Commit Graph

57954 Commits

Author SHA1 Message Date
Michael Starzinger
fd8fe87387 [wasm] Add WebAssembly.Module type reflection of memories.
This adds type reflection support to the {WebAssembly.Module.exports} as
well as {WebAssembly.Module.imports} method. It also refactors existing
reflective code to use the internal instead of the public embedder API,
which is slightly more efficient anyways.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I88a6c7e9236a549808707c72e40a63302b7747a9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763527
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63312}
2019-08-21 14:45:14 +00:00
Michael Starzinger
df76f1e55a [wasm] Add test case for {WebAssembly.Function} re-export.
This just adds a test case checking against the current behavior, but
expectations might change once the proposal is clarified. For details
see: https://github.com/WebAssembly/js-types/issues/11

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I2fc502460c0a8094a414d138703b75497b2d1c6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762517
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63311}
2019-08-21 14:43:03 +00:00
Dan Elphick
6d20778e4a [tests] Add --stress-lazy-source-positions to stress variant
Bug: v8:8510
Change-Id: Ie2b1cbbc136fecf3a81716b129e51857bd8db157
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762294
Reviewed-by: Tamer Tas <tmrts@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63310}
2019-08-21 12:42:05 +00:00
Igor Sheludko
861f09d6b7 [ptr-compr][csa] Define optimal parameter mode as Smi
This generates slightly better code and gives some performance.

Bug: v8:8948
Change-Id: I958fed109c85d2b1a413c82b37e56a39766dd172
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762295
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63309}
2019-08-21 11:56:44 +00:00
Simon Zünd
c4e0dd7422 [cleanup] Re-enable clang-format for BuildAsciiCharFlags
With the added parenthesis from a previous CL, clang-format does a
decent job of formatting the nested ternary operator statement.

R=leszeks@chromium.org

Change-Id: If2f5db766b6234a44f771c167f9831adda5dbd43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762301
Auto-Submit: Simon Zünd <szuend@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63308}
2019-08-21 11:33:40 +00:00
Sigurd Schneider
ea42cf707c [debugger] Report function proxies as proxies, not as functions
This CL fixes a bug where function proxies were reported as functions
instead as proxies to devtools, which caused dev-tools to call methods
on the function, possibly triggering side-effects.

Change-Id: I1d5d234b784601bd4b7ec91107e4b0cf0d877d07
Bug: chromium:995753
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762303
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63307}
2019-08-21 11:03:30 +00:00
Santiago Aboy Solanes
18cdc2f0e8 [CSA] TNodify ArrayPrototype(Pop|Push)
Bug: v8:6949, v8:9396
Change-Id: Ibb0979979e7092521cacf0931a98b4d5aa39a695
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1758306
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63306}
2019-08-21 10:45:48 +00:00
Maya Lekova
688b702eb6 [turbofan] Cleanup PropertyAccessInfos serialization
Bug: v8:7790
Change-Id: I5659dd0fd9cc9eb6c129dbdafbc678d6c62289c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763528
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63305}
2019-08-21 10:18:19 +00:00
Santiago Aboy Solanes
3c948f1cd5 [CSA][cleanup] TNodified Smi related methods, loads and stores
Methods TNodified:
* CodeStubAssembler::LoadWeakFixedArrayLength
* InterpreterAssembler::LoadAndUntagConstantPoolEntryAtOperandIndex
* InterpreterAssembler::LoadWeakFixedArrayLength

Bug: v8:6949, v8:9396
Change-Id: I30edf1799c35175799ebcca9d9e5d7a815997358
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1755845
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63304}
2019-08-21 09:59:48 +00:00
Michael Lippautz
509ac9424c heap,test: Fix test for TracedGlobal destructors
The tests were assuming that the destructor leaves behind memory in a
defined state when the object was allocated with placement new. Turns
out gcc with no component builds optimizes away the resetting of the
memory.

There's a simpler way to test the functionality by inspecting global
handle counts.

Bug: v8:9639, chromium:995684
Change-Id: I253d84910414c62ca314507b20d2c819f925ea6e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762512
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63303}
2019-08-21 09:35:48 +00:00
Ana Peško
104e9b86d5 Turn regexp tier-up on by default to test performance and memory.
Change-Id: If546b1d2dc7019424383ce047ac4eb0410e954f0
Bug: v8:9566
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762289
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Ana Pesko <anapesko@google.com>
Cr-Commit-Position: refs/heads/master@{#63302}
2019-08-21 09:17:27 +00:00
Joshua Litt
3be772d60a [regexp] Add fuzzing for JSRegExpResultIndices to regexp-builtins
When regexp match indices are enabled, we stash required data in the JSRegExpResult object,
and then build a JSRegExpResultIndices object lazily when the 'indices' property is
accessed.

This cl simply checks that fast and slow paths produce the same values for
result.indices and result.indices.groups.

Change-Id: I6322d8eaef4c6e5a0ed3a5aef8b2ff05ac2b2c7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763249
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63301}
2019-08-21 09:14:47 +00:00
Keno Fischer
c8a39b114c [wasm][test] Clean up macros
This set of macros was only used for one test, while another versions
exists in the header file that's used in the rest of the tests. Clean up
the duplication.

R=ahaas@chromium.org, titzer@chromium.org

Change-Id: I851c47a0748b5c78d9a966dfb59b95a3381e7cf7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747179
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63300}
2019-08-21 09:13:07 +00:00
Michael Starzinger
431cfbc4e8 [wasm] Add WebAssembly.Module type reflection of tables.
This adds type reflection support to the {WebAssembly.Module.exports} as
well as {WebAssembly.Module.imports} method. It also refactors existing
reflective code to use the internal instead of the public embedder API,
which is slightly more efficient anyways.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: Ic51b7b4744f7b3ad056a778aecfc4614ca8d6e75
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762019
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63299}
2019-08-21 08:40:56 +00:00
Michael Lippautz
3be845c78d heap: Fix V8.GCMainThreadMarkingThroughput
Some scopes that were subtracted were not part of the outer scopes and
thus can result in negative values.

Change-Id: I2264b27c4b7a48075fed4e3afaa6b6dd27d8daa4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762299
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63298}
2019-08-21 08:32:26 +00:00
Joshua Litt
dc1cc2232b [regexp] Only append to JSRegExpResult's initial map if we add descriptor
Before this cl, we always added slack to JSRegExpResult's initial_map.
However, this is incorrect. Now we only add slack to JSRegExpResult's initial map
if we intend to actually append the indices descriptor.

Bug: chromium:996099
Change-Id: Iac23e92415a9b60409915ff1de9634326ed109c5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1763064
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63297}
2019-08-21 08:19:32 +00:00
v8-ci-autoroll-builder
6958121b3d Update V8 DEPS.
Rolling v8/build: b05c392..5f675b2

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/939b6b1..04a66c3

Rolling v8/third_party/depot_tools: a44d67c..5329779

Rolling v8/third_party/fuchsia-sdk: 5fd2915..d677ea6

Rolling v8/third_party/googletest/src: d5e9e0c..c9ccac7

Rolling v8/tools/clang: c5d786f..ebf97a6

TBR=machenbach@chromium.org,tmrts@chromium.org

Change-Id: I40a2ec0c70121e44744c25ed9f56b804d6df2cf5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762116
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#63296}
2019-08-21 03:39:49 +00:00
Shu-yu Guo
9f73f5a36a [class] Fix ClassScope::LookupPrivateName to walk scope chain
private name was not found in the current scope. Outer private names
were sometimes coincidentally correctly resolved if the innermost
ClassScope does not need to allocate a context and does not have a
ScopeInfo.

ClassScope: :LookupPrivateName was not walking the scope chain when a
Change-Id: I18937e6cdf2ad4ae15825b11762fbec7a1358145
Bug: v8:9635
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1761547
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63295}
2019-08-20 20:18:39 +00:00
Leszek Swirski
489e7deb7e [object] Remove MutableHeapNumber
Since the mutability of HeapNumbers is determined by their owning
object's descriptor array, we can remove the MutableHeapNumber type
entirely, at the cost of a few fewer DCHECKs and a couple of TODOs
to use the descriptor array information.

This is a necessary step towards a follow-up which allows in-place
Double -> Tagged transitions

Design doc: https://docs.google.com/document/d/1VeKIskAakxQFnUBNkhBmVswgR7Vk6T1kAyKRLhqerb4/

Bug: v8:9606
Change-Id: I13209f9c86f1f204088f6fd80089e17d956b4a50
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1743972
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63294}
2019-08-20 19:04:04 +00:00
Sathya Gunasekaran
5c59ba4fbc [ic] Fix KeyedLoadIC for ArrayIndex access
Previously, without support for converting strings to numbers we'd
switch to megamorphic state and go to the runtime always to do the
conversion causing a performance cliff.

This patch improves the following js-perf-test scores:
Object-Lookup-String-Constant-BytecodeHandler: 4.25%
Object-Lookup-Index-String-BytecodeHandler: 5.41%

Bug: v8:9449
Change-Id: I63787fa84373fc946f1304b0141e48a52a1b4bcb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1690953
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63293}
2019-08-20 17:20:04 +00:00
Ng Zhi An
6cc107e935 Refactor kScrachDoubleReg usages to temp double registers
Bug: v8:9528
Change-Id: I7df27c3ee949a4c44fa0f78cfded6d8c34575e6b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754445
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63292}
2019-08-20 17:09:05 +00:00
Maya Lekova
14cb014726 [turbofan] Fully brokerize JSCallReducer
ReduceTypedArrayPrototypeToStringTag, ReduceObjectGetPrototype and
ReduceObjectGetPrototype are now heap-access free.

Bug: v8:7790
Change-Id: If7f7ae4c7712326240aa50e02189fee94a57afa9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762022
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63291}
2019-08-20 16:53:04 +00:00
Dan Elphick
ed50ab6529 [compiler] Re-enable lazy source positions
5th attempt to reland now that crash with cpu profiler combined with
code caching is fixed.

Bug: v8:8510
Change-Id: I3489150a5067c41c36a4b468e412f9398a55135d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762293
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63290}
2019-08-20 16:49:54 +00:00
Michael Lippautz
debbfe4ebd api: Add trait that allows disabling v8::TracedGlobal<T> destructor
TracedGlobal is already cleared by V8 during garbage collections. It's
the embedders responsibility to clear the reference if it destroys the
underlying reference through other means.

Allow embedders to specify whether they want TracedGlobal to execute
clear on destruction via TracedGlobalTrait.

Bug: chromium:995684
Change-Id: Ieb10cf21f95eb97e01eff15d4fbd83538f17cf7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762007
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63289}
2019-08-20 16:38:39 +00:00
Santiago Aboy Solanes
70275615d7 [CSA][cleanup] TNodify interpreter-generator's TaggedPointer loads
Follow-up CL that TNodifies loads from AnyTagged to TaggedPointer in
interpreter-generator.cc for:
 * DescriptorArray::kEnumCacheOffset
 * EnumCache::kKeysOffset
 * EnumCache::kIndicesOffset
 * JSFunction::kSharedFunctionInfoOffset
 * JSGeneratorObject::kParametersAndRegistersOffset
 * JSGeneratorObject::kContextOffset
 * SourceTextModule::kRegularExportsOffset
 * SourceTextModule::kRegularImportsOffset

Bug: v8:6949, v8:9396
Change-Id: I559d2a5ea353fbd9e1f539f30ce981d70d93714f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752858
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63288}
2019-08-20 16:31:34 +00:00
Mathias Bynens
18c4164e93 Remove always-true --fast-calls-with-arguments-mismatches flag
This feature shipped in V8 v7.4:
https://v8.dev/blog/v8-release-74#faster-calls-with-arguments-mismatch

Bug: v8:8895
Change-Id: I55c50aeda6c61d07b37987404ea09266c9f66702
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762026
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63287}
2019-08-20 16:15:34 +00:00
Dan Elphick
cc65464029 [snapshot] Fix source positions deserialized from cache
When deserializing from a code snapshot with logging enabled (e.g. when
profiling) then this ensures source positions are collected before
creating code events that need them.

Bug: chromium:994673, v8:9504
Change-Id: Iad7644e983d3004c4889615cf2104dc4ef40da46
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762023
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63286}
2019-08-20 16:00:15 +00:00
Seth Brenith
fb453dd4b5 [torque] Allow single-param annotations in AnnotationSet
Extend the order-independent annotation parsing logic to include the
following forms:
  @foo                // bare annotation (already supported)
  @foo(0x70)          // decimal literal
  @foo(HI)            // identifier
  @foo("hello there") // quoted string
This is obviously still pretty far from annotations in other languages,
which usually support arbitrary expressions and multiple parameters, but
I think it's sufficient to cover a pretty good variety of usages. The
existing class-field annotations @if and @ifnot are reimplemented in the
new style, meaning they could now appear in any order relative to other
annotations on the same field (and can be repeated, though I doubt it
would be of much use to anybody).

Change-Id: I97b7c0c9a541ca3126b5ae3a2484688b04dda9f4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1754947
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63285}
2019-08-20 15:46:44 +00:00
Joyee Cheung
77d50cd8e7 [class] implement private accessor declarations
This patch implements the declaration of private accessors.
When iterating over the class properties, we track private
accessors associated with the same name in a ZoneHashMap.
Once we get to all the necessary components for a private name
(we know statically whether we should expect only a setter,
only a getter, or both), we emit a call to a runtime function
`CreatePrivateAccessors` that creates an AccessorPair, and
store the components in it. The AccessorPair is then associated
with the private name variable and stored in the context
for later retrieval when the private accessors are accessed.

Design doc: https://docs.google.com/document/d/10W4begYfs7lmldSqBoQBBt_BKamgT8igqxF9u50RGrI/edit

Bug: v8:8330
Change-Id: Ie6d3882507d143b1f645d7ae82b21b7358656e89
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1725670
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63284}
2019-08-20 15:32:34 +00:00
Dan Elphick
dd54736795 [parser] Fix bytecode mismatch for this
Fixes bytecode mismatch between lazy and non-lazy where "this" was
marked as maybe assigned in constructors that called the super
constructor. Since this will return the hole in cases where it was not
yet initialized by super (and the hole is explicitly handled by
JSContextSpecialization::ReduceJSLoadContext), it's safe to treat it as
a constant in all cases. In the case of lazy compilation case, "this"
is never added to the ScopeInfo so is never seen as mutable.

Bug: chromium:994719
Change-Id: I43478fbc626b19eb1533aa9dec61b7f276ae140b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762025
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63283}
2019-08-20 15:21:24 +00:00
Dominik Inführ
74e68e6a8a [heap] Remove ClearRecordedSlots
Do not pass it as argument to CreateObjectFillerAt and remove the enum.

Bug: v8:9454
Change-Id: Iafa37acbfea73d3cabb1732dbec0944db859fac2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762017
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63282}
2019-08-20 15:09:57 +00:00
Keno Fischer
6ebc808a9b [wasm][anyref] fix decoding of table index immediates
Before dd6f4d4f4c, this function was reading a single u8 and verifying
that it was 0x00. The referenced commit dropped this check as part of
implementing decoding for table.get, but neglected to change the read type
to u32v, which is the specified type of this immediate. Fix that.

R=ahaas@chromium.org, titzer@chromium.org

Change-Id: Ic2ce795023ec57be2c95aa79e62d3ccd1aa9c43c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1747178
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63281}
2019-08-20 14:54:59 +00:00
Jakob Kummerow
ec9bc860b4 [wasm-c-api] Roll 351b9b7: Support multiple return values
This just adds the upstream tests; our implementation already had support.

Change-Id: If8d340ebe79eae65d12164a01883482d521b8451
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762287
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63280}
2019-08-20 14:48:14 +00:00
Jakob Gruber
81642fa6c3 [deoptimizer] Extract frame layout calculation into helper classes
The deoptimizer calculates frame layout based on the translation's
`height` field, together with additional data (e.g.: are we looking at
the topmost frame? what kind of deopt are we in?). The result is the
final deoptimized frame size in bytes, together with a bunch of
intermediate results such as the variable frame size (= without the
fixed-size portion).

In order to consider the deoptimized frame size in optimized stack
checks, we will need to calculate the frame layout during compilation
in addition to what we currently do during deoptimization. This CL
moves in that direction by extracting relevant parts of frame layout
calculation into classes that can be reused by both compiler and
deoptimizer.

These helpers will support both precise and conservative modes; the
deoptimizer will use the precise mode (since it has full information),
while the instruction selector will use the conservative mode.

Bug: v8:9534
Change-Id: I93d6c39f10d251733f4625d3cc161b2010652d02
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760825
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63279}
2019-08-20 14:47:10 +00:00
Georg Neis
69d0eade54 [turbofan] Try to insert soft deopt for JSStoreDataPropertyInLiteral
... at graph building time already, just like we do for other property
accesses.

Bug: v8:7790
Change-Id: I7ffc8ee4fb1df91fc59271edd7b70c14f531330a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762018
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63278}
2019-08-20 14:17:19 +00:00
Igor Sheludko
05d83a0e73 Temporarily disable frozen/sealed elements kinds
... to prepare for merging this back to stable channel.

Bug: chromium:992914
Change-Id: Icbb257b5c02417d9222e60346575567360376264
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762021
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63277}
2019-08-20 13:59:49 +00:00
Michael Starzinger
f2bb20f6c5 [wasm] Add WebAssembly.Module type reflection of functions.
This adds type reflection support to the {WebAssembly.Module.exports} as
well as {WebAssembly.Module.imports} method. It also refactors existing
reflective code to use the internal instead of the public embedder API,
which is slightly more efficient anyways.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I168741d382373ec47ebe0517ce7803732cbb3b24
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762011
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63276}
2019-08-20 13:49:05 +00:00
Santiago Aboy Solanes
b4859582bf [CSA] Don't TNodify LoadMap
When TNodifying LoadMap, I went did a proper LoadObjectField<Map> and
removed UncheckedCast. However, TNodification makes some code objects
too big, as in Large code objects.

This makes the x64 no embed bot green again.

Bug: v8:9637
Change-Id: I5cb36834d7134c459ff2e2f11a852dd8c8ba5d94
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762015
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63275}
2019-08-20 13:03:53 +00:00
Santiago Aboy Solanes
d8ce7cd3d3 [CSA][cleanup] TNodified some CSA methods relating to Strings
This is a CL in a string of CLs that aims to TNodify CSA. In particular,
there were some loads that were done in AnyTagged instead of
TaggedPointer. TNode-ifying them brings improvement in pointer
compression since we are able to decompress using the Pointer
decompression.

Bug: v8:6949, v8:9396
Change-Id: I368d4f85348f3560a7f71bf66ebc7c4dd978a8dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1752854
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63274}
2019-08-20 13:01:23 +00:00
Michael Starzinger
017a68c0ee [wasm] Add WebAssembly.Module type reflection of globals.
This adds type reflection support to the {WebAssembly.Module.exports} as
well as {WebAssembly.Module.imports} method. It also refactors existing
reflective code to use the internal instead of the public embedder API,
which is slightly more efficient anyways.

R=ahaas@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: I5f20ea57261f6433b8d86f55054216bf96b41382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760826
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63273}
2019-08-20 12:48:43 +00:00
Joshua Litt
9460101cdb [regexp] Implement the match indices proposal
Implements match indices for regexp, as specified by
https://github.com/tc39/proposal-regexp-match-indices,
a stage 3 TC39 proposal. This implementation is hidden
behind the '--harmony-regexp-match-indices' flag.

Regexp match indices extends the JSRegExpResult object
with an array of indices of matches, as well as a
dictionary of capture names to match indices.

Bug: v8:9548
Change-Id: I9866a2d1f5af6a507de710357cb5e74c694e7558
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1734937
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63272}
2019-08-20 12:32:43 +00:00
Dominik Inführ
aba185a713 [heap] Remove slots when shrinking objects
Immediately remove recorded old-to-new slots when shrinking objects.
This operation needs to drain the store buffer, however the store buffer
is supposed to be removed anyway.

Also do not remove slots when left-trimming since this isn't needed for
correctness.

Bug: v8:9454
Change-Id: I751baf2dcd03c87aee9cb1ebd168e05bf373a738
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762012
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63271}
2019-08-20 12:11:13 +00:00
Maya Lekova
fe7b0974c8 [turbofan] Fully brokerize JSNativeContextSpecialization
Bug: v8:7790
Change-Id: I2b9971b7944837a5a6943e401b8c9d91f25c515e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762016
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63270}
2019-08-20 12:02:51 +00:00
Georg Neis
7a253510c8 [turbofan] Try to insert soft deopt for exponentiation
This brings the graph builder in sync with the serializer (and
exponentiation in sync with the other binary operators).

Bug: chromium:995430, v8:7790
Change-Id: I809b6f3756f75392cdc6747f8bcee8cdf0ee0f74
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762013
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63269}
2019-08-20 11:55:46 +00:00
Georg Neis
4ec75d8409 [turbofan] Fix JSStoreDataPropertyInLiteral reduction
... by making the operator have a control output, since we could deopt
after my last change.

Bug: chromium:995562, v8:7790
Change-Id: Ibc8c44708b4d43c4b2c3dfab2fd8fdf79c7ea671
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762010
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63268}
2019-08-20 11:37:16 +00:00
Santiago Aboy Solanes
761addecef [arm64][ptr-compr] Mark some Arm64 sim pointer compression tests as slow
They were timeouting, e.g
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression/2193

Change-Id: Icf3fcde15510cbdefcd2da8e66530c589f4423f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762008
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63267}
2019-08-20 10:46:57 +00:00
Leszek Swirski
caaaeceb4e [compiler] Remove static init for kMinusZeroBits
Chromium has checks which don't like static initializers in binaries,
which fires on effect_control_linearizer.cc. We can remove these by
making kMinusZeroBits (and family) constexpr, but to do this we have to
avoid bit_cast. Instead, set the correct bit pattern manually (thankfully
IEEE 754 0.0 is just zero bits, and -0.0 is 0.0 with a set sign bit).

Change-Id: If1695ff715ad8f821e956757f8f9f7c850895011
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1762009
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63266}
2019-08-20 10:39:17 +00:00
Maya Lekova
69a7e86a5e [turbofan] Fully brokerize ReducePropertyAccess
Bug: v8:7790
Change-Id: I6f493d994f49d84020966322d60061567b54c854
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760808
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63265}
2019-08-20 10:22:27 +00:00
Sam Sebree
d3e6e0466d [SyntheticModules] Synthetic Module Export String Fix
This is a very small change which must go in before
https://chromium-review.googlesource.com/c/chromium/src/+/1731108
is able to land.

Certain WPT tests for synthetic modules were spawning DCHECK crashes by JSObject::SetNormalizedProperty.

Export names were previously failing:
DCHECK(name->IsUniqueName());

This small change corrects the issue and allows Module::GetModuleNamespace to run correctly.
This change aligns synthetic module behavior for export string storage with JS modules, as well as the spec.

chromium: 967018
Change-Id: I151e7150290bd72d4e4753c8c5be243eafae915f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1761583
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63264}
2019-08-20 10:09:47 +00:00
Jakob Kummerow
3b45da47cd [wasm-c-api] Roll 70a2889: Remove template meta-programming
This change is very mechanical:
own<Foo*> → own<Foo>
vec<Foo*> → ownvec<Foo>
As usual, everything in third_party/ is straight-up copied from upstream.

Change-Id: If5fabda99e2b281da6f2e71ce23a2f5b68aaac86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1760815
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#63263}
2019-08-20 09:35:35 +00:00