Commit Graph

43163 Commits

Author SHA1 Message Date
Pierre Langlois
9f4f3c28ec Simplify DoubleToI stub.
The DoubleToI stub is no longer called outside of TurboFan, and always in the
same way:

  - The parameter is on top of the stack.
  - The stub is always called in a slow path.
  - It truncates.

Therefore, we can simplify it to only support this case and remove dead
code.

On top of this, since the stub is always considered to be on a slow path for all
backends, this patch takes the opportunity to remove the `skip_fastpath`
optimisation. This would generate a stub which does not handle all inputs,
assuming that the backend already handled some of the inputs in a fast
path. Removing this allows the stub to have the same behaviour on all targets.

On Arm, this patch reworks the stub a little. We could use ip instead of saving
and restoring a register on the stack. Also, comments would mention that we
assume the exponent to be greater than 31 when the it can be 30 or higher. As
done for Arm64, let's check this at runtime in debug mode.

On Arm64, we can also implement the stub without pushing and poping off the
stack. It needs 2 general purpose and a double scratch registers which we have
reserved already (ip0, ip1 and d30). This removes the need to check that the
stack pointer is always 16-bytes aligned.

Finally, this also fixes a potential bug on Arm64, in the
`GetAllocatableRegisterThatIsNotOneOf` method which is now removed. We were
picking an allocatable double register when we meant to pick a general one.

Bug: v8:6644
Change-Id: I88d4597f377c9fc05432d5922a0d7129b6d19b47
Reviewed-on: https://chromium-review.googlesource.com/720963
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#48671}
2017-10-18 10:23:21 +00:00
Clemens Hammacher
5f6510825a [cleanup] Fix remaining (D)CHECK macro usages
This CL fixes all occurences that don't require special OWNER reviews,
or can be reviewed by Michi.

After this one, we should be able to reenable the readability/check
cpplint check.

R=mstarzinger@chromium.org

Bug: v8:6837, v8:6921
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ic81d68d5534eaa795b7197fed5c41ed158361d62
Reviewed-on: https://chromium-review.googlesource.com/721120
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48670}
2017-10-18 10:12:31 +00:00
Georgia Kouveli
9f1eceee43 [arm64] Prepare for pushing arguments to runtime with padding.
Also updates TurboAssembler::DropArguments to simplify dropping the receiver
and the arguments.

Bug: v8:6644
Change-Id: Ief3b529ffc574c213816a533948c7b1f5d014bd7
Reviewed-on: https://chromium-review.googlesource.com/723466
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#48669}
2017-10-18 09:29:31 +00:00
Michael Lippautz
d433928987 Fix CompactionPartiallyAbortedPageWithStoreBufferEntries
The test was reading from undefined stack addresses instead of creating
a string filled with characters that look like a new space pointer.

Bug: v8:6953
Change-Id: I2c0a9034076012746bd70325a4f21c63f4c264fa
Reviewed-on: https://chromium-review.googlesource.com/725322
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48668}
2017-10-18 09:27:11 +00:00
Leszek Swirski
ac0fe8ec8a [interpreter] Remove TryInstallOptimizedCode
Removes the interrupt check and runtime call to TryInstallOptimizedCode
from the optimization marker checks (i.e. CompileLazy and
InterpreterEntryTrampoline). Instead, we rely on the other interrupt
sources (in particular stack checks at function entries and loop
headers) to install optimized code for us.

This will hopefully not cause regressions, as we have plenty of other
interrupt checks, but it may delay optimized code execution for
some function by one function call.

Bug: v8:6933
Change-Id: Ieadfff7ae2078d2a84085294158ad9a706eb9c64
Reviewed-on: https://chromium-review.googlesource.com/723475
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48667}
2017-10-18 09:05:15 +00:00
Jakob Gruber
4104fd90b7 Reland "Reland "[snapshot] Add BuiltinDeserializerAllocator""
This is a reland of 526c31d07b
Original change's description:
> Reland "[snapshot] Add BuiltinDeserializerAllocator"
> 
> This is a reland of 2b9a6d8908
> Original change's description:
> > [snapshot] Add BuiltinDeserializerAllocator
> > 
> > Encapsulates special reservation / allocation behavior for builtin
> > deserialization.
> > 
> > Bug: v8:6624
> > Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd
> > Reviewed-on: https://chromium-review.googlesource.com/716229
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48638}
> 
> TBR=yangguo@chromium.org
> 
> Bug: v8:6624
> Change-Id: I07c49263b4ef128dfe9b97d364e9a279b343aa24
> Reviewed-on: https://chromium-review.googlesource.com/723520
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48647}

TBR=yangguo@chromium.org

Bug: v8:6624
Change-Id: I4186fcf89b9fce3433a02fc864346a300b90ffb5
Reviewed-on: https://chromium-review.googlesource.com/725439
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48666}
2017-10-18 09:04:10 +00:00
Jaroslav Sevcik
57c6c97904 [deoptimizer] Remove incorrect cast for materialized property array.
Bug: chromium:774824
Change-Id: Id3d0af0bb55c0985393fe3b139308b6b706e7bc0
Reviewed-on: https://chromium-review.googlesource.com/725339
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48665}
2017-10-18 08:13:51 +00:00
Jaroslav Sevcik
8f752a5c5c [tests] Create canonicalized handle scope for Turbofan.
Change-Id: I76a792638b58f0bdc0a6a04c912d816ebf04718c
Reviewed-on: https://chromium-review.googlesource.com/725320
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48664}
2017-10-18 07:41:43 +00:00
Michael Achenbach
4e8d24e3bd [CQ] Add fuchsia trybots to CQ experiment
TBR=sergiyb@chromium.org
NOTRY=true

Bug: chromium:772816
Change-Id: I532e2c05360547686844f73c56d021abcbeb46bf
Reviewed-on: https://chromium-review.googlesource.com/725280
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48663}
2017-10-18 07:38:33 +00:00
Michael Achenbach
49bdec3470 Revert "Revert "[test] Fix win-asan symbolizer path""
This reverts commit 4054cf278f.

Reason for revert: Just exposes existing issues.

Original change's description:
> Revert "[test] Fix win-asan symbolizer path"
> 
> This reverts commit 135576ffb6.
> 
> Reason for revert: V8 Win32 ASAN failures: https://build.chromium.org/p/client.v8/builders/V8%20Win32%20ASAN/builds/73
> 
> It appears these failures were lurking there already, but were hidden because of the bug this CL fixed. Opened https://crbug.com/v8/6953 about these issues.
> 
> Original change's description:
> > [test] Fix win-asan symbolizer path
> > 
> > This makes the symbolizer path relative, as the absolute paths contain
> > a drive letter + colon on windows. The colon is confused by the
> > sanitizer as an option separator.
> > 
> > The test driver changes the cwd to the V8 root dir in each
> > invocation.
> > 
> > Bug: chromium:726584
> > Change-Id: Icf4e5a55bba5dec8e59a3dfe3eccdf7224e65c33
> > Reviewed-on: https://chromium-review.googlesource.com/721124
> > Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> > Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48652}
> 
> TBR=glider@chromium.org,rnk@chromium.org,machenbach@chromium.org,sergiyb@chromium.org,etienneb@chromium.org
> 
> Change-Id: Ic78527950f6a239a03658e042d7244c9781d05db
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: chromium:726584
> Reviewed-on: https://chromium-review.googlesource.com/723825
> Reviewed-by: Eric Holk <eholk@chromium.org>
> Commit-Queue: Eric Holk <eholk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48653}

TBR=glider@chromium.org,rnk@chromium.org,machenbach@chromium.org,eholk@chromium.org,sergiyb@chromium.org,etienneb@chromium.org

Change-Id: I8ea3b1d74ece09bed4758522f51cbee56a7792e1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:726584
Reviewed-on: https://chromium-review.googlesource.com/725319
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48662}
2017-10-18 06:54:46 +00:00
peterwmwong
bee98aecc7 Remove SubString intrinsic and convert SubString code stub to CSA.
Bug: v8:5049
Change-Id: Ia4f5729be64794e9080eb0e644b86cd5d8c88a11
Reviewed-on: https://chromium-review.googlesource.com/722168
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48661}
2017-10-18 05:52:47 +00:00
Tobias Tebbi
1cee0e012e Reland^4 "[turbofan] eagerly prune None types and deadness from the graph"
This fixes https://bugs.chromium.org/p/chromium/issues/detail?id=773954.
The issue was that in the EffectControlLinearizer, the effect input of an
{Unreachable} node was not updated, leaving a {Checkpoint} behind.

This is a reland of 4cf476458f
Original change's description:
> Reland^3 "[turbofan] eagerly prune None types and deadness from the graph"
> 
> This fixes the issues 
> https://bugs.chromium.org/p/chromium/issues/detail?id=772873 
> and https://bugs.chromium.org/p/chromium/issues/detail?id=772872.
> 
> One problem was that mutating an effect node into Unreachable confused 
> the LoadElimination sidetables, so I just always create a new node now.
> 
> The other problem was that UpdateBlockControl() was executed after 
> UpdateEffectPhi() in the lazy case. This reverted the update to the Merge input.
> So now I make sure that UpdateEffectPhi() is always executed last.
> 
> This is a reland of 6ddb5e7da7
> Original change's description:
> > Reland^2 "[turbofan] eagerly prune None types and deadness from the graph"
> > 
> > Now, the EffectControlLinearizer connects all occurrences of Unreachable to the 
> > graph end. This fixes issues with later phases running DeadCodeElimination and
> > introducing new DeadValue nodes when processing uses of Unreachable.
> > 
> > This is a reland of 3c4bc27f13
> > Original change's description:
> > > Reland "[turbofan] eagerly prune None types and deadness from the graph"
> > > 
> > > This is a reland of e1cdda2512
> > > Original change's description:
> > > > [turbofan] eagerly prune None types and deadness from the graph
> > > > 
> > > > In addition to using the {Dead} node to prune dead control nodes and nodes that 
> > > > depend on them, we introduce a {DeadValue} node representing an impossible value 
> > > > that can occur at any position in the graph. The extended {DeadCodeElimination}
> > > > prunes {DeadValue} and its uses, inserting a crashing {Unreachable} node into
> > > > the effect chain when possible. The remaining uses of {DeadValue} are handled
> > > > in {EffectControlLinearizer}, where we always have access to the effect chain.
> > > > In addition to explicitly introduced {DeadValue} nodes, we consider any value use
> > > > of a node with type {None} as dead.
> > > > 
> > > > Bug: chromium:741225
> > > > Change-Id: Icc4b636d1d018c452ba1a2fa7cd3e00e522f1655
> > > > Reviewed-on: https://chromium-review.googlesource.com/641250
> > > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > > Cr-Commit-Position: refs/heads/master@{#48208}
> > > 
> > > Bug: chromium:741225
> > > Change-Id: I21316913dae02864f7a6d7c9269405a79f054138
> > > Reviewed-on: https://chromium-review.googlesource.com/692034
> > > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#48232}
> > 
> > Bug: chromium:741225
> > Change-Id: I5702ec34856c075717162153adc765774453c45f
> > Reviewed-on: https://chromium-review.googlesource.com/702264
> > Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> > Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48366}
> 
> Bug: chromium:741225
> Change-Id: I4054a694d2521c2e1f0c4a3ad0f3cf100b5c536f
> Reviewed-on: https://chromium-review.googlesource.com/709214
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48469}

Bug: chromium:741225
Change-Id: Id9d4f3a3ae36cb3e38f80edcdba88efa7922ca24
Reviewed-on: https://chromium-review.googlesource.com/715716
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48660}
2017-10-18 05:24:17 +00:00
v8-autoroll
7e952c23da Update V8 DEPS.
Rolling v8/base/trace_event/common: abcc415..0e9a47d

Rolling v8/build: b6fbb0d..8a3ae28

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/733ecb1..7525730

Rolling v8/tools/clang: af65d54..dce4014

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I9b3ac4e257fe17b402d96e7817a47dda1f50144f
Reviewed-on: https://chromium-review.googlesource.com/724980
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48659}
2017-10-18 03:52:36 +00:00
Sathya Gunasekaran
4903cc409a [intl] Set NumberFormat.prototype.formatToParts.length to 1
Bug: v8:5244
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I3528b6786be4a820ecb7570df83164fcce80ec5c
Reviewed-on: https://chromium-review.googlesource.com/724209
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48658}
2017-10-17 22:59:33 +00:00
Sathya Gunasekaran
6e420382ca [test] test262 roll
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I9603fd12ef979586a0718269e51497ec52352a5c
Reviewed-on: https://chromium-review.googlesource.com/721565
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48657}
2017-10-17 22:43:33 +00:00
Pierre Langlois
71dbefee7a [cctest] Compare results of parallel moves with a simulation.
Introduce new `SimulateMoves` and `SimulateSwaps` methods which take an initial
"state" as a FixedArray and perform a given list of moves on it. They give us
what the result of testing the CodeGenerator's AssembleMove and AssembleSwap
should be.

This way, we can now compare the results of running parallel moves with a
reference simulation.

Bug: v8:6848
Change-Id: I228f4310f32d2a82e0744afaff183e2c7ac08cb7
Reviewed-on: https://chromium-review.googlesource.com/723222
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48656}
2017-10-17 19:46:03 +00:00
Ulan Degenbaev
fcee0a973f [heap] Avoid concurrently marking through JS API objects.
They can have unboxed double fields and embedder fields.

Bug: chromium:775055
Change-Id: Idff67c776cb4209d78006b8f3f8ebc07aa509c42
Reviewed-on: https://chromium-review.googlesource.com/723425
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48655}
2017-10-17 19:44:58 +00:00
Alexei Filippov
fe5963c6e4 [runtime-call-stats] Do not piggyback onto main thread's RCS in the background parser.
BUG=chromium:760649

Change-Id: If108830a1869238102e1c3475fe99e1ffb78d48d
Reviewed-on: https://chromium-review.googlesource.com/706140
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48654}
2017-10-17 19:43:50 +00:00
Eric Holk
4054cf278f Revert "[test] Fix win-asan symbolizer path"
This reverts commit 135576ffb6.

Reason for revert: V8 Win32 ASAN failures: https://build.chromium.org/p/client.v8/builders/V8%20Win32%20ASAN/builds/73

It appears these failures were lurking there already, but were hidden because of the bug this CL fixed. Opened https://crbug.com/v8/6953 about these issues.

Original change's description:
> [test] Fix win-asan symbolizer path
> 
> This makes the symbolizer path relative, as the absolute paths contain
> a drive letter + colon on windows. The colon is confused by the
> sanitizer as an option separator.
> 
> The test driver changes the cwd to the V8 root dir in each
> invocation.
> 
> Bug: chromium:726584
> Change-Id: Icf4e5a55bba5dec8e59a3dfe3eccdf7224e65c33
> Reviewed-on: https://chromium-review.googlesource.com/721124
> Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48652}

TBR=glider@chromium.org,rnk@chromium.org,machenbach@chromium.org,sergiyb@chromium.org,etienneb@chromium.org

Change-Id: Ic78527950f6a239a03658e042d7244c9781d05db
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:726584
Reviewed-on: https://chromium-review.googlesource.com/723825
Reviewed-by: Eric Holk <eholk@chromium.org>
Commit-Queue: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48653}
2017-10-17 19:42:12 +00:00
Michael Achenbach
135576ffb6 [test] Fix win-asan symbolizer path
This makes the symbolizer path relative, as the absolute paths contain
a drive letter + colon on windows. The colon is confused by the
sanitizer as an option separator.

The test driver changes the cwd to the V8 root dir in each
invocation.

Bug: chromium:726584
Change-Id: Icf4e5a55bba5dec8e59a3dfe3eccdf7224e65c33
Reviewed-on: https://chromium-review.googlesource.com/721124
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48652}
2017-10-17 18:01:14 +00:00
Bruce Dawson
82d8b3ac81 Change stray NULL to nullptr
While change crrev.com/c/718338 was changing NULL to nullptr, change
crrev.com/c/711334 was adding another NULL. I noticed this (eventually)
because I was simultaneously trying to write a change which was very
dependent on the precise value being used for null pointers.

BUG=v8:6928,v8:6921

Change-Id: Ib42cccf90c91c050032cc9e34e44c99fd14ff1bb
Reviewed-on: https://chromium-review.googlesource.com/722619
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48651}
2017-10-17 17:34:22 +00:00
Michael Achenbach
cec3496fdf Revert "Reland "[snapshot] Add BuiltinDeserializerAllocator""
This reverts commit 526c31d07b.

Reason for revert: cfi still unhappy:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20cfi/builds/11905

Original change's description:
> Reland "[snapshot] Add BuiltinDeserializerAllocator"
> 
> This is a reland of 2b9a6d8908
> Original change's description:
> > [snapshot] Add BuiltinDeserializerAllocator
> > 
> > Encapsulates special reservation / allocation behavior for builtin
> > deserialization.
> > 
> > Bug: v8:6624
> > Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd
> > Reviewed-on: https://chromium-review.googlesource.com/716229
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#48638}
> 
> TBR=yangguo@chromium.org
> 
> Bug: v8:6624
> Change-Id: I07c49263b4ef128dfe9b97d364e9a279b343aa24
> Reviewed-on: https://chromium-review.googlesource.com/723520
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48647}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I2a0534505d646a3ba90523f06f726b5059b90e35
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6624
Reviewed-on: https://chromium-review.googlesource.com/723521
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48650}
2017-10-17 17:32:46 +00:00
Ross McIlroy
3118f47395 [TurboFan] Fix type checks for lowering SpeculativeNumberBinop.
Ensure we only lower SpeculativeNumberBinops to a pure operator for
non-string plain primitives. Previously we could lower if a value might be
the-hole, however this would fail a CHECK in ConvertInputsToNumber which
expects a plain primitive.

BUG=chromium:772420

Change-Id: I0c755d10db7afd9cabfb638eca5662d70dfc8d51
Reviewed-on: https://chromium-review.googlesource.com/715717
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48649}
2017-10-17 16:12:49 +00:00
Clemens Hammacher
269b35a359 [arm] [simulator] Box floats and doubles
This prepares fixes in the implementations of vabs and vneg (potentially
more). In order to implement them correctly, we need to preserve the
exact bit pattern.

R=ahaas@chromium.org, rodolph.perfetta@arm.com

Bug: v8:6947
Change-Id: I7194a60371a6e3c9ffba32981c90090ffafaa610
Reviewed-on: https://chromium-review.googlesource.com/722941
Reviewed-by: Rodolph Perfetta <rodolph.perfetta@arm.com>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48648}
2017-10-17 16:02:14 +00:00
Jakob Gruber
526c31d07b Reland "[snapshot] Add BuiltinDeserializerAllocator"
This is a reland of 2b9a6d8908
Original change's description:
> [snapshot] Add BuiltinDeserializerAllocator
> 
> Encapsulates special reservation / allocation behavior for builtin
> deserialization.
> 
> Bug: v8:6624
> Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd
> Reviewed-on: https://chromium-review.googlesource.com/716229
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48638}

TBR=yangguo@chromium.org

Bug: v8:6624
Change-Id: I07c49263b4ef128dfe9b97d364e9a279b343aa24
Reviewed-on: https://chromium-review.googlesource.com/723520
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48647}
2017-10-17 15:56:34 +00:00
Ben L. Titzer
24459dff25 [wasm] Disable trap handlers also in d8.
This feature is turned off in flag-definitions but reenabled in a non-standard
way in d8. Given that the situations in which the trap handler are disabled are
more limited now due to integration problems, disabling this feature for now, since
we lack enough coverage to have confidence to turn it on by default.

We should probably introduce a proper test variant for this feature so that it
can be handled in a more standard way.

R=eholk@chromium.org
CC=​mlippautz@chromium.org,hablich@chromium.org,mstarzinger@chromium.org

Bug: 
Change-Id: Ic2e13181036ace8802736be847ae16ff889e3cea
Reviewed-on: https://chromium-review.googlesource.com/723221
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48646}
2017-10-17 15:34:34 +00:00
Michael Achenbach
e11ae2a526 [test] Fix isolating symbolizer for ubsan
Bug: chromium:726584
Change-Id: I1d413b5568e533e4f517c0687716689dd15da70d
Reviewed-on: https://chromium-review.googlesource.com/723459
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48645}
2017-10-17 15:02:04 +00:00
Michael Lippautz
33dbc65b98 [heap] Simplify CompactionSpace::SweepAndRetry
Bug: v8:6923
Change-Id: Ic8c8829d39d482463309507719379cd17346b52a
Reviewed-on: https://chromium-review.googlesource.com/723179
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48644}
2017-10-17 14:38:24 +00:00
Franziska Hinkelmann
9b46f38392 [type-profile] Use vector list from isolate
Instead of re-iterating over the heap all the time, use the
list of feedback vectors on the isolate. This also avoids GC of vectors.

Bug: v8:5935
Change-Id: I0bb96fcf2b0feb9856e9806f812188de1fc7b37e
Reviewed-on: https://chromium-review.googlesource.com/668396
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48643}
2017-10-17 14:10:52 +00:00
Michael Achenbach
2aa434d2f5 [foozzie] Skip unsuitable test
NOTRY=true
TBR=yangguo@chromium.org

Bug: chromium:774805
Change-Id: Iaf744749acf006558e02300c05627c8f25457e0d
Reviewed-on: https://chromium-review.googlesource.com/723383
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48642}
2017-10-17 13:39:22 +00:00
Michael Achenbach
db67b3886b Revert "[snapshot] Add BuiltinDeserializerAllocator"
This reverts commit 2b9a6d8908.

Reason for revert: Fails ubsan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20UBSanVptr/builds/770

Original change's description:
> [snapshot] Add BuiltinDeserializerAllocator
> 
> Encapsulates special reservation / allocation behavior for builtin
> deserialization.
> 
> Bug: v8:6624
> Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd
> Reviewed-on: https://chromium-review.googlesource.com/716229
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48638}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I0c6eceb88efe65526499e124acc4a45ee2904c1c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6624
Reviewed-on: https://chromium-review.googlesource.com/723141
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48641}
2017-10-17 13:38:15 +00:00
Michael Lippautz
c3e8b00367 [heap] Move page scavenging logic into Scavenger
Mechanical move simplifying a follow up that removes the recursive
locking strategy by properly partitioning pages.

Bug: v8:6923
Change-Id: I688e61131731e2b9dc9c311b0b43f0902c149359
Reviewed-on: https://chromium-review.googlesource.com/723020
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48640}
2017-10-17 13:14:53 +00:00
Benedikt Meurer
594803c946 [turbofan] Inline Function#bind in more cases.
So far the inlining of Function#bind into TurboFan optimized code was
limited to cases where TurboFan could infer the constant JSFunction that
was bound. However we can easily extend that to cover JSBoundFunction as
well, and obviously also take the LOAD_IC feedback if we don't have a
known JSFunction or JSBoundFunction.

This adds a new operator JSCreateBoundFunction that contains the logic
for the creation of the bound function object and the arguments.

On the micro-benchmarks we go from

  functionBindParameter0: 1239 ms.
  functionBindConstant0: 478 ms.
  functionBindBoundConstant0: 1256 ms.
  functionBindParameter1: 1278 ms.
  functionBindConstant1: 475 ms.
  functionBindBoundConstant1: 1253 ms.
  functionBindParameter2: 1431 ms.
  functionBindConstant2: 616 ms.
  functionBindBoundConstant2: 1437 ms.

to

  functionBindParameter0: 462 ms.
  functionBindConstant0: 485 ms.
  functionBindBoundConstant0: 474 ms.
  functionBindParameter1: 478 ms.
  functionBindConstant1: 474 ms.
  functionBindBoundConstant1: 474 ms.
  functionBindParameter2: 617 ms.
  functionBindConstant2: 614 ms.
  functionBindBoundConstant2: 616 ms.

which is a ~2.5x improvement. On the jshint benchmark in the
web-tooling-benchmark we observe a 2-3% improvement, which corresponds
to the time we had seen it running in the generic version.

Bug: v8:6936, v8:6946
Change-Id: I940d13220ff35ae602dbaa33349ba4bbe0c9a9d3
Reviewed-on: https://chromium-review.googlesource.com/723080
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48639}
2017-10-17 12:56:32 +00:00
jgruber
2b9a6d8908 [snapshot] Add BuiltinDeserializerAllocator
Encapsulates special reservation / allocation behavior for builtin
deserialization.

Bug: v8:6624
Change-Id: Ic784ed43b607c881b356c6e535c9dbe185e1d4cd
Reviewed-on: https://chromium-review.googlesource.com/716229
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48638}
2017-10-17 12:45:36 +00:00
Hannes Payer
3a20e450ce [heap] Remove unused PretenuringScope class forward declaration.
Bug: 
Change-Id: I28d6905a0c527a171deae89374ef54c2b4b97d3d
Reviewed-on: https://chromium-review.googlesource.com/722960
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48637}
2017-10-17 12:39:26 +00:00
jgruber
a4001d9398 [snapshot] Remove builtins area from startup snapshot
This removes the builtins area from the startup snapshot. It's now
completely contained in the separate builtins blob area.

Bug: v8:6624
Change-Id: Id3c43a177c7e1ed418eec59cf620fa461eb6df81
Reviewed-on: https://chromium-review.googlesource.com/715759
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48636}
2017-10-17 12:31:46 +00:00
Ben L. Titzer
bff42d3594 [wasm] Add regression tests for some recently fixed WasmInterpreter issues.
R=clemensh@chromium.org

Bug: chromium:766003,chromium:772332,chromium:771243
Change-Id: I1e2df014f31a87fd94154277d1a415ec359d42df
Reviewed-on: https://chromium-review.googlesource.com/721666
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48635}
2017-10-17 12:04:40 +00:00
jgruber
4450f7ca51 [snapshot] Refactor deserializer allocations
A continuation of the work in 59e4b751, this extracts logic around
memory reservation and allocations out of the Deserializer class.

Follow-up work is planned to create a specialized allocator for
builtin deserialization.

Bug: v8:6624
Change-Id: I7081cdc557ab8fb2571aadb816399e136ea2cdbb
Reviewed-on: https://chromium-review.googlesource.com/716036
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48634}
2017-10-17 11:36:05 +00:00
Michael Starzinger
8411f8f939 [turbofan] Remove obsolete CodeGenerator::MakeCodeEpilogue.
R=bmeurer@chromium.org
BUG=v8:6792

Change-Id: I8ed3e6ec06bfba117781efc63d79bc7641b7ec24
Reviewed-on: https://chromium-review.googlesource.com/722641
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48633}
2017-10-17 11:34:55 +00:00
Ben L. Titzer
9fe36eca64 [test] Shorten regression-*.js filenames to regress-*.js
R=rossberg@chromium.org

Bug: 
Change-Id: Icac33dc87dd660173e5a45d02b31be46f7d1cb2d
Reviewed-on: https://chromium-review.googlesource.com/721550
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48632}
2017-10-17 11:13:26 +00:00
Marja Hölttä
d2bf7ea55b [runtime] Remove "don't OSR functions which use arguments" logic.
OSR for functions which use arguments no longer needs to be disabled, since
TurboFan handles the case.

Bug: 
Change-Id: I121f1190a142c18f113bd5f875e258812645c43f
Reviewed-on: https://chromium-review.googlesource.com/721661
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48631}
2017-10-17 10:54:05 +00:00
Igor Sheludko
b0fc24503c Fix slack tracking for function subclasses.
Bug: chromium:774860
Change-Id: I180ca7e9e8d8603e0d61deb0eb71d758895d0f74
Reviewed-on: https://chromium-review.googlesource.com/721551
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48630}
2017-10-17 10:37:04 +00:00
Marja Hölttä
490fabb457 [objects.h splitting] Move JSArray, JSRegExp + related classes.
BUG=v8:5402,v8:6921

Change-Id: Iab2509554718a6beca73217f80cafedf650bd066
Reviewed-on: https://chromium-review.googlesource.com/718741
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48629}
2017-10-17 10:07:55 +00:00
Andreas Haas
1347891dcd Revert "[wasm] Use 64-bit comparison for bounds checks on 64-bit platforms"
This reverts commit 972d460f4f.

Reason for revert: This CL is not the right solution, and it makes back-merging the right solution more difficult.

Original change's description:
> [wasm] Use 64-bit comparison for bounds checks on 64-bit platforms
> 
> By using 64-bit comparison we make sure that there will be no out of
> memory accesses even if there are stale values in the high word of a
> register.
> 
> R=​titzer@chromium.org
> 
> Change-Id: I2627b15e1598f35cc480d7028031e8de405164ea
> Reviewed-on: https://chromium-review.googlesource.com/721323
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48604}

TBR=titzer@chromium.org,ahaas@chromium.org

Change-Id: I0c15e9d8ac72def2e22543a17366126d90a17918
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/721702
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48628}
2017-10-17 10:00:47 +00:00
Clemens Hammacher
4fe179cd7c [arm] [simulator] Disable wasm float tests
The simulator currently does not handle signalling NaNs correctly on
the vabs and vneg instructions.
Temporarily disable the tests until we have a fix.

R=ahaas@chromium.org

Bug: v8:6947
Change-Id: I281cb8213cdcc73c91768a82c44f90f009f7c8eb
Reviewed-on: https://chromium-review.googlesource.com/721663
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48627}
2017-10-17 09:24:28 +00:00
Ulan Degenbaev
a4ec099489 [wasm] Disable regress/wasm/regression-694433 on all TSAN variants.
Disabling only for stress mode did not help, the test uses 10GB
in other modes too.

Bug: v8:6924
Change-Id: I0e1348f8a43e41612d3a94e75396f0a26a82ece2
Reviewed-on: https://chromium-review.googlesource.com/721662
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48626}
2017-10-17 09:17:48 +00:00
jgruber
5b5391b888 [builtins] Clean out macros.py
Remove unused macros, and move macro definitions used only in a single
file into the file itself.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: If62107816ad1e6addf58705a075d3eba4f23bf08
Reviewed-on: https://chromium-review.googlesource.com/721381
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48625}
2017-10-17 09:03:47 +00:00
Daniel Clifford
6148cbfab4 Add FixedArray extraction and cloning utils to CSA
This adds a single bottleneck that properly handles the copying of empty, COW
and FixedDoubleArray arrays under the control of flags. This is in preparation
of adding new CSA-based array builtins on Array.prototype.

Drive by: Fix SmiConstant handling when ENABLE_VERIFY_CSA is not active and 
make the use of constant detection/folding consistent in the CSA depending
on ParameterMode.

Change-Id: If1889ab8cbff1805286b7b4344c29ffbe7191b39
Reviewed-on: https://chromium-review.googlesource.com/715798
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48624}
2017-10-17 08:32:57 +00:00
Peter Marshall
e0e08d52aa [heap] Remove unused code for TypedArrays in RightTrim.
This code is never used, and we don't right trim TypedArrays.

Bug: 
Change-Id: Ic3e32b194fb10ecd067449c755b1982c87c98257
Reviewed-on: https://chromium-review.googlesource.com/721541
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48623}
2017-10-17 07:54:30 +00:00
Michael Achenbach
ef2a870555 Revert "[ia32][wasm] Add I32x4AddHoriz and I16x8AddHoriz"
This reverts commit 2857e78347.

Reason for revert:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/20965

Original change's description:
> [ia32][wasm] Add I32x4AddHoriz and I16x8AddHoriz
> 
> Add phaddd, phaddw and AVX version
> Add vmovdqu and Movdqu macro
> 
> Bug: 
> Change-Id: I4f5c0cf96ab481fc18f0a0d554101a996a16c954
> Reviewed-on: https://chromium-review.googlesource.com/715677
> Commit-Queue: Jing Bao <jing.bao@intel.com>
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#48621}

TBR=bbudge@chromium.org,mtrofin@chromium.org,bmeurer@chromium.org,jing.bao@intel.com

Change-Id: Icaf36b46134e77e46180fc1671d0c6569b729a89
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/722679
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48622}
2017-10-17 06:46:56 +00:00