Commit Graph

58157 Commits

Author SHA1 Message Date
Georg Neis
ab089c7864 [turbofan] Prepare for moving part of CreateGraph into the background
- Pass Refs, not Handles, to graph builder, and drop bytecode array argument
  (get it from SFI instead).
- Add some fields to FeedbackVectorRef that are needed to avoid heap access
  in BytecodeGraphBuilderPhase.
- Rename FeedbackVectorRef's SerializeSlots to Serialize, since it's more
  than just the feedback slots.
- Rearrange the last steps in PipelineCompilationJob::PrepareJobImpl such
  that CreateGraph is last.

Bug: v8:7790
Change-Id: I4b17790d1d74da41ba63ee68e3a33968662fc398
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781682
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63515}
2019-09-03 09:07:39 +00:00
Maya Lekova
8b455eff56 Revert "[turbofan] Serialize missing objects"
This reverts commit d82600ecc8.

Reason for revert: Blocking the roll, see https://ci.chromium.org/p/chromium/builders/try/linux-rel/181725

Original change's description:
> [turbofan] Serialize missing objects
> 
> Added a few objects to the standard objects list, as well as specific
> builtins when the corresponding runtime calls are detected in the
> serializer. Now JSHeapCopyReducer is needed only when concurrent
> inlining is disabled.
> 
> Bug: v8:7790
> Change-Id: I91d933611b0352df8ede4fded665f13669591fef
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63509}

TBR=neis@chromium.org,mslekova@chromium.org

Change-Id: I5eb8a8371994822debb852fc2a090ba585826d4a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1782157
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63514}
2019-09-03 07:30:11 +00:00
Simon Zünd
70dd77c7c1 Reset DeclarationScope::function_ variable after pre-parsing
"--print-scopes" uses the {function_} variable to print the function
name and locals of a function scope. In case of a pre-parsed function,
the function variable of the scope lives in a zone which is nuked after
pre-parsing, while the scope lives on. This leaves the {function_}
variable pointer in the scope in a state where it points to
invalid memory, causing "--print-scopes" to crash.
This CL fixes the crash by properly resetting the {function_}
pointer.

TBR=verwaest@chromium.org

Change-Id: Id24dbb605bec883317f676265a920fe0ca662301
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776094
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63513}
2019-09-03 07:01:16 +00:00
v8-ci-autoroll-builder
25e7bba53d Update V8 DEPS.
Rolling v8/build: 5dd1782..4fa36b1

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/9f64c5c..5198ea1

Rolling v8/tools/clang: 6783233..2fef805

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I2357d1ea3e6b28825b4b952ad6bc5db852bdfb18
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1780230
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63512}
2019-09-03 03:33:26 +00:00
Michael Lippautz
fba101cdac heap: Inspect embedder fields on global and global proxy object
Those object types can carry embedder fields as they are generated from
embedder-provided function templates.

Bug: v8:9672
Change-Id: Iaea794ba8bea2ffec3559131eecfe1941479759a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781048
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63511}
2019-09-02 17:22:04 +00:00
Dominik Inführ
93063ade0f [heap] Remove size from invalidated slots
Slots are always valid inside an invalidated area when outside the
respective object's current size. This allows us to remove the size
from the InvalidatedSlots data structure.

This change was enabled by https://crrev.com/c/1771793.

Bug: v8:9454
Change-Id: I2b5a7234d47227cb6ad8d67de20e9b5a2028ae83
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773242
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63510}
2019-09-02 15:14:04 +00:00
Maya Lekova
d82600ecc8 [turbofan] Serialize missing objects
Added a few objects to the standard objects list, as well as specific
builtins when the corresponding runtime calls are detected in the
serializer. Now JSHeapCopyReducer is needed only when concurrent
inlining is disabled.

Bug: v8:7790
Change-Id: I91d933611b0352df8ede4fded665f13669591fef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781053
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63509}
2019-09-02 14:05:44 +00:00
Jakob Gruber
f6fc9d6e3e [ia32] Add a root-relative addressing mode
.. and use it for generating faster loads of external references. This
changes the stack check instruction sequence from

mov ecx,0x567651dc  // The address of the stack limit.
cmp esp,[ecx]

to

cmp esp,[ebx+0x3c]

This addressing mode was likely forgotten when we recently added root
register support on ia32.

Bug: chromium:998751,v8:9534
Change-Id: I3521519da1e9d373dfcd83831b3e399e0e9c895b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781056
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63508}
2019-09-02 13:51:14 +00:00
Michael Achenbach
6039d7baa2 [foozzie] Enable wasm staging on correctness fuzzer
NOTRY=true

Bug: v8:9601
Change-Id: I0406326dab681843ef8accadefa10a9e85593fb1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781055
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63507}
2019-09-02 13:41:34 +00:00
Maya Lekova
0b4573a544 [turbofan] Move one-shot-bytecode counter increment to serializer
Bug: v8:7790
Change-Id: I79b81d66751707756139db50720080a144bdcd38
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781045
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63506}
2019-09-02 13:31:24 +00:00
Yang Guo
0b403dcbec [inspector] honor order in console.table's filter argument
R=sigurds@chromium.org

Bug: chromium:956475
Change-Id: Ie4ccd84e1c239d771fd9238599c687782ddb1356
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776097
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63505}
2019-09-02 13:21:24 +00:00
Leszek Swirski
cbf56ee501 [csa] Make CSA::TaggedEqual use WordEqual
Similar to https://crrev.com/c/1781047, WordEqual already does the right
truncation in the instruction selector.

Bug: v8:8948
Change-Id: I92e74bafab6a467aeca1570494e9044f9cf18c46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781049
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63504}
2019-09-02 13:14:34 +00:00
Ana Peško
611d84ee13 [regexp] Naive tier-up testing
This CL adds initial tests for the tier-up logic.

Change-Id: I6e6ff69604b14387e81b08d178f98d2227b4f496
Bug: v8:9566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776080
Commit-Queue: Ana Pesko <anapesko@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63503}
2019-09-02 12:55:54 +00:00
Thibaud Michaud
2a75da33bf [regalloc] Improve backward spilling heuristic
Allow the backward spilling heuristic to look and spill before the start
of the current range.

This solves a common scenario where control-flow aware allocation
cannot apply the heuristic as efficiently as splintering because it
creates smaller live ranges.

Bug: v8:9088
Change-Id: I7f8af8bb9c82849fbae0c652baa5011fd890690e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776085
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63502}
2019-09-02 12:31:34 +00:00
Igor Sheludko
539041c554 [ptr-compr][turbofan] Implement GraphAssembler::TaggedEqual() as WordEqual()
... which already does good the right job of generating 32-bit comparisons
while Word32Equal() seems to break some optimizations in TurboFan and produce
a little bit slower code.

Bug: v8:8948
Change-Id: I288656479fa32c34a7253c4879cb3566d7470a6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781047
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63501}
2019-09-02 11:49:24 +00:00
Dan Elphick
00cd9cfd9d [interpreter] Improve reporting for bytecode mismatches
If a bytecode mismatch occurs, the original and new bytecode are now
printed along with the position of the bytecode mismatch.

Bug: v8:8510
Change-Id: Ia3b016fb4e0edde46944533a6a768499b20678d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774722
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63500}
2019-09-02 11:43:14 +00:00
Leszek Swirski
981aafaf97 Reland "[ic] In-place Double -> Tagged transitions"
This is a reland of 0736599a69.
This is a reland of 7e1fbe8f34.

Original change description:
> [ic] In-place Double -> Tagged transitions
>
> With no more MutableHeapNumber, we can make Double -> Tagged transitions
> in-place, at the cost of an extra map check when accessing double fields
> to make sure they are still doubles.
>
> Bug: v8:9606
> Change-Id: I74ff39ed6fba62ee223cd37dfe761f7d73020e1c
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743973
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63374}

TBR=verwaest@chromium.org, tebbi@chromium.org

Bug: v8:9606
Change-Id: I2d1b7416064d743582f4983fb868316b7e8a4cf2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1777661
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63499}
2019-09-02 10:18:34 +00:00
Georg Neis
1a7fe98137 [turbofan] Improve broker's "miss" tracing output
Print the file name instead of the function name, as the
function name can be ambiguous.

Bug: v8:7790
Change-Id: I079eb0e5a0012aff1d241618d132ecd2d3d93c8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781043
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63498}
2019-09-02 08:59:29 +00:00
Georg Neis
b7b4229336 [turbofan] Further reduce dependence on HeapCopyReducer
- Add serialization for CallNoFeedback, which was missing.
- Extend serialization for CallJSRuntime.
- Serialize for calls to higher-order Array builtins.
- Serialize for calls to Function#apply and Function#call.
- Serialize for calls to Reflect.apply and Reflect.construct.
- Serialize for calls to Promise constructor.
- Fix ConvertReceiverMode in serialization for CallProperty.

Bug: v8:7790
Change-Id: I4bba6f45f9b7948ed2ba9c70bd423a23ec29ecf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763530
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63497}
2019-09-02 08:50:19 +00:00
Peter Marshall
6498f8bb33 [regexp] Don't clone new JSRegExps when there is no feedback vector
When creating a new JSRegExp for a literal, we sometimes create a
boilerplate and store it in the feedback vector. Then for future
creations, we can copy the boilerplate instead of re-creating the
regexp from scratch.

When we don't have a feedback vector, we currently create a
boilerplate, copy it and return the copy, and then throw out the
boilerplate, which is unnecessary. We can just return the first
JSRegExp we create.

Change-Id: I98b4e3a3082654ea989e0e6ba1524ce080b0125c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776086
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63496}
2019-09-02 08:40:39 +00:00
Michael Achenbach
14243f1206 [foozzie] Fix sanity checks
The sanity checks never really worked since the file was missing in the
output dir. Runs bailed out with "Error loading file".
As both configurations bailed out in the same way, the correctness fuzzer
treated it as pass.

NOTRY=true

Bug: chromium:933076
Change-Id: Id3a2f7e8e3fa8c6654e3e08654d2e9e6b7010484
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778289
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63495}
2019-09-02 08:30:40 +00:00
Michael Achenbach
960d9b4445 [foozzie] Improve TypeError suppression
This also ignores the line number for type errors.

NOTRY=true

Bug: chromium:995075
Change-Id: I9d9a91842383eba60db858c2c2e02df7dda1a9e1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778287
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63494}
2019-09-02 08:29:39 +00:00
Georg Neis
a930362253 [interpreter] Include SFI in --print-bytecode
Now it's easy to find the bytecode corresponding to a given
SFI in logging output.

Change-Id: I32100d54830c2dae3cef838f09582e8d023b5ecb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1781044
Commit-Queue: Georg Neis <neis@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63493}
2019-09-02 08:20:39 +00:00
Maya Lekova
a4c9e9ee42 [turbofan] Gather feedback in advance in non-concurrent mode
Bug: chromium:998802
Change-Id: I243c00b367ffd1c5c54ca6930681b1b1d3317b26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773273
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63492}
2019-09-02 07:54:39 +00:00
Mu Tao
a5d85ba53c [mips][regexp] Add an offset argument CheckAtStart
Port 2e0bc516b7

Original Commit Message:

    Similar to CheckNotAtStart, one can now apply an offset to the
    CheckAtStart operation. Due to a recent change, all callsites of
    CheckNotAtStart now need to pass an offset, whereas previously the
    offset was just assumed to be zero.

Change-Id: I8201ae7620809be3767ad32feab069074b3cbf86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1775983
Auto-Submit: Mu Tao <pamilty@gmail.com>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63491}
2019-09-02 06:42:59 +00:00
Mu Tao
19b3ec7609 [mips][regexp] Consolidate calls to jitted irregexp and regexp interpreter
Port 213504b9d7

Original Commit Message:

    The code fields in a JSRegExp object now either contain irregexp
    compiled code or a trampoline to the interpreter. This way the code
    can be executed without explicitly checking if the regexp shall be
    interpreted or executed natively.
    In case of interpreted regexp the generated bytecode is now stored in
    its own fields instead of the code fields for Latin1 and UC16
    respectively.
    The signatures of the jitted irregexp match and the regexp interpreter
    have been equalized.

Change-Id: I843b11cfdd9ecbb38f03706bcb86a5cfcbf69050
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778083
Auto-Submit: Mu Tao <pamilty@gmail.com>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63490}
2019-09-02 06:34:59 +00:00
v8-ci-autoroll-builder
ad253a9a14 Update V8 DEPS.
Rolling v8/build: b99a3be..5dd1782

Rolling v8/tools/clang: 3d3532b..6783233

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I4872aa1ed13a08e257d7f722c8f0348df943b9c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779633
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63489}
2019-09-02 03:39:29 +00:00
v8-ci-autoroll-builder
714c9f31a9 Update V8 DEPS.
Rolling v8/build: 5f1456d..b99a3be

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/354c81a..9f64c5c

Rolling v8/third_party/depot_tools: 5aeddeb..355e97e

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ib817bc78402251bc181b2f5429b9cd335836d935
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779631
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63488}
2019-09-01 03:36:57 +00:00
John Budorick
fd6e713f61 infra: make Win64 ASAN bots request Windows-10-15063.
This should allow us to add other Windows-10 versions to pool:Chrome
without adversely affecting the V8 bots.

Bug: chromium:990885
Change-Id: I760eb6b1fc6f9fb91c9bacce692b21cbc044b261
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778916
Auto-Submit: John Budorick <jbudorick@chromium.org>
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Tamer Tas <tmrts@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63487}
2019-08-31 08:13:16 +00:00
v8-ci-autoroll-builder
02be649df3 Update V8 DEPS.
Rolling v8/build: d2d4319..5f1456d

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/8fe3e6a..354c81a

Rolling v8/third_party/depot_tools: ee8d9ce..5aeddeb

Rolling v8/third_party/icu: 952ccb9..53f6b23

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I0d9c69c1253243928b40aeed62769299f09d50ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1779628
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63486}
2019-08-31 03:41:56 +00:00
Seth Brenith
2ccca6c5ac [tools][torque] Include string values in GetObjectProperties responses
This change provides a quick way to see string contents in postmortem
debugging sessions, without digging through a (possibly very large, in
the case of ConsString) tree of properties. As well as being convenient
for inspecting String objects, this functionality will also be necessary
for displaying property names on JSReceiver objects. In order to support
custom behaviors for specific classes, this change extends the existing
generated debug reader classes with a visitor pattern.

Bug: v8:9376
Change-Id: I70eab9ea4e74ca0fab39bf5998d6a602716a4202
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1771939
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#63485}
2019-08-30 21:56:06 +00:00
Dan Elphick
3e545f38cb [coverage] Collect source positions when toggling mode
When changing the code coverage or type profiler modes, first ensure
there are source positions for all BytecodeArrays as regenerating the
source positions after toggling the mode will result in a bytecode
mismatch.

Bug: v8:9656, v8:8510
Change-Id: Ic6cf3afec1588f11e5ce5fcbea2fd13e4452e15f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774721
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63484}
2019-08-30 17:58:30 +00:00
Darius Mercadier
eba13c21bc [heap] Use twice less Freelists categories
Our current Freelist uses 47 categories. Because FreeListCategory is
about 26 bytes or so, this causes a non-neglieable overhead per
page. This CL divides by two the number of categories used.

Benchmark have shown that this should not increase old heap size. And
since less categories will be used, size of mallocated objects will be
smaller.
Furthermore,in both precise and fast modes, Scavenger time is lower
when using 24 Freelists rather than 47.

Bug: v8:9329
Change-Id: I81cca63a0ffd0aad5f9e009a176f401f2299493d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778941
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63483}
2019-08-30 17:01:41 +00:00
Ross McIlroy
286590504d [Compiler] Extend stress source positions for eager inner functions.
Extend stress source positions to also ensure source positions for eagerly
compiled inner functions when lazily compiling the outer function.

BUG=v8:8510

Change-Id: I66d04beb789f13c15ed87cf10f606723c18f5d8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774725
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63482}
2019-08-30 16:08:20 +00:00
Ulan Degenbaev
1884223839 [heap] Clear recorded slots for trimmed strings and preparse data
Currently string and preparse data trimming code creates filler object
without clearing the slots in the trimmed area. This currently works
because the slots are overwritten by filler/free space map.

This CL explicitly clears the slots and makes the code more robust.

Bug: v8:9454
Change-Id: I20ad8a210eb17932e46be5df4b42389955b5e5eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778023
Reviewed-by: Dominik Inführ <dinfuehr@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63481}
2019-08-30 15:41:20 +00:00
Patrick Thier
baed90dcbd [regexp] Fix tier-up logic
Commit 213504b9d7 broke tier-up for
regular expressions (Tier-up didn't trigger anymore).
This CL fixes this issue.

Bug: v8:9516,v8:9566
Change-Id: I76971bc4375f9885e58988eca92be217ddd4d924
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778291
Auto-Submit: Patrick Thier <pthier@google.com>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63480}
2019-08-30 15:04:10 +00:00
Georg Schmid
cbf015025a [torque] Add HeapSlice location references to Torque
This CL adds a LocationReference specifically for slices to Torque. This allows us to safely reference arrays in objects and pass around such references. For an array of T-typed elements, referencing yields a Slice<T>. In addition, the traditional element access syntax ('o.array[i]') now internally produces a slice, indexes it at 'i' and dereferences the resulting HeapReference.

Bug: v8:7793
Change-Id: I4af58e4d2feac547c55a1f6f9350a6c510383df2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1771782
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63479}
2019-08-30 11:51:32 +00:00
Sathya Gunasekaran
f4a3028b59 Reland "[ic] Inline constant fields in IC"
This reverts commit f6e08f43fc.

This patch doesn't allow thin/cons strings to be inlined as weak refs
to them are not supported by the GC.

Bug: v8:9616
Change-Id: I0407654bd9d20fe0182de4b8554e21ddbce8b28c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1774720
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63478}
2019-08-30 11:20:29 +00:00
Leszek Swirski
ef2df57aa5 Reland "[destructuring] Elide coercible check for simple keys"
This is a reland of 1fba044154
Chromium expectation tests have been disabled, and will be enabled

Original change's description:
> [destructuring] Elide coercible check for simple keys
>
> Simple object destructuring, such as `let {a,b} = o`, is less efficient
> than the equivalent assignments `let a = o.a; let b = o.b`. This is
> because it does a nil check of `o` before the assignments. However, this
> nil check is not strictly necessary for simple (i.e. non-computed) names,
> as there will be an equivalent nil check on the first access to o in
> `o.a`. For computed names the computation is unfortunately obervable.
>
> So, we can elide the nil check when the first property (if any) of the
> destructuring target is a non-computed name. This messes a bit with our
> error messages, so we re-use the CallPrinter to also find destructuring
> assignment based errors, and fiddle with the error message there. As
> a side-effect, we also get out the object name in the AST, so we can
> output a slightly nicer error message.
>
> Change-Id: Iafa858e27ed771a146cd3ba57903cc73bb46951d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773254
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63453}

TBR=verwaest@chromium.org

Bug: chromium:999473
Change-Id: Ib0b2e4be433c50521ba1722e1c06b672bfefa405
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1777702
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63477}
2019-08-30 10:51:49 +00:00
Benedikt Meurer
7dad47c693 [inspector] Generate custom previews in the objects creation context.
Generating custom previews can invoke user specified JavaScript (via the
`window.devtoolsFormatters` custom formatters feature). These custom
formatters were previously invoked in the main page context, even for
objects coming from other `<iframe>`s. Instead of using the main
renderer context, we should instead generate the custom preview in the
creation context of the object.

Bug: chromium:997925
Change-Id: Ia07915cff6680153b6727e68117ed565e60bc1c2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776093
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63476}
2019-08-30 10:50:40 +00:00
Georg Neis
890a315396 [turbofan] Clean up heap broker initialization
E.g. make the setup of the ObjectRef hash table more explicit.

Tbr: jgruber@chromium.org
Bug: v8:7790
Change-Id: I58c03848e7da5c418ff2d6ae1e71b644278f406b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776089
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63475}
2019-08-30 10:19:20 +00:00
Joyee Cheung
df12eb194e [class] implement private accessors
This patch implements the access of private accessors by loading the
referenced component from the AccessorPair associated with private
name variables. It also makes the error messages for invalid kind
of private accessor access more specific.

Bug: v8:8330
Design doc: https://docs.google.com/document/d/10W4begYfs7lmldSqBoQBBt_BKamgT8igqxF9u50RGrI/edit

Change-Id: I6d441cffb85f8d9cd0417ec9b6ae20f3e34ef418
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695205
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/master@{#63474}
2019-08-30 10:16:29 +00:00
Sigurd Schneider
bdcc7502cb [torque] Check for prototype before loading it
Add a missing check for a prototype to GetDerivedMap.

Bug: chromium:999310
Change-Id: I99c342a53e3b95bb7b624ff14c1c40576ee629df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776092
Auto-Submit: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63473}
2019-08-30 09:37:23 +00:00
Maya Lekova
2a099bfaf7 [turbofan] Fully brokerize JSInlining and EscapeAnalysis
Introduce JSGlobalObjectRef to the heap broker.

Bug: v8:7790
Change-Id: I055a0545b582d6ff4c4e0dd639ce532311a76fec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773267
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63472}
2019-08-30 08:26:37 +00:00
Ulan Degenbaev
9da3483136 Revert "Reland x5 [arraybuffer] Rearchitect backing store ownership"
This reverts commit 62e168308c.

Reason for revert: it will be relanded after branch

Original change's description:
> Reland x5 [arraybuffer] Rearchitect backing store ownership
> 
> This reverts commit 8fdb23873b.
> 
> Original change's description:
> > "Reland x4 [arraybuffer] Rearchitect backing store ownership"
> >
> > This is a reland of bc33f5aeba
> >
> > Contributed by titzer@chromium.org
> >
> > Original change's description:
> > > [arraybuffer] Rearchitect backing store ownership
> > >
> > > This CL completely rearchitects the ownership of array buffer backing stores,
> > > consolidating ownership into a {BackingStore} C++ object that is tracked
> > > throughout V8 using unique_ptr and shared_ptr where appropriate.
> > >
> > > Overall, lifetime management is simpler and more explicit. The numerous
> > > ways that array buffers were initialized have been streamlined to one
> > > Attach() method on JSArrayBuffer. The array buffer tracker in the
> > > GC implementation now manages std::shared_ptr<BackingStore> pointers,
> > > and the construction and destruction of the BackingStore object itself
> > > handles the underlying page or embedder-allocated memory.
> > >
> > > The embedder API remains unchanged for now. We use the
> > > v8::ArrayBuffer::Contents struct to hide an additional shared_ptr to
> > > keep the backing store alive properly, even in the case of aliases
> > > from live heap objects. Thus the embedder has a lower chance of making
> > > a mistake. Long-term, we should move the embedder to a model where they
> > > manage backing stores using shared_ptr to an opaque backing store object.
> >
> > TBR=yangguo@chromium.org
> >
> > BUG=v8:9380,v8:9221,chromium:986318
> >
> > Change-Id: If671a4a9ca0476e8f084efae46e0d2bf99ed99ef
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1731005
> > Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> > Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#63041}
> 
> TBR=yangguo@chromium.org,clemensh@chromium.org,mstarzinger@chromium.org
> 
> Change-Id: Iba55c7ab71e5642b5cb6aeb699d6fc9cf9061486
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1771795
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63461}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Id8f67a68ab398032eb2975b1b24ee125394d9c4b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776095
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63471}
2019-08-30 08:23:40 +00:00
Maya Lekova
1de815c5b1 [turbofan] Remove heap access from BytecodeGraphBuilder
BytecodeGraphBuilder is now completely heap-access free.

Bug: v8:7790
Change-Id: I86a26550cb65015a804dbabf117e11d2bc6aff60
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1773255
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63470}
2019-08-30 08:13:27 +00:00
Michael Achenbach
f36ba13a12 [test] Bump gcmole version
This updates the gcmole archive to include:
https://crrev.com/c/1773243

Bug: v8:9321
Change-Id: Ia892f1dcf6814e80a12d6828331626aae84d9ddd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776087
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63469}
2019-08-30 07:53:27 +00:00
v8-ci-autoroll-builder
e1d4ee733c Update V8 DEPS.
Rolling v8/build: 370f887..d2d4319

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/4b46042..8fe3e6a

Rolling v8/third_party/googletest/src: eb56ee5..565f1b8

Rolling v8/tools/clang: 2993c5f..3d3532b

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: Ia4c8198c1491b1ffbe9a57ecf350e949e3e1032f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1777322
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63468}
2019-08-30 07:08:07 +00:00
Michael Achenbach
39c8a147aa [test] Bump shards on slow builder
NOTRY=true
TBR=tmrts@chromium.org

Change-Id: I6ffee170454ca8362591f9f650b3a6ac8bb09552
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776091
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63467}
2019-08-30 06:57:57 +00:00
Ng Zhi An
991b5296a8 [wasm-simd] Enable reduction test for 64x2
This is only for turbofan and interpreter, and simd lowering for 64x2 is
not implemented yet.

Bug: v8:8460
Change-Id: I0d046cb39ff64936da772e0db9a86b88b1509ac2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1769194
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63466}
2019-08-29 23:57:35 +00:00