Commit Graph

14497 Commits

Author SHA1 Message Date
vogelheim
ffa4010cc8 Skip mjsunit/big-object-literal for debug builds.
mjsunit/big-object-literal will exhaust the stack in debug builds,
due to different compiler settings. It will work in optdebug.
This disables for both. Adding an 'optdebug' test to .status files
is easy, but I don't want to contribute to the 'mode x variant explosion'.

R=jochen@chromium.org
CC=franzih@chromium.org, machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2609193002
Cr-Commit-Position: refs/heads/master@{#42061}
2017-01-04 10:00:42 +00:00
bmeurer
7aa3931fa4 [turbofan] Add constant-folding for CheckedFloat64ToInt32.
BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2612763002
Cr-Commit-Position: refs/heads/master@{#42060}
2017-01-04 09:43:23 +00:00
bmeurer
c1a0e8567a [turbofan] Add constant-folding for Float64RoundDown.
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2616613002
Cr-Commit-Position: refs/heads/master@{#42058}
2017-01-04 08:29:49 +00:00
neis
d946a27e03 [modules] Make @@toStringTag on namespace objects non-configurable.
See https://github.com/tc39/ecma262/pull/747.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2603193002
Cr-Commit-Position: refs/heads/master@{#42057}
2017-01-04 06:33:10 +00:00
mtrofin
da70d7aa9f Steps towards removing the dependency on ModuleEnv from the compiler.
This CL simplifies the relation between the wasm graph builder, the
wasm decoder, and the wasm module they work on.

BUG=

Review-Url: https://codereview.chromium.org/2612643002
Cr-Commit-Position: refs/heads/master@{#42056}
2017-01-04 05:14:04 +00:00
binji
534ddf645b Disallow passing a SharedArrayBuffer in the transfer list.
This behavior changed recently. SharedArrayBuffers should not be put in the
transfer list, because they are not detached, and that is the meaning of being
in the transfer list.

This is the V8 side of the change, the Blink side will come next.

Reland of https://codereview.chromium.org/2570433005, it was reverted because
of a Blink-side test failure which has been temporarily disabled; see
https://codereview.chromium.org/2590003002.

BUG=https://bugs.chromium.org/p/chromium/issues/detail?id=676063

Review-Url: https://codereview.chromium.org/2594793005
Cr-Commit-Position: refs/heads/master@{#42054}
2017-01-03 22:52:17 +00:00
gsathya
a2c15ba376 [promises] Refactor debug code
-- Removes remaning debug from promise.js and moves it to c++
-- Changes debug_id to be a smi in PromiseReactionJobInfo and
   PromiseResolveThenableJobInfo.
-- Changes debug_name to be a smi in PromiseReactionJobInfo and
   PromiseResolveThenableJobInfo.
-- Adds PromiseDebugActionName and PromiseDebugActionType enums
-- Adds PromiseDebugActionNameToString and
   PromiseDebugActionTypeToString helper methods
-- Changes variable `status` to be int in runtime functions.
-- Changes debug_id to start from 1, not 0 for easier bookkeeping.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2606093002
Cr-Commit-Position: refs/heads/master@{#42052}
2017-01-03 21:43:38 +00:00
caitp
c523474713 [cleanup] remove sloppy generator/async function maps
These maps contain exactly the same information as the strict maps, so
this frees up a few pointers of native context space, gets rid of some
branches in FastNewClosure, and adds missing poisoned properties tests
for async functions.

BUG=v8:2355, v8:4483
R=adamk@chromium.org, bmeurer@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2608333002
Cr-Commit-Position: refs/heads/master@{#42051}
2017-01-03 21:38:22 +00:00
marja
e87e82b8e7 Force ctxt allocation in eval scopes.
This is another attempt at solving v8:5736; the previous one (r 41723)
regressed code load.

BUG=v8:5736
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/2583163002
Cr-Commit-Position: refs/heads/master@{#42049}
2017-01-03 20:27:20 +00:00
caitp
5c6e79e184 [builtins] throw if TypedArray buffer is detached during iteration
Per spec change in https://github.com/tc39/ecma262/pull/724, this adds
the exception thrown when a TypedArray's array buffer is detached at
some point during iteration, after the iterator has already been
created.

BUG=v8:5388
R=littledan@chromium.org, bmeurer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2609913002
Cr-Commit-Position: refs/heads/master@{#42048}
2017-01-03 20:12:19 +00:00
jochen
efb329a8ab Reland "Use background tasks for the compiler dispatcher
Original issue's description:
> Use background tasks for the compiler dispatcher
>
> BUG=v8:5215
> R=marja@chromium.org,vogelheim@chromium.org
>
> Review-Url: https://codereview.chromium.org/2606263002
> Cr-Commit-Position: refs/heads/master@{#42035}
> Committed: 7a1b3a7beb

BUG=v8:5215
TBR=marja@chromium.org,vogelheim@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2613483002
Cr-Commit-Position: refs/heads/master@{#42040}
2017-01-03 17:00:56 +00:00
rmcilroy
d4b5bfe306 Revert of Use background tasks for the compiler dispatcher (patchset #5 id:80001 of https://codereview.chromium.org/2606263002/ )
Reason for revert:
Causes IgnitionCompilerDispatcherTest.FinishNowWithBackgroundTask to fail.

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/11209

Original issue's description:
> Use background tasks for the compiler dispatcher
>
> BUG=v8:5215
> R=marja@chromium.org,vogelheim@chromium.org
>
> Review-Url: https://codereview.chromium.org/2606263002
> Cr-Commit-Position: refs/heads/master@{#42035}
> Committed: 7a1b3a7beb

TBR=marja@chromium.org,vogelheim@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2614433002
Cr-Commit-Position: refs/heads/master@{#42037}
2017-01-03 15:51:44 +00:00
jochen
7a1b3a7beb Use background tasks for the compiler dispatcher
BUG=v8:5215
R=marja@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2606263002
Cr-Commit-Position: refs/heads/master@{#42035}
2017-01-03 15:24:00 +00:00
mythria
d338b94e86 [Interpreter] Ensure that a function is compiled before tiering up to baseline.
When baselining a function using the BaselineFunctionOnNextCall intrinsic, it is
not always ensured that a function is already compiled. Update the
Runtime_BaselineFunctionOnNextCall function to trigger a compile if it is not already
compiled.

BUG=v8:5768

Review-Url: https://codereview.chromium.org/2594543003
Cr-Commit-Position: refs/heads/master@{#42033}
2017-01-03 15:11:32 +00:00
marja
a8a45d875f Various IWYU fixes.
(Missing includes discovered during the objects.h splitting work.)

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2610643002
Cr-Commit-Position: refs/heads/master@{#42029}
2017-01-03 13:16:59 +00:00
jochen
1795343f3c Add support for idle tasks to the default platform
BUG=

Review-Url: https://codereview.chromium.org/2609833003
Cr-Commit-Position: refs/heads/master@{#42022}
2017-01-03 08:41:40 +00:00
bmeurer
589ecbfa85 [turbofan] Utilize maps from field type tracking to eliminate map checks.
Hook up TurboFan with the existing field type tracking machinery to
eliminate redundant map checks on the results of LoadField operators.
The store side is already implemented in TurboFan for quite some time,
this just adds the load part.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2604393002
Cr-Commit-Position: refs/heads/master@{#42015}
2017-01-02 19:07:28 +00:00
caitp
4f95a1eb5f [promises] port NewPromiseCapability to TF
- Adds CodeAssembler::ConstructJS() to simplify calling JS functions as
constructors, used by NewPromiseCapability()
- Defines PromiseCapability as a special JSObject subclass, with a
non-exensible Map, and read-only non-configurable DataDescriptors which
point to its in-object fields. This allows its fields to be used by JS
builtins until there is no longer any need.

Currently, the performance benefit comes from
https://codereview.chromium.org/2567033003/, but does not appear to
regress performance in any significant way.

BUG=v8:5343
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2567333002
Cr-Commit-Position: refs/heads/master@{#42014}
2017-01-02 17:22:30 +00:00
mlippautz
5622bc15f1 Reland of "[heap] Report wrappers after processing the marking deque incrementally"
We need to report cached wrappers within v8 to the embedder after each atomic
phase of v8 marking because the embedder can invalidate the wrappers in-between
v8 marking steps.

E.g., in Chrome, a conservative GC might need to wipe dead wrappables from
the wrapper tracing marking deque.

BUG=chromium:676700, chromium:468240

Review-Url: https://codereview.chromium.org/2610563002
Cr-Commit-Position: refs/heads/master@{#42011}
2017-01-02 13:06:11 +00:00
jochen
09cb6efd58 Reland "Disable the CompilerDispatcher if we don't have idle time"
Original issue's description:
> Disable the CompilerDispatcher if we don't have idle time
>
> Since we can't do all steps on background threads, we need idle time to
> work
>
> BUG=v8:5215
> R=danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2600743002
> Cr-Commit-Position: refs/heads/master@{#41944}
> Committed: https://chromium.googlesource.com/v8/v8/+/a0d9eb346bba90aa0b32a
2d3184cbbfd6adb243e

BUG=v8:5215

Review-Url: https://codereview.chromium.org/2606233002
Cr-Commit-Position: refs/heads/master@{#42009}
2017-01-02 12:59:07 +00:00
bmeurer
b617335623 [turbofan] Use InternalizedString feedback abstract/strict equality comparisons.
Add machinery to Ignition and TurboFan to collect and consume
InternalizedString feedback for abstract and strict equality
comparisons. Here we can turn the comparison into a simple
pointer equality check.

R=jarin@chromium.org
BUG=v8:5786

Review-Url: https://codereview.chromium.org/2609013002
Cr-Commit-Position: refs/heads/master@{#42008}
2017-01-02 11:58:01 +00:00
jochen
4246200c4c Remove old debug code from compiler-dispatcher-job-unittest
R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2606223002
Cr-Commit-Position: refs/heads/master@{#42007}
2017-01-02 11:56:50 +00:00
neis
c5d75a381f [test] Add more maybe-assigned tests for parameters.
R=marja@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2580833005
Cr-Commit-Position: refs/heads/master@{#42006}
2017-01-02 11:25:26 +00:00
bmeurer
380a0207db [crankshaft] Don't bailout on uninitialized access to arguments object.
When Crankshaft compiles a keyed load to arguments, it disabled
optimization unless the KEYED_LOAD_IC for the access was monomorphic.
But that's too restrictive, since it will also disable optimization
for this function when the access is on a path that was never executed
so far.

This was spotted in the Node.js core function EventEmitter.prototype.emit,
which was no longer optimizable with Crankshaft using latest V8.

R=jarin@chromium.org
BUG=v8:5790

Review-Url: https://codereview.chromium.org/2607303002
Cr-Commit-Position: refs/heads/master@{#42005}
2017-01-02 06:52:04 +00:00
ulan
b00fc8be8a Use std::deque for storing edges and children in heap snapshot.
This patch fixes OOM crash that happens for large heap where
the total size of edges exceeds 2GB, which is the hard limit
for v8::internal::List allocated using tcmalloc.

BUG=chromium:675911

Review-Url: https://codereview.chromium.org/2595003002
Cr-Commit-Position: refs/heads/master@{#42004}
2016-12-30 16:27:15 +00:00
mvstanton
b211993740 [builtins] Move LoadGlobalICStub to builtins
Following in the footsteps of the other load/store ICs.

R=epertoso@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2608893002
Cr-Commit-Position: refs/heads/master@{#42002}
2016-12-30 13:37:08 +00:00
mvstanton
92d8d95575 [builtins] Move several CodeStub-based ICs to builtins
This CL is from danno@chromium.org. Moves code stubs

LoadIC
KeyedLoadICTF
StoreIC
KeyedStoreICTF
LoadICTrampoline
KeyedLoadICTrampolineTF
StoreICTrampoline
KeyedStoreICTrampolineTF

into builtins.

TBR Yang for serializer changes.

R=epertoso@chromium.org
TBR=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2608883002
Cr-Commit-Position: refs/heads/master@{#42001}
2016-12-30 10:31:01 +00:00
gsathya
2d46f50771 [promsies] Verify status field is a smi
R=adamk@chromium.org
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2608843002
Cr-Commit-Position: refs/heads/master@{#41997}
2016-12-30 01:50:47 +00:00
gsathya
5668ce3987 [promises] Remove deferred object
This patch stores the promise, resolve, reject properties of the
deferred object created by CreateInternalPromiseCapability and
NewPromiseCapability directly on the promise (if the promise hasn't
been fulfilled), otherwise they are stored on the
PromiseReactionJobInfo.

This patch removes the currently unused
CreateInternalPromiseCapability and inlines the call to create the
deferred promise object.

NewPromiseCapability is the only function that works with a deferred.

This patch results in a 8.5% improvement in benchmarks over 5 runs.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2590563003
Cr-Commit-Position: refs/heads/master@{#41991}
2016-12-29 20:30:28 +00:00
gsathya
df179704ff [promisehook] Fire init hook for promise subclass
Add test as well.
Add regression test for passing uninitialized promises to init hook

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2578173004
Cr-Commit-Position: refs/heads/master@{#41982}
2016-12-28 19:31:24 +00:00
danno
743b89768c [csa] Re-introduce automatic constant folding for IntPtrAdd and IntPtrSub
R=ishell@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2608433003
Cr-Commit-Position: refs/heads/master@{#41977}
2016-12-28 16:59:03 +00:00
ishell
d083833499 [turbofan] Remove virtual methods from CodeAssembler.
... and add explicit CallPrologue/CallEpilogue callbacks to CodeAssemblerState instead.
This will allow IntepreterAssembler to use any other helper assembler.

TBR=rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2600183004
Cr-Commit-Position: refs/heads/master@{#41973}
2016-12-28 15:47:34 +00:00
littledan
2c3fda910d test262 roll
Review-Url: https://codereview.chromium.org/2595403002
Cr-Commit-Position: refs/heads/master@{#41965}
2016-12-27 20:32:27 +00:00
adamk
24547376a9 Fix SealHandleScope usage in runtime-classes.cc
R=gsathya@chromium.org
BUG=v8:5783

Review-Url: https://codereview.chromium.org/2603783003
Cr-Commit-Position: refs/heads/master@{#41963}
2016-12-27 18:55:16 +00:00
adamk
23019c4ec0 Object.prototype.toString must reflect mutated @@toStringTag values for primitives
The TF version of this operation was missing a ToObject coercion, so failed to do
@@toStringTag lookups when passed primitive values.

R=franzih@chromium.org
BUG=v8:5780

Review-Url: https://codereview.chromium.org/2597323002
Cr-Commit-Position: refs/heads/master@{#41961}
2016-12-27 17:57:38 +00:00
bakkot
bf9e013bbc [counters] Add UseCounters for 'f() = 0' syntax
This syntax was formerly legal per ECMAScript, but has been a
SyntaxError for some time now. V8 deviates from spec in that it
is instead a runtime error; we'd like to know if we can get
away with removing it (at least in sloppy mode) or if the spec
should be changed.

c.f. https://github.com/tc39/ecma262/issues/257#issuecomment-195106880

Also add self to authors file

BUG=v8:4480

Review-Url: https://codereview.chromium.org/2599253002
Cr-Commit-Position: refs/heads/master@{#41960}
2016-12-27 17:48:40 +00:00
littledan
e0359c3629 [intl] Create the Intl constructors to C++
This patch moves the creation of the Intl constructors from JavaScript
to C++ in bootstrapper.cc, to match all of the other builtins exposed
to the web.

BUG=v8:5751

Review-Url: https://codereview.chromium.org/2586763002
Cr-Commit-Position: refs/heads/master@{#41959}
2016-12-27 17:10:00 +00:00
littledan
d20c23cd13 Revert of [intl] Remove redundant type checking system (patchset #3 id:40001 of https://codereview.chromium.org/2591203002/ )
Reason for revert:
Issue https://bugs.chromium.org/p/chromium/issues/detail?id=677055 . I'll send out a follow-on reland, as it should still be possible to eliminate the redundant type system.

Original issue's description:
> [intl] Remove redundant type checking system
>
> Previously, the Intl implementation tracked types two ways:
>  - In the intl_initialized_marker_symbol
>  - In various named properties of the intl_impl_object_symbol value
>
> As far as I can tell, these will never disagree with each other,
> modulo bugs in Intl itself. This patch removes the second type
> checking system.
>
> BUG=v8:5751
>
> Review-Url: https://codereview.chromium.org/2591203002
> Cr-Commit-Position: refs/heads/master@{#41941}
> Committed: 0d5561b64d

TBR=yangguo@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5751

Review-Url: https://codereview.chromium.org/2601783002
Cr-Commit-Position: refs/heads/master@{#41958}
2016-12-27 15:31:07 +00:00
ulan
d6c66dbce6 [heap] New API for increasing the heap limit for debugging.
BUG=chromium:675911

Review-Url: https://codereview.chromium.org/2593043002
Cr-Commit-Position: refs/heads/master@{#41957}
2016-12-27 13:29:58 +00:00
machenbach
061a3a152c Revert of [heap] Report wrappers after processing the marking deque incrementally (patchset #5 id:80001 of https://codereview.chromium.org/2604583002/ )
Reason for revert:
Speculative revert. Might block the roll:
https://codereview.chromium.org/2606503002/

The gpu bots crash with this stack top:v88internal18IncrementalMarking25AdvanceIncrementalMarkingEdNS1_16CompletionActionENS1_21ForceCompletionActionENS0_10StepOrigin

Original issue's description:
> [heap] Report wrappers after processing the marking deque incrementally
>
> BUG=chromium:676700, chromium:468240
>
> Review-Url: https://codereview.chromium.org/2604583002
> Cr-Commit-Position: refs/heads/master@{#41946}
> Committed: 1344e3a9ca

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:676700, chromium:468240

Review-Url: https://codereview.chromium.org/2604673002
Cr-Commit-Position: refs/heads/master@{#41951}
2016-12-24 12:07:32 +00:00
machenbach
26325f0c8d Revert of Disable the CompilerDispatcher if we don't have idle time (patchset #1 id:1 of https://codereview.chromium.org/2600743002/ )
Reason for revert:
[Sheriff] Speculative revert since we got persistent timeouts on win32 debug:
https://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20debug/builds/6417

Please reland if it doesn't help.

Original issue's description:
> Disable the CompilerDispatcher if we don't have idle time
>
> Since we can't do all steps on background threads, we need idle time to
> work
>
> BUG=v8:5215
> R=danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2600743002
> Cr-Commit-Position: refs/heads/master@{#41944}
> Committed: a0d9eb346b

TBR=danno@chromium.org,jochen@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5215

Review-Url: https://codereview.chromium.org/2600773002
Cr-Commit-Position: refs/heads/master@{#41948}
2016-12-23 19:03:48 +00:00
mlippautz
1344e3a9ca [heap] Report wrappers after processing the marking deque incrementally
BUG=chromium:676700, chromium:468240

Review-Url: https://codereview.chromium.org/2604583002
Cr-Commit-Position: refs/heads/master@{#41946}
2016-12-23 17:11:42 +00:00
littledan
8c1397e4a0 [intl] Fix build for noi18n mode
Fix issue created by patch https://codereview.chromium.org/2582993002/

CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_noi18n_rel_ng
TBR=yangguo@chromium.org
BUG=v8:4360

Review-Url: https://codereview.chromium.org/2599973002
Cr-Commit-Position: refs/heads/master@{#41945}
2016-12-23 17:10:30 +00:00
jochen
a0d9eb346b Disable the CompilerDispatcher if we don't have idle time
Since we can't do all steps on background threads, we need idle time to
work

BUG=v8:5215
R=danno@chromium.org

Review-Url: https://codereview.chromium.org/2600743002
Cr-Commit-Position: refs/heads/master@{#41944}
2016-12-23 15:11:15 +00:00
littledan
b0a09d7809 [intl] Add new semantics + compat fallback to Intl constructor
ECMA 402 v2 made Intl constructors more strict in terms of how they would
initialize objects, refusing to initialize objects which have already
been constructed. However, when Chrome tried to ship these semantics,
we ran into web compatibility issues.

This patch tries to square the circle and implement the simpler v2 object
semantics while including a compatibility workaround to allow objects to
sort of be initialized later, storing the real underlying Intl object
in a symbol-named property.

The new semantics are described in this PR against the ECMA 402 spec:
https://github.com/tc39/ecma402/pull/84

BUG=v8:4360, v8:4870
LOG=Y

Review-Url: https://codereview.chromium.org/2582993002
Cr-Commit-Position: refs/heads/master@{#41943}
2016-12-23 14:32:16 +00:00
jarin
e92118bbc2 [turbofan] Optimize store to typed arrays only if the value is plain primitive.
BUG=v8:5756

Review-Url: https://codereview.chromium.org/2596843002
Cr-Commit-Position: refs/heads/master@{#41942}
2016-12-23 14:29:00 +00:00
littledan
0d5561b64d [intl] Remove redundant type checking system
Previously, the Intl implementation tracked types two ways:
 - In the intl_initialized_marker_symbol
 - In various named properties of the intl_impl_object_symbol value

As far as I can tell, these will never disagree with each other,
modulo bugs in Intl itself. This patch removes the second type
checking system.

BUG=v8:5751

Review-Url: https://codereview.chromium.org/2591203002
Cr-Commit-Position: refs/heads/master@{#41941}
2016-12-23 14:23:21 +00:00
ivica.bogosavljevic
c42bbec953 MIPS: Reland of Fix bad RegisterConfiguration usage in InstructionSequence unit tests
Reland 0cf5623220

The original patch got reverted because testing RegisterConfiguration was
overwritten by turbofan RegisterConfiguration. This caused some test cases not being
properly tested. The new patch uses correct RegisterConfiguration.

Original commit message:
Test InstructionSequenceTest has been initialized with a testing RegisterConfiguration
instance defined in instruction-sequence-unittest.h, whereas class ExplicitOperand which
is being tested used RegisterConfiguration from instruction.cc. In case these two
instances are different, the tests would fail. The issue is fixed by using the same
instance of RegisterConfiguration both for test code and code under test.

Additionally, the tests in register-allocator-unittest.cc use hardcoded values
for register and begin failing is the hardcoded register is not available for
allocation. Fix by forcing the use of allocatable registers only.

TEST=unittests.MoveOptimizerTest.RemovesRedundantExplicit,unittests.RegisterAllocatorTest.SpillPhi
BUG=

Review-Url: https://codereview.chromium.org/2595293002
Cr-Commit-Position: refs/heads/master@{#41938}
2016-12-23 10:51:08 +00:00
yangguo
f85678159d Revert of [debugger] deprecate v8::Debug:GetDebugContext. (patchset #2 id:20001 of https://codereview.chromium.org/2589203002/ )
Reason for revert:
crbug/676749

Original issue's description:
> [debugger] deprecate v8::Debug:GetDebugContext.
>
> R=jgruber@chromium.org
> BUG=v8:5530
>
> Review-Url: https://codereview.chromium.org/2589203002
> Cr-Commit-Position: refs/heads/master@{#41911}
> Committed: 381082168d

TBR=jgruber@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5530, chromium:676749

Review-Url: https://codereview.chromium.org/2595413003
Cr-Commit-Position: refs/heads/master@{#41935}
2016-12-23 09:15:15 +00:00
wez
b344f930c8 Suppress symbol import warning from linker when building cctest.exe
Ignoring this linker warning will enable Chromium builds to start
treating all linker warnings as errors in Windows builds.

BUG=676417, 659007

Review-Url: https://codereview.chromium.org/2594013004
Cr-Commit-Position: refs/heads/master@{#41931}
2016-12-22 19:33:00 +00:00
adamk
57e8acbbb3 Align __lookupGetter__/__lookupSetter__ behavior with the spec
These methods now return undefined upon finding a data property in the
prototype chain which shadows an accessor property, and when hitting
a Proxy, call the appropriate proxy traps.

R=cbruni@chromium.org, littledan@chromium.org
BUG=v8:5130

Review-Url: https://codereview.chromium.org/2592013003
Cr-Commit-Position: refs/heads/master@{#41929}
2016-12-22 19:24:47 +00:00
adamk
207214b604 Revert of Turn on icu_case_mapping by default (patchset #4 id:60001 of https://codereview.chromium.org/2588963002/ )
Reason for revert:
Causes crashes on Canary: crbug.com/676643

Original issue's description:
> Turn on icu_case_mapping by default
>
> Update string-capitalize expected result because now it
> passes all the tests in the file.
> Mark fast/js/string-capitalization as failing with no_i18n.
>
> Relanding after revert because the failure was taken care of
> by Adam's CL at https://codereview.chromium.org/2597543002 .
>
>
> BUG=v8:4477, v8:4476
> TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*,
>      mjsunit/string-case, intl/general/case*
>
> Cr-Original-Commit-Position: refs/heads/master@{#41834}
> Committed: 7c79e23c34
> Review-Url: https://codereview.chromium.org/2588963002
> Cr-Commit-Position: refs/heads/master@{#41883}
> Committed: a42c8c67de

TBR=littledan@chromium.org,yangguo@chromium.org,jshin@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:4477, v8:4476, chromium:676643

Review-Url: https://codereview.chromium.org/2601553002
Cr-Commit-Position: refs/heads/master@{#41928}
2016-12-22 18:29:15 +00:00
bbudge
0f12793f69 [WASM] Skip failing F32x4 tests on ARM.
LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2589283002
Cr-Commit-Position: refs/heads/master@{#41925}
2016-12-22 16:05:05 +00:00
cbruni
f73973092c [ic] Always use generic ICs for growing element stores on arguments
In certain corner-cases we would grow a FAST_ELEMENTS packed backing store of a
JS_ARGUMENTS_TYPE object without converting to holey elements kinds. As a side
effect you could then read out the_hole.

BUG=v8:5772

Review-Url: https://codereview.chromium.org/2597013004
Cr-Commit-Position: refs/heads/master@{#41921}
2016-12-22 14:10:51 +00:00
hablich
aa8a208a47 Revert of [TypeFeedbackVector] Root literal arrays in function literals slots (patchset #11 id:370001 of https://codereview.chromium.org/2504153002/ )
Reason for revert:
Speculative revert because of blocked roll: https://codereview.chromium.org/2596013002/

Original issue's description:
> [TypeFeedbackVector] Root literal arrays in function literals slots
>
> Literal arrays and feedback vectors for a function can be garbage
> collected if we don't have a rooted closure for the function, which
> happens often. It's expensive to come back from this (recreating
> boilerplates and gathering feedback again), and the cost is
> disproportionate if the function was inlined into optimized code.
>
> To guard against losing these arrays when we need them, we'll now
> create literal arrays when creating the feedback vector for the outer
> closure, and root them strongly in that vector.
>
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2504153002
> Cr-Commit-Position: refs/heads/master@{#41893}
> Committed: 93df094081

TBR=bmeurer@chromium.org,mlippautz@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2597163002
Cr-Commit-Position: refs/heads/master@{#41917}
2016-12-22 10:26:36 +00:00
dusan.simicic
cc77bd8234 MIPS: Fix improper use of odd FP reg on mips32r6
Odd numbered floating-point register shouldn't be used as compare register
on mips32r6 architecture. In case cpu switches to FRE mode, writes to odd
numbered single-precision fp register will update upper part of even
double-precision register, which will corrupt the even register.

BUG=

Review-Url: https://codereview.chromium.org/2591063003
Cr-Commit-Position: refs/heads/master@{#41916}
2016-12-22 10:06:18 +00:00
hablich
1e994192d6 Revert of [regexp] Remove IsRegExp intrinsic (patchset #1 id:1 of https://codereview.chromium.org/2591923003/ )
Reason for revert:
speculative revert: https://codereview.chromium.org/2596013002/

Original issue's description:
> [regexp] Remove IsRegExp intrinsic
>
> The two remaining uses of this intrinsic in debug.js and mirrors.js now
> simply rely on the runtime function.
>
> BUG=v8:5339
>
> Review-Url: https://codereview.chromium.org/2591923003
> Cr-Commit-Position: refs/heads/master@{#41892}
> Committed: c9cb94a06f

TBR=bmeurer@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2592383002
Cr-Commit-Position: refs/heads/master@{#41915}
2016-12-22 09:39:37 +00:00
yangguo
381082168d [debugger] deprecate v8::Debug:GetDebugContext.
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2589203002
Cr-Commit-Position: refs/heads/master@{#41911}
2016-12-22 07:04:01 +00:00
yangguo
546152e754 Fix DoubleToRadixCString wrt Number.MIN_VALUE.
R=bmeurer@chromium.org
BUG=v8:5767

Review-Url: https://codereview.chromium.org/2599693002
Cr-Commit-Position: refs/heads/master@{#41910}
2016-12-22 06:57:01 +00:00
gsathya
2041c50402 [promises] Move Promise.prototype.catch to TF
This patch also refactors most of PromiseThen into InternalPromiseThen to
be reused with PromiseCatch and also changes InternalResolvePromise to
return and not branch.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2596553002
Cr-Commit-Position: refs/heads/master@{#41902}
2016-12-21 18:12:09 +00:00
caitp
3d6a477bd0 [cctest] print name instead of context index for CallJSRuntime
Change bytecode-expectations-printer.cc in the cctest application so
that intrinsic function names are printed rather than their native
context index.

This minimizes the amount of unnecessary changes to the bytecode
expectations that need to happen whenever the context fields are
changed.

BUG=v8:5769
R=neis@chromium.org, rmcilroy@chromium.org, adamk@chromium.org

Review-Url: https://codereview.chromium.org/2593823002
Cr-Commit-Position: refs/heads/master@{#41900}
2016-12-21 16:41:11 +00:00
ishell
7cd573f439 [runtime] Remove specific Descriptor subclasses and add respective factory methods instead.
This is a preliminary step for constant tracking.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2595893002
Cr-Commit-Position: refs/heads/master@{#41899}
2016-12-21 16:40:00 +00:00
bbudge
7a6138ae11 [WASM] Skip SIMD test values that may result in denormalized numbers.
On ARM Neon at least, denormals flush to zero, which may not match
regular FP behavior.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2598583002
Cr-Commit-Position: refs/heads/master@{#41895}
2016-12-21 15:31:42 +00:00
mvstanton
93df094081 [TypeFeedbackVector] Root literal arrays in function literals slots
Literal arrays and feedback vectors for a function can be garbage
collected if we don't have a rooted closure for the function, which
happens often. It's expensive to come back from this (recreating
boilerplates and gathering feedback again), and the cost is
disproportionate if the function was inlined into optimized code.

To guard against losing these arrays when we need them, we'll now
create literal arrays when creating the feedback vector for the outer
closure, and root them strongly in that vector.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2504153002
Cr-Commit-Position: refs/heads/master@{#41893}
2016-12-21 14:06:29 +00:00
jgruber
c9cb94a06f [regexp] Remove IsRegExp intrinsic
The two remaining uses of this intrinsic in debug.js and mirrors.js now
simply rely on the runtime function.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2591923003
Cr-Commit-Position: refs/heads/master@{#41892}
2016-12-21 13:55:27 +00:00
titzer
55fc5c0c32 [wasm] Rename wasm::LocalType to wasm::ValueType and kAst* to kWasm*
This is more renaming work to comply with the naming in the public
design repository. E.g. types are called "value types" and we no longer
refer to ASTs.

R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2594993002
Cr-Commit-Position: refs/heads/master@{#41891}
2016-12-21 13:43:00 +00:00
titzer
ceb29f7c62 [wasm] Rename ast-decoder.* to function-body-decoder.*
Since WASM is no longer an AST :-(

R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2594973003
Cr-Commit-Position: refs/heads/master@{#41889}
2016-12-21 12:42:06 +00:00
titzer
01c464a5af [wasm] Set JS API names and function lengths appropriately.
R=clemensh@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2590243003
Cr-Commit-Position: refs/heads/master@{#41885}
2016-12-21 09:03:35 +00:00
jshin
a42c8c67de Turn on icu_case_mapping by default
Update string-capitalize expected result because now it
passes all the tests in the file.
Mark fast/js/string-capitalization as failing with no_i18n.

Relanding after revert because the failure was taken care of
by Adam's CL at https://codereview.chromium.org/2597543002 .

BUG=v8:4477, v8:4476
TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*,
     mjsunit/string-case, intl/general/case*

Cr-Original-Commit-Position: refs/heads/master@{#41834}
Committed: 7c79e23c34
Review-Url: https://codereview.chromium.org/2588963002
Cr-Commit-Position: refs/heads/master@{#41883}
2016-12-21 06:48:47 +00:00
adamk
b0c05f4ab3 [test] Avoid stack space exhaustion in test by passing --no-lazy
The test depends on tricky stack space requirements, so it stopped
working in some configurations win FLAG_min_preparse_length was removed
in commit 4a5b7e32c4.

As a workaround, pass --no-lazy until the test can be refined to work
on all configurations.

BUG=v8:5729
TBR=marja@chromium.org

Review-Url: https://codereview.chromium.org/2596673002
Cr-Commit-Position: refs/heads/master@{#41878}
2016-12-21 00:08:46 +00:00
Adam Klein
75586d3d9b Skip regress-trap-allocation-memento in gc_stress
This test requires its objects to live in new space, so running it
through gc stress runs just makes it susceptible to flakiness, as
was recently seen when turning on the --harmony-string-padding
flag (which just adds an extra JS file to the bootstrapper sequence).

TBR=ishell@chromium.org, jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2597543002 .
Cr-Commit-Position: refs/heads/master@{#41876}
2016-12-20 23:09:16 +00:00
bbudge
5354e28c8d [Turbofan] Add native ARM support for Simd Float32x4 operations.
- Adds Float32x4 Abs, Neg, Equal, NotEqual.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2594683002
Cr-Commit-Position: refs/heads/master@{#41870}
2016-12-20 16:49:53 +00:00
littledan
53fdf9d192 Use a different map to distinguish eval contexts
eval() may introduce a scope which needs to be represented as a context at
runtime, e.g.,

  eval('var x; let y; ()=>y')

introduces a variable y which needs to have a context allocated for it. However,
when traversing upwards to find the declaration context for a variable which leaks,
as the declaration of x does above, this context has to be understood to not be
a declaration context in sloppy mode.

This patch makes that distinction by introducing a different map for eval-introduced
contexts. A dynamic search for the appropriate context will continue past an eval
context to find the appropriate context. Marking contexts as eval contexts rather
than function contexts required updates in each compiler backend.

BUG=v8:5295, chromium:648719

Review-Url: https://codereview.chromium.org/2435023002
Cr-Commit-Position: refs/heads/master@{#41869}
2016-12-20 16:23:19 +00:00
bmeurer
3d9c77d812 [es6] Fix the %TypedArray% constructor.
The %TypedArray% constructor must not ever try to construct an instance,
but rather throw a TypeError instead.

R=jarin@chromium.org
BUG=v8:5763

Review-Url: https://codereview.chromium.org/2587413002
Cr-Commit-Position: refs/heads/master@{#41868}
2016-12-20 16:14:08 +00:00
littledan
b88d96c73a [intl] Remove new.target check in Intl functions and method
The Intl implementation included manual checks to see if they were
being called as a constructor. However, these checks are redundant,
as %FunctionRemovePrototype has already marked the functions as
un-constructable. This path removes the unnecessary checks.

R=yangguo

Review-Url: https://codereview.chromium.org/2587713002
Cr-Commit-Position: refs/heads/master@{#41867}
2016-12-20 16:06:19 +00:00
titzer
6e8338865a [wasm] Implement correct 2-level namespace for imports.
R=clemensh@chromium.org
CC=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2591753002
Cr-Commit-Position: refs/heads/master@{#41866}
2016-12-20 15:32:56 +00:00
jyan
2d7f1c2c55 s390: clean up RR/RRE/RRD/RIL format in Assembler
R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2589063002
Cr-Commit-Position: refs/heads/master@{#41864}
2016-12-20 15:03:49 +00:00
clemensh
081ac37048 [wasm] Introduce WasmSharedModuleData and refactor other objects
The new object will hold information which is shared by all clones of a
WasmCompiledModule, e.g. the decoded asm.js offset table, and in the
future also breakpoints. From there, we can set them on each new
instantiation of any clone.

While already changing lots of the code base, I also renamed all
getters from "get_foo" to "foo", to conform to the style guide.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:5732

Review-Url: https://codereview.chromium.org/2591653002
Cr-Commit-Position: refs/heads/master@{#41862}
2016-12-20 14:34:07 +00:00
jgruber
9feefafa66 [js-perf-test] Add a basic async-await microbenchmark
These benchmarks are intended to compare the overhead of async-await vs.
a naive promise implementation vs. the babel async-await transformation.
The functions in the benchmark don't do any work themselves, so results
should reflect only overhead of the chosen implementation.

Current numbers on my local machine (higher is better):

BaselineES2017-AsyncAwait(Score): 2006
BaselineNaivePromises-AsyncAwait(Score): 7470
Native-AsyncAwait(Score): 3640

BUG=v8:5639

Review-Url: https://codereview.chromium.org/2577393002
Cr-Commit-Position: refs/heads/master@{#41860}
2016-12-20 13:10:07 +00:00
bbudge
e54e2dd916 [ARM] Add fp version of vceq to assembler, disassembler, and simulator.
LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2593443002
Cr-Commit-Position: refs/heads/master@{#41859}
2016-12-20 13:06:58 +00:00
cbruni
c1402cbde3 [builtins] Fix String.prototype.indexOf with negative positions
BUG=chromium:674889

Review-Url: https://codereview.chromium.org/2593593002
Cr-Commit-Position: refs/heads/master@{#41858}
2016-12-20 12:40:57 +00:00
yangguo
28432588c2 [api] add API for Promise status and result.
Currently, to find out a Promise's status and result, one has to use the
debug context. This is for example done in Node.js. This new API is a
better replacement, also in the context of the debug context being
deprecated eventually.

R=franzih@chromium.org, gsathya@chromium.org, jochen@chromium.org
BUG=v8:5764

Review-Url: https://codereview.chromium.org/2589113002
Cr-Commit-Position: refs/heads/master@{#41855}
2016-12-20 12:13:29 +00:00
leszeks
73afbaa8c1 [tests] Fix test-api for non-optimizing ignition-staging runs
BUG=v8:5762

Review-Url: https://codereview.chromium.org/2590843002
Cr-Commit-Position: refs/heads/master@{#41852}
2016-12-20 11:47:31 +00:00
clemensh
6361f133ab [wasm] Add iterators for opcodes or offsets of one function
We have the BytecodeIterator with next() and has_next() methods, and
pc_offset() and current() accessors.
This CL adds an interface to iterate over the opcodes or offsets in a
C++ foreach loop.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2587143002
Cr-Commit-Position: refs/heads/master@{#41851}
2016-12-20 11:28:44 +00:00
titzer
e797e0ea6d [wasm] Add test for reexport of the same import twice.
R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2592563003
Cr-Commit-Position: refs/heads/master@{#41850}
2016-12-20 10:43:54 +00:00
titzer
cbd3b3d0fe Implement header size calculation for array iterators.
R=bmeurer@chromium.org
BUG=chromium:674232

Review-Url: https://codereview.chromium.org/2592633002
Cr-Commit-Position: refs/heads/master@{#41849}
2016-12-20 10:38:17 +00:00
tebbi
abd63018d7 [turbofan] fixed escape analysis bug: missing copy of virtual state
R=jarin@chromium.org

BUG=chromium:673243

Review-Url: https://codereview.chromium.org/2578133002
Cr-Commit-Position: refs/heads/master@{#41848}
2016-12-20 10:30:52 +00:00
ishell
faf80b4ec0 [crankshaft] Ensure that we use inlined Array.prototype.shift only when there's no elements in the prototype chain.
BUG=chromium:663340

Review-Url: https://codereview.chromium.org/2593553002
Cr-Commit-Position: refs/heads/master@{#41846}
2016-12-20 10:18:02 +00:00
ishell
576a46f520 [crankshaft] Properly handle OOB string accesses.
BUG=chromium:665793

Review-Url: https://codereview.chromium.org/2589823003
Cr-Commit-Position: refs/heads/master@{#41842}
2016-12-20 10:01:59 +00:00
mlippautz
119db080c5 [heap] Fix unittest compilation on mips
BUG=
TBR=hpayer@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/2587363002
Cr-Commit-Position: refs/heads/master@{#41841}
2016-12-20 09:56:39 +00:00
mlippautz
17318bbd39 [heap] Create a thin wrapper around wrapper tracing in V8 to avoid misuse
BUG=chromium:468240

Review-Url: https://codereview.chromium.org/2576453002
Cr-Commit-Position: refs/heads/master@{#41837}
2016-12-20 09:35:05 +00:00
machenbach
f6d8ec4fca Revert of Turn on icu_case_mapping by default (patchset #3 id:40001 of https://codereview.chromium.org/2588963002/ )
Reason for revert:
Causes gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/9920

Original issue's description:
> Turn on icu_case_mapping by default
>
> BUG=v8:4477, v8:4476
> TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*,
>      mjsunit/string-case, intl/general/case*
>
> Review-Url: https://codereview.chromium.org/2588963002
> Cr-Commit-Position: refs/heads/master@{#41834}
> Committed: 7c79e23c34

TBR=littledan@chromium.org,yangguo@chromium.org,jshin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4477, v8:4476

Review-Url: https://codereview.chromium.org/2593543002
Cr-Commit-Position: refs/heads/master@{#41835}
2016-12-20 09:28:35 +00:00
jshin
7c79e23c34 Turn on icu_case_mapping by default
BUG=v8:4477, v8:4476
TEST=test262/{built-ins,intl402}/Strings/*, webkit/fast/js/*,
     mjsunit/string-case, intl/general/case*

Review-Url: https://codereview.chromium.org/2588963002
Cr-Commit-Position: refs/heads/master@{#41834}
2016-12-20 09:00:50 +00:00
yangguo
a141898108 [debugger] sunset --expose-debug-as flag.
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2589083002
Cr-Commit-Position: refs/heads/master@{#41832}
2016-12-20 07:45:48 +00:00
bbudge
0625a686b5 [Turbofan] Add native ARM support for basic SIMD 32x4 operations.
- Adds Float32x4 ExtractLane, ReplaceLane, Splat, Add, Sub,
and conversions to Int32x4 and Uint32x4.
- Adds Int32x4 ExtractLane, ReplaceLane, Splat, Add, Sub and
conversions to Float32x4 (int and unsigned int).
- Adds Int32x4 CompareEqual, CompareNotEqual.
- Adds S32x4 Select.
- Adds tests for all new SIMD operations.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2584863002
Cr-Commit-Position: refs/heads/master@{#41828}
2016-12-19 22:23:03 +00:00
gsathya
cc7e0b0eff [promises] Port CreateResolvingFunctions to TF
2% improvement on benchmarks over 5 runs.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2567033003
Cr-Commit-Position: refs/heads/master@{#41827}
2016-12-19 22:21:35 +00:00
littledan
48a36c7df7 [intl] Avoid modifying options bag from constructor
Previously, the Intl.DateTimeFormat constructor and other related paths had
a bug where the options bag passed in would be modified in place. This patch
makes V8's Intl implementation follow the specification's logic to avoid
such a modification.

BUG=v8:4219

Review-Url: https://codereview.chromium.org/2587703002
Cr-Commit-Position: refs/heads/master@{#41826}
2016-12-19 21:36:16 +00:00
clemensh
5cbc4a9674 [wasm] Freeze exports object
We were not conforming to the spec before.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2587913005
Cr-Commit-Position: refs/heads/master@{#41822}
2016-12-19 18:45:07 +00:00
jshin
af38272dd9 Optimize case conversion with icu_case_mapping
Use FastAsciiConvert (as used by Unibrow) for i18n-aware
case conversion with --icu_case_mapping.

Move FastAsciiConvert to src/string-case.cc so that it can be used
by both runtime-{string,i18n}.

Add more tests.

BUG=v8:4477,v8:4476
TEST=intl/general/case*

Review-Url: https://codereview.chromium.org/2533983006
Cr-Commit-Position: refs/heads/master@{#41821}
2016-12-19 18:43:55 +00:00
clemensh
1fef739ab0 [wasm] Implement GetPossibleBreakpoints
This CL implements GetPossibleBreakpoints for wasm, by iterating over
all functions in the requested range and returning the location of all
instructions within that range.

The connection to the inspector will be added later, when setting
breakpoint also works for wasm: http://crrev.com/2536763002

BUG=chromium:613110
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2588763002
Cr-Commit-Position: refs/heads/master@{#41818}
2016-12-19 17:22:55 +00:00
titzer
b6a57e6ff5 [wasm] Add js-api test and fix property details for some functions.
R=clemensh@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2585193004
Cr-Commit-Position: refs/heads/master@{#41817}
2016-12-19 17:19:56 +00:00
gsathya
81f765718e [builtins] move PromiseBuiltinsAssembler to it's own header file
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2585133002
Cr-Commit-Position: refs/heads/master@{#41816}
2016-12-19 17:14:36 +00:00
franzih
86eafdd4c0 Add CreateDataPropertyInLiteralFlags.
Encode the PropertyAttribute and whether the function
names must be set as a flag instead of setting two registers.

BUG=v8:5624

Review-Url: https://codereview.chromium.org/2586463002
Cr-Commit-Position: refs/heads/master@{#41812}
2016-12-19 16:30:36 +00:00
mvstanton
0d4b990497 CompilerDispatcher unittest should use is_compiled() predicate.
BUG=v8:5759
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2588743003
Cr-Commit-Position: refs/heads/master@{#41810}
2016-12-19 15:41:04 +00:00
clemensh
21a85c4a03 [wasm] Always provide a wasm instance object at runtime
When executing wasm code for testing, we did not create a
WasmInstanceObject and link it to the generated code. This required
some special handling at runtime (mainly for stack trace generation).
This CL always provides the WasmInstanceObject, such that e.g. function
names can be resolved the usual way.
The module bytes referenced by the WasmCompiledModule linked with the
WasmInstanceObject do not hold a valid wasm module yet. Instead, we
just add the bytes we need, and make the objects in WasmModule point to
those bytes (currently only used for function names). Those bytes will
not be parsed at runtime anyway.

R=titzer@chromium.org
CC=jgruber@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551053002
Cr-Commit-Position: refs/heads/master@{#41809}
2016-12-19 15:03:13 +00:00
yangguo
d5566b9e77 [inspector] gracefully handle stack overflows in the inspector.
Hopefully we can avoid going through JS at all, so we can avoid this issue.

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5654

Review-Url: https://codereview.chromium.org/2510093002
Cr-Original-Commit-Position: refs/heads/master@{#41802}
Committed: 3ab3b6261a
Review-Url: https://codereview.chromium.org/2510093002
Cr-Commit-Position: refs/heads/master@{#41807}
2016-12-19 14:07:55 +00:00
yangguo
a680b260ed Revert of [inspector] gracefully handle stack overflows in the inspector. (patchset #13 id:240001 of https://codereview.chromium.org/2510093002/ )
Reason for revert:
asan failure: https://build.chromium.org/p/client.v8/builders/V8%20Mac64%20ASAN/builds/10047/steps/Ignition%20-%20turbofan/logs/regress-2318

Original issue's description:
> [inspector] gracefully handle stack overflows in the inspector.
>
> Hopefully we can avoid going through JS at all, so we can avoid this issue.
>
> R=jgruber@chromium.org, kozyatinskiy@chromium.org
> BUG=v8:5654
>
> Review-Url: https://codereview.chromium.org/2510093002
> Cr-Commit-Position: refs/heads/master@{#41802}
> Committed: 3ab3b6261a

TBR=jgruber@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5654

Review-Url: https://codereview.chromium.org/2583173002
Cr-Commit-Position: refs/heads/master@{#41805}
2016-12-19 13:28:10 +00:00
cbruni
c0282f608c Add unittests to keep InstanceType lists in sync
STRUCT_LIST and INSTANCE_TYPE_LIST are now forced to have the same order
as the InstanceType enum.

Drive-by-fix 1: Move type check and cast functions closer together in objects-inl.h

Drive-by-fix 2: Remove unused instance types SIGNATURE_INFO_TYPE and  TYPE_SWITCH_INFO_TYPE.

BUG=

Review-Url: https://codereview.chromium.org/2578573002
Cr-Commit-Position: refs/heads/master@{#41804}
2016-12-19 12:50:30 +00:00
cbruni
99a5aa1b95 [crankshaft] Fix IsClassOfTest helper method
Drive-by-fix: Add AstNode::Print() and improve printing of CallRuntime
              Expression.

BUG=v8:5749

Review-Url: https://codereview.chromium.org/2586933002
Cr-Commit-Position: refs/heads/master@{#41803}
2016-12-19 12:49:21 +00:00
yangguo
3ab3b6261a [inspector] gracefully handle stack overflows in the inspector.
Hopefully we can avoid going through JS at all, so we can avoid this issue.

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5654

Review-Url: https://codereview.chromium.org/2510093002
Cr-Commit-Position: refs/heads/master@{#41802}
2016-12-19 12:24:57 +00:00
cbruni
1c1465f124 [runtime] Add PositiveNumberToUint32 helper to avoid double to uint roundtrip
BUG=

Review-Url: https://codereview.chromium.org/2577143002
Cr-Commit-Position: refs/heads/master@{#41801}
2016-12-19 12:06:58 +00:00
yangguo
8ac9e55aa6 [serializer] fix leak in test.
BUG=chromium:662388
R=cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2582333002
Cr-Commit-Position: refs/heads/master@{#41800}
2016-12-19 12:04:19 +00:00
yangguo
2a19ad3603 Fix memory leak in logging-unittest.
R=cbruni@chromium.org
BUG=chromium:662388

Review-Url: https://codereview.chromium.org/2586203002
Cr-Commit-Position: refs/heads/master@{#41799}
2016-12-19 11:58:28 +00:00
ishell
52702e55aa [turbofan] Avoid allocation of temporary array of Nodes when generating calls.
BUG=

Review-Url: https://codereview.chromium.org/2586903002
Cr-Commit-Position: refs/heads/master@{#41798}
2016-12-19 11:35:42 +00:00
machenbach
81dd9847cf Revert of [crankshaft] Fix IsClassOfTest helper method (patchset #1 id:1 of https://codereview.chromium.org/2586933002/ )
Reason for revert:
Breaks vtune:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20vtunejit/builds/15379

Original issue's description:
> [crankshaft] Fix IsClassOfTest helper method
>
> Drive-by-fix: Add AstNode::Print() and improve printing of CallRuntime
>               Expression.
>
> BUG=v8:5749
>
> Review-Url: https://codereview.chromium.org/2586933002
> Cr-Commit-Position: refs/heads/master@{#41792}
> Committed: d4493222b9

TBR=bmeurer@chromium.org,cbruni@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5749

Review-Url: https://codereview.chromium.org/2587973002
Cr-Commit-Position: refs/heads/master@{#41795}
2016-12-19 11:22:36 +00:00
yangguo
07fa0f4967 [serializer] do not serialize script wrappers.
The scenario here: the asm function fails asm validation,
so we emit a message. In doing so, we create a JSValue wrapper for
the script object that we cache on the script object. This wrapper
is context-dependent and causes the code serializer to choke.

R=mtrofin@chromium.org, titzer@chromium.org
BUG=chromium:674446,chromium:673321

Review-Url: https://codereview.chromium.org/2586943003
Cr-Commit-Position: refs/heads/master@{#41794}
2016-12-19 10:53:02 +00:00
cbruni
d4493222b9 [crankshaft] Fix IsClassOfTest helper method
Drive-by-fix: Add AstNode::Print() and improve printing of CallRuntime
              Expression.

BUG=v8:5749

Review-Url: https://codereview.chromium.org/2586933002
Cr-Commit-Position: refs/heads/master@{#41792}
2016-12-19 10:45:48 +00:00
yangguo
1296dd1f5a [debug-wrapper] remove last uses of --expose-debug-as
The inspector cannot deal with breaking inside of debug-evaluate.
There is therefore no point in supporting that in the debugger.
The optional additional context parameter for debug-evaluate also
can be removed since it's not being used.

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2580323002
Cr-Commit-Position: refs/heads/master@{#41791}
2016-12-19 10:44:34 +00:00
henrique.ferreiro
815f91c0ed [es6] Perform the IsConstructor test in GetSuperConstructor.
This is so that a NotSuperConstructor error is thrown before evaluating the
arguments to the super constructor. Besides updating the runtime function, a
new bytecode GetSuperConstructor is introduced.

BUG=v8:5336

Review-Url: https://codereview.chromium.org/2504553003
Cr-Commit-Position: refs/heads/master@{#41788}
2016-12-19 10:12:22 +00:00
kozyatinskiy
c42915f02d [inspector] introduce limit for amount of stored async stacks
BUG=v8:5738
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2579403002
Cr-Commit-Position: refs/heads/master@{#41783}
2016-12-18 17:04:40 +00:00
bbudge
431223f34f [ARM] Add NEON instructions for implementing SIMD.
- Adds vabs, vneg, vmul, vext, vzip, vrev instructions.
- Adds Swizzle function to macro assembler.
- Simplifies if-else logic in disassembler, simulator, for Neon special.
- Some refactoring of Neon assembler, macro-assembler tests.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2579913002
Cr-Commit-Position: refs/heads/master@{#41781}
2016-12-17 21:56:26 +00:00
mtrofin
9564d803ea Move register allocation unittests and constrain owners
There are subtle test expectations/nuances that are easy to break.

BUG=

Review-Url: https://codereview.chromium.org/2585583006
Cr-Commit-Position: refs/heads/master@{#41778}
2016-12-17 00:24:36 +00:00
mtrofin
8e833623e9 Revert of MIPS: Fix bad RegisterConfiguration usage in InstructionSequence unit tests. (patchset #3 id:40001 of https://codereview.chromium.org/2433093002/ )
Reason for revert:
This change rendered InstructionSequenceTest::SetNumRegs ineffectual, thus
loosening the tests that were using that API to ensure correct register
allocation under intentionally constrained setups.

For the problem stated in this CL, a solution needs to continue supporting the
intentionally set-up test configuration.

Original issue's description:
> MIPS: Fix bad RegisterConfiguration usage in InstructionSequence unit tests.
>
> Test InstructionSequenceTest has been initialized with a testing RegisterConfiguration
> instance defined in instruction-sequence-unittest.h, whereas class ExplicitOperand which
> is being tested used RegisterConfiguration from instruction.cc. In case these two
> instances are different, the tests would fail. The issue is fixed by using the same
> instance of RegisterConfiguration both for test code and code under test.
>
> Additionally, the tests in register-allocator-unittest.cc use hardcoded values
> for register and begin failing is the hardcoded register is not available for
> allocation. Fix by forcing the use of allocatable registers only.
>
> TEST=unittests.MoveOptimizerTest.RemovesRedundantExplicit,unittests.RegisterAllocatorTest.SpillPhi
> BUG=
>
> Committed: https://crrev.com/0cf56232209d4c9c669b8426680de18806f6c29a
> Cr-Commit-Position: refs/heads/master@{#40862}

TBR=dcarney@chromium.org,bmeurer@chromium.org,mstarzinger@chromium.org,vogelheim@chromium.org,titzer@chromium.org,ivica.bogosavljevic@imgtec.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=

Review-Url: https://codereview.chromium.org/2587593002
Cr-Commit-Position: refs/heads/master@{#41777}
2016-12-16 23:09:34 +00:00
gsathya
b1c148b91f [promisehook] Implement PromiseHook
This adds kInit, kResolve, kBefore and kAfter lifecycle hooks to promises.

This also exposes an API to set the PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2575313002
Cr-Commit-Position: refs/heads/master@{#41775}
2016-12-16 19:17:16 +00:00
clemensh
8341b8baf4 [wasm] Fix nondeterministic Win64 failures
E.g.
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/14083/steps/Check/logs/RunWasmCompiledWithTr..

This also reverts CL http://crrev.com/2584833002 which
disabled the tests on windows.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2579213004
Cr-Commit-Position: refs/heads/master@{#41769}
2016-12-16 15:32:09 +00:00
mythria
74ccda64dc [Interpreter] Transform StrictEquality with null/undefined to special bytecodes.
Transform LdaNull/LdaUndefined followed by StrictEquality to TestNull/TestUndefined.
This would avoid a call to the compare IC. In the bytecode-graph builder these are
mapped to StrictEqual javascript operator. When reducing this operator, we already
optimize the cases for null/undefined.

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2554723004
Cr-Commit-Position: refs/heads/master@{#41768}
2016-12-16 15:01:08 +00:00
jochen
692ba84f4f Use idle time to make progress on scheduled compilation jobs
BUG=v8:5215
R=rmcilroy@chromium.org,marja@chromium.org,vogelheim@chromium.org

Review-Url: https://codereview.chromium.org/2573493002
Cr-Commit-Position: refs/heads/master@{#41767}
2016-12-16 14:40:32 +00:00
yangguo
bcb73f6219 [inspector] add scope type for modules.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2568083002
Cr-Commit-Position: refs/heads/master@{#41765}
2016-12-16 14:28:56 +00:00
rossberg
16fe426320 Implement LinkError; import tweaks
- Implement new WebAssembly.LinkError exception
- Implement stricter checks for glboal imports
- Add tests
- Refactor handling of import names
- Add TODOs for empty import names

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2584843002
Cr-Commit-Position: refs/heads/master@{#41764}
2016-12-16 14:23:35 +00:00
clemensh
bb76432fde [wasm] Disable trap-if test on windows for now
It's failing nondeterministically.
Disable trap-if tests on windows until this issue is fixed.

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2584833002
Cr-Commit-Position: refs/heads/master@{#41763}
2016-12-16 14:20:13 +00:00
yangguo
d2d6da0354 [serializer] add test for snapshotting cached accessor property.
R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2582623003
Cr-Commit-Position: refs/heads/master@{#41761}
2016-12-16 13:25:19 +00:00
cbruni
89f159b042 [runtime] Port simple String.prototype.indexOf cases to TF Builtin
Many websites use simple calls to String.prototype.indexOf with either a
one character ASCII needle or needles bigger than the search string. This
CL adds a TFJ builtin for these simple cases, giving up to factor 5 speedup.

Drive-by-fix: Add default Object type to Arguments.at

BUG=

Review-Url: https://codereview.chromium.org/2539093002
Cr-Commit-Position: refs/heads/master@{#41760}
2016-12-16 13:24:07 +00:00
yangguo
55e8c2e4d3 [serializer] allocate global proxy with the expected size.
If a context snapshot includes the global proxy constructor function, we
expect the incoming global proxy to have the correct instance size so
that we can reinitialize it with said constructor. However, when the
bootstrapper allocates a new global proxy, we need to know the expected
size.

We solve this by storing the size on the to-be-serialized isolate.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2585693002
Cr-Commit-Position: refs/heads/master@{#41756}
2016-12-16 12:40:38 +00:00
jochen
87bf033799 Don't compile inner functions when compiling via the dispatcher
BUG=v8:5394
R=mstarzinger@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2579973002
Cr-Commit-Position: refs/heads/master@{#41754}
2016-12-16 12:38:17 +00:00
mstarzinger
92b370ee64 Introduce {ConstantElementsPair} struct for type safety.
This introduces an explicit struct for the communication channel between
the {ArrayLiteral} AST node and the corresponding runtime methods. Those
methods take a pair of {ElementsKind} as well as an array (can either be
a FixedArray or a FixedDoubleArray) of constant values.

For bonus points it also reduces the size of the involved heap object by
one word (i.e. length field of FixedArray not needed anymore).

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2581683003
Cr-Commit-Position: refs/heads/master@{#41752}
2016-12-16 10:57:06 +00:00
rmcilroy
cb9d0fe7f4 [Complier] Only optimize a function marked for tier-up if it is compiled.
When mark-shared-funtion-for-tier-up is enabled, a function could be marked for
optimization, then the baseline (FCG) code is flushed by the GC. The next time
the function is executed, we shouldn't optimize the code if there isn't
baseline code.

BUG=chromium:673242

Review-Url: https://codereview.chromium.org/2575333003
Cr-Commit-Position: refs/heads/master@{#41751}
2016-12-16 10:44:50 +00:00
clemensh
6709edd7f6 [wasm] Make WasmRunner the central test structure
The WasmRunner now always holds a TestingModule, and allows to add
several functions to it. The prepares a change to always run wasm code
with a full module behind it, removing the special handling for "no wasm
instance" at runtime (http://crrev.com/2551053002).
This CL here also templatizes the WasmRunner such that the Call method must
be called with the same signature specified for the WasmRunner. This
already catched several mismatches there.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551043002
Cr-Original-Commit-Position: refs/heads/master@{#41728}
Committed: 2ff5906231
Review-Url: https://codereview.chromium.org/2551043002
Cr-Commit-Position: refs/heads/master@{#41747}
2016-12-16 10:13:11 +00:00
neis
e3ad4f131b [modules] Remove @@iterator on namespace objects.
TC39 decided at their last meeting to remove this feature.

R=adamk@chromium.org
TBR=ulan@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2578053003
Cr-Commit-Position: refs/heads/master@{#41745}
2016-12-16 08:57:29 +00:00
machenbach
6932ea5904 Revert of Disallow passing a SharedArrayBuffer in the transfer list. (patchset #4 id:60001 of https://codereview.chromium.org/2570433005/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/12098

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Disallow passing a SharedArrayBuffer in the transfer list.
>
> This behavior changed recently. SharedArrayBuffers should not be put in the
> transfer list, because they are not detached, and that is the meaning of being
> in the transfer list.
>
> This is the V8 side of the change, the Blink side will come next.
>
> Review-Url: https://codereview.chromium.org/2570433005
> Cr-Commit-Position: refs/heads/master@{#41740}
> Committed: 1c5e1504e0

TBR=jbroman@chromium.org,jkummerow@chromium.org,binji@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2579963002
Cr-Commit-Position: refs/heads/master@{#41744}
2016-12-16 07:34:40 +00:00
binji
1c5e1504e0 Disallow passing a SharedArrayBuffer in the transfer list.
This behavior changed recently. SharedArrayBuffers should not be put in the
transfer list, because they are not detached, and that is the meaning of being
in the transfer list.

This is the V8 side of the change, the Blink side will come next.

Review-Url: https://codereview.chromium.org/2570433005
Cr-Commit-Position: refs/heads/master@{#41740}
2016-12-15 23:55:03 +00:00
bbudge
03f33f2e68 [Turbofan] Add ARM NEON instructions for implementing SIMD.
- Adds NEON instructions to assembler, disassembler, simulator.
- Adds ExtractLane, ReplaceLane functions to macro assembler.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2546933002
Cr-Commit-Position: refs/heads/master@{#41737}
2016-12-15 18:15:23 +00:00
jochen
4f2cb8fe82 Reland of "Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID"
Original CL description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Review-Url: https://codereview.chromium.org/2547483002

BUG=v8:5589
TBR=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2577063002
Cr-Commit-Position: refs/heads/master@{#41734}
2016-12-15 17:19:55 +00:00
clemensh
5993a1161b Revert of [wasm] Make WasmRunner the central test structure (patchset #5 id:80001 of https://codereview.chromium.org/2551043002/ )
Reason for revert:
Win64 dbg failures

Original issue's description:
> [wasm] Make WasmRunner the central test structure
>
> The WasmRunner now always holds a TestingModule, and allows to add
> several functions to it. The prepares a change to always run wasm code
> with a full module behind it, removing the special handling for "no wasm
> instance" at runtime (http://crrev.com/2551053002).
> This CL here also templatizes the WasmRunner such that the Call method must
> be called with the same signature specified for the WasmRunner. This
> already catched several mismatches there.
>
> R=titzer@chromium.org, ahaas@chromium.org
> BUG=v8:5620
>
> Review-Url: https://codereview.chromium.org/2551043002
> Cr-Commit-Position: refs/heads/master@{#41728}
> Committed: 2ff5906231

TBR=ahaas@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2583543002
Cr-Commit-Position: refs/heads/master@{#41732}
2016-12-15 16:51:11 +00:00
neis
7ca7229283 [parsing] Be less pessimistic about maybe_assigned of parameters.
Instead of unconditionally setting maybe_assigned for parameters, treat
parameters like other variables except that at the end we set maybe_assigned if
the function has a sloppy arguments object.

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2578103002
Cr-Commit-Position: refs/heads/master@{#41731}
2016-12-15 16:04:44 +00:00
gsathya
b4aadaec1e [promisehook] Store promise in PromiseReactionJob
This will be used in PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2581503003
Cr-Commit-Position: refs/heads/master@{#41730}
2016-12-15 15:50:54 +00:00
clemensh
2ff5906231 [wasm] Make WasmRunner the central test structure
The WasmRunner now always holds a TestingModule, and allows to add
several functions to it. The prepares a change to always run wasm code
with a full module behind it, removing the special handling for "no wasm
instance" at runtime (http://crrev.com/2551053002).
This CL here also templatizes the WasmRunner such that the Call method must
be called with the same signature specified for the WasmRunner. This
already catched several mismatches there.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551043002
Cr-Commit-Position: refs/heads/master@{#41728}
2016-12-15 15:37:29 +00:00
franzih
0e7a2ca0d7 [runtime] Throw if re-declaring a non-configurable accessor.
If an accessor property is non-configurable, one should not be able
to re-declare it as a function. This specifically applies to special properties like window.location.

BUG=chromium:670596

Review-Url: https://codereview.chromium.org/2582493002
Cr-Commit-Position: refs/heads/master@{#41725}
2016-12-15 14:41:07 +00:00
marja
ed080e6966 Disable lazy parsing inside eval (see bug).
If the eval contains a let, we need to know whether an inner function
refers to the variable to be able to decide its context allocation
status.

The added test needs https://codereview.chromium.org/2435023002/ too
in order to pass.

BUG=v8:5736

Review-Url: https://codereview.chromium.org/2574753002
Cr-Commit-Position: refs/heads/master@{#41723}
2016-12-15 14:26:58 +00:00
ishell
f1441384ff [stubs] Remove CSA::INTEGER_PARAMETERS in favor of CSA::INTPTR_PARAMETERS.
BUG=

Review-Url: https://codereview.chromium.org/2580533002
Cr-Commit-Position: refs/heads/master@{#41722}
2016-12-15 14:01:07 +00:00
ahaas
7bd61b601c [wasm] Introduce the TrapIf and TrapUnless operators to generate trap code.
Some instructions in WebAssembly trap for some inputs, which means that the
execution is terminated and (at least at the moment) a JavaScript exception is
thrown. Examples for traps are out-of-bounds memory accesses, or integer
divisions by zero.

Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
constant), in addition to the trap condition itself. Additionally, each
WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
number of inputs is linear to the number of trap checks in the function.
Especially for functions with high numbers of trap checks we observe a
significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
a TrapIf common operator only a single node is necessary per trap check, in
addition to the trap condition. Also the nodes which are shared between trap
checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
speedup of 30-50% on average.

This CL only implements TrapIf and TrapUnless on x64. The implementation is also
hidden behind the --wasm-trap-if flag.

Please take a special look at how the source position is transfered from the
instruction selector to the code generator, and at the context that is used for
the runtime call.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2562393002
Cr-Commit-Position: refs/heads/master@{#41720}
2016-12-15 13:31:29 +00:00
leszeks
bcb38979f7 [turbofan] Add and use bytecode loop assigment analysis
Adds assignment tracking to the bytecode analysis pass, and updates
bytecode graph builder to only create LoopExitValues for assigned
values.

Review-Url: https://codereview.chromium.org/2558093005
Cr-Commit-Position: refs/heads/master@{#41719}
2016-12-15 13:24:19 +00:00
jarin
01de216fd7 [turbofan] Handle the impossible value representation mismatch in instruction selector.
Review-Url: https://codereview.chromium.org/2579743002
Cr-Commit-Position: refs/heads/master@{#41718}
2016-12-15 12:13:06 +00:00
ivica.bogosavljevic
ee7281f8ff MIPS[64]: Disable fusion multiple-accumulate instructions
MIPS[64]R6 supports only fusion multiply-accumulate instructions, and using
these causes failures of several tests that expect exact floating-point
results. Therefore we disable fusion multiply-accumulate in both emitted and
compiled code on R6.

TEST=cctest/test-run-machops/RunFloat64MulAndFloat64Add1,mjsunit/es6/math-expm1.js
mjsunit/es6/math-fround.js,mjsunit/compiler/multiply-add.js

BUG=

Review-Url: https://codereview.chromium.org/2569683002
Cr-Commit-Position: refs/heads/master@{#41717}
2016-12-15 11:50:12 +00:00
ishell
b5925c0ad0 [stubs] Enable machine graph verification for CodeStubAssembler and friends by default in debug mode.
BUG=

Review-Url: https://codereview.chromium.org/2570213002
Cr-Commit-Position: refs/heads/master@{#41715}
2016-12-15 11:45:18 +00:00
rmcilroy
ae741d042c [Interpreter] Allocate registers used as call arguments on-demand.
Allocate the registers used as arguments to a call on-demand after visiting the
argument (or reciever). This means that the visited expression can use registers
that would otherwise have been allocated for arguments which haven't been
visited yet.

The reason for doing this is to avoid keeping things live in registers
unecessarily for chained function calls, which avoids a memory leak for
functions which chain a large number of calls with large temporary arguments /
recievers.

BUG=chromium:672027

Review-Url: https://codereview.chromium.org/2557173004
Cr-Commit-Position: refs/heads/master@{#41714}
2016-12-15 10:59:57 +00:00
mstarzinger
6c620e5312 Fix usage of literal cloning for large double arrays.
This fixes a corner case where the {FastCloneShallowArrayStub} was used
for literals that are backed by a double backing store and would exceed
limits for new-space allocations on 32-bit architectures. The stub in
question does not support such literals, callers must use the runtime.
Note that this fix is for Ignition as well as FullCodeGenerator.

R=rmcilroy@chromium.org
TEST=mjsunit/regress/regress-crbug-672792
BUG=chromium:672792

Review-Url: https://codereview.chromium.org/2570843002
Cr-Commit-Position: refs/heads/master@{#41713}
2016-12-15 10:29:47 +00:00
rmcilroy
e27b348d1a [Interpreter] Templatize AccumulatorUsage and OperandType for bytecode creation.
Templatizes the AccumulatorUsage and OperandType for BytecodeNode creation and
BytecodeRegisterOptimizer::PrepareForBytecode. This allows the compiler to
statically know whether the bytecode being created accesses the accumulator
and what operand types need scaling, avoiding runtime checks in the code.

Also removes BytecodeNode::set_bytecode methods.

Review-Url: https://codereview.chromium.org/2542903003
Cr-Commit-Position: refs/heads/master@{#41706}
2016-12-15 07:56:21 +00:00
jgruber
f3b9d570cb [regexp] Let RegExp.prototype.compile return this
ES6 requires the compile method to return this:
www.ecma-international.org/ecma-262/6.0/#sec-regexp.prototype.compile

BUG=v8:5722,chromium:585775

Review-Url: https://codereview.chromium.org/2577653002
Cr-Commit-Position: refs/heads/master@{#41705}
2016-12-15 07:29:39 +00:00
mtrofin
77b50a8e12 [wasm] disable serialization for asm-wasm
Determine if the scope of the function to be serialized includes asm-
wasm, and if so, bypass serialization, since we do not support it in
that scenario.

In this change, we do so regardless of whether the asm-wasm path was
successful. This is so we keep the design simple, since the guidance
to developers, moving forward, is to use wasm.

BUG=643595

Review-Url: https://codereview.chromium.org/2573193002
Cr-Commit-Position: refs/heads/master@{#41704}
2016-12-15 05:06:54 +00:00
titzer
058939ab93 [wasm] Enforce limits for maximums for many WebAssembly binary entities.
This CL moves even more limits to wasm-limits.h and enforces limits for
types, functions, parameter counts, return counts, local counts, imports,
globals, and exports.

R=clemensh@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2574133002
Cr-Commit-Position: refs/heads/master@{#41699}
2016-12-14 17:46:47 +00:00
nikolaos
f39665e360 [parser] Fix bug with non-static name method/property
Without this patch, the tests on lines 410, 414, 418 and 422 in
function testNonStaticName of test/mjsunit/es6/function-name.js
would all fail.  The bug caused non-static "name" methods and
properties to be mistaken for static ones.

R=adamk@chromium.org, verwaest@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/2567343004
Cr-Commit-Position: refs/heads/master@{#41692}
2016-12-14 12:12:01 +00:00
titzer
576abe14c6 [runtime] Add instance size check for CheckEquivalent().
WASM exported functions have additional internal fields which change the instance
size. Adding a getter or setter to such an exported function results in its map
becoming normalized. The normalized map cache, however, finds a different map
with a different instance size, and thus BOOM.

R=verwaest@chromium.org,cbruni@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2554343002
Cr-Commit-Position: refs/heads/master@{#41691}
2016-12-14 11:59:56 +00:00
yangguo
341b39f9d0 [debug-wrapper] migrate some scope related tests
R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2566093002
Cr-Commit-Position: refs/heads/master@{#41688}
2016-12-14 07:20:33 +00:00
jgruber
bbf3c697ae [heap] Initialize the owner on each page after lospace allocation
The least two bits of the owner field of a Page are used to determine
whether the Page is part of a large object. If these bits are not equal
to 0x11, the page is part of a large object and needs special handling
e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
belongs to.

This CL fixes an issue in which the store buffer overflows after
a large object space allocation but before the object has been fully
initialized. Store buffer overflow handling attempts to look up the
chunk of a page, but fails to do so correctly since the page's owner
field has not yet been initialized.

This CL ensures that the owner field of all pages belonging to a large
object allocation are initialized to a value that is interpreted
correctly.

BUG=chromium:672041

Committed: https://crrev.com/9b6808bfb5366beebe3af30a06f9851edb2039d4
Review-Url: https://codereview.chromium.org/2565713002
Cr-Original-Commit-Position: refs/heads/master@{#41641}
Cr-Commit-Position: refs/heads/master@{#41687}
2016-12-14 06:45:35 +00:00
yangguo
825dd8a904 [debug-wrappers] remove mirror tests.
Debug mirrors will no longer be supported in the near future.
It will now only be tested by being used by the v8-inspector.

R=jgruber@chromium.org
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2566103002
Cr-Commit-Position: refs/heads/master@{#41686}
2016-12-14 06:37:07 +00:00
kozyatinskiy
3dea2c8354 Revert of Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID (patchset #11 id:190001 of https://codereview.chromium.org/2547483002/ )
Reason for revert:
LiveEdit is broken in some cases.

Original issue's description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Committed: https://crrev.com/6595e7405769dc9d49e9568d61485efc6d468baf
> Cr-Commit-Position: refs/heads/master@{#41600}

TBR=jgruber@chromium.org,verwaest@chromium.org,yangguo@chromium.org,jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5589,chromium:673950
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2578433002
Cr-Commit-Position: refs/heads/master@{#41684}
2016-12-14 02:05:05 +00:00
gsathya
3b1a09f56d [stubs] Add CSA::IsSymbol() and CSA::IsPrivateSymbol().
Review-Url: https://codereview.chromium.org/2571883002
Cr-Commit-Position: refs/heads/master@{#41682}
2016-12-13 23:13:20 +00:00
kozyatinskiy
73ac1d3877 [inspector] add async instrumentation for setTimeout in tests
BUG=v8:5738
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2574803002
Cr-Commit-Position: refs/heads/master@{#41680}
2016-12-13 19:41:22 +00:00
tebbi
c22c70b605 [turbofan] fixed escape analysis crash because of incomplete replacements
R=epertoso@chromium.org,mstarzinger@chromium.org

BUG=671324

Review-Url: https://codereview.chromium.org/2571793002
Cr-Commit-Position: refs/heads/master@{#41679}
2016-12-13 16:25:30 +00:00
leszeks
f6ee3b5ff3 [ignition] Fix hole check for dynamic local variables
The fast-path for dynamic local variables was previously checking the
lookup variable rather than the shadowed variable when deciding whether
to add a hole check.

BUG=669540

Review-Url: https://codereview.chromium.org/2551023004
Cr-Commit-Position: refs/heads/master@{#41677}
2016-12-13 14:29:07 +00:00
ishell
b5a9381a56 [interpreter][stubs] Enable graph verification for bytecode handlers and stubs included into snapshot.
BUG=

Review-Url: https://codereview.chromium.org/2575473002
Cr-Commit-Position: refs/heads/master@{#41676}
2016-12-13 13:55:29 +00:00
gsathya
dfa2660672 Add PromiseReactionJobInfo to CSA
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2573703002
Cr-Commit-Position: refs/heads/master@{#41674}
2016-12-13 13:22:15 +00:00
marja
0c827cd000 PreParsing inner funcs: Remove nonsense code from PreParser.
The assignment in default parameters (e.g., function foo(a = somedefault) { }
doesn't flow through PreParserFactory::NewAssignment even if the comment claims so.
Thus, piping through the variables is not needed.

Kudos to neis@ for pointing this out.

BUG=v8:5501
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2569983003
Cr-Commit-Position: refs/heads/master@{#41670}
2016-12-13 12:35:11 +00:00
yangguo
449829b85c [serializer] API to re-use global proxy in v8::Context::FromSnapshot.
R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2571743002
Cr-Commit-Position: refs/heads/master@{#41668}
2016-12-13 11:24:58 +00:00
mstarzinger
397a09afc5 Revert of [deoptimizer] Enable test that should no longer fail. (patchset #1 id:1 of https://codereview.chromium.org/2568723003/ )
Reason for revert:
Still flakes on ARM.

Original issue's description:
> [deoptimizer] Enable test that should no longer fail.
>
> R=jarin@chromium.org
> TEST=cctest/test-cpu-profiler/CollectDeoptEvents
>
> Committed: https://crrev.com/3f9c2c590d687562d6adb531d1159738c07013f4
> Cr-Commit-Position: refs/heads/master@{#41664}

TBR=jarin@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2568403003
Cr-Commit-Position: refs/heads/master@{#41667}
2016-12-13 10:29:12 +00:00
ulan
ca9209d705 [heap] Special handling for small heaps in eager finalization of
incremental marking.

BUG=chromium:671994

Review-Url: https://codereview.chromium.org/2565173004
Cr-Commit-Position: refs/heads/master@{#41666}
2016-12-13 10:25:53 +00:00
mstarzinger
3f9c2c590d [deoptimizer] Enable test that should no longer fail.
R=jarin@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2568723003
Cr-Commit-Position: refs/heads/master@{#41664}
2016-12-13 09:19:38 +00:00
gsathya
2886e3917f [promises] Refactor CreatePromise
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2571663002
Cr-Commit-Position: refs/heads/master@{#41660}
2016-12-13 02:15:20 +00:00
jkummerow
bb753b6dd7 [stubs] Fix negative index lookup in hasOwnProperty
...and HasProperty, for dictionary-elements receivers.

BUG=chromium:673008

Review-Url: https://codereview.chromium.org/2568943002
Cr-Commit-Position: refs/heads/master@{#41656}
2016-12-12 20:13:07 +00:00
jochen
1bdf908db0 Add a basic compiler dispatcher
It doesn't schedule steps yet, but there are tests.

BUG=v8:5215
R=rmcilroy@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2558293004
Cr-Commit-Position: refs/heads/master@{#41650}
2016-12-12 15:36:25 +00:00
ishell
02f917f7ef [interpreter][stubs] Fixing issues found by machine graph verifier.
All issues in interpreter bytecode handlers are fixed.

BUG=

Review-Url: https://codereview.chromium.org/2552883012
Cr-Commit-Position: refs/heads/master@{#41649}
2016-12-12 14:53:04 +00:00
bradnelson
aabbbec67c [wasm] [asmjs] Route asm.js warnings to the dev console.
Generalize Messages to include an error level.
Add a parameter to AddMessageHandler to select which error levels to receive, using a mask (default being just errors, i.e. the current behavior).

BUG=v8:4203
R=dgozman@chromium.org,machenbach@chromium.org,danno@chromium.org,bmeurer@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2526703002
Cr-Commit-Position: refs/heads/master@{#41648}
2016-12-12 14:48:50 +00:00
bradnelson
be9ee2237d [wasm][asm.js] Ignore duplicate exports in asm.js.
BUG=672789
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2559113006
Cr-Commit-Position: refs/heads/master@{#41647}
2016-12-12 14:47:38 +00:00
marja
64d9352a54 Preparsing inner funcs: be less pessimistic about maybe_assigned.
BUG=v8:5501, v8:5678

Review-Url: https://codereview.chromium.org/2539123002
Cr-Commit-Position: refs/heads/master@{#41645}
2016-12-12 14:45:16 +00:00
hablich
1e70454f73 Revert of [heap] Initialize the owner on each page after lospace allocation (patchset #2 id:20001 of https://codereview.chromium.org/2565713002/ )
Reason for revert:
Tree closer: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/12409

Original issue's description:
> [heap] Initialize the owner on each page after lospace allocation
>
> The least two bits of the owner field of a Page are used to determine
> whether the Page is part of a large object. If these bits are not equal
> to 0x11, the page is part of a large object and needs special handling
> e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
> belongs to.
>
> This CL fixes an issue in which the store buffer overflows after
> a large object space allocation but before the object has been fully
> initialized. Store buffer overflow handling attempts to look up the
> chunk of a page, but fails to do so correctly since the page's owner
> field has not yet been initialized.
>
> This CL ensures that the owner field of all pages belonging to a large
> object allocation are initialized to a value that is interpreted
> correctly.
>
> BUG=chromium:672041
>
> Committed: https://crrev.com/9b6808bfb5366beebe3af30a06f9851edb2039d4
> Cr-Commit-Position: refs/heads/master@{#41641}

TBR=mlippautz@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:672041

Review-Url: https://codereview.chromium.org/2562273004
Cr-Commit-Position: refs/heads/master@{#41644}
2016-12-12 14:37:44 +00:00
bradnelson
626d620d4d [wasm][asm.js] Require a number for fround literals.
BUG=673240
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2565343002
Cr-Commit-Position: refs/heads/master@{#41643}
2016-12-12 13:51:25 +00:00
clemensh
c4057d4645 [wasm] Provide correct eval origin for asm.js code
This CL moves all methods related to scripts and eval origin (HasScript,
GetScript, IsEval, GetEvalOrigin) from JSStackFrame to StackFrameBase,
because it also applies to WasmFrames.
This makes the AppendFileLocation method append the same information to
WasmStackFrames and AsmJsWasmStackFrames than to JSStackFrames.

R=titzer@chromium.org, mstarzinger@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2557923005
Cr-Commit-Position: refs/heads/master@{#41642}
2016-12-12 13:31:37 +00:00
jgruber
9b6808bfb5 [heap] Initialize the owner on each page after lospace allocation
The least two bits of the owner field of a Page are used to determine
whether the Page is part of a large object. If these bits are not equal
to 0x11, the page is part of a large object and needs special handling
e.g. in MemoryChunk::FromAnyPointerAddress to determine which chunk it
belongs to.

This CL fixes an issue in which the store buffer overflows after
a large object space allocation but before the object has been fully
initialized. Store buffer overflow handling attempts to look up the
chunk of a page, but fails to do so correctly since the page's owner
field has not yet been initialized.

This CL ensures that the owner field of all pages belonging to a large
object allocation are initialized to a value that is interpreted
correctly.

BUG=chromium:672041

Review-Url: https://codereview.chromium.org/2565713002
Cr-Commit-Position: refs/heads/master@{#41641}
2016-12-12 13:19:07 +00:00
clemensh
222541dff5 [wasm] Generate correct locations for error messages
The current logic in Isolate::GetLocationFromStackTrace just ignores
wasm frames, making the computed location point to the first javascript
frame, like this:

test.js:17: RuntimeError: divide by zero
module.exports.main();
               ^
RuntimeError: divide by zero
    at main (<WASM>[1]+5)
    at test.js:17:16

This CL not only fixes the location to point to the top-most wasm
frame, but also exposes to the embedder that the script of that location
is a wasm script, allowing for custom printing of wasm locations.
The Shell::ReportException method now checks for this flag, and prints
wasm locations like this:

<WASM>[0]+5: RuntimeError: divide by zero
RuntimeError: divide by zero
    at main (<WASM>[0]+5)
    at test/message/wasm-trap.js:15:16

R=titzer@chromium.org, yangguo@chromium.org
BUG=chromium:613110

Review-Url: https://codereview.chromium.org/2563673002
Cr-Commit-Position: refs/heads/master@{#41640}
2016-12-12 12:46:02 +00:00
clemensh
c69b48adc4 [wasm] Handle potentially null callee-pc
This only happens if there is a asm.js-wasm-frame on top of the stack
trace, which was not covered by our tests so far. The regression test
create a stack overflow in asm.js code, triggering this case.

R=mstarzinger@chromium.org
CC=titzer@chromium.org, bradnelson@chromium.org
BUG=chromium:673241

Review-Url: https://codereview.chromium.org/2562333002
Cr-Commit-Position: refs/heads/master@{#41639}
2016-12-12 12:30:39 +00:00
bradnelson
7659728be2 [wasm][asm.js] Forbid function declaration replacing variable declaration.
BUG=673240
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2568773002
Cr-Commit-Position: refs/heads/master@{#41638}
2016-12-12 12:27:14 +00:00
jarin
d024df4d22 [turbofan] Fix representation change from bit to tagged pointer.
BUG=chromium:673244

Review-Url: https://codereview.chromium.org/2568053002
Cr-Commit-Position: refs/heads/master@{#41634}
2016-12-12 09:36:47 +00:00
petermarshall
375fc067b0 [Ignition] Fix incorrect arg evaluation order for some super calls.
The evaluation order of this argument was accidentally changed when the
special-case was added for super calls with a final spread argument.

Review-Url: https://codereview.chromium.org/2563423002
Cr-Commit-Position: refs/heads/master@{#41633}
2016-12-12 08:46:01 +00:00
gsathya
1f34eb0ab1 [debugger] use abortjs to quit
--asan test config passes --omit-quit which breaks this test on
  failure.

Review-Url: https://codereview.chromium.org/2546093002
Cr-Commit-Position: refs/heads/master@{#41627}
2016-12-10 04:00:08 +00:00
bradnelson
25189ffc36 [wasm][asm.js] Check that property keys are literals for imports.
BUG=672785
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2566683002
Cr-Commit-Position: refs/heads/master@{#41624}
2016-12-09 15:58:40 +00:00
mstarzinger
50c5ac57de [deoptimizer] Fix Deoptimizer::GetDeoptInfo for last entry.
This fixes the corner-case where the method in question failed to lookup
the very last deoptimization bailout without subsequent entries within
the relocation info. Also enable a test covering this.

R=tebbi@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2565733002
Cr-Commit-Position: refs/heads/master@{#41623}
2016-12-09 15:06:26 +00:00
bradnelson
89e10055e4 [wasm][asm.js] Allow true/false in int binary ops.
Because the parser optimizes !123 -> false,
we allow booleans in expressions (but not parameter annotations).
Allow this in asm-wasm-builder.
Turn on an early out case in asm-typer that is fine.

BUG=672784
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2561193003
Cr-Commit-Position: refs/heads/master@{#41622}
2016-12-09 15:01:30 +00:00
mstarzinger
75128636f3 [wasm] Remove obsolete %IsNotAsmWasmCode predicate.
By now the predicate in question is an exact negation of %IsAsmWasmCode
as the name intuitively implies. The need for two separate test methods
no longer exists and one of the two can be removed.

R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2562003002
Cr-Commit-Position: refs/heads/master@{#41616}
2016-12-09 11:56:05 +00:00
mstarzinger
9fde10ebed [wasm] Cleanup %IsAsmWasmCode testing predicate.
By now the compiler pipeline will not produce optimized code for asm.js
functions unless validation failed (even when --always-opt is enabled).
The related workaround in the testing predicate can be removed.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2549463002
Cr-Commit-Position: refs/heads/master@{#41614}
2016-12-09 11:30:10 +00:00
clemensh
890d28f361 [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- the StackFrame::State struct now also holds the callee_pc_address,
  which is set in ComputeCallerState. The WASM frame uses this
  information to determine whether the callee frame is WASM_TO_JS, and
  whether that frame is at the ToNumber conversion call.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
Review-Url: https://codereview.chromium.org/2555243002
Cr-Original-Commit-Position: refs/heads/master@{#41599}
Cr-Commit-Position: refs/heads/master@{#41613}
2016-12-09 10:30:19 +00:00