Commit Graph

47003 Commits

Author SHA1 Message Date
Michael Starzinger
51d1573b2a [turbofan] Simplify handling of calls with saved registers.
This removes the explicit {kCallWithCallerSavedRegisters} opcode which
is just a regular call node with special handling for saving/restoring
caller saved registers before/after the call. This is now handled via
the {CallDescriptor::kCallerSavedRegisters} flag.

R=neis@chromium.org
BUG=v8:9396

Change-Id: Ie6421085eb2be8a067040222cd5215a9b1013048
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728611
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63021}
2019-08-01 08:59:15 +00:00
Mythri A
159df2488c [ic] Don't transition to premonomorphic state
We used to use premonomorphic state to delay initializing the ICs.
This optimization was to avoid the cost of setting up handlers if the
code executed only once. With lazy feedback allocation we no longer
need this.

This cl also renames LoadIC_Uninitialized to LoadIC_Nofeedback and
StoreIC_Uninitialized to StoreIC_Nofeedback since we now miss to
runtime in the uninitialized state and use the builtin when there
is no feedback.


Change-Id: I1633e61ea74664da51348e362c34c47a017a264a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1683525
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63020}
2019-08-01 08:57:38 +00:00
Maya Lekova
b1c641be58 [turbofan] Brokerize ReduceJSCall and ReduceJSConstruct
Bug: v8:7790

Change-Id: Icd0194924d7b0aa58f5b7ee74028cec9f5c39564
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715460
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63018}
2019-08-01 08:41:57 +00:00
Z Nguyen-Huu
e88a8ae216 call ProxyDeleteProperty inside DeleteProperty
Instead of having fast path for proxy only in Reflect.deleteProperty, it
is also in delete operator.

Bug: v8:6664
Change-Id: I3db919953e31f51a5dc4a504062bd691a6e17446
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717660
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63014}
2019-07-31 17:06:45 +00:00
Dan Elphick
43c8538d91 [compiler] Always collect source positions for wrapped functions
Wrapped functions don't recompile properly with lazy source positions so
just force them to always collect the source positions.

Fixes cctest/test-compiler/CompileFunctionInContext in the presence of
--enable-lazy-source-positions and --stress-lazy-source-positions.

Bug: v8:8510
Change-Id: I2402a441d4930be11dc037c6041cb577a63a3529
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709427
Commit-Queue: Dan Elphick <delphick@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63013}
2019-07-31 17:01:25 +00:00
Deepti Gandluri
289aa11ba0 Make atomic operations effectful.
Bug: v8:9536
Change-Id: Ie9c47493ab29f604d6e43ef318e08618ee527fc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728329
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63012}
2019-07-31 16:12:04 +00:00
Francis McCabe
195679de3f Revert ""Reland x3 [arraybuffer] Rearchitect backing store ownership""
This reverts commit df8e617772.

Reason for revert: Multiple flakes in apparently related areas:

https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8906409837768155568/+/steps/Check__flakes_/0/logs/BackingStoreTest.RacyGrowWasmMem.../0

Original change's description:
> "Reland x3 [arraybuffer] Rearchitect backing store ownership"
> 
> This is a reland of bc33f5aeba
> 
> Original change's description:
> > [arraybuffer] Rearchitect backing store ownership
> >
> > This CL completely rearchitects the ownership of array buffer backing stores,
> > consolidating ownership into a {BackingStore} C++ object that is tracked
> > throughout V8 using unique_ptr and shared_ptr where appropriate.
> >
> > Overall, lifetime management is simpler and more explicit. The numerous
> > ways that array buffers were initialized have been streamlined to one
> > Attach() method on JSArrayBuffer. The array buffer tracker in the
> > GC implementation now manages std::shared_ptr<BackingStore> pointers,
> > and the construction and destruction of the BackingStore object itself
> > handles the underlying page or embedder-allocated memory.
> >
> > The embedder API remains unchanged for now. We use the
> > v8::ArrayBuffer::Contents struct to hide an additional shared_ptr to
> > keep the backing store alive properly, even in the case of aliases
> > from live heap objects. Thus the embedder has a lower chance of making
> > a mistake. Long-term, we should move the embedder to a model where they
> > manage backing stores using shared_ptr to an opaque backing store object.
> 
> R=​mlippautz@chromium.org
> BUG=v8:9380,v8:9221,chromium:986318
> TBR=ulan@chromium.org
> 
> Change-Id: I6c49e2425029b5664ef1c68dab8b5146f4ed0ff2
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719191
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63007}

TBR=mstarzinger@chromium.org,titzer@chromium.org,mlippautz@chromium.org

Change-Id: If0266e5893b1325a332d5986337fa7ece2cb6943
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9380, v8:9221, chromium:986318
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1729549
Reviewed-by: Francis McCabe <fgm@chromium.org>
Commit-Queue: Francis McCabe <fgm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63011}
2019-07-31 15:50:56 +00:00
Seth Brenith
bea0ffd0dd Reland "[regexp] Better quick checks on loop entry nodes"
This is a reland of 4b15b984ad

Updates since original: fix an arithmetic overflow bug, remove an invalid
DCHECK, add a unit test that would trigger that DCHECK.

Original change's description:
> [regexp] Better quick checks on loop entry nodes
>
> Like the predecessor change https://crrev.com/c/v8/v8/+/1702125 , this
> change is inspired by attempting to exit earlier from generated RegExp
> code, when no further matches are possible because any match would be
> too long. The motivating example this time is the following expression,
> which tests whether a string of Unicode playing cards has five of the
> same suit in a row:
>
> /([🂡-🂮]{5})|([🂱-🂾]{5})|([🃁-🃎]{5})|([🃑-🃞]{5})/u
>
> A human reading this expression can readily see that any match requires
> at least 10 characters (5 surrogate pairs), but the LoopChoiceNode for
> each repeated option reports its minimum distance to the end of a match
> as zero. This is correct, because the LoopChoiceNode's behavior depends
> on additional state (the loop counter). However, the preceding node, a
> SET_REGISTER action that initializes the loop counter, could confidently
> state that it consumes at least 10 characters. Furthermore, when we try
> to emit a quick check for that action, we could follow only paths from
> the LoopChoiceNode that are possible based on the minimum iteration
> count. This change implements both of those "could"s.
>
> I expect this improvement to apply pretty broadly to expressions that
> use minimum repetition counts and that don't meet the criteria for
> unrolling. In this particular case, I get about 12% improvement on the
> overall UniPoker test, due to reducing the execution time of this
> expression by 85% and the execution time of another similar expression
> that checks for n-of-a-kind by 20%.
>
> Bug: v8:9305
>
> Change-Id: I319e381743967bdf83324be75bae943fbb5dd496
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1704941
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62963}

Bug: v8:9305
Change-Id: I992070d383009013881bf778242254c27134b650
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726674
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#63009}
2019-07-31 14:34:20 +00:00
Seth Brenith
0921e8f28b Reland "Add postmortem debugging helper library"
This is a reland of 517ab73fd7

Updates since original: now compressed pointers passed to the function
GetObjectProperties are required to be sign-extended. Previously, the
function allowed zero-extended values, but that led to ambiguity on
pointers like 0x88044919: is it compressed or is the heap range actually
centered on 0x100000000?

Original change's description:
> Add postmortem debugging helper library
>
> This change begins to implement the functionality described in
> https://docs.google.com/document/d/1evHnb1uLlSbvHAAsmOXyc25x3uh1DjgNa8u1RHvwVhk/edit#
> for investigating V8 state in crash dumps.
>
> This change adds a new library, v8_debug_helper, for providing platform-
> agnostic assistance with postmortem debugging. This library can be used
> by extensions built for debuggers such as WinDbg or lldb. Its public API
> is described by debug-helper.h; currently the only method it exposes is
> GetObjectProperties, but we'd like to add more functionality over time.
> The API surface is restricted to plain C-style structs and pointers, so
> that it's easy to link from a debugger extension built with a different
> toolchain.
>
> This change also adds a new cctest file to exercise some basic
> interaction with the new library.
>
> The API function GetObjectProperties takes an object pointer (which
> could be compressed, or weak, or a SMI), and returns a string
> description of the object and a list of properties the object contains.
> For now, the list of properties is entirely based on Torque object
> definitions, but we expect to add custom properties in future updates so
> that it can be easier to make sense of complex data structures such as
> dictionaries.
>
> GetObjectProperties does several things that are intended to generate
> somewhat useful results even in cases where memory may be corrupt or
> unavailable:
> - The caller may optionally provide a type string which will be used if
>   the memory for the object's Map is inaccessible.
> - All object pointers are compared against the list of known objects
>   generated by mkgrokdump. The caller may optionally provide the
>   pointers for the first pages of various heap spaces, to avoid spurious
>   matches. If those pointers are not provided, then any matches are
>   prefixed with "maybe" in the resulting description string, such as
>   "maybe UndefinedValue (0x4288000341 <Oddball>)".
>
> Bug: v8:9376
>
> Change-Id: Iebf3cc2dea3133c7811bcefcdf38d9458b02fded
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1628012
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62882}

Bug: v8:9376
Change-Id: I866a1cc9d4c34bfe10c7b98462451fe69763cf3f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717090
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#63008}
2019-07-31 14:30:19 +00:00
Ben L. Titzer
df8e617772 "Reland x3 [arraybuffer] Rearchitect backing store ownership"
This is a reland of bc33f5aeba

Original change's description:
> [arraybuffer] Rearchitect backing store ownership
>
> This CL completely rearchitects the ownership of array buffer backing stores,
> consolidating ownership into a {BackingStore} C++ object that is tracked
> throughout V8 using unique_ptr and shared_ptr where appropriate.
>
> Overall, lifetime management is simpler and more explicit. The numerous
> ways that array buffers were initialized have been streamlined to one
> Attach() method on JSArrayBuffer. The array buffer tracker in the
> GC implementation now manages std::shared_ptr<BackingStore> pointers,
> and the construction and destruction of the BackingStore object itself
> handles the underlying page or embedder-allocated memory.
>
> The embedder API remains unchanged for now. We use the
> v8::ArrayBuffer::Contents struct to hide an additional shared_ptr to
> keep the backing store alive properly, even in the case of aliases
> from live heap objects. Thus the embedder has a lower chance of making
> a mistake. Long-term, we should move the embedder to a model where they
> manage backing stores using shared_ptr to an opaque backing store object.

R=mlippautz@chromium.org
BUG=v8:9380,v8:9221,chromium:986318
TBR=ulan@chromium.org

Change-Id: I6c49e2425029b5664ef1c68dab8b5146f4ed0ff2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719191
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63007}
2019-07-31 14:13:59 +00:00
Milad Farazmand
9ed9157626 PPC/s390: [deoptimizer, cleanup] Don't store values of single precision fp registers
Port 556e4859bb

Original Commit Message:

    Instead of storing the values of the single precision floating point registers,
    get their values from the aliased double precision registers.

    This saves, on arm64, 184 bytes per deoptimisation kind function (552 in total)
    and 128 bytes in the RegisterValues class.

R=joey.gouly@arm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: If38a721cfaefb7980902f4f963119cb88061e342
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726857
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#63006}
2019-07-31 13:55:00 +00:00
Georg Schmid
d4e6525849 [torque] Generalize type argument inference for generic calls
With the arrival of generic structs (https://chromium-review.googlesource.com/c/v8/v8/+/1714868) the existing type inference procedure for generic calls became incomplete, since it could not infer types that were only constrained as part of generic types. For instance, given

  struct Box<T: Type> { ... }

  macro unbox<T: type>(box: Box<T>): T

the type argument (Smi) at the following call site

  const box: Box<Smi> = ...;
  unbox(box);

could not be inferred.

This CL re-implements the inference procedure and documents the semantics of type argument inference in Torque a bit more clearly.

R=tebbi@chromium.org

Change-Id: I868f16afbd9864b9c810ac49bc1639b467df939c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720812
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63005}
2019-07-31 13:12:29 +00:00
Dan Elphick
3a1bb751c9 [cleanup] Remove redundant static modifiers
Removes static modifier from global inline functions defined in
globals.h.

R=rmcilroy@chromium.org

Bug: v8:9396
Change-Id: Ieacbcbf592d219fb50ab2d23dfbaba27246fb7ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1728610
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63004}
2019-07-31 11:08:39 +00:00
Tom Tan
3f1f001a67 Unwind V8 frames correctly on Windows ARM64
On Windows ARM64, OS stack walking does not work because the V8 ARM64 backend
doesn't emit unwinding info and also because it doesn't emit ABI compliant
stack frames. This was fixed for Windows X64 (https://crrev.com/c/1469329) and
documented below:

https://docs.google.com/document/d/1-wf50jFlii0c_Pr52lm2ZU-49m220nhYMrHDi3vXnh0

This problem can be fixed similarly for Windows ARM64 by observing that V8
frames usually all have the same prolog which maintains a chain via frame
pointer (fp or x29 register).

stp fp, lr, [sp, ...]

One exception is JSEntry which stops fp pointer chain and needs to be handled
specially.

So it is possible to define XDATA with UNWIND_CODE which specify how Windows
should walk through V8 dynamic frames. The same as X64, since V8 Code objects
are all allocated in the same code-range for an Isolate, it is possible to
register at most 2 XDATA and a group of PDATA entries to cover stack walking
for all the code generated inside that code-range. This is more than 1
PDATA/XDATA because according to the Windows ARM64 exeption handling document,
1 PDATA can cover less than 1MB code range (see below doc).

https://docs.microsoft.com/en-us/cpp/build/arm64-exception-handling

This PR implements stackwalk for Windows ARM64 to be on par with X64, including
embedded builtins, jitted code and wasm jitted code, but not including register
handler for handling exception only, because there is no backward compatibility
to maintain for Windows ARM64 which was released since 1709 windows build.

Bug: chromium:893460
Change-Id: Ic74cbdad8af5cf342185030a4c53796f12ea5429
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1701133
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63002}
2019-07-31 06:24:45 +00:00
Joran Siu
775148b8d4 S390: Guard auvx.h include with V8_HOST_ARCH_S390
The s390 port uses the auxvector APIs to detect hardware/OS
support for various z/Architecture features.  These checks
only make sense if we are running native, non-simulator mode.

Moving the include<auxv.h> under V8_HOST_ARCH_S390 enables
compilation of s390 simulation on platforms that do not have auxv.h
header available.

R=miladfar@ca.ibm.com,jyan@ca.ibm.com

Change-Id: I685681a4f8786509beb181d8ae63876b3a4235b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726844
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Commit-Queue: Joran Siu <joransiu@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62999}
2019-07-31 02:03:15 +00:00
Yu Yin
c2f18318f2 [mips][deoptimizer][cleanup] Don't store values of single precision fp registers
port 556e485 https://crrev.com/c/1669687

Original Commit Message:

    Instead of storing the values of the single precision floating point registers,
    get their values from the aliased double precision registers.

    This saves, on arm64, 184 bytes per deoptimisation kind function (552 in total)
    and 128 bytes in the RegisterValues class.

Change-Id: Ic178de717d27a63b3f510b3a93e8f33a1730dc8b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725669
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#62998}
2019-07-31 01:23:35 +00:00
Ng Zhi An
cfc1573727 Fix assembler sequence for cmppd
REX prefix should be after mandatory prefix and before opcode.

Change-Id: I9829384d7d617d3be203026ae84ffa30aaef6d2e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1726983
Commit-Queue: Bill Budge <bbudge@chromium.org>
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62997}
2019-07-30 23:52:35 +00:00
Thibaud Michaud
fc1e98acd1 Reland "[wasm] Simplify module creation"
Original CL:
> [wasm] Simplify module creation
>
> This includes WasmEngine::NewNativeModule() and
WasmModuleObject::New().
> The intent is to make the various ways of creating a module (sync,
> async, deserialize, import) more similar.
>
> After this change, a NativeModule will always be created before a
> WasmModuleObject. This will make it easier to look up a cached
> NativeModule given its wire bytes.
>
> The following changes are made:
>
> * Use WasmCodeManager::EstimateNativeModuleCodeSize() to find the code
>   size estimate by default. A different code size estimate is only
used in
>   tests.
> * Change CompileJsToWasmWrappers() to allocate a new FixedArray
instead of
>   assuming the array was created with the correct size. This
simplifies
>   WasmModuleObject::New(), and matches what CompileToNativeModule()
>   does.
> * Remove the WasmModuleObject::New() constructor that creates a
>   NativeModule. This case was only used in DeserializeNativeModule()
and
>   in test code.
>
> Change-Id: I6bdfc425057f92de11abbbf702d052d40aa8267d
> Reviewed-on:
https://chromium-review.googlesource.com/c/v8/v8/+/1717497
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62925}

R=ahaas@chromium.org, clemensh@chromium.org
CC=binji@chromium.org

Change-Id: I03aa901a1df65af28f864d9aabe2b134ea132e99
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724213
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62996}
2019-07-30 20:43:55 +00:00
Deepti Gandluri
f6a05ec845 [wasm-simd] SIMD shifts should use register instead of immediates
- Add new instruction variants for psllq, psrlq (x64), vshl (ARM)
 - Add instruction selection, code generation for register shifts
 - Remove implicit immediate for shift operators
 - Fix interpreter, tests

Bug:v8:8934, v8:8460

Change-Id: I3481d7ba34a34f7792ff1a61d4a726a1a9abab8d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722198
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62995}
2019-07-30 19:51:55 +00:00
Joshua Litt
af4a7dc312 [scanner] fix edge case for parsing numeric separators
Numeric separators are not allowed in NonOctalDecimalIntegerLiterals.

Bug: v8:9437
Change-Id: Ic62b35b361de36fc622e207c140c365665021029
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722194
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62994}
2019-07-30 17:06:29 +00:00
Toon Verwaest
19810c489c [ic] Remove broken DCHECK and clean up naming
The DCHECK related to a time when dictionary mode prototypes were the payload
of complex data driven handlers. Now the additional data is used to hold
entirely different kinds of objects. The DCHECK made no sense anymore. Cleaning
up the names makes this clearer.

Bug: chromium:986187
Change-Id: I7173d7d2824396c04c01acb4ceb74693ee9ce6b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724215
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62993}
2019-07-30 16:22:08 +00:00
Ben L. Titzer
d187b07005 [d8] Add handlescope within message loop
D8 workers were leaking all messages due to a missing HandleScope
within the message loop. Add one to fix leaks.

R=verwaest@chromium.org
BUG=v8:9524

Change-Id: I2f2f6ba0b8c58bf38bf68b7464dffdf1d826a29d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724212
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62992}
2019-07-30 15:41:58 +00:00
Georgia Kouveli
207d6b35e9 [arm64] Reduce code size of deoptimization exits
Do not pass the deoptimization index in a register, instead infer it
from the address we made the deoptimization call from. This makes the
deoptimization exit sequence one instruction long instead of two.

This requires emitting all deoptimization exits at the end of the
function in a contiguous block, making sure no constant or veneer
pools are emitted in between. This means that soft deoptimizations
require an additional branch to the end of the function, which
counteracts the removal of the move instruction, however soft
deoptimizations are rare compared to eager and lazy ones.

This reduces the code size of optimised functions for benchmarks like
Octane and ARES-6 by about 4%.

Change-Id: I771f9104a07de7931a4bb9c5836e25fb55b1a2a4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714876
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62991}
2019-07-30 15:00:29 +00:00
Joyee Cheung
a6dd7f1c98 [class] parse private accessors
This patch adds:

- VariableMode::kPrivateMethod
- VariableMode::kPrivateSetterOnly
- VariableMode::kPrivateGetterOnly
- VariableMode::kPrivateGetterAndSetter

And replace the previous RequiresBrandCheckFlag by inferring
whether the brand check is required from these VariableModes.
It is then possible to check duplicate non-complementary
accessors in the parsers and throw early errors, and allow
complementary accessors to be associated with the same
private name variable.

This patch also adds the following AssignType:

- PRIVATE_METHOD
- PRIVATE_GETTER_ONLY
- PRIVATE_SETTER_ONLY
- PRIVATE_GETTER_AND_SETTER

corresponding to the new VariableModes so that it's possible
to generate specialized code for different type of
private accessor declarations.

Design doc: https://docs.google.com/document/d/10W4begYfs7lmldSqBoQBBt_BKamgT8igqxF9u50RGrI/edit

Bug: v8:8330
Change-Id: I0fb61b1be248630d1eadd74fb16d7d64a421f4c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1695204
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62988}
2019-07-30 13:26:01 +00:00
Andreas Haas
4df3db7b2e [wasm][ia32] Fix i64tof32 conversion on Windows
On Windows, the FP stack registers are used with less precision.
This causes rounding errors in the uint64 to float32 conversion.

This CL replaces the implementation based on FP stack registers
with an implementation based on bit operations. This implementation
is 2x slower than the original implementation.

An alternative would be to change the precision of the FP stack
registers just for the uint64 to float32 conversion. However, in a
micro-benchmark this is 5-6x slower than the original implementation.
It is also not clear if changing the precision could cause side
effects.

R=clemensh@chromium.org

Change-Id: Iaab6b6f258ff01e0c6e93f3632daf516fae3e74b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708486
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62986}
2019-07-30 12:30:09 +00:00
Thibaud Michaud
924ab19bcc Reland "[wasm] Compile JS to WASM wrappers asynchronously"
Revert reason should be fixed with this CL:
https://chromium-review.googlesource.com/c/v8/v8/+/1722554

The underlying problem was the isolate being accessed from the
background compilation thread. Other known places where the isolate was
used have also been fixed in these CLs:
https://chromium-review.googlesource.com/c/v8/v8/+/1722555
https://chromium-review.googlesource.com/c/v8/v8/+/1722559
https://chromium-review.googlesource.com/c/v8/v8/+/1722556

Original CL:
> Reland "[wasm] Compile JS to WASM wrappers asynchronously"
>
> Original CL had an issue with builtins being accessed through the
> isolate after the isolate died. See:
> https://ci.chromium.org/p/v8/builders/try.triggered/v8_win64_rel_ng_triggered/b8907837534672203296
>
> Initial upload is the original CL and the following patch sets will
> attempt to fix it.
>
> Original CL:
>
> > [wasm] Compile JS to WASM wrappers asynchronously
> >
> > R=mstarzinger@chromium.org, ahaas@chromium.org
> >
> > Bug: v8:9231
> > Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699
> > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#62672}
>
> R=​mstarzinger@chromium.org, ahaas@chromium.org
>
> Bug: v8:9231
> Change-Id: I1b01d5d2b9f728d6f6a90fe9b642f5ba3bf686eb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708485
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62918}

R=mstarzinger@chromium.org

Bug: v8:9231, v8:9554
Change-Id: I40443e7228eb26d6669e826e96073b20fa038c15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725619
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62985}
2019-07-30 12:28:39 +00:00
Sathya Gunasekaran
743ce7726d [WeakRefs] Make cleanup callback run as a task
Previously, this was run as a microtask and this CL changes it to run
as a separate task as mandated by the current WeakRef spec.

This CL also introduces a FinalizationGroup type to the V8 API
representing the JSFinalizationGroup. This has a `Cleanup`
function that runs the cleanup callback associated with it.

SetHostCleanupFinalizationGroupCallback is added to set
the embedder defined HostCleanupFinalizationGroupCallback.

ClearKeptObject is exposed on the v8::Isolate to reset the strongly
held set of objects.

The general workflow is the following:

(a) When the GC notices that a given finalization group has dirty
    cells, it calls HostCleanupFinalizationGroupCallback with the given
    finalization group.

(b) As part of HostCleanupFinalizationGroupCallback, the embedder
    enqueues a task that at some point later calls
    FinalizationGroup::Cleanup.

(c) At some point in the future, FinalizationGroup::Cleanup is called,
    which runs the cleanup callback of the finalization group.

This patch also includes d8 changes to use these new APIs. Currently,
d8 cycles through the enqueued finalization groups after a synchronous
turn (and it's microtask checkpoint) and runs the cleanup callbacks.

Change-Id: I06eb4da2c103b2792a9c62bc4b98fd4e5c4892fc
Bug: v8:8179
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655655
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62984}
2019-07-30 12:19:39 +00:00
Toon Verwaest
a4dd93bf29 [parser] Validate the target of property access assignment as expression
This drops possible remaining pattern errors from the access target. This is
necessary since sub patterns with default values (assignment expression) aren't
otherwise identifiable as being property accesses.

Bug: v8:9560
Change-Id: Ie6781c0d161e00790268f7d9db81377d045f93b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725624
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62982}
2019-07-30 11:41:59 +00:00
Dominik Inführ
036140dc10 [heap] Limit size of semi space
FLAG_max_semi_space_size could be used to allow arbitrarily huge semi
spaces. Limit semi space size to kMaxSemiSpaceSize also in the case
this flag is used.

Change-Id: Id52cea6ef73eb1957265cf38c109dd490d7feccc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725618
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62980}
2019-07-30 11:00:49 +00:00
Tobias Tebbi
b0801678d5 [csa] block cloning to optimize branch on phi
This allows to return bool values from Torque macros and branch on them
without performance penalty, reconstructing good control flow.

Drive-by cleanup: Delete EnsureDeferredCodeSingleEntryPoint(), since
it's no longer needed. Constructing a graph and then re-inferring
deferred blocks based on branch hints achieves this effect
automatically.

Bug: v8:7793
Change-Id: Idb6802372b407549e4760f290933d5b8f1e9d952
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1681132
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62979}
2019-07-30 10:30:29 +00:00
Yuki Shiino
edacd8000a Invoke access-check-interceptor in GetOwnPropertyDescriptor
Object::Get, Set, etc. properly invoke an interceptor
registered via SetAccessCheckCallbackAndHandler, however,
Object::GetOwnPropertyDescriptor does not invoke
an interceptor.

This patch supports access-check-interceptor for
descriptors.

Change-Id: Ie2b2f2456be95c6eef8c2cdfee2bdd651c011fa3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720969
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Yuki Shiino <yukishiino@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62978}
2019-07-30 10:04:39 +00:00
Leszek Swirski
51afbd1a46 Revert "[regexp] Better quick checks on loop entry nodes"
This reverts commit 4b15b984ad.

Reason for revert: UBSan failure (https://logs.chromium.org/logs/v8/buildbucket/cr-buildbucket.appspot.com/8906578530303352544/+/steps/Check/0/logs/regress-126412/0).

Original change's description:
> [regexp] Better quick checks on loop entry nodes
> 
> Like the predecessor change https://crrev.com/c/v8/v8/+/1702125 , this
> change is inspired by attempting to exit earlier from generated RegExp
> code, when no further matches are possible because any match would be
> too long. The motivating example this time is the following expression,
> which tests whether a string of Unicode playing cards has five of the
> same suit in a row:
> 
> /([🂡-🂮]{5})|([🂱-🂾]{5})|([🃁-🃎]{5})|([🃑-🃞]{5})/u
> 
> A human reading this expression can readily see that any match requires
> at least 10 characters (5 surrogate pairs), but the LoopChoiceNode for
> each repeated option reports its minimum distance to the end of a match
> as zero. This is correct, because the LoopChoiceNode's behavior depends
> on additional state (the loop counter). However, the preceding node, a
> SET_REGISTER action that initializes the loop counter, could confidently
> state that it consumes at least 10 characters. Furthermore, when we try
> to emit a quick check for that action, we could follow only paths from
> the LoopChoiceNode that are possible based on the minimum iteration
> count. This change implements both of those "could"s.
> 
> I expect this improvement to apply pretty broadly to expressions that
> use minimum repetition counts and that don't meet the criteria for
> unrolling. In this particular case, I get about 12% improvement on the
> overall UniPoker test, due to reducing the execution time of this
> expression by 85% and the execution time of another similar expression
> that checks for n-of-a-kind by 20%.
> 
> Bug: v8:9305
> 
> Change-Id: I319e381743967bdf83324be75bae943fbb5dd496
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1704941
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62963}

TBR=jgruber@chromium.org,seth.brenith@microsoft.com

Change-Id: Iac085b75e054fdf0d218987cfe449be1f1630545
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9305
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725621
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62977}
2019-07-30 09:48:31 +00:00
Clemens Hammacher
a73359202d Speed up compilation and execution of CSA_ASSERTs
Currently, each single CSA_ASSERT invokation creates its own lambda,
which is then wrapped in a {std::function} and passed to
{CodeStubAssembler::Assert}. It takes a lot of compile time for clang
to generate all the code for that.
This CL introduces a more light-weight alternative to
{CodeStubAssembler::Assert} which just receives the node directly.
This reduces compile time of {code-stub-assembler.cc} in optdebug mode
from ~30 seconds to ~17 seconds locally.

R=tebbi@chromium.org

Bug: v8:7629
Change-Id: I4520a7b587cb96319d75048cf11c1124be583d6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724370
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62976}
2019-07-30 08:36:25 +00:00
Richard Townsend
351654ba4f [arm64] Add missing base type to enum.
This fixes a build failure for arm64 on Windows.

Bug: v8:9564
Change-Id: I845b7687379ae12c27fa2924775553c83dc5d1ec
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724386
Commit-Queue: Richard Townsend <richard.townsend@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62975}
2019-07-30 08:19:55 +00:00
Ben L. Titzer
e0b18b9022 Reland "[d8] Remove maximum workers limitation"
This is a reland of a0728e869b

Original change's description:
> [d8] Remove maximum workers limitation
> 
> This CL refactors the lifetime management of the v8::Worker C++ object
> and in the process lifts the 100 maximum worker limitation. To do this,
> it uses a Managed<v8::Worker> heap object and attaches the managed to
> the API worker object.
> 
> R=mstarzinger@chromium.org
> BUG=v8:9524
> 
> Change-Id: I279b7aeb6645a87f9108ee6f572105739721cef4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715453
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62932}

Bug: v8:9524
Change-Id: I7d903fb12ddb00909a9429455f46c55db2fd02de
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722562
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62974}
2019-07-30 07:56:17 +00:00
Peter Marshall
2e74bec6a0 [cpu-profiler] Ignore repeat source positions in the CPU profiler
We can get repeated positions from optimized code objects in some cases
but for our purposes of looking up a line number from a PC, we can only
return one line number so just use the first one that is reported in
the source position table on the code object.

Change-Id: I4c0e866fb1948f65bf6c988d992ef55f520dd874
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724375
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62972}
2019-07-30 06:49:16 +00:00
Simon Zünd
92ad6fcb2a [cleanup] Only include halfsiphash.h when libsiphash is used
R=yangguo@chromium.org

Change-Id: If4c158e339b603268563223d900e6879f43ec63b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725611
Commit-Queue: Simon Zünd <szuend@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62971}
2019-07-30 06:43:56 +00:00
Ng Zhi An
6aac01f3ff Fix f32x4 min and max in wasm-interpreter
-0.0 and 0.0 compare equals, so a < b ? a : b for min would pick b
incorrectly. We need to use JS semantics here, which returns -0.0.

Bug: v8:8425
Change-Id: I8ab094b566ece9c586de86aad4594dfdf8da930b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724802
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62969}
2019-07-30 00:32:28 +00:00
Deepti Gandluri
237e8c2c7b [wasm-simd] Use movddup instead of pshufd for 64x2 splats
Performance is comparable on newer hardware, movddup performs slightly
better on older chips

Change-Id: Ic3248dd2807bf2c49311cba45ba4f0e8baa47730
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715981
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62968}
2019-07-30 00:25:48 +00:00
Ng Zhi An
8a5a1a68b2 [wasm-simd] Implement I64x2 AnyTrue AllTrue for arm64
Bug: v8:8460
Change-Id: I1ba49fed9500f0cadd307da02a3b6a0d1a5e2785
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1721711
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62967}
2019-07-29 23:34:06 +00:00
Ng Zhi An
f57efec544 [wasm-simd] Implement I64x2 Gt Ge Lt Le signed and unsigned for arm64
Bug: v8:8460
Change-Id: I185b110df3832dfd1b657d04a85efc96628b02b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719038
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62966}
2019-07-29 21:55:02 +00:00
Georg Neis
6636420fce [turbofan] Second part of brokerization/serialization for instanceof
Serialize for all cases of JSNativeContextSpecialization::ReduceJSInstanceOf.

Bug: v8:7790
Change-Id: I147991353b86619808257a92961b7051105511f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722558
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62965}
2019-07-29 18:19:35 +00:00
Ng Zhi An
e016562bf9 [wasm-simd] Implement I64x2 Add Sub Eq Ne for arm64
Bug: v8:8460
Change-Id: I1307b2b7daa33c621501489619ae5f6913354db4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719037
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62964}
2019-07-29 17:48:04 +00:00
Seth Brenith
4b15b984ad [regexp] Better quick checks on loop entry nodes
Like the predecessor change https://crrev.com/c/v8/v8/+/1702125 , this
change is inspired by attempting to exit earlier from generated RegExp
code, when no further matches are possible because any match would be
too long. The motivating example this time is the following expression,
which tests whether a string of Unicode playing cards has five of the
same suit in a row:

/([🂡-🂮]{5})|([🂱-🂾]{5})|([🃁-🃎]{5})|([🃑-🃞]{5})/u

A human reading this expression can readily see that any match requires
at least 10 characters (5 surrogate pairs), but the LoopChoiceNode for
each repeated option reports its minimum distance to the end of a match
as zero. This is correct, because the LoopChoiceNode's behavior depends
on additional state (the loop counter). However, the preceding node, a
SET_REGISTER action that initializes the loop counter, could confidently
state that it consumes at least 10 characters. Furthermore, when we try
to emit a quick check for that action, we could follow only paths from
the LoopChoiceNode that are possible based on the minimum iteration
count. This change implements both of those "could"s.

I expect this improvement to apply pretty broadly to expressions that
use minimum repetition counts and that don't meet the criteria for
unrolling. In this particular case, I get about 12% improvement on the
overall UniPoker test, due to reducing the execution time of this
expression by 85% and the execution time of another similar expression
that checks for n-of-a-kind by 20%.

Bug: v8:9305

Change-Id: I319e381743967bdf83324be75bae943fbb5dd496
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1704941
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62963}
2019-07-29 17:36:45 +00:00
Dan Elphick
4189da7b0e [parsing] Fix bytecode mismatch for arrow funcs
Fixes a bytecode mismatch for arrow functions with default arguments
between eager and lazy compilation. In the former case, parameters with
default values are marked as assigned even if the value never changes
within the function because the parser does not know it's an
arrow-function at the point it sees the assignment.

So this changes ArrowHeadParsingScope::ValidateAndCreateScope to clear
the is_assigned flag on its parameter VariableProxies before it binds
them.

Bug: chromium:988304, v8:8510
Change-Id: I68bf205c73471386181e5fdcec6c8c3b2e527c8f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724384
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62962}
2019-07-29 16:30:10 +00:00
Joey Gouly
556e4859bb [deoptimizer, cleanup] Don't store values of single precision fp registers
Instead of storing the values of the single precision floating point registers,
get their values from the aliased double precision registers.

This saves, on arm64, 184 bytes per deoptimisation kind function (552 in total)
and 128 bytes in the RegisterValues class.

Change-Id: I681ad46efbb610e94d1e45871e012d2c0a3cfa3b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669687
Commit-Queue: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62961}
2019-07-29 16:01:28 +00:00
Darius Mercadier
a250aa77bb [heap] add specialized freelist for maps
Bug: v8:9329
Change-Id: Ic9b107667e90ef975240e915fec86d6bf0692f8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720818
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62960}
2019-07-29 14:27:37 +00:00
Clemens Hammacher
0cabc6a0e5 Reland "[utils] Make BitField final"
This is a reland of 658ff20085

Original change's description:
> [utils] Make BitField final
> 
> We have hundreds of classes that derive from {BitField} without adding
> any functionality. This CL switches all such occurrences to 'using'
> declarations instead.
> 
> Before:
>   class MyBitField : public BitField<int, 6, 4, MyEnum> {};
> After:
>   using MyBitField = BitField<int, 6, 4, MyEnum>;
> 
> This might reduce compilation time by reducing the number of existing
> classes.
> 
> The old pattern is forbidden now by making {BitField} final.
> 
> R=yangguo@chromium.org
> 
> Bug: v8:9396, v8:7629
> Change-Id: I8a8364707e8eae0bb522af2459c160e3293eecbb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722565
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62956}

Bug: v8:9396, v8:7629
Change-Id: Ic68541af9d1e8d0340691970922f282b24a9767f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724379
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62959}
2019-07-29 14:20:58 +00:00
Clemens Hammacher
753a07db03 Revert "[utils] Make BitField final"
This reverts commit 658ff20085.

Reason for revert: Fails no-i18n bot: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20noi18n%20-%20debug/27826

Original change's description:
> [utils] Make BitField final
> 
> We have hundreds of classes that derive from {BitField} without adding
> any functionality. This CL switches all such occurrences to 'using'
> declarations instead.
> 
> Before:
>   class MyBitField : public BitField<int, 6, 4, MyEnum> {};
> After:
>   using MyBitField = BitField<int, 6, 4, MyEnum>;
> 
> This might reduce compilation time by reducing the number of existing
> classes.
> 
> The old pattern is forbidden now by making {BitField} final.
> 
> R=​yangguo@chromium.org
> 
> Bug: v8:9396, v8:7629
> Change-Id: I8a8364707e8eae0bb522af2459c160e3293eecbb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722565
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62956}

TBR=yangguo@chromium.org,clemensh@chromium.org

Change-Id: I50234a09c77aa89fdcf1e01c2497cc08d3ac79a8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9396, v8:7629
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1724377
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62958}
2019-07-29 13:17:50 +00:00
Thibaud Michaud
b8a50cf739 [wasm] Remove unused stack limit in export wrappers
R=mstarzinger@chromium.org

Bug: v8:9554
Change-Id: Id09bb2d98ae62fcbd7b444d467d7ff446991f020
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722555
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62957}
2019-07-29 12:52:53 +00:00
Clemens Hammacher
658ff20085 [utils] Make BitField final
We have hundreds of classes that derive from {BitField} without adding
any functionality. This CL switches all such occurrences to 'using'
declarations instead.

Before:
  class MyBitField : public BitField<int, 6, 4, MyEnum> {};
After:
  using MyBitField = BitField<int, 6, 4, MyEnum>;

This might reduce compilation time by reducing the number of existing
classes.

The old pattern is forbidden now by making {BitField} final.

R=yangguo@chromium.org

Bug: v8:9396, v8:7629
Change-Id: I8a8364707e8eae0bb522af2459c160e3293eecbb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722565
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62956}
2019-07-29 12:50:32 +00:00
Thibaud Michaud
0df7f62c44 [wasm] Use wasm engine allocator for export wrappers
Prefer using the wasm engine's allocator, as the isolate may not be
available during asynchronous compilation.

Bug: v8:9554
Change-Id: Iee3777efb62d18de6b2a64fa7a71d4ef4c6b3a92
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722559
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62955}
2019-07-29 12:46:22 +00:00
Michael Starzinger
58f1b315e1 [wasm][cleanup] Use Vector<Node*> instead of Node** more.
R=clemensh@chromium.org
BUG=v8:9396

Change-Id: Ic1c49aed8110b982ca793ba5ee94d5135619c2fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722567
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62954}
2019-07-29 12:41:02 +00:00
Michael Starzinger
ba77172be1 [wasm] Make constructed {WebAssembly.Function} callable.
This makes function objects constructed via the {WebAssembly.Function}
constructor callable directly from JavaScript (not just from within
WebAssembly modules). Semantics are as if the function performed the
transition JS-to-Wasm and then Wasm-to-JS in sequence.

R=clemensh@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: Ic7dcf36ccfda1b473f2541e49419f4d2ee38bc2c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720809
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62953}
2019-07-29 11:29:32 +00:00
Clemens Hammacher
695c40f08e [csa] Fix for debug build in MSVC
The preprocessor of MSVC works differently for empty __VA_ARGS__.
Another hack is needed to make this compile in both MSVC and clang.

R=tebbi@chromium.org

Bug: v8:9555
Change-Id: Ie8f2e1ed302730419dae95e49ab0cca35a4a8131
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720669
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62952}
2019-07-29 10:58:42 +00:00
Georg Neis
282dec2fbd [turbofan] Pass a read-only value by const-reference rather than pointer
Change-Id: I7dbc632ea3eff419d6670519f7005382e2cadce4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720815
Auto-Submit: Georg Neis <neis@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62951}
2019-07-29 10:41:42 +00:00
Darius Mercadier
8318fcfb2a [heap] Add tracing of allocations origins
Bug: v8:9329
Change-Id: Id92ab58179a5b5765560f22beefef842055d7e28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715461
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62950}
2019-07-29 09:58:24 +00:00
Thibaud Michaud
eb3935f409 [wasm] Pass enabled features argument to export wrapper compilation
In export wrapper compilation, the isolate was used to get enabled
features. This prevents asynchronous compilation, so this is replaced
with an enabled_features argument passed from the main thread.

R=mstarzinger@chromium.org

Bug: v8:9554
Change-Id: Iab8a090841170dc235273dda58997cde716ee13f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722554
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62949}
2019-07-29 09:21:34 +00:00
Jakob Gruber
c6b1ef0efb [regexp] Restructure fast path check logic
Prior to this CL, the regexp fast path check is stricter than it
needs to be. For example, adding any arbitrary property on the regexp
prototype would move the execution of all regexp builtins in the same
context onto the slow path. This actually happens in the real world:
popular web frameworks commonly monkey-patch builtin prototypes to add
functionality.

The intent of this CL is to widen the fast path for regexp builtins s.t.
modifications of the prototype that do not conflict with our
requirements stay on the fast path.

This is done by extending the current fast path check with an
additional step. If checking the prototype map identity or
relevant prototype property constness fails, we now compare the actual
value of all relevant properties against the expected value. If these
match, the prototype can be considered fast.

The new step as described in the previous paragraph is part of the
permissive fast path check (BranchIfFastRegExp_Permissive). The strict
variant (BranchIfFastRegExp_Strict) is also still required by a few
spots. We should refactor these to also allow the permissive check in
follow-up work.

Bug: v8:5577,chromium:977382
Change-Id: I69b2244e68ccfbd00edf17fc326aa4b5f5d089fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1706056
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62948}
2019-07-29 08:44:33 +00:00
Thibaud Michaud
6cb6f8ee04 [wasm] Load undefined value from the wasm instance
In export wrappers generated code, load the undefined value from the
wasm instance rather than from the isolate. With asynchronous
compilation, the isolate may not be available.

R=mstarzinger@chromium.org

Bug: v8:9554
Change-Id: Ic448bda82c2125fc9c9f8715bce26870308715d2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1722556
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62946}
2019-07-29 08:15:32 +00:00
Ng Zhi An
9f3f2d5b8c [wasm-simd] Implement I64x2 Neg for arm64
Bug: v8:8460
Change-Id: Ia9ffb214738fca17fc36a4323d5e6c4d82a36f2a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719036
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62945}
2019-07-27 00:28:12 +00:00
Andrew Comminos
8f97640136 [cpu-profiler] Enable logging for the lifetime of each CpuProfiler
Implements ProfilerCodeObserver, a class to track the generation and
movement of code on the heap for the lifetime of each CpuProfiler. When
sampling is inactive, logged code is committed directly to the CodeMap.
During profiling, ProfilerCodeObserver redirects these events onto the
profiling thread for later dispatch.

Bug: v8:9151
Change-Id: Ib5b152446d2a3838e1b00a80253fc4fbd2f6e8c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1604143
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Andrew Comminos <acomminos@fb.com>
Cr-Commit-Position: refs/heads/master@{#62943}
2019-07-26 19:57:02 +00:00
Seth Brenith
5ce023df29 [regexp] Stricter bounds checks in interpreter
This change updates the RegExp bytecode generator to emit checks for
larger eats_at_least values when they are available, so we can fail to
match earlier in some cases.

Bug: v8:9305
Change-Id: I96740531e142ff8dced41c49b774845b07df6ae6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709768
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62942}
2019-07-26 15:38:12 +00:00
Santiago Aboy Solanes
0e8215eaee [ptr-compr][turbofan] Remove unneeded CheckedTaggedToTaggedPointer conversion
In some cases, we end up with a ChangeCompressedPointerToTaggedPointer next
to a CheckedTaggedToTaggedPointer. In this case, the checked one is not
needed since we are sure we are dealing with a pointer (and not a Smi).

This doesn't get resolved in the simplfied lowering phase due to having a
Phi[Tagged] in the middle of those two nodes.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: Ia4a44b36423c2242d5c663f9b93b09924190fe8e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709426
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62941}
2019-07-26 14:55:21 +00:00
Santiago Aboy Solanes
dc76a4da20 [ptr-compr] Add method that checks sminess in 32 bits
If we are sure that we are dealing with a Compressed value, we can check
for sminess in 32 bits.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: Icf77d8bcd1decfd392b4887241a9b559f11814c4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718146
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62940}
2019-07-26 14:53:41 +00:00
Georg Schmid
35a613555c [torque] Replace ReferenceType by generic Torque struct Reference<T>
This CL removes the built-in reference type in favor of a Torque-implemented generic struct, i.e., internal::Reference<T>. It also adds various infrastructure for getting and creating new generic struct instances, as well as matching against them.

R=tebbi@chromium.org

Change-Id: I1e3d6afe355a0603fa9c3ad789c6b8a97d1b3c26
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718148
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62939}
2019-07-26 14:26:51 +00:00
Santiago Aboy Solanes
0a424ac1a5 [ptr-compr][gc] Propagate tenuring in StoreField with Compress nodes.
The propagation of tenuring from outer allocations to inner allocations
was blocked in pointer compression since we now had Compress nodes between
AllocateRaw and StoreField.

This was causing issues in GC. It popped up in the Octane2.1/Splay
benchmark, where we had big regressions.

This CL updates the memory optimizer so that it can use the Compress nodes
as bridges and can perform the optimization successfully. Note that the
Compress nodes only appear on the value input of the StoreField.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703, v8:9519
Change-Id: I6b0cc67955c6cc696e8c426b85c87a1794098ed0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714650
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62938}
2019-07-26 12:52:01 +00:00
Maya Lekova
e25fcd26b2 Revert "[d8] Remove maximum workers limitation"
This reverts commit a0728e869b.

Reason for revert: Times out on Windows & debug builds - https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20nosnap%20-%20shared/34484

Original change's description:
> [d8] Remove maximum workers limitation
> 
> This CL refactors the lifetime management of the v8::Worker C++ object
> and in the process lifts the 100 maximum worker limitation. To do this,
> it uses a Managed<v8::Worker> heap object and attaches the managed to
> the API worker object.
> 
> R=​mstarzinger@chromium.org
> BUG=v8:9524
> 
> Change-Id: I279b7aeb6645a87f9108ee6f572105739721cef4
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715453
> Commit-Queue: Ben Titzer <titzer@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62932}

TBR=mstarzinger@chromium.org,titzer@chromium.org,clemensh@chromium.org

Change-Id: I3a27937cba13b5413390f49268a107c184515153
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9524
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1720590
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62937}
2019-07-26 12:38:26 +00:00
Dan Elphick
f47cbb28ab [parsing] Improve elision of hole checks for default parameters
Use the position of commas in arrow expressions to mark the initializer
position of any parameters that might have been set in the preceding
parameter.

To enable this, this makes variable_list_ in ExpressionParsingScope a
ScopedList<pair<VariableProxy*, int>> and changes ScopedList::at to
return references so its elements can be modified in place.

This fixes a source of bytecode mismatches when collecting source
positions lazily and is a second attempt at fixing this after
https://chromium-review.googlesource.com/c/v8/v8/+/1683267 introduced
problems due to destructuring.

Bug: chromium:980422, chromium:981701, v8:8510
Change-Id: I948f89f34fb75d7463a13183e363f7f96ad09d13
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710671
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62936}
2019-07-26 12:15:31 +00:00
Ulan Degenbaev
5c95dbda9e Revert "[snapshot] Fix clearing of feedback vector in serializer (follow-up 2)"
This reverts commit 1320c917dd.

Reason for revert: The code in SFI is also flushed by the serializer with FunctionCodeHandling::kClear, so this fix does not work with --no_flush_bytecode.

Original change's description:
> [snapshot] Fix clearing of feedback vector in serializer (follow-up 2)
> 
> Bug: v8:7857
> Change-Id: I3940ae2830adb6c572e079551b7bba7d84462afd
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715444
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62881}

TBR=ulan@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7857
Change-Id: If85fe29b2cdf6523ee53895628da38d942d45c2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719190
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62935}
2019-07-26 12:14:01 +00:00
David Carlier
c09aff1721 random number generator seeding update for macOS
using file descriptor's free approach instead.

Change-Id: I9baa3d471b4ed6f624985a5b6325648ef7875596
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1710665
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62933}
2019-07-26 11:55:01 +00:00
Ben L. Titzer
a0728e869b [d8] Remove maximum workers limitation
This CL refactors the lifetime management of the v8::Worker C++ object
and in the process lifts the 100 maximum worker limitation. To do this,
it uses a Managed<v8::Worker> heap object and attaches the managed to
the API worker object.

R=mstarzinger@chromium.org
BUG=v8:9524

Change-Id: I279b7aeb6645a87f9108ee6f572105739721cef4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715453
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62932}
2019-07-26 11:50:51 +00:00
Georg Neis
0a47bc63f3 [turbofan] Eliminate more non-const reference arguments
... mostly by turning them into pointer arguments.

After this CL, all remaining non-const reference arguments in
the compiler directory are in the backend.

Bug: v8:9429
Change-Id: I6a546da0fe93179e1a0b12296632591cbf209808
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719185
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62930}
2019-07-26 09:33:08 +00:00
Ng Zhi An
0cedd8649b [wasm-simd] Implement I64x2 Shl ShrS ShrU for arm64
Bug: v8:8460
Change-Id: I70bdd71909fd103f3cc537d3184d2f7225cf8cfa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719034
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62929}
2019-07-25 23:51:18 +00:00
Ng Zhi An
1a1138f57a [wasm-simd] Implement I64x2 splat extract_lane replace_lane for arm64
Bug: v8:8460
Change-Id: Ic92efbcb7c64184c237d0fb00c3c7aa75323a3e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717662
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62928}
2019-07-25 23:19:48 +00:00
Zhi An Ng
11e27b5e6a Revert "Reland "[wasm] Compile JS to WASM wrappers asynchronously""
This reverts commit 801930f5f5.

Reason for revert: blink layout tests failure https://bugs.chromium.org/p/v8/issues/detail?id=9554

Original change's description:
> Reland "[wasm] Compile JS to WASM wrappers asynchronously"
> 
> Original CL had an issue with builtins being accessed through the
> isolate after the isolate died. See:
> https://ci.chromium.org/p/v8/builders/try.triggered/v8_win64_rel_ng_triggered/b8907837534672203296
> 
> Initial upload is the original CL and the following patch sets will
> attempt to fix it.
> 
> Original CL:
> 
> > [wasm] Compile JS to WASM wrappers asynchronously
> >
> > R=mstarzinger@chromium.org, ahaas@chromium.org
> >
> > Bug: v8:9231
> > Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699
> > Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> > Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> > Reviewed-by: Andreas Haas <ahaas@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#62672}
> 
> R=​mstarzinger@chromium.org, ahaas@chromium.org
> 
> Bug: v8:9231
> Change-Id: I1b01d5d2b9f728d6f6a90fe9b642f5ba3bf686eb
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708485
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62918}

TBR=mstarzinger@chromium.org,thibaudm@chromium.org

Change-Id: I3a6829692614c44bacb764ef02723e61a3d61763
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9231
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719231
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62927}
2019-07-25 22:48:13 +00:00
Zhi An Ng
bf7284b90c Revert "[wasm] Simplify module creation"
This reverts commit 425fa3ae15.

Reason for revert: test failure https://bugs.chromium.org/p/v8/issues/detail?id=9554 reverting the root cause has merge conflicts due to changes in same file

Original change's description:
> [wasm] Simplify module creation
> 
> This includes WasmEngine::NewNativeModule() and WasmModuleObject::New().
> The intent is to make the various ways of creating a module (sync,
> async, deserialize, import) more similar.
> 
> After this change, a NativeModule will always be created before a
> WasmModuleObject. This will make it easier to look up a cached
> NativeModule given its wire bytes.
> 
> The following changes are made:
> 
> * Use WasmCodeManager::EstimateNativeModuleCodeSize() to find the code
>   size estimate by default. A different code size estimate is only used in
>   tests.
> * Change CompileJsToWasmWrappers() to allocate a new FixedArray instead of
>   assuming the array was created with the correct size. This simplifies
>   WasmModuleObject::New(), and matches what CompileToNativeModule()
>   does.
> * Remove the WasmModuleObject::New() constructor that creates a
>   NativeModule. This case was only used in DeserializeNativeModule() and
>   in test code.
> 
> Change-Id: I6bdfc425057f92de11abbbf702d052d40aa8267d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717497
> Commit-Queue: Ben Smith <binji@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62925}

TBR=binji@chromium.org,ahaas@chromium.org,clemensh@chromium.org

Change-Id: I8dcad7ddcd4601f657b6263bf22009907284fce3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1719230
Reviewed-by: Zhi An Ng <zhin@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62926}
2019-07-25 22:47:10 +00:00
Ben Smith
425fa3ae15 [wasm] Simplify module creation
This includes WasmEngine::NewNativeModule() and WasmModuleObject::New().
The intent is to make the various ways of creating a module (sync,
async, deserialize, import) more similar.

After this change, a NativeModule will always be created before a
WasmModuleObject. This will make it easier to look up a cached
NativeModule given its wire bytes.

The following changes are made:

* Use WasmCodeManager::EstimateNativeModuleCodeSize() to find the code
  size estimate by default. A different code size estimate is only used in
  tests.
* Change CompileJsToWasmWrappers() to allocate a new FixedArray instead of
  assuming the array was created with the correct size. This simplifies
  WasmModuleObject::New(), and matches what CompileToNativeModule()
  does.
* Remove the WasmModuleObject::New() constructor that creates a
  NativeModule. This case was only used in DeserializeNativeModule() and
  in test code.

Change-Id: I6bdfc425057f92de11abbbf702d052d40aa8267d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1717497
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62925}
2019-07-25 21:22:46 +00:00
Ng Zhi An
8c58e0513e [wasm simd] Implement I64x2 Min and Max on x64
Bug: v8:8460
Change-Id: I913406a4079c766432a56d059a6cb9861fd469bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1703993
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62924}
2019-07-25 18:13:16 +00:00
Bill Ticehurst
84a641faa1 Fix layout of the Space class for members accessed via an offset
Bug: v8:9118
Change-Id: I2271a158226a12f69a7efdfcb6c4faccccf98d15
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715090
Commit-Queue: Bill Ticehurst <billti@microsoft.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62923}
2019-07-25 17:23:14 +00:00
Ng Zhi An
f9b2f66579 [wasm simd] Implement F64x2 Add Sub Mul on x64
Bug: v8:8460
Change-Id: Ia9b2360c414abedfd9690e97b555c4e9b19fa1b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708451
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62922}
2019-07-25 17:05:54 +00:00
Georg Neis
f95124821e [turbofan] First part of brokerization/serialization for instanceof
- Move SerializePrototype out of DependOnStablePrototypes into
  ComputePropertyAccessInfo.
- Brokerize JSNativeContextSpecialization::InferHasInPrototypeChain.
- Brokerize JSNativeContextSpecialization::ReduceJSOrdinaryHasInstance
  (modulo the call to ReduceJSInstanceOf).
- Brokerize JSNativeContextSpecialization::ReduceJSHasInPrototypeChain.
- Serialize for JSCallReducer::ReduceObjectPrototypeIsPrototypeOf.
- Serialize for JSNativeContextSpecialization::ReduceJSInstanceOf. This
  is still incomplete.

Bug: v8:7790
Change-Id: Ic56eab5ddd8d725a13d2980e5b55db53ae82e822
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709408
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62920}
2019-07-25 14:39:54 +00:00
Seth Brenith
f42b1a5d5b [regexp] Use stricter bounds check to avoid additional iteration
The motivating example is JetStream 2's UniPoker test, which tests
whether a sorted string of Unicode playing cards contains a five-card
straight using a regular expression. In the top-level generated loop for
this RegExp, we see this loop exit condition:

00000350000C2067    27  83fffe         cmpl rdi,0xfe
00000350000C206A    2a  0f8da8e40000   jge 00000350000D0518  <+0xe4d8>

Meaning if the current position is pointing at the very last (16-bit)
character, then we exit the loop. Otherwise we go on and try to find
various matches starting at the current position. However, we can see
in the original expression that any possible match is at least 10
characters (5 astral-plane Unicode values), so we're wasting a lot of
time attempting to find matches in cases where we're too close to the
end of the string for any match to succeed.

This example might be a bit contrived, but I expect that an improvement
in this bounds check would help a larger family of regular expressions,
where the minimum match length is large relative to the string being
matched and we don't meet the other necessary criteria for fast Boyer-
Moore lookahead.

To get the desired bounds check in this case, this patch does the
following:
1. Compute accurate EatsAtLeast values for every node during the
   analysis phase. This could end up doing more work than the current
   implementation, but analysis already has to touch every node, so it
   seems like a cache-friendly time to compute these values. In some
   cases, this might be less total work than the current implementation,
   because the current implementation might recompute the same node
   multiple times.
2. When emitting a quick check, use the EatsAtLeast value from the
   predecessor ChoiceNode for the bounds check.

This improves the UniPoker score on my machine by about 4%, because it
cuts the time spent checking for straights roughly in half, and checking
for straights originally accounted for about 8% of the total time.

Bug: v8:9305
Change-Id: I110b190c2578f73b2263259d5aa5750e921b01be
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1702125
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62919}
2019-07-25 14:24:34 +00:00
Thibaud Michaud
801930f5f5 Reland "[wasm] Compile JS to WASM wrappers asynchronously"
Original CL had an issue with builtins being accessed through the
isolate after the isolate died. See:
https://ci.chromium.org/p/v8/builders/try.triggered/v8_win64_rel_ng_triggered/b8907837534672203296

Initial upload is the original CL and the following patch sets will
attempt to fix it.

Original CL:

> [wasm] Compile JS to WASM wrappers asynchronously
>
> R=mstarzinger@chromium.org, ahaas@chromium.org
>
> Bug: v8:9231
> Change-Id: I9e18073bbe25bf8c9c5f9ace102316e6209d0459
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1669699
> Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62672}

R=mstarzinger@chromium.org, ahaas@chromium.org

Bug: v8:9231
Change-Id: I1b01d5d2b9f728d6f6a90fe9b642f5ba3bf686eb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1708485
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62918}
2019-07-25 13:44:14 +00:00
Santiago Aboy Solanes
31518ccc0e [ptr-compr] Avoid (de)compressions in CheckSmi
Avoids unnecessary compression and decompression nodes since we
are going to be able to check for smis without needing to decompress and
re-compress.

It was doing a CheckedInt32ToTaggedSigned ->
ChangeTaggedSignedToCompressedSigned combo, where we could just do
CheckedInt32ToCompressedSigned.

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng
Cq-Include-Trybots: luci.v8.try:v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:7703
Change-Id: I0bbbbb5bd4744c49840c84b2fcb775fe6b603de0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1714878
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62917}
2019-07-25 13:36:53 +00:00
Tobias Tebbi
a6c859f9bc [torque] disallow tail calls from macros
Bug: v8:7793
Change-Id: I36daa0ef26cc7c274c64cfdba7e3a196677a7bc4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718156
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62916}
2019-07-25 13:20:32 +00:00
Georg Neis
52dbefd66a [turbofan] Remove some obsolete serialization calls
Bug: v8:7790
Change-Id: I774601b25f4dbe104875d18c03e17244efc1a0e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718157
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62915}
2019-07-25 13:15:02 +00:00
Leszek Swirski
b50ee58ca7 [obj-stats] Count more field types (Smi, boxed double, string)
Distinguish between generic Tagged and Smi in-object fields, and special
case (boxed) double values and string data rather than lumping those
into generic "raw data"

Change-Id: I5d635434ab94065c077a40110948424c31ead73d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718154
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62914}
2019-07-25 13:04:12 +00:00
Mathias Bynens
dd7190a979 [regexp] Add UseCounter for matchAll with non-g RegExp
Per the July TC39 meeting consensus, we'd like to make the
upcoming String.prototype.replaceAll proposal throw for
non-global RegExp searchValues. However,
String.prototype.matchAll currently does not throw in this
case, causing consistency concerns.

This patch adds a use counter for String.prototype.matchAll
with a non-global RegExp as the searchValue. Hopefully, this
pattern isn't too common in real-world code today, in which case
we can both a) change matchAll and b) proceed with the desired
replaceAll semantics.

https://github.com/tc39/proposal-string-replaceall/issues/16

V8 CL: https://chromium-review.googlesource.com/c/v8/v8/+/1718145
Chromium CL: https://chromium-review.googlesource.com/c/chromium/src/+/1718367

BUG=v8:9551

Change-Id: Ica660a0a6189d84c3d33398c98305d0bcb9f8c23
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718145
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62913}
2019-07-25 12:53:02 +00:00
Leszek Swirski
61a3f827ee [ptr-compr] Fix literal field copy iteration size
When iterating over fields to copy, we should copy kTagged-sized fields,
not kPointer-sized fields, to avoid overwriting something allocated after
the last slot of an object if the end of the object isn't kPointer
aligned.

Bug: v8:8948
Change-Id: Ic3d933157ca1962a779dba6ae58facb558d75ca0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718151
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62912}
2019-07-25 12:49:33 +00:00
Clemens Hammacher
9afbef1ebe [wasm] Grow reserved code space exponentially
If a new code allocation request cannot be fulfilled, do not just
reserve enough to fulfill this one request, but request at least 20
percent of the total reserved code space so far. This ensures that
the reserved space grows exponentially instead of linearly.

R=mstarzinger@chromium.org

Bug: chromium:987560
Change-Id: I3fc4dd0f7acee2a380495a87c0425c58058551bc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1718144
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62910}
2019-07-25 11:03:40 +00:00
Santiago Aboy Solanes
7f1304755b [turbofan][cleanup] Do a Word32Equal since inputs are 32 bits
The two inputs are a Word32And and an Int32Constant. There is no need to
do this in 64 bits.

Bug: v8:9396
Change-Id: Ie564ac2f43e98192bf9853855b6c766248264886
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715462
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62909}
2019-07-25 10:28:10 +00:00
Maya Lekova
60d2018f1f Reland "[turbofan] Brokerize Function.prototype.bind"
This is a reland of 49f8323f7c

Re-applied previous fix for an undefined symbol,
changing std::max to i::Max.

Original change's description:
> [turbofan] Brokerize Function.prototype.bind
>
> Bug: v8:7790
> Change-Id: I2985f5740b947445723ce0f5072a32be48d22be1
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709410
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62895}

Bug: v8:7790
Change-Id: I1f141ea097054f069b94563e6140848e41c0ae1f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715459
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62908}
2019-07-25 09:39:40 +00:00
Yu Yin
484c155825 [mips][wasm] Access "CEntryStub" from the root set.
Port 5564356 https://crrev.com/c/1714656

Original Commit Message:

    This removes a shortcut to a "CEntryStub" from the instance object and
    instead loads those values via the root set which is also referenced
    from the instance. It makes instance objects smaller.

Change-Id: I62d16960cb18e3cd69c2fa56da85a6bfc6064db4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1716473
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#62907}
2019-07-25 08:59:18 +00:00
Andreas Haas
81efb932b5 [wasm][bulk-memory] Adjust elem and data segment to recent spec changes
R=binji@chromium.org

Change-Id: I8eeff7dbc92749c4b9ea6bedd9123b9e6635ab5c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1709048
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62906}
2019-07-25 08:40:27 +00:00
Patrick Thier
3a0f407d26 Reland "Reland "[regexp] Call the regexp interpreter without CEntry overhead""
This is a reland of c2ee4a7999

Original change's description:
> Reland "[regexp] Call the regexp interpreter without CEntry overhead"
> 
> This is a reland of d4d28b73cb
> 
> Original change's description:
> > [regexp] Call the regexp interpreter without CEntry overhead
> > 
> > Previously all RegExp calls went through Runtime_RegExpExec when --regexp-interpret-all was set.
> > 
> > This CL avoids the runtime overhead by calling into the interpreter directly from the RegExpExec Builtin when the regular expression subject was already compiled to ByteCode (i.e. after the first call).
> > 
> > Bug: v8:8954
> > Change-Id: Iae9dfcef3370b772a05b2942305335d592f6f15a
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1698391
> > Commit-Queue: Patrick Thier <pthier@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Peter Marshall <petermarshall@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#62753}
> 
> Bug: v8:8954
> Change-Id: I1f0b6de9c6da65bcb582ddb41a37419116a5c510
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1706053
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Patrick Thier <pthier@google.com>
> Cr-Commit-Position: refs/heads/master@{#62794}

Bug: v8:8954
Change-Id: Ice77c05240f1fabd36bf97b8e789dd4c25a9718f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1715451
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62904}
2019-07-24 17:20:15 +00:00
Frank Tang
5bd577834b [Intl] Adding volume units.
Add 'fluid-ounce','gallon', 'liter', and 'milliliter'
Also roll ICU to 682a2309

Sync with https://github.com/tc39/proposal-unified-intl-numberformat/pull/48


Bug: v8:9475
Change-Id: If45a20f17f5973b860893b0f70e724cc93c6550a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1699759
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jungshik Shin <jshin@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62903}
2019-07-24 17:16:46 +00:00
Daniel Clark
61e2b67ecd Move potentially reentrant allocation out of the middle of Module::Reset
During Module::Reset(), the module is in an unstable state between the
change to SourceTextModule::code and Module::status.  Any reentrancy
between these points is problematic because the normal invariants about
the value of SourceTextModule::code in relation to Module::status do not
hold.

An allocation of the exports hash table in the middle of Module::Reset()
was causing reentrancy during this problematic time.  This change fixes
the issue by moving the allocation earlier in Reset() before any fields
are modified.

Bug: v8:9522
Change-Id: Ia941af60a0b31f05a6d8da610b9a270e7f79dac2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1712449
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Dan Clark <daniec@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62902}
2019-07-24 17:14:18 +00:00
Georgia Kouveli
7cb9984ef9 [arm64] Add support for pointer authentication instructions
Change-Id: I29c88d9e5de34e9a940b76ab76a40376d251c25f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1373781
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62901}
2019-07-24 17:00:26 +00:00
Bill Budge
95c7148d82 [wasm simd] Fix two reversing swizzles.
- Fixes bugs in x64 and ia32 reversing swizzles.

Change-Id: Iea0beccab804fd8e68dc58bc0fa11db46ac391c1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1330104
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62900}
2019-07-24 16:41:15 +00:00