Commit Graph

44243 Commits

Author SHA1 Message Date
Michael Lippautz
9ac877fa77 [heap] Minor MC: Free and prefree empty remembered set buckets
No-try: true
Bug: chromium:651354, chromium:788113
Change-Id: Iff2051751c4688c307e8f23ddd08de203974e842
Reviewed-on: https://chromium-review.googlesource.com/800272
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49751}
2017-11-30 13:03:09 +00:00
Michael Hablich
bb23ab8346 Updated version to 6.5
TBR=machenbach@chromium.org
NOTRY=true

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I9d074745843b550603c0b68f2b397a121a494504
Reviewed-on: https://chromium-review.googlesource.com/800173
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49750}
2017-11-30 12:54:29 +00:00
Ulan Degenbaev
21650958ba [runtime] Use methods instead of static functions in RuntimeCallStats.
Bug: chromium:758183
Change-Id: If43122140626207e3f972ccb7d048e012db3ed02
Reviewed-on: https://chromium-review.googlesource.com/796771
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49749}
2017-11-30 12:39:39 +00:00
Michael Lippautz
776721396a [heap] Minor MC: Fix task computation
No-try: true
Bug: chromium:651354, chromium:788113
Change-Id: I8955b322b826c0a59f85c32bb2c1ec8c9d4e0761
Reviewed-on: https://chromium-review.googlesource.com/800330
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49748}
2017-11-30 12:37:19 +00:00
Michael Achenbach
d8b369d2be Revert "[test] Creating command before execution phase."
This reverts commit 98cc9e862f.

Reason for revert: Breaks test isolation:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20builder/builds/29746

Original change's description:
> [test] Creating command before execution phase.
> 
> Immutable command class with shell, flags and
> environment.
> 
> Command creation moved from worker to the main
> process. Because of that there is no need to send
> test cases beyond process boundaries and load test
> suites in worker processes.
> 
> Bug: v8:6917
> Change-Id: Ib6a44278095b4f7141eb9b96802fe3e8117678a6
> Reviewed-on: https://chromium-review.googlesource.com/791710
> Commit-Queue: Michał Majewski <majeski@google.com>
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49746}

TBR=machenbach@chromium.org,sergiyb@chromium.org,majeski@google.com

Change-Id: I44b99468d18fd093833f4185dad067a9eeaf2bc1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6917
Reviewed-on: https://chromium-review.googlesource.com/800292
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49747}
2017-11-30 12:32:31 +00:00
Michal Majewski
98cc9e862f [test] Creating command before execution phase.
Immutable command class with shell, flags and
environment.

Command creation moved from worker to the main
process. Because of that there is no need to send
test cases beyond process boundaries and load test
suites in worker processes.

Bug: v8:6917
Change-Id: Ib6a44278095b4f7141eb9b96802fe3e8117678a6
Reviewed-on: https://chromium-review.googlesource.com/791710
Commit-Queue: Michał Majewski <majeski@google.com>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49746}
2017-11-30 12:30:09 +00:00
Sergiy Byelozyorov
3350608823 [tools] Double timeout for JSTests
R=machenbach@chromium.org

Bug: chromium:775123
Change-Id: I8ca24e48c978b754b8cf9d455ae9314d730104c3
Reviewed-on: https://chromium-review.googlesource.com/800071
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49745}
2017-11-30 12:12:09 +00:00
Benedikt Meurer
ced5628226 [turbofan] Use proper string map in NewConsString.
Finally address that long-standing TODO where ConsString allocation in
TurboFan would always go for the two byte map instead of choosing the
one byte map if the inputs are one byte strings.

Bug: v8:5269, v8:7109
Change-Id: Ibcfceaf499ceebef0ef928ebc5f204bcacf29bc0
Reviewed-on: https://chromium-review.googlesource.com/799700
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49744}
2017-11-30 12:08:09 +00:00
Ulan Degenbaev
cf7fa2eb08 [runtime] Refactor RuntimeCallStats counters to use enums.
Currently RuntimeCallStats stores CounterIds as inner pointers.
This patch replaces them with enums and removes static table.

Bug: chromium:758183
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icb4030fc3ad3dd02e9c2648ce7c43b6f2d47fa9d
Reviewed-on: https://chromium-review.googlesource.com/796477
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49743}
2017-11-30 11:32:53 +00:00
Andreas Haas
603d52f393 [d8] Fix --enable-tracing
This CL fixes an issue with --enable-tracing which was introduced
recently where the tracing file was closed too early. In addition it
adds a test for --enable-tracing to avoid such an issue in the future.

R=machenbach@chromium.org, rmcilroy@chromium.org

Change-Id: I1b3699a4dfbe27230ac1d21d5f6bc7b2ee9ed435
Reviewed-on: https://chromium-review.googlesource.com/796214
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49742}
2017-11-30 10:53:37 +00:00
Michael Achenbach
df659b17ed [test] Refactor variant flags
This derives two global variables to ease adding new variants.

Bug: chromium:788104
Change-Id: Ibe933dc0999f6dfa0ae8bf2afa0a5de8e44aefca
Reviewed-on: https://chromium-review.googlesource.com/799790
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49741}
2017-11-30 10:41:57 +00:00
Michael Lippautz
c99c9c3e96 [testing] Add minor MC variant
No-try: true
Bug: v8:788113
Change-Id: I6e9c659cc5658f4da361552936551adb594f56d9
Reviewed-on: https://chromium-review.googlesource.com/799872
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49740}
2017-11-30 10:02:57 +00:00
Michael Achenbach
9095b279fa [build] Enable slow-fast-switch feature on a subset of bots
This prefixes the flag to be more uniform with existing flags and makes
it available as a gn argument.

The switch feature is enabled on a subset of bots, the linux64 release
trybot and all sanitizers. Note, this doesn't switch to slow paths -
it just allows to use the runtime flag on those bots.

Bug: v8:7120
Change-Id: I706a7a9bd503c13d5432cac9a13a909f4f32a0a7
Reviewed-on: https://chromium-review.googlesource.com/798412
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49739}
2017-11-30 09:51:37 +00:00
Jochen Eisinger
abe77c57df Turn DCHECKs in FindSharedFunctionInfo into CHECKs
When we try to get a function literal with an ID beyond the
last known ID we easily create out-of-bound read bugs. It's preferable
to crash in this situation.

BUG=chromium:789764
R=marja@chromium.org

Change-Id: I4f35e9231ef6af18204bbac96df3652c3d30c29f
Reviewed-on: https://chromium-review.googlesource.com/798411
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49738}
2017-11-30 09:43:27 +00:00
Jakob Gruber
f34c58a062 [regexp] Ensure handles are freed inside RegExpReplace loop
Handles created inside each loop iteration should be freed as the
current iteration goes out of scope.

TBR=yangguo@chromium.org

Bug: v8:7122, chromium:763839
Change-Id: I70a95457c773b26792d87734dab62bc8f4f5fbd0
Reviewed-on: https://chromium-review.googlesource.com/796794
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49737}
2017-11-30 09:10:57 +00:00
Jakob Gruber
a812ecdcea [test] Disable --force-slow-path for mjsunit/es6/array-iterator-turbo
This test expects certain functions to be optimized, which does not
happen if we force array objects onto the slow path.

Bug: v8:7122
Change-Id: I716954fff564f1c4f0782b3452557ec89a3b4307
Reviewed-on: https://chromium-review.googlesource.com/796860
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49736}
2017-11-30 09:05:57 +00:00
Benedikt Meurer
e42e7fc800 [objects] No longer create short external strings.
This fixes String::MakeExternal() to bail out if the subject string
doesn't fit a regular ExternalString, instead of creating a short
external string. The observation here is that for short external strings
the overhead of having to have the StringResource plus going to the
runtime/C++ for each and every character access from JavaScript land
is probably bigger than the anticipated benefits.

If this turns out to be wrong and there's a real benefit, we should make
use of ThinStrings instead of having a separate way to represent
external strings.

Bug: v8:6621, v8:7109, v8:7145
Change-Id: I4b75da08b82a72027c782a69de9c8eaf3cca1d4d
Reviewed-on: https://chromium-review.googlesource.com/799750
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49735}
2017-11-30 08:57:07 +00:00
Clemens Hammacher
bb64e34f0c [wasm] Add "freeze" flag to test lazy compilation
In order to test that we don't repeatedly go through the
WasmCompileLazy runtime function, add a flag to the
LazyCompilationOrchestrator to "freeze" it, i.e. disallow any further
lazy compilation.
In tests, use this flag to first call a method, then freeze lazy
compilation, then call the method again to assert that no further lazy
compilation is triggered.

This test currently fails with --wasm-jit-to-native, so disable it for
that variant.

R=titzer@chromium.org
CC=mtrofin@chromium.org

Bug: v8:7140, chromium:788441, v8:5991
Change-Id: I18a40d302c24041740d8a54351d06ed968f4beec
Reviewed-on: https://chromium-review.googlesource.com/796430
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49734}
2017-11-30 08:54:12 +00:00
Clemens Hammacher
b15be58f3a [wasm] [cleanup] Fix WasmCode::Kind enum names
According to the style guide, enum names they must either be
capitalized, or start with a "k". I prefer the kFoo syntax.

R=mtrofin@chromium.org

Bug: v8:7109
Change-Id: I9c06c4cb05b05ec50de8d68d118f1a0807938426
Reviewed-on: https://chromium-review.googlesource.com/796856
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49733}
2017-11-30 08:53:07 +00:00
Marja Hölttä
c08ab6dacc [cleanup] Add STATIC_ASSERTs for JSFunction size to relevant places.
Makes it easier to modify JSFunction; the failing asserts will tell which places
need to be modified.

Change-Id: I70c7cd0b89cf05964b4730990fb3d7f23927437a
Reviewed-on: https://chromium-review.googlesource.com/781689
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49732}
2017-11-30 08:03:16 +00:00
Benedikt Meurer
500d7b9315 [turbofan] Introduce a dedicated StringLength operator.
Strings are immutable in JavaScript land (contrast with the runtime,
where we can truncate strings that haven't escaped to JavaScript yet),
so the length of a String is immutable. Thus loading the length of a
String is a pure operation and should be expressed as such (i.e. doesn't
depend on control or effect). The StringLength operator does exactly
this and is hooked up to the effect chain in the EffectControlLinearizer.

This will eventually allow us to simplify the optimization of string
concatention and other operations that are a bit cumbersome in TurboFan
currently, and it will also allow us to optimize string operations
across effectful operations, for example combining multiple invocations
to String#slice with the same inputs.

Bug: v8:5269, v8:6936, v8:7109, v8:7137
Change-Id: Iffcccbb0c7fc4cfe1281c10e7af24b40eba4c987
Reviewed-on: https://chromium-review.googlesource.com/799690
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49731}
2017-11-30 06:55:06 +00:00
v8-autoroll
b43b11f98d Update V8 DEPS.
Rolling v8/build: 9338ce5..64dd7ca

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/11d7efb..9968f9b

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I0f41345b892a8627b6e184d69bce9743028cec6f
Reviewed-on: https://chromium-review.googlesource.com/798894
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49730}
2017-11-30 04:46:15 +00:00
Benedikt Meurer
c061734f39 [turbofan] Introduce dedicated NewConsString operator.
This is in preparation of adding a dedicated StringLength operator that
loads the string length. This way operations on strings don't sit in the
effect chain anymore until the EffectControlLinearizer, which wires them.

The NewConsString semantics could still be better, i.e. it could try to
figure out the proper map instead of going for the CONS_STRING_TYPE
always. But this change is meant to be just about pushing the logic down
to the EffectControlLinearizer, which we didn't have initially when the
ConsString handling was done.

This also allows us to remove the handling of CONS_STRING_TYPE from the
Deoptimizer, since the escape analysis no longer sees cons strings.

Bug: v8:5269, v8:6936, v8:7109, v8:7137
Change-Id: If6c4a6d7cf63a3a3f7a34a920c8e50a94dfa67fa
Reviewed-on: https://chromium-review.googlesource.com/796413
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49729}
2017-11-30 04:27:15 +00:00
Alexey Kozyatinskiy
c30472b83e [inspector] external stack intrumentation can be called on one debugger
Some embedders primitive can trigger execution in current JavaScript
instance or in another (e.g. MessageChannel).
With this CL external async task can be local as well.

R=dgozman@chromium.org

Bug: chromium:661705
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I82c68a021c2c25bc67a706c4bfed8c1a2b2388c5
Reviewed-on: https://chromium-review.googlesource.com/792015
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49728}
2017-11-29 23:29:55 +00:00
Clemens Hammacher
0762f35fa7 [wasm] Print wasm code kind in disassembly
The disassembler currently shows calls from JS code objects to wasm
code as:
REX.W movq r10,0x58466fd5120                   ;; js to wasm call

This does not show which code kind is being called (wasm function, lazy
compile stub, or wasm-to-wasm wrapper).

This CL extends the output to:
REX.W movq r10,0x58466fd5120 (wasm-to-wasm)    ;; js to wasm call

R=mtrofin@chromium.org, titzer@chromium.org

Bug: v8:6876, v8:7140
Change-Id: Ib350088017f767528ec0acd7d4c1c347758adcf2
Reviewed-on: https://chromium-review.googlesource.com/796270
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49727}
2017-11-29 19:51:23 +00:00
Deepti Gandluri
1ca9756f91 [wasm] Remove interpreter atomics gcc workaround
Bug=v8:6532

Change-Id: Icad4a697dd82233f939f0e6606fb6f92870622eb
Reviewed-on: https://chromium-review.googlesource.com/795040
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49726}
2017-11-29 18:36:53 +00:00
Georg Neis
ac2394bb97 [bigint,compiler] Remove reduction of Number(x) to ToNumber(x).
In the presence of bigints, this optimization is no longer valid.

Bug: v8:6791
Change-Id: I996ac78f8ae4aef5494dd0089374d04c6db6e72f
Reviewed-on: https://chromium-review.googlesource.com/796070
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49725}
2017-11-29 18:28:03 +00:00
Ross McIlroy
a5fc4e085e [Counters] Add histogram timers for StreamingSource compiles.
Adds histogram timing for main-thread portions of streaming source
compilation. Also adds a histogram timer for capturing the amount of time
spent for off-thread parse / compile of streaming sources.

BUG=v8:5203

Change-Id: Ie9f16052205832a620cfbf266d3d66d3fe9d6c12
Reviewed-on: https://chromium-review.googlesource.com/797038
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49724}
2017-11-29 17:02:34 +00:00
Andreas Haas
5d433b2d65 [fuzzer] Use std::unique_ptr for the FuzzerSupport
The FuzzerSupport was keeping a single instance of itself. With this CL,
this instance is now stored in a unique_ptr. Therefore it is not
necessary to register an onExit callback to delete the FuzzerSupport
instance.

Drive-by changes: Some cleanup with the FuzzerSupport.

R=clemensh@chromium.org

Bug: chromium:787723
Change-Id: I5188c7aa7e778ccd45fc80ed0115c947d23a0dee
Reviewed-on: https://chromium-review.googlesource.com/792949
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49723}
2017-11-29 16:36:23 +00:00
Michael Achenbach
5ff7af939e Revert "Add support to produce code cache after execute."
This reverts commit 5d4a090377.

Reason for revert: Speculative revert due to timeouts on testing with
--isolates:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/21889
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/18138

Original change's description:
> Add support to produce code cache after execute.
> 
> Adds new API function to request code cache. Earlier code cache was
> produced along with compile requests. This new API allows us to request
> code cache after executing. Also adds support in the code serializer to
> serialize after executing the script.
> 
> Bug: chromium:783124
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: Id7b972a2b4c8dcf7a6d9f5ea210890ae968320bd
> Reviewed-on: https://chromium-review.googlesource.com/781767
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49717}

TBR=ulan@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org,mythria@chromium.org

Change-Id: Id9e0285e73bbc3ea3908b4b7bbf6599e4f7cd76e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:783124
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/796870
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49722}
2017-11-29 14:59:11 +00:00
Michael Starzinger
27fd921a28 [debug] Fix debug-evaluate for de-materialized function.
This fixes debug-evaluate in the presence of a de-materialized function
object. The creation of an arguments object is now requested based on a
given frame (potentially inlined) instead of a target function. It makes
sure that multiple calls to {StandardFrame::Summarize} don't cause any
confusion when they give back non-identical function objects.

R=jgruber@chromium.org
TEST=debugger/debug/debug-evaluate-arguments
BUG=chromium:788647

Change-Id: I575bb6cb20b4657dc09019e631b5d6e36c1b5189
Reviewed-on: https://chromium-review.googlesource.com/796474
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49721}
2017-11-29 14:53:18 +00:00
peterwmwong
3669036509 [typedarray] Port TA.p.findIndex() to CSA TFJ
This reduces the overhead of calling the builtin.
Quick measurements show >5x improvement. As the
typed array's size grows, iterating dominates
and the performance gap closes.
https://github.com/peterwmwong/v8-perf/blob/master/typedarray-findIndex/README.md

Bug: v8:5929
Change-Id: I27d67776c83cbe28f4f9f5ef479a7eeabf594654
Reviewed-on: https://chromium-review.googlesource.com/792394
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49720}
2017-11-29 14:47:48 +00:00
jgruber
3cfc4b3afa [typedarray] CHECKs, now with less overflow
Ensure that bound-checking CHECKs do not overflow and properly access
the JSTypedArray's length value.

This addresses remaining comments from
https://crrev.com/c/788857/9/src/runtime/runtime-typedarray.cc#233

Bug: v8:3590
Change-Id: Ic06ff2ecd64a23ab9724c25d7b6cb689b9e7932b
Reviewed-on: https://chromium-review.googlesource.com/796611
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49719}
2017-11-29 14:42:48 +00:00
Yang Guo
579d955355 [debug] do not handle debug interrupt in JSON parse/stringify.
R=jgruber@chromium.org

Bug: chromium:789472
Change-Id: I578c0fb13abaeaedcecf862c4e5aa7680b4067e8
Reviewed-on: https://chromium-review.googlesource.com/795972
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49718}
2017-11-29 14:31:48 +00:00
Mythri
5d4a090377 Add support to produce code cache after execute.
Adds new API function to request code cache. Earlier code cache was
produced along with compile requests. This new API allows us to request
code cache after executing. Also adds support in the code serializer to
serialize after executing the script.

Bug: chromium:783124
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Id7b972a2b4c8dcf7a6d9f5ea210890ae968320bd
Reviewed-on: https://chromium-review.googlesource.com/781767
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49717}
2017-11-29 13:38:03 +00:00
Michael Lippautz
f043bf8a57 [heap] Remove dead Sweeper:AddSweptPageSafe
R=ulan@chromium.org

Bug: 
Change-Id: Ifba0b1bb649f0ee90fc76f738b7912d300c77447
Reviewed-on: https://chromium-review.googlesource.com/796470
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49716}
2017-11-29 13:36:58 +00:00
Clemens Hammacher
690ac5760c [wasm] Lazy-compilation: Support exporting an import
When exporting an imported wasm function, we generate a js-to-wasm
wrapper which calls the wasm-to-wasm wrapper (which then tail-calls
the WasmCompileLazy stub).
This wasm-to-wasm wrapper also needs to be patched.

R=titzer@chromium.org

Bug: chromium:788441, v8:5991
Change-Id: Ibf27618a0511851cb55714b720fe7299a21c2959
Reviewed-on: https://chromium-review.googlesource.com/795990
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49715}
2017-11-29 13:20:34 +00:00
Martyn Capewell
0d5b0d7365 [arm64] Enforce restriction on stlxr instructions
The stlxr (store-release exclusive register) instructions in Arm64 have similar
restrictions to Arm's strex instructions - the status register must not alias
the source or address registers.

Enforce this in the assembler and simulator, and modify Turbofan and cctest to
conform to this. Also, make a small improvement to the code generated for
compare and exchange.

This is a port of 44c52f7bb5.

Bug: 
Change-Id: Ia3a8c39b09c5cb579357a5f61c3d88f13d61b724
Reviewed-on: https://chromium-review.googlesource.com/793037
Reviewed-by: Ben Smith <binji@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#49714}
2017-11-29 13:19:28 +00:00
Michael Achenbach
23ccfa1d94 [test] Turn exemplary configurations into reference comments
This also updates the README with guidelines.

Bug: chromium:788104
Change-Id: I0ca0ea78c5990204b0242be9c7fe6368439a5dd1
Reviewed-on: https://chromium-review.googlesource.com/796311
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49713}
2017-11-29 13:18:22 +00:00
Benedikt Meurer
c13981cd22 [ignition] Collect JSBoundFunction feedback on Construct/ConstructWithSpread.
This addresses two TODOs in Ignition where the Construct and the
ConstructWithSpread bytecodes didn't collect JSBoundFunction
new.target feedback. This is fairly trivial to add now with the
existing machinery and the TurboFan side of this was already fixed
before, so we can leverage the new feedback.

Bug: v8:5267, v8:7109
Change-Id: Iae257836716c14f05f5d301326cbe8b2acaeb38b
Reviewed-on: https://chromium-review.googlesource.com/793048
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49712}
2017-11-29 13:15:18 +00:00
Sathya Gunasekaran
278981d73b [class] Test that fields are initialized before calling the base constructor
Bug: v8:5367
Change-Id: If10539597c07a497d0e9c89af9529ae90f92ddf3
Reviewed-on: https://chromium-review.googlesource.com/794470
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49711}
2017-11-29 12:17:28 +00:00
Michael Starzinger
f55286c6cd Remove obsolete {JavaScriptFrame::GetArgumentsLength}.
R=jarin@chromium.org

Change-Id: I07bde35a44734b49e143a6dafa17dd7c20587412
Reviewed-on: https://chromium-review.googlesource.com/795950
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49710}
2017-11-29 11:56:46 +00:00
Clemens Hammacher
efed6ba94a [wasm] Lazy-compilation: Fix patching of wasm-to-wasm wrappers
Cross-instance calls call through a wasm-to-wasm stub, which
tail-calls and hence does not show up on the stack. It was not being
patched so far, leading to repeatedly calling through the
WasmCompileLazy stub. Even though this did not crash, it resulted in
significant overhead.
This CL fixes this and also adds checks to ensure that we patch at
least one call site whenever we execute the WasmCompileLazy stub.

R=titzer@chromium.org

Bug: chromium:788441, v8:5991
Change-Id: I1c2cd52497c577252a64dbf1cfa92d2f2e60b06c
Reviewed-on: https://chromium-review.googlesource.com/794132
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49709}
2017-11-29 11:53:26 +00:00
Michael Starzinger
588d8d3dd5 [turbofan] Remove obsolete {SupportsTailCalls} flag.
R=jarin@chromium.org

Change-Id: I2b2d5095e7c5c06c509a0e1b1b1121e78a80735a
Reviewed-on: https://chromium-review.googlesource.com/796031
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49708}
2017-11-29 11:52:06 +00:00
Michael Achenbach
76c39af174 Revert "V8: Temporary run wasm_traps on native arm debug"
This reverts commit 0269965b37.

Reason for revert: Successfully got some stack traces:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Arm%20-%20debug/builds/5274

Original change's description:
> V8: Temporary run wasm_traps on native arm debug
> 
> This will break the bot. This is for getting a stack trace and then
> revert.
> 
> TBR=mtrofin@chromium.org
> 
> Bug: v8:7138
> Change-Id: I244492ca81f817d64ef7c12e291a6ed9b97e68de
> Reviewed-on: https://chromium-review.googlesource.com/795718
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49698}

TBR=machenbach@chromium.org,mtrofin@chromium.org

Change-Id: Id81736508fd7eb2b9220bf41188f7687c4046960
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7138
Reviewed-on: https://chromium-review.googlesource.com/796290
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49707}
2017-11-29 11:36:38 +00:00
peterwmwong
04746c8109 [typedarray] Port TA.p.find() to CSA TFJ
This reduces the overhead of calling the builtin.
Quick measurements show >5x improvement. As the
typed array's size grows, iterating dominates
and the performance gap closes.
https://github.com/peterwmwong/v8-perf/blob/master/typedarray-find/README.md

Bug: v8:5929
Change-Id: Ia74546bb46d446c6161c8956e350d4b5cdc1b328
Reviewed-on: https://chromium-review.googlesource.com/792454
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49706}
2017-11-29 11:31:16 +00:00
Michael Achenbach
32033f4f4f Revert "Implement and use VectorSegment to avoid repeated allocation of ZoneVector properties."
This reverts commit d3104923b2.

Reason for revert: Breaks win debug, causes lots of timeouts.
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/20387

Original change's description:
> Implement and use VectorSegment to avoid repeated allocation of ZoneVector properties.
> 
> The parser holds a single vector whose backing storage is reused in calls
> to ParseJsonObject, so that once we reach the peak number of unstored
> properties no more allocations are required.
> 
> This improves performance of parsing inputs like those in Speedometer VanillaJS
> by about 2% in my local measurement, and would presumably do better on more
> pathological inputs.
> 
> This should also have the side effect of reducing peak memory usage at this time
> slightly, since we do fewer zone allocations which cannot be freed until the
> parse finishes.
> 
> Bug: chromium:771227
> Change-Id: I8aa1514b37a74f82539f95f94292c8fa1582d66a
> Reviewed-on: https://chromium-review.googlesource.com/789511
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Commit-Queue: Jeremy Roman <jbroman@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49693}

TBR=jbroman@chromium.org,marja@chromium.org,cbruni@chromium.org

Change-Id: I5b198aeffed6f1543f6110709dc74b311d4ba144
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:771227
Reviewed-on: https://chromium-review.googlesource.com/796151
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49705}
2017-11-29 10:57:48 +00:00
Benedikt Meurer
3200cc600c [turbofan] Optimize String#slice(-1) calls.
In TurboFan we can easily recognize calls to String.prototype.slice
where the start parameter is -1 and the end parameter is either
undefined or not present. These calls either return an empty string if
the input string is empty, or the last character of the input string
as a single character string. So we can just make use of the existing
StringCharAt operator.

This reduces the overhead of the String.prototype.slice calls from
optimized code in the chai test of the web-tooling-benchmark
significantly. We observe a 2-3% improvement on the test.

Bug: v8:6936, v8:7137
Change-Id: Iebe02667446880f5760e3e8c80f8b7cc712df663
Reviewed-on: https://chromium-review.googlesource.com/795726
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49704}
2017-11-29 10:55:26 +00:00
Michael Achenbach
c0a4680d70 Revert "[cleanup] Harden the SubString CSA/Runtime implementations."
This reverts commit 99cb4d35a3.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/16445

Original change's description:
> [cleanup] Harden the SubString CSA/Runtime implementations.
> 
> Remove the self-healing for invalid parameters in the
> CodeStubAssembler::SubString helper and the %SubString runtime function,
> which is used as a fallback for the CodeStubAssembler implementation.
> All call sites must do appropriate parameter validation anyways now that
> the self-hosted JavaScript builtins using these helpers are gone, and we
> have proper contracts with the uses.
> 
> Also remove the context parameter from the CodeStubAssembler::SubString
> method, which is unnecessary, since this can no longer throw an
> exception.
> 
> Bug: v8:5269, v8:6936, v8:7109, v8:7137
> Change-Id: I19d93bad5f41faa0561c4561a48f78fcba99a549
> Reviewed-on: https://chromium-review.googlesource.com/795720
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#49702}

TBR=jgruber@chromium.org,bmeurer@chromium.org

Change-Id: I2900b5f087e78f1d321724f03bd063a5ff094183
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:5269, v8:6936, v8:7109, v8:7137
Reviewed-on: https://chromium-review.googlesource.com/796150
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49703}
2017-11-29 10:50:28 +00:00
Benedikt Meurer
99cb4d35a3 [cleanup] Harden the SubString CSA/Runtime implementations.
Remove the self-healing for invalid parameters in the
CodeStubAssembler::SubString helper and the %SubString runtime function,
which is used as a fallback for the CodeStubAssembler implementation.
All call sites must do appropriate parameter validation anyways now that
the self-hosted JavaScript builtins using these helpers are gone, and we
have proper contracts with the uses.

Also remove the context parameter from the CodeStubAssembler::SubString
method, which is unnecessary, since this can no longer throw an
exception.

Bug: v8:5269, v8:6936, v8:7109, v8:7137
Change-Id: I19d93bad5f41faa0561c4561a48f78fcba99a549
Reviewed-on: https://chromium-review.googlesource.com/795720
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#49702}
2017-11-29 09:58:07 +00:00