnapshot builds due to a broken CHECK.

# Fatal error in ../../test/cctest/test-unboxed-doubles.cc, line 1417
# Check failed: heap->InNewSpace(*obj_value).

It expects the result of Factory::NewJSArray() to be in new
space; but NewJSArray encapsulates two allocations so the return value can
actually be in old space. Fix it by ensuring only one allocation occurs.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2759433002
Cr-Commit-Position: refs/heads/master@{#43886}
2017-03-17 10:16:54 +00:00
neis
877d9758eb [compiler] Add more tests for monotonicity of typing.
R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2753543009
Cr-Commit-Position: refs/heads/master@{#43885}
2017-03-17 09:17:10 +00:00
littledan
3fa2633841 [intl] Fix debug-evaluate-no-side-effect-builtins test
String case conversion is known to debug-evaluate to not have a side
effect in noi18n mode, but debug-evaluate thinks it has a side effect
in i18n mode. Update the tests accordingly.

Verified locally that the test passes in i18n and noi18n mode (not sure
whether the noi18n trybot executes this test).

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng

Review-Url: https://codereview.chromium.org/2750403004
Cr-Commit-Position: refs/heads/master@{#43882}
2017-03-17 07:18:07 +00:00
gdeepti
1fce7d604a [wasm] Fix DetachArrayBuffer for WebAssembly.Memory on grow
DetachArrayBuffer makes incorrect assumptions about the state of the ArrayBuffer. It assumes that that the ArrayBuffer is internal to wasm unless guard pages are enabled, this is not the case as the ArrayBuffer can be externalized outside of wasm, in this case through gin.

BUG=chromium:700384

Review-Url: https://codereview.chromium.org/2754153002
Cr-Commit-Position: refs/heads/master@{#43880}
2017-03-17 01:12:07 +00:00
allada
3e1e90dec2 [Devtools] Add stacktrace to protocol for scriptParsed event
Stacktrace data is now passed when scriptParsed event is triggered.

R=kozyatinskiy@chromium.org,dgozman
BUG=chromium:646849

Review-Url: https://codereview.chromium.org/2755863002
Cr-Commit-Position: refs/heads/master@{#43879}
2017-03-16 23:34:11 +00:00
titzer
3bbd81afbc [testing] Add the notion of a wait count to allow tests to robustly wait on asynchronous tasks.
Note that this also modifies mjsunit.js to allow the {failWithMessage} method to be monkey-patched by a test. This is necessary because assertions which fail in a promise's then-clause would normally only throw an exception, which is swallowed by the promise, causing the test to silently pass. Instead, patching this {failWithMessage} functionality allows then clauses to use the full assertion machinery of mjsunit.js.

R=ulan@chromium.org, gsathya@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2752043002
Cr-Commit-Position: refs/heads/master@{#43875}
2017-03-16 18:20:19 +00:00
bradnelson
4c3217e132 [wasm][asm.js] Adding custom asm.js lexer.
Adding a custom lexer for asm.js parsing.
It takes advantage of a number of asm.js properties to simply things:
* Assumes 'use asm' is the only string.
* Does not handle unicode for now (tools don't emit it).
* Combines global + local string table with lexer.

R=marja@chromium.org,vogelheim@chromium.org,kschimpf@chromium.org

BUG=v8:4203
BUG=v8:6090

Review-Url: https://codereview.chromium.org/2751693002
Cr-Commit-Position: refs/heads/master@{#43874}
2017-03-16 18:10:45 +00:00
yangguo
cd640d225b [debug] whitelist Object and Symbol builtins for debug-evaluate.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2747243006
Cr-Commit-Position: refs/heads/master@{#43871}
2017-03-16 17:10:34 +00:00
cwhan.tunz
da1bddcd75 [typedarrays] Implement %TypedArray%.prototype.lastIndexOf in C++
- Implement C++ builtins and ElementsAccessor for
  %TypedArray%.prototype.lastIndexOf
- Remove TypedArrayLastIndexOf in src/js/typedarray.js
- Combine InnerArrayLastIndexOf and ArrayLastIndexOf in src/js/array.js

BUG=v8:5929

Review-Url: https://codereview.chromium.org/2744283002
Cr-Commit-Position: refs/heads/master@{#43870}
2017-03-16 16:28:00 +00:00
franzih
947a043766 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

For now, has a test that compares the stdout of --type-profile in test/message. We
will remove this test when --type-profile is fully integrated in
the debugger protocol. Adding
the test in test/inspector does not work, because the inspector
test itself consists of JavaScript code that would convolute the
output and be non-deterministic under stress.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43866}
2017-03-16 15:01:31 +00:00
bbudge
11f69171c3 [WASM] Fix SIMD test that fails on ARM hardware.
- Change test to avoid adding denormalized numbers. This flushes to
  zero on ARM hardware when using Neon.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2754543007
Cr-Commit-Position: refs/heads/master@{#43864}
2017-03-16 14:06:49 +00:00
Clemens Hammacher
783f68c53b [wasm] [interpreter] Throw exception on trap
This behaviour was missing before. If a trap is encountered in the
interpreter, we now throw the right error. With test.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5822

Change-Id: I09c23d15fcde32ec586fb6d3094a5ec49155a9a2
Reviewed-on: https://chromium-review.googlesource.com/453839
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43859}
2017-03-16 12:01:15 +00:00
Clemens Hammacher
f3aeb762ae [wasm] [interpreter] Implement calling imported functions
When instantiating the wasm interpreter for debugging, we unwrap all
wasm-to-js wrappers and store the callable objects. The handles are
stored in a DeferredHandleScope and deleted when the InterpreterHandle
(store in WasmDebugInfo) is freed.
A call to an imported function reads the arguments from the stack,
converts them to JS objects, calls the callable, converts back the
return value and pushes it onto the stack.
Reentering the interpreter from the calles JS code is not permitted
yet, but will be in a follow-up CL.
Also, indirect calls to imported functions will have to follow.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5822

Change-Id: I66c35053bccb6cf8d416606e4f840d888ccb3b65
Reviewed-on: https://chromium-review.googlesource.com/453838
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43855}
2017-03-16 10:57:16 +00:00
franzih
79ccd3a693 Revert of Collect type profile for DevTools. (patchset #41 id:770001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
Still flaky

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Original-Commit-Position: refs/heads/master@{#43804}
> Committed: 6cf880f4b8
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43846}
> Committed: 5c32287390
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43849}
> Committed: 18c35e4958

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2745413006
Cr-Commit-Position: refs/heads/master@{#43852}
2017-03-16 09:59:20 +00:00
jgruber
10500cb79c [csa] Replace remaining old-style GetProperty calls
Change

Node* name = HeapConstant(name_string);
Callable callable = CodeFactory::GetProperty(isolate);
CallStub(callable, context, receiver, name);

to

GetProperty(context, receiver, name_string);

BUG=

Review-Url: https://codereview.chromium.org/2751363002
Cr-Commit-Position: refs/heads/master@{#43850}
2017-03-16 09:33:30 +00:00
franzih
18c35e4958 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Original-Original-Commit-Position: refs/heads/master@{#43791}
Committed: 0332bebde9
Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Original-Commit-Position: refs/heads/master@{#43804}
Committed: 6cf880f4b8
Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43846}
Committed: 5c32287390
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43849}
2017-03-16 09:25:23 +00:00
franzih
9e827c2384 Revert of Collect type profile for DevTools. (patchset #40 id:750001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
Flaky under stress. Fix first.

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43804}
> Committed: 6cf880f4b8
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43846}
> Committed: 5c32287390

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2747383004
Cr-Commit-Position: refs/heads/master@{#43847}
2017-03-16 08:49:08 +00:00
franzih
5c32287390 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Original-Commit-Position: refs/heads/master@{#43791}
Committed: 0332bebde9
Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43804}
Committed: 6cf880f4b8
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43846}
2017-03-16 08:42:40 +00:00
bmeurer
9224d5d1bc [csa] Bailout to the runtime for ToInteger conversion in Array.p.indexOf.
The fast-path for Array.prototype.indexOf first checks whether the
receiver is a fast-mode JSArray (and there are no elements in the
prototype chain in case of holey arrays), then loads the known
JSArray::length, and afterwards calls ToInteger on the fromIndex.

But this ToInteger(fromIndex) call can cause arbitrary side effects if
the fromIndex is a JSReceiver, in particular it can invalidate the
assumptions about the fast-mode of the receiver and the length. In the
worst case this leads to OOB memory access.

Quick-fix is to bailout to the runtime if the fromIndex is neither a Smi
nor undefined, which represents the common cases.

R=jarin@chromium.org
BUG=chromium:702058

Review-Url: https://codereview.chromium.org/2756663002
Cr-Commit-Position: refs/heads/master@{#43843}
2017-03-16 06:53:09 +00:00
bbudge
365492f17e [WASM] Implement Simd128 Load/Store on ARM.
- Adds new load/store opcodes (0xc0, 0xc1) for S128 type.
- Implements these for ARM.
- Enables more WASM SIMD tests, and adds new LoadStoreLoad test.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2745853002
Cr-Commit-Position: refs/heads/master@{#43841}
2017-03-15 23:34:53 +00:00
Toon Verwaest
c2a53d2574 [ic] Cleanup accessor handling, fix cached property on global, remove cache-on-prototype support
BUG=v8:5561

Change-Id: I425ad7e670b8e9c701ff284ab1be3638a975a6d3
Reviewed-on: https://chromium-review.googlesource.com/455832
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43836}
2017-03-15 16:42:51 +00:00
Clemens Hammacher
69da6fcd2a [wasm] Fix wasm to js wrapper on ia32 for i64 return
When generating the code for an illegal (non-js-compliant) wrapper for
a js function, we were generating a zero constant of the return type.
This failed on ia32 if the return type is i64.
The correct thing to do is to return two i32 zero constants.

R=titzer@chromium.org
BUG=v8:6104, v8:6096

Change-Id: Idc0dd8d3eef901c22d5278d97f1879b000a18588
Reviewed-on: https://chromium-review.googlesource.com/455857
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43835}
2017-03-15 16:14:19 +00:00
Jochen Eisinger
9d0f248201 Store the FunctionTemplateInfo used to create remote objects in the map
That way, we don't need to create a context-less constructor function.
Instead, we use the constructor_or_backpointer (or null) field, and
rename it to constructor_or_fti_or_backpointer so nobody is confused.

Note that technically, we still have JSFunctions without contexts, as
they're temporarily created in the deoptimizer.

BUG=v8:6084
R=dcheng@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

Change-Id: I084f052533c317f2cbfb9c35e1acf40263c6257b
Reviewed-on: https://chromium-review.googlesource.com/454636
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43834}
2017-03-15 15:57:38 +00:00
Ross McIlroy
3db32e064f [Interpreter / TurboFan] Add TestTypeof bytecode.
Adds a TestTypeof bytecode to deal with comparisons of the form:
  typeof(object) === 'string';

Also adds support to Turbofan to perform these comparisons without
inserting checkpoints.

BUG=v8:4280,v8:5267

Change-Id: Ib5cc1c6816dfe70a4120838d8eada2fc0267750f
Reviewed-on: https://chromium-review.googlesource.com/454837
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43832}
2017-03-15 14:05:51 +00:00
leszeks
2b1ed94464 [test] Fix mjsunit/getters-on-elements to reset function state
The function "foo" in "base_getter_test" was picking up a left-over
optimised code object from foo's code map, the third time that
base_getter_test was run, instead of optimising it itself. This
broke the assumptions of the test, that each case was functionally
independent from the others, and had started off with empty feedback
and no optimised code.

This breaks the test though, so we have to blacklist it pending a fix
to the root cause (http://crbug.com/v8/6101).

Review-Url: https://codereview.chromium.org/2750623004
Cr-Commit-Position: refs/heads/master@{#43828}
2017-03-15 13:31:01 +00:00
gdeepti
16796914cb Add Int32x4 Wasm Simd Binops, compare ops, select
- Added: Int32x4Mul, Int32x4Min, Int32x4Max, Int32x4Equal, Int32x4NotEqual
 Uint32x4Min, Uint32x4Max
 - Fix I32x4Splat

R=bbudge@chromium.org, bradnelson@chromium.org, mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2719953002
Cr-Commit-Position: refs/heads/master@{#43827}
2017-03-15 13:24:54 +00:00
Michael Starzinger
a148861c52 [turbofan] Handle equality comparison in early lowering.
This handles non-strict equality comparison operations having number
feedback during the early type-hint lowering (i.e. during graph
construction).

R=jarin@chromium.org

Change-Id: I1db67e78312934bbb20aee775979797420ff2581
Reviewed-on: https://chromium-review.googlesource.com/455796
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43824}
2017-03-15 12:53:17 +00:00
Wiktor Garbacz
bb927eb439 [parser] Fix template escapes in preparser
BUG=v8:6100

Change-Id: Ib8729b2688bbaf6fb397737ccf1b1c086698ab93
Reviewed-on: https://chromium-review.googlesource.com/455876
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43822}
2017-03-15 12:44:41 +00:00
Clemens Hammacher
3e6873abcb [wasm] Fix wasm to js wrapper for illegal signature
When compiling a wasm to js wrapper for a signature which is not JS
compatible, we generate a runtime call to throw a type error and return
immediately afterwards. We were using the return value of the runtime
call as return value for the wrapper.
This worked for integer return values, since the same registers are
used for tagged values and integer values. For float values, however,
it failed, since the return value needs to be stored in another
register.

R=titzer@chromium.org
BUG=v8:6096

Change-Id: I8f39ea132cd150c3044673d25fa3c3588b4266bf
Reviewed-on: https://chromium-review.googlesource.com/455816
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43821}
2017-03-15 12:19:08 +00:00
Marja Hölttä
beacd656f2 [iwyu|arm64] Pre-work for removing the illegal include macro-assembler.h -> assembler-inl.h
BUG=v8:5294

Change-Id: I6214c50c7d1344210a80763b066e5ec56df1265a
Reviewed-on: https://chromium-review.googlesource.com/453460
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43820}
2017-03-15 12:08:50 +00:00
Michael Achenbach
6e376b6c5b [test] Mark slow tests
Mark slow tests discovered by manual audit of reported durations.

Slow tests will run first, which will lead to higher test runner throughput.

Also some tests have flaky timeouts occasionally.

BUG=chromium:601468

Change-Id: If9aeb5422e79ff25b867b01c50386a5fdebeb494
Reviewed-on: https://chromium-review.googlesource.com/455736
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43819}
2017-03-15 12:05:12 +00:00
Toon Verwaest
afeb560c84 [ic] Remove ICUseVector and some access compiler cleanup
BUG=

Change-Id: I1fd0ae3dcb0e644e9f2a56c242720b4def4bb579
Reviewed-on: https://chromium-review.googlesource.com/454836
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43818}
2017-03-15 11:53:47 +00:00
Michael Starzinger
6fca2cfae2 [turbofan] Elide redundant {IfSuccess} control projections.
This changes the IR to no longer require single {IfSuccess} projection
nodes unless there is a corresponding {IfException} node that links the
potentially throwing call to an exception handler. This reduces graph
size as well as compilation time when exception handlers aren't present.

The new invariant for potentially throwing nodes is: Nodes that can
potentially throw either have both IfSuccess/IfException projections as
the only control uses and no direct control uses, or no projections at
all and solely direct control uses.

R=jarin@chromium.org

Change-Id: I3d9cd816d74ad5af13e0673da7ec7a98f1ecdc7e
Reviewed-on: https://chromium-review.googlesource.com/449715
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43814}
2017-03-15 09:26:18 +00:00
jarin
5790aad425 [turbofan] Fix typing for NumberMin and NumberMax to handle uninhabited types.
BUG=chromium:700883

Review-Url: https://codereview.chromium.org/2751513006
Cr-Commit-Position: refs/heads/master@{#43812}
2017-03-15 07:46:25 +00:00
jarin
8c114d1737 [turbofan] Handle Smi -> Float32 conversion in representation changer.
BUG=chromium:693425

Review-Url: https://codereview.chromium.org/2749193003
Cr-Commit-Position: refs/heads/master@{#43811}
2017-03-15 07:44:59 +00:00
jing.bao
d598386db8 [ia32] Add minps/maxps and AVX v_ps/v_pd for add/sub/mul/div/min/max
Also use vinstr for vps/vpd/vss/vsd

BUG=

Review-Url: https://codereview.chromium.org/2747103002
Cr-Commit-Position: refs/heads/master@{#43809}
2017-03-15 02:01:05 +00:00
Eric Holk
2e002b9e20 [wasm] Enable cctests when out of bounds trap handler is enabled
Change-Id: I47f0d5578a7c26aa7a30c97175eefc1a9c935d77
Reviewed-on: https://chromium-review.googlesource.com/455318
Commit-Queue: Eric Holk <eholk@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43808}
2017-03-15 01:40:09 +00:00
Ross McIlroy
b7648be7ec [Flags] Remove --ignition-staging flag.
Removes the --ignition-staging flag since it is no longer used
by anything and won't be a shipping configuration. Also removes
ignition_turbo variant from testrunner, since it is now 
the same as the turbofan variant.

BUG=v8:4280

Change-Id: I3b96e986879fc70b8e202fe9496334828acdd0ba
Reviewed-on: https://chromium-review.googlesource.com/452621
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43806}
2017-03-14 23:07:09 +00:00
franzih
14d0930d40 Revert of Collect type profile for DevTools. (patchset #40 id:750001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
gcc bot is now flaky https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/11863

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Original-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43804}
> Committed: 6cf880f4b8

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2754573002
Cr-Commit-Position: refs/heads/master@{#43805}
2017-03-14 21:32:32 +00:00
franzih
6cf880f4b8 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Original-Commit-Position: refs/heads/master@{#43791}
Committed: 0332bebde9
Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43804}
2017-03-14 21:08:56 +00:00
bradnelson
8c1af20baf [wasm][asm.js] Fix asm.js in tests to be more strictly valid.
These tests fail with the new asm.js parser, because they are invalid under
a more strict reading of the spec.

NOTE: These also fail to validate when run in Firefox.

BUG=v8:4203
BUG=v8:6090
R=aseemgarg@chromium.org,eholk@chromium.org

Review-Url: https://codereview.chromium.org/2745393002
Cr-Commit-Position: refs/heads/master@{#43803}
2017-03-14 20:17:04 +00:00
caitp
e08289d0ed [test] remove unnecessary whitelisted builtins from test-debug.cc
BUG=chromium:691875
R=gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2747733002
Cr-Commit-Position: refs/heads/master@{#43800}
2017-03-14 17:02:27 +00:00
machenbach
c92f41d00a Revert of Collect type profile for DevTools. (patchset #39 id:730001 of https://codereview.chromium.org/2707873002/ )
Reason for revert:
gcc bot has problems with this: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20gcc%204.8/builds/11858

Original issue's description:
> Collect type profile for DevTools
>
> Collect type information for JavaScript variables and display it
> in Chrome DevTools.
> Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing
>
> When debugging JavaScript, it’s helpful to know the type of
> a variable, parameter, and return values. JavaScript is
> dynamically typed, and for complex
> source code it’s often hard to infer types. With type profiling, we
> can provide type information to JavaScript developers.
>
> This CL is a proof of concept. It collects type profile for
> assignments and simply prints the types to stdout.
>
> The output looks something like this:
>
> #my_var1
>   #Object
>   #number
>   #string
>   #number
>   #undefined
>   #string
>   #Object
>   #Object
>
>
> We use an extra slot in the feedback vector of assignments to
> carry the list of types for that assignment. The extra slot is
> only added when the flag --type-profile is given.
>
>
> Missing work:
> * Collect data for parameters and return values (currently only assignments).
> * Remove duplicates from the list of collected types and use a common base class.
> * Add line numbers or source position instead of the variable name.
>
>
>
> BUG=v8:5935
>
> Review-Url: https://codereview.chromium.org/2707873002
> Cr-Commit-Position: refs/heads/master@{#43791}
> Committed: 0332bebde9

TBR=yangguo@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org,mstarzinger@chromium.org,franzih@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5935

Review-Url: https://codereview.chromium.org/2749673003
Cr-Commit-Position: refs/heads/master@{#43798}
2017-03-14 16:41:02 +00:00
yangguo
62b6dd1942 [debugger] correctly find inner function scope.
Nested arrow functions can have the same end positions, so
the end position is unsuitable to decide whether a scope is
an inner function scope.

BUG=chromium:696202
R=jgruber@chromium.org, kozyatinskiy@chromium.org

Review-Url: https://codereview.chromium.org/2751573003
Cr-Commit-Position: refs/heads/master@{#43797}
2017-03-14 16:35:19 +00:00
bbudge
a75f7cd344 [ARM] Implement more NEON permutation instructions.
- Implements vuzp, vtrn instructions for q-registers.
- Refactors vmvn, vswp to use common unary op helper fn.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2739033002
Cr-Commit-Position: refs/heads/master@{#43795}
2017-03-14 16:28:45 +00:00
Clemens Hammacher
0a4c5c4411 [wasm] Cleanup wasm interpreter
This is a cleanup in preparation to implement calling imported
functions via the wasm interpreter.
For imported functions, we do not create entries in the
interpreter_code_ vector any more.

I also simplified the interface and removed unused or redundant return
values. More things are now DCHECKed instead of bailing out.

Also, we previously had two PushFrame methods: One is supposed to
initialize the interpreter from external code (i.e. adds the first
frame to the stack), the other one is used to push new frames on the
frame stack for called functions. This CL renames the first to
InitFrame, and makes it use the second one. The other remaining user is
the DoCall method.

R=titzer@chromium.org
BUG=v8:5822

Change-Id: Id09ff1e3256428fbd8c955e4664507a0c3167e53
Reviewed-on: https://chromium-review.googlesource.com/453482
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43793}
2017-03-14 16:18:18 +00:00
franzih
0332bebde9 Collect type profile for DevTools
Collect type information for JavaScript variables and display it
in Chrome DevTools.
Design Doc: https://docs.google.com/a/google.com/document/d/1O1uepXZXBI6IwiawTrYC3ohhiNgzkyTdjn3R8ysbYgk/edit?usp=sharing

When debugging JavaScript, it’s helpful to know the type of
a variable, parameter, and return values. JavaScript is
dynamically typed, and for complex
source code it’s often hard to infer types. With type profiling, we
can provide type information to JavaScript developers.

This CL is a proof of concept. It collects type profile for
assignments and simply prints the types to stdout.

The output looks something like this:

#my_var1
  #Object
  #number
  #string
  #number
  #undefined
  #string
  #Object
  #Object

We use an extra slot in the feedback vector of assignments to
carry the list of types for that assignment. The extra slot is
only added when the flag --type-profile is given.

Missing work:
* Collect data for parameters and return values (currently only assignments).
* Remove duplicates from the list of collected types and use a common base class.
* Add line numbers or source position instead of the variable name.

BUG=v8:5935

Review-Url: https://codereview.chromium.org/2707873002
Cr-Commit-Position: refs/heads/master@{#43791}
2017-03-14 16:11:56 +00:00
Jochen Eisinger
f5a508f31f Disable other background modules while testing the CompilerDispatcher
R=rmcilroy@chromium.org,mlippautz@chromium.org
BUG=v8:6069

Change-Id: Iea0134ef3a0252f5a6f4ae2154218776dc6ff96d
Reviewed-on: https://chromium-review.googlesource.com/453960
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43786}
2017-03-14 14:01:03 +00:00
jkummerow
d0e604bf26 FunctionEntryHook: require no-snapshot build
When a FunctionEntryHook parameter was passed to isolate creation,
we ignored any existing snapshots anyway. Since the ability to
bootstrap from scratch will be removed from snapshot builds, the
FunctionEntryHook feature must depend on a no-snapshot build.

BUG=v8:6055

Review-Url: https://codereview.chromium.org/2733203002
Cr-Commit-Position: refs/heads/master@{#43779}
2017-03-14 12:31:03 +00:00
Michael Achenbach
a0077f222b [test] Skip slow tests
BUG=chromium:682617
TBR=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: If121a5d01bba113374bc1673780fc713997e54a9
Reviewed-on: https://chromium-review.googlesource.com/454618
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43776}
2017-03-14 11:43:01 +00:00
Michael Starzinger
3b597bb701 [runtime] Fix KeyAccumulator for non-internalized keys.
This fixes a corner-case in {KeyAccumulator::CollectOwnJSProxyKeys}
where the keys returned by {JSReceiver::OwnPropertyKeys} for an array
are not internalized and hence have a diverging identity from keys
returned by the "ownKeys" trap of a proxy.

R=cbruni@chromium.org
TEST=mjsunit/regress/regress-crbug-700678
BUG=chromium:700678

Change-Id: I5efd012eade14bd45c69e4abb0aeda684baf38f0
Reviewed-on: https://chromium-review.googlesource.com/452979
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43775}
2017-03-14 11:19:28 +00:00
Clemens Hammacher
7f460012c6 [wasm] Show interpreted frames on captured stack traces
In Isolate::CaptureSimpleStackTrace, we were ignoring interpreter entry
frames so far. This CLs changes this to gets the interpreted stack from
the wasm interpreter and add the frames to the FrameArray.

R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5822

Change-Id: I705909532ff28af412ff809da94522866eaa1c0d
Reviewed-on: https://chromium-review.googlesource.com/452378
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43772}
2017-03-14 10:23:20 +00:00
Michael Achenbach
9f4188c252 [test] Fix fullcode and ignition testing variants
BUG=chromium:682617
R=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org

Change-Id: Id0c904e080bb09e4ac1a127a02b110459442f7f3
Reviewed-on: https://chromium-review.googlesource.com/452484
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43771}
2017-03-14 09:59:04 +00:00
Jochen Eisinger
2cd2f5feff Remove experimental fast accessor builder API
As the code isn't used, but would have to be ported from hand-written
assembly to CodeStubAssembler anyways, I propose to remove it and
restore it if we decide that we actually need it.

R=vogelheim@chromium.org
BUG=

Change-Id: Iffd7fc6ec534b1dd7a9144da900424355c8a7a02
Reviewed-on: https://chromium-review.googlesource.com/453461
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43763}
2017-03-14 08:14:48 +00:00
jing.bao
97254b0d23 [ia32] Supplement shift instructions for SIMD
psll/rl/raw(xmm, imm)
psrad(xmm, imm)
vpsll/rl/raw(xmm, xmm, imm)
vpsll/rl/rad(xmm, xmm, imm)

BUG=

Review-Url: https://codereview.chromium.org/2747783004
Cr-Commit-Position: refs/heads/master@{#43762}
2017-03-14 08:01:20 +00:00
jing.bao
3800ba6cc7 [ia32] Add some SSE2, SSE4 instructions and AVX version for SIMD
Add instructions in following format:
instr(xmm, xmm/mem)
vinstr(xmm, xmm, xmm/mem)

BUG=

Review-Url: https://codereview.chromium.org/2744643004
Cr-Commit-Position: refs/heads/master@{#43760}
2017-03-14 02:00:13 +00:00
eholk
118c376fcb [wasm] Initial signal handler
This is basically the minimum viable signal handler for Wasm bounds checks.
It includes the TLS check and the fine grained instructions checks. These
two checks provide most of the safety for the signal handler. Future CLs will
add code range and data range checks for more robustness.

The trap handling code and data structures are all in src/trap-handler, with
the code that actually runs in the signal handler confined to
src/trap-handler/signal-handler.cc.

This changes adds a new V8 API that the embedder should call from a signal
handler that will give V8 the chance to handle the fault first. For hosts that
do not want to implement their own signal handler, we include the option to
install a simple one. This simple handler is also used for the tests.

When a Wasm module is instantiated, information about each function is passed
to the trap handler, which is used to classify faults. These are removed during
the instance finalizer.

Several future enhancements are planned before turning this on by default.
Obviously, the additional checks will be added to MaybeHandleFault. We are
also planning to add a two-level CodeObjectData table that is grouped by
isolates to make cleanup easier and also reduce potential for contending on
a single data structure.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2371833007
Cr-Original-Original-Commit-Position: refs/heads/master@{#43523}
Committed: a5af7fe9ee
Review-Url: https://codereview.chromium.org/2371833007
Cr-Original-Commit-Position: refs/heads/master@{#43755}
Committed: 338622d7ca
Review-Url: https://codereview.chromium.org/2371833007
Cr-Commit-Position: refs/heads/master@{#43759}
2017-03-13 22:12:23 +00:00
binji
65200967b7 Reland moving Atomics builtins to C++
This reverts the previous revert, commit
5a04f4fd68.

Previously reverted changes:

>    Revert "[SAB] Move Atomics builtins to C++"
>
>     This reverts commit 2b9840d86f.
>
>     Revert "[SAB] Remove unreachable Uint8Clamped atomics paths"
>
>     This reverts commit d1160fb14f.
>
>     Revert "Remove tiny unit test for MinSimple/MaxSimple"
>
>     This reverts commit 837760ecb7.
>
>     Revert "Remove infrastructure for experimental JS natives"
>
>     This reverts commit 8cfe45b6f1.

These changes were reverted to improve a perf regression on a Chrome
bot. Since then, the regression has reappeared, then disappeared again
all from seemingly unrelated changes.

BUG=v8:6033
TBR=adamk@chromium.org,hpayer@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2732213005
Cr-Commit-Position: refs/heads/master@{#43758}
2017-03-13 20:59:15 +00:00
eholk
aba151b92f Revert of [wasm] Initial signal handler (patchset #60 id:1170001 of https://codereview.chromium.org/2371833007/ )
Reason for revert:
ASAN breakage, such as https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/19111/steps/Check/logs/grow-memory

Original issue's description:
> [wasm] Initial signal handler
>
> This is basically the minimum viable signal handler for Wasm bounds checks.
> It includes the TLS check and the fine grained instructions checks. These
> two checks provide most of the safety for the signal handler. Future CLs will
> add code range and data range checks for more robustness.
>
> The trap handling code and data structures are all in src/trap-handler, with
> the code that actually runs in the signal handler confined to
> src/trap-handler/signal-handler.cc.
>
> This changes adds a new V8 API that the embedder should call from a signal
> handler that will give V8 the chance to handle the fault first. For hosts that
> do not want to implement their own signal handler, we include the option to
> install a simple one. This simple handler is also used for the tests.
>
> When a Wasm module is instantiated, information about each function is passed
> to the trap handler, which is used to classify faults. These are removed during
> the instance finalizer.
>
> Several future enhancements are planned before turning this on by default.
> Obviously, the additional checks will be added to MaybeHandleFault. We are
> also planning to add a two-level CodeObjectData table that is grouped by
> isolates to make cleanup easier and also reduce potential for contending on
> a single data structure.
>
> BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277
>
> Review-Url: https://codereview.chromium.org/2371833007
> Cr-Original-Commit-Position: refs/heads/master@{#43523}
> Committed: a5af7fe9ee
> Review-Url: https://codereview.chromium.org/2371833007
> Cr-Commit-Position: refs/heads/master@{#43755}
> Committed: 338622d7ca

TBR=ahaas@chromium.org,bradnelson@google.com,hpayer@chromium.org,jochen@chromium.org,mark@chromium.org,mseaborn@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2744383002
Cr-Commit-Position: refs/heads/master@{#43757}
2017-03-13 20:03:25 +00:00
eholk
338622d7ca [wasm] Initial signal handler
This is basically the minimum viable signal handler for Wasm bounds checks.
It includes the TLS check and the fine grained instructions checks. These
two checks provide most of the safety for the signal handler. Future CLs will
add code range and data range checks for more robustness.

The trap handling code and data structures are all in src/trap-handler, with
the code that actually runs in the signal handler confined to
src/trap-handler/signal-handler.cc.

This changes adds a new V8 API that the embedder should call from a signal
handler that will give V8 the chance to handle the fault first. For hosts that
do not want to implement their own signal handler, we include the option to
install a simple one. This simple handler is also used for the tests.

When a Wasm module is instantiated, information about each function is passed
to the trap handler, which is used to classify faults. These are removed during
the instance finalizer.

Several future enhancements are planned before turning this on by default.
Obviously, the additional checks will be added to MaybeHandleFault. We are
also planning to add a two-level CodeObjectData table that is grouped by
isolates to make cleanup easier and also reduce potential for contending on
a single data structure.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2371833007
Cr-Original-Commit-Position: refs/heads/master@{#43523}
Committed: a5af7fe9ee
Review-Url: https://codereview.chromium.org/2371833007
Cr-Commit-Position: refs/heads/master@{#43755}
2017-03-13 19:14:35 +00:00
kozyatinskiy
c418902be4 [inspector] don't make v8::debug::Call for breakProgram.
We emulate break by callling breakProgramCallback function in debugger context, we can just use HandleDebugBreak.
It allows us to move all stepping logic to debug.cc later and remove one usage of debugger context.
+ two minor issues fixed, see tests.

BUG=v8:5510
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2738503006
Cr-Commit-Position: refs/heads/master@{#43750}
2017-03-13 14:59:43 +00:00
littledan
01cc4f9fbb test262 roll
A couple infrastructure changes went into this patch:
- test262 changed from expecting $ to $262
- upstream-local-tests.sh gets a command-line parameter for ease of use
- Fixed up the FAIL_SLOPPY infrastructure, which seems to have bit-rotted
- Inserted a terrible hack to get around test262 tests with a $ in the name

Drive-by fix for the length of Intl.DateTimeFormat.prototype.format

R=adamk

Review-Url: https://codereview.chromium.org/2733843002
Cr-Commit-Position: refs/heads/master@{#43749}
2017-03-13 14:33:07 +00:00
Michael Achenbach
8e4be1a2e3 [test] Fix typo in testing variant name
This makes it possible to directly request testing noturbofan_stress on the command line.

BUG=chromium:682617
TBR=mstarzinger@chromium.org,mvstanton@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: I6ba9a022c4ef24fb5abe6878d3f2f972e8461eb8
Reviewed-on: https://chromium-review.googlesource.com/453180
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43748}
2017-03-13 14:21:15 +00:00
Peter Marshall
06fef85bdd [builtins] Port TypedArrayConstructByArrayBuffer to CodeStubAssembler.
Part of the performance and refactoring work to move the TypedArray
constructors into CSA. This CL moves ConstructByArrayBuffer from JS
to CSA.

BUG=v8:5977

Change-Id: I0a200e6b3f6261ea2372ea9c3d3ca98e313cf2c5
Reviewed-on: https://chromium-review.googlesource.com/451620
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43747}
2017-03-13 14:04:37 +00:00
Ilija.Pavlovic
d9bcc067ca [turbofan] Fix regress-694088.js for big endian.
Test regress-694088.js is adapted for execution on big endian platforms.

TEST=test/mjsunit/compiler/regress-694088.js
BUG=

Review-Url: https://codereview.chromium.org/2739403002
Cr-Commit-Position: refs/heads/master@{#43746}
2017-03-13 12:59:48 +00:00
yangguo
09de9969cc [debugger] fix switch block source positions.
The switch statement itself is part of the switch block.
However, the source position of the statement is outside of
the block. This leads to confusion for the debugger, if the
switch block pushes a block context: the current context is
a block context, but the scope analysis based on the current
source position tells the debugger that we should be outside
the scope, so we should have the function context.

R=marja@chromium.org
BUG=v8:6085

Review-Url: https://codereview.chromium.org/2744213003
Cr-Commit-Position: refs/heads/master@{#43744}
2017-03-13 12:47:48 +00:00
Caitlin Potter
326d4f436d [builtins] add exception predictions for AsyncFromSyncIterator methods
Add a mechanic to set these Builtin exception predictions per-Isolate
rather than per-Context in the Bootstrapper.

Also add Debugger tests which would fail without these prediction
modes set.

Does not yet test for AsyncFromSyncIteratorPrototypeReturn, as this
requires AsyncGenerators and `yield*` to be hit.

BUG=chromium:691875
R=yangguo@chromium.org, jgruber@chromium.org, gsathya@chromium.org

Change-Id: Ic2d2aba3870cce2f7321080f4278875edf253c76
Reviewed-on: https://chromium-review.googlesource.com/451967
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#43742}
2017-03-13 11:10:38 +00:00
yangguo
07ee0b175c [debugger] correctly annotate scripts with debug id.
Previously, we would incorrectly not assign any debug id to scripts
deserialized from the code cache.

R=jgruber@chromium.org
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2742713003
Cr-Commit-Position: refs/heads/master@{#43740}
2017-03-13 09:13:43 +00:00
shiyu.zhang
78199ce5e0 [turbofan] Enable complex memory operands for binops on ia32/x64
With this change, on ia32 and x64, a load from memory into a register can be replaced by a memory operand for integer binops if it makes sense.

BUG=

Review-Url: https://codereview.chromium.org/2728533003
Cr-Commit-Position: refs/heads/master@{#43739}
2017-03-13 08:50:54 +00:00
Michael Achenbach
384fe54e02 [test] Mark slow msan tests
TBR=mstarzinger@chromium.org,rmcilroy@chromium.org
NOTRY=true

Change-Id: I355953b0b24a64e3c5e1a43cdeaa8ec2650b0988
Reviewed-on: https://chromium-review.googlesource.com/453459
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43737}
2017-03-13 08:17:54 +00:00
bmeurer
9bee8f1065 [turbofan] Fix lowering of Number.isNaN().
BUG=v8:6082
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2743183003
Cr-Commit-Position: refs/heads/master@{#43735}
2017-03-13 07:00:59 +00:00
Sathya Gunasekaran
36a22fe775 [debug] Add exception predictions to builtins where missing.
This fixes the catch predictions for the following builtins --
AsyncFunctionAwaitCaught
AsyncFunctionAwaitUncaught
PromiseResolveClosure
ResolvePromise
PromiseResolve

Added tests for each.

Added whitelist for builtins behind a flag.

BUG=chromium:691875

Change-Id: I816cafdb69f0c9f1eefc440a0a44c36713d0b7dc
Reviewed-on: https://chromium-review.googlesource.com/450894
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43725}
2017-03-10 17:44:51 +00:00
kozyatinskiy
fb147b0ef1 [inspector] merged IsSubjectToDebugging and IsBlackboxed and fixed issue
- additionally doesn't deoptimize function in HandleDebugBreak for debugger statements inside of blackboxed code.

BUG=none
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2742843003
Cr-Commit-Position: refs/heads/master@{#43724}
2017-03-10 17:44:35 +00:00
Michael Starzinger
f2ad990f41 Fix bogus implication from --turbo to --crankshaft.
Now that the --turbo flag is on by default, this implication makes it
impossible to disable the runtime profiler to prevent functions from
being considered hot. Essentially the --nocrankshaft flag was borked.

R=machenbach@chromium.org

Change-Id: I698008b4b69038e8bfab6d8ec3ccf57e2fd71701
Reviewed-on: https://chromium-review.googlesource.com/452619
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43720}
2017-03-10 11:37:24 +00:00
Camillo Bruni
53d67fe45d [tools] Show more entries in the ticks-processor
- lower the cutoff-threshold for bottom up graphs to 1%
- show all builtins/stubs/ics by default

R=jkummerow@chromium.org

Change-Id: I522173155b817ae20a37c40ecf411f2b55d82105
Reviewed-on: https://chromium-review.googlesource.com/452482
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43717}
2017-03-10 10:34:11 +00:00
yangguo
faf5f52627 [debugger,api] deprecate everything in v8-debug.h
R=clemensh@chromium.org, jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2727393003
Cr-Commit-Position: refs/heads/master@{#43714}
2017-03-10 07:06:25 +00:00
yangguo
62b0fa2ee9 Allow C++11 in unittests.
BUG=v8:6072

Review-Url: https://codereview.chromium.org/2741573003
Cr-Commit-Position: refs/heads/master@{#43712}
2017-03-10 06:35:51 +00:00
yangguo
c827075993 [inspector] do not translate offset to line/column for coverage.
R=caseq@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2741653003
Cr-Commit-Position: refs/heads/master@{#43710}
2017-03-10 05:19:04 +00:00
jing.bao
b9614d4bd1 Add several SIMD opcodes to IA32
CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
Int32x4Add, Int32x4Sub

Also add paddd, psubd, vpaddd, vpsubd, pinsrw to ia32-assembler

BUG=

Review-Url: https://codereview.chromium.org/2695613004
Cr-Original-Commit-Position: refs/heads/master@{#43483}
Committed: 4deb9ffdec
Review-Url: https://codereview.chromium.org/2695613004
Cr-Commit-Position: refs/heads/master@{#43708}
2017-03-10 02:40:06 +00:00
danno
e466744da5 [interpreter] Create custom call opcodes for specific argument counts
Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
and CallProperty2. Also share the bytecode handler code between between
equivalent CallX and CallPropertyX handlers.

Review-Url: https://codereview.chromium.org/2684993002
Cr-Original-Commit-Position: refs/heads/master@{#43290}
Committed: 00d6f1f80a
Review-Url: https://codereview.chromium.org/2684993002
Cr-Commit-Position: refs/heads/master@{#43700}
2017-03-09 14:40:02 +00:00
bmeurer
18be5d7057 [turbofan] Revert invalid optimization of flooring division.
The optimization

  NumberFloor(NumberDivide(lhs, rhs))

to

  NumberToInt32(NumberDivide(lhs, rhs))

for potentially negative lhs is not valid, since Math.floor rounds
towards -infinity, whereas ToInt32 truncates.

BUG=chromium:699282
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2743673002
Cr-Commit-Position: refs/heads/master@{#43699}
2017-03-09 13:41:39 +00:00
Michael Achenbach
f58177dd92 [test] Switch future/no-turbo perf configs for js-tests
BUG=chromium:682617
NOTRY=true
R=mvstanton@chromium.org,petermarshall@chromium.org

Change-Id: I5902c4ac3c8fb4230142896addbb75a9e7d28fbb
Reviewed-on: https://chromium-review.googlesource.com/451378
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43694}
2017-03-09 13:38:02 +00:00
Igor Sheludko
fa7b88fddd [json] Fix error reporting when parsing an internalized one-byte string.
BUG=chromium:686010

Change-Id: I7bd4ab48f90a1013132bf037fd352ab55747189c
Reviewed-on: https://chromium-review.googlesource.com/451377
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43691}
2017-03-09 12:28:17 +00:00
yangguo
f2408624c9 [json] use OrderedHashSet for replacer property list.
R=ishell@chromium.org
BUG=v8:6071

Review-Url: https://codereview.chromium.org/2740073002
Cr-Commit-Position: refs/heads/master@{#43690}
2017-03-09 12:27:46 +00:00
Igor Sheludko
c03c7b7387 [runtime] Prototype const-to-mutable field migrations without deprecating maps.
It depends on constant field tracking and currently disabled.

BUG=v8:5495

Change-Id: I6202cddfc2d32b5a06c5ab00c42caa6e276a3eb1
Reviewed-on: https://chromium-review.googlesource.com/451639
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43687}
2017-03-09 12:26:12 +00:00
jgruber
5002a4a961 [regexp] Properly flatten string during initialization
This fixes an incorrect usage of String::Flatten in EscapeRegExpSource.

It also adds %ConstructConsString (to easily and reliably construct cons
strings in tests) and Factory::NewConsString (to enable guaranteed cons
string construction without preemptive flattening attempts).

BUG=chromium:698790

Review-Url: https://codereview.chromium.org/2736383003
Cr-Commit-Position: refs/heads/master@{#43686}
2017-03-09 12:25:19 +00:00
bbudge
cbfd9f5ede [WASM] Make F32x4 Tests pass on ARM hardware.
- Changes input filtering to test NaNs, but skip very large or very
  small inputs, which may cause imprecision on some platforms.
- Changes expected result filtering to only skip NaNs.

LOG=N
BUG=6020

Review-Url: https://codereview.chromium.org/2738703006
Cr-Commit-Position: refs/heads/master@{#43681}
2017-03-09 00:07:03 +00:00
hpayer
b643bb7713 [heap] Add atomics to mark bit operations.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2492263002
Cr-Commit-Position: refs/heads/master@{#43679}
2017-03-08 16:31:18 +00:00
Michael Starzinger
fb887b8192 [zone] Fix propagation of OOM in Zone::NewSegment.
This fixes various allocator methods to properly propagate {nullptr} to
callers without accidentally dereferencing it. We also disable one test
case for stress mode as it runs out of memory due to inlining limits
being lifted in the stress mode.

R=bmeurer@chromium.org
TEST=mjsunit/array-natives-elements
BUG=v8:6061

Change-Id: Id0a7b826a8612d00b4f4ae8aa0bea011c50890ca
Reviewed-on: https://chromium-review.googlesource.com/451365
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43672}
2017-03-08 13:26:55 +00:00
bmeurer
6560707945 [ia32] Fix invalid DCHECK on cmpw with immediate.
The immediate passed to cmpw can be either a signed 16-bit or an
unsigned 16-bit integer, but the DCHECK was testing for signed 16-bit
values only.

R=mstarzinger@chromium.org
BUG=v8:6063

Review-Url: https://codereview.chromium.org/2735363002
Cr-Commit-Position: refs/heads/master@{#43671}
2017-03-08 13:04:45 +00:00
cwhan.tunz
5fc1bd5b32 [typedarrays] check byte offset for fast typedarray sort
BUG=v8:5953

Review-Url: https://codereview.chromium.org/2733393002
Cr-Commit-Position: refs/heads/master@{#43666}
2017-03-08 12:01:19 +00:00
Michael Lippautz
efd4b2d3af [heap] Bail out for page promotion tests when feature is disabled
BUG=chromium:651354

Change-Id: Iaa2be2504474842d101f19fa2f6c15baa88544c6
Reviewed-on: https://chromium-review.googlesource.com/451497
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43665}
2017-03-08 12:01:10 +00:00
yangguo
77165eb4df [debug] change coverage API to use offset instead of line/column.
R=caseq@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2733783002
Cr-Commit-Position: refs/heads/master@{#43662}
2017-03-08 07:23:21 +00:00
jarin
18f169d46c [turbofan] Propagate minus-zero truncation in representation inference.
This introduces a new truncation bit for truncation of minus-zero to zero.

At the moment it is only used to handle the limit cases of deopt, such as the
one in the Google maps workload (see simplified version below), where the -q
(which is desugared to q * -1.0) currently deoptimizes because the result would
produce minus zero. To handle this situation, we exploit the knowledge that
righthand side of + cannot be -0, so even if lefthand side was -0, the result
would still be 0 (so the + operation cannot distinguish between left hand side
0 and -0).

function f(q) {
  q -= 4;
  return (-q) + q;
}

f(10);
f(10);
%OptimizeFunctionOnNextCall(f);
f(4);

Review-Url: https://codereview.chromium.org/2734253002
Cr-Commit-Position: refs/heads/master@{#43661}
2017-03-08 06:11:37 +00:00
bbudge
78382d7272 [WASM] Implement remaining F32x4 operations for ARM.
- Implements Float32x4 Mul, Min, Max for ARM.
- Implements Float32x4 relational ops for ARM.
- Implements reciprocal, reciprocal square root estimate/refinement ops for ARM.
- Reorganizes tests to eliminate need for specialized float ref fns in tests.
- Rephrases Gt, Ge in terms of Lt, Le, and eliminates the redundant machine
  operators.
- Renames test-run-wasm-simd test names to match instructions.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2729943002
Cr-Commit-Position: refs/heads/master@{#43658}
2017-03-08 00:01:36 +00:00
kozyatinskiy
e502665d34 [inspector] added createContextGroup for tests
BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2737603006
Cr-Commit-Position: refs/heads/master@{#43657}
2017-03-07 22:30:05 +00:00
kozyatinskiy
07ada64a57 [inspector] added length for scriptParsed notification
BUG=none
R=caseq@chromium.org

Review-Url: https://codereview.chromium.org/2740623002
Cr-Commit-Position: refs/heads/master@{#43656}
2017-03-07 22:01:37 +00:00
Ross McIlroy
f774d8c56f [Flags] Add negation implications for --turbo negative so --no-turbo works.
Once we enabled --turbo by default we need to turn all the implications
off with --no-turbo as well. Chrome sets flags in V8 using SetFlagFromString,
which enforces the implications each time it is called. Therefore, if --turbo
is enabled by default, and an unrelated flag is set, the turbo implications are
enabled but not later disabled if we set --no-turbo. To fix this, add negative
implications as well.

BUG=chromium:692409

Change-Id: Iadb0ca542f49ba65c7419cda8c7a03636a8d5ba9
Reviewed-on: https://chromium-review.googlesource.com/451320
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43655}
2017-03-07 20:41:12 +00:00
clemensh
6cf8f54d90 [wasm] Fix interpreter entry for i64 return type
Fix two issues in the interpreter entry for 64 bit return values on
32 bit platforms. First, the effect chain was slightly incorrect, second
the order of the returned values was wrong.

Also add a test case for this.
Tested on x64, ia32 and s390.

Plus drive-by fix in Int64Lowering to reuse global constants for
big-endian/little-endian disambiguation.

R=titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2731713002
Cr-Commit-Position: refs/heads/master@{#43654}
2017-03-07 18:03:08 +00:00
bbudge
b23f6a462e [WASM] Fix failing F32x4 Equal, NotEqual tests.
- Fix typo, compare operand diff should be a float.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2734173003
Cr-Commit-Position: refs/heads/master@{#43651}
2017-03-07 17:52:08 +00:00
jkummerow
c478a2298d SnapshotCreator: start from existing snapshot if we have one
This requires serialized data to track the number of API-provided
external references separately.
And it flushes out a case of serialized data corruption (stored "length"
field too large) that we didn't handle without crashing.

BUG=v8:6055

Review-Url: https://codereview.chromium.org/2736923002
Cr-Commit-Position: refs/heads/master@{#43649}
2017-03-07 16:36:51 +00:00
bjaideep
7c0f3f0623 AIX: Work around for malloc(0) behavior
malloc(0) returning 0 is expected behavior on AIX but
compiling with -D_LINUX_SOURCE_COMPAT, malloc(0) should
return a valid pointer (which we do define for AIX). However,
including cstdlib resets the behaviour of _LINUX_SOURCE_COMPAT.
GCC bug: 79839

R=jochen@chromium.org, titzer@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2732743002
Cr-Commit-Position: refs/heads/master@{#43647}
2017-03-07 15:49:20 +00:00
hpayer
6517b4477c [heap] Do not clear mark bits of left trimmed old object start.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2731363002
Cr-Commit-Position: refs/heads/master@{#43645}
2017-03-07 15:16:49 +00:00
Toon Verwaest
7bc196d2a5 [interpreter] Mark known immutable context slots as immutable
BUG=

Change-Id: I85f9619e0ecb7d0ebee9523e3b4c44ab7f091cfb
Reviewed-on: https://chromium-review.googlesource.com/451380
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43644}
2017-03-07 14:56:05 +00:00
ahaas
040fa762df [arm64][turbofan] Do not use ubfx for shr+and combination for mask=0.
R=titzer@chromium.org, v8-arm-ports@googlegroups.com
BUG=v8:6046

Review-Url: https://codereview.chromium.org/2737493002
Cr-Commit-Position: refs/heads/master@{#43643}
2017-03-07 14:54:05 +00:00
bmeurer
f0e7a3174e [turbofan] Extend optimization of flooring integer division.
So far we only recognize the special

  NumberFloor(NumberDivide(lhs, rhs))

subgraph when both lhs and rhs are in the Unsigned32 range, and the
result is a PlainNumber. Extend this pattern matching to also cover

  NumberFloor(SpeculativeNumberDivide(lhs, rhs))

and to replace the NumberFloor with NumberToInt32 truncation if the
lhs value is in Signed32 range and the rhs is in Unsigned32 range.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2739573004
Cr-Commit-Position: refs/heads/master@{#43642}
2017-03-07 14:46:10 +00:00
Marja Hölttä
f489f7ab44 [parser] Skipping inner funcs: collect data needed for allocation, not the allocation result.
This pretty much rewrites the preparsed scope data collection. We used to store
the allocation result, but it's faster to just store the raw data which is
needed for deciding it later. (This way we don't need to run the allocation
algorithm for just getting this data.)

For each variable: is_used, maybe_assigned,
has_forced_context_allocation, and for each scope:
inner_scope_calls_eval_.

In addition, this CL moves data handling out of Scope and into
PreParsedScopeData where it belongs and simplifies the API for
PreParsedScopeData.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Ia5a4fa52f585cd4f483ce9a92f2dd7d9754f34ed
Reviewed-on: https://chromium-review.googlesource.com/451273
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43641}
2017-03-07 14:23:14 +00:00
ulan
dab18fb0bb Make idle tasks optional in the default platform.
BUG=v8:6056

Review-Url: https://codereview.chromium.org/2737743002
Cr-Commit-Position: refs/heads/master@{#43640}
2017-03-07 13:37:41 +00:00
mvstanton
15bed19495 Adjust some tests to prepare enabling Ignition+TurboFan
BUG=v8:5267, chromium:692409

Review-Url: https://codereview.chromium.org/2720713003
Cr-Commit-Position: refs/heads/master@{#43638}
2017-03-07 13:27:55 +00:00
Michael Starzinger
aa894affc8 Remove dead handling of Token::NE from all backends.
The parser already changes all negative equality comparison operations
to their positive pendants in {ParserBase::ParseBinaryExpression}. No
other source of the Token::NE exists in the system. We can remove all
handling from the compiler and interpreter backends.

R=bmeurer@chromium.org

Change-Id: I58722c08dd8e498f20c65886fce86b8172737b10
Reviewed-on: https://chromium-review.googlesource.com/449716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43627}
2017-03-07 09:18:24 +00:00
Peter Marshall
ead3656cbd [builtins] Port TypedArrayConstructByLength to CodeStubAssembler.
Part of the performance and refactoring work to move the TypedArray
constructors into CSA. This CL moves ConstructByLength from JS
to CSA.

There are still other callers to typed_array_initialize in
typedarray.js, so we share the implementation using DoInitialize.

In a later CL we can split apart DoInitialize once we have more
TA constructors written in CSA, so that we can reuse specific
parts more easily.

BUG=v8:5977

Change-Id: Ia51e8363970e9a025a82933e56a7baaf82cb1eec
Reviewed-on: https://chromium-review.googlesource.com/448220
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43626}
2017-03-07 09:15:17 +00:00
Ross McIlroy
dba45fde81 [IdentityMap] Remove ability to delete entries during iteration.
Deletion can cause collisions to be moved in the map which breaks iteration.
For now just remove this support. Also add some additional collision tests
to the test.

BUG=v8:5203

Change-Id: I54a0a4af51da08b3f963dc1d7661dba291e4efea
Reviewed-on: https://chromium-review.googlesource.com/445900
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43621}
2017-03-06 21:15:20 +00:00
yangguo
5e0c178fe6 [debugger] remove default count for top-level functions.
If the top-level function cannot be found, we previously assumed an
invocation count of 1. This is wrong when we expect the invocation
counts to be reset for precise coverage.

TBR=jgruber@chromium.org
R=caseq@chromium.org,pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2723003007
Cr-Commit-Position: refs/heads/master@{#43620}
2017-03-06 20:49:11 +00:00
kozyatinskiy
562da35614 [inspector] added type of break location into getPossibleBreakpoints output
This CL provide type with each break location, type could be: call, return or debugger statement.

BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2728563002
Cr-Commit-Position: refs/heads/master@{#43619}
2017-03-06 20:47:55 +00:00
ulan
a3923ce210 [heap] Implement simple marking in the concurrent marking thread.
The concurrent marker uses ObjectVisitor to iterate pointers in objects
and local marking bitmaps to keep track of visited objects.

To keep it simple for now, I removed support for multiple tasks
and canceling unfinished tasks.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2732053002
Cr-Commit-Position: refs/heads/master@{#43618}
2017-03-06 20:46:41 +00:00
kozyatinskiy
47276d3db3 [inspector] introduced Debugger.scheduleStepIntoAsync
This method could be called on pause and will do stepInto next scheduled callback if any will happen until next break.
First implementation support only callbacks chained by Promise.prototype.then.

BUG=chromium:432469
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2723273002
Cr-Commit-Position: refs/heads/master@{#43616}
2017-03-06 16:28:21 +00:00
ulan
e96b5ed423 [heap] Implement concurrent marking boilerplate.
This patch adds a trivial ConcurrentMarking class that can start
background tasks.

BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2728363002
Cr-Commit-Position: refs/heads/master@{#43615}
2017-03-06 15:19:36 +00:00
Clemens Hammacher
7d8a3028dd [wasm] Fix code specialization for empty memory buffer
From asm.js code we might get an empty ArrayBuffer as heap memory. In
this case, both the old memory start and the new memory start will be
nullptr. The size however has to be patched from default_size to 0.

This CL changes code specialization to be able to either patch memory
references, or patch memory sizes or both.

R=titzer@chromium.org, ahaas@chromium.org
BUG=chromium:698587

Change-Id: I4d9d811d75cb83842f23df317e8e7fc02aeb5146
Reviewed-on: https://chromium-review.googlesource.com/450257
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43613}
2017-03-06 13:39:54 +00:00
bmeurer
1e4a2725b8 [turbofan] Teach escape analysis about ObjectIsNaN.
BUG=chromium:698607
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2735633003
Cr-Commit-Position: refs/heads/master@{#43612}
2017-03-06 12:55:28 +00:00
jarin
fe704477d6 [deoptimizer] When deoptimizing code, unlink all functions referring to that code.
Drive by: remove two unused methods in optimized code visitor.

Review-Url: https://codereview.chromium.org/2730323002
Cr-Commit-Position: refs/heads/master@{#43611}
2017-03-06 12:22:05 +00:00
hpayer
bb31612af1 [heap] Remove Marking::BlackToWhite and Marking::GreyToWhite.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2737483002
Cr-Commit-Position: refs/heads/master@{#43609}
2017-03-06 12:10:05 +00:00
addaleax
de1461b7ef Drop UniqueId from include/v8.h
It's unused since March 2 2017 (https://chromium-review.googlesource.com/448539).
This removes it assuming that leaving it in the header was an oversight.

BUG=v8:5828

Review-Url: https://codereview.chromium.org/2732803002
Cr-Commit-Position: refs/heads/master@{#43605}
2017-03-06 10:58:01 +00:00
jarin
fcce4797bc [profiler] Graphical front-end for tick processor.
Improvements:
- top-down call tree.
- interactive restriction to time interval.

Review-Url: https://codereview.chromium.org/2696903002
Cr-Commit-Position: refs/heads/master@{#43599}
2017-03-04 13:04:58 +00:00
bakkot
baa74e89b6 [parser] Correctly handle invalid escapes in adjacent template tokens.
A previous patch lifting the restriction on invalid escape sequences in
tagged templates had a bug when two template tokens appeared immediately
adject to each other. This moves invalid escape information from the
tokenizer state proper into the TokenDesc, preventing the overwriting
which caused this issue.

Previous CL is at
https://codereview.chromium.org/2665513002

BUG=v8:6029,v8:5546

Review-Url: https://codereview.chromium.org/2724003006
Cr-Commit-Position: refs/heads/master@{#43596}
2017-03-03 22:08:57 +00:00
luoe
3a20c322bb [inspector] remove iterators and for...of loops from injected-script-source
BUG=chromium:686003

Review-Url: https://codereview.chromium.org/2705533002
Cr-Commit-Position: refs/heads/master@{#43595}
2017-03-03 19:30:40 +00:00
bmeurer
9ef1e35bc6 [turbofan] Drop obsolete unused JSStrictNotEqual operator.
We don't need the JSStrictNotEqual operator in the compiler, because
this is never generated by the BytecodeGraphBuilder, and the code in
the AstGraphBuilder was dead code. Also remove the backing builtin
StrictNotEqual.

R=mstarzinger@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2727003006
Cr-Commit-Position: refs/heads/master@{#43594}
2017-03-03 17:59:21 +00:00
Ross McIlroy
8ec7144e0f [Compiler] Process multiple jobs in background compiler dispatcher task.
Spinning up a new background task is expensive, and many times an existing
task will finish it's work before a new task starts work on a job, so enable
the existing tasks to do more than one background job.

BUG=v8:5203

Change-Id: Ibbef317c8bb3921c36a096fed88d244716be9c42
Reviewed-on: https://chromium-review.googlesource.com/441706
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43593}
2017-03-03 17:28:39 +00:00
Marja Hölttä
5178fa0e76 [parser] Skipping inner funcs: add tests.
BUG=v8:5516
R=verwaest@chromium.org

Change-Id: Ica04f74788a4812128bce1297aeee23f8c3bec3d
Reviewed-on: https://chromium-review.googlesource.com/449675
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43591}
2017-03-03 15:01:12 +00:00
Peter Marshall
5f79c9231a [builtins] Ensure length is within Smi range in TypedArray constructor.
The callsite in ConstructByArrayBuffer could have a length that is
above Smi range if the buffer had such a length. Check this before
calling. Add a test too.

BUG=v8:5977, chromium:698201

Change-Id: Ic22046a31607f1f85642c8caf7f5ed064edb3110
Reviewed-on: https://chromium-review.googlesource.com/449813
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43589}
2017-03-03 14:42:34 +00:00
tebbi
e61ff99104 [turbofan] compute arguments length in deoptimizer
Following the design of https://codereview.chromium.org/2692753004, also compute the arguments length in the deoptimizer sucht that it does not have to be computed in optimized code.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2729163002
Cr-Commit-Position: refs/heads/master@{#43587}
2017-03-03 13:43:40 +00:00
hpayer
b7944a5cd5 [heap] Remove Marking::AnyToGrey and change its callers to use simple marking functions.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2728113002
Cr-Commit-Position: refs/heads/master@{#43586}
2017-03-03 13:31:52 +00:00
clemensh
eb36a7dbcf [wasm] Fix importing wasm functions which are being debugged
If the imported wasm function is being debugged (i.e. redirects to the
interpreter), call it via the JS_TO_WASM stub, such that we can disable
the breakpoint later by patching the exported function.

This also contains a drive-by fix in wasm-translation.cc (for the case
that all known positions are bigger than the requested one).

R=titzer@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5971, v8:5822

Review-Url: https://codereview.chromium.org/2720813002
Cr-Commit-Position: refs/heads/master@{#43583}
2017-03-03 12:38:41 +00:00
Peter Marshall
1a6487fd65 Fix incorrect side-effect ordering in TypedArray constructor.
We should throw a RangeError for offset % elementSize before
length.toPrimitive is observable. Adds a test that checks this, too.

BUG=v8:6037

Change-Id: Ie9f2551c8e8fb0018b508762ac93cdc470e15dde
Reviewed-on: https://chromium-review.googlesource.com/449792
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43582}
2017-03-03 12:34:55 +00:00
clemensh
7f68cbbffa [wasm] Prepare WasmCompilationUnit for lazy compilation
In lazy compilation, we only compile one function at a time, and we
might not have the wire bytes of the whole module available.
This CL prepares the WasmCompilationUnit for this setting.
It will also be helpful for streaming compilation.

Also, the ErrorThrower (which might heap-allocate) is not stored in the
WasmCompilationUnit any more. Instead, it is passed to the
FinishCompilation method which is allowed to heap-allocate.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5991

Review-Url: https://codereview.chromium.org/2726553003
Cr-Commit-Position: refs/heads/master@{#43573}
2017-03-03 09:47:39 +00:00
bmeurer
de52562d8e [turbofan] Introduce dedicated ObjectIsNaN operator.
We can compile a !== a and Number.isNaN(a) to ObjectIsNaN. The former is
commonly used to check for NaN, i.e. in case of equals in AngularJS.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2722483003
Cr-Commit-Position: refs/heads/master@{#43572}
2017-03-03 09:08:14 +00:00
kozyatinskiy
0832bae354 [inspector] fixed endLine in Debugger.scriptParsed event
BUG=chromium:698077
R=lushnikov@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2730813002
Cr-Commit-Position: refs/heads/master@{#43567}
2017-03-03 06:58:11 +00:00
loorongjie
dbac977011 Reland Migrate Object.prototype.valueOf to CSA
Original issue: https://codereview.chromium.org/2724833002/

BUG=v8:6005
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel
R=bmeurer@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2725053007
Cr-Commit-Position: refs/heads/master@{#43566}
2017-03-03 06:30:26 +00:00
aseemgarg
8b130a8495 [wasm] Implement simd lowering for F32x4 and I32x4 compare ops
R=bbudge@chromium.org,titzer@chromium.org,gdeepti@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2728823005
Cr-Commit-Position: refs/heads/master@{#43562}
2017-03-03 02:31:44 +00:00
aseemgarg
81ad6b521f [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions
This fixes and relands https://codereview.chromium.org/2718323003.

R=bbudge@chromium.org,titzer@chromium.org,ahaas@chromium.org,machenbach@chromium.org,bradnelson@chromium.org
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2724973003
Cr-Commit-Position: refs/heads/master@{#43561}
2017-03-03 02:04:07 +00:00
Adam Klein
fb16583179 Retain source order when hoisting sloppy block functions
This involved adding a count_ member to SloppyBlockFunctionMap, so
to avoid making DeclarationScope larger, this patch makes the
creation of the map lazy, thus reducing the size of DeclarationScope
by several words in the process.

BUG=chromium:688567

Change-Id: If9a9eb2ccc01690fe10edadb3aa9625454ff4a19
Reviewed-on: https://chromium-review.googlesource.com/448701
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43558}
2017-03-02 21:06:00 +00:00
bbudge
386e5a1149 Implement remaining Boolean SIMD operations on ARM.
- Implements Select instructions using a single ARM vbsl instruction.
- Renames boolean machine operators to match renamed S1xN machine types.
- Implements S1xN vector logical ops, AND, OR, XOR, NOT for ARM.
- Implements S1xN AnyTrue, AllTrue ops for ARM.
- Eliminates unused SIMD op categories in opcodes.h.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2711863002
Cr-Commit-Position: refs/heads/master@{#43556}
2017-03-02 19:50:33 +00:00
ahaas
91cd070769 [arm64][turbofan] Tst instructions can have a shifted operand.
This CL fixes a bug in the implementation of the code generation of
kArm64Tst32, where the shift input operand of kArm64Tst32 was ignored.
Please take a special look at the fix in kArm64Tst. I applied the fix
there as well, but because of differences in the instruction selector
I was not able to write a test for it.

R=v8-arm-ports@googlegroups.com
BUG=v8:6028

Review-Url: https://codereview.chromium.org/2729853003
Cr-Commit-Position: refs/heads/master@{#43555}
2017-03-02 19:46:09 +00:00
Michael Lippautz
78867ad870 Remove object grouping
Enbedders should switch to EmbedderHeapTracer API.

BUG=v8:5828

Change-Id: I82f2bc583d246617865a17f5904e02cd35f92fec
Reviewed-on: https://chromium-review.googlesource.com/448539
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43551}
2017-03-02 17:53:07 +00:00
ulan
2e00025038 [inspector] Enable debugger/pause-on-oom test with larger heap limit.
BUG=v8:6018

Review-Url: https://codereview.chromium.org/2729843002
Cr-Commit-Position: refs/heads/master@{#43550}
2017-03-02 17:49:15 +00:00
Peter Marshall
ff8b1abb1a [builtins] Reland of Port TypedArrayInitialize to CodeStubAssembler.
Turbofan is a lot slower than Crankshaft at constructing TypedArrays,
because we always go to the C++ builtin. Port the builtin to CSA
to improve performance, and to clean up the implementation, which is
split across multiple files and pieces at the moment.

This CL increases the performance with --future to roughly the same
as with crankshaft.

BUG=v8:5977

Change-Id: Id0d91a4592de41a3a308846d79bd44a608931762
Reviewed-on: https://chromium-review.googlesource.com/448537
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43548}
2017-03-02 14:31:18 +00:00
machenbach
d7cb3cfc91 Revert of Migrate Object.prototype.valueOf to CSA (patchset #4 id:80001 of https://codereview.chromium.org/2724833002/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13900

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Migrate Object.prototype.valueOf to CSA
>
> BUG=v8:6005
>
> Review-Url: https://codereview.chromium.org/2724833002
> Cr-Commit-Position: refs/heads/master@{#43539}
> Committed: f93b27e639

TBR=bmeurer@chromium.org,yangguo@chromium.org,loorongjie@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6005

Review-Url: https://codereview.chromium.org/2730573004
Cr-Commit-Position: refs/heads/master@{#43547}
2017-03-02 14:26:45 +00:00
loorongjie
f93b27e639 Migrate Object.prototype.valueOf to CSA
BUG=v8:6005

Review-Url: https://codereview.chromium.org/2724833002
Cr-Commit-Position: refs/heads/master@{#43539}
2017-03-02 12:57:21 +00:00
clemensh
fa8dba0e86 [wasm] Several unrelated cleanups
Most are minor performance optimizations that aggregated while implementing
other changes. Those fixes will probably not be visible in perf graphs, but
they bothered me anyway.

R=titzer@chromium.org, ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2714373003
Cr-Commit-Position: refs/heads/master@{#43535}
2017-03-02 10:42:22 +00:00
bbudge
f3d26d3d55 [WASM] Fix failing Wasm SIMD F32x4 tests.
- Perform lane checks using FP compare instead of reinterpret casts. 0 and -0
will be different under I32 compare.
- Some arithmetic operations can generate NaN results, such as adding -Inf
and +Inf. Skip these tests until we have a way to do more sophisticated
FP comparisons in the SIMD tests.
- Eliminate a redundant F32x4 parameter for FP SIMD vector checking. We will only have this one FP type.

LOG=N
BUG=v8:6020

Review-Url: https://codereview.chromium.org/2594043002
Cr-Original-Commit-Position: refs/heads/master@{#42154}
Committed: 5560bbb498
Review-Url: https://codereview.chromium.org/2594043002
Cr-Commit-Position: refs/heads/master@{#43528}
2017-03-01 23:31:47 +00:00
Marja Hölttä
12c2c15310 [parser] Skipping inner funcs: arrow functions now work too.
BUG=v8:5516
R=verwaest@chromium.org

Change-Id: I1bb88e981b81fec85ba6da314e3be927085e6e76
Reviewed-on: https://chromium-review.googlesource.com/447438
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43526}
2017-03-01 20:21:06 +00:00
bmeurer
0b3e554e03 Revert of [wasm] Initial signal handler (patchset #56 id:1090001 of https://codereview.chromium.org/2371833007/ )
Reason for revert:
Breaks tree, i.e. https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20ASAN/builds/18928/steps/Check/logs/grow-memory

Original issue's description:
> [wasm] Initial signal handler
>
> This is basically the minimum viable signal handler for Wasm bounds checks.
> It includes the TLS check and the fine grained instructions checks. These
> two checks provide most of the safety for the signal handler. Future CLs will
> add code range and data range checks for more robustness.
>
> The trap handling code and data structures are all in src/trap-handler, with
> the code that actually runs in the signal handler confined to
> src/trap-handler/signal-handler.cc.
>
> This changes adds a new V8 API that the embedder should call from a signal
> handler that will give V8 the chance to handle the fault first. For hosts that
> do not want to implement their own signal handler, we include the option to
> install a simple one. This simple handler is also used for the tests.
>
> When a Wasm module is instantiated, information about each function is passed
> to the trap handler, which is used to classify faults. These are removed during
> the instance finalizer.
>
> Several future enhancements are planned before turning this on by default.
> Obviously, the additional checks will be added to MaybeHandleFault. We are
> also planning to add a two-level CodeObjectData table that is grouped by
> isolates to make cleanup easier and also reduce potential for contending on
> a single data structure.
>
> BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277
>
> Review-Url: https://codereview.chromium.org/2371833007
> Cr-Commit-Position: refs/heads/master@{#43523}
> Committed: a5af7fe9ee

TBR=ahaas@chromium.org,bradnelson@google.com,hpayer@chromium.org,jochen@chromium.org,mark@chromium.org,mseaborn@chromium.org,titzer@chromium.org,eholk@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2723133003
Cr-Commit-Position: refs/heads/master@{#43525}
2017-03-01 19:47:27 +00:00
eholk
a5af7fe9ee [wasm] Initial signal handler
This is basically the minimum viable signal handler for Wasm bounds checks.
It includes the TLS check and the fine grained instructions checks. These
two checks provide most of the safety for the signal handler. Future CLs will
add code range and data range checks for more robustness.

The trap handling code and data structures are all in src/trap-handler, with
the code that actually runs in the signal handler confined to
src/trap-handler/signal-handler.cc.

This changes adds a new V8 API that the embedder should call from a signal
handler that will give V8 the chance to handle the fault first. For hosts that
do not want to implement their own signal handler, we include the option to
install a simple one. This simple handler is also used for the tests.

When a Wasm module is instantiated, information about each function is passed
to the trap handler, which is used to classify faults. These are removed during
the instance finalizer.

Several future enhancements are planned before turning this on by default.
Obviously, the additional checks will be added to MaybeHandleFault. We are
also planning to add a two-level CodeObjectData table that is grouped by
isolates to make cleanup easier and also reduce potential for contending on
a single data structure.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2371833007
Cr-Commit-Position: refs/heads/master@{#43523}
2017-03-01 18:02:13 +00:00
Eric Holk
d6808c0f9c [wasm] compile fuzzer: initialize temporary before filling.
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=697191

Change-Id: I01ddd6824b1a79d86944ac766f5c2070e9b0c244
Reviewed-on: https://chromium-review.googlesource.com/448317
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43522}
2017-03-01 17:33:29 +00:00
Peter Marshall
a8e15e8fc5 Revert "[builtins] Port TypedArrayInitialize to CodeStubAssembler."
This reverts commit b23b2c107b.

Reason for revert: Makes Linux debug bot sad

Original change's description:
> [builtins] Port TypedArrayInitialize to CodeStubAssembler.
> 
> Turbofan is a lot slower than Crankshaft at constructing TypedArrays,
> because we always go to the C++ builtin. Port the builtin to CSA
> to improve performance, and to clean up the implementation, which is
> split across multiple files and pieces at the moment.
> 
> This CL increases the performance with --future to roughly the same
> as with crankshaft.
> 
> BUG=v8:5977
> 
> Change-Id: I5a4c4b544a735a56290b85bf33c2f3718df7e2b8
> Reviewed-on: https://chromium-review.googlesource.com/445717
> Commit-Queue: Peter Marshall <petermarshall@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43518}

TBR=cbruni@chromium.org,petermarshall@chromium.org,bmeurer@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5977

Change-Id: I5d5bc8b4677a405c716d78e688af80ae9c737b4a
Reviewed-on: https://chromium-review.googlesource.com/448558
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43520}
2017-03-01 15:55:51 +00:00
hpayer
c45d065edc [heap] Remove Marking::MarkBlack and some minor cleanups.
BUG=chromium:694255

Review-Url: https://codereview.chromium.org/2720133005
Cr-Commit-Position: refs/heads/master@{#43519}
2017-03-01 14:53:20 +00:00
Peter Marshall
b23b2c107b [builtins] Port TypedArrayInitialize to CodeStubAssembler.
Turbofan is a lot slower than Crankshaft at constructing TypedArrays,
because we always go to the C++ builtin. Port the builtin to CSA
to improve performance, and to clean up the implementation, which is
split across multiple files and pieces at the moment.

This CL increases the performance with --future to roughly the same
as with crankshaft.

BUG=v8:5977

Change-Id: I5a4c4b544a735a56290b85bf33c2f3718df7e2b8
Reviewed-on: https://chromium-review.googlesource.com/445717
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43518}
2017-03-01 14:28:23 +00:00
Michael Starzinger
6ec735e08b [compiler] Fix {UseTurboFan} for disabled optimization.
This fixes a corner-case in the above predicate that was introduced to
allow fully disabling optimization using %NeverOptimizeFunction. This
property of a function is a transient property (i.e. changes over time),
whereas {UseTurboFan} is designed to be a static property (i.e. gives
same answer over time). Violating this led to cases where functions got
optimization disabled for other reasons would suddenly be baselined.
The correct place to check transient properties is when optimization is
requested.

R=jarin@chromium.org
TEST=mjsunit/never-baseline

Change-Id: I37eb0c70d2b39704be29fd4bda76975bfbede66b
Reviewed-on: https://chromium-review.googlesource.com/447937
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43514}
2017-03-01 12:53:59 +00:00
Andreas Haas
c77622318d [runtime] Fix flattening of ConsStrings with empty first parts.
String::SlowFlatten assumed that ConsStrings with empty first parts have
flattened strings as their second part. TurboFan, however, can create
ConsStrings with empty first parts and arbitrary second parts. With
this CL we call String::Flatten on the second part of a ConsString if
the first part is empty, but only when String::Flatten would not call
String::SlowFlatten.

R=jkummerow@chromium.org

BUG=chromium:696651

Change-Id: I9acb681de1be695e1ec2f6f6d28b9e4dc4344e98
Reviewed-on: https://chromium-review.googlesource.com/448457
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43513}
2017-03-01 12:50:32 +00:00
machenbach
88c240bda5 Revert of [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions (patchset #2 id:20001 of https://codereview.chromium.org/2718323003/ )
Reason for revert:
breaks nosse4:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/13871

Original issue's description:
> [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions
>
> BUG=v8:4124
> R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org
>
> Review-Url: https://codereview.chromium.org/2718323003
> Cr-Commit-Position: refs/heads/master@{#43510}
> Committed: f75748cf4c

TBR=bbudge@chromium.org,bradnelson@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org,aseemgarg@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2723943003
Cr-Commit-Position: refs/heads/master@{#43512}
2017-03-01 12:39:48 +00:00
Ilija.Pavlovic
d0e1de1705 Fix unused lambda captures for big endian targets.
This CL fixes unused lambda captures for big endian targets when Clang
is used for build V8.

TEST=
BUG=

Review-Url: https://codereview.chromium.org/2725613002
Cr-Commit-Position: refs/heads/master@{#43511}
2017-03-01 12:16:09 +00:00
aseemgarg
f75748cf4c [wasm]implement simd lowering for f32x4->i32x4, i32x4 min/max and shift instructions
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2718323003
Cr-Commit-Position: refs/heads/master@{#43510}
2017-03-01 11:39:10 +00:00
aseemgarg
a727f9e8c0 [wasm]implement simd lowering for simple F32x4 and I32x4 unops
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org,mtrofin@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2726453003
Cr-Commit-Position: refs/heads/master@{#43509}
2017-03-01 11:13:00 +00:00
Igor Sheludko
e003d21d4a [runtime] Properly handle null constructor case when feeding back normalization.
BUG=chromium:697017

Change-Id: Ibb7165387a983987dcd04be330591b6bb70ff991
Reviewed-on: https://chromium-review.googlesource.com/448217
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43507}
2017-03-01 10:02:14 +00:00
Georg Neis
78d9d5b51a [ast] Fix bug in deserialization of catch scopes.
The maybe-assigned flag of the catch variable was not preserved.

BUG=v8:5636,chromium:696332

Change-Id: I9c55e1b1312bdebc53bc45bc3ca1c982bdbe9846
Reviewed-on: https://chromium-review.googlesource.com/447680
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43506}
2017-03-01 08:45:46 +00:00
aseemgarg
e6b9f07d43 [wasm]disable F32x4 and I32x4 cross ops test for arm as they break chromebook build
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2723823002
Cr-Commit-Position: refs/heads/master@{#43504}
2017-02-28 21:53:05 +00:00
kozyatinskiy
9c385f0405 [inspector] added reconnect method for tests
This method enables test of agent::restore methods.
Bonus: forbid setCustomObjectFormatterEnabled on disabled agent.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2713023004
Cr-Commit-Position: refs/heads/master@{#43502}
2017-02-28 20:22:24 +00:00
Georg Neis
1c578f2477 Fix completion value of class declarations.
BUG=v8:6022

Change-Id: I54205cb3ecc2dd31ed62e55726f0ec5fcd202c30
Reviewed-on: https://chromium-review.googlesource.com/446349
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43500}
2017-02-28 19:36:45 +00:00
Adam Klein
fc023664bd Accurately record eval calls in arrow parameter lists
Previously, we over-approximated Scope::scope_calls_eval_ in
arrow functions: if either the outer scope or the arrow function
parameters had a direct eval call, we marked both scopes as calling
eval. This over-approximation kept getting us into trouble, though,
especially when eager or lazy parsing would disagree about the
"calls eval" bit.

This patch instead tracks eval calls accurately, using a boolean on
Scope::Snapshot that is reset as appropriately depending on whether
a particular AssignmentExpression turned out to be an arrow parameter
list or not.

BUG=chromium:691687

Change-Id: I527dc59b4d32a2797805ff26dc9f70b1311377b2
Reviewed-on: https://chromium-review.googlesource.com/446094
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43499}
2017-02-28 19:15:09 +00:00
Georg Neis
ae66dcbec0 [modules] Make Module::Evaluate return the completion value.
This is more useful than always returning undefined.

BUG=v8:1569,v8:5978

Change-Id: Id10cf87f7865db1a85de412460eaead4e4bf3b62
Reviewed-on: https://chromium-review.googlesource.com/446846
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43498}
2017-02-28 19:02:32 +00:00
Georg Neis
59c9e6ff69 [modules] Fix bug in Module::Instantiate.
The order in which things were done wasn't quite correct and lead
to wrong behaviour for certain circular module graphs.

BUG=v8:1569,chromium:694566

Change-Id: I291186e261268c853a30ad891ff362904e0b28ef
Reviewed-on: https://chromium-review.googlesource.com/447399
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43497}
2017-02-28 19:00:58 +00:00
yangguo
a813525a07 [regexp] fix /\W/ui wrt \u017f and \u212a.
R=jgruber@chromium.org
BUG=v8:5080

Review-Url: https://codereview.chromium.org/2725583002
Cr-Commit-Position: refs/heads/master@{#43496}
2017-02-28 18:28:42 +00:00
Igor Sheludko
1c7f83980e [runtime] Mark old JSGlobalProxy's map as unstable when an iframe navigates away.
This CL also introduces Realm.navigate(i).

BUG=chromium:683667

Change-Id: I9227292ea3a575f34367e82fc6297d234d3eecae
Reviewed-on: https://chromium-review.googlesource.com/447638
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43494}
2017-02-28 17:05:51 +00:00
kozyatinskiy
497dff7809 [inspector] restore provisional breakpoints smarter
For breakpoints which are set by setBreakpointByUrl(url:..) backend calculates source hint on first related breakpoints resolved event and then uses this hint to adjust breakpoint position in later arrived scripts with the same url or on page reload.

Doc: https://docs.google.com/a/google.com/document/d/1VtWo_-jelzEXSNbjESGTtruZngzXgbHLexfTzxNlnjE/edit?usp=sharing

BUG=chromium:688776
R=pfeldman@chromium.org, alph@chromium.org

Review-Url: https://codereview.chromium.org/2671193002
Cr-Commit-Position: refs/heads/master@{#43493}
2017-02-28 16:14:27 +00:00
mvstanton
bfa425cc08 Remove shared-function-tier-up-default.js
It tests a pipeline configuration we are removing.

BUG=v8:5778

Review-Url: https://codereview.chromium.org/2715153005
Cr-Commit-Position: refs/heads/master@{#43491}
2017-02-28 15:31:08 +00:00
Marja Hölttä
14ac291a03 [parser] Skipping inner funcs: simplify rest parameter handling.
With the params (a, b, ...c) the param / variable declaration order used to be
"temp, temp, c, a, b". Now it is "temp, temp, a, b, c" as you'd expect. This
makes it easier for PreParser to match the parameter order of Parser.

R=verwaest@chromium.org
BUG=v8:5516

Change-Id: I79da04ef3f812bf52c032bed6263c009fecb7988
Reviewed-on: https://chromium-review.googlesource.com/447677
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43490}
2017-02-28 15:08:31 +00:00
machenbach
a6b20adbf9 Revert of Add several SIMD opcodes to IA32 (patchset #9 id:160001 of https://codereview.chromium.org/2695613004/ )
Reason for revert:
Fails with nosse4:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/13853

Original issue's description:
> Add several SIMD opcodes to IA32
>
> CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
> Int32x4Add, Int32x4Sub
>
> Also add paddd and psubd to ia32-assembler
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2695613004
> Cr-Commit-Position: refs/heads/master@{#43483}
> Committed: 4deb9ffdec

TBR=bbudge@chromium.org,gdeepti@chromium.org,bmeurer@chromium.org,jing.bao@intel.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2717423003
Cr-Commit-Position: refs/heads/master@{#43489}
2017-02-28 14:54:28 +00:00
littledan
a48d7ce226 Reland of [test] Speculatively remove local-tests from archive (patchset #1 id:1 of https://codereview.chromium.org/2640223003/ )
Reason for revert:
With the Windows bots fixed in https://chromium-review.googlesource.com/445786 , this should be good to reland. Thanks, Michael!

Original issue's description:
> Revert of [test] Speculatively remove local-tests from archive (patchset #2 id:20001 of https://codereview.chromium.org/2643983002/ )
>
> Reason for revert:
> Breaks all windows bots:
> https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/6811
>
> Original issue's description:
> > [test] Remove local-tests from test262 archive and add to .isolate
> >
> > This might help fix the bots, which are broken in e.g.,
> > https://build.chromium.org/p/tryserver.v8/builders/v8_mac_rel_ng_triggered/builds/14011
> >
> > The archive was added in order to transmit test262 tests more rapidly.
> > It doesn't serve much of a purpose for local-tests. I naively added
> > local-tests there out of symmetry. However, the BUILD.gn file does not
> > regenerate an archive when files are only deleted and not added or
> > changed. Since the performance concern is not present for the small
> > volume of local-tests, this patch reverts to the more normal mechanism
> > for sending over dependencies, with test262.isolate.
> >
> > R=adamk
> >
> > Review-Url: https://codereview.chromium.org/2643983002
> > Cr-Commit-Position: refs/heads/master@{#42485}
> > Committed: 9f545ea96f
>
> TBR=adamk@chromium.org,littledan@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2640223003
> Cr-Commit-Position: refs/heads/master@{#42491}
> Committed: 4ffe0850db

TBR=adamk@chromium.org,machenbach@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2725643002
Cr-Commit-Position: refs/heads/master@{#43488}
2017-02-28 14:43:15 +00:00
yangguo
a35616e324 [debug] add more tests for side-effect free debug-evaluate.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2720013003
Cr-Commit-Position: refs/heads/master@{#43487}
2017-02-28 14:23:09 +00:00
yangguo
a5dfa06213 [unibrow] remove mongolian vowel separator as white space.
Unibrow is currently at Unicode version 7.0.0, which does not
include mongolian vowel separator (\u180E) as white space. In
order to appease test262 at the time however we kept it as a
whitespace.

Test262 has since then been updated. And while this is not an
update of unibrow, we are removing \u180E as white space here.

R=jshin@chromium.org, littledan@chromium.org
BUG=v8:5155

Review-Url: https://codereview.chromium.org/2720953003
Cr-Commit-Position: refs/heads/master@{#43485}
2017-02-28 13:42:29 +00:00
jing.bao
4deb9ffdec Add several SIMD opcodes to IA32
CreateInt32x4, Int32x4ExtractLane, Int32x4ReplaceLane
Int32x4Add, Int32x4Sub

Also add paddd and psubd to ia32-assembler

BUG=

Review-Url: https://codereview.chromium.org/2695613004
Cr-Commit-Position: refs/heads/master@{#43483}
2017-02-28 13:35:22 +00:00
Michael Achenbach
63afdb0075 [test] Work-around for checking test262 archives on bots
This relaxes the check if the test262 archive should be unpacked or not.
A bug in the swarming isolate processor for windows makes the old check for the data directory pass and not unpack.
With this work-around we actually start running tests on windows.

This also fixes the regexp for exception extraction and handles the windows drive letter.
It also strips whitespace to fix a case where a carriage return was included on windows.

BUG=v8:5872

Change-Id: I363925665b0bad7530a1f93a2ea8f39b056d4174
Reviewed-on: https://chromium-review.googlesource.com/445786
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43482}
2017-02-28 13:33:13 +00:00
Marja Hölttä
fc8922e448 [iwyu|arm] Pre-work for removing unallowed include macro-assembler.h -> assembler-inl.h
The x64 side is included in https://chromium-review.googlesource.com/c/444226/

BUG=v8:5294

Change-Id: Ie255604c5e38c72e3c2b76e1ca3557a5fde108ee
Reviewed-on: https://chromium-review.googlesource.com/446394
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43481}
2017-02-28 13:31:30 +00:00
Michael Starzinger
08d84f6d23 [string] Fix error message in String.prototype.repeat.
R=yangguo@chromium.org
TEST=message/regress/regress-crbug-691194
BUG=chromium:691194

Change-Id: I72198e087f88abf89cdd38b99c19e10cbebda08d
Reviewed-on: https://chromium-review.googlesource.com/445942
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43480}
2017-02-28 12:48:39 +00:00
Michael Starzinger
09a07038f2 [turbofan] Fix lowering of %_GetSuperConstructor intrinsic.
The above intrinsic by now has to perform a check whether the prototype
of a derived constructor is actually a constructor function itself. This
is done as part of the {JSGetConstructorCall} operator. The intrinsic
should just reduce down to the operator to maintain correct semantics.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-696622
BUG=chromium:696622

Change-Id: Ia19c188f17ad16b12248db1f01a01b8d7258499b
Reviewed-on: https://chromium-review.googlesource.com/447716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43479}
2017-02-28 12:47:37 +00:00
tebbi
9881b6c740 [turbofan] extend escape analysis to reduce CheckMaps
R=bmeurer@chromium.org

BUG=

Review-Url: https://codereview.chromium.org/2680973013
Cr-Original-Commit-Position: refs/heads/master@{#43163}
Committed: f01c8a6e4b
Review-Url: https://codereview.chromium.org/2680973013
Cr-Commit-Position: refs/heads/master@{#43478}
2017-02-28 12:44:01 +00:00
jarin
3c36aacc87 [turbofan] Fix handling of typed array loads in load elimination.
BUG=chromium:694088

Review-Url: https://codereview.chromium.org/2725593002
Cr-Commit-Position: refs/heads/master@{#43477}
2017-02-28 12:20:19 +00:00
tebbi
7467f16d73 [turbofan] escape analysis supports arguments object and rest elements
The new NewUnmappedArgumentsElements node now takes two inputs:
- the frame holding the arguments (current frame or arguments adaptor frame)
- the length of the suffix of passed arguments to be copied into the backing store

These inputs are computed with two new node types:
ArgumentsFrame()
ArgumentsLength[formal_parameter_count,is_rest_length](Node* arguments_frame)
The node type NewRestParameterElements can now be expressed with NewUnmappedArgumentsElements and an appropriate length and is thus not needed anymore.

In escape analysis, we lower loads from the length field of NewUnmappedArgumentsElements with its length input and if we find out that no write access to the arguments elements exists, we replace element loads with direct stack access and replace the NewUnmappedArgumentsElements node with a node of the new node type ArgumentsElementsState. This corresponds to an ObjectState node and gets translated into a deoptimizer instruction to allocate the backing store. Together with the already existing deoptimizer support for the actual arguments object/rest parameters, this allows to remove all allocations for arguments objects/rest parameters in this case.
In the deoptimizer, we read the actual parameters from the stack while transforming the static deopt info into TranslatedValue objects.

If escape analysis cannot remove the backing store allocation, NewUnmappedArgumentsElements gets lo

BUG=v8:5726

Review-Url: https://codereview.chromium.org/2692753004
Cr-Commit-Position: refs/heads/master@{#43475}
2017-02-28 11:16:27 +00:00
Michael Starzinger
4d7e7acdf2 Fix test to not teach ClusterFuzz ugly tricks.
R=bradnelson@chromium.org
TEST=mjsunit/wasm/asm-with-wasm-off
BUG=chromium:696655

Change-Id: I9375d8ac2f111009233dc480529fd0f0e00fe811
Reviewed-on: https://chromium-review.googlesource.com/447398
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43472}
2017-02-28 10:25:50 +00:00
yangguo
7c39a838ba [debugger] add more tests to side-effect free debug evaluate.
Add tests for local variables in function scopes and async features.

R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2707043003
Cr-Commit-Position: refs/heads/master@{#43468}
2017-02-28 08:20:00 +00:00
aseemgarg
048a0a13e7 Revert "Revert of [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator (patchset #8 id:140001 of https://codereview.chromium.org/2711473002/ )"
This reverts commit 2362f869a4.

BUG=v8:4614

Review-Url: https://codereview.chromium.org/2720133004
Cr-Commit-Position: refs/heads/master@{#43467}
2017-02-28 03:31:39 +00:00
jbroman
6543519977 ValueSerializer: Add an explicit tag for host objects.
This makes it no longer necessary to ensure that V8 and Blink have non-colliding
tags, which makes it easier for them to evolve independently, and also makes
the wire format more suitable for other V8 embedders, who would not
necessarily be surveyed before V8 introduced a new tag that might collide
with theirs.

BUG=chromium:686159

Review-Url: https://codereview.chromium.org/2709023003
Cr-Commit-Position: refs/heads/master@{#43466}
2017-02-28 02:16:30 +00:00
aseemgarg
7f5701507d [wasm]implement simd lowering for F32x4 and I32x4 binops
BUG=v8:4124
R=bradnelson@chromium.org,bbudge@chromium.org,gdeepti@chromium.org

Review-Url: https://codereview.chromium.org/2713613005
Cr-Commit-Position: refs/heads/master@{#43465}
2017-02-27 23:45:03 +00:00
littledan
2362f869a4 Revert of [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator (patchset #8 id:140001 of https://codereview.chromium.org/2711473002/ )
Reason for revert:
The tree is closed due to an msan violation (use of uninitialized value) in the arm64 simulator soon after this patch landed; this seems related

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/13607/steps/Check/logs/simulator_invalidate_..

Original issue's description:
> [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator
>
> BUG=v8:4614
> R=binji@chromium.org
>
> Review-Url: https://codereview.chromium.org/2711473002
> Cr-Commit-Position: refs/heads/master@{#43461}
> Committed: a2a2c1b9ee

TBR=binji@chromium.org,jarin@chromium.org,jacob.bramley@arm.com,aseemgarg@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4614

Review-Url: https://codereview.chromium.org/2720133003
Cr-Commit-Position: refs/heads/master@{#43463}
2017-02-27 22:47:14 +00:00
binji
5a04f4fd68 This is a speculative chain of reverts to improve a Chrome
perf regression. See crbug.com/695653 for more info.

Revert "[SAB] Move Atomics builtins to C++"

This reverts commit 2b9840d86f.

Revert "[SAB] Remove unreachable Uint8Clamped atomics paths"

This reverts commit d1160fb14f.

Revert "Remove tiny unit test for MinSimple/MaxSimple"

This reverts commit 837760ecb7.

Revert "Remove infrastructure for experimental JS natives"

This reverts commit 8cfe45b6f1.

BUG=695653
TBR=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2715223003
Cr-Commit-Position: refs/heads/master@{#43462}
2017-02-27 22:26:27 +00:00
aseemgarg
a2a2c1b9ee [Atomics] Implement ldaxr/stlxr instructions in ARM64 simulator
BUG=v8:4614
R=binji@chromium.org

Review-Url: https://codereview.chromium.org/2711473002
Cr-Commit-Position: refs/heads/master@{#43461}
2017-02-27 22:12:17 +00:00
Eric Holk
f348e573c0 [wasm] Update JS API tests to version 1
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=694954

Change-Id: I07d7eeccca716028e1151db3df7ebee81d4a9ef2
Reviewed-on: https://chromium-review.googlesource.com/446707
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43460}
2017-02-27 21:27:09 +00:00
kozyatinskiy
bbeb6dc15d [inspector] added master test for break locations
BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2710903003
Cr-Commit-Position: refs/heads/master@{#43459}
2017-02-27 20:20:39 +00:00
kozyatinskiy
c63e83c1e9 [inspector] added step-into test to cover most stepInto cases
This test helps to prevent regressions during work on new break locations.

BUG=none
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2719763002
Cr-Commit-Position: refs/heads/master@{#43458}
2017-02-27 18:58:55 +00:00
kozyatinskiy
4d7fa10c2b [inspector] added restrictToFunction flag for getPossibleBreakpoints
BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2710953004
Cr-Commit-Position: refs/heads/master@{#43457}
2017-02-27 16:53:03 +00:00
Toon Verwaest
0e21a147db [runtime] Feed back normalization to constructors (behind flag)
When an instance of a constructor goes dictionary mode, this changes the initial map
of that constructor to also be in dictionary mode. This avoids spurious hidden class
creation, that also results in IC misses.

BUG=

Change-Id: I0e70f822ac345d0224f2092ec473621a603d4cc5
Reviewed-on: https://chromium-review.googlesource.com/446361
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43452}
2017-02-27 13:56:14 +00:00
Igor Sheludko
9760851789 [ic] KeyedStoreIC should use a slow stub when a prototype chain contains dictionary elements.
BUG=chromium:688734

Change-Id: If5dd370971cb02c4463fa20a489d0fa60b0423c4
Reviewed-on: https://chromium-review.googlesource.com/446845
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43451}
2017-02-27 13:41:11 +00:00
Michael Starzinger
0a3060fa59 [turbofan] Extend typer for number comparison ops.
This extends the existing typer for JS-level comparisons to also be
applied on simplified-level number comparisons. Now that nodes having
such operators are introduced early during graph construction, precise
type information has become more important.

R=jarin@chromium.org
TEST=unittests/TyperTest

Change-Id: Ibcfda36cadf72381b3c63138dd8ad2f6b1f7fbba
Reviewed-on: https://chromium-review.googlesource.com/445879
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43447}
2017-02-27 12:11:38 +00:00
Choongwoo Han
cd3a76d56f [typedarrays] Fix Out of Bound Access in TypedArraySortFast
Compare function for std::sort should satisfy strict weak ordering
relation.

BUG=chromium:696251

Change-Id: I1c07e3bb1b012fd203bc059a21a75ae0fc61f5ac
Reviewed-on: https://chromium-review.googlesource.com/447036
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43446}
2017-02-27 11:41:25 +00:00
Michael Starzinger
1ed1622ef2 [turbofan] Remove obsolte value input to {Throw} nodes.
Nodes having the {Throw} operator are just used as terminators for
control-flow leaving the function body with an exception completion,
they turn into basic-block terminators within the schedule. Actually
raising an exception is done solely via runtime calls. Hence {Throw}
nodes no longer need any value input.

R=bmeurer@chromium.org

Change-Id: Id6d8e46b12c4b84f4e7a8ac96623c8efb1f27b26
Reviewed-on: https://chromium-review.googlesource.com/446501
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43445}
2017-02-27 11:23:06 +00:00
Yang Guo
e3ae7ad9c7 [regexp] fix regexp lookbehind with back reference on ARM.
BUG=chromium:695416

Change-Id: Ied3a389d0dfb0132c798bc85e10f7b1fd4432eb4
Reviewed-on: https://chromium-review.googlesource.com/446343
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43435}
2017-02-27 06:29:47 +00:00
kozyatinskiy
64a563c97f [inspector] move coverage related methods to profiler
R=dgozman@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2715833003
Cr-Commit-Position: refs/heads/master@{#43426}
2017-02-25 02:44:56 +00:00
kozyatinskiy
6b7650f039 [inspector] disable debugger/pause-on-oom test before further fix
It looks like https://codereview.chromium.org/2705293004 changes available space in heap on OOM notification and it produces crash on one of the ports try bot [1].
This test should be more reliable.

[1] https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug

BUG=v8:6018
TBR=dgozman@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2714253002
Cr-Commit-Position: refs/heads/master@{#43425}
2017-02-25 00:43:05 +00:00
kozyatinskiy
0ccb028121 [test262] skip two Intl.NumberFormat tests
Currently try bots [1] are failing on these tests and no CLs can be landed to V8. It looks like these tests were added recently.
Based on https://bugs.chromium.org/p/v8/issues/detail?id=6015, it's known issue in V8 implementation, so mark them as needs investigation.

[1] https://build.chromium.org/p/tryserver.v8/builders/v8_linux64_asan_rel_ng_triggered/builds/16490/steps/Test262%20-%20no%20variants

BUG=v8:6015,v8:6016
TBR=adamk@chromium.org,littledan@chromium.org
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2717773002
Cr-Commit-Position: refs/heads/master@{#43423}
2017-02-24 23:41:23 +00:00
caitp
0423341034 [async-iteration] implement Async-from-Sync Iterator
Introduce a new Object to allow GetIterator("async") to function when the
iterable does not have a Symbol.asyncIterator method.

This patch has been split out from https://codereview.chromium.org/2622833002/
and incorporates test cases.

BUG=v8:5855, v8:4483
R=jgruber@chromium.org, rmcilroy@chromium.org, neis@chromium.org
TBR=hpayer@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2645313003
Cr-Commit-Position: refs/heads/master@{#43419}
2017-02-24 17:48:49 +00:00
adamk
8cfe45b6f1 Remove infrastructure for experimental JS natives
Now that no harmony-flagged features are implemented in experimental
JS, most of this is simply dead code.

As PostExperimentals() is no longer needed, I also removed the use of
Import() in the debug context, allowing the deletion of PostDebug()
along with PostExperimentals(); cleanup code is moved to the
end of PostNatives.

Also gets rid of some longer-dead code in prologue.js related to
TypedArrays, and some duplicate code for setting up SharedArrayBuffer
builtins.

Review-Url: https://codereview.chromium.org/2705293004
Cr-Commit-Position: refs/heads/master@{#43418}
2017-02-24 17:43:28 +00:00
franzih
0ba513f056 [api] Fix DescriptorInterceptor with access check.
The DescriptorInterceptor should intercept all
Object.getOwnPropertyDescriptor calls. This CL fixes
the interceptor's behavior if the iterator state is
ACCESS_CHECK.

BUG=

Review-Url: https://codereview.chromium.org/2707263002
Cr-Commit-Position: refs/heads/master@{#43417}
2017-02-24 16:34:02 +00:00
dcheng
e5f89fa5ae Don't mark remote contexts as callable or constructible.
Marking it as callable makes typeof return 'function' instead of
'object' when invoked on a remote context or object.

BUG=chromium:527190

Review-Url: https://codereview.chromium.org/2715593002
Cr-Commit-Position: refs/heads/master@{#43416}
2017-02-24 16:08:11 +00:00
neis
42ded33b5b [compiler] Speculate a little more in SpeculativeShiftRightLogical.
If the RHS is 0 and we have Smi feedback, speculate that the result (the LHS)
will continue to be in the Unsigned31 range.  This helps us avoid converting
the result to double when merging with Signed32.

R=jarin@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2709423002
Cr-Commit-Position: refs/heads/master@{#43415}
2017-02-24 14:39:38 +00:00
Peter Marshall
45dfd76a9c [Test] Add perf tests for TypedArray constructors.
Adds a perf test for constructing a TypedArray from a regular array,
and from a pre-made ArrayBuffer. Runs both new tests with default and
future configurations for comparison.

BUG=v8:5977

Change-Id: Idd132ca879702c54b2947a0e57ed8fe782f2767f
Reviewed-on: https://chromium-review.googlesource.com/446342
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43412}
2017-02-24 13:06:10 +00:00
Marja Hölttä
6b5ab92315 [parser] Skipping inner funcs: omit uninteresting scopes in the data.
This is also needed so that PreParser doesn't need to gather more data for arrow
function params in order to create the uninteresting varblock scopes matching
the scopes created in Parser::BuildParameterInitializationBlock.

This cancels the changes in https://chromium-review.googlesource.com/c/444747
which make PreParser create uninteresting scopes for the normal (non-arrow)
function "eval in default param" case.

R=vogelheim@chromium.org
BUG=v8:5516

Change-Id: I8957ac0796d8738c63492f7928bca6f00e4b4241
Reviewed-on: https://chromium-review.googlesource.com/446339
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43411}
2017-02-24 12:20:25 +00:00
yangguo
9db139e120 [inspector] fix coverage test flakiness.
TBR=kozyatinskiy@chromium.org
BUG=chromium:695631

Review-Url: https://codereview.chromium.org/2718543005
Cr-Commit-Position: refs/heads/master@{#43406}
2017-02-24 09:17:56 +00:00
shiyu.zhang
bd74f1cf57 [turbofan] Relax limitation for using BaseWithIndexAndDisplacement for load/stores
Enable using BaseWithIndexAndDisplacement addressing mode for an address
used by multiple load/stores. It can reduce one instruction to calculate
the address and one register to store the address.

BUG=

Review-Url: https://codereview.chromium.org/2620293004
Cr-Commit-Position: refs/heads/master@{#43402}
2017-02-24 06:38:14 +00:00
kozyatinskiy
59eb62d483 [inspector] use BREAK_POSITION_ALIGNED for breakpoints
With inline breakpoints DevTools are ready for break position aligned breakpoints instead of statement aligned.

BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2709263002
Cr-Original-Commit-Position: refs/heads/master@{#43385}
Committed: 2fed7a0090
Review-Url: https://codereview.chromium.org/2709263002
Cr-Commit-Position: refs/heads/master@{#43400}
2017-02-24 02:01:26 +00:00
machenbach
bdd23acd92 Revert of [inspector] use BREAK_POSITION_ALIGNED for breakpoints (patchset #7 id:120001 of https://codereview.chromium.org/2709263002/ )
Reason for revert:
breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13747

which blocks rolling. See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [inspector] use BREAK_POSITION_ALIGNED for breakpoints
>
> With inline breakpoints DevTools are ready for break position aligned breakpoints instead of statement aligned.
>
> BUG=chromium:695236
> R=dgozman@chromium.org,yangguo@chromium.org
>
> Review-Url: https://codereview.chromium.org/2709263002
> Cr-Commit-Position: refs/heads/master@{#43385}
> Committed: 2fed7a0090

TBR=dgozman@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:695236

Review-Url: https://codereview.chromium.org/2709313003
Cr-Commit-Position: refs/heads/master@{#43395}
2017-02-23 20:27:08 +00:00
adamk
837760ecb7 Remove tiny unit test for MinSimple/MaxSimple
The source code of those functions is simple a ternary operator, and
the test seems to have been designed as a "regression" test for the
previous implementation (which used a macro, and thus evaluated its
arguments multiple times).

I don't think the test is worth the weight of supporting importing
JS natives from tests.

This patch removes the last test that depends on JS natives.

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2711833002
Cr-Commit-Position: refs/heads/master@{#43394}
2017-02-23 18:19:16 +00:00
adamk
184e80a60d Remove a regression test that depended on utils.ImportNow()
The test itself was for an issue that's handled statically since
https://codereview.chromium.org/1302313013 (we were missing some
instance types in a switch statement).

This leaves us with only a single test that depends on the JS
native import system.

R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/2707133005
Cr-Commit-Position: refs/heads/master@{#43393}
2017-02-23 17:31:51 +00:00
neis
c0651535d5 [interpreter] Teach --print-bytecode the names of runtime functions and intrinsics.
This changes the bytecode decoder such that --print-bytecode will print

    ... CallRuntime [GeneratorGetResumeMode] ...
    ... InvokeIntrinsic [CreateIterResultObject] ...

instead of

    ... CallRuntime [762] ...
    ... InvokeIntrinsic [2] ...

The printing of CallJSRuntime remains unchanged.

R=gsathya@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2712943002
Cr-Commit-Position: refs/heads/master@{#43391}
2017-02-23 14:25:45 +00:00
Marja Hölttä
2a2fc69221 [parser] Skipping inner funcs: enable more strict mode tests.
Non-simple parameters are only disallowed when a function declares itself
strict, but they're otherwise ok in strict mode.

Enabling these tests will expose more problems when scope data for arrow
functions is tested (in a future CL).

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I839ad37d46305975a56aff20e8ca70505c16bf1d
Reviewed-on: https://chromium-review.googlesource.com/446497
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43389}
2017-02-23 12:53:32 +00:00
Marja Hölttä
83849da70f [iwyu] Pre-work for removing unallowed include macro-assembler.h -> assembler-inl.h
BUG=v8:5294

Change-Id: If45f25aae8de526027b7851cb4efe0ccf4a7c4b1
Reviewed-on: https://chromium-review.googlesource.com/444226
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43388}
2017-02-23 12:10:21 +00:00
kozyatinskiy
2fed7a0090 [inspector] use BREAK_POSITION_ALIGNED for breakpoints
With inline breakpoints DevTools are ready for break position aligned breakpoints instead of statement aligned.

BUG=chromium:695236
R=dgozman@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2709263002
Cr-Commit-Position: refs/heads/master@{#43385}
2017-02-23 00:05:26 +00:00
bakkot
18e4c46de5 [parser] Lift template literal invalid escape restriction
This implements the proposal at
https://github.com/tc39/proposal-template-literal-revision
staged behind a flag --harmony-template-escapes. The proposal allows
invalid octal, unicode, and hexadecimal escape sequences to appear in
tagged template literals, instead of being a syntax error. These have
a 'cooked' value of 'undefined', but are still accessible through the
'raw' property.

BUG=v8:5546

Review-Url: https://codereview.chromium.org/2665513002
Cr-Commit-Position: refs/heads/master@{#43384}
2017-02-22 21:20:32 +00:00
titzer
6a09a41622 [wasm] Remove support for experimental version 0xD.
R=mtrofin@chromium.org
BUG=chromium:575167,chromium:694657

Review-Url: https://codereview.chromium.org/2709753003
Cr-Original-Commit-Position: refs/heads/master@{#43368}
Committed: c8329253ea
Review-Url: https://codereview.chromium.org/2709753003
Cr-Commit-Position: refs/heads/master@{#43383}
2017-02-22 21:02:39 +00:00
Michael Starzinger
beb94c5e87 [turbofan] Fix Object.prototype.__proto__ getter reduction.
This fixes a corner-case where the call reduction of the aforementioned
getter did not simulate the {ToObject} conversion of the receiver value
as required by the spec. This caused the wrong prototype to be constant
promoted (i.e. {null} instead of wrapper object prototype).

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-694709
BUG=chromium:694709

Change-Id: Idf3a37071949d9ddaf5ef43974570c06fd31c0c9
Reviewed-on: https://chromium-review.googlesource.com/445818
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43376}
2017-02-22 15:07:49 +00:00
machenbach
5004748868 Revert of [wasm] Remove support for experimental version 0xD. (patchset #3 id:40001 of https://codereview.chromium.org/2709753003/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/13730

Original issue's description:
> [wasm] Remove support for experimental version 0xD.
>
> R=mtrofin@chromium.org
> BUG=chromium:575167,chromium:694657
>
> Review-Url: https://codereview.chromium.org/2709753003
> Cr-Commit-Position: refs/heads/master@{#43368}
> Committed: c8329253ea

TBR=ahaas@chromium.org,mtrofin@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167,chromium:694657

Review-Url: https://codereview.chromium.org/2706303004
Cr-Commit-Position: refs/heads/master@{#43373}
2017-02-22 13:59:23 +00:00
Ross McIlroy
38262dde22 Revert "[Compiler] Use IdentityMap to store jobs in CompilerDispatcher."
This reverts commit 087e95ba63.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [Compiler] Use IdentityMap to store jobs in CompilerDispatcher.
> 
> Stores jobs in an IdentityMap keyed by their SharedFunctionInfo to enable
> fast checking of whether a job is enqueued.
> 
> BUG=v8:5203
> 
> Change-Id: I6c37972093515a27077f79594cad27e32e1a4e7c
> Reviewed-on: https://chromium-review.googlesource.com/444768
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#43370}

TBR=rmcilroy@chromium.org,jochen@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5203

Change-Id: I5d1101bdae6939378dad595b26698fe2aaaad35e
Reviewed-on: https://chromium-review.googlesource.com/446357
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43372}
2017-02-22 13:46:33 +00:00
yangguo
4a655cbe0c [debugger] extend side effect free debug-evaluate to Array builtins.
R=jgruber@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2695933005
Cr-Commit-Position: refs/heads/master@{#43371}
2017-02-22 13:29:40 +00:00
Ross McIlroy
087e95ba63 [Compiler] Use IdentityMap to store jobs in CompilerDispatcher.
Stores jobs in an IdentityMap keyed by their SharedFunctionInfo to enable
fast checking of whether a job is enqueued.

BUG=v8:5203

Change-Id: I6c37972093515a27077f79594cad27e32e1a4e7c
Reviewed-on: https://chromium-review.googlesource.com/444768
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43370}
2017-02-22 12:35:33 +00:00
titzer
c8329253ea [wasm] Remove support for experimental version 0xD.
R=mtrofin@chromium.org
BUG=chromium:575167,chromium:694657

Review-Url: https://codereview.chromium.org/2709753003
Cr-Commit-Position: refs/heads/master@{#43368}
2017-02-22 12:06:09 +00:00
Andreas Haas
73d45c9630 [wasm] Use builtins wrappers for traps
With this CL the out-of-line code of TrapIf will call a builtin instead
of doing a direct runtime call, which is cheaper. In the best case, the
out-of-line code now consists of a single call instruction. The builtin
will load the trapID and then call the runtime to throw a trap.

R=titzer@chromium.org, clemensh@chromium.org

Change-Id: I8a75ba09f40236a3d5cbdc17c1317baf0a3c915a
Reviewed-on: https://chromium-review.googlesource.com/445937
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43366}
2017-02-22 12:01:02 +00:00
yangguo
901c29eb1c [inspector] extend protocol for code coverage.
R=jgruber@chromium.org, kozyatinskiy@chromium.org, pfeldman@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2700743002
Cr-Commit-Position: refs/heads/master@{#43363}
2017-02-22 10:21:57 +00:00
Ross McIlroy
e2de1b8696 Add support to IdentityMap for deletion, iteration and AllocationPolicy.
In order to use the IdentityMap in the CompilerDispatcher the following
support is added:
 - Support for deleting entries
 - Support for iterating through the entries.
 - Support for AllocationPolicy to enable non-zone allocation of backing
   stores.
 - Also refactors the code a bit.

BUG=v8:5203

Change-Id: I8b616cba8ae9dc22a7f4d76070fbb318c4edc80d
Reviewed-on: https://chromium-review.googlesource.com/444409
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43362}
2017-02-22 10:20:15 +00:00
dcheng
96eda1f7d1 Fix receiver checks for v8::Function on a remote context receiver.
v8 allows the embedder to specify a global template to use when
creating a new context. However, v8 does not use the supplied
template directly when creating the global proxy: it creates a
unique template for each global proxy. However, this is problematic
for remote contexts: functions cannot use strict receiver checks
with the remote context, as the global template will never match
the global proxy.

To fix this, remote contexts now also include a remote global
object in the prototype chain that is instantiated with the global
template. This mirrors the way the global proxy is configured for a
full v8 context, and allows strict receiver checks to work.

BUG=527190

Review-Url: https://codereview.chromium.org/2677653002
Cr-Commit-Position: refs/heads/master@{#43361}
2017-02-22 10:13:24 +00:00
yangguo
3f303da292 [debugger] remove debugger statement support from FCG/CS.
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2650193002
Cr-Original-Commit-Position: refs/heads/master@{#42892}
Committed: eef855a1dc
Review-Url: https://codereview.chromium.org/2650193002
Cr-Commit-Position: refs/heads/master@{#43360}
2017-02-22 08:45:09 +00:00
Caitlin Potter
4cd8a8b784 [builtins] fix slow-path handling of -Infinity in ArrayIncludes
This is a speculative fix, but I believe it might work.

Idea is to keep `start_from` as a double while establishing an appropriate
index to begin iteration. This should keep -Infinity intact rather than
converting it to a positive high value, which would break the algorithm.
This is similar to what had been implemented on the fast path before it was
changed to send non-Smis to the slow path.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org, machenbach@chromium.org, adamk@chromium.org

Change-Id: I9965fd2e75a8972f3f1c7a18e51bd580030a66ea
Reviewed-on: https://chromium-review.googlesource.com/445857
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43358}
2017-02-21 23:31:39 +00:00
binji
8235558bd0 [SAB] Test262 Agent harness
Review-Url: https://codereview.chromium.org/2658933004
Cr-Commit-Position: refs/heads/master@{#43357}
2017-02-21 19:59:05 +00:00
clemensh
e6819ee286 [wasm] Test argument passing in the interpreter entry
Test the wasm interpreter entry stub by creating two wasm functions A
and B, make A pass arguments to B, then redirect B to be executed in the
interpreter.
Test different number and types or arguments.

BUG=v8:5822
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2651793003
Cr-Commit-Position: refs/heads/master@{#43353}
2017-02-21 18:21:31 +00:00
clemensh
cc805e42af [wasm] Enforce module size limit early enough
The limit needs to be checked before casting the length to int in
ModuleWireBytes.

R=titzer@chromium.org
BUG=694433

Review-Url: https://codereview.chromium.org/2705233002
Cr-Commit-Position: refs/heads/master@{#43352}
2017-02-21 18:13:02 +00:00
mtrofin
caa1d4b262 [wasm] Managed<T> ensures T's lifetime does not leak past Isolate's
Native resources allocated by v8, as internal implementation detail,
and held by a Foreign object, must be released when the Isolate is
torn down. Example: wasm::WasmModule allocated by wasm compile, and
held throughout the lifetime of the WebAssembly.Module object.

This change:
- Extends Managed<CppType> with a mechanism for doing just that
- Separates the role of Managed<CppType> to be strictly an owner of
the lifetime of the native resource. For cases where that's not
desirable, we can polymorphically use Foregin.
- moves managed.h out of wasm, since it's not wasm-specific.

BUG=680065

Review-Url: https://codereview.chromium.org/2676513008
Cr-Commit-Position: refs/heads/master@{#43350}
2017-02-21 17:23:38 +00:00
bbudge
9fe0b4c708 [V8] Implement SIMD Boolean vector types to allow mask registers.
- Adds new machine types SimdBool4/8/16 for the different boolean vector types.
- Adds a kSimdMaskRegisters flag for each platform. These are all false for now.
- Removes Create, ExtractLane, ReplaceLane, Equal, NotEqual, Swizzle and Shuffle
  opcodes from the Boolean types. These are unlikely to be well supported natively,
  and can be synthesized using Select.
- Changes the signature of Relational opcodes to return boolean vectors.
- Changes the signature of Select opcodes to take boolean vectors.
- Updates the ARM implementation of Relational and Select opcodes.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2700813002
Cr-Commit-Position: refs/heads/master@{#43348}
2017-02-21 16:45:30 +00:00
Michael Starzinger
875ccb48ff [turbofan] Fix missing name check for keyed global load.
This fixes a missing name check for keyed property loads targeting the
global object where the feedback was warmed up with a single name. This
affects {JSLoadProperty} nodes only, syntactic global property loads via
the {JSLoadGlobal} operator are not affected.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-694416
BUG=chromium:694416

Change-Id: I54aa3f27eaa72630539f02602ec7642b04835b27
Reviewed-on: https://chromium-review.googlesource.com/445224
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43344}
2017-02-21 14:51:07 +00:00
mtrofin
b40d44ecc1 [wasm] Embedder can control what buffers wasm compilation works on.
Two controls, one for instantiation and one for compilation. They allow
the embedder (e.g. Chrome) check properties of the parameters of those
two operations, and decide if they are allowed to continue.

For example, Chrome may now decline compilation of certain size buffers,
in synchronous cases; same for instantiation (where the buffer size
refers to the size of the buffer containing wasm wire bytes)

BUG=v8:5981

Review-Url: https://codereview.chromium.org/2699843003
Cr-Original-Commit-Position: refs/heads/master@{#43295}
Committed: d9bc0ffb16
Review-Url: https://codereview.chromium.org/2699843003
Cr-Commit-Position: refs/heads/master@{#43336}
2017-02-21 03:43:14 +00:00
littledan
2b9840d86f [SAB] Move Atomics builtins to C++
This patch refactors the Atomics builtins so that they are implemented
as C++ builtins rather than experimental JS builtins. Previously, each
of these functions called out to a runtime function, so no significant
change in performance is anticipated. The goal of this patch is to
remove the last user of experimental JS builtins so that the mechanism
can be removed, for performance reasons. The patch includes a drive-by
fix of a check-fail. For the most part, the patch is just moving code
without modification from runtime-atomics.cc to
builtins-sharedarraybuffer.cc .

BUG=v8:5880

Review-Url: https://codereview.chromium.org/2698813004
Cr-Commit-Position: refs/heads/master@{#43335}
2017-02-20 22:08:52 +00:00
titzer
7f672535e6 [wasm] Move decoding constants out of wasm-module.h and into module-decoder.h
R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2703243002
Cr-Commit-Position: refs/heads/master@{#43332}
2017-02-20 17:42:02 +00:00
Marja Hölttä
7a457c711b [parser] Skipping inner funcs: params part 5
Handle eval in default parameters.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Ib6543a4aef9a3cc9636e65d0337bc269c8a079dc
Reviewed-on: https://chromium-review.googlesource.com/444747
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43328}
2017-02-20 16:37:24 +00:00
dusan.simicic
38affafd35 MIPS[64]: Skip float-constant-folding tests
qNaN and sNaN values have different binary representation on MIPS
compared to ARM/x86 architectures. We are skipping these tests because
we can't provide specific NaNs encodings from ARM/x86 architectures.

BUG=

Review-Url: https://codereview.chromium.org/2702213003
Cr-Commit-Position: refs/heads/master@{#43327}
2017-02-20 16:21:49 +00:00
Caitlin Potter
6746227291 [builtins] fix incorrect return value in ArrayIncludes
Take runtime path if startIndex parameter requires a ToInteger() call,
which can modify the elements kind of the receiver.

This removes a stub call from the builtin, and simplifies code slightly.

BUG=v8:5986
R=bmeurer@chromium.org, cbruni@chromium.org

Change-Id: Id238a81ab8ba28621858004b34d00a4356b8037f
Reviewed-on: https://chromium-review.googlesource.com/445006
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#43323}
2017-02-20 14:41:25 +00:00
yangguo
46290669d1 [serializer] allow duplicate API external references.
Due to link-time optimizations functions with same code
can be folded into one, resulting in duplicate references.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2707903002
Cr-Commit-Position: refs/heads/master@{#43317}
2017-02-20 12:52:53 +00:00
jgruber
3acc00a017 [regexp] Fix smi receiver in stack accessors
info.This returns a Local<Object>, which results in a call to
Utils::OpenHandle<JSReceiver>.  Casting to a Local<Value> first uses the
correct OpenHandle<Object> overload.

BUG=chromium:693500

Review-Url: https://codereview.chromium.org/2706833002
Cr-Commit-Position: refs/heads/master@{#43314}
2017-02-20 11:48:10 +00:00
titzer
9dae92066e [wasm] Fix fuzzer size calculation
R=ahaas@chromium.org, mythria@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2702123003
Cr-Commit-Position: refs/heads/master@{#43312}
2017-02-20 11:06:50 +00:00
Marja Hölttä
6b5f7d23dc [parser] Skipping inner funcs: add tests for strict mode.
BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I7a39e49cc569b87064e5ac6764f4e3a65b2c6d11
Reviewed-on: https://chromium-review.googlesource.com/444765
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43311}
2017-02-20 10:56:12 +00:00
titzer
df834f3ff2 [wasm] Split the compilation and instantiation API into sync and async methods.
This makes it easier to implement asynchronous compilation by hiding all the implementation details of both synchronous and asynchronous compilation within wasm-module.cc, whereas before the code in wasm-js.cc actually implemented asynchronous compilation in terms of synchronous.

BUG=

Review-Url: https://codereview.chromium.org/2695813005
Cr-Commit-Position: refs/heads/master@{#43310}
2017-02-20 10:41:57 +00:00
dcheng
db624fc4d7 Always early return from HandleApiCallHelper on access check failure.
BUG=693695

Review-Url: https://codereview.chromium.org/2702123002
Cr-Commit-Position: refs/heads/master@{#43309}
2017-02-20 10:07:05 +00:00
danno
1b3c4afcad Revert of [interpreter] Create custom call opcodes for specific argument counts (patchset #13 id:240001 of https://codereview.chromium.org/2684993002/ )
Reason for revert:
Due to arm64 failures

Original issue's description:
> [interpreter] Create custom call opcodes for specific argument counts
>
> Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
> and CallProperty2. Also share the bytecode handler code between between
> equivalent CallX and CallPropertyX handlers.
>
> Review-Url: https://codereview.chromium.org/2684993002
> Cr-Commit-Position: refs/heads/master@{#43290}
> Committed: 00d6f1f80a

TBR=rmcilroy@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.

Review-Url: https://codereview.chromium.org/2709533002
Cr-Commit-Position: refs/heads/master@{#43308}
2017-02-20 09:51:19 +00:00
dcheng
40b74d04da Make CreationContext() not crash when there is no creation context.
Remote objects don't have a creation context.

BUG=527190

Review-Url: https://codereview.chromium.org/2693203003
Cr-Commit-Position: refs/heads/master@{#43306}
2017-02-20 09:47:14 +00:00
Igor Sheludko
c6b57edc04 [crankshaft][turbofan] Compilers' part of constant field tracking.
The constant field tracking is still disabled.

BUG=v8:5495

Change-Id: I543fe50b82e2255bbf200ea785ec53e3623e30cb
Reviewed-on: https://chromium-review.googlesource.com/440924
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43304}
2017-02-20 09:05:55 +00:00
hablich
1bbbfb42d5 Revert of [wasm] Embedder can control what buffers wasm compilation works on. (patchset #3 id:60001 of https://codereview.chromium.org/2699843003/ )
Reason for revert:
Introduces a new test failure/flake: https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/16427

Original issue's description:
> [wasm] Embedder can control what buffers wasm compilation works on.
>
> Two controls, one for instantiation and one for compilation. They allow
> the embedder (e.g. Chrome) check properties of the parameters of those
> two operations, and decide if they are allowed to continue.
>
> For example, Chrome may now decline compilation of certain size buffers,
> in synchronous cases; same for instantiation (where the buffer size
> refers to the size of the buffer containing wasm wire bytes)
>
> BUG=v8:5981
>
> Review-Url: https://codereview.chromium.org/2699843003
> Cr-Commit-Position: refs/heads/master@{#43295}
> Committed: d9bc0ffb16

TBR=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5981

Review-Url: https://codereview.chromium.org/2701413002
Cr-Commit-Position: refs/heads/master@{#43303}
2017-02-20 08:01:01 +00:00
Georg Neis
8686368321 [interpreter] When generating bytecode, properly track current scope.
The bytecode generator did not necessarily know for which scope, and
thus language mode, it was generating code, because it only tracked
scopes that have a context.  This led to wrong behavior in some
examples involving class expressions (which are always in strict
mode).

With this CL, the bytecode generator explicitly tracks the current
scope, independent of whether it has a context.

BUG=v8:5927

Change-Id: Ifa6b3ee5e13e07b63d00e74c7f557a328633c88b
Reviewed-on: https://chromium-review.googlesource.com/444785
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43300}
2017-02-19 13:08:19 +00:00
vabr
6302753e2f Fix typeof optimization for undetectable
Currently, typeof o, where o is an undetectable
callable object (such as document.all), returns 'function' if
optimised. It should, however, return 'undefined'.

This CL excludes undetectable objects from the optimization
resulting in type 'function' and renames the related code to
reflect that.

BUG=v8:5972
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2697063002
Cr-Commit-Position: refs/heads/master@{#43298}
2017-02-18 12:43:37 +00:00
mtrofin
d9bc0ffb16 [wasm] Embedder can control what buffers wasm compilation works on.
Two controls, one for instantiation and one for compilation. They allow
the embedder (e.g. Chrome) check properties of the parameters of those
two operations, and decide if they are allowed to continue.

For example, Chrome may now decline compilation of certain size buffers,
in synchronous cases; same for instantiation (where the buffer size
refers to the size of the buffer containing wasm wire bytes)

BUG=v8:5981

Review-Url: https://codereview.chromium.org/2699843003
Cr-Commit-Position: refs/heads/master@{#43295}
2017-02-18 01:08:36 +00:00
gsathya
18ad0f13af [ESnext] Implement Promise.prototype.finally
Adds five new TF builtins for the spec defined functions/closures. This follows
mechanism similar to promise resolving functions approach where we store the
closure variables in a custom context.

Adds a new --harmony-promise-finally flag.

BUG=v8:5967

Review-Url: https://codereview.chromium.org/2695753002
Cr-Commit-Position: refs/heads/master@{#43294}
2017-02-17 22:10:28 +00:00
binji
4dfd5e5ee2 Make regress-crbug-514081 less flaky by having max serialization size
BUG=v8:5906
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2697723004
Cr-Commit-Position: refs/heads/master@{#43292}
2017-02-17 18:55:54 +00:00
danno
00d6f1f80a [interpreter] Create custom call opcodes for specific argument counts
Specifically, add bytecodes for Call0, Call1, Call2, CallProperty0, CallProperty1,
and CallProperty2. Also share the bytecode handler code between between
equivalent CallX and CallPropertyX handlers.

Review-Url: https://codereview.chromium.org/2684993002
Cr-Commit-Position: refs/heads/master@{#43290}
2017-02-17 17:57:22 +00:00
eholk
3e1db847b3 [wasm] Syntax- and Type-aware Fuzzer
This is the beginning of a new fuzzer that generates
correct-by-construction Wasm modules. This should allow us to better
exercise the compiler and correctness aspects of fuzzing. It is based off
of ahaas' original Wasm fuzzer.

At the moment, it can generate expressions made up of most binops, and
also nested blocks with unconditional breaks. Future CLs will add
additional constructs, such as br_if, loops, memory access, etc.

The way the fuzzer works is that it starts with an array of arbitrary
data provided by libfuzzer. It uses the data to generate an expression.
Care is taken to make use of the entire string. Basically, the
generator has a bunch of grammar-like rules for how to construct an
expression of a given type. For example, an i32 can be made by adding
two other i32s, or by wrapping an i64. The process then continues
recursively until all the data is consumed.

We generate an expression from a slice of data as follows:
* If the slice is less than or equal to the size of the type (e.g. 4
  bytes for i32), then it will emit the entire slice as a constant.
* Otherwise, it will consume the first 4 bytes of the slice and use
  this to select which rule to apply. Each rule then consumes the
  remainder of the slice in an appropriate way. For example:
  * Unary ops use the remainder of the slice to generate the argument.
  * Binary ops consume another four bytes and mod this with the length
    of the remaining slice to split the slice into two parts. Each of
    these subslices are then used to generate one of the arguments to
    the binop.
  * Blocks are basically like a unary op, but a stack of block types is
    maintained to facilitate branches. For blocks that end in a break,
    the first four bytes of a slice are used to select the break depth
    and the stack determines what type of expression to generate.
The goal is that once this generator is complete, it will provide a one
to one mapping between binary strings and valid Wasm modules.

Review-Url: https://codereview.chromium.org/2658723006
Cr-Commit-Position: refs/heads/master@{#43289}
2017-02-17 17:06:29 +00:00
Igor Sheludko
76c65af808 [csa] Rename GotoUnless to GotoIfNot.
BUG=

Change-Id: Ifc441739ef730a0b2278be0b662413c223631a72
Reviewed-on: https://chromium-review.googlesource.com/444190
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43288}
2017-02-17 17:04:18 +00:00
Igor Sheludko
a85f27d8a4 [ic] Introduce StoreOwnIC.
... which is used for initializing properties with non compile time values.

Currently we use StoreOwnIC only for storing properties that already exist
in the boilerplate therefore we can reuse StoreIC dispatcher.
The proper StoreOwnIC dispatcher will be implemented in a separate CL.

BUG=v8:5495, v8:4414

Change-Id: I9c33fdb8499ec5be2c7fce1ecb6ce7aa285e5844
Reviewed-on: https://chromium-review.googlesource.com/443588
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43285}
2017-02-17 15:55:33 +00:00
ulan
9e187ea91b [heap] Remove Heap::TracePath* functions.
The functions do not work correctly with concurrent sweeper and they
do not take weak references into account.

The latter is a fundamental problem for this tracing approach.

BUG=

Review-Url: https://codereview.chromium.org/2707433002
Cr-Commit-Position: refs/heads/master@{#43284}
2017-02-17 15:06:58 +00:00
Michael Lippautz
a84b23399e Remove some unused flags
BUG=

Change-Id: I7542ada0eb557b5b813396f7d250549abb880f91
Reviewed-on: https://chromium-review.googlesource.com/444408
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43283}
2017-02-17 14:46:51 +00:00
addaleax
3b15d950ee ValueSerializer: Add SetTreatArrayBufferViewsAsHostObjects() flag
Add `ValueSerializer::SetTreatArrayBufferViewsAsHostObjects()` which
instructs the `ValueSerializer` to treat ArrayBufferView objects as
host objects.

BUG=v8:5926

Review-Url: https://codereview.chromium.org/2696133007
Cr-Commit-Position: refs/heads/master@{#43281}
2017-02-17 14:19:39 +00:00
Camillo Bruni
3a43be9b78 [elements] Check if the backing store has been neutered for indexOf
BUG=691323

Change-Id: I84f2c90355982567c421639e115745eadd5fcb21
Reviewed-on: https://chromium-review.googlesource.com/441964
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43279}
2017-02-17 12:49:21 +00:00
Marja Hölttä
3ee21f289b [parser] Skipping inner funcs: params part 4
Add some tests which already pass.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: Icf5cf5e40010deb2efb69dea750661854b055566
Reviewed-on: https://chromium-review.googlesource.com/444744
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43278}
2017-02-17 12:19:35 +00:00
vabr
454816f08f Report unexpected lexical decl also without destructuring
https://codereview.chromium.org/2694003002/ introduced
"SyntaxError: Lexical declaration cannot appear in a single-statement context"
for the case when let + desctructuring from a list happen.

As was pointed out in https://codereview.chromium.org/2694003002/#msg18, the
case without destructuring would also benefit from a better message: if a
single statement is expected and "let identifier = ..." is seen, the error is
indeed again that the lexical declaration is not a statement. However, the current
error is "Unexpected identifier", because the parser tries to accept "let" as
an identifier in an expression statement, and then gives up seeing the other
identifier after "let".

This CL ensures that the parser recognises the error properly and reports
accordingly. It also renames the existing test, which contains destructuring,
and adds the one with a non-destructuring lexical declaration.

BUG=v8:5686

Review-Url: https://codereview.chromium.org/2697193007
Cr-Commit-Position: refs/heads/master@{#43275}
2017-02-17 10:57:32 +00:00
Toon Verwaest
0a8de761ff Remove unused Box type
BUG=

Change-Id: Ie7a8327fac62a0608b60cf9f0f072f979ac4fd76
Reviewed-on: https://chromium-review.googlesource.com/443528
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@google.com>
Cr-Commit-Position: refs/heads/master@{#43269}
2017-02-17 10:06:22 +00:00
dcheng
c5ccae970d Remove a few unnecssary scopers from unit tests.
TestWithIsolate and TestWithContext already instantiate the scopers.

BUG=none

Review-Url: https://codereview.chromium.org/2690303009
Cr-Commit-Position: refs/heads/master@{#43268}
2017-02-17 09:51:07 +00:00
dcheng
692cccce26 Make instance checks understand remote contexts.
https://crrev.com/2500363002 updated FunctionTemplate::HasInstance to
follow the hidden prototype chain of a global proxy to the global
object. However, remote contexts don't have a global object to check;
instead, teach the instance check knows about the conventions of
global proxy setup and have it also check the constructor's prototype.

Similarly, also teach Object::FindInstanceInPrototypeChain about the
unusual conventions for remote contexts.

BUG=527190

Review-Url: https://codereview.chromium.org/2698683003
Cr-Commit-Position: refs/heads/master@{#43263}
2017-02-16 21:46:15 +00:00
jwolfe
d1d4b9ce51 Implement new Function.prototype.toString --harmony-function-tostring
For functions declared in source code, the .toString() representation
will be an excerpt of the source code.
* For functions declared with the "function" keyword, the excerpt
  starts at the "function" or "async" keyword and ends at the final "}".
  The previous behavior would start the excerpt at the "(" of the
  parameter list, and prepend a canonical `"function " + name` or
  similar, which would discard comments and formatting surrounding the
  function's name. Anonymous functions declared as function expressions
  no longer get the name "anonymous" in their toString representation.
* For methods, the excerpt starts at the "get", "set", "*" (for
  generator methods), or property name, whichever comes first.
  Previously, the toString representation for methods would use a
  canonical prefix before the "(" of the parameter list. Note that any
  "static" keyword is omitted.
* For arrow functions and class declarations, the excerpt is unchanged.

For functions created with the Function, GeneratorFunction, or
AsyncFunction constructors:
* The string separating the parameter text and body text is now
  "\n) {\n", where previously it was "\n/*``*/) {\n" or ") {\n".
* At one point, newline normalization was required by the spec here,
  but that was removed from the spec, and so this CL does not do it.

Included in this CL is a fix for CreateDynamicFunction parsing. ')'
and '`' characters in the parameter string are no longer disallowed,
and Function("a=function(", "}){") is no longer allowed.

BUG=v8:4958, v8:4230

Review-Url: https://codereview.chromium.org/2156303002
Cr-Commit-Position: refs/heads/master@{#43262}
2017-02-16 20:19:24 +00:00
Daniel Clifford
bd21c2bd04 [ignition] Optimize reloading of registers before Dispatch
Before this patch, the registers needed for bytecode dispatch in interpreter
handlers were inconsistently stored in the interpreter frame and/or kept in
values that remained live across calls.

After this patch, these registers are explicitly reloaded after calls, making it
possible to elide the spills of those registers before the call in many cases.

Some highlights from the CL:

* Added methods to the CSA and InterpreterAssembler to efficiently store and
  load Smis values and Smi interpreter registers on x64 without explicit
  tagging/untagging.

* Created Variables for all of the interpreter-internal values that need to be
  reloaded before bytecode dispatch at the end of an interpreter handler.

* The bytecode offset can be written out early in a handler by marking it
  has having a call along it's critical path. By moving this early in a
  handler, it becomes possible to use memory operands for pushes used to
  marshall parameters when making calls.

Change-Id: Icf8d7798789f88a4489e06a7092616bbbb881577
Reviewed-on: https://chromium-review.googlesource.com/442566
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43260}
2017-02-16 19:30:39 +00:00
vabr
94bf354af5 Raise SyntaxError on let [ starting an ExpressionStatement
ES2017 forbids the sequence of tokens "let [" in in expression statements [1].

This CL makes ParserBase report those instances as SyntaxError. It also adds a
customised error message for that, because the standard "Unexpected token" is
not applicable: "let" itself is not forbidden in those context, only the
sequence of "let [".

[1] https://tc39.github.io/ecma262/#sec-expression-statement

BUG=v8:5686

Review-Url: https://codereview.chromium.org/2694003002
Cr-Commit-Position: refs/heads/master@{#43258}
2017-02-16 17:37:21 +00:00
gsathya
7ee77b9be6 [mjsunit] Exit on hitting unreachable code instead of throwing
Errors are swallowed by promises, so just exit with stack trace.

Review-Url: https://codereview.chromium.org/2693383004
Cr-Commit-Position: refs/heads/master@{#43254}
2017-02-16 14:46:55 +00:00
mvstanton
ae8f28208f This is a workaround for the fact that %SetCode can "lose" the script for a js native. If the js native is re-initialized (for a Realm or something), then the source SharedFunctionInfo won't have a script anymore. Nonetheless, we may want to optimize the function. If we've compiled bytecode, then we can compile optimized code without a script.
Here, we carve out a special exception for this case, so that we can turn on the --mark-shared-functions-for-tier-up.

BUG=v8:5946
R=leszeks@chromium.org

Review-Url: https://codereview.chromium.org/2684033007
Cr-Original-Commit-Position: refs/heads/master@{#43240}
Committed: 4123a3dd79
Review-Url: https://codereview.chromium.org/2684033007
Cr-Commit-Position: refs/heads/master@{#43252}
2017-02-16 14:39:17 +00:00
rossberg
e2b83fbbfd [wasm] Inspect right control frames for unreachable flag
We were looking at the unreachable flag or stack_depth of the target frame
instead of the current one in a couple of places (most notably BreakTo).
This change fixes these bugs and makes us pass the latest spec tests for
br_table validation. Also need to ensure that br_table targets have consistent
types, which is not implied if the stack is polymorphic.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2696813002
Cr-Commit-Position: refs/heads/master@{#43250}
2017-02-16 14:12:01 +00:00
jbroman
8990399dc7 ValueDeserializer: Only allow valid keys when deserializing object properties.
The serializer won't ever write a more complex object. Not validating this
allows other things to be used as keys, and converted to string when the
property set actually occurs. It turns out this gives an opportunity to trigger
OOM by giving an object a key which is a very large sparse array (whose string
representation is very large).

This case is now rejected by the deserializer.

BUG=chromium:686511

Review-Url: https://codereview.chromium.org/2697023002
Cr-Commit-Position: refs/heads/master@{#43249}
2017-02-16 13:59:56 +00:00
Andreas Haas
5f1661aad7 [turbofan] For Word32Shl optimizations only consider the last 5 bits of the shift
One optimization in the machine-operator-reducer did not consider that
that word32 shift left instructions only consider the last 5 bits of
the shift input.

The issue only occurs for WebAssembly because in JavaScript we always
add a "& 0xf" on the shift value to the TurboFan graph.

For additional background: The JavaScript and WebAssembly spec both
say that only the last 5 bits of the shift value are used in the
word32-shift-left operation. This means that an "x << 0x29", in the
code is actually executed as "x << 0x09". Therefore the changes in
this CL are okay because they mask the last 5 bit of the shift value.

BUG=chromium:689450

Change-Id: Id92f298ed6d7f1714b109b3f4fbcecd5ac6d30f7
Reviewed-on: https://chromium-review.googlesource.com/439312
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43245}
2017-02-16 12:09:32 +00:00
jgruber
e9f5e1e99e [debug] Handle OOM events in debugger tests
Map OOM breaks generated by inspector to DebugEvent.OOM.
This avoids generating unintentional DebugEvent.Break events.

Also be more future-proof in event categorization.

On a related note, this CL also fixes a DCHECK in
Runtime::GetFrameDetails.

The receiver needs to be grabbed from the inlined frame, not
the outer optimized frame. Optimized frames only provide the
receiver on a best-effort basis.

BUG=v8:5950

Review-Url: https://codereview.chromium.org/2696173002
Cr-Commit-Position: refs/heads/master@{#43244}
2017-02-16 11:48:22 +00:00
Andreas Haas
140ec9d7cc [wasm][fuzzer] Small fixes in the correctness fuzzer result comparison.
R=eholk@chromium.org

Change-Id: Ieb88f807275e1cc31cc7715270e316c427b212d4
Reviewed-on: https://chromium-review.googlesource.com/442425
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43243}
2017-02-16 11:23:29 +00:00
machenbach
4d942ac741 Revert of Allow a ParseInfo without a script for %SetCode users (patchset #5 id:220001 of https://codereview.chromium.org/2684033007/ )
Reason for revert:
Please remove the file in status file too. Breaks presubmit:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20presubmit/builds/14754

Or lets call it post-submit :(

Original issue's description:
> This is a workaround for the fact that %SetCode can "lose" the script for a js native. If the js native is re-initialized (for a Realm or something), then the source SharedFunctionInfo won't have a script anymore. Nonetheless, we may want to optimize the function. If we've compiled bytecode, then we can compile optimized code without a script.
>
> Here, we carve out a special exception for this case, so that we can turn on the --mark-shared-functions-for-tier-up.
>
> BUG=v8:5946
> R=leszeks@chromium.org
>
> Review-Url: https://codereview.chromium.org/2684033007
> Cr-Commit-Position: refs/heads/master@{#43240}
> Committed: 4123a3dd79

TBR=leszeks@chromium.org,mstarzinger@chromium.org,marja@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5946

Review-Url: https://codereview.chromium.org/2703553002
Cr-Commit-Position: refs/heads/master@{#43242}
2017-02-16 10:39:58 +00:00
Marja Hölttä
712800a636 [parser] Skipping inner funcs: params part 3
Produce the same scopes / variables for parameters (part 3).

This CL fixes the ordering + variable types in PreParser when there are
simple parameters + a rest parameter. In that case, Parser declares
unnamed temporaries for the non-rest params, then the rest param, then
the named variables (which are not parameters) for the non-rest params.

BUG=v8:5516
R=vogelheim@chromium.org

Change-Id: I9b006595039c8002b0508d1d2a200aa9a0f3eae0
Reviewed-on: https://chromium-review.googlesource.com/443527
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43241}
2017-02-16 10:24:52 +00:00
mvstanton
4123a3dd79 This is a workaround for the fact that %SetCode can "lose" the script for a js native. If the js native is re-initialized (for a Realm or something), then the source SharedFunctionInfo won't have a script anymore. Nonetheless, we may want to optimize the function. If we've compiled bytecode, then we can compile optimized code without a script.
Here, we carve out a special exception for this case, so that we can turn on the --mark-shared-functions-for-tier-up.

BUG=v8:5946
R=leszeks@chromium.org

Review-Url: https://codereview.chromium.org/2684033007
Cr-Commit-Position: refs/heads/master@{#43240}
2017-02-16 10:23:59 +00:00
littledan
d31c5410c4 [builtins] Apply ES2016 conditional default timezone semantics
ES2016 changed the default timezone of dates to be conditional on
whether a time is included. The semantics were a compromise approach
based on web compatibility feedback from V8, but until now, we have been
shipping ES5.1 default timezone semantics. This patch implements the
new semantics, following ChakraCore and SpiderMonkey (though JSC
implements V8's previous semantics).

BUG=chromium:589858

Review-Url: https://codereview.chromium.org/2648603002
Cr-Commit-Position: refs/heads/master@{#43239}
2017-02-16 10:02:01 +00:00
Marja Hölttä
d21621cf35 [parser] No need to collect literal counts.
Patch adopted from mvstanton@ ( https://codereview.chromium.org/2657413002/ )

BUG=

Change-Id: I4296b3d5694116e250a6bb88296fbed0f0c444e6
Reviewed-on: https://chromium-review.googlesource.com/443246
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43238}
2017-02-16 09:58:45 +00:00
Michael Starzinger
9d53d16bcf [turbofan] Handle arithmetic addition in early lowering.
This handles arithmetic addition operations during the early type-hint
lowering (i.e. during graph construction). The string addition case is
still handled by {JSTypedLowering} as it needs static type information.

R=bmeurer@chromium.org

Change-Id: I9df47dfc5bf7613c51f6d803ab43d5d3f6c21be8
Reviewed-on: https://chromium-review.googlesource.com/443185
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43235}
2017-02-16 09:32:32 +00:00
jgruber
c0fe56e63d [regexp] Correct lastIndex behavior in RegExp.prototype[@@replace]
@@replace has a pretty complex implementation, taking different paths
for various situations (e.g.: global/nonglobal regexp, functional/string
replace argument, etc.). Each of these paths must implement similar
logic for calling into the RegExpBuiltinExec spec operation, and many
paths get this subtly wrong.

This CL fixes a couple of issues related to the way @@replace handles lastIndex:
* All paths now respect lastIndex when calling into exec (some used to assume 0).
* lastIndex is now advanced after a successful match for sticky regexps.
* lastIndex is now only reset to 0 on failure for sticky regexps.

BUG=v8:5361

Review-Url: https://codereview.chromium.org/2685183003
Cr-Commit-Position: refs/heads/master@{#43234}
2017-02-16 09:21:37 +00:00
yangguo
c39123dd53 [debugger] implement inspector-facing API for code coverage.
The inspector uses V8's API handles and should not access
V8 internals. This change makes sure it can use the coverage
data in an encapsulated way.

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2696163002
Cr-Commit-Position: refs/heads/master@{#43231}
2017-02-16 08:36:12 +00:00
caitp
76ab55e3d3 [async-iteration] add support for for-await-of loops in Async Functions
When --harmony-async-iteration is enabled, it is now possible to
use the for-await-of loop, which uses the Async Iteration protocol
rather than the ordinary ES6 Iteration protocol.

the Async-from-Sync Iterator object is not implemented in this CL,
and so for-await-of loops will abort execution if the iterated object
does not have a Symbol.asyncIterator() method. Async-from-Sync
Iterators are implemented seperately in https://codereview.chromium.org/2645313003/

BUG=v8:5855, v8:4483
R=neis@chromium.org, littledan@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/2637403008
Cr-Commit-Position: refs/heads/master@{#43224}
2017-02-15 19:39:06 +00:00
Peter Marshall
817e0358e3 [builtins] Convert the hole to undefined when pushing spread arguments.
The mips64 implementation always ended up in the slowpath due to some
loads that were the wrong width, so that is also fixed here.

BUG=v8:5974

Change-Id: Ie448a1fab5b7fca87597c5a1bf75443864e30c28
Reviewed-on: https://chromium-review.googlesource.com/443247
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43222}
2017-02-15 18:32:16 +00:00
bbudge
717c8f2c76 [HEAP] Remove SIMD 128 bit alignment from heap.
LOG=N
BUG=v8:4124, v8:5948

Review-Url: https://codereview.chromium.org/2694063005
Cr-Commit-Position: refs/heads/master@{#43219}
2017-02-15 15:42:27 +00:00
Michael Starzinger
67d087d577 [turbofan] Handle some arithmetic ops in early lowering.
This handles all arithmetic binary operations except addition during the
early type-hint lowering (i.e. during graph construction). We still use
static type information to potentially further reduce the speculative
operations down to pure operations during the typed lowering phase.

R=bmeurer@chromium.org

Change-Id: I8b93fd7c46ec8e5b81234a49624d503520c3d082
Reviewed-on: https://chromium-review.googlesource.com/443105
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43218}
2017-02-15 15:10:02 +00:00
cwhan.tunz
693b741f6d [tests] Add js-perf-test for %TypedArray%.prototype.sort
- Add benchmark for sorting of Float64Array
- Rename existing typedarray.js to copywithin.js

BUG=v8:5953
R=bmeurer@chromium.org, caitp@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2691423003
Cr-Commit-Position: refs/heads/master@{#43217}
2017-02-15 14:48:42 +00:00
caitp
dc302c74be Reland [typedarrays] move %TypedArray%.prototype.copyWithin to C++
- Removes shared InnerArrayCopyWithin JS builtin from src/js/array.js
- Implements %TypedArray%.prototype.copyWithin as a C++ builtin, which
relies on std::memmove rather than accessing individual eleements.
- Fixes the case where copyWithin is invoked on a TypedArray with a
detached buffer.
- Add tests to ensure that +/-Infinity (for all 3 parameters) is handled
  correctly by the
algorithm

The C++ version gets through the benchmark more than 25000 times as
quickly as the JS implementation.

BUG=v8:5925, v8:5929, v8:4648
R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2697593002
Cr-Commit-Position: refs/heads/master@{#43213}
2017-02-15 14:21:18 +00:00
Igor Sheludko
fdc78d294e [ic] Cleanup vector-based IC clearing.
... and don't clear ICs during GC. The IC clearing used to prevent memory
leaks but it's not necessary anymore because all the handlers that need
to embed objects already use weak cells.

This CL unblocks inlining of IC dispatchers into bytecode handlers.

BUG=v8:5917

Change-Id: I229b9ba8dba44f431dfbe8ac5370d855e3e84dd6
Reviewed-on: https://chromium-review.googlesource.com/442127
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43209}
2017-02-15 13:01:11 +00:00
Michael Starzinger
d0b9062432 [turbofan] Implement early lowering based on type hints.
This allows part of typed lowering that is solely based on type-hints to
run as part of the graph construction. The lowering in question does not
inspect types and hence doesn't require the typer to have run before. We
insert the speculative simplied-level operations in favor of the generic
JavaScript-level variants.

R=bmeurer@chromium.org

Change-Id: I5f0549fc1e4ff607622ee9059e6232a32f77db2e
Reviewed-on: https://chromium-review.googlesource.com/442584
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43208}
2017-02-15 12:18:42 +00:00
ishell@chromium.org
65f0e958f6 [runtime][tests] More *TypeFeedbackVector* -> *FeedbackVector* renamings.
BUG=

Change-Id: I859fef6b18e51cca80343a89e2b6f38eee95d408
Reviewed-on: https://chromium-review.googlesource.com/442428
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43206}
2017-02-15 08:53:51 +00:00
vabr
e3d761d94b ParserBase should accept ESCAPED_STRICT_RESERVED_WORD as an identifier
ParserBase::is_any_identifier currently does not recognise
Token::ESCAPED_STRICT_RESERVED_WORD as an identifier. This seems different
from what ParserBase::ParseIdentifierName does, and also prevents
"l\u0065t", unlike "let", from becoming a label.

This CL extends is_any_identifier to also accept ESCAPED_STRICT_RESERVED_WORD.

BUG=v8:5692

Review-Url: https://codereview.chromium.org/2695973003
Cr-Commit-Position: refs/heads/master@{#43204}
2017-02-15 02:35:12 +00:00
eholk
c7eabee422 [wasm] include JS conformance tests in Wasm mjsunit tests
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5507

Review-Url: https://codereview.chromium.org/2660903003
Cr-Original-Commit-Position: refs/heads/master@{#42821}
Committed: eb9b5edffb
Review-Url: https://codereview.chromium.org/2660903003
Cr-Commit-Position: refs/heads/master@{#43201}
2017-02-14 18:25:32 +00:00
ahaas
2f8ad11f2b [arm64] A shift of 0 is not allowed in ubfx.
R=bmeurer@chromium.org, v8-arm-ports@googlegroups.com
BUG=v8:5951

Review-Url: https://codereview.chromium.org/2685943003
Cr-Original-Commit-Position: refs/heads/master@{#43090}
Committed: c46ccef921
Review-Url: https://codereview.chromium.org/2685943003
Cr-Commit-Position: refs/heads/master@{#43199}
2017-02-14 17:40:51 +00:00
vabr
0559fd7082 NumberFormat: default mnsd value is 1
CreateNumberFormat of src/js/i18n.js implements
http://www.ecma-international.org/ecma-402/1.0/#sec-11.1.1.1, but has a typo
in step 33a. The spec says that the default value for minimumSignificantDigits
should be 1, while the script set it to 0.

This CL fixes that typo and adds a test for that.

BUG=v8:5554

Review-Url: https://codereview.chromium.org/2694673003
Cr-Commit-Position: refs/heads/master@{#43197}
2017-02-14 17:12:49 +00:00
vabr
566e05c11e Provide default month for Date.UTC
After https://github.com/tc39/ecma262/pull/642, Date.UTC no longer requires
the month argument to be specified. The spec provides 0 as its default value.

This CL updates the builtins-date.cc code to reflect that and drops the test
suppression for test262/built-ins/Date/UTC/return-value.

BUG=v8:5534

Review-Url: https://codereview.chromium.org/2689173003
Cr-Commit-Position: refs/heads/master@{#43193}
2017-02-14 15:14:01 +00:00
Georg Neis
a68dcff45b [test] Add some more tests for async functions.
BUG=

Change-Id: I4a5db9bc045a63e710d0115523ab23b98e7c7ae6
Reviewed-on: https://chromium-review.googlesource.com/442504
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43189}
2017-02-14 14:49:45 +00:00
mstarzinger
e432f07db4 [unittests] Remove redundant checkpoint in JSTypedLoweringTest.
R=bmeurer@chromium.org
TEST=unittests/JSTypedLoweringTest

Review-Url: https://codereview.chromium.org/2694063003
Cr-Commit-Position: refs/heads/master@{#43186}
2017-02-14 13:36:37 +00:00
vabr
b478e9c11c Fix TypeError message for Reflect.construct
If the Reflect.construct receives an argument expected to be a constructor,
and the argument is not a constructor, V8 currently declares that
Reflect.construct is not a function. It should instead say that the offending
argument is not a constructor.

This is the case for all ports of builtins
(Builtins::Generate_ReflectConstruct). All of them make an
attempt to at least pass the right argument to the TypeError parametrised
message, calling out the offending Reflect.construct argument. However,
Runtime::kThrowCalledNonCallable extracts the callsite from those arguments,
discarding the precise information.

This CL adds Runtime::kNotConstructor, which reports the arguments passed
to it, and the CL also modifies the ports of builtins to make use of
Runtime::kNotConstructor

BUG=v8:5671

Review-Url: https://codereview.chromium.org/2688393003
Cr-Commit-Position: refs/heads/master@{#43182}
2017-02-14 11:21:34 +00:00
gsathya
a09157033b [tests] make the function expression, an iife to run the test
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2690163004
Cr-Commit-Position: refs/heads/master@{#43180}
2017-02-14 10:15:21 +00:00
clemensh
be1a5f7551 [asm] Fix lots of invalid asm.js tests
I identified lots of asm.js tests that are actually not valid according
to the spec, hence they execute in default-javascript-mode.
This CL fixes most of them by adding additional type annotations.

The atomic tests are totally non-spec-compliant by expecting a fourth
argument, and infinite-loops-taken expects a function-type parameter,
so I did not fix those.
I also did not fix the regression tests.

R=titzer@chromium.org, bradnelson@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2663243002
Cr-Commit-Position: refs/heads/master@{#43179}
2017-02-14 09:26:52 +00:00
clemensh
0b287bd4ea [asm-wasm] Fix continue target of do-while loops
See associated bug: A continue if a do-while loop did jump back to the
loop header, instead of jumping to the condition.
This CL fixes this and adds a test case.

R=bradnelson@chromium.org, titzer@chromium.org
BUG=v8:5912

Review-Url: https://codereview.chromium.org/2693993002
Cr-Commit-Position: refs/heads/master@{#43178}
2017-02-14 08:57:35 +00:00
bbudge
deabb19abc Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43169}
Committed: a9b59a11f1
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43176}
2017-02-14 06:57:25 +00:00
yangguo
033d3b577b [debugger] change coverage format to nested, with function name.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2694623003
Cr-Commit-Position: refs/heads/master@{#43175}
2017-02-14 06:47:58 +00:00
franzih
a386eb4f04 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
Breaks Node integration build.

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,v8:5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Original-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43169}
> Committed: a9b59a11f1

TBR=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,machenbach@chromium.org,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,v8:5948

Review-Url: https://codereview.chromium.org/2695653005
Cr-Commit-Position: refs/heads/master@{#43170}
2017-02-13 21:33:46 +00:00
bbudge
a9b59a11f1 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43169}
2017-02-13 20:43:08 +00:00
bbudge
11f88ef53f [Turbofan] Add more non-arithmetic SIMD operations.
- Renames select, swizzle, and shuffle to be consistent with the S128 and
  existing S32x4 ops, and reflect that these aren't arithmetic.
  e.g. I16x8Swizzle -> S16x8Swizzle.
- Implements S16x8 and S8x16 Select operations and tests.
- Implements S128And, Or, Xor, Not operations and tests.
- Implements Swizzle for 32x4 formats.
- Refactors test macros that generate SIMD code.

TEST=cctest/test-run-wasm-simd/*

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2683713003
Cr-Commit-Position: refs/heads/master@{#43168}
2017-02-13 20:24:43 +00:00
jyan
2dab40ccda s390: use new mul instruction
R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com, danno@chromium.org, bmeurer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2691893002
Cr-Commit-Position: refs/heads/master@{#43166}
2017-02-13 18:50:35 +00:00
bradnelson
43fc15bb79 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
red

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
> (notry since trybots can't patch directory deletes)
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9

TBR=bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,5948

Review-Url: https://codereview.chromium.org/2692933002
Cr-Commit-Position: refs/heads/master@{#43164}
2017-02-13 18:12:14 +00:00
bbudge
d170c57ab9 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
(notry since trybots can't patch directory deletes)
NOTRY=true

Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43162}
2017-02-13 15:59:22 +00:00
Marja Hölttä
2d9b9faf17 [iwyu, wasm] Remove unallowed includes to objects-inl.h from wasm.
R=mstarzinger@chromium.org
BUG=v8:5294

Change-Id: If2cdb4d38829e69ddd8aecb99c99c3a03050f57c
Reviewed-on: https://chromium-review.googlesource.com/441824
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43158}
2017-02-13 15:05:37 +00:00
Marja Hölttä
8c449e39b5 [parsing/test] Skipping inner funcs: add more (structured tests).
Test both cases where the interesting constructs occur at the
laziness boundary and cases where they occur deeper.

BUG=v8:5501
R=vogelheim@chromium.org

Change-Id: I99e32cb0c829616011bf7d1f389a8d309b54d67e
Reviewed-on: https://chromium-review.googlesource.com/441844
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43157}
2017-02-13 15:04:34 +00:00
Marja Hölttä
cb7e3d39fd Disable flaky debugger/debug/harmony/modules-debug-scopes1
BUG=v8:5950
NOTRY=true

Change-Id: I735e9be997167aa9f7252ad592c0881f6f5f621d
Reviewed-on: https://chromium-review.googlesource.com/441726
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43156}
2017-02-13 14:44:55 +00:00
vabr
1dd803f9d3 Fix error message for invalid buffer offset
The constructor for TypedArray in js/typedarray.js emitted
kInvalidTypedArrayAlignment if the array offset exceeded the size of the
underlying buffer. This seems like a typo introduced in
https://codereview.chromium.org/2090353003.

The error message to be emitted instead coincides with the already existing
kInvalidDataViewOffset. The message string is independent of whether the
object in question is a DataView or a typed array, so this CL:
  (1) renames kInvalidDataViewOffset to just kInvalidOffset, and
  (2) uses kInvalidOffset instead of kInvalidTypedArrayAlignment for cases
      when the TypedArray is constructed with an offset exceeding the buffer
      size.

BUG=v8:5733
TEST=Run d8, execute "new Uint8Array(new ArrayBuffer(1),2)", see the error message mention the invalid offset 2.

Review-Url: https://codereview.chromium.org/2692753002
Cr-Commit-Position: refs/heads/master@{#43151}
2017-02-13 10:28:34 +00:00
vabr
e08f85fcfe Unify TypeError messages
This CL fixes some nits in TypeError messages, unifying the form of
kDefineDisallowed and kObjectNotExtensible to match what is used by the
majority of the other messages:
  * "Cannot" vs. "Can't" -> choose "Cannot"
  * "property:%" -> "property %"
  * omit the full-stop at the end of the message

BUG=v8:5673

Review-Url: https://codereview.chromium.org/2686233008
Cr-Commit-Position: refs/heads/master@{#43150}
2017-02-13 10:27:03 +00:00
Michael Starzinger
6ee0b6cec6 [turbofan] Correct lazy deopt by {JSCreate} operation.
This adds support for deoptimizing into the JSConstructStub after the
receiver instantiation but before the actual constructor invocation.
Such a deoptimization point is needed for cases where instantiation
might be observed (e.g. when new.target is a proxy) and hence might
trigger a deopt.

We use this new deoptimization point for the "after" frame-state the
inliner attaches to {JSCreate} nodes being inserted when constructor
calls are being inlined.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-5638b
BUG=v8:5638

Change-Id: I7c72c807ee8fb76d12e0e9ccab86d970ab1a0efd
Reviewed-on: https://chromium-review.googlesource.com/440125
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43149}
2017-02-13 10:14:54 +00:00
Marja Hölttä
d1055c1fbd [iwyu] Remove unallowed include arguments.h -> objects-inl.h
After this, only 2 illegal includes to objects-inl.h remain (some wasm stuff).

R=​mstarzinger@chromium.org
BUG=v8:5294

Change-Id: I18682f42f0d2a7cc29a0a0be76f8e4eea26aafd9
Reviewed-on: https://chromium-review.googlesource.com/441744
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43147}
2017-02-13 10:06:48 +00:00
ahaas
94c9a4fafd [fuzzer] Format README.md
NOTRY=true
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2692443002
Cr-Original-Commit-Position: refs/heads/master@{#43138}
Committed: a3de4726c3
Review-Url: https://codereview.chromium.org/2692443002
Cr-Commit-Position: refs/heads/master@{#43140}
2017-02-13 08:42:26 +00:00
ahaas
68bcaf9be3 Revert of [fuzzer] Format README.md (patchset #2 id:20001 of https://codereview.chromium.org/2692443002/ )
Reason for revert:
Found another mistake

Original issue's description:
> [fuzzer] Format README.md
>
> NOTRY=true
> R=hablich@chromium.org
>
> Review-Url: https://codereview.chromium.org/2692443002
> Cr-Commit-Position: refs/heads/master@{#43138}
> Committed: a3de4726c3

TBR=hablich@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2693863002
Cr-Commit-Position: refs/heads/master@{#43139}
2017-02-13 08:39:55 +00:00
ahaas
a3de4726c3 [fuzzer] Format README.md
NOTRY=true
R=hablich@chromium.org

Review-Url: https://codereview.chromium.org/2692443002
Cr-Commit-Position: refs/heads/master@{#43138}
2017-02-13 08:37:47 +00:00
bmeurer
1a2362089c [es2015] Remove the @@hasInstance protector cell.
We cannot skip the @@hasInstance lookup in instanceof depending on a
global protector cell, as the lookup of the property is observable
via proxies or accessors. So remove the global protector and properly
implement CSA::InstanceOf via GetPropertyStub, with an appropriate
fast-path for Function.prototype[@@hasInstance] where we call the
builtin code object directly if the function matches, skipping all
the checks from the call sequence, and also avoid the redundant
ToBoolean conversion on the result.

R=yangguo@chromium.org
TBR=ulan@chromium.org
BUG=v8:5958

Review-Url: https://codereview.chromium.org/2684033012
Cr-Commit-Position: refs/heads/master@{#43137}
2017-02-13 07:16:27 +00:00
littledan
4530f0dc0c Revert of [typedarrays] move %TypedArray%.prototype.copyWithin to C++ (patchset #6 id:100001 of https://codereview.chromium.org/2671233002/ )
Reason for revert:
Due to security issue described in review thread.

Original issue's description:
> [typedarrays] move %TypedArray%.prototype.copyWithin to C++
>
> - Removes shared InnerArrayCopyWithin JS builtin from src/js/array.js
> - Implements %TypedArray%.prototype.copyWithin as a C++ builtin, which
> relies on std::memmove rather than accessing individual eleements.
> - Fixes the case where copyWithin is invoked on a TypedArray with a
> detached buffer.
> - Add tests to ensure that +/-Infinity (for all 3 parameters) is handled correctly by the
> algorithm
>
> The C++ version gets through the benchmark more than 25000 times as
> quickly as the JS implementation.
>
> BUG=v8:5925, v8:5929, v8:4648
> R=cbruni@chromium.org, adamk@chromium.org, littledan@chromium.org
>
> Review-Url: https://codereview.chromium.org/2671233002
> Cr-Commit-Position: refs/heads/master@{#42975}
> Committed: 0f1c626d55

TBR=cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org,cwhan.tunz@gmail.com,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5925, v8:5929, v8:4648

Review-Url: https://codereview.chromium.org/2693753002
Cr-Commit-Position: refs/heads/master@{#43132}
2017-02-12 21:16:18 +00:00
cwhan.tunz
48dff523f7 Throw when a holey property is set in Array.sort
Do not allow that holey properties are defined in Array sort.
Throw a type error if the array is not extensible and there are holey
properties in the middle of the array.

BUG=v8:4888

Review-Url: https://codereview.chromium.org/2664173002
Cr-Commit-Position: refs/heads/master@{#43126}
2017-02-11 13:00:40 +00:00
Ross McIlroy
96009d28dc [Compiler] Avoid stepping a job in EnqueueAndStep if job is already enqueued.
If a job was already enqueued, EnqueueAndStep would still step the job one
more step. However, since it didn't take the job out of the
pending_background_jobs pool, the job could get picked up by a background
thread which would try to step it, but it the job is now at a step which
can't be run on the background.

BUG=v8:5203,chromium:685515

Change-Id: I2cee2a33625ba455aca49a8037601be9ff8bb73f
Reviewed-on: https://chromium-review.googlesource.com/441084
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43121}
2017-02-10 22:40:24 +00:00
jwolfe
9675811a60 Heuristic for eager parsing works for async functions
The heuristic checks for "(function", and now it also checks for
"(async function".

BUG=v8:4230

Review-Url: https://codereview.chromium.org/2682173005
Cr-Commit-Position: refs/heads/master@{#43120}
2017-02-10 20:55:57 +00:00
littledan
91b79fb789 test262 roll
This roll includes the SharedArrayBuffer tests (skipping for now)
but doesn't include the $ renaming.

This is a reland; previously, I reverted because I was confused about why
the rename of $ to $262 didn't break tests; it now seems that the
previous patch left it as an alias. This patch does not do the renaming
yet, as the renaming usage has not landed upstream yet.

R=adamk

Review-Url: https://codereview.chromium.org/2685603003
Cr-Commit-Position: refs/heads/master@{#43118}
2017-02-10 19:05:55 +00:00
rmcilroy
53c11006e5 [Compiler] Avoid blocking on inner function parallel compilation.
Don't block on inner function compilation before competing outer function
compilation. Instead wait for the compilation to complete when the function
is called.

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2686673002
Cr-Commit-Position: refs/heads/master@{#43116}
2017-02-10 18:46:31 +00:00
Leszek Swirski
2bfd8a7cb7 [ignition] Remove handles from bytecode generation
Removes handles from bytecode generation, instead storing
un-internalized AstValues (and other, similar values such as Scopes and
AstRawStrings) in the constant array builder.

This will allow us in the future to generate the bytecode before
internalizing the AST.

BUG=v8:5832

Change-Id: I3b8be8f7329a484eb1e5d12808b001d3475239da
Reviewed-on: https://chromium-review.googlesource.com/439326
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43115}
2017-02-10 17:52:39 +00:00