Commit Graph

3060 Commits

Author SHA1 Message Date
dcheng
40b74d04da Make CreationContext() not crash when there is no creation context.
Remote objects don't have a creation context.

BUG=527190

Review-Url: https://codereview.chromium.org/2693203003
Cr-Commit-Position: refs/heads/master@{#43306}
2017-02-20 09:47:14 +00:00
Toon Verwaest
0a8de761ff Remove unused Box type
BUG=

Change-Id: Ie7a8327fac62a0608b60cf9f0f072f979ac4fd76
Reviewed-on: https://chromium-review.googlesource.com/443528
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@google.com>
Cr-Commit-Position: refs/heads/master@{#43269}
2017-02-17 10:06:22 +00:00
jwolfe
d1d4b9ce51 Implement new Function.prototype.toString --harmony-function-tostring
For functions declared in source code, the .toString() representation
will be an excerpt of the source code.
* For functions declared with the "function" keyword, the excerpt
  starts at the "function" or "async" keyword and ends at the final "}".
  The previous behavior would start the excerpt at the "(" of the
  parameter list, and prepend a canonical `"function " + name` or
  similar, which would discard comments and formatting surrounding the
  function's name. Anonymous functions declared as function expressions
  no longer get the name "anonymous" in their toString representation.
* For methods, the excerpt starts at the "get", "set", "*" (for
  generator methods), or property name, whichever comes first.
  Previously, the toString representation for methods would use a
  canonical prefix before the "(" of the parameter list. Note that any
  "static" keyword is omitted.
* For arrow functions and class declarations, the excerpt is unchanged.

For functions created with the Function, GeneratorFunction, or
AsyncFunction constructors:
* The string separating the parameter text and body text is now
  "\n) {\n", where previously it was "\n/*``*/) {\n" or ") {\n".
* At one point, newline normalization was required by the spec here,
  but that was removed from the spec, and so this CL does not do it.

Included in this CL is a fix for CreateDynamicFunction parsing. ')'
and '`' characters in the parameter string are no longer disallowed,
and Function("a=function(", "}){") is no longer allowed.

BUG=v8:4958, v8:4230

Review-Url: https://codereview.chromium.org/2156303002
Cr-Commit-Position: refs/heads/master@{#43262}
2017-02-16 20:19:24 +00:00
Marja Hölttä
d21621cf35 [parser] No need to collect literal counts.
Patch adopted from mvstanton@ ( https://codereview.chromium.org/2657413002/ )

BUG=

Change-Id: I4296b3d5694116e250a6bb88296fbed0f0c444e6
Reviewed-on: https://chromium-review.googlesource.com/443246
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43238}
2017-02-16 09:58:45 +00:00
yangguo
c39123dd53 [debugger] implement inspector-facing API for code coverage.
The inspector uses V8's API handles and should not access
V8 internals. This change makes sure it can use the coverage
data in an encapsulated way.

R=jgruber@chromium.org, kozyatinskiy@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2696163002
Cr-Commit-Position: refs/heads/master@{#43231}
2017-02-16 08:36:12 +00:00
Igor Sheludko
fdc78d294e [ic] Cleanup vector-based IC clearing.
... and don't clear ICs during GC. The IC clearing used to prevent memory
leaks but it's not necessary anymore because all the handlers that need
to embed objects already use weak cells.

This CL unblocks inlining of IC dispatchers into bytecode handlers.

BUG=v8:5917

Change-Id: I229b9ba8dba44f431dfbe8ac5370d855e3e84dd6
Reviewed-on: https://chromium-review.googlesource.com/442127
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43209}
2017-02-15 13:01:11 +00:00
yangguo
20c7d5431a [debugger] add lcov support to d8.
Use d8 with --lcov=<file> to append coverage info to a file.
The result can be fed into genhtml(1).

R=jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2695823003
Cr-Commit-Position: refs/heads/master@{#43207}
2017-02-15 10:16:44 +00:00
Marja Hölttä
a1547aa914 [objects.h splitting] Move out Code::FindAndReplacePattern.
It's needed by code-stubs.h and it was defined in objects-inl.h.
That cannot work without violating the include rules.

BUG=v8:5402
R=mstarzinger@chromium.org

Change-Id: Icb84b97de5622df8cf76e9fc4d117982901c99d9
Reviewed-on: https://chromium-review.googlesource.com/441845
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43195}
2017-02-14 15:53:57 +00:00
bbudge
deabb19abc Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43169}
Committed: a9b59a11f1
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43176}
2017-02-14 06:57:25 +00:00
franzih
a386eb4f04 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
Breaks Node integration build.

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,v8:5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Original-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43169}
> Committed: a9b59a11f1

TBR=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,machenbach@chromium.org,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,v8:5948

Review-Url: https://codereview.chromium.org/2695653005
Cr-Commit-Position: refs/heads/master@{#43170}
2017-02-13 21:33:46 +00:00
bbudge
a9b59a11f1 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,v8:5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org

Review-Url: https://codereview.chromium.org/2684313003
Cr-Original-Commit-Position: refs/heads/master@{#43162}
Committed: d170c57ab9
Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43169}
2017-02-13 20:43:08 +00:00
bradnelson
43fc15bb79 Revert of Remove SIMD.js from V8. (patchset #7 id:120001 of https://codereview.chromium.org/2684313003/ )
Reason for revert:
red

Original issue's description:
> Remove SIMD.js from V8.
>
> LOG=Y
> BUG=v8:4124,5948
> R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
> (notry since trybots can't patch directory deletes)
> NOTRY=true
>
> Review-Url: https://codereview.chromium.org/2684313003
> Cr-Commit-Position: refs/heads/master@{#43162}
> Committed: d170c57ab9

TBR=bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org,bradnelson@google.com,bbudge@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124,5948

Review-Url: https://codereview.chromium.org/2692933002
Cr-Commit-Position: refs/heads/master@{#43164}
2017-02-13 18:12:14 +00:00
bbudge
d170c57ab9 Remove SIMD.js from V8.
LOG=Y
BUG=v8:4124,5948
R=bradnelson@chromium.org,bmeurer@chromium.org,jochen@chromium.org,hpayer@chromium.org,danno@chromium.org
(notry since trybots can't patch directory deletes)
NOTRY=true

Review-Url: https://codereview.chromium.org/2684313003
Cr-Commit-Position: refs/heads/master@{#43162}
2017-02-13 15:59:22 +00:00
gsathya
31bc17f006 [promises] cleanup default promise handlers
Use private symbols to mark default promise handler, instead of calling out to default
handlers defined in JS. We check for this symbol in PromiseHandle and perform the
appropriate behavior as the default handlers.

Catch prediction logic is updated to account for a symbol.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2695593002
Cr-Commit-Position: refs/heads/master@{#43135}
2017-02-13 06:31:11 +00:00
Leszek Swirski
2bfd8a7cb7 [ignition] Remove handles from bytecode generation
Removes handles from bytecode generation, instead storing
un-internalized AstValues (and other, similar values such as Scopes and
AstRawStrings) in the constant array builder.

This will allow us in the future to generate the bytecode before
internalizing the AST.

BUG=v8:5832

Change-Id: I3b8be8f7329a484eb1e5d12808b001d3475239da
Reviewed-on: https://chromium-review.googlesource.com/439326
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43115}
2017-02-10 17:52:39 +00:00
yangguo
8422e25bb2 [debugger] add precise mode for code coverage.
Collecting precise invocation counts need to be explicitly
enabled. Once enabled, we disable optimization (optimized
code does not increment invocation count, and may inline
callees), and make sure feedback vectors interesting for
code coverage is not garbage-collected.

R=hpayer@chromium.org, jgruber@chromium.org
BUG=v8:5808

Review-Url: https://codereview.chromium.org/2686063002
Cr-Commit-Position: refs/heads/master@{#43082}
2017-02-10 08:21:03 +00:00
ishell
a4f4c74050 [runtime][ic] Constant field tracking support.
This CL includes runtime and IC parts of the tracking. It is controlled by
compile-time flag FLAG_constant_field_tracking and currently disabled.

Transition from kConst to kMutable still involves map deprecation.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2598543003
Cr-Commit-Position: refs/heads/master@{#43081}
2017-02-10 08:05:25 +00:00
jkummerow
1fae6c339a [cleanup] CSA: add helpers for accessing details/value via key_index
TBR=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2688573003
Cr-Commit-Position: refs/heads/master@{#43075}
2017-02-09 22:51:33 +00:00
mvstanton
a1bba7fe3b [FeedbackVector] Clarify the way the feedback vector is installed.
Installing a feedback vector in a closure is a multi-step process.
The closure actually points to a Cell that points to a feedback
vector or undefined if we haven't created one yet.
This happens because we often create closures before we've compiled
the code.

JSFunction::EnsureLiterals is the bottleneck in our system that
creates a feedback vector if necessary. The predicates it used to
determine what to do were arcane. This CL allows it to think it
terms of state, and clarifies the reading of that useful
bottleneck.

I also did a few renamings in parts of the code that referred
to a "literals array," which we don't have any more.

BUG=

Review-Url: https://codereview.chromium.org/2681773004
Cr-Commit-Position: refs/heads/master@{#43035}
2017-02-08 11:51:06 +00:00
ishell@chromium.org
45adc5f836 [ic] Use FeedbackSlotKind instead of Code::Kind in IC class and friends.
Now we can inline vector-based IC dispatchers to bytecode handlers.

BUG=v8:5917

Change-Id: Ie81750f252a730240097e514e69b348f410a48b7
Reviewed-on: https://chromium-review.googlesource.com/439265
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#43028}
2017-02-08 09:57:36 +00:00
ishell@chromium.org
32971301ea Rename TypeFeedbackVector to FeedbackVector.
... and TypeFeedbackMetadata to FeedbackMetadata.

BUG=

Change-Id: I2556d1c2a8f37b8cf3d532cc98d973b6dc7e9e6c
Reviewed-on: https://chromium-review.googlesource.com/439244
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#42999}
2017-02-07 14:46:36 +00:00
kozyatinskiy
6e17719e79 [inspector] introduced v8::debug::EntriesPreview for inspector
- entries preview available even if debugger agent is disabled,
- less deprecated mirrors usage in debugger-script.js
- no usage of debugger context - zero probability of leaking it.
- better test coverage.

BUG=v8:5510
R=yangguo@chromium.org,jgruber@chromium.org,alph@chromium.org,luoe@chromium.org

Review-Url: https://codereview.chromium.org/2672213002
Cr-Commit-Position: refs/heads/master@{#42978}
2017-02-07 07:46:21 +00:00
mstarzinger
b628aba090 [turbofan] Enable inlining based on SharedFunctionInfo.
This adapts the inlining logic to allow for inlining based solely on a
statically known underlying SharedFunctionInfo instead of a concrete
closure of the call target.

In cases where the closure is known, its bound context is constant
promoted just as before. In the new cases where only the SFI for an
entire class of closures is known, we use the dynamic SSA-value of the
bound context.

R=bmeurer@chromium.org
BUG=v8:2206

Review-Url: https://codereview.chromium.org/2626783003
Cr-Commit-Position: refs/heads/master@{#42968}
2017-02-06 13:54:38 +00:00
marja
35a82866d7 [iwyu] runtime.h doesn't need objects.h
BUG=v8:5294
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2675233002
Cr-Commit-Position: refs/heads/master@{#42963}
2017-02-06 12:26:31 +00:00
mvstanton
aea3ce3df3 [TypeFeedbackVector] Root feedback vectors at function literal site.
TypeFeedbackVectors are strongly rooted by a closure. However, in modern
JavaScript closures are created and abandoned more freely. An important
closure may not be present in the root-set at time of garbage collection,
even though we've cached optimized code and use it regularly. For
example, consider leaf functions in an event dispatching system. They may
well be "hot," but tragically non-present when we collect the heap.

Until now, we've relied on a weak root to cache the feedback vector in
this case. Since there is no way to signal intent or relative importance,
this weak root is as susceptible to clearing as any other weak root at
garbage collection time.

Meanwhile, the feedback vector has become more important. All of our
ICs store their data there. Literal and regex boilerplates are stored there.
If we lose the vector, then we not only lose optimized code built from
it, we also lose the very feedback which allowed us to create that optimized
code. Therefore it's vital to express that dependency through the root
set.

This CL does this by creating a strong link to a feedback
vector at the instantiation site of the function closure.
This instantiation site is in the code and feedback vector
of the outer closure.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2674593003
Cr-Commit-Position: refs/heads/master@{#42953}
2017-02-06 10:18:05 +00:00
bmeurer
2baea747de [stubs] Remove obsolete CALL_IC code kind.
We don't need Code::CALL_IC for anything now that the CallICStub is
migrated and no longer hooks into the traditional IC system.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2669193002
Cr-Commit-Position: refs/heads/master@{#42890}
2017-02-02 13:33:26 +00:00
eholk
91f8a063cc [wasm] Move protected instruction info to RelocInfo
Previously this information was encoded in a FixedArray dangling off the
Code object. This extra field seems to be responsible for increased memory
usage, as seen in the linked bugs. In this change, we instead encode this
in the RelocInfo and remove the field from the Code object.

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=678583
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=671180
BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=670733

Review-Url: https://codereview.chromium.org/2651833003
Cr-Commit-Position: refs/heads/master@{#42802}
2017-01-31 02:25:57 +00:00
mvstanton
93f05b64ae [TypeFeedbackVector] Combine the literals array and the feedback vector.
They have the same lifetime. It's a match!

Both structures are native context dependent and dealt with (creation,
clearing, gathering feedback) at the same time. By treating the spaces used
for literal boilerplates as feedback vector slots, we no longer have to keep
track of the materialized literal count elsewhere.

A follow-on CL removes even more parser infrastructure related to this count.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2655853010
Cr-Commit-Position: refs/heads/master@{#42771}
2017-01-30 12:31:35 +00:00
marja
5f950698c0 [objects.h splitting] Move out ConstantElementsPair and BoileplateDescriptor.
BUG=v8:5402

Review-Url: https://codereview.chromium.org/2663513002
Cr-Commit-Position: refs/heads/master@{#42742}
2017-01-27 15:29:47 +00:00
bmeurer
ec00a78f3f [turbofan] Assign proper type to Object.prototype.toString().
BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2652273003
Cr-Commit-Position: refs/heads/master@{#42691}
2017-01-26 12:07:22 +00:00
kozyatinskiy
cb545a8c0c [inspector] change target promise for kDebugWillHandle & kDebugDidHandle
- kDebugPromiseCreated(task, parent_task)
This event occurs when promise is created (PromiseHookType::Init). V8Debugger uses this event to maintain task -> parent task map.

- kDebugEnqueueAsyncFunction(task)
This event occurs when first internal promise for async function is created. V8Debugger collects stack trace at this point.

- kDebugEnqueuePromiseResolve(task),
This event occurs when Promise fulfills with resolved status. V8Debugger collects stack trace at this point.

- kDebugEnqueuePromiseReject(task),
This event occurs when Promise fulfills with rejected status. V8Debugger collects stack trace at this point.

- kDebugPromiseCollected,
This event occurs when Promise is collected and no other chained callbacks can be added. V8Debugger removes information about async task for this promise.

- kDebugWillHandle,
This event occurs when chained promise function (either resolve or reject handler) is called. V8Debugger installs parent promise's stack (based on task -> parent_task map) as current if available or current promise's scheduled stack otherwise.

- kDebugDidHandle,
This event occurs after chained promise function has finished. V8Debugger restores asynchronous call chain to previous one.

With this change all instrumentation calls are related to current promise (before WillHandle and DidHandle were related to next async task).

Before V8Debugger supported only the following:
- asyncTaskScheduled(task1)
- asyncTaskStarted(task1)
- asyncTaskFinished(task1)

Now V8Debugger supports the following:
- asyncTaskScheduled(parent_task)
..
- asyncTaskCreated(task, parent_task),
- asyncTaskStarted(task), uses parent_task scheduled stack
- asyncTaskScheduled(task)
- asyncTaskFinished(task)

Additionally: WillHandle and DidHandle were migrated to PromiseHook API.

More details: https://docs.google.com/document/d/1u19N45f1gSF7M39mGsycJEK3IPyJgIXCBnWyiPeuJFE

BUG=v8:5738
R=dgozman@chromium.org,gsathya@chromium.org,yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2650803003
Cr-Commit-Position: refs/heads/master@{#42644}
2017-01-25 07:05:43 +00:00
kozyatinskiy
ac50c79a3e [inspector] implemented blackboxing inside v8
V8 has internal mechanism to ignore steps and breaks inside internal scripts, in this CL it's reused for blackboxing implementation.
Advantages:
- much faster blackboxing implementation (before we at least wrap and collect current call stack for each step),
- get rid of StepFrame action and potential pause in blackboxed code after N StepFrame steps,
- simplification of debugger agent logic.
Disadvtanges:
- currently when user was paused in blackboxed code (e.g. on breakpoint) and then makes step action, debugger ignores blackboxed state of the script and allows to use step actions as usual - this behavior is regressed, we still able to support it on frontend side.

Current state and proposed changes for blackboxing: https://docs.google.com/document/d/1hnzaXPAN8_QC5ENxIgxgMNDbXLraM_OXT73rAyijTF8/edit?usp=sharing

BUG=v8:5842
R=yangguo@chromium.org,dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2633803002
Cr-Commit-Position: refs/heads/master@{#42614}
2017-01-24 01:50:25 +00:00
ishell
f9f5fc31fd Access double fields in C++ as uint64_t fields to preserve signaling bit of a NaN.
Manipulating the signaling NaN used for the hole and uninitialized double
field sentinel in C++, e.g. with bit_cast or HeapNumber::value()/set_value(),
will change its value on ia32 (the x87 stack is used to return values and
stores to the stack silently clear the signalling bit).

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2652553003
Cr-Commit-Position: refs/heads/master@{#42609}
2017-01-23 18:18:48 +00:00
yangguo
3a9152ece7 Split some SharedFunctionInfo's compiler hints off into debugger hints.
We are planning to add a few more debugger related bits, and are running
out of compiler hints bits. The new bit field is going to be part of the
debug info struct. If the debug info is not available, we store the bit
field in its place on the shared function info.

Review-Url: https://codereview.chromium.org/2649873002
Cr-Commit-Position: refs/heads/master@{#42594}
2017-01-23 10:25:02 +00:00
gsathya
72e8a97815 [pattern rewriter] Only desugar to call %ToName on computed properties
Convert strings to numbers if possible in the runtime call and store
in excluded property list.

BUG=v8:5549

Review-Url: https://codereview.chromium.org/2639333004
Cr-Commit-Position: refs/heads/master@{#42581}
2017-01-21 01:09:47 +00:00
franzih
399f36b518 [runtime] Allocate space for computed property names.
Allocate space in the backing store for computed property names.

The property backing store was pre-allocated for the constant
properties up to the first non-constant (computed name) property.
To use lowering for storing data properties in literals
with computed property names effectively, a fast store is needed, i.e.,
available space in the property backing store for properties
with computed names.

backing_store_size is the number of all properties (including
computed names, but without __proto__)
that is calculated in the ast and passed to the runtime function that allocates
the property backing store. backing_store_size and
constant_properties constitute a BoilerplateDescription.

backing_store_size might be slightly too high because computed names
can evaluate to the same name, but that should be a rare
case so over-allocating is OK.

If a property is __proto__, we don't store it as a regular
property, because the map changes. Keep track of
has_seen_proto in the parser to calculate the
backing store size correctly.

BUG=v8:5625

Review-Url: https://codereview.chromium.org/2632503003
Cr-Commit-Position: refs/heads/master@{#42576}
2017-01-20 18:47:55 +00:00
ishell
14bf73576c Remove one of the JSObject::WriteToField() methods in favor of another.
BUG=

Review-Url: https://codereview.chromium.org/2645083003
Cr-Commit-Position: refs/heads/master@{#42571}
2017-01-20 17:56:28 +00:00
marja
7366d8954c objects.h splitting: Move RegExpMatchInfo.
BUG=v8:5402

Review-Url: https://codereview.chromium.org/2642353002
Cr-Commit-Position: refs/heads/master@{#42552}
2017-01-20 13:01:55 +00:00
bmeurer
f23819ef6d [turbofan] Assign proper types to various builtins.
Let the Typer assign proper types to Map, Set, WeakMap and WeakSet
builtins. Also assign a proper type to Array.isArray, Object.assign
and Object.create.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2640783006
Cr-Commit-Position: refs/heads/master@{#42535}
2017-01-20 08:56:33 +00:00
mvstanton
55feaaea4c Revert [TypeFeedbackVector] Root literal arrays in function literal slots
GC performance issues need to be addressed first.

TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642743002
Cr-Original-Commit-Position: refs/heads/master@{#42495}
Committed: 7803aa1ffb
Review-Url: https://codereview.chromium.org/2642743002
Cr-Commit-Position: refs/heads/master@{#42517}
2017-01-19 17:12:28 +00:00
jbroman
ba2cd16986 Mark JSArrayBuffer::SetupAllocatingData with WARN_UNUSED_RESULT.
Also update a call in cctest to check the result.

BUG=chromium:681843

Review-Url: https://codereview.chromium.org/2647573003
Cr-Commit-Position: refs/heads/master@{#42513}
2017-01-19 16:23:07 +00:00
jkummerow
3e915e12a1 Internalize strings in-place (reland^3)
using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

(Previously landed as #42168 / af51befe69)
(Previously landed as #42193 / 4c699e349a)
(Previously landed as #42235 / ec45e6ed2e)

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42503}
2017-01-19 13:27:59 +00:00
machenbach
a8f2890757 Revert of Revert [TypeFeedbackVector] Root literal arrays in function literal slots (patchset #2 id:20001 of https://codereview.chromium.org/2642743002/ )
Reason for revert:
Breaks nosnap:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/13802

Original issue's description:
> Revert [TypeFeedbackVector] Root literal arrays in function literal slots
>
> GC performance issues need to be addressed first.
>
> TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2642743002
> Cr-Commit-Position: refs/heads/master@{#42495}
> Committed: 7803aa1ffb

TBR=mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642933003
Cr-Commit-Position: refs/heads/master@{#42496}
2017-01-19 12:01:36 +00:00
mvstanton
7803aa1ffb Revert [TypeFeedbackVector] Root literal arrays in function literal slots
GC performance issues need to be addressed first.

TBR=bmeurer@chromium.org, mstarzinger@chromium.org, yangguo@chromium.org
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2642743002
Cr-Commit-Position: refs/heads/master@{#42495}
2017-01-19 10:38:04 +00:00
neis
b0f5abbea3 [modules] Add an IsModule flag to ScriptOriginOptions.
Since the script origin is part of the key used in the compilation
cache, this ensures that the cache never confuses a module with a
non-module script.

BUG=v8:1569,v8:5685

Review-Url: https://codereview.chromium.org/2611643002
Cr-Commit-Position: refs/heads/master@{#42490}
2017-01-19 06:59:20 +00:00
cbruni
5f7af3cd0f [collections] Shuffle OrderedHashTable fields around for future optimization
A future linear version of the hash table will only need the element count and
deleted element count. Hence moving them to the beginning of the underlying
fixed array makes the transition easier.

BUG=v8:5717

Review-Url: https://codereview.chromium.org/2630373002
Cr-Commit-Position: refs/heads/master@{#42459}
2017-01-18 14:26:56 +00:00
gsathya
54b5c4b853 [ESnext] Implement Object Rest
This rewrites the rest property into a runtime call which sets up the
correct properties in the newly created object.

- Changes flag to --harmony-object-rest-spread
- Changes pattern rewriter to desugar rest property
- Adds new runtime function CopyDataPropertiesWithExcludedProperties

BUG=v8:5549

Review-Url: https://codereview.chromium.org/2620943002
Cr-Commit-Position: refs/heads/master@{#42430}
2017-01-18 01:05:17 +00:00
ishell
23fb6cf07d [runtime] Remove redundant StoreMode enum.
BUG=v8:5495

Review-Url: https://codereview.chromium.org/2639583002
Cr-Commit-Position: refs/heads/master@{#42419}
2017-01-17 15:41:45 +00:00
ishell
322a37856a [runtime] Add DescriptorArray::GeneralizeAllFields().
... and rename [Copy]GeneralizeAllRepresentations() -> [Copy]GeneralizeAllFields().

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2632373002
Cr-Commit-Position: refs/heads/master@{#42418}
2017-01-17 15:39:06 +00:00
marja
bc35251f5e objects.h splitting: Move ModuleInfoEntry
BUG=v8:5402

Review-Url: https://codereview.chromium.org/2638893002
Cr-Commit-Position: refs/heads/master@{#42405}
2017-01-17 13:28:54 +00:00
jochen
f40fdd1f3b [compiler-dispatcher] make it so that we can always parse on bg threads
BUG=v8:5215
R=rmcilroy@chromium.org,hpayer@chromium.org,vogelheim@chromium.org,marja@chromium.org

Review-Url: https://codereview.chromium.org/2625413004
Cr-Commit-Position: refs/heads/master@{#42361}
2017-01-16 10:49:16 +00:00
kozyatinskiy
154cb8542a [inspector] merged type and name of async task event
Inspector uses event name only for enqueue* events and doesn't really need name for other events.

BUG=v8:5738
R=jgruber@chromium.org,gsathya@chromium.org
TBR=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2628173005
Cr-Commit-Position: refs/heads/master@{#42339}
2017-01-13 19:13:40 +00:00
cbruni
c60ec4e111 [compiler] Support Object.create(null) inlining in TF
In the ideal case, this will speed up Object.create(null) by ~10x.

Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
              IsSpecialReceiverInstanceType(InstanceType) helpers.

BUG=v8:5788

Review-Url: https://codereview.chromium.org/2622723003
Cr-Commit-Position: refs/heads/master@{#42336}
2017-01-13 16:47:12 +00:00
cbruni
aca17974f6 [printing] Improve FixedArray debug printing
- condense repeated elements
- print map

BUG=

Review-Url: https://codereview.chromium.org/2626023002
Cr-Commit-Position: refs/heads/master@{#42330}
2017-01-13 13:57:00 +00:00
ishell
4caeb1e9eb [runtime] Cleanup DescriptorArray interface, remove more PropertyType usages.
BUG=v8:5495

Review-Url: https://codereview.chromium.org/2633553002
Cr-Commit-Position: refs/heads/master@{#42329}
2017-01-13 13:23:27 +00:00
cbruni
83d5b65ae0 Revert of [compiler] Support Object.create(null) inlining in TF (patchset #5 id:80001 of https://codereview.chromium.org/2622723003/ )
Reason for revert:
Breaks buildbot: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20avx2/builds/13399/steps/Benchmarks/logs/stdio

Original issue's description:
> [compiler] Support Object.create(null) inlining in TF
>
> In the ideal case, this will speed up Object.create(null) by ~10x.
>
> Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
>               IsSpecialReceiverInstanceType(InstanceType) helpers.
>
> BUG=v8:5788
>
> Review-Url: https://codereview.chromium.org/2622723003
> Cr-Commit-Position: refs/heads/master@{#42321}
> Committed: ff7063c7d5

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5788

Review-Url: https://codereview.chromium.org/2636493003
Cr-Commit-Position: refs/heads/master@{#42326}
2017-01-13 12:56:03 +00:00
neis
9eb8714262 [modules] Remove dead code.
TBR=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2621413009
Cr-Commit-Position: refs/heads/master@{#42325}
2017-01-13 12:23:06 +00:00
cbruni
ff7063c7d5 [compiler] Support Object.create(null) inlining in TF
In the ideal case, this will speed up Object.create(null) by ~10x.

Drive-by-fix: Spread usage of new IsSpecialReceiverMap() and
              IsSpecialReceiverInstanceType(InstanceType) helpers.

BUG=v8:5788

Review-Url: https://codereview.chromium.org/2622723003
Cr-Commit-Position: refs/heads/master@{#42321}
2017-01-13 12:04:35 +00:00
gsathya
687b60c874 [promisehook] Pass deferred promise to Before/After callback
Before, in `var p1 = p.then(() => {}) we would trigger the
before/after callbacks with p as the associated promise, but we must
call it with p1.

Also removes promise from PromiseReactionJobInfo.

Review-Url: https://codereview.chromium.org/2633443002
Cr-Commit-Position: refs/heads/master@{#42295}
2017-01-12 22:06:55 +00:00
ishell
aee244b0e1 [modules] Define @@toStringTag on namespace object as a field.
The constant field tracking implies data constants to be stored
in fields instead of descriptor arrays. This CL does necessary
modifications to the JSModuleNamespace map setup.

BUG=v8:1569, v8:5495

Review-Url: https://codereview.chromium.org/2625093005
Cr-Commit-Position: refs/heads/master@{#42294}
2017-01-12 21:40:04 +00:00
ishell
5d85e8ccf9 [printing] Remove duplicate code that prints property details.
BUG=

Review-Url: https://codereview.chromium.org/2627003005
Cr-Commit-Position: refs/heads/master@{#42291}
2017-01-12 21:22:48 +00:00
ishell
d3d57ebaf6 [runtime] Use PropertyKind/PropertyLocation instead of PropertyType.
This is a necessary cleanup before introducing PropertyConstness bit.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2624903003
Cr-Commit-Position: refs/heads/master@{#42277}
2017-01-12 16:37:12 +00:00
verwaest
75a2fce3a2 [runtime] Remove SharedFunctionInfo::is_function which is the inverse of SFI::is_toplevel
BUG=

Review-Url: https://codereview.chromium.org/2629143002
Cr-Commit-Position: refs/heads/master@{#42275}
2017-01-12 16:16:12 +00:00
jkummerow
b4654bf30e Revert of Internalize strings in-place (patchset #20 id:380001 of https://codereview.chromium.org/2549773002/ )
Reason for revert:
Blocks roll, ASan detects leaking ExternalStrings.

Original issue's description:
> Internalize strings in-place (reland^2)
>
> using newly introduced ThinStrings, which store a pointer to the actual,
> internalized string they represent.
>
> BUG=v8:4520
>
> (Previously landed as #42168 / af51befe69)
> (Previously landed as #42193 / 4c699e349a)
>
> Review-Url: https://codereview.chromium.org/2549773002
> Cr-Commit-Position: refs/heads/master@{#42235}
> Committed: ec45e6ed2e

TBR=ishell@chromium.org,hpayer@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4520

Review-Url: https://codereview.chromium.org/2626893005
Cr-Commit-Position: refs/heads/master@{#42271}
2017-01-12 15:00:19 +00:00
yangguo
aa75904e3c [debugger] infrastructure for side-effect-free debug-evaluate.
R=jgruber@chromium.org, mstarzinger@chromium.org
BUG=v8:5821

Review-Url: https://codereview.chromium.org/2622863003
Cr-Commit-Position: refs/heads/master@{#42270}
2017-01-12 14:18:45 +00:00
mvstanton
b8294aaa97 [TypeFeedbackVector] Root literal arrays in function literals slots
Literal arrays and feedback vectors for a function can be garbage
collected if we don't have a rooted closure for the function, which
happens often. It's expensive to come back from this (recreating
boilerplates and gathering feedback again), and the cost is
disproportionate if the function was inlined into optimized code.

To guard against losing these arrays when we need them, we'll now
create literal arrays when creating the feedback vector for the outer
closure, and root them strongly in that vector.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2620753003
Cr-Original-Commit-Position: refs/heads/master@{#42258}
Committed: 3188780410
Review-Url: https://codereview.chromium.org/2620753003
Cr-Commit-Position: refs/heads/master@{#42264}
2017-01-12 11:29:09 +00:00
machenbach
3d9e2ea32d Revert of [TypeFeedbackVector] Root literal arrays in function literals slots (patchset #7 id:120001 of https://codereview.chromium.org/2620753003/ )
Reason for revert:
gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/8105

also on mac

Original issue's description:
> [TypeFeedbackVector] Root literal arrays in function literals slots
>
> Literal arrays and feedback vectors for a function can be garbage
> collected if we don't have a rooted closure for the function, which
> happens often. It's expensive to come back from this (recreating
> boilerplates and gathering feedback again), and the cost is
> disproportionate if the function was inlined into optimized code.
>
> To guard against losing these arrays when we need them, we'll now
> create literal arrays when creating the feedback vector for the outer
> closure, and root them strongly in that vector.
>
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2620753003
> Cr-Commit-Position: refs/heads/master@{#42258}
> Committed: 3188780410

TBR=bmeurer@chromium.org,mstarzinger@chromium.org,yangguo@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2626863004
Cr-Commit-Position: refs/heads/master@{#42260}
2017-01-12 10:10:56 +00:00
mvstanton
3188780410 [TypeFeedbackVector] Root literal arrays in function literals slots
Literal arrays and feedback vectors for a function can be garbage
collected if we don't have a rooted closure for the function, which
happens often. It's expensive to come back from this (recreating
boilerplates and gathering feedback again), and the cost is
disproportionate if the function was inlined into optimized code.

To guard against losing these arrays when we need them, we'll now
create literal arrays when creating the feedback vector for the outer
closure, and root them strongly in that vector.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2620753003
Cr-Commit-Position: refs/heads/master@{#42258}
2017-01-12 09:28:48 +00:00
jkummerow
ec45e6ed2e Internalize strings in-place (reland^2)
using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

(Previously landed as #42168 / af51befe69)
(Previously landed as #42193 / 4c699e349a)

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42235}
2017-01-11 14:59:35 +00:00
clemensh
81700ddfdc [wasm] Introduce WasmToInterpreterFrame
and rename WasmFrame to WasmCompiledFrame.
The WasmToInterpreterFrames are not used yet; this will follow in a
follow-up CL (see tracking bug for the overall picture).
Those frames will represent frames for WASM_TO_INTERPRETER stubs, which
call from wasm code to the wasm interpreter, implemented in C++.
They will support the Summarize method to inspect the stack frames in
the wasm interpreter.

R=yangguo@chromium.org, titzer@chromium.org
BUG=v8:5822

Review-Url: https://codereview.chromium.org/2623773004
Cr-Commit-Position: refs/heads/master@{#42213}
2017-01-11 10:16:10 +00:00
jkummerow
7ef86f8091 Revert of Internalize strings in-place (patchset #17 id:320001 of https://codereview.chromium.org/2549773002/ )
Reason for revert:
blocks roll, see: https://codereview.chromium.org/2628733002/

Debug mode runs into an Abort("External string expected, but not found").

Original issue's description:
> Internalize strings in-place (reland)
>
> using newly introduced ThinStrings, which store a pointer to the actual,
> internalized string they represent.
>
> BUG=v8:4520
>
> (Previously landed as #42168 / af51befe69.
>
> Review-Url: https://codereview.chromium.org/2549773002
> Cr-Commit-Position: refs/heads/master@{#42193}
> Committed: 4c699e349a

TBR=ishell@chromium.org,hpayer@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4520

Review-Url: https://codereview.chromium.org/2625073002
Cr-Commit-Position: refs/heads/master@{#42212}
2017-01-11 09:59:52 +00:00
jkummerow
4c699e349a Internalize strings in-place (reland)
using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

(Previously landed as #42168 / af51befe69.

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42193}
2017-01-10 19:08:58 +00:00
titzer
6921b71d41 [test] Fix test-api.cc test for caching of FunctionTemplate.
R=verwaest@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2627543004
Cr-Commit-Position: refs/heads/master@{#42188}
2017-01-10 16:59:57 +00:00
marja
03762b8488 objects.h splitting: move ModuleInfo
Including a fix: object-macros.h needs to be the last include: otherwise
we'll have a problem when a file does this:

#include "object-macros.h"
#include "x.h" // x.h also includes object-macros.h

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2623573003
Cr-Commit-Position: refs/heads/master@{#42187}
2017-01-10 16:05:34 +00:00
ishell
0f159f5973 [runtime] Add MapUpdater class that manages all kinds of map updates.
... including property reconfiguring, elements kind change and migration
of a map to an up-to-date non-deprecated version.

BUG=v8:5495

Review-Url: https://codereview.chromium.org/2601643002
Cr-Commit-Position: refs/heads/master@{#42177}
2017-01-10 12:42:53 +00:00
machenbach
32c0dff263 Revert of Internalize strings in-place (patchset #16 id:300001 of https://codereview.chromium.org/2549773002/ )
Reason for revert:
gc stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/8024

Original issue's description:
> Internalize strings in-place
>
> using newly introduced ThinStrings, which store a pointer to the actual,
> internalized string they represent.
>
> BUG=v8:4520
>
> Review-Url: https://codereview.chromium.org/2549773002
> Cr-Commit-Position: refs/heads/master@{#42168}
> Committed: af51befe69

TBR=ishell@chromium.org,hpayer@chromium.org,bmeurer@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4520

Review-Url: https://codereview.chromium.org/2621913002
Cr-Commit-Position: refs/heads/master@{#42170}
2017-01-10 11:33:04 +00:00
jkummerow
af51befe69 Internalize strings in-place
using newly introduced ThinStrings, which store a pointer to the actual,
internalized string they represent.

BUG=v8:4520

Review-Url: https://codereview.chromium.org/2549773002
Cr-Commit-Position: refs/heads/master@{#42168}
2017-01-10 10:58:03 +00:00
cbruni
09167bf6cd Add Object::IsNullOrUndefined(Isolate*) helper method
The pattern IsNull(isolate) || IsUndefined(isolate) is used in many places all
over the code base.

Review-Url: https://codereview.chromium.org/2601503002
Cr-Commit-Position: refs/heads/master@{#42138}
2017-01-09 13:40:51 +00:00
gsathya
a40b7172fe [ESnext] Implement Object spread
This patch adds parsing of spread object property.

-- Changes ParsePropertyName to parse Token::ELLIPSIS.
-- Throws if rest is encountered by setting a pattern error.
-- Adds a new PropertyKind enum (SPREAD)
-- Adds a new ObjectLiteralProperty::kind (SPREAD)
-- Adds a new harmony-object-spread flag and protects the parser code
with it.
-- Adds a new runtime function called CopyDataProperties
-- Does not add any support for this feature in fullcodegen.
-- Ignition calls out to a runtime function CopyDataProperties to
perform spread operation.
-- Move FastAssign from builtins-objects.cc to objects.cc
-- Refactor Builtin_ObjectAssign to use SetOrCopyDataProperties

Object rest will be implemented in a follow on patch.

BUG=v8:5549

Review-Url: https://codereview.chromium.org/2606833002
Cr-Commit-Position: refs/heads/master@{#42102}
2017-01-05 23:44:25 +00:00
adamk
1bc48138a6 [class fields] Remove a bit of dead code leftover from cleanup
R=littledan@chromium.org
BUG=v8:5367

Review-Url: https://codereview.chromium.org/2611063002
Cr-Commit-Position: refs/heads/master@{#42097}
2017-01-05 18:11:37 +00:00
gsathya
a2c15ba376 [promises] Refactor debug code
-- Removes remaning debug from promise.js and moves it to c++
-- Changes debug_id to be a smi in PromiseReactionJobInfo and
   PromiseResolveThenableJobInfo.
-- Changes debug_name to be a smi in PromiseReactionJobInfo and
   PromiseResolveThenableJobInfo.
-- Adds PromiseDebugActionName and PromiseDebugActionType enums
-- Adds PromiseDebugActionNameToString and
   PromiseDebugActionTypeToString helper methods
-- Changes variable `status` to be int in runtime functions.
-- Changes debug_id to start from 1, not 0 for easier bookkeeping.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2606093002
Cr-Commit-Position: refs/heads/master@{#42052}
2017-01-03 21:43:38 +00:00
bmeurer
3a81236f4a [builtins] Migrate more Date builtins to TurboFan builtins.
Migrate Date.prototype.valueOf and Date.prototype[ @@toPrimitive ]
to use the CodeStubAssembler, to avoid going through C++ always
when comparing or subtracting two dates.

R=epertoso@chromium.org

Review-Url: https://codereview.chromium.org/2608143003
Cr-Commit-Position: refs/heads/master@{#42030}
2017-01-03 13:35:05 +00:00
caitp
4f95a1eb5f [promises] port NewPromiseCapability to TF
- Adds CodeAssembler::ConstructJS() to simplify calling JS functions as
constructors, used by NewPromiseCapability()
- Defines PromiseCapability as a special JSObject subclass, with a
non-exensible Map, and read-only non-configurable DataDescriptors which
point to its in-object fields. This allows its fields to be used by JS
builtins until there is no longer any need.

Currently, the performance benefit comes from
https://codereview.chromium.org/2567033003/, but does not appear to
regress performance in any significant way.

BUG=v8:5343
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2567333002
Cr-Commit-Position: refs/heads/master@{#42014}
2017-01-02 17:22:30 +00:00
gsathya
5668ce3987 [promises] Remove deferred object
This patch stores the promise, resolve, reject properties of the
deferred object created by CreateInternalPromiseCapability and
NewPromiseCapability directly on the promise (if the promise hasn't
been fulfilled), otherwise they are stored on the
PromiseReactionJobInfo.

This patch removes the currently unused
CreateInternalPromiseCapability and inlines the call to create the
deferred promise object.

NewPromiseCapability is the only function that works with a deferred.

This patch results in a 8.5% improvement in benchmarks over 5 runs.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2590563003
Cr-Commit-Position: refs/heads/master@{#41991}
2016-12-29 20:30:28 +00:00
mvstanton
05873add85 [builtins] More stubs to the builtin-o-sphere.
The following ported to builtins:
FastCloneRegExp
FastCloneShallowArray
FastCloneShallowObject

BUG=
TBR=rmcilroy@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/2605893002
Cr-Commit-Position: refs/heads/master@{#41989}
2016-12-29 13:02:08 +00:00
adamk
c5dd44c331 Remove duplicate C++ implementation of Object.prototype.toString
The only caller was the API, and it can just as easily use the
TurboFan version.

R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2603493002
Cr-Commit-Position: refs/heads/master@{#41962}
2016-12-27 18:28:47 +00:00
gsathya
0f5c69c5ed [promises] Move PromiseHasUserDefinedRejectHandler to c++
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2604483002
Cr-Commit-Position: refs/heads/master@{#41947}
2016-12-23 18:03:33 +00:00
cbruni
f73973092c [ic] Always use generic ICs for growing element stores on arguments
In certain corner-cases we would grow a FAST_ELEMENTS packed backing store of a
JS_ARGUMENTS_TYPE object without converting to holey elements kinds. As a side
effect you could then read out the_hole.

BUG=v8:5772

Review-Url: https://codereview.chromium.org/2597013004
Cr-Commit-Position: refs/heads/master@{#41921}
2016-12-22 14:10:51 +00:00
hablich
aa8a208a47 Revert of [TypeFeedbackVector] Root literal arrays in function literals slots (patchset #11 id:370001 of https://codereview.chromium.org/2504153002/ )
Reason for revert:
Speculative revert because of blocked roll: https://codereview.chromium.org/2596013002/

Original issue's description:
> [TypeFeedbackVector] Root literal arrays in function literals slots
>
> Literal arrays and feedback vectors for a function can be garbage
> collected if we don't have a rooted closure for the function, which
> happens often. It's expensive to come back from this (recreating
> boilerplates and gathering feedback again), and the cost is
> disproportionate if the function was inlined into optimized code.
>
> To guard against losing these arrays when we need them, we'll now
> create literal arrays when creating the feedback vector for the outer
> closure, and root them strongly in that vector.
>
> BUG=v8:5456
>
> Review-Url: https://codereview.chromium.org/2504153002
> Cr-Commit-Position: refs/heads/master@{#41893}
> Committed: 93df094081

TBR=bmeurer@chromium.org,mlippautz@chromium.org,mvstanton@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5456

Review-Url: https://codereview.chromium.org/2597163002
Cr-Commit-Position: refs/heads/master@{#41917}
2016-12-22 10:26:36 +00:00
eholk
5fa423d7c2 [wasm] sundry trap handler fixes
This CL includes several small bug fixes for trap handlers. Among the changes:

* Use the correct representation for ProtectedLoads, enabling protected loads of
  floating point types.

* Including the protected instruction list in what gets serialized for Code
  objects. This is needed to allow deserialization for Wasm modules to work.

* Get the context needed to through and exception from the Isolate rather than
  getting it as a parameter to the Protected instructions. Passing it in as an
  argument is problematic when code is compiled ahead of time, as the context
  may not be known yet. The new approach is similar to how it works for TrapIf
  and TrapUnless.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2591903002
Cr-Commit-Position: refs/heads/master@{#41907}
2016-12-22 00:31:59 +00:00
mvstanton
93df094081 [TypeFeedbackVector] Root literal arrays in function literals slots
Literal arrays and feedback vectors for a function can be garbage
collected if we don't have a rooted closure for the function, which
happens often. It's expensive to come back from this (recreating
boilerplates and gathering feedback again), and the cost is
disproportionate if the function was inlined into optimized code.

To guard against losing these arrays when we need them, we'll now
create literal arrays when creating the feedback vector for the outer
closure, and root them strongly in that vector.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2504153002
Cr-Commit-Position: refs/heads/master@{#41893}
2016-12-21 14:06:29 +00:00
marja
a48e5ab880 objects.h splitting: Split out ScopeInfo + add necessary structures.
See tracking bug for more information.

BUG=v8:5402

Review-Url: https://codereview.chromium.org/2594663002
Cr-Commit-Position: refs/heads/master@{#41861}
2016-12-20 14:08:21 +00:00
cbruni
1e56813f48 [runtime] Add fast-paths for common conversion methods
Add inlineable fast-paths for Object::ToPropertyKey, Object::ToLength and
Object::ToIndex for the most common argument types.

BUG=

Review-Url: https://codereview.chromium.org/2587013002
Cr-Commit-Position: refs/heads/master@{#41856}
2016-12-20 12:21:00 +00:00
cbruni
608df93382 Revert of [runtime] Add fast-paths for common conversion methods (patchset #1 id:1 of https://codereview.chromium.org/2587013002/ )
Reason for revert:
breaks mips port: http://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/6131

Original issue's description:
> [runtime] Add fast-paths for common conversion methods
>
> Add inlineable fast-paths for Object::ToPropertyKey, Object::ToLength and
> Object::ToIndex for the most common argument types.
>
> BUG=
>
> Review-Url: https://codereview.chromium.org/2587013002
> Cr-Commit-Position: refs/heads/master@{#41839}
> Committed: d173807b9d

TBR=jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2587373002
Cr-Commit-Position: refs/heads/master@{#41845}
2016-12-20 10:14:23 +00:00
cbruni
d173807b9d [runtime] Add fast-paths for common conversion methods
Add inlineable fast-paths for Object::ToPropertyKey, Object::ToLength and
Object::ToIndex for the most common argument types.

BUG=

Review-Url: https://codereview.chromium.org/2587013002
Cr-Commit-Position: refs/heads/master@{#41839}
2016-12-20 09:50:30 +00:00
cbruni
c0282f608c Add unittests to keep InstanceType lists in sync
STRUCT_LIST and INSTANCE_TYPE_LIST are now forced to have the same order
as the InstanceType enum.

Drive-by-fix 1: Move type check and cast functions closer together in objects-inl.h

Drive-by-fix 2: Remove unused instance types SIGNATURE_INFO_TYPE and  TYPE_SWITCH_INFO_TYPE.

BUG=

Review-Url: https://codereview.chromium.org/2578573002
Cr-Commit-Position: refs/heads/master@{#41804}
2016-12-19 12:50:30 +00:00
cbruni
1c1465f124 [runtime] Add PositiveNumberToUint32 helper to avoid double to uint roundtrip
BUG=

Review-Url: https://codereview.chromium.org/2577143002
Cr-Commit-Position: refs/heads/master@{#41801}
2016-12-19 12:06:58 +00:00
cbruni
c0d6939836 [runtime] Improve Object::ToNumber, ToInteger, ToInt32, ToUint32, ToString
This CL adds inlineable fast-cases for the above conversion functions in
objects-inl.h and a slower conversion function in objects.cc.

BUG=

Review-Url: https://codereview.chromium.org/2579023002
Cr-Commit-Position: refs/heads/master@{#41766}
2016-12-16 14:30:05 +00:00
cbruni
89f159b042 [runtime] Port simple String.prototype.indexOf cases to TF Builtin
Many websites use simple calls to String.prototype.indexOf with either a
one character ASCII needle or needles bigger than the search string. This
CL adds a TFJ builtin for these simple cases, giving up to factor 5 speedup.

Drive-by-fix: Add default Object type to Arguments.at

BUG=

Review-Url: https://codereview.chromium.org/2539093002
Cr-Commit-Position: refs/heads/master@{#41760}
2016-12-16 13:24:07 +00:00
mstarzinger
92b370ee64 Introduce {ConstantElementsPair} struct for type safety.
This introduces an explicit struct for the communication channel between
the {ArrayLiteral} AST node and the corresponding runtime methods. Those
methods take a pair of {ElementsKind} as well as an array (can either be
a FixedArray or a FixedDoubleArray) of constant values.

For bonus points it also reduces the size of the involved heap object by
one word (i.e. length field of FixedArray not needed anymore).

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2581683003
Cr-Commit-Position: refs/heads/master@{#41752}
2016-12-16 10:57:06 +00:00
neis
e3ad4f131b [modules] Remove @@iterator on namespace objects.
TC39 decided at their last meeting to remove this feature.

R=adamk@chromium.org
TBR=ulan@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2578053003
Cr-Commit-Position: refs/heads/master@{#41745}
2016-12-16 08:57:29 +00:00
jochen
4f2cb8fe82 Reland of "Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID"
Original CL description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Review-Url: https://codereview.chromium.org/2547483002

BUG=v8:5589
TBR=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2577063002
Cr-Commit-Position: refs/heads/master@{#41734}
2016-12-15 17:19:55 +00:00
gsathya
b4aadaec1e [promisehook] Store promise in PromiseReactionJob
This will be used in PromiseHook.

BUG=v8:4643

Review-Url: https://codereview.chromium.org/2581503003
Cr-Commit-Position: refs/heads/master@{#41730}
2016-12-15 15:50:54 +00:00
kozyatinskiy
3dea2c8354 Revert of Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID (patchset #11 id:190001 of https://codereview.chromium.org/2547483002/ )
Reason for revert:
LiveEdit is broken in some cases.

Original issue's description:
> Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
>
> Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
> we can use them as an index into an array, instead of using a
> WeakFixedArray where we have to do a linear scan.
>
> Hooking up liveedit is a bit more involved, see
> https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
> for an overview
>
> BUG=v8:5589
> R=verwaest@chromium.org,jgruber@chromium.org
>
> Committed: https://crrev.com/6595e7405769dc9d49e9568d61485efc6d468baf
> Cr-Commit-Position: refs/heads/master@{#41600}

TBR=jgruber@chromium.org,verwaest@chromium.org,yangguo@chromium.org,jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5589,chromium:673950
NOPRESUBMIT=true

Review-Url: https://codereview.chromium.org/2578433002
Cr-Commit-Position: refs/heads/master@{#41684}
2016-12-14 02:05:05 +00:00
gsathya
9fc3c017e1 PromiseHandle port to TF
Splits PromiseHandle into two TF builtins to account for catch
prediction. An exception in PromiseHandleReject builtin results in a
"caught" prediction whereas an expception in PromiseHandle results in a
"promise rejection" prediction.

An extra is_exception_caught bit is added to Code to mark this catch
prediction behavior.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2572623002
Cr-Commit-Position: refs/heads/master@{#41683}
2016-12-13 23:55:08 +00:00
bradnelson
aabbbec67c [wasm] [asmjs] Route asm.js warnings to the dev console.
Generalize Messages to include an error level.
Add a parameter to AddMessageHandler to select which error levels to receive, using a mask (default being just errors, i.e. the current behavior).

BUG=v8:4203
R=dgozman@chromium.org,machenbach@chromium.org,danno@chromium.org,bmeurer@chromium.org,jochen@chromium.org

Review-Url: https://codereview.chromium.org/2526703002
Cr-Commit-Position: refs/heads/master@{#41648}
2016-12-12 14:48:50 +00:00
yangguo
75f5200508 [perf-prof] fix crash when logging.
Logging for --perf-prof is not GC safe. Now, we are going to
emit source position info for optimized code when we are
profiling, logging, or debugging, and under the same condition,
pre-compute the line ends array for line number computation.

R=tebbi@chromium.org
BUG=v8:5730

Review-Url: https://codereview.chromium.org/2562973002
Cr-Commit-Position: refs/heads/master@{#41619}
2016-12-09 14:30:38 +00:00
clemensh
890d28f361 [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- the StackFrame::State struct now also holds the callee_pc_address,
  which is set in ComputeCallerState. The WASM frame uses this
  information to determine whether the callee frame is WASM_TO_JS, and
  whether that frame is at the ToNumber conversion call.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
Review-Url: https://codereview.chromium.org/2555243002
Cr-Original-Commit-Position: refs/heads/master@{#41599}
Cr-Commit-Position: refs/heads/master@{#41613}
2016-12-09 10:30:19 +00:00
clemensh
d3d125417d Revert of [wasm] Fix location for error in asm.js ToNumber conversion (patchset #5 id:80001 of https://codereview.chromium.org/2555243002/ )
Reason for revert:
gc-stress failures

Original issue's description:
> [wasm] Fix location for error in asm.js ToNumber conversion
>
> In the asm.js code translated to wasm, we call imported functions via a
> WASM_TO_JS stub, which first calls the function and then calls ToNumber
> on the return value. Exceptions can happen in both calls.
> We were only ever reporting the location of the function call, whereas
> asm.js code executed via turbofan reported the location of the type
> coercion operator ("+" on "+foo()" or "|" on "foo()|0").
>
> This CL implements the same behaviour for asm.js code translated to
> wasm. The following is changed:
> - the AsmWasmBuilder records the parent node when descending on a binary
>   operator (also "+foo()" is represented by a binary operation).
> - it stores not one location per call in the source position side
>   table, but two (one for the call, one for the parent which does the
>   type coercion).
> - the wasm compiler annotates the source positions "0" and "1" to the
>   two calls in the WASM_TO_JS wrapper (only if the module origin is
>   asm.js).
> - during stack trace generation (in the StackTraceIterator), when we
>   move from the WASM_TO_JS frame to the WASM frame, we remember at which
>   call inside the WASM_TO_JS wrapper we are, and encode this information
>   in the generated caller state, used for the WASM frame.
> - the same information is also stored in the FrameArray which is used
>   to reconstruct the stack trace later.
>
> R=titzer@chromium.org, bradnelson@chromium.org
> CC=jgruber@chromium.org
> BUG=v8:4203,v8:5724
>
> Committed: https://crrev.com/94cd46b55e24fa2bb7b06b3da4d5ba7f029bc262
> Cr-Commit-Position: refs/heads/master@{#41599}

TBR=bradnelson@chromium.org,mstarzinger@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4203,v8:5724

Review-Url: https://codereview.chromium.org/2563613003
Cr-Commit-Position: refs/heads/master@{#41601}
2016-12-08 17:36:14 +00:00
jochen
6595e74057 Store SharedFunctionInfos of a Script in a FixedArray indexed by their ID
Now that SharedFunctionInfos have a unique ID (and the IDs are dense),
we can use them as an index into an array, instead of using a
WeakFixedArray where we have to do a linear scan.

Hooking up liveedit is a bit more involved, see
https://docs.google.com/presentation/d/1FtNa3U7WsF5bPhY9uGoJG5Y9hnz5VBDabfOWpb4unWI/edit
for an overview

BUG=v8:5589
R=verwaest@chromium.org,jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2547483002
Cr-Commit-Position: refs/heads/master@{#41600}
2016-12-08 17:07:11 +00:00
clemensh
94cd46b55e [wasm] Fix location for error in asm.js ToNumber conversion
In the asm.js code translated to wasm, we call imported functions via a
WASM_TO_JS stub, which first calls the function and then calls ToNumber
on the return value. Exceptions can happen in both calls.
We were only ever reporting the location of the function call, whereas
asm.js code executed via turbofan reported the location of the type
coercion operator ("+" on "+foo()" or "|" on "foo()|0").

This CL implements the same behaviour for asm.js code translated to
wasm. The following is changed:
- the AsmWasmBuilder records the parent node when descending on a binary
  operator (also "+foo()" is represented by a binary operation).
- it stores not one location per call in the source position side
  table, but two (one for the call, one for the parent which does the
  type coercion).
- the wasm compiler annotates the source positions "0" and "1" to the
  two calls in the WASM_TO_JS wrapper (only if the module origin is
  asm.js).
- during stack trace generation (in the StackTraceIterator), when we
  move from the WASM_TO_JS frame to the WASM frame, we remember at which
  call inside the WASM_TO_JS wrapper we are, and encode this information
  in the generated caller state, used for the WASM frame.
- the same information is also stored in the FrameArray which is used
  to reconstruct the stack trace later.

R=titzer@chromium.org, bradnelson@chromium.org
CC=jgruber@chromium.org
BUG=v8:4203,v8:5724

Review-Url: https://codereview.chromium.org/2555243002
Cr-Commit-Position: refs/heads/master@{#41599}
2016-12-08 16:48:08 +00:00
mvstanton
044b2d1bd8 Reland Store OSR'd optimized code on the native context.
The patch was reverted due to a bug - we failed to evict OSR-optimized
code in the case where the SharedFunctionInfo OptimizedCodeMap was
empty/cleared.

Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.

Review-Url: https://codereview.chromium.org/2561083002
Cr-Commit-Position: refs/heads/master@{#41584}
2016-12-08 11:13:59 +00:00
bmeurer
b5f27ef30c Revert of Store OSR'd optimized code on the native context. (patchset #8 id:140001 of https://codereview.chromium.org/2549753002/ )
Reason for revert:
Speculative revert WebGL breakage reported in https://bugs.chromium.org/p/chromium/issues/detail?id=672367

Original issue's description:
> Store OSR'd optimized code on the native context.
>
> Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.
>
> BUG=
>
> Committed: https://crrev.com/378b6b22fb7925ac5b672335a54599f5739e7758
> Cr-Commit-Position: refs/heads/master@{#41554}

TBR=mstarzinger@chromium.org, mvstanton@chromium.org, ulan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2562623003
Cr-Commit-Position: refs/heads/master@{#41571}
2016-12-08 07:29:20 +00:00
gsathya
11359e331a [promises] Port ResolvePromise to TF
-- Moves promiseHasHandlerSymbol to inobject property
-- Ports PromiseResolveClosure to TF
-- Fix a non spec async-await test which fails now because we do a map
check for native promise check (instead of IsPromise). Changing the
constructor (in the test) invalidates the map check.

This patch results in a 7.1% performance improvement in the bluebird
benchmark (over 5 runs).

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2541283002
Cr-Commit-Position: refs/heads/master@{#41569}
2016-12-08 06:12:48 +00:00
mvstanton
378b6b22fb Store OSR'd optimized code on the native context.
Since we OSR code rarely, it makes sense to store it and look for it on the native context rather than the SharedFunctionInfo. This makes the OptimizedCodeMap data structure more space efficient, as it doesn't have to store an ast ID for the OSR entry point.

BUG=

Review-Url: https://codereview.chromium.org/2549753002
Cr-Commit-Position: refs/heads/master@{#41554}
2016-12-07 15:11:04 +00:00
mstarzinger
0ded4cbd41 Remove dead SharedFunctionInfo::TrimOptimizedCodeMap.
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2561563002
Cr-Commit-Position: refs/heads/master@{#41551}
2016-12-07 13:53:24 +00:00
petermarshall
a25e768864 [Ignition/turbo] Add a NewWithSpread bytecode.
This just calls into a runtime function for implementation currently.

Intermediate step in speeding up constructor calls containing a spread.

The NewWithSpread bytecode will probably end up having different arguments with future CLs - the constructor and the new.target should have their own regs. For now we are calling into the runtime function, so we need the regs together.

BUG=v8:5659

Review-Url: https://codereview.chromium.org/2541113004
Cr-Commit-Position: refs/heads/master@{#41542}
2016-12-07 08:35:09 +00:00
gsathya
52e2c154ff Reland Create JSPromise (patchset #16 id:300001 of https://codereview.chromium.org/2536463002/ )"
This reverts commit 4c7cccf9f4.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2554943002
Cr-Commit-Position: refs/heads/master@{#41534}
2016-12-06 18:43:18 +00:00
yangguo
d26cdb7d6f v8::Private::ForApi should be context-independent.
This is done by reimplementing Symbol.for directly on top of
NameDictionary. A nice side effect is the removal of src/js/symbol.js

R=jochen@chromium.org, peria@chromium.org
BUG=chromium:617892

Review-Url: https://codereview.chromium.org/2551763003
Cr-Commit-Position: refs/heads/master@{#41520}
2016-12-06 13:21:38 +00:00
machenbach
4c7cccf9f4 Revert of Create JSPromise (patchset #16 id:300001 of https://codereview.chromium.org/2536463002/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11861

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> Object
> -- New JSObject for promises: JSPromise
>
> Builtins
> -- PromiseThen TFJ
> -- PromiseCreateAndSet TFJ for internal use
> -- PerformPromiseThen TFJ for internal use
> -- PromiseInit for initial promise setup
> -- SpeciesConstructor for use in PromiseThen
> -- ThrowIfNotJSReceiver for use in SpeciesConstructor
> -- AppendPromiseCallback to update FixedArray with new callback
> -- InternalPerformPromiseThen
>
> Promises.js
> -- Cleanup unused symbols
> -- Remove PerformPromiseThen
> -- Remove PromiseThen
> -- Remove PromiseSet
> -- Remove PromiseAttachCallbacks
>
> Runtime
> -- PromiseSet to set promise inobject values
> -- Refactor functions to use FixedArrays for callbacks instead of
>    JSArray
> -- Runtime_PromiseStatus to return promise status
> -- Runtime_PromiseResult to return promise result
> -- Runtime_PromiseDeferred to return deferred attached to promise
> -- Runtime_PromiseRejectReactions to return reject reactions attached
>    to promise
>
> This CL results in a 13.07% improvement in the promises benchmark
> (over 5 runs).
>
> BUG=v8:5343
>
> Committed: https://crrev.com/30b564c76f490f8f6b311a74b25b26cf0a96be2d
> Cr-Commit-Position: refs/heads/master@{#41503}

TBR=bmeurer@chromium.org,jgruber@chromium.org,caitp@igalia.com,gsathya@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2554013002
Cr-Commit-Position: refs/heads/master@{#41512}
2016-12-06 11:19:07 +00:00
gsathya
30b564c76f Object
-- New JSObject for promises: JSPromise

Builtins
-- PromiseThen TFJ
-- PromiseCreateAndSet TFJ for internal use
-- PerformPromiseThen TFJ for internal use
-- PromiseInit for initial promise setup
-- SpeciesConstructor for use in PromiseThen
-- ThrowIfNotJSReceiver for use in SpeciesConstructor
-- AppendPromiseCallback to update FixedArray with new callback
-- InternalPerformPromiseThen

Promises.js
-- Cleanup unused symbols
-- Remove PerformPromiseThen
-- Remove PromiseThen
-- Remove PromiseSet
-- Remove PromiseAttachCallbacks

Runtime
-- PromiseSet to set promise inobject values
-- Refactor functions to use FixedArrays for callbacks instead of
   JSArray
-- Runtime_PromiseStatus to return promise status
-- Runtime_PromiseResult to return promise result
-- Runtime_PromiseDeferred to return deferred attached to promise
-- Runtime_PromiseRejectReactions to return reject reactions attached
   to promise

This CL results in a 13.07% improvement in the promises benchmark
(over 5 runs).

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2536463002
Cr-Commit-Position: refs/heads/master@{#41503}
2016-12-05 21:08:31 +00:00
cbruni
7036eec6f7 Copy dictionary keys and values in enumeration in TransferNamedProperties
During bootstrapping when installing the global object we copy over the
properties from the snapshotted global object to the one created from a
provided template. Originally Genesis::TransferNamedProperties just iterated
over the entries, making the final order hash and thus platform dependent.
This CL fixes this by sorting the keys by enumeration index before copying them
to the destination object and thus making the key enumaration on the global
object platform independent.

Drive-by-fix: avoid crash when printing the global object during bootstrapping.

BUG=chromium:669029

Review-Url: https://codereview.chromium.org/2533223002
Cr-Commit-Position: refs/heads/master@{#41502}
2016-12-05 20:17:43 +00:00
clemensh
34342f312c Move Smi::kZero definition to the header
Since we don't pass references to this constant to the DCHECKs any more
(see http://crrev.com/2524093002), the constant can now be initialized
in the header, reducing code size and increasing performance.

Before the mentioned change in CHECK/DCHECK, this caused link errors.

R=ishell@chromium.org
CC=jgruber@chromium.org
BUG=v8:5684

Review-Url: https://codereview.chromium.org/2541533002
Cr-Commit-Position: refs/heads/master@{#41450}
2016-12-02 10:05:57 +00:00
ishell
39e6f2ca4a [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, chromium:669411, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
Review-Url: https://codereview.chromium.org/2534613002
Cr-Original-Commit-Position: refs/heads/master@{#41332}
Cr-Commit-Position: refs/heads/master@{#41449}
2016-12-02 10:03:33 +00:00
gsathya
b361b59fff [promises] Move promise constructor to TFS
BUG=v8:5343,chromium:660947,chromium:658194

Review-Url: https://codereview.chromium.org/2497523002
Cr-Commit-Position: refs/heads/master@{#41438}
2016-12-01 21:10:02 +00:00
eholk
bf35d15e52 [wasm] OOB traps: build protected instruction list during codegen
During codegen, we build a list mapping protected instructions to their
associated landing pads. This will ultimately by used by the signal handler to
recover from out of bounds faults and throw a JS exception.

This is mostly pulled from my larger in-progress CL at
https://codereview.chromium.org/2371833007/.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2500443004
Cr-Commit-Position: refs/heads/master@{#41400}
2016-11-30 22:32:03 +00:00
rmcilroy
067e9e295f [Interpreter] Add bytecode aging and use it enable CompilationCache for bytecode
Adds a bytecode_age field to BytecodeArray objects. This is incremented each
time the bytecode array is marked by GC, and reset to zero if the bytecode
is executed.

This is used to enable the CompilationCache for interpreted functions,
where Interpreted entries are evicted once the bytecode becomes old.

BUG=chromium:666275,v8:4680

Review-Url: https://codereview.chromium.org/2534763003
Cr-Commit-Position: refs/heads/master@{#41356}
2016-11-29 12:34:58 +00:00
rmcilroy
5fd2b71236 [Heap] Remove concept of MarkingParity.
MarkingParity was used to avoid performing an operation on an object if it was
marked multiple times. We no longer mark things multiple times, so this concept
is no longer required.

BUG=chromium:666275

Review-Url: https://codereview.chromium.org/2529173002
Cr-Commit-Position: refs/heads/master@{#41354}
2016-11-29 12:10:16 +00:00
cbruni
85321456cd [api] Support sharing prototypes between FunctionTemplates
FunctionTemplateInfo::SetPrototypeProviderTemplate adds support for sharing
prototypes between several function templates. This is used to properly set up
Image.prototype and HTMLImageElement.protoype which should be equal according
to the spec.

BUG=chromium:2969

Review-Url: https://codereview.chromium.org/2531653002
Cr-Commit-Position: refs/heads/master@{#41343}
2016-11-29 10:14:18 +00:00
mstarzinger
7a82d8e9e4 [runtime] Simplify handler table lookup semantics.
The range-based exception handler table is by now only used for bytecode
arrays. The semantics of the interpreter are that bytecode offsets point
to the beginning of the currently executing bytecode instruction. Uses
hence need to compensate for lookups based on a "retrun address". This
change removes the need for such off-by-one compensations by changing
lookup semantics to be based on "current instruction" offsets.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2534893002
Cr-Commit-Position: refs/heads/master@{#41339}
2016-11-29 09:17:09 +00:00
machenbach
9c0e2a6723 Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain modificati… (patchset #2 id:40001 of https://codereview.chromium.org/2534613002/ )
Reason for revert:
Layout test crashes:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11691

Original issue's description:
> [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
>
> ... instead of clearing of all the KeyedStoreICs which didn't always work.
>
> BUG=chromium:662907, v8:5561
> TBR=verwaest@chromium.org, bmeurer@chromium.org
>
> Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
> Cr-Commit-Position: refs/heads/master@{#41332}

TBR=jkummerow@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:662907, v8:5561

Review-Url: https://codereview.chromium.org/2538693002
Cr-Commit-Position: refs/heads/master@{#41337}
2016-11-29 08:49:48 +00:00
henrique.ferreiro
bc1a3820c2 Implement DefineOwnProperty for TypedArrays
TypedArrays need specific checks before calling OrdinaryDefineOwnProperty.

BUG=v8:5328

Review-Url: https://codereview.chromium.org/2431223005
Cr-Commit-Position: refs/heads/master@{#41333}
2016-11-29 00:07:58 +00:00
ishell
a39522f44f [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2534613002
Cr-Commit-Position: refs/heads/master@{#41332}
2016-11-28 22:56:52 +00:00
mstarzinger
ac88607375 [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
Review-Url: https://codereview.chromium.org/2529343003
Cr-Original-Commit-Position: refs/heads/master@{#41318}
Cr-Commit-Position: refs/heads/master@{#41323}
2016-11-28 15:58:36 +00:00
mstarzinger
54aac1f778 Revert of [deoptimizer] Remove dead Code::LookupRangeInHandlerTable. (patchset #2 id:20001 of https://codereview.chromium.org/2529343003/ )
Reason for revert:
Seems to break TSAN builds.

https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/12897/steps/Check/logs/stack-traces

Original issue's description:
> [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
>
> This removes the supporting function to perform a range-lookup in the
> exception handler table for unoptimized code. Such tables are by now
> guaranteed to be empty, the deoptimizer cannot encounter this case.
>
> R=jarin@chromium.org
>
> Committed: https://crrev.com/1f27ed9d7da78904e0418364c6394f913eabbe70
> Cr-Commit-Position: refs/heads/master@{#41318}

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2536673002
Cr-Commit-Position: refs/heads/master@{#41319}
2016-11-28 14:07:40 +00:00
mstarzinger
1f27ed9d7d [deoptimizer] Remove dead Code::LookupRangeInHandlerTable.
This removes the supporting function to perform a range-lookup in the
exception handler table for unoptimized code. Such tables are by now
guaranteed to be empty, the deoptimizer cannot encounter this case.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2529343003
Cr-Commit-Position: refs/heads/master@{#41318}
2016-11-28 13:25:20 +00:00
jochen
cfebe6034c Assign unique IDs to FunctionLiterals
They're supposed to be stable across several parse passes, so we'll also
store them in the associated SharedFunctionInfos

To achieve this, the PreParser and Parser need to generated the same number of
FunctionLiterals. To achieve this, we teach the PreParser about desuggaring of
class literals.

For regular functions, the function IDs are assigned in the order they occur in
the source. For arrow functions, however, we only know that it's an arrow function
after parsing the parameter list, and so the ID assigned to the arrow function is
larger than the IDs assigned to functions defined in the parameter list. This
implies that we have to reset the function ID counter to before the parameter list
when re-parsing an arrow function. To be able to do this, we store the number of
function literals found in the parameter list of arrow functions as well.

BUG=v8:5589

Review-Url: https://codereview.chromium.org/2481163002
Cr-Commit-Position: refs/heads/master@{#41309}
2016-11-28 11:40:53 +00:00
bmeurer
ffdf474956 [turbofan] Add more typing rules for Array.prototype builtins.
For a couple of those Array builtins we can specify a useful type that
will help us to eliminate a couple of checks on their outputs.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2529233002
Cr-Commit-Position: refs/heads/master@{#41295}
2016-11-28 08:01:26 +00:00
bmeurer
ae14b6b721 [turbofan] Assign types to remaining builtins on String.prototype.
Assign types to the remaining builtins on the String.prototype where we
know a meaningful type, i.e. where the type is not dependent on some
callable function that is pass or loaded.

BUG=v8:5267
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2532463002
Cr-Commit-Position: refs/heads/master@{#41294}
2016-11-27 19:20:39 +00:00
mstarzinger
309b77f00d [fullcodegen] Remove exception handling support.
This removes support for try-catch as well as try-finally constructs
from the {FullCodeGenerator}. Consequently optimized code containing
such constructs must use the {BytecodeGraphBuilder} and can no longer
use the {AstGraphBuilder} for graph building.

R=jarin@chromium.org
BUG=v8:5657

Review-Url: https://codereview.chromium.org/2521233002
Cr-Commit-Position: refs/heads/master@{#41279}
2016-11-25 07:26:20 +00:00
jkummerow
9be747666c Reland^2 of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2528883003
Cr-Commit-Position: refs/heads/master@{#41272}
2016-11-24 16:23:12 +00:00
hablich
474bbec73d Revert of [stubs] KeyedStoreGeneric: inline dictionary property stores (patchset #2 id:10002 of https://codereview.chromium.org/2524943002/ )
Reason for revert:
Blocks current roll:
https://codereview.chromium.org/2526753003/

Bisect results:
https://codereview.chromium.org/2531483002

Original issue's description:
> Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
>
> For dictionary-mode receivers, the KeyedStoreGeneric stub can store
> properties directly in most cases. Doing so avoids the need to have
> an entry in the stub cache for every map/property combination.
>
> Original review: https://codereview.chromium.org/2504403005/
>
> Committed: https://crrev.com/7a963deb85a0cc04623947a759534c48e2871901
> Cr-Commit-Position: refs/heads/master@{#41218}

TBR=ishell@chromium.org,machenbach@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2522393002
Cr-Commit-Position: refs/heads/master@{#41251}
2016-11-24 08:43:22 +00:00
bmeurer
3709108896 [turbofan] Infer proper type for calls to Date.now.
Recognize Date.now() calls in the Typer and assign the proper integer
type to them.

See Node issue https://github.com/nodejs/node/issues/9729 for more
information.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2528853003
Cr-Commit-Position: refs/heads/master@{#41242}
2016-11-24 06:41:40 +00:00
bmeurer
d66aaedd0e [turbofan] Assign appropriate types to RegExp builtins.
Recognize a couple of builtins on the RegExp.prototype in the Typer and
assign useful types to them, so we can optimize various checks on their
results.

R=yangguo@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2531463002
Cr-Commit-Position: refs/heads/master@{#41240}
2016-11-24 06:02:11 +00:00
jkummerow
7a963deb85 Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2524943002
Cr-Commit-Position: refs/heads/master@{#41218}
2016-11-23 12:43:48 +00:00
cbruni
bbb74424ae Introduce set_the_hole(Isolate*, int) and friends
Passing in the isolate to retrieve the heap constants (undefine, the_hole, null)
has a positive performance impact.

BUG=

Review-Url: https://codereview.chromium.org/2517153002
Cr-Commit-Position: refs/heads/master@{#41210}
2016-11-23 09:44:07 +00:00
rmcilroy
5f5300a61b [compiler] Ensure code unsupported by Crankshaft goes to Ignition.
BUG=v8:4280,v8:5657

Review-Url: https://codereview.chromium.org/2505933008
Cr-Commit-Position: refs/heads/master@{#41209}
2016-11-23 09:30:34 +00:00
hablich
e3f5c515fa Revert of [stubs] KeyedStoreGeneric: inline dictionary property stores (patchset #5 id:100001 of https://codereview.chromium.org/2504403005/ )
Reason for revert:
Blocks roll: https://codereview.chromium.org/2526573002/

Original issue's description:
> [stubs] KeyedStoreGeneric: inline dictionary property stores
>
> For dictionary-mode receivers, the KeyedStoreGeneric stub can store
> properties directly in most cases. Doing so avoids the need to have
> an entry in the stub cache for every map/property combination.
>
> Committed: https://crrev.com/af168e330e95c4460fd1bb7734f0e9a750f2e748
> Cr-Commit-Position: refs/heads/master@{#41185}

TBR=ishell@chromium.org,rmcilroy@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2528583002
Cr-Commit-Position: refs/heads/master@{#41207}
2016-11-23 08:26:11 +00:00
jkummerow
af168e330e [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Review-Url: https://codereview.chromium.org/2504403005
Cr-Commit-Position: refs/heads/master@{#41185}
2016-11-22 14:51:59 +00:00
neis
c051ef383d Remove some leftovers of full-codegen's generators implementation.
TBR=littledan@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2517143003
Cr-Commit-Position: refs/heads/master@{#41180}
2016-11-22 13:49:01 +00:00
tebbi
1b320d2039 [cpu-profiler] use new source position information for deoptimization in cpu profiler
The new SourcePosition class allows for precise tracking of source positions including the stack of inlinings. This CL makes the cpu profiler use this new information. Before, the cpu profiler used the deoptimization data to reconstruct the inlining stack. However, optimizing compilers (especially Turbofan) can hoist out checks such that the inlining stack of the deopt reason and the inlining stack of the position the deoptimizer jumps to can be different (the old cpu profiler tests and the ones introduced in this cl produce such situations for turbofan). In this case, relying on the deoptimization info produces paradoxical results, where the reported position is before the function responsible is called. Even worse, https://codereview.chromium.org/2451853002/ combines the precise position with the wrong inlining stack from the deopt info, leading to completely wrong results.

Other changes in this CL:
- DeoptInlinedFrame is no longer needed, because we can compute the correct inlining stack up front.
- I changed the cpu profiler tests back to test situations where deopt checks are hoisted out in Turbofan and made them robust enough to handle the differences between Crankshaft and Turbofan.
- I reversed the order of SourcePosition::InliningStack to make it match the cpu profiler convention.
- I removed CodeDeoptEvent::position, as it is no longer used.

R=alph@chromium.org

BUG=v8:5432

Review-Url: https://codereview.chromium.org/2503393002
Cr-Commit-Position: refs/heads/master@{#41168}
2016-11-22 10:14:59 +00:00
mstarzinger
71c5904fb7 [runtime] Rename {JSGeneratorObject::operand_stack} field.
This renames the {operand_stack} field to {register_file}, to refelct
how said field is used on all {JSGeneratorObject} instances by now. This
is a pure refactoring CL, not changes in semantics.

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2520913002
Cr-Commit-Position: refs/heads/master@{#41140}
2016-11-21 13:31:35 +00:00
bmeurer
241c024c10 [turbofan] Properly optimize instanceof (even in the presence of @@hasInstance).
This is the TurboFan counterpart of http://crrev.com/2504263004, but it
is a bit more involved, since in TurboFan we always inline the appropriate
call to the @@hasInstance handler, and by that we can optimize a lot more
patterns of instanceof than Crankshaft, and even yield fast instanceof
for custom @@hasInstance handlers (which we can now properly inline as
well).

Also we now properly optimize Function.prototype[@@hasInstance], even if
the right hand side of an instanceof doesn't have the Function.prototype
as its direct prototype.

For the baseline case, we still rely on the global protector cell, but
we can address that in a follow-up as well, and make it more robust in
general.

TEST=mjsunit/compiler/instanceof
BUG=v8:5640
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2511223003
Cr-Commit-Position: refs/heads/master@{#41092}
2016-11-18 06:31:42 +00:00
eholk
eaed31c5f5 [wasm] Add guard regions to end of WebAssembly.Memory buffers
With this change, WebAssembly.Memory objects have backing stores allocated as an
8GB region where everything beyond the size of the Wasm heap is inaccessible.

GrowMemory is now implemented by changing the protection on the guard regions to
make the new portions of the heap accessible.

Guard pages are not enabled by default, but this change adds a flag and a test
variant to make sure we get test coverage on them.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5277

Review-Url: https://codereview.chromium.org/2396433008
Cr-Commit-Position: refs/heads/master@{#41089}
2016-11-17 20:29:13 +00:00
ishell
937b8cb684 [ic] Support data handlers in LoadGlobalIC.
Also fixed handling of load non-existent handlers outside typeof.

BUG=v8:5561, chromium:662854

Review-Url: https://codereview.chromium.org/2511603002
Cr-Commit-Position: refs/heads/master@{#41073}
2016-11-17 12:18:40 +00:00
yangguo
45cb0fc7b8 Refactor SharedFunctionInfo::IsBuiltin.
This method is a slight misnomer. What we actually want to know is
whether the function was defined in a user-provided script.

Also remove redundant Script::hide_source flag.

R=bmeurer@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/2505853003
Cr-Commit-Position: refs/heads/master@{#41065}
2016-11-17 09:43:12 +00:00
kozyatinskiy
6808ec1f83 [inspector] introduced Script::TYPE_INSPECTOR
Inspector uses this type for all internal scripts, e.g. injected-script-source.js. Scripts with new type are not reported by remote debugging protocol, frames from them are ignored.

CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_precise_blink_rel
BUG=none
R=yangguo@chromium.org,dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2499273003
Cr-Commit-Position: refs/heads/master@{#41056}
2016-11-17 04:39:47 +00:00
machenbach
1160e5edcc Revert of Refactor SharedFunctionInfo::IsBuiltin. (patchset #1 id:1 of https://codereview.chromium.org/2505853003/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11394

Original issue's description:
> Refactor SharedFunctionInfo::IsBuiltin.
>
> This method is a slight misnomer. What we actually want to know is
> whether the function was defined in a user-provided script.
>
> Also remove redundant Script::hide_source flag.
>
> R=bmeurer@chromium.org, ulan@chromium.org

TBR=bmeurer@chromium.org,ulan@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2512463002
Cr-Commit-Position: refs/heads/master@{#41050}
2016-11-16 19:48:48 +00:00
ishell
f718cd1309 [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
BUG=chromium:665886

Review-Url: https://codereview.chromium.org/2502393002
Cr-Commit-Position: refs/heads/master@{#41045}
2016-11-16 17:45:33 +00:00
yangguo
f21a6b259b Refactor SharedFunctionInfo::IsBuiltin.
This method is a slight misnomer. What we actually want to know is
whether the function was defined in a user-provided script.

Also remove redundant Script::hide_source flag.

R=bmeurer@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/2505853003
Cr-Commit-Position: refs/heads/master@{#41036}
2016-11-16 14:04:37 +00:00
cbruni
14c6a651d1 [elements] Precisely estimate elements size as last resort
In case of an allocation failure in for-in over holey elements, use precise
number of elements to allocate a smaller buffer for the collected indices.

Drive-by-fix: make is_the_hole accept the isolate for faster checks.

BUG=chromium:609761

Review-Url: https://codereview.chromium.org/2041963003
Cr-Commit-Position: refs/heads/master@{#41010}
2016-11-15 18:31:19 +00:00
clemensh
32077e01fb [wasm] Allocate a single script per wasm module
Before, we allocated one script per function per instance, and each
script referenced the wasm instance and the function index. Now we only
allocate one script per compiled wasm module, so the script also only
references this WasmCompiledModule, which causes changes to many interfaces.

Instead of fixing the disassemble API only used via debug.js, I decided
to drop it for now. Some later CL will reintroduce it via
DebugInterface.

BUG=v8:5530,chromium:659715
R=yangguo@chromium.org, titzer@chromium.org
CC=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2493823003
Cr-Commit-Position: refs/heads/master@{#41004}
2016-11-15 17:05:39 +00:00
tebbi
c3a6ca68d0 This CL enables precise source positions for all V8 compilers. It merges compiler::SourcePosition and internal::SourcePosition to a single class used throughout the codebase. The new internal::SourcePosition instances store an id identifying an inlined function in addition to a script offset.
SourcePosition::InliningId() refers to a the new table DeoptimizationInputData::InliningPositions(), which provides the following data for every inlining id:
 - The inlined SharedFunctionInfo as an offset into DeoptimizationInfo::LiteralArray
 - The SourcePosition of the inlining. Recursively, this yields the full inlining stack.
Before the Code object is created, the same information can be found in CompilationInfo::inlined_functions().

If SourcePosition::InliningId() is SourcePosition::kNotInlined, it refers to the outer (non-inlined) function.
So every SourcePosition has full information about its inlining stack, as long as the corresponding Code object is known. The internal represenation of a source position is a positive 64bit integer.

All compilers create now appropriate source positions for inlined functions. In the case of Turbofan, this required using AstGraphBuilderWithPositions for inlined functions too. So this class is now moved to a header file.

At the moment, the additional information in source positions is only used in --trace-deopt and --code-comments. The profiler needs to be updated, at the moment it gets the correct script offsets from the deopt info, but the wrong script id from the reconstructed deopt stack, which can lead to wrong outputs. This should be resolved by making the profiler use the new inlining information for deopts.

I activated the inlined deoptimization tests in test-cpu-profiler.cc for Turbofan, changing them to a case where the deopt stack and the inlining position agree. It is currently still broken for other cases.

The following additional changes were necessary:
 - The source position table (internal::SourcePositionTableBuilder etc.) supports now 64bit source positions. Encoding source positions in a single 64bit int together with the difference encoding in the source position table results in very little overhead for the inlining id, since only 12% of the source positions in Octane have a changed inlining id.
 - The class HPositionInfo was effectively dead code and is now removed.
 - SourcePosition has new printing and information facilities, including computing a full inlining stack.
 - I had to rename compiler/source-position.{h,cc} to compiler/compiler-source-position-table.{h,cc} to avoid clashes with the new src/source-position.cc file.
 - I wrote the new wrapper PodArray for ByteArray. It is a template working with any POD-type. This is used in DeoptimizationInputData::InliningPositions().
 - I removed HInlinedFunctionInfo and HGraph::inlined_function_infos, because they were only used for the now obsolete Crankshaft inlining ids.
 - Crankshaft managed a list of inlined functions in Lithium: LChunk::inlined_functions. This is an analog structure to CompilationInfo::inlined_functions. So I removed LChunk::inlined_functions and made Crankshaft use CompilationInfo::inlined_functions instead, because this was necessary to register the offsets into the literal array in a uniform way. This is a safe change because LChunk::inlined_functions has no other uses and the functions in CompilationInfo::inlined_functions have a strictly longer lifespan, being created earlier (in Hydrogen already).

BUG=v8:5432

Review-Url: https://codereview.chromium.org/2451853002
Cr-Commit-Position: refs/heads/master@{#40975}
2016-11-14 17:22:32 +00:00
caitp
7f21e67b38 [builtins] implement JSBuiltinReducer for ArrayIteratorNext()
Adds a protector cell to prevent inlining (which will likely lead to deopt
loops) when a JSArrayIterator's array transitions from a fast JSArray to a
slow JSArray (such as, when the array is touched during iteration in a way
which triggers a map transition).

Also adds TODO comments relating to the spec update proposed by Dan at
https://github.com/tc39/ecma262/pull/724

BUG=v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org
TBR=hpayer@chromium.org, ulan@chromium.org

Review-Url: https://codereview.chromium.org/2484003002
Cr-Commit-Position: refs/heads/master@{#40970}
2016-11-14 15:59:47 +00:00
gsathya
ec61e6b434 [promises] Remove one runtime call to create_resolving_functions
- Creates a new promise-utils.{h, cc} which refactors out the
logic to create resolving functions. This is shared between the
runtime functions and builtins.

- Changes PromiseResolveThenableJobInfo to store the context
since we no longer create the resolving functions in JS.

- Changes EnqueuPromiseResolveThenableJob to take in the promise and
  not the callbacks.

BUG=v8:5343

Review-Url: https://codereview.chromium.org/2487053002
Cr-Commit-Position: refs/heads/master@{#40941}
2016-11-11 20:59:46 +00:00
jkummerow
5c03cb7922 [stubs] Port KeyedStoreIC_Megamorphic stub to Turbofan
BUG=v8:5269,v8:5561

Review-Url: https://codereview.chromium.org/2444353002
Cr-Commit-Position: refs/heads/master@{#40896}
2016-11-10 14:23:57 +00:00
rmcilroy
abad9b2ff9 [Interpreter] Add IsInterpreted() to JSFunction and use to fix test-heap tests.
Adds an IsInterpreted() function to both SharedFunctionInfo and JSFunction.
This is used to fix the test-heap code-aging tests since Ignition doesn't
age code.

BUG=v8:4680

Review-Url: https://codereview.chromium.org/2481433002
Cr-Commit-Position: refs/heads/master@{#40868}
2016-11-09 17:20:02 +00:00
neis
21463f73e9 [modules] Maintain array of cells for imports and local exports.
This makes use of the newly introduced cell indices to speed up variable
accesses. Imports and local exports are now directly stored in (separate)
arrays. In the future, we may merge the two arrays into a single one, or
even into the module context.

This CL also replaces the LoadImport and LoadExport runtime functions with
a single LoadVariable taking a variable index as argument (rather than a
name).

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2465283004
Cr-Commit-Position: refs/heads/master@{#40808}
2016-11-07 16:23:47 +00:00
neis
9d6c6e5a66 [modules] Make handling of module info's regular exports more robust.
R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2473993002
Cr-Commit-Position: refs/heads/master@{#40795}
2016-11-07 09:55:55 +00:00
vogelheim
cadcd787cf V8 support for cached accessors.
Some accessors requires little to no computation at all, its result can be
cached in a private property, avoiding the call overhead.
Calls to the getter are translated into a cheap property load.

Follow-on to crrev.com/2347523003, from peterssen@google.com

BUG=chromium:634276, v8:5548

Review-Url: https://codereview.chromium.org/2405213002
Cr-Commit-Position: refs/heads/master@{#40765}
2016-11-04 13:03:18 +00:00
dcheng
7fede7bb98 Set global proxy internal field count based on the global object template.
BUG=v8:5588
R=jochen@chromium.org

Review-Url: https://codereview.chromium.org/2475433008
Cr-Commit-Position: refs/heads/master@{#40755}
2016-11-04 10:02:36 +00:00
neis
43995e2fa8 [modules] Make ModuleInfoEntry a Struct rather than FixedArray.
It always has the same number of slots.

R=adamk@chromium.org
TBR=bmeurer@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2460353002
Cr-Commit-Position: refs/heads/master@{#40754}
2016-11-04 09:37:43 +00:00
neis
1dd241c44b [modules] Assign cell indices at validation time.
Instead of having a MODULE variable's index be 0 or 1, let it be the index of
its cell.  In this CL, we assign the indices but we continue to only use them to
distinguish imports from exports.  Actually using them to directly access the
cells will be done in a later CL.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2460233003
Cr-Commit-Position: refs/heads/master@{#40752}
2016-11-04 08:51:39 +00:00
jochen
bf77741d43 Reland "Create internal fields on global proxy objects"
Original CL description:
> Create internal fields on global proxy objects
>
> BUG=v8:5588
> R=verwaest@chromium.org

BUG=v8:5588
TBR=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2472573004
Cr-Commit-Position: refs/heads/master@{#40705}
2016-11-02 14:40:31 +00:00
machenbach
b19abf5371 Revert "Create internal fields on global proxy objects"
This reverts commit 26547761ef.

Breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/bui...

See also:
https://github.com/v8/v8/wiki/Blink-layout-tests

BUG=v8:5588
TBR=jochen@chromium.org, verwaest@chromium.org, hablich@chromium.org

Review-Url: https://codereview.chromium.org/2467073002
Cr-Commit-Position: refs/heads/master@{#40686}
2016-11-01 20:40:09 +00:00
ishell
7c22a153e2 [ic] Simplify handling of primitive maps.
This CL adds support for primitive maps to
1) PrototypeIterator,
2) PropertyHandlerCompiler::CheckPrototypes(),
3) Map::GetOrCreatePrototypeChainValidityCell(),
4) Prototype checks in data-driven ICs.

BUG=v8:5561

Review-Url: https://codereview.chromium.org/2466553002
Cr-Commit-Position: refs/heads/master@{#40673}
2016-10-31 14:58:52 +00:00
jochen
26547761ef Create internal fields on global proxy objects
BUG=v8:5588
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2467463002
Cr-Commit-Position: refs/heads/master@{#40670}
2016-10-31 14:16:24 +00:00
jochen
f074215082 Add a native data property that replaces itself with a real data property
This is useful for things that don't ever change, but we don't want to
eagerly compute the result.

Doing this from the embedder is difficult, using DefineOwnProperty would
read the property to get the property descriptor, creating an endless
recursion.

R=verwaest@chromium.org,haraken@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2449783006
Cr-Commit-Position: refs/heads/master@{#40648}
2016-10-28 14:40:11 +00:00
leszeks
a5ed05aa8b [compiler] Make SFI "optimize" flag a "tier up" flag
Reuses (and renames) the SFI "mark for optimization" flag to also permit
marking for baseline recompilation. The flag now represents a "tier up"
request, and CompileLazy can get baseline code as well as optimized
code.

BUG=v8:5512

Review-Url: https://codereview.chromium.org/2448933002
Cr-Commit-Position: refs/heads/master@{#40612}
2016-10-27 10:08:09 +00:00
neis
038a81976e [modules] Improve error messages.
For instance, when an import cannot be resolved, actually
point at the corresponding import statement.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2451153002
Cr-Commit-Position: refs/heads/master@{#40594}
2016-10-26 15:10:24 +00:00
neis
9c558d7bd9 Reland: [modules] Add partial support for debug-scopes.
Setting variables is not yet implemented.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2445683002
Cr-Commit-Position: refs/heads/master@{#40566}
2016-10-25 14:39:29 +00:00
machenbach
de52faf948 Revert of [modules] Add partial support for debug-scopes. (patchset #1 id:1 of https://codereview.chromium.org/2445683002/ )
Reason for revert:
Breaks https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/9349

Original issue's description:
> [modules] Add partial support for debug-scopes.
>
> Setting variables is not yet implemented..
>
> R=adamk@chromium.org
> BUG=v8:1569

TBR=adamk@chromium.org,yangguo@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2449883002
Cr-Commit-Position: refs/heads/master@{#40564}
2016-10-25 12:56:02 +00:00
neis
ee2f80c6bd [modules] Add partial support for debug-scopes.
Setting variables is not yet implemented..

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2445683002
Cr-Commit-Position: refs/heads/master@{#40559}
2016-10-25 12:30:15 +00:00
cbruni
532c16eca0 [runtime] Object.create(null) creates a slow object
Object.create(null) is most likely to be used for dictionary-like objects.
Hence it would be beneficial to directly create a slow-mode object and avoid
additional overhead later-on.

BUG=

Review-Url: https://codereview.chromium.org/2430273007
Cr-Commit-Position: refs/heads/master@{#40551}
2016-10-25 08:30:50 +00:00
leszeks
4a31323e97 [compiler] Mark shared functions for optimization
The current method of marking functions for optimization, which replaces
the JSFunction's code object with one that triggers optimization, would
never allow unnamed functions to be optimized. This is an issue for a
style of programming which heavily relies on passing around closures.

This patch sets a bit on the SharedFunctionInfo when a JSFunction is
marked. When another JSFunction referring to the same SharedFunctionInfo
is lazily compiled, it immediately triggers a non-concurrent optimize.

BUG=v8:5512

Review-Url: https://chromiumcodereview.appspot.com/2437043002
Cr-Commit-Position: refs/heads/master@{#40506}
2016-10-21 13:13:07 +00:00
titzer
acf99a893c [wasm] Improve naming consistency for WASM instances.
R=clemensh@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2428343005
Cr-Commit-Position: refs/heads/master@{#40426}
2016-10-19 10:30:38 +00:00
jwolfe
21fda06c05 [turbofan] Implement JSBuiltinReducer for String.prototype[Symbol.iterator].
BUG=v8:5388

Review-Url: https://codereview.chromium.org/2422383002
Cr-Commit-Position: refs/heads/master@{#40406}
2016-10-18 16:33:05 +00:00
caitp
86d0dd362f [builtins] implement Array.prototype[@@iterator] in TFJ builtins
Implements the variations of CreateArrayIterator() in TFJ builtins
(ArrayPrototypeValues, ArrayPrototypeEntries and ArrayPrototypeKeys), and
provides two new Object types with numerous maps which identify certain
behaviours, which will be useful for inlining.

Removes src/js/array-iterator.js entirely

Also adds support for printing Symbol literals inserted by the Parser during
desugaring when FLAG_print_builtin_ast is set to true.

BUG=v8:5388
R=bmeurer@chromium.org, cbruni@chromium.org
TBR=ulan@chromium.org

Review-Url: https://codereview.chromium.org/2405253006
Cr-Commit-Position: refs/heads/master@{#40373}
2016-10-18 02:43:14 +00:00
gsathya
18a116c7bd [promises] Move async debug event creation to c++
BUG=v8:5343

Review-Url: https://codereview.chromium.org/2415023002
Cr-Commit-Position: refs/heads/master@{#40369}
2016-10-17 15:38:16 +00:00
ishell
7078c31dc6 [ic] Cache weak cells containing prototypes in respective PrototypeInfo objects.
BUG=

Review-Url: https://codereview.chromium.org/2428473002
Cr-Commit-Position: refs/heads/master@{#40358}
2016-10-17 11:45:00 +00:00
jochen
6755b55a74 Make unittests work in component build
R=machenbach@chromium.org,titzer@chromium.org,bmeurer@chromium.org,jgruber@chromium.org
BUG=
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2416243002
Cr-Commit-Position: refs/heads/master@{#40350}
2016-10-17 10:02:06 +00:00
neis
4c364e63af [modules] Don't unnecessarily keep function alive after evaluation.
Also hide some implementation details behind abstract predicates and clean up the heap verifier functions.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2407183002
Cr-Commit-Position: refs/heads/master@{#40336}
2016-10-17 07:37:03 +00:00
jgruber
f60a7c4f61 [regexp] Turn last match info into a simple FixedArray
Now that all accesses to the last match info are in C++ and TF code, we can
finally turn the last match info into a FixedArray. Similar to the ArrayList,
it uses its first field to store its length and grows dynamically in amortized
O(1) time.

Unlike previously, this means that the last match info pointer stored on the
context can actually change (in case the FixedArray needs to grow).

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415103002
Cr-Commit-Position: refs/heads/master@{#40308}
2016-10-14 11:47:09 +00:00
jochen
c592e45400 Fix generate-bytecode-expectations to work in component builds
R=machenbach@chromium.org,jgruber@chromium.org,mythria@chromium.org
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg,v8_mac_dbg;master.tryserver.chromium.android:android_arm64_dbg_recipe

Review-Url: https://codereview.chromium.org/2410353005
Cr-Commit-Position: refs/heads/master@{#40300}
2016-10-14 08:56:07 +00:00
ishell
73460009a6 [ic] Support data handlers that represent loads from prototypes.
This CL also adds separate runtime call stats buckets for data handlers.

BUG=

Review-Url: https://codereview.chromium.org/2419513002
Cr-Commit-Position: refs/heads/master@{#40281}
2016-10-13 16:19:24 +00:00
mvstanton
0bf492215c OBJECT_PRINT needs to have ICState2String() defined.
R=ishell@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2410353004
Cr-Commit-Position: refs/heads/master@{#40270}
2016-10-13 14:06:33 +00:00
neis
dafe6867f3 [modules] Implement @@iterator on namespace objects.
As part of this, introduce a new JSObject for iterating over the elements of a
FixedArray.

R=adamk@chromium.org,bmeurer@chromium.org
TBR=ulan@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2407423002
Cr-Commit-Position: refs/heads/master@{#40265}
2016-10-13 13:35:06 +00:00
jgruber
33a4faa47d [regexp] Port RegExp.prototype[@@replace]
This moves the implementation of @@replace from regexp.js to builtins-regexp.cc
(the TurboFan fast path) and runtime-regexp.cc (slow path). The fast path
handles all cases in which the regexp itself is an unmodified JSRegExp
instance, the given 'replace' argument is not callable and does not contain any
'$' characters (i.e. we are doing a string replacement).

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2398423002
Cr-Commit-Position: refs/heads/master@{#40253}
2016-10-13 11:27:50 +00:00
gsathya
4fda85aa19 [promises] rename PromiseContainer to PromiseResolveThenableJobInfo
This is a much more descriptive name.

BUG=v8:5343
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2412263002
Cr-Commit-Position: refs/heads/master@{#40240}
2016-10-12 22:19:09 +00:00
gsathya
6f94a8f1c7 [promises] Move PromiseReactionJob to c++
This patch results in a 11% improvement over 5 runs in the
bluebird benchmark.

BUG=v8:5343,v8:5046
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2406343002
Cr-Commit-Position: refs/heads/master@{#40239}
2016-10-12 20:45:57 +00:00