Commit Graph

7210 Commits

Author SHA1 Message Date
neis
7ca7229283 [parsing] Be less pessimistic about maybe_assigned of parameters.
Instead of unconditionally setting maybe_assigned for parameters, treat
parameters like other variables except that at the end we set maybe_assigned if
the function has a sloppy arguments object.

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2578103002
Cr-Commit-Position: refs/heads/master@{#41731}
2016-12-15 16:04:44 +00:00
gsathya
b4aadaec1e [promisehook] Store promise in PromiseReactionJob
This will be used in PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2581503003
Cr-Commit-Position: refs/heads/master@{#41730}
2016-12-15 15:50:54 +00:00
clemensh
2ff5906231 [wasm] Make WasmRunner the central test structure
The WasmRunner now always holds a TestingModule, and allows to add
several functions to it. The prepares a change to always run wasm code
with a full module behind it, removing the special handling for "no wasm
instance" at runtime (http://crrev.com/2551053002).
This CL here also templatizes the WasmRunner such that the Call method must
be called with the same signature specified for the WasmRunner. This
already catched several mismatches there.

R=titzer@chromium.org, ahaas@chromium.org
BUG=v8:5620

Review-Url: https://codereview.chromium.org/2551043002
Cr-Commit-Position: refs/heads/master@{#41728}
2016-12-15 15:37:29 +00:00
franzih
0e7a2ca0d7 [runtime] Throw if re-declaring a non-configurable accessor.
If an accessor property is non-configurable, one should not be able
to re-declare it as a function. This specifically applies to special properties like window.location.

BUG=chromium:670596

Review-Url: https://codereview.chromium.org/2582493002
Cr-Commit-Position: refs/heads/master@{#41725}
2016-12-15 14:41:07 +00:00
ishell
f1441384ff [stubs] Remove CSA::INTEGER_PARAMETERS in favor of CSA::INTPTR_PARAMETERS.
BUG=

Review-Url: https://codereview.chromium.org/2580533002
Cr-Commit-Position: refs/heads/master@{#41722}
2016-12-15 14:01:07 +00:00
ahaas
7bd61b601c [wasm] Introduce the TrapIf and TrapUnless operators to generate trap code.
Some instructions in WebAssembly trap for some inputs, which means that the
execution is terminated and (at least at the moment) a JavaScript exception is
thrown. Examples for traps are out-of-bounds memory accesses, or integer
divisions by zero.

Without the TrapIf and TrapUnless operators trap check in WebAssembly introduces 5
TurboFan nodes (branch, if_true, if_false, trap-reason constant, trap-position
constant), in addition to the trap condition itself. Additionally, each
WebAssembly function has four TurboFan nodes (merge, effect_phi, 2 phis) whose
number of inputs is linear to the number of trap checks in the function.
Especially for functions with high numbers of trap checks we observe a
significant slowdown in compilation time, down to 0.22 MiB/s in the sqlite
benchmark instead of the average of 3 MiB/s in other benchmarks. By introducing
a TrapIf common operator only a single node is necessary per trap check, in
addition to the trap condition. Also the nodes which are shared between trap
checks (merge, effect_phi, 2 phis) would disappear. First measurements suggest a
speedup of 30-50% on average.

This CL only implements TrapIf and TrapUnless on x64. The implementation is also
hidden behind the --wasm-trap-if flag.

Please take a special look at how the source position is transfered from the
instruction selector to the code generator, and at the context that is used for
the runtime call.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2562393002
Cr-Commit-Position: refs/heads/master@{#41720}
2016-12-15 13:31:29 +00:00
ivica.bogosavljevic
ee7281f8ff MIPS[64]: Disable fusion multiple-accumulate instructions
MIPS[64]R6 supports only fusion multiply-accumulate instructions, and using
these causes failures of several tests that expect exact floating-point
results. Therefore we disable fusion multiply-accumulate in both emitted and
compiled code on R6.

TEST=cctest/test-run-machops/RunFloat64MulAndFloat64Add1,mjsunit/es6/math-expm1.js
mjsunit/es6/math-fround.js,mjsunit/compiler/multiply-add.js

BUG=

Review-Url: https://codereview.chromium.org/2569683002
Cr-Commit-Position: refs/heads/master@{#41717}
2016-12-15 11:50:12 +00:00
ishell
b5925c0ad0 [stubs] Enable machine graph verification for CodeStubAssembler and friends by default in debug mode.
BUG=

Review-Url: https://codereview.chromium.org/2570213002
Cr-Commit-Position: refs/heads/master@{#41715}
2016-12-15 11:45:18 +00:00
rmcilroy
ae741d042c [Interpreter] Allocate registers used as call arguments on-demand.
Allocate the registers used as arguments to a call on-demand after visiting the
argument (or reciever). This means that the visited expression can use registers
that would otherwise have been allocated for arguments which haven't been
visited yet.

The reason for doing this is to avoid keeping things live in registers
unecessarily for chained function calls, which avoids a memory leak for
functions which chain a large number of calls with large temporary arguments /
recievers.

BUG=chromium:672027

Review-Url: https://codereview.chromium.org/2557173004
Cr-Commit-Position: refs/heads/master@{#41714}
2016-12-15 10:59:57 +00:00
kozyatinskiy
3dea2c8354 Revert of Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID (patchset #11 id:190001 of https://codereview.chromium.org/2547483002/ )
Reason for revert:
LiveEdit is broken in some cases.

Original issue's description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Committed: https://crrev.com/6595e7405769dc9d49e9568d61485efc6d468baf
> Cr-Commit-Position: refs/heads/master@{#41600}

TBR=jgruber@chromium.org,verwaest@chromium.org,yangguo@chromium.org,jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5589,chromium:673950
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2578433002
Cr-Commit-Position: refs/heads/master@{#41684}
2016-12-14 02:05:05 +00:00
gsathya
3b1a09f56d [stubs] Add CSA::IsSymbol() and CSA::IsPrivateSymbol().
Review-Url: https://codereview.chromium.org/2571883002
Cr-Commit-Position: refs/heads/master@{#41682}
2016-12-13 23:13:20 +00:00
ishell
b5a9381a56 [interpreter][stubs] Enable graph verification for bytecode handlers and stubs included into snapshot.
BUG=

Review-Url: https://codereview.chromium.org/2575473002
Cr-Commit-Position: refs/heads/master@{#41676}
2016-12-13 13:55:29 +00:00
gsathya
dfa2660672 Add PromiseReactionJobInfo to CSA
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2573703002
Cr-Commit-Position: refs/heads/master@{#41674}
2016-12-13 13:22:15 +00:00
marja
0c827cd000 PreParsing inner funcs: Remove nonsense code from PreParser.
The assignment in default parameters (e.g., function foo(a = somedefault) { }
doesn't flow through PreParserFactory::NewAssignment even if the comment claims so.
Thus, piping through the variables is not needed.

Kudos to neis@ for pointing this out.

BUG=v8:5501
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2569983003
Cr-Commit-Position: refs/heads/master@{#41670}
2016-12-13 12:35:11 +00:00
yangguo
449829b85c [serializer] API to re-use global proxy in v8::Context::FromSnapshot.
R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2571743002
Cr-Commit-Position: refs/heads/master@{#41668}
2016-12-13 11:24:58 +00:00
mstarzinger
397a09afc5 Revert of [deoptimizer] Enable test that should no longer fail. (patchset #1 id:1 of https://codereview.chromium.org/2568723003/ )
Reason for revert:
Still flakes on ARM.

Original issue's description:
> [deoptimizer] Enable test that should no longer fail.
>
> R=jarin@chromium.org
> TEST=cctest/test-cpu-profiler/CollectDeoptEvents
>
> Committed: https://crrev.com/3f9c2c590d687562d6adb531d1159738c07013f4
> Cr-Commit-Position: refs/heads/master@{#41664}

TBR=jarin@chromium.org,machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2568403003
Cr-Commit-Position: refs/heads/master@{#41667}
2016-12-13 10:29:12 +00:00
ulan
ca9209d705 [heap] Special handling for small heaps in eager finalization of
incremental marking.

BUG=chromium:671994

Review-Url: https://codereview.chromium.org/2565173004
Cr-Commit-Position: refs/heads/master@{#41666}
2016-12-13 10:25:53 +00:00
mstarzinger
3f9c2c590d [deoptimizer] Enable test that should no longer fail.
R=jarin@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2568723003
Cr-Commit-Position: refs/heads/master@{#41664}
2016-12-13 09:19:38 +00:00
gsathya
2886e3917f [promises] Refactor CreatePromise
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2571663002
Cr-Commit-Position: refs/heads/master@{#41660}
2016-12-13 02:15:20 +00:00
bradnelson
aabbbec67c [wasm] [asmjs] Route asm.js warnings to the dev console.
Generalize Messages to include an error level.
Add a parameter to AddMessageHandler to select which error levels to receive, using a mask (default being just errors, i.e. the current behavior).

BUG=v8:4203
R=dgozman@chromium.org,machenbach@chromium.org,danno@chromium.org,bmeurer@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2526703002
Cr-Commit-Position: refs/heads/master@{#41648}
2016-12-12 14:48:50 +00:00
marja
64d9352a54 Preparsing inner funcs: be less pessimistic about maybe_assigned.
BUG=v8:5501, v8:5678

Review-Url: https://codereview.chromium.org/2539123002
Cr-Commit-Position: refs/heads/master@{#41645}
2016-12-12 14:45:16 +00:00
bradnelson
7659728be2 [wasm][asm.js] Forbid function declaration replacing variable declaration.
BUG=673240
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2568773002
Cr-Commit-Position: refs/heads/master@{#41638}
2016-12-12 12:27:14 +00:00
petermarshall
375fc067b0 [Ignition] Fix incorrect arg evaluation order for some super calls.
The evaluation order of this argument was accidentally changed when the
special-case was added for super calls with a final spread argument.

Review-Url: https://codereview.chromium.org/2563423002
Cr-Commit-Position: refs/heads/master@{#41633}
2016-12-12 08:46:01 +00:00
mstarzinger
50c5ac57de [deoptimizer] Fix Deoptimizer::GetDeoptInfo for last entry.
This fixes the corner-case where the method in question failed to lookup
the very last deoptimization bailout without subsequent entries within
the relocation info. Also enable a test covering this.

R=tebbi@chromium.org
TEST=cctest/test-cpu-profiler/CollectDeoptEvents

Review-Url: https://codereview.chromium.org/2565733002
Cr-Commit-Position: refs/heads/master@{#41623}
2016-12-09 15:06:26 +00:00
clemensh
890d28f361 [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- the StackFrame::State struct now also holds the callee_pc_address,
  which is set in ComputeCallerState. The WASM frame uses this
  information to determine whether the callee frame is WASM_TO_JS, and
  whether that frame is at the ToNumber conversion call.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
Review-Url: https://codereview.chromium.org/2555243002
Cr-Original-Commit-Position: refs/heads/master@{#41599}
Cr-Commit-Position: refs/heads/master@{#41613}
2016-12-09 10:30:19 +00:00
mstarzinger
5dcda5bb17 [parser] Ensure asm.js modules always allocate context.
The deserialization of the {Scope::asm_module} predicate relies on a
context being present for such modules. This ensures we always allocate
such a context, even in cases where no variables are allocated in it.

R=neis@chromium.org
TEST=cctest/test-parsing/AsmModuleFlag
BUG=v8:5653

Review-Url: https://codereview.chromium.org/2561103004
Cr-Commit-Position: refs/heads/master@{#41611}
2016-12-09 10:12:40 +00:00
gsathya
d778b36f0c [promisehook] Add is_promisehook_enabled
This will be used in CSA to check if any promisehook is set.

-- Adds a is_promisehook_enabled_ field to the isolate and helper methods.
-- Adds this field to the ExternalReference table.
-- Adds a helper method to access this from CSA

Note -- this patch doesn't actually add the ability to attach the hook
yet.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2566483002
Cr-Commit-Position: refs/heads/master@{#41607}
2016-12-09 06:57:22 +00:00
clemensh
d3d125417d Revert of [wasm] Fix location for error in asm.js ToNumber conversion (patchset #5 id:80001 of https://codereview.chromium.org/2555243002/ )
Reason for revert:
gc-stress failures

Original issue's description:
> [wasm] Fix location for error in asm.js ToNumber conversion
>
> In the asm.js code translated to wasm, we call imported functions via a
> WASM_TO_JS stub, which first calls the function and then calls ToNumber
> on the return value. Exceptions can happen in both calls.
> We were only ever reporting the location of the function call, whereas
> asm.js code executed via turbofan reported the location of the type
> coercion operator ("+" on "+foo()" or "|" on "foo()|0").
>
> This CL implements the same behaviour for asm.js code translated to
> wasm. The following is changed:
> - the AsmWasmBuilder records the parent node when descending on a binary
>   operator (also "+foo()" is represented by a binary operation).
> - it stores not one location per call in the source position side
>   table, but two (one for the call, one for the parent which does the
>   type coercion).
> - the wasm compiler annotates the source positions "0" and "1" to the
>   two calls in the WASM_TO_JS wrapper (only if the module origin is
>   asm.js).
> - during stack trace generation (in the StackTraceIterator), when we
>   move from the WASM_TO_JS frame to the WASM frame, we remember at which
>   call inside the WASM_TO_JS wrapper we are, and encode this information
>   in the generated caller state, used for the WASM frame.
> - the same information is also stored in the FrameArray which is used
>   to reconstruct the stack trace later.
>
> R=titzer@chromium.org, bradnelson@chromium.org
> CC=jgruber@chromium.org
> BUG=v8:4203,v8:5724
>
> Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
> Cr-Commit-Position: refs/heads/master@{#41599}

TBR=bradnelson@chromium.org,mstarzinger@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4203,v8:5724

Review-Url: https://codereview.chromium.org/2563613003
Cr-Commit-Position: refs/heads/master@{#41601}
2016-12-08 17:36:14 +00:00
jochen
6595e74057 Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
we can use them as an index into an array, instead of using a
WeakFixedArray where we have to do a linear scan.

Hooking up liveedit is a bit more involved, see
https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
for an overview

BUG=v8:5589
R=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2547483002
Cr-Commit-Position: refs/heads/master@{#41600}
2016-12-08 17:07:11 +00:00
clemensh
94cd46b55e [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- during stack trace generation (in the StackTraceIterator), when we
  move from the WASM_TO_JS frame to the WASM frame, we remember at which
  call inside the WASM_TO_JS wrapper we are, and encode this information
  in the generated caller state, used for the WASM frame.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Review-Url: https://codereview.chromium.org/2555243002
Cr-Commit-Position: refs/heads/master@{#41599}
2016-12-08 16:48:08 +00:00
Ilija.Pavlovic
e8f5adbed2 MIPS[64]: Fix MIPS: Improve Float(32|64)(Max|Min).
Fix 7a6f294ffe.

The first correction enables correct execution DoMathMinMax when two
input registers are the same register.
The second correction adds NOP instructions after branch instructions
in tests macro_float_minmaxf(32|64).

TEST=cctest/test-macro-assembler-mips[64]/macro_float_minmax_f32
     cctest/test-macro-assembler-mips[64]/macro_float_minmax_f64
     mjsunit/regress/math-min
BUG=

Review-Url: https://codereview.chromium.org/2556793003
Cr-Commit-Position: refs/heads/master@{#41596}
2016-12-08 14:57:07 +00:00
yangguo
98b563ebf3 [serializer] include global proxy in additional context snapshots.
Aside from the default snapshot, there is no need for additional context
snapshots to have the ability to replace the global proxy and global object
after deserialization. Changes include:
 - Changes to the API to better distinguish default context snapshot from
   additional context snapshots.
 - Disallow global handles when creating snapshots.
 - Allow extensions when creating snapshots.

This solves the issue of not being able to having accessors and interceptors on
the global object of contexts to be serialized.

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2557743003
Cr-Commit-Position: refs/heads/master@{#41588}
2016-12-08 12:45:05 +00:00
ishell
c522c6baa5 [turbofan] Further adapting machine graph verifier to code stubs.
All accessor IC stubs now pass the verification.

BUG=

Review-Url: https://codereview.chromium.org/2556123002
Cr-Commit-Position: refs/heads/master@{#41585}
2016-12-08 11:31:34 +00:00
mvstanton
044b2d1bd8 Reland Store OSR'd optimized code on the native context.
The patch was reverted due to a bug - we failed to evict OSR-optimized
code in the case where the SharedFunctionInfo OptimizedCodeMap was
empty/cleared.

Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.

Review-Url: https://codereview.chromium.org/2561083002
Cr-Commit-Position: refs/heads/master@{#41584}
2016-12-08 11:13:59 +00:00
rmcilroy
bfc53f6ed0 [Interpreter] Add expression positions to BinaryOps.
BUG=v8:5723

Review-Url: https://codereview.chromium.org/2555263002
Cr-Commit-Position: refs/heads/master@{#41583}
2016-12-08 10:11:17 +00:00
neis
fcb7591520 [parsing] Fix maybe-assigned flag in some cases.
This CL attempts to set the maybe-assigned flag for variables that are written
to as part of a destructuring or loop header.

For instance, in the following two cases we now mark x as maybe-assigned.

a) [x] = [1];
b) for (x of [1,2,3]) {};

There's more work to do here, this is just a first step.

R=adamk@chromium.org, mstarzinger@chromium.org
BUG=v8:5636

Review-Url: https://codereview.chromium.org/2562443003
Cr-Commit-Position: refs/heads/master@{#41582}
2016-12-08 10:06:09 +00:00
qiuyi.zqy
9ca022fab2 Return false in TryNumberToSize if the number is 1 << 64.
Currently when the number passed to TryNumberToSize is 1 << 64,
it gets away with a bug caused by rounding of mantissa.
Then the number will be casted to 0 and TryNumberToSize
will return true. This patch fix this by making the range check
more accurate.

BUG=v8:5712

Review-Url: https://codereview.chromium.org/2548243004
Cr-Commit-Position: refs/heads/master@{#41578}
2016-12-08 09:20:30 +00:00
neis
d23f837166 [parsing] Add some more tests of maybe-assigned.
R=adamk@chromium.org, mstarzinger@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2554363002
Cr-Commit-Position: refs/heads/master@{#41577}
2016-12-08 08:56:02 +00:00
bmeurer
b5f27ef30c Revert of Store OSR'd optimized code on the native context. (patchset #8 id:140001 of https://codereview.chromium.org/2549753002/ )
Reason for revert:
Speculative revert WebGL breakage reported in https://bugs.chromium.org/p/chromium/issues/detail?id=672367

Original issue's description:
> Store OSR'd optimized code on the native context.
>
> Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.
>
> BUG=
>
> Committed: https://crrev.com/378b6b22fb7925ac5b672335a54599f5739e7758
> Cr-Commit-Position: refs/heads/master@{#41554}

TBR=mstarzinger@chromium.org, mvstanton@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2562623003
Cr-Commit-Position: refs/heads/master@{#41571}
2016-12-08 07:29:20 +00:00
gsathya
11359e331a [promises] Port ResolvePromise to TF
-- Moves promiseHasHandlerSymbol to inobject property
-- Ports PromiseResolveClosure to TF
-- Fix a non spec async-await test which fails now because we do a map
check for native promise check (instead of IsPromise). Changing the
constructor (in the test) invalidates the map check.

This patch results in a 7.1% performance improvement in the bluebird
benchmark (over 5 runs).

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2541283002
Cr-Commit-Position: refs/heads/master@{#41569}
2016-12-08 06:12:48 +00:00
lpy
ecdff43b99 [Tracing] Support multi-categories group list.
jasongin@ created this patch.
dcc50445a3
This patch adds the support to emit a trace event by using a comma-separated
list of categories, so that the trace event will be emitted if there is at least
one category is enabled in the categories list.

TBR=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2558193002
Cr-Commit-Position: refs/heads/master@{#41567}
2016-12-08 00:28:18 +00:00
dcheng
ebe9419228 Propagate exceptions thrown by access check interceptors.
When v8 fails an access check, it invokes a helper to try to see if it
can service the request via an access check interceptor. Invoking the
access check interceptor can throw an exception (e.g. a SecurityError).

Unfortunately, the failed access check property helpers and the
interceptor helpers don't agree on how to propagate the exception: if
the interceptor helper detects a scheduled exception, it promotes the
exception to a pending exception and returns to the failed access check
property helper.

The failed access check property helper also has an early return in
case of a scheduled exception. However, this doesn't work, as the
previously thrown exception is no longer scheduled, as it's been
promoted to a pending exception. Thus, the failed access check property
helper always end up calling the failed access check callback as well.
Since Blink's implementation of the failed access check callback also
throws an exception, this conflicts with the previously-thrown,
already-pending exception.

With this patch, the failed access check property helpers check for a
pending exception rather than a scheduled exception after invoking the
interceptor, so the exception can be propagated correctly.

BUG=v8:5715
R=yangguo@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2550423002
Cr-Commit-Position: refs/heads/master@{#41556}
2016-12-07 15:54:39 +00:00
caitp
b5f146a02a [ignition] desugar GetIterator() via bytecode rather than via AST
Introduces:
- a new AST node representing the GetIterator() algorithm in the specification, to be used by ForOfStatement, YieldExpression (in the case of delegating yield*), and the future `for-await-of` loop proposed in http://tc39.github.io/proposal-async-iteration/#sec-async-iterator-value-unwrap-functions.
- a new opcode (JumpIfJSReceiver), which is useful for `if Type(object) is not Object` checks which are common throughout the specification. This node is easily eliminated by TurboFan.

The AST node is desugared specially in bytecode, rather than manually when building the AST. The benefit of this is that desugaring in the BytecodeGenerator is much simpler and easier to understand than desugaring the AST.

This also reduces parse time very slightly, and allows us to use LoadIC rather than KeyedLoadIC, which seems to have  better baseline performance. This results in a ~20% improvement in test/js-perf-test/Iterators micro-benchmarks, which I believe owes to the use of the slightly faster LoadIC as opposed to the KeyedLoadIC in the baseline case. Both produce identical optimized code via TurboFan when the type check can be eliminated, and the load can be replaced with a constant value.

BUG=v8:4280
R=bmeurer@chromium.org, rmcilroy@chromium.org, adamk@chromium.org, neis@chromium.org, jarin@chromium.org
TBR=rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2557593004
Cr-Commit-Position: refs/heads/master@{#41555}
2016-12-07 15:20:33 +00:00
mvstanton
378b6b22fb Store OSR'd optimized code on the native context.
Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.

BUG=

Review-Url: https://codereview.chromium.org/2549753002
Cr-Commit-Position: refs/heads/master@{#41554}
2016-12-07 15:11:04 +00:00
yangguo
0d4219913e [debug] do not retroactively apply script break points.
R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5510

Review-Url: https://codereview.chromium.org/2530093002
Cr-Commit-Position: refs/heads/master@{#41549}
2016-12-07 11:44:12 +00:00
ishell
36807f8a21 [stubs] Fix issues found by the machine graph verifier in load/store IC stubs.
BUG=

Review-Url: https://codereview.chromium.org/2560663002
Cr-Commit-Position: refs/heads/master@{#41548}
2016-12-07 10:57:42 +00:00
ishell
df2f66e01e [turbofan] Add --csa-verify flag that enables machine graph verification of code stubs.
The flag must be used only by CodeStubAssemblerGraphsCorrectness cctest for now
and once all the verification issues are fixed the flag will be enabled in debug
mode by default.

This CL also relaxes some checks for code stub graphs and fixes some issues in the stubs.

BUG=

Review-Url: https://codereview.chromium.org/2558653002
Cr-Commit-Position: refs/heads/master@{#41547}
2016-12-07 10:41:03 +00:00
henrique.ferreiro
afd5ff553b Install the 'name' property in classes at runtime
This allows to detect a static property also named 'name', and also makes sure 'name' is added last, to be standards-compliant.

BUG=v8:4199

Review-Url: https://codereview.chromium.org/2423053002
Cr-Commit-Position: refs/heads/master@{#41546}
2016-12-07 10:35:00 +00:00
ishell
331b0df6e4 [stubs] Ensure that the stubs are recompiled in respective tests.
Removing elements from stub cache by Major key only does not always work.

BUG=

Review-Url: https://codereview.chromium.org/2551353003
Cr-Commit-Position: refs/heads/master@{#41544}
2016-12-07 10:23:21 +00:00
dusan.simicic
c35cc1419c MIPS[64]: Fix jump_tables6 test for r6 architectures
This patch fixes jump_tables6 test for mips32r6 and mips64r6.
This is regression from CL:
https://crrev.com/d735f3ab12061f0a588b3f0538f9229cf747f818

BUG=

Review-Url: https://codereview.chromium.org/2547033002
Cr-Commit-Position: refs/heads/master@{#41543}
2016-12-07 09:13:44 +00:00
petermarshall
a25e768864 [Ignition/turbo] Add a NewWithSpread bytecode.
This just calls into a runtime function for implementation currently.

Intermediate step in speeding up constructor calls containing a spread.

The NewWithSpread bytecode will probably end up having different arguments with future CLs - the constructor and the new.target should have their own regs. For now we are calling into the runtime function, so we need the regs together.

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2541113004
Cr-Commit-Position: refs/heads/master@{#41542}
2016-12-07 08:35:09 +00:00
gsathya
52e2c154ff Reland Create JSPromise (patchset #16 id:300001 of https://codereview.chromium.org/2536463002/ )"
This reverts commit 4c7cccf9f4.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2554943002
Cr-Commit-Position: refs/heads/master@{#41534}
2016-12-06 18:43:18 +00:00
ishell
a9345a158a Revert of [turbofan] Add --csa-verify flag that enables machine graph verification of code stubs. (patchset #2 id:60001 of https://codereview.chromium.org/2551933002/ )
Reason for revert:
Broke nosnap build: https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/10689

Original issue's description:
> [turbofan] Add --csa-verify flag that enables machine graph verification of code stubs.
>
> The flag must be used only by CodeStubAssemblerGraphsCorrectness cctest for now
> and once all the verification issues are fixed the flag will be enabled in debug
> mode by default.
>
> BUG=
>
> Committed: https://crrev.com/292b3548f6d02b964b4afe3e05f89c0681fa5620
> Cr-Commit-Position: refs/heads/master@{#41531}

TBR=mstarzinger@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2552893003
Cr-Commit-Position: refs/heads/master@{#41532}
2016-12-06 17:29:15 +00:00
ishell
292b3548f6 [turbofan] Add --csa-verify flag that enables machine graph verification of code stubs.
The flag must be used only by CodeStubAssemblerGraphsCorrectness cctest for now
and once all the verification issues are fixed the flag will be enabled in debug
mode by default.

BUG=

Review-Url: https://codereview.chromium.org/2551933002
Cr-Commit-Position: refs/heads/master@{#41531}
2016-12-06 16:18:40 +00:00
titzer
f897e36c8c [wasm] Names of exported functions should be the stringified function index.
R=bradnelson@chromium.org,rossberg@chromium.org
BUG=v8:5705

Review-Url: https://codereview.chromium.org/2551323003
Cr-Commit-Position: refs/heads/master@{#41530}
2016-12-06 15:33:42 +00:00
bradnelson
051bc1ec3e [wasm][asm.js] Pass Script with Handle.
The asm-wasm-builder started allocating SharedFunctionInfos,
this makes it bad we'd passed Script by pointer (due to ignorance).
Switching to Handle<Script>.

R=clemensh@chromium.org,titzer@chromium.org
BUG=v8:5716

Review-Url: https://codereview.chromium.org/2552873003
Cr-Commit-Position: refs/heads/master@{#41529}
2016-12-06 15:29:22 +00:00
ulan
fdc0aa0c97 [heap] Ensure finalization of incremental marking even if all allocations
come from the runtime.

This patch fixes an issue of heap growing to max capacity when incremental
marking is finished but cannot finalize due to GC stack guard not triggering.

It can happen if all allocations come from the runtime, for example,
from JSON parser or compiler.

Now before expanding the heap we check if we are above the allocation limit
and the incremental marking needs to be finalized. If so we do not expand
the heap and force GC, which will finalize the incremental marking.
The check is performed for paged spaces and large-object space.

BUG=chromium:670675

Review-Url: https://codereview.chromium.org/2552613004
Cr-Commit-Position: refs/heads/master@{#41524}
2016-12-06 14:06:40 +00:00
machenbach
ca74343a70 [test] Skip flaky FunctionApplySample test on windows
BUG=v8:5193
NOTRY=true
TBR=alph@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2555683003
Cr-Commit-Position: refs/heads/master@{#41523}
2016-12-06 13:58:12 +00:00
marja
1b5ccb055a PreParser: track variable declarations and parameters
This makes the context allocation less pessimistic in the following cases:

function outer() {
  var a; // Won't be context allocated
  function inner1() { var a; a; }
  function inner2(a) { a; }
  function inner3([a]) { a; }
  function inner4({ a: b}) { a; }
}

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2407163003
Cr-Commit-Position: refs/heads/master@{#41521}
2016-12-06 13:24:07 +00:00
yangguo
d26cdb7d6f v8::Private::ForApi should be context-independent.
This is done by reimplementing Symbol.for directly on top of
NameDictionary. A nice side effect is the removal of src/js/symbol.js

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2551763003
Cr-Commit-Position: refs/heads/master@{#41520}
2016-12-06 13:21:38 +00:00
mythria
9119d16904 [Interpreter] Optimize equality check with null/undefined with a check on the map.
Equality with null/undefined is equivalent to a check on the undetectable bit
on the map of the object. This would be more efficient than performing the entire
comparison operation.

This cl introduces:
1. A new bytecode called TestUndetectable that checks if the object is null/undefined.
2. Updates peeophole optimizer to emit TestUndetectable when a LdaNull/Undefined
precedes equality check.
4. TestUndetectable is transformed to ObjectIsUndetectable operator when building
turbofan graph.

BUG=v8:4280

Review-Url: https://codereview.chromium.org/2547043002
Cr-Commit-Position: refs/heads/master@{#41514}
2016-12-06 11:32:39 +00:00
machenbach
4c7cccf9f4 Revert of Create JSPromise (patchset #16 id:300001 of https://codereview.chromium.org/2536463002/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11861

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Object
> -- New JSObject for promises: JSPromise
>
> Builtins
> -- PromiseThen TFJ
> -- PromiseCreateAndSet TFJ for internal use
> -- PerformPromiseThen TFJ for internal use
> -- PromiseInit for initial promise setup
> -- SpeciesConstructor for use in PromiseThen
> -- ThrowIfNotJSReceiver for use in SpeciesConstructor
> -- AppendPromiseCallback to update FixedArray with new callback
> -- InternalPerformPromiseThen
>
> Promises.js
> -- Cleanup unused symbols
> -- Remove PerformPromiseThen
> -- Remove PromiseThen
> -- Remove PromiseSet
> -- Remove PromiseAttachCallbacks
>
> Runtime
> -- PromiseSet to set promise inobject values
> -- Refactor functions to use FixedArrays for callbacks instead of
>    JSArray
> -- Runtime_PromiseStatus to return promise status
> -- Runtime_PromiseResult to return promise result
> -- Runtime_PromiseDeferred to return deferred attached to promise
> -- Runtime_PromiseRejectReactions to return reject reactions attached
>    to promise
>
> This CL results in a 13.07% improvement in the promises benchmark
> (over 5 runs).
>
> BUG=v8:5343
>
> Committed: https://crrev.com/30b564c76f490f8f6b311a74b25b26cf0a96be2d
> Cr-Commit-Position: refs/heads/master@{#41503}

TBR=bmeurer@chromium.org,jgruber@chromium.org,caitp@igalia.com,gsathya@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2554013002
Cr-Commit-Position: refs/heads/master@{#41512}
2016-12-06 11:19:07 +00:00
ishell
df2fc5ef57 [turbofan] Move CodeAssembler::Label and CodeAssembler::Variable to compiler namespace.
This allows us to forward declare Label and Variable classes without including the
code-assembler.h.

BUG=

Review-Url: https://codereview.chromium.org/2551163003
Cr-Commit-Position: refs/heads/master@{#41509}
2016-12-06 10:29:49 +00:00
Ilija.Pavlovic
7a6f294ffe MIPS: Improve Float(32|64)(Max|Min).
Port for 3396bb2907

TEST=
BUG=

Review-Url: https://codereview.chromium.org/2534413002
Cr-Commit-Position: refs/heads/master@{#41508}
2016-12-06 10:16:50 +00:00
gdeepti
02c6b04179 [wasm] Implement I32x4ReplaceLane, I32x4Add, I32x4Sub.
R=bbudge@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2385393002
Cr-Commit-Position: refs/heads/master@{#41505}
2016-12-06 01:12:55 +00:00
gsathya
30b564c76f Object
-- New JSObject for promises: JSPromise

Builtins
-- PromiseThen TFJ
-- PromiseCreateAndSet TFJ for internal use
-- PerformPromiseThen TFJ for internal use
-- PromiseInit for initial promise setup
-- SpeciesConstructor for use in PromiseThen
-- ThrowIfNotJSReceiver for use in SpeciesConstructor
-- AppendPromiseCallback to update FixedArray with new callback
-- InternalPerformPromiseThen

Promises.js
-- Cleanup unused symbols
-- Remove PerformPromiseThen
-- Remove PromiseThen
-- Remove PromiseSet
-- Remove PromiseAttachCallbacks

Runtime
-- PromiseSet to set promise inobject values
-- Refactor functions to use FixedArrays for callbacks instead of
   JSArray
-- Runtime_PromiseStatus to return promise status
-- Runtime_PromiseResult to return promise result
-- Runtime_PromiseDeferred to return deferred attached to promise
-- Runtime_PromiseRejectReactions to return reject reactions attached
   to promise

This CL results in a 13.07% improvement in the promises benchmark
(over 5 runs).

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2536463002
Cr-Commit-Position: refs/heads/master@{#41503}
2016-12-05 21:08:31 +00:00
clemensh
e6bd306353 [debug] Remove DebugInterface class
It only contained type definitions and static functions, so we
can also just make it a namespace.

R=kozyatinskiy@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2549133002
Cr-Commit-Position: refs/heads/master@{#41501}
2016-12-05 19:44:50 +00:00
mvstanton
3e46a3b754 Remove FLAG_flush_optimized_code_cache
It's no longer necessary, and has been off for a year.

BUG=

Review-Url: https://codereview.chromium.org/2553643002
Cr-Commit-Position: refs/heads/master@{#41499}
2016-12-05 18:28:29 +00:00
vogelheim
0315bfff6b Remove unused code, AstValueFactory::ConcatStrings.
BUG=

Review-Url: https://codereview.chromium.org/2545773003
Cr-Commit-Position: refs/heads/master@{#41497}
2016-12-05 18:00:39 +00:00
verwaest
ce63eb08f9 [counters] Move waiting for more data from background-parsing into callbacks
BUG=

Review-Url: https://codereview.chromium.org/2549083002
Cr-Commit-Position: refs/heads/master@{#41492}
2016-12-05 15:47:12 +00:00
bmeurer
bf5c5bf8a4 [turbofan] Properly check Tagged->Word32 changes.
Don't unconditionally assume that Tagged->Word32 changes are always
truncating independent of the type of the input. Work-around the
remaining issues with for-in by properly renaming the index if it's
not already of appropriate type (happens with generators or OSR).

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2545393002
Cr-Commit-Position: refs/heads/master@{#41484}
2016-12-05 11:57:16 +00:00
ishell
3d618949e1 [stubs] Cleanup usages of lambdas in CodeStubAssembler and friends.
The changes are:
1) Pass lambdas as const references to avoid unnecessary copying.
2) Remove CodeStubAssembler* parameter from loop bodies and let the lambdas
   capture the right assembler instead. It makes the loop body code look
   uniform with the surrounding code and unblocks splitting of a CSA
   into different classes.

BUG=

Review-Url: https://codereview.chromium.org/2535753012
Cr-Commit-Position: refs/heads/master@{#41482}
2016-12-05 11:29:17 +00:00
ulan
a1680631ff Revert "[heap] Use RAIL mode for initial heap sizing"
This reverts commit aea4f1a704.

Reason: performance regression on benchmarks (crbug.com/671118).

BUG=chromium:671118,chromium:613518
TBR=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2549053002
Cr-Commit-Position: refs/heads/master@{#41479}
2016-12-05 10:15:21 +00:00
ulan
aea4f1a704 [heap] Use RAIL mode for initial heap sizing
BUG=chromium:613518

Review-Url: https://codereview.chromium.org/2407153002
Cr-Commit-Position: refs/heads/master@{#41459}
2016-12-02 16:34:12 +00:00
predrag.rudic
11f0a0e819 Fix MIPS maddf and msubf instructions in simulator and tests.
Tests were falling in qemu because of inexact computation in tests.
After correcting tests, simulator also had to be fixed.

Review-Url: https://codereview.chromium.org/2539133002
Cr-Commit-Position: refs/heads/master@{#41447}
2016-12-02 09:12:04 +00:00
jgruber
1a6dae8070 [debug] Partial reland of debug API deprecation
This relands API deprecation (without removing the implementation),
removal of NewFunction and BeforeCompile events, and removal of
DebugCommandProcessor tests.

The remaining portion of the original CLs can be relanded after the 4.7
branch point.

Original CLs:

https://codereview.chromium.org/2524323002
https://codereview.chromium.org/2531543002

BUG=v8:5510

Review-Url: https://codereview.chromium.org/2546473008
Cr-Commit-Position: refs/heads/master@{#41446}
2016-12-02 09:02:01 +00:00
aseemgarg
ff8bbe245a [wasm] implement simd lowering for replaceLane, load, store and test for phi
BUG=v8:4124
TEST:test-run-wasm-simd-lowering
R=bradnelson@chromium.org,titzer@chromium.org,mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2498283002
Cr-Commit-Position: refs/heads/master@{#41443}
2016-12-02 03:47:46 +00:00
Ilija.Pavlovic
a1901cfbc7 MIPS[64]: Fix compilation failure in test-macro-assembler[64].cc
Fix compilation failure in test-macro-assembler[64].cc
caused by 8fcfe66f94
due to warning `lambda-expression in unevaluated context`.

TEST=cctest/test-macro-assembler-mips[64]
BUG=

Review-Url: https://codereview.chromium.org/2543643005
Cr-Commit-Position: refs/heads/master@{#41433}
2016-12-01 16:16:05 +00:00
jgruber
4292f32ed3 [debug] Revert debug API removal
Debugging API is still in use by Node.

Revert "[debug] remove deprecated debug command message queue."
This reverts commit abdbfc953d.

Revert "[debug] mark more unused debug API as deprecated."
This reverts commit d5ada19ce7.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2537313005
Cr-Commit-Position: refs/heads/master@{#41427}
2016-12-01 13:34:45 +00:00
dusan.simicic
d735f3ab12 MIPS: Fix trampoline emission after switch table generation
Trampolines are generated when the value of pc_offset is greater than
next_buffer_check_ (attribute from Assembler class). This value
shouldn't be incremented in bind_to() method when internal reference
label is bound, because it is not decremented when the switch table is
generated (dd() method from Assemler class).

This patch fixes this problem. Regression test are also included for
mips and mips64 arch.

BUG=

Review-Url: https://codereview.chromium.org/2530143002
Cr-Commit-Position: refs/heads/master@{#41423}
2016-12-01 13:03:19 +00:00
petermarshall
a328143eb3 Move desugaring of super calls with trailing spread to one runtime call.
Unfortunately we have to split this up into two cases: those with exactly one spread argument as the final argument, and all others, due to any side-effects of evaluation being visible.

This is in preparation for a new bytecode which handles super calls.

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2540593003
Cr-Commit-Position: refs/heads/master@{#41415}
2016-12-01 09:42:37 +00:00
eholk
bf35d15e52 [wasm] OOB traps: build protected instruction list during codegen
During codegen, we build a list mapping protected instructions to their
associated landing pads. This will ultimately by used by the signal handler to
recover from out of bounds faults and throw a JS exception.

This is mostly pulled from my larger in-progress CL at
https://codereview.chromium.org/2371833007/.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2500443004
Cr-Commit-Position: refs/heads/master@{#41400}
2016-11-30 22:32:03 +00:00
bbudge
9e3feefff2 [Turbofan] Modify ARM vswp assembler test to use integers.
Attempt to fix or get insight into failing vswp test on V8 ARM bot.

LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2539533005
Cr-Commit-Position: refs/heads/master@{#41397}
2016-11-30 19:45:08 +00:00
neis
9ef7ab1e2e [compiler] Remove context value input from JSLoadContext and JSStoreContext.
JS operators always have an implicit context input, so just use that instead.

BUG=

Review-Url: https://codereview.chromium.org/2541813002
Cr-Commit-Position: refs/heads/master@{#41392}
2016-11-30 15:46:08 +00:00
clemensh
6572b5622e [wasm] Remove raw byte pointers from WasmModule
These byte pointers (module_start and module_end) were only valid
during decoding. During instantiation or execution, they can get
invalidated by garbage collection.
This CL removes them from the WasmModule struct, and introduces a new
ModuleStorage struct as interface to the wasm wire bytes.
Since the storage is often needed together with the ModuleEnv, a new
ModuleStorageEnv struct holds both a ModuleEnv and a ModuleStorage.
The pointers in the ModuleStorage should never escape the live range of
this struct, as they might point into a SeqOneByteString or ArrayBuffer.
Therefore, the WasmInterpreter needs to create its own copy of the
whole module.
Runtime functions that previously used the raw pointers in WasmModule
(leading to memory errors) now have to use the SeqOneByteString in the
WasmCompiledModule.

R=titzer@chromium.org
BUG=chromium:669518

Review-Url: https://codereview.chromium.org/2540133002
Cr-Commit-Position: refs/heads/master@{#41388}
2016-11-30 15:03:06 +00:00
jochen
a1473f5306 Split parsing of functions and top-level code into two separate methods
Also move them to a separate interface header to avoid having to include
parser.h so much

BUG=v8:5589
R=verwaest@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2534393002
Cr-Commit-Position: refs/heads/master@{#41386}
2016-11-30 13:21:37 +00:00
titzer
a0c518627f [wasm] Add a flag --wasm-opt to test optimizations in the WASM pipeline.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2528033002
Cr-Commit-Position: refs/heads/master@{#41381}
2016-11-30 10:36:14 +00:00
rmcilroy
8037e98e44 [Interpreter] Remove skips for tests that no longer seem to be flaky.
BUG=v8:4680

Review-Url: https://codereview.chromium.org/2541563002
Cr-Commit-Position: refs/heads/master@{#41378}
2016-11-30 09:21:37 +00:00
bradnelson
14e05c1046 [wasm] asm.js - Parse and convert asm.js to wasm a function at a time.
Make the AsmWasmBuilder drive the process of typing and potentially parsing
function bodies. This will allow us to keep only a single asm.js function's
AST in memory as we convert to WebAssembly.
This is needed to keep our memory footprint low.

Add some additional output to a few tests that's helpful to see which stage they fail at.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=marja@chromium.org,adamk@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2398023002
Cr-Commit-Position: refs/heads/master@{#41372}
2016-11-30 00:26:05 +00:00
danno
df2578d2ec [stubs] Port builtin for Array.push fast-case from Crankshaft to TF
Improves performance in simple, single element case by 5% and in multiple
elements cases by 2%.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2497243002
Cr-Commit-Position: refs/heads/master@{#41368}
2016-11-29 16:58:30 +00:00
rmcilroy
067e9e295f [Interpreter] Add bytecode aging and use it enable CompilationCache for bytecode
Adds a bytecode_age field to BytecodeArray objects. This is incremented each
time the bytecode array is marked by GC, and reset to zero if the bytecode
is executed.

This is used to enable the CompilationCache for interpreted functions,
where Interpreted entries are evicted once the bytecode becomes old.

BUG=chromium:666275,v8:4680

Review-Url: https://codereview.chromium.org/2534763003
Cr-Commit-Position: refs/heads/master@{#41356}
2016-11-29 12:34:58 +00:00
rmcilroy
5fd2b71236 [Heap] Remove concept of MarkingParity.
MarkingParity was used to avoid performing an operation on an object if it was
marked multiple times. We no longer mark things multiple times, so this concept
is no longer required.

BUG=chromium:666275

Review-Url: https://codereview.chromium.org/2529173002
Cr-Commit-Position: refs/heads/master@{#41354}
2016-11-29 12:10:16 +00:00
bmeurer
777e142ca1 [turbofan] Add appropriate types to express Callable.
This introduces three new types OtherCallable, CallableProxy (and OtherProxy),
and BoundFunction to make it possible to express Callable in the Type system.
It also forces all undetectable receivers to be Callable, which matches the
use case for undetectable, namely document.all (guarded by proper checks and
tests).

It also uses these new types to properly optimize instanceof (indirectly via
OrdinaryHasInstance) based on the type of the constructor and the object. So
we are able to constant-fold certain instanceof expressions based on types
and completely avoid the builtin call.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2535753004
Cr-Commit-Position: refs/heads/master@{#41345}
2016-11-29 10:48:13 +00:00
cbruni
85321456cd [api] Support sharing prototypes between FunctionTemplates
FunctionTemplateInfo::SetPrototypeProviderTemplate adds support for sharing
prototypes between several function templates. This is used to properly set up
Image.prototype and HTMLImageElement.protoype which should be equal according
to the spec.

BUG=chromium:2969

Review-Url: https://codereview.chromium.org/2531653002
Cr-Commit-Position: refs/heads/master@{#41343}
2016-11-29 10:14:18 +00:00
tebbi
08931d45ba [parser] removed redundant undefined check of for-of iterator
Removed a redundant check: If completion is not normal, then #iterator cannot be undefined.

Review-Url: https://codereview.chromium.org/2533803002
Cr-Commit-Position: refs/heads/master@{#41321}
2016-11-28 15:30:17 +00:00
ziyang
f5d373b012 PPC64: Changing test-spaces/SizeOfInitialHeap to accomodate 64K page size
Since the page size of PPC 64 bit machines is 64K, memory smaller than 64K
    cannot be freed causing the committed memory of code space to be
    exactly 2M. Changing the test case to accomodate this.

R=mlippautz@chromium.org, ulan@chromium.org, vogelheim@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2523293002
Cr-Commit-Position: refs/heads/master@{#41292}
2016-11-25 19:38:17 +00:00
bbudge
ef3f125d37 [Turbofan] Add ARM support for simd128 moves and swaps.
- Adds vmov, vswp instructions for QwNeonRegisters.
- Refactors existing vswp implementation, moves non-Neon adaption to
MacroAssembler.
- Adds simd128 support to CodeGenerator AssembleMove, AssembleSwap.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2523933002
Cr-Commit-Position: refs/heads/master@{#41291}
2016-11-25 19:37:04 +00:00
yangguo
d5ada19ce7 [debug] mark more unused debug API as deprecated.
R=jgruber@chromium.org
BUG=v8:5510

Review-Url: https://codereview.chromium.org/2531543002
Cr-Commit-Position: refs/heads/master@{#41283}
2016-11-25 09:11:04 +00:00
rmcilroy
49ea60ef9d [GC] Fix code flushing to use bytecode if it exists.
If code is flushed on a SFI, we can still use the bytecode if it was compiled,
since this never gets flushed.

This fixes a DCHECK where we were trying to compile the bytecode multiple
times after the baseline code was flushed.

BUG=chromium:668133

Review-Url: https://codereview.chromium.org/2526243002
Cr-Commit-Position: refs/heads/master@{#41274}
2016-11-24 17:27:04 +00:00
vogelheim
9d0f5ab745 Treat all functions in a 'comma sequence' the same for (pre-)parsing.
R=verwaest@chromium.org
BUG=v8:5643

Review-Url: https://codereview.chromium.org/2524263003
Cr-Commit-Position: refs/heads/master@{#41267}
2016-11-24 14:45:19 +00:00