Commit Graph

12394 Commits

Author SHA1 Message Date
jpp
974f4a8059 V8. ASM-2-WASM. Validator V2.
This is a rewrite of the ASM validator. This one follows the spec instead of using the AST visitors.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=cctest/asmjs/test-asm-typer
TEST=cctest/asmjs/test-typing-asm
LOG=N

Review-Url: https://codereview.chromium.org/2071343003
Cr-Commit-Position: refs/heads/master@{#37694}
2016-07-12 23:12:08 +00:00
aseemgarg
cd95c600be [wasm] allow array access with unsigned indices
BUG=618608
R=bradnelson@chromium.org
TEST=regress-618608.js

Review-Url: https://codereview.chromium.org/2138243002
Cr-Commit-Position: refs/heads/master@{#37693}
2016-07-12 21:56:38 +00:00
mtrofin
81f42220a6 [wasm] cloning compiled module before instantiation
To correctly support instantiating a compiled module multiple times, we clone the
compiled module each time we create an instance, since some of the data is specific
to the instance - e.g. export code, wasm functions, indirect table.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2134593002
Cr-Commit-Position: refs/heads/master@{#37692}
2016-07-12 21:37:21 +00:00
littledan
117fda1401 [parser] report errors for invalid binding patterns in async formal parameters
BUG=v8:4483, v8:5190

R=caitp@igalia.com, nikolaos@chromium.org

Review-Url: https://codereview.chromium.org/2139063002
Cr-Commit-Position: refs/heads/master@{#37691}
2016-07-12 19:50:09 +00:00
neis
457c02573c Make toLocaleString on arrays always call toLocaleString on its elements.
As required by the spec.

BUG=v8:5113

Review-Url: https://codereview.chromium.org/2141603002
Cr-Commit-Position: refs/heads/master@{#37689}
2016-07-12 17:33:36 +00:00
ssanfilippo
9b9f885e99 Revert of Implement .eh_frame writer and disassembler. (patchset #72 id:2030001 of https://codereview.chromium.org/2023503002/ )
Reason for revert:
The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc causes a compiler error on V8 Win64 - clang buildbot. Removing that bit should be sufficient.

Original issue's description:
> Implement .eh_frame writer and disassembler.
>
> Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
> to a EhFrameWriter and will attach unwinding information to the code
> object when passed one.
>
> BUG=v8:4899
> LOG=N
>
> Committed: https://crrev.com/27d810e63b744b5b3d9aa28ff21413247773e6c2
> Cr-Commit-Position: refs/heads/master@{#37683}

TBR=rmcilroy@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4899

Review-Url: https://codereview.chromium.org/2143033002
Cr-Commit-Position: refs/heads/master@{#37688}
2016-07-12 16:17:34 +00:00
epertoso
60c95d85ab [turbofan] Move TryCloneBranch in the EffectControlLinearizer pass.
When trying to clone a branch, the ControlFlowOptimizer gave up as soon as it found a Phi/EffectPhi node that could not be placed directly below the IfTrue or IfFalse control paths.

Moving the step in the EffectControlLinearizer phase, after the first schedule, works around the problem by looking at the successor blocks.

BUG=

Review-Url: https://codereview.chromium.org/2139593002
Cr-Commit-Position: refs/heads/master@{#37687}
2016-07-12 15:23:36 +00:00
neis
8f1f1cb1c7 Move catch prediction into frontend and make it aware of rethrows.
This solves an issue with throws inside for-of always being marked as caught.

BUG=v8:5183

Review-Url: https://codereview.chromium.org/2146493002
Cr-Commit-Position: refs/heads/master@{#37686}
2016-07-12 15:23:35 +00:00
hpayer
ea90556a2f [heap] Untangle Marking and friends from heap dependencies.
BUG=

Review-Url: https://codereview.chromium.org/2139133003
Cr-Commit-Position: refs/heads/master@{#37685}
2016-07-12 15:10:52 +00:00
ssanfilippo
27d810e63b Implement .eh_frame writer and disassembler.
Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
to a EhFrameWriter and will attach unwinding information to the code
object when passed one.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/2023503002
Cr-Commit-Position: refs/heads/master@{#37683}
2016-07-12 15:04:29 +00:00
cbruni
d234118e29 Revert of making heap verification more aggressive (patchset #7 id:120001 of https://codereview.chromium.org/2126613002/ )
Reason for revert:
failing gc stress tests: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/7223/steps/Mjsunit/logs/stdio

Original issue's description:
> [runtime] making heap verification more aggressive
>
> - check that packed elements do not contain the_hole (with fix)
> - verify argument objects with elements kind
> - use JSObjectVerifiy in all JSObject "subclasses"
> - change initialization order for ArrayLiteralBoilerplate to simplify verification
>
> BUG=v8:5188
>
> Committed: https://crrev.com/599aa2e106ca8ab79f5cc489d1b93b6a26b19714
> Cr-Commit-Position: refs/heads/master@{#37680}

TBR=ishell@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5188

Review-Url: https://codereview.chromium.org/2140163002
Cr-Commit-Position: refs/heads/master@{#37682}
2016-07-12 14:07:17 +00:00
cbruni
599aa2e106 [runtime] making heap verification more aggressive
- check that packed elements do not contain the_hole (with fix)
- verify argument objects with elements kind
- use JSObjectVerifiy in all JSObject "subclasses"
- change initialization order for ArrayLiteralBoilerplate to simplify verification

BUG=v8:5188

Review-Url: https://codereview.chromium.org/2126613002
Cr-Commit-Position: refs/heads/master@{#37680}
2016-07-12 13:32:03 +00:00
mstarzinger
6e38f4270a [test] Remove NaCl support from test runner harness.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141013002
Cr-Commit-Position: refs/heads/master@{#37678}
2016-07-12 13:18:49 +00:00
mstarzinger
88402eccc7 [turbofan] Re-enable tests no longer failing on ARM hardware.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141563002
Cr-Commit-Position: refs/heads/master@{#37677}
2016-07-12 12:44:11 +00:00
oth
b215c9e5b8 Address compilation warnings for android build.
LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2135573002
Cr-Commit-Position: refs/heads/master@{#37676}
2016-07-12 11:21:56 +00:00
jgruber
a0c7ab6306 Remove detailed from simple stack trace functionality
This is another point where we add inconsistent behavior between simple and
detailed stack traces. The functionality also does not seem to be used in
chrome anymore when uncaught exceptions are thrown.  Remove it to reduce
maintenance burden.

BUG=624285
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2141523002
Cr-Commit-Position: refs/heads/master@{#37673}
2016-07-12 10:24:57 +00:00
ahaas
b571026f26 [test] Change or replace unrepresentable number in the lists of float test values.
I removed or replaced some values in the list of float and double values
in value-helper.h which cannot be represented precisely as floats or
doubles, respectively.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2135243004
Cr-Commit-Position: refs/heads/master@{#37671}
2016-07-12 10:09:06 +00:00
mstarzinger
f3ca214222 [turbofan] Speed up structural graph verification.
This removes the checking for use-def and def-use chain links from the
graph verification. Presence of such links can only be violated by a bug
in the actual {Node} implementation itself. That container class is also
covered by unit tests.

The verification in question was useful in the early days when the graph
implementation itself was prone to bugs. By now it has stabilized and
spending O(n^2) time during graph verification is too wasteful to still
be considered a reasonable trade-off.

R=jarin@chromium.org
TEST=unittests/NodeTest.*

Review-Url: https://codereview.chromium.org/2140973003
Cr-Commit-Position: refs/heads/master@{#37670}
2016-07-12 09:31:12 +00:00
bmeurer
85969edead [turbofan] Unify BooleanToNumber, StringToNumber and PlainPrimitiveToNumber.
The PlainPrimitiveToNumber operator performs a superset of the operations
previously performed by the BooleanToNumber and StringToNumber operators,
so we can just use the special lowering rules for PlainPrimitiveToNumber
based on the input type and get rid of the specialized operators.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2139183002
Cr-Commit-Position: refs/heads/master@{#37669}
2016-07-12 09:15:11 +00:00
danno
e92e911814 [turbofan] Robustify tail parameter stack size computations
This CL separates the check whether something is tail-callable from
the computation of the size of the stack parameters that a function
takes.

In order to track this precisely, the stack parameter size calculation
uses the recently landed MachineType information that's embedded
in return and parameter value LinkageLocations.

Review-Url: https://codereview.chromium.org/2121753002
Cr-Commit-Position: refs/heads/master@{#37668}
2016-07-12 08:40:49 +00:00
bmeurer
4e862dd964 [intrinsics] Remove obsolete intrinsics.
Remove obsolete definitions from macros.py, and drop the now obsolete
%_ToPrimitive, %_ToPrimitive_Number, %_ToPrimitive_String, %_ToName
and the %ToPrimitive_String intrinsics/runtime entries.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2137203002
Cr-Commit-Position: refs/heads/master@{#37665}
2016-07-12 06:41:23 +00:00
yangguo
bbb2159d4c [regexp] Fix regexp source escaping with preceding backslashes.
R=franzih@chromium.org
BUG=chromium:515897

Review-Url: https://codereview.chromium.org/2137033002
Cr-Commit-Position: refs/heads/master@{#37664}
2016-07-12 05:36:17 +00:00
jochen
992e34c216 Don't compile functions in a context the caller doesn't have access to
Instead just return undefined

A side effect of this is that it's no longer possible to compile
functions in a detached context.

BUG=chromium:541703
R=verwaest@chromium.org,bmeurer@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2034083002
Cr-Commit-Position: refs/heads/master@{#37657}
2016-07-11 20:11:51 +00:00
jwolfe
b8668fa846 Recognize HTMLCloseComment after multiline comment
When the scanner finds a '-->', it's either part of an HTMLCloseComment
or a '--' followed by a '>'. Previously, only a preceding newline would
make it an HTMLCloseComment. Now, a preceding multiline comment also
makes it an HTMLCloseComment. The effect is that now the following is
not a SyntaxError:

x/*
*/-->this is now a comment

BUG=v8:5142
LOG=y

Review-Url: https://codereview.chromium.org/2119763003
Cr-Commit-Position: refs/heads/master@{#37656}
2016-07-11 20:05:24 +00:00
littledan
77cbe27689 Narrowly address async function stack overflow parsing case
This patch just checks for a stack overflow and returns failure
from the cases which Clusterfuzz found. However, there may be
more locations in the parser which need similar treatment.

R=caitpotter88@gmail.com,neis
BUG=v8:4483,chromium:624300

Review-Url: https://codereview.chromium.org/2135503002
Cr-Commit-Position: refs/heads/master@{#37655}
2016-07-11 19:33:43 +00:00
bbudge
56d013d481 [Turbofan] Support 128 bit moves/swaps for x64.
LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2139513002
Cr-Commit-Position: refs/heads/master@{#37654}
2016-07-11 18:21:50 +00:00
aseemgarg
8474f24450 [wasm] throw in case of assignment to module parameters
BUG=613928
R=bradnelson@chromium.org
TEST=regress-613928.js

Review-Url: https://codereview.chromium.org/2123283007
Cr-Commit-Position: refs/heads/master@{#37653}
2016-07-11 17:41:30 +00:00
ishell
b030a6f59d [runtime] Follow-up fix for "Better encapsulation of dictionary objects handling in lookup iterator."
BUG=chromium:626715

Review-Url: https://codereview.chromium.org/2135253002
Cr-Commit-Position: refs/heads/master@{#37651}
2016-07-11 15:51:58 +00:00
hpayer
8551daee4d TestCodeFlushingIncrementalScavenge should not allocate on black pages.
BUG=

Review-Url: https://codereview.chromium.org/2138783002
Cr-Commit-Position: refs/heads/master@{#37648}
2016-07-11 15:20:05 +00:00
mstarzinger
136e60a7ce [turbofan] Remove eager frame state from comparisons.
This removes the frame state input representing the before-state from
nodes having any comparison operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2134173002
Cr-Commit-Position: refs/heads/master@{#37646}
2016-07-11 14:25:42 +00:00
mstarzinger
ecfec3b039 [turbofan] Respect pretenuring of heap numbers.
This extends pretenuring decisions based on allocation sites to heap
numbers that are allocated as part of object literals. It ensures memory
locality of a bigger enclosure of the deep copy of an object literal.

R=bmeurer@chromium.org
TEST=cctest/test-heap/OptimizedPretenuringMixedInObjectProperties

Review-Url: https://codereview.chromium.org/2135933002
Cr-Commit-Position: refs/heads/master@{#37645}
2016-07-11 14:15:24 +00:00
titzer
9be74f6687 [wasm] Add a BytecodeIterator and use in non-performance-critical situations.
R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2135693002
Cr-Commit-Position: refs/heads/master@{#37642}
2016-07-11 13:00:27 +00:00
peterssen
e28b16265a Fix FastAccessorAssembler inverted jump conditions
BUG=chromium:508898

Review-Url: https://codereview.chromium.org/2135153002
Cr-Commit-Position: refs/heads/master@{#37640}
2016-07-11 12:38:17 +00:00
rmcilroy
4f2d37da0c [Interpreter] Add ClassOf intrinsic.
BUG=v8:4280

Review-Url: https://codereview.chromium.org/2128233002
Cr-Commit-Position: refs/heads/master@{#37637}
2016-07-11 11:48:21 +00:00
mstarzinger
f57b0604ed [crankshaft] Re-enable Math.min/max tests that no longer fail.
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2132373002
Cr-Commit-Position: refs/heads/master@{#37635}
2016-07-11 11:14:00 +00:00
caitp
08d0012dda [keys] propagate PropertyFilter to proxy targets in KeyAccumulator
BUG=v8:5174, v8:1543
R=cbruni@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2129193003
Cr-Commit-Position: refs/heads/master@{#37634}
2016-07-11 10:39:35 +00:00
danno
3e2085eba4 [turbofan] Add MachineType to LinkageLocation
By adding MachineType to LinkageLocation, it is possible not only to reason
about the location of a LinkageLocation on the stack, but also about it's
size. This will be useful in follow-on CLs that attempt to merge some of the
parameter passing logic of tail calls and normal (non-tail) calls.

As a nice side-effect, it is no longer necessary to separately keep a
MachineSignature in a CallDescriptor, because the MachineTypes contianed in
LinkageLocation for all of the Descriptor's parameters and return types are
sufficient. This CL therefore removes the MachineSignature from the
CallDescriptor and adjusts all the calling code accordingly, simplifying and
de-duplicating code in a bunch of places.

R=titzer@chromium.org, bmeurer@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2124023003
Cr-Commit-Position: refs/heads/master@{#37633}
2016-07-11 10:39:34 +00:00
jgruber
be5808bff8 Correctly format builtin constructors in stack traces
CallSite::IsConstructor() was unable to recognize builtin construct stubs
(NumberConstructor_ConstructStub and StringConstructor_ConstructStub) as
constructors, and thus these frames were not formatted correctly in stack
traces.

Fix this by explicitly marking their Code objects as construct stubs and
passing along a special receiver value when we encounter such cases in
CaptureSimpleStackTrace.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2125163004
Cr-Commit-Position: refs/heads/master@{#37631}
2016-07-11 10:05:03 +00:00
mstarzinger
7dbc223983 [turbofan] Enable pretenuring tests for optimized code.
This enables tests which verify allocation site feedback is used and
influences pretenuring decisions. By now TurboFan is respecting such
feedback. Ignition however doesn't provide such feedback yet.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2135563003
Cr-Commit-Position: refs/heads/master@{#37628}
2016-07-11 08:40:58 +00:00
machenbach
4af2bb9e38 Revert three commits due to cpu-profiler failures.
Revert "Move SimulatorHelper into V8 out of profiler clients."

This reverts commit b837241150.

Revert "Make use of v8::TickSample instead of v8::internal::TickSample in logger."

This reverts commit c3a16f0a9f.

Revert "Clean up SimulatorHelper code."

This reverts commit 8ee236e144.

BUG=v8:5193
TBR=alph@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2138643003
Cr-Commit-Position: refs/heads/master@{#37626}
2016-07-11 08:03:26 +00:00
yangguo
dfcc5d4ee8 [debugger] omit exception events for rethrown exceptions in async.
R=bmeurer@chromium.org, littledan@chromium.org
BUG=v8:5167

Review-Url: https://codereview.chromium.org/2124813002
Cr-Commit-Position: refs/heads/master@{#37623}
2016-07-11 05:50:03 +00:00
bmeurer
03bde2660a [turbofan] Introduce CheckedInt32Div and CheckedInt32Mod operators.
Consume Smi/Signed32 feedback for division and modulus and introduce
appropriate checked operators. This is especially important for modulus
where the Float64Mod operator is significantly slower than Int32Mod on
most platforms. For division it's mostly important to propagate
integerness, i.e. to avoid follow-up conversions between float and
int32.

Drive-by-fix: Use Int32Mod for the ModulusStub (and the bytecode handler)
when the inputs are both Smi.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2138633002
Cr-Commit-Position: refs/heads/master@{#37621}
2016-07-11 05:27:55 +00:00
alph
b837241150 Move SimulatorHelper into V8 out of profiler clients.
Clients should not know about the simulator.

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2128613004
Cr-Commit-Position: refs/heads/master@{#37617}
2016-07-08 23:52:49 +00:00
littledan
97e8046e44 Avoid calling the builtin String.prototype.split in Intl
The Intl code previously called the initial value of String.prototype.split
for some internal operations. However, this did not have the intended effect
as Intl only needs to split strings by strings, but String.prototype.split
has integration with Symbol.split for RegExps.

This patch replaces the calls of StringSplit in the Intl implementation
with direct calls to the %StringSplit runtime function to avoid the issue.

R=yangguo@chromium.org
BUG=v8:5179

Review-Url: https://codereview.chromium.org/2126073002
Cr-Commit-Position: refs/heads/master@{#37615}
2016-07-08 16:53:09 +00:00
alph
120b753f71 Introduce v8::CpuProfiler::New and v8::CpuProfiler::Dispose API.
Isolate is not going to retain a CPU profiler.
The client will be creating an instance of profiler when needed.

Deprectate v8::Isolate::GetCpuProfiler()

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2117343006
Cr-Commit-Position: refs/heads/master@{#37613}
2016-07-08 15:01:10 +00:00
mstarzinger
3660505e5f [turbofan] Re-enable debugger tests that no longer fail.
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2127423002
Cr-Commit-Position: refs/heads/master@{#37609}
2016-07-08 12:49:53 +00:00
Michael Starzinger
2c09760ac4 [turbofan] Re-enable test that no longer fails.
This enables tests which rely on the context available at "debugger"
statements to be accurate. This is the case by now when deoptimization
information is available.

R=yangguo@chromium.org
BUG=v8:4055

Review URL: https://codereview.chromium.org/2129123002 .

Cr-Commit-Position: refs/heads/master@{#37604}
2016-07-08 09:52:07 +00:00
yangguo
3885fa0974 Do not record source positions for non-script or native script compiles.
R=bmeurer@chromium.org, mstarzinger@chromium.org, rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2112853002
Cr-Commit-Position: refs/heads/master@{#37602}
2016-07-08 08:49:45 +00:00
lpy
4e53b1a1a7 Remove v8- prefix of file name in libsampler.
BUG=

Review-Url: https://codereview.chromium.org/2125023004
Cr-Commit-Position: refs/heads/master@{#37599}
2016-07-08 06:47:54 +00:00
jgruber
d49d3864d7 [builtins] Construct builtin frame in String/Number ctors
BUG=v8:5173
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2118283003
Cr-Commit-Position: refs/heads/master@{#37598}
2016-07-08 06:38:19 +00:00