Commit Graph

2091 Commits

Author SHA1 Message Date
ishell
a39522f44f [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2534613002
Cr-Commit-Position: refs/heads/master@{#41332}
2016-11-28 22:56:52 +00:00
ishell
a814b8aeaf [heap] Clear recorded slots for inobject properties when migrating fast object to slow mode.
BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539493002
Cr-Commit-Position: refs/heads/master@{#41327}
2016-11-28 20:11:30 +00:00
yangguo
ee84d9f7f9 [debug] remove debug command processor from regress tests.
BUG=v8:5510
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2535733002
Cr-Commit-Position: refs/heads/master@{#41312}
2016-11-28 12:02:44 +00:00
ahaas
5d5ccb6e45 [mjsunit] Change assertThrows such that it can check the exception message.
Up until now assertThrows allows to check the type field of an
exception, which is, however, a custom field introduced in a single
regression test. With the change assertThrows allows to check the
message field of an exception, which is set for standard V8 exceptions
by default.

I use the new assertThrows to refactor test/mjsunit/wasm/divrem-trap.js

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2525313003
Cr-Commit-Position: refs/heads/master@{#41302}
2016-11-28 10:26:44 +00:00
cbruni
a09e5eda26 [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS
A missing @@IsConcatSpreadable check caused the fast path inside the slow path
to be incorrect and follow the default concat strategy when the arguments
arrays contain only doubles.

BUG=chromium:668414

Review-Url: https://codereview.chromium.org/2527173002
Cr-Commit-Position: refs/heads/master@{#41301}
2016-11-28 10:06:17 +00:00
jkummerow
9be747666c Reland^2 of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2528883003
Cr-Commit-Position: refs/heads/master@{#41272}
2016-11-24 16:23:12 +00:00
neis
b481afd893 [parser] Fix scopes in rewriting of for-of and destructuring assignments.
The catch scopes were created with the wrong parent scope.

R=littledan@chromium.org
BUG=v8:5648

Committed: https://crrev.com/f385268d11d6da9508e481202b39f75f4b56afdd
Review-Url: https://codereview.chromium.org/2520883002
Cr-Original-Commit-Position: refs/heads/master@{#41222}
Cr-Commit-Position: refs/heads/master@{#41253}
2016-11-24 09:48:21 +00:00
hablich
474bbec73d Revert of [stubs] KeyedStoreGeneric: inline dictionary property stores (patchset #2 id:10002 of https://codereview.chromium.org/2524943002/ )
Reason for revert:
Blocks current roll:
https://codereview.chromium.org/2526753003/

Bisect results:
https://codereview.chromium.org/2531483002

Original issue's description:
> Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
>
> For dictionary-mode receivers, the KeyedStoreGeneric stub can store
> properties directly in most cases. Doing so avoids the need to have
> an entry in the stub cache for every map/property combination.
>
> Original review: https://codereview.chromium.org/2504403005/
>
> Committed: https://crrev.com/7a963deb85a0cc04623947a759534c48e2871901
> Cr-Commit-Position: refs/heads/master@{#41218}

TBR=ishell@chromium.org,machenbach@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2522393002
Cr-Commit-Position: refs/heads/master@{#41251}
2016-11-24 08:43:22 +00:00
hablich
e461facff2 Revert of [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric (patchset #1 id:1 of https://codereview.chromium.org/2525913002/ )
Reason for revert:
Needed to revert 2661b3e8a5

Original issue's description:
> [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric
>
> BUG=chromium:668101
>
> Committed: https://crrev.com/2661b3e8a5447773a23a219ba085454c459b654b
> Cr-Commit-Position: refs/heads/master@{#41223}

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:668101

Review-Url: https://codereview.chromium.org/2525253002
Cr-Commit-Position: refs/heads/master@{#41250}
2016-11-24 08:41:29 +00:00
machenbach
7edbd535a9 Revert of [parser] Fix scopes in rewriting of for-of and destructuring assignments. (patchset #6 id:100001 of https://codereview.chromium.org/2520883002/ )
Reason for revert:
Speculative revert: Seems to break jsfunfuzz:
https://build.chromium.org/p/client.v8/builders/V8%20Fuzzer/builds/14385

Original issue's description:
> [parser] Fix scopes in rewriting of for-of and destructuring assignments.
>
> The catch scopes were created with the wrong parent scope.
>
> R=littledan@chromium.org
> BUG=v8:5648
>
> Committed: https://crrev.com/f385268d11d6da9508e481202b39f75f4b56afdd
> Cr-Commit-Position: refs/heads/master@{#41222}

TBR=littledan@chromium.org,verwaest@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5648

Review-Url: https://codereview.chromium.org/2519333005
Cr-Commit-Position: refs/heads/master@{#41228}
2016-11-23 15:23:17 +00:00
jkummerow
2661b3e8a5 [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric
BUG=chromium:668101

Review-Url: https://codereview.chromium.org/2525913002
Cr-Commit-Position: refs/heads/master@{#41223}
2016-11-23 13:27:22 +00:00
neis
f385268d11 [parser] Fix scopes in rewriting of for-of and destructuring assignments.
The catch scopes were created with the wrong parent scope.

R=littledan@chromium.org
BUG=v8:5648

Review-Url: https://codereview.chromium.org/2520883002
Cr-Commit-Position: refs/heads/master@{#41222}
2016-11-23 13:25:35 +00:00
jkummerow
7a963deb85 Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2524943002
Cr-Commit-Position: refs/heads/master@{#41218}
2016-11-23 12:43:48 +00:00
jgruber
0dcc7a0e20 [debug] Add Eval scope type to inspector protocol
BUG=v8:5530,chromium:667218

Review-Url: https://codereview.chromium.org/2519773003
Cr-Commit-Position: refs/heads/master@{#41205}
2016-11-23 07:30:23 +00:00
mtrofin
7a1ad0c581 [turbofan] Regalloc validator: support same block pending assessment
Previous fuzzer fix broke the case when the pending assessment came from the same
block. In that case, the assessments table does not have an entry yet for the block,
because we register only when we're done processing a block.

BUG=667745

Review-Url: https://codereview.chromium.org/2519973004
Cr-Commit-Position: refs/heads/master@{#41193}
2016-11-22 17:31:06 +00:00
jgruber
facd6b9a4a [debug-wrapper] Migrate more tests
* Fix setting script-scope variables through inspector by internalizing
  their names.
* Reconstruct values of Number, String, and Boolean classes.
* Adapt a couple of tests for API restrictions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2512963002
Cr-Commit-Position: refs/heads/master@{#41175}
2016-11-22 12:44:18 +00:00
titzer
5a1fbe24ba [d8] Do not try to verify zero-ness of failed virtual memory allocation.
BUG=chromium:667603
R=clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2519363002
Cr-Commit-Position: refs/heads/master@{#41174}
2016-11-22 12:36:37 +00:00
mstarzinger
a90671f1b9 [interpreter] Fix stack unwinding of deoptimized frames.
This fixes stack unwinding to always recompute the stack pointer for
interpreted frames. For frames materialized by the deoptimizer we elide
the handler frame in between, hence arguments being pushed on the stack
will no longer be pushed into the handler frame but into the interpreted
frame directly.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-662830
BUG=chromium:662830

Review-Url: https://codereview.chromium.org/2517203003
Cr-Commit-Position: refs/heads/master@{#41170}
2016-11-22 11:28:45 +00:00
bmeurer
84c9360b82 [turbofan] Fix broken effect chain for instanceof.
BUG=chromium:667689
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2518313002
Cr-Commit-Position: refs/heads/master@{#41169}
2016-11-22 11:05:35 +00:00
mtrofin
71144e5aa6 [turbofan] Use correct block when tracing pending assessments in regalloc verifier
The verifier needs to use the block and assessments in that block corresponding to
a predecessor of a "pending" assessment. Not doing that causes incorrect
assessments when 2 locations are swapped.

BUG=665402

Review-Url: https://codereview.chromium.org/2515803002
Cr-Commit-Position: refs/heads/master@{#41159}
2016-11-21 22:21:14 +00:00
eholk
d0fe942d23 [wasm] Throw a RangeError if Wasm memory could not be allocated.
This fixes a bug found by the fuzzer where we would attempt to
dereference a null handle if memory allocation failed. In this case,
the failure was because the amount of memory requested was above V8's
hardcoded limit.

BUG= https://bugs.chromium.org/p/chromium/issues/detail?id=666741

Review-Url: https://codereview.chromium.org/2514983002
Cr-Commit-Position: refs/heads/master@{#41158}
2016-11-21 21:58:53 +00:00
ishell
8ca50a8862 [ic] Ensure prototype validity cell guards global object's prototype changes for LoadGlobalIC.
BUG=chromium:666742, v8:5561

Review-Url: https://codereview.chromium.org/2512183002
Cr-Commit-Position: refs/heads/master@{#41136}
2016-11-21 12:46:44 +00:00
ishell
4513532f63 [ic] Don't check full prototype chain if name is a private symbol.
BUG=chromium:664974, chromium:664802, v8:5561

Review-Url: https://codereview.chromium.org/2513893003
Cr-Commit-Position: refs/heads/master@{#41133}
2016-11-21 11:21:43 +00:00
jgruber
1834ab7246 [debug-wrapper] Adapt tests, breakpoint.actual_location
Adapted various tests to restrictions of inspector protocol:

* osr-typing-debug-change: Don't set function variable value.
* debug-evaluate-locals: Add variable introduced by eval, run typeof
  inside evaluate().
* regress-419663: Don't set duplicate breakpoints.
* regress-crbug-465298: Compare against function name instead of value.
* regress-crbug-621361: Make evaluate return string results.
* debug-script: Various counts were off due to new way tests are called.
                Added new inspector script type.

Breakpoints now contain the actual break position, and remote object
reconstruction has been extended a bit.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2505363002
Cr-Commit-Position: refs/heads/master@{#41129}
2016-11-21 09:29:17 +00:00
littledan
06f8e87726 Fix function name inference corruption for async functions
The code which pushes and pops to the function name inference stack
generally checks if the stack is active with the IsOpen method. One
piece of code pertaining to async functions was missing that check.
This patch adds it.

BUG=chromium:658267
R=gsathya,caitp

Review-Url: https://codereview.chromium.org/2514893002
Cr-Commit-Position: refs/heads/master@{#41120}
2016-11-18 18:31:54 +00:00
marja
4a5b7e32c4 Remove FLAG_min_preparse_length.
It originates from the era where we used to run a separate preparse step
before parsing and store the function data. Now the usage of preparser
is something completely different, so this flag doesn't make sense any
more.

In addition, this way we get more test coverage for preparser (for small
scripts).

BUG=

Review-Url: https://codereview.chromium.org/2513563002
Cr-Commit-Position: refs/heads/master@{#41110}
2016-11-18 14:06:49 +00:00
verwaest
0c70f3729e [crankshaft] Don't inline the fast path for instanceof if the function has a non-instance .prototype
BUG=chromium:666308

Review-Url: https://codereview.chromium.org/2516603002
Cr-Commit-Position: refs/heads/master@{#41105}
2016-11-18 12:57:37 +00:00
ishell
937b8cb684 [ic] Support data handlers in LoadGlobalIC.
Also fixed handling of load non-existent handlers outside typeof.

BUG=v8:5561, chromium:662854

Review-Url: https://codereview.chromium.org/2511603002
Cr-Commit-Position: refs/heads/master@{#41073}
2016-11-17 12:18:40 +00:00
jgruber
2c8a4155aa [debug-wrapper] clearAllBreakPoints and several scripts functions
This adds clearAllBreakPoints functionality (which requires tracking set
breakpoints internally), and several script-related functions that rely
on runtime functions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2508853003
Cr-Commit-Position: refs/heads/master@{#41064}
2016-11-17 09:34:18 +00:00
jgruber
4fb4f3408c [debug-wrapper] LiveEdit, frame.restart(), breakpoints
This adds access to the LiveEdit API object, frame.restart(), and
various breakpoint setters. The LiveEdit API still depends on the JS
debugging context and blocks its removal; but it should be removed
once LiveEdit is rewritten in the midterm.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2503293002
Cr-Commit-Position: refs/heads/master@{#41062}
2016-11-17 08:43:59 +00:00
ishell
f718cd1309 [ic] Invalidate prototype validity cell when a slow prototype becomes fast.
BUG=chromium:665886

Review-Url: https://codereview.chromium.org/2502393002
Cr-Commit-Position: refs/heads/master@{#41045}
2016-11-16 17:45:33 +00:00
mstarzinger
31a8ec7762 [turbofan] Fix bogus representation for {kCheckTaggedHole}.
The operator in question is guaranteed to produce a tagged value that is
not equal to the-hole, it however does not guarantee the value to be a
HeapObject. The correct representation hence is {kTagged}.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-665587
BUG=chromium:665587

Review-Url: https://codereview.chromium.org/2504183002
Cr-Commit-Position: refs/heads/master@{#41032}
2016-11-16 12:53:47 +00:00
ishell
446d6a0678 [turbofan] Always install code dependency when optimizing a store to global property.
The reason is that non-configurability still allows a writable property to become read-only.

BUG=chromium:663750

Review-Url: https://codereview.chromium.org/2508873002
Cr-Commit-Position: refs/heads/master@{#41029}
2016-11-16 12:03:01 +00:00
jgruber
b06c4ce5a6 [debug-wrapper] Further extend the debug wrapper
This CL further extends the debug wrapper, migrates around 60 tests, and
removes a few tests that use functionality we will not support anymore.

In more detail:

* Removed tests that use:
  * enable/disable individual breakpoints
  * invocationText()
  * the ScriptCollected event
  * showBreakPoints
  * evalFromScript (and similar)
  * mirror.constructedBy and mirror.referencedBy
  * event_data.promise()
* Some frame.evaluate uses were adapted since due to differences between
  remote objects (inspector) and mirrors. For instance, exceptions are
  currently not recreated exactly, since the inspector protocol does not
  give us the stack and message separately. Other objects (such as
  'this' in debug-evaluate-receiver-before-super) need to be explicitly
  converted to a string before the test works correctly.
* Ensure that inspector stores the script before sending ScriptParsed and
  ScriptFailedToParse events in order to be able to use the script from
  within those events.
* Better remote object reconstruction (e.g. for undefined and arrays).
* New functionality in wrapper:
  * debuggerFlags().breakPointsActive.setValue()
  * scripts()
  * execState.setVariableValue()
  * execState.scopeObject().value()
  * execState.scopeObject().property()
  * execState.frame().allScopes()
  * eventData.exception()
  * eventData.script()
  * setBreakPointsActive()

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2497973002
Cr-Commit-Position: refs/heads/master@{#41019}
2016-11-16 08:34:44 +00:00
mstarzinger
79aee39f24 [builtins] Fix pointer comparison in ToString builtin.
This fixes the bogus {Word32Equal} comparison in the ToString builtin
implementing Object.prototype.toString to be a pointer-size {WordEqual}
comparison instead. Comparing just the lower half-word is insufficient
on 64-bit architectures.

R=jgruber@chromium.org
TEST=mjsunit/regress/regress-crbug-664506
BUG=chromium:664506

Review-Url: https://codereview.chromium.org/2496043003
Cr-Commit-Position: refs/heads/master@{#40963}
2016-11-14 12:44:29 +00:00
bmeurer
5667280310 [turbofan] Properly allocate constant-folded string.
When constant-folding S[K], make sure to return a String, and not the
character code as Number.

BUG=chromium:664942
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2503433002
Cr-Commit-Position: refs/heads/master@{#40960}
2016-11-14 11:58:09 +00:00
verwaest
942604dfb2 Add test for making private symbols non-enumerable
BUG=chromium:664411

Review-Url: https://codereview.chromium.org/2498963002
Cr-Commit-Position: refs/heads/master@{#40950}
2016-11-14 09:17:07 +00:00
jkummerow
567904f1a7 [ic] Fix elements conversion in KeyedStoreGeneric
A SmiUntag() was missing when loading the old backing store's length.

BUG=chromium:664469

Review-Url: https://codereview.chromium.org/2492783004
Cr-Commit-Position: refs/heads/master@{#40921}
2016-11-11 13:02:10 +00:00
jgruber
b32ee40de8 [debug-wrapper] Conditional breaks, locals, evaluate, scopes
This CL adds support for:
* conditional breaks in setBreakpoint,
* locals in frame.local{Count,Name,Value},
* evaluation on a frame in frame.evaluate,
* and more detailed scope information in scopeObject.

Uses of several functions that are not covered by the
inspector protocol and are only used in tests have been removed.

Local handling has been modified to also include arguments as locals.
Inspector differs in this regard from our FrameDetails in that
arguments are always shown as locals. Argument-related functions
were removed.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2491543002
Cr-Commit-Position: refs/heads/master@{#40917}
2016-11-11 12:08:34 +00:00
ishell
45b9f15f44 [runtime] Treat empty property cells properly when doing Object.freeze() on a global object.
BUG=chromium:663750, chromium:664123

Review-Url: https://codereview.chromium.org/2495563002
Cr-Commit-Position: refs/heads/master@{#40902}
2016-11-10 16:01:15 +00:00
jarin
c71e5e1294 [crankshaft] Always force number representation for increment.
BUG=chromium:664087

Review-Url: https://codereview.chromium.org/2491333002
Cr-Commit-Position: refs/heads/master@{#40900}
2016-11-10 14:51:18 +00:00
mstarzinger
25d2268ecc [crankshaft] Fix constant folding of HDiv instruction.
R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-662367
BUG=chromium:662367

Review-Url: https://codereview.chromium.org/2486923004
Cr-Commit-Position: refs/heads/master@{#40897}
2016-11-10 14:27:52 +00:00
jkummerow
cc2a2771a6 [stubs] Fix CodeStubAssembler::TrapAllocationMemento
to actually trap allocation mementos.

Review-Url: https://codereview.chromium.org/2487943005
Cr-Commit-Position: refs/heads/master@{#40895}
2016-11-10 13:47:41 +00:00
bmeurer
6d533403f9 [crankshaft] Not all HAdd instructions produce a number.
BUG=chromium:664084
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2494703002
Cr-Commit-Position: refs/heads/master@{#40894}
2016-11-10 13:11:28 +00:00
mstarzinger
93c6595200 [turbofan] Advance bytecode offset after lazy deopt.
This changes {FrameState} nodes modeling "after" states to use bytecode
offsets pointing to the deoptimizing bytecode. This is in sync with the
normal execution, as the bytecode offset is advanced after operations
complete in regular bytecode handlers.

The change is necessary to ensure lazy deoptimized frames contain an
accurate bytecode offset while they are on the stack. Such frames can be
inspected by various stack walks. The continuation builtin will advance
the bytecode offset upon return.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-660379
BUG=chromium:660379

Review-Url: https://codereview.chromium.org/2487173002
Cr-Commit-Position: refs/heads/master@{#40887}
2016-11-10 11:35:22 +00:00
ishell
6aa16edf36 [runtime] Ensure Object.freeze() deoptimizes code that depends on global property cells.
BUG=chromium:663750

Review-Url: https://codereview.chromium.org/2488223002
Cr-Commit-Position: refs/heads/master@{#40882}
2016-11-10 10:37:26 +00:00
littledan
5975c47a6a Avoid calling out to JS during stack overflow
If an exception is thrown when there is a Promise being created, the Promise
catch prediction code would call into a part implemented in JavaScript to see if
the Promise has a catch handler. If it is not possible to call back into JS,
e.g., due to a stack overflow, then this would lead to a crash. This patch
"speculates" that, if it's impossible to call back into JavaScript, then the
error is unhandled, avoding the issue. In a future patch, the catch prediction
logic should be entirely written in C++, but this patch adds a minimal fix to
be more friendly to backports.

BUG=chromium:662935
R=jgruber

Review-Url: https://codereview.chromium.org/2487833002
Cr-Commit-Position: refs/heads/master@{#40851}
2016-11-09 07:53:08 +00:00
jkummerow
87332fdf67 [arm] Fix custom addition in MacroAssembler::[Fast]Allocate
Don't rely on carry flags you didn't set yourself.

BUG=chromium:663402

Review-Url: https://codereview.chromium.org/2484283002
Cr-Commit-Position: refs/heads/master@{#40848}
2016-11-08 18:19:30 +00:00
jgruber
0cb3897179 [debugger] Basic scope functionality and exception events in wrapper
BUG=v8:5530

Review-Url: https://codereview.chromium.org/2487673002
Cr-Commit-Position: refs/heads/master@{#40840}
2016-11-08 14:54:10 +00:00
jgruber
4d6ff7dfaa [debugger] Stepping and break-related functions in wrapper
This adds clearStepping plus the family of
{set,clear}BreakOn{,Uncaught}Exception functions.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2482903002
Cr-Commit-Position: refs/heads/master@{#40834}
2016-11-08 13:54:37 +00:00