Commit Graph

11786 Commits

Author SHA1 Message Date
bmeurer
8e5e6333cf [turbofan] Remove obsolete EffectSet common operator.
This operator was initially designed to handle arbitrary effect merging
for effect relaxation, but we don't do that (at least currently). So no
need to keep the dead operator around.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/1954983002
Cr-Commit-Position: refs/heads/master@{#36063}
2016-05-06 07:46:44 +00:00
zhengxing.li
23a650ed07 X87: Add new relocation type WASM_MEMORY_SIZE_REFERENCE, use relocatable pointers to update wasm memory size references in generated code.
port 117a56b7c2 (r36044)

  original commit message:
  - Add new RelocInfo mode WASM_MEMORY_SIZE_REFERENCE in the assembler and add relocation information to immediates in compare instructions.
  - Use relocatable constants for MemSize/BoundsCheck in the wasm compiler

BUG=

Review-Url: https://codereview.chromium.org/1947413003
Cr-Commit-Position: refs/heads/master@{#36058}
2016-05-06 07:31:04 +00:00
adamk
40b3626e45 Disallow yield in computed property names of class expressions in params
R=littledan@chromium.org
BUG=v8:4974
LOG=n

Review-Url: https://codereview.chromium.org/1949223002
Cr-Commit-Position: refs/heads/master@{#36047}
2016-05-04 23:25:25 +00:00
adamk
75f2d65f00 Don't treat catch scopes as possibly-shadowing for sloppy eval
Scope analysis is over-conservative when treating variable resolutions
as possibly-shadowed by a sloppy eval. In the attached bug, this comes
into play since catch scopes have different behavior with respect to
the "calls eval" in eager vs lazy compilation (in the latter, they
are never marked as "calls eval" because CatchContexts don't have
an associated ScopeInfo).

This patch changes the scope-type check to also eliminate a few other
cases where shadowing isn't possible, such as non-declaration block scopes.

BUG=chromium:608279
LOG=n

Review-Url: https://codereview.chromium.org/1950803002
Cr-Commit-Position: refs/heads/master@{#36046}
2016-05-04 21:36:13 +00:00
mike
915ec67cc6 Convert negative zero in ArraySpeciesCreate
As per the ES2015 spec, the value `-0` should be converted to `+0` prior
to invocation of the species constructor.

BUG=v8:4988
LOG=N
R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/1950073002
Cr-Commit-Position: refs/heads/master@{#36045}
2016-05-04 21:33:51 +00:00
gdeepti
117a56b7c2 Add new relocation type WASM_MEMORY_SIZE_REFERENCE, use relocatable pointers to update wasm memory size references in generated code.
- Add new RelocInfo mode WASM_MEMORY_SIZE_REFERENCE in the assembler and add relocation information to immediates in compare instructions.
 - Use relocatable constants for MemSize/BoundsCheck in the wasm compiler

R=titzer@chromium.org, yangguo@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/1921203002
Cr-Commit-Position: refs/heads/master@{#36044}
2016-05-04 20:20:50 +00:00
pierre.langlois
f07d2cdd6a ARM64: [turbofan] Avoid zero-extension after a 32-bit load
A load instruction will implicitely clear the top 32 bits when writing to a W
register. This patch avoids generating a `mov` instruction to zero-extend the
result in this case.

For example, this occurs in the generated code for dispatching to the next
bytecode in the interpreter:

  kind = BYTECODE_HANDLER
  name = LdaZero
  compiler = turbofan
  Instructions (size = 36)
  0x32e64c60     0  add x19, x19, #0x1 (1)
  0x32e64c64     4  ldrb w0, [x20, x19]
  0x32e64c68     8  mov w0, w0
                    ^^^^^^^^^^
  0x32e64c6c    12  lsl x0, x0, #3
  0x32e64c70    16  ldr x1, [x21, x0]
  0x32e64c74    20  movz x0, #0x0
  0x32e64c78    24  br x1

BUG=

Review-Url: https://codereview.chromium.org/1950013003
Cr-Commit-Position: refs/heads/master@{#36038}
2016-05-04 18:35:56 +00:00
nikolaos
0d1687b9df Add support for disabling the preparser when testing modules
R=adamk@chromium.org
BUG=
LOG=N

Review-Url: https://codereview.chromium.org/1952473003
Cr-Commit-Position: refs/heads/master@{#36035}
2016-05-04 17:22:20 +00:00
littledan
04c8c11ee5 Make array __proto__ manipulations not disturb the species protector
Previously, the species protector was invalidated whenever the __proto__ of
an Array instance was manipulated. Then, if the map's new_target_is_base field
remained set, it was correct to conclude that GetPrototypeOf(array) was
%ArrayPrototype%. However, this choice caused the popular D3 framework to
invalidate the species protector, causing many functions to become slower.

This patch eliminates that aspect of the species protector. Instead, the check
is to look at the instance->map()->prototype(). It is valid to look directly
at the map's prototype slot, ignoring hidden prototypes and proxies, because
- This is only called on Array instances, so the receiver cannot be a Proxy.
- For hidden prototypes, any inaccuracy would only result in conservatively
  taking the slow path.

Theoretically, this patch could make methods applied to arrays from other
contexts slower. However, the slowdown would only affect a particular array
instance and not have a global spill-over effect. Further, the slowdown could
be addressed by tracking, either in the instance's map or in the actual
prototype object, whether it is a %ArrayPrototype% from any context, in a way
which is cheap to query, and use that rather than comparing to the currently
executing native context.

In interactive testing, this patch led the OnShape CAD system to experience
faster load times (110+s -> 40s).

BUG=chromium:606207
LOG=Y

Review-Url: https://codereview.chromium.org/1936393002
Cr-Commit-Position: refs/heads/master@{#36033}
2016-05-04 16:48:50 +00:00
kozyatinskiy
f0d27360a6 Add v8::Object::GetOwnPropertyNames(context, filter) method
This method provides ability to get all properties of the object with passed filter in addition to existing GetOwnPropertyNames(context) method that returns only enumerable properties.

BUG=v8:3861,chromium:581495
R=yangguo@chromium.org
LOG=Y

Review-Url: https://codereview.chromium.org/1943773002
Cr-Commit-Position: refs/heads/master@{#36031}
2016-05-04 16:15:36 +00:00
neis
ca5aa3c86a [interpreter] Always 'continue' loops by jumping forward to end of body.
We sometimes used to continue by jumping _back_ to the condition check at the
top of the loop. After my recent generator-related changes, that check is no
longer at the loop header, so a continue could create an additional loop. In
order to avoid this, we now always set the continue target to be the first
instruction following the loop body.

BUG=

Review-Url: https://codereview.chromium.org/1943383003
Cr-Commit-Position: refs/heads/master@{#36029}
2016-05-04 15:57:40 +00:00
jochen
e5baec22d3 Make it possible to set a getter and a setter at the same time
BUG=chromium:588893, chromium:325923
LOG=n
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/1943303002
Cr-Commit-Position: refs/heads/master@{#36025}
2016-05-04 14:15:39 +00:00
ishell
1350eb3dc9 [es8] More spec compliant syntactic tail calls implementation.
Unlike previous implementation where the 'continue' keyword was a feature of a return statement the keyword is now recognized as a part of expression. Error reporting was significantly improved.

--harmony-explicit-tailcalls option is now orthogonal to --harmony-tailcalls so we can test both modes at the same time.

This CL also adds %GetExceptionDetails(exception) that fetches hidden |start_pos| and |end_pos| values from the exception object.

BUG=v8:4915
LOG=N

Review-Url: https://codereview.chromium.org/1928203002
Cr-Commit-Position: refs/heads/master@{#36024}
2016-05-04 13:44:42 +00:00
bmeurer
ce38a8a92a [turbofan] Inline the allocation fast path.
Now that everything is properly wired to the effect chain when we get to
ChangeLowering, we can safely inline the allocation fast path and only
need to consule the slow path stub fallback when bump pointer allocation
fails.

R=jarin@chromium.org
BUG=v8:4931
LOG=n

Review-Url: https://codereview.chromium.org/1951853002
Cr-Commit-Position: refs/heads/master@{#36022}
2016-05-04 12:44:32 +00:00
neis
06c5127f5b [full-codegen] Introduce NestedStatement subclass for class literals.
This fixes a bug where returning from a class literal inside
a try-finally didn't restore the context properly when
entering the finally clause.

BUG=v8:4965
LOG=n

Review-Url: https://codereview.chromium.org/1952633002
Cr-Commit-Position: refs/heads/master@{#36021}
2016-05-04 12:42:04 +00:00
ulan
d441100b70 Deprecate PersistentBase::MarkPartiallyDependent.
It is already effectively disabled by --scavenge_reclaim_unmodified_objects.

BUG=

Review-Url: https://codereview.chromium.org/1944793002
Cr-Commit-Position: refs/heads/master@{#36018}
2016-05-04 11:56:20 +00:00
mstarzinger
22b4db544c [compiler] Allow optimization of top-level eval code.
This allows for top-level eval code to be parsed properly before doing
optimization. It uses the same kind of re-parsing we already perform
when compiling code for debugging.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1884143003
Cr-Commit-Position: refs/heads/master@{#36014}
2016-05-04 10:59:07 +00:00
martyn.capewell
0322c20d17 [turbofan] ARM64: Use zr to store immediate zero
When storing an immediate integer or floating point zero, use the zero register
as the source value. This avoids the need to sometimes allocate a new register.

BUG=

Review-Url: https://codereview.chromium.org/1945783002
Cr-Commit-Position: refs/heads/master@{#36013}
2016-05-04 10:19:48 +00:00
mlippautz
07c72af0d7 [heap] Add regression test for chromium:598319
BUG=chromium:598319
LOG=N

Review-Url: https://codereview.chromium.org/1948573003
Cr-Commit-Position: refs/heads/master@{#36011}
2016-05-04 09:33:23 +00:00
titzer
f82b33781d [wasm] Fix for 608630: allow proxies as FFI.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:608630
LOG=Y

Review-Url: https://codereview.chromium.org/1943313002
Cr-Commit-Position: refs/heads/master@{#36008}
2016-05-04 08:54:00 +00:00
bmeurer
c3218375c1 [turbofan] Implement %_NewObject using FastNewObjectStub.
The inline allocation sequence in the optimizing compilers cannot deal
well with funky types like JSRegExp, which have some magic fields in
addition to the inobject properties. In Crankshaft we already use the
FastNewObjectStub for %_NewObject in general, so fix TurboFan to the same.
Hopefully one day we can kill %_NewObject completely.

R=jarin@chromium.org
BUG=chromium:609029
LOG=n

Review-Url: https://codereview.chromium.org/1943403004
Cr-Commit-Position: refs/heads/master@{#36006}
2016-05-04 07:35:22 +00:00
adamk
c8a342a582 Fix 'eval' in class extends clauses to be always-strict
Compiler backends get their language mode from the current
function, but should instead be deriving it from the current scope.
This allows proper handling of the always-strictness of class declarations
and expressions, and in particular the treatment of 'eval' calls in an
extends clause as a strict eval.

Also fix the parser's RecordEvalCall logic to only reach out to the
DeclarationScope in sloppy mode, which fixes the strange case of a
sloppy function thinking it contains a sloppy eval when in fact
it contains only a strict eval.

BUG=v8:4970
LOG=n

Review-Url: https://codereview.chromium.org/1931003003
Cr-Commit-Position: refs/heads/master@{#36001}
2016-05-03 22:36:29 +00:00
binji
81cb841170 [Atomics] Make Atomics.store a builtin using TF
BUG=v8:4614
R=bmeurer@chromium.org,jarin@chromium.org
LOG=n

Review-Url: https://codereview.chromium.org/1938213002
Cr-Commit-Position: refs/heads/master@{#35993}
2016-05-03 17:28:34 +00:00
titzer
d622c3a8bd [wasm] Disallow runtime calls in asm.js modules.
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:592352
LOG=Y

Review-Url: https://codereview.chromium.org/1943373002
Cr-Commit-Position: refs/heads/master@{#35992}
2016-05-03 15:57:23 +00:00
jarin
caf460b288 [turbofan] Better test for for-in/continue OSR problem.
The problem is actually not related to try-catch, so here is a test
without try-catch.

BUG=chromium:607493
LOG=n

Review-Url: https://codereview.chromium.org/1943883002
Cr-Commit-Position: refs/heads/master@{#35985}
2016-05-03 14:05:27 +00:00
mlippautz
95b8f3b0d3 Reland of [turbofan] Restore basic write barrier elimination. (patchset #1 id:1 of https://codereview.chromium.org/1943743003/ )
Reason for revert:
Jakob found the actual issue with the CL and is going to land the fix after relanding the WB elimination.

Original issue's description:
> Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ )
>
> Reason for revert:
> Breaks WBs that should be there ;)
>
> https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305
>
> Will open repro bug asap.
>
> Original issue's description:
> > [turbofan] Restore basic write barrier elimination.
> >
> > Restore the basic write barrier elimination that we used to run as part
> > of the simplified lowering phase (in ChangeLowering actually) before, by
> > moving the write barrier computation to SimplifiedLowering where we can
> > still look at types and consider the heap/isolate, and just update the
> > WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
> > lowering to a machine Load/Store.
> >
> > CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
> > R=mstarzinger@chromium.org
> > BUG=v8:4969,chromium:608636
> > LOG=n
> >
> > Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62
> > Cr-Commit-Position: refs/heads/master@{#35969}
>
> TBR=mstarzinger@chromium.org,bmeurer@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:4969,chromium:608636
>
> Committed: https://crrev.com/a782e93c617e728cded5ad878de11137a67891b7
> Cr-Commit-Position: refs/heads/master@{#35983}

TBR=mstarzinger@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4969,chromium:608636

Review-Url: https://codereview.chromium.org/1943323002
Cr-Commit-Position: refs/heads/master@{#35984}
2016-05-03 13:56:30 +00:00
mlippautz
a782e93c61 Revert of [turbofan] Restore basic write barrier elimination. (patchset #2 id:20001 of https://codereview.chromium.org/1938993002/ )
Reason for revert:
Breaks WBs that should be there ;)

https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3305

Will open repro bug asap.

Original issue's description:
> [turbofan] Restore basic write barrier elimination.
>
> Restore the basic write barrier elimination that we used to run as part
> of the simplified lowering phase (in ChangeLowering actually) before, by
> moving the write barrier computation to SimplifiedLowering where we can
> still look at types and consider the heap/isolate, and just update the
> WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
> lowering to a machine Load/Store.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
> R=mstarzinger@chromium.org
> BUG=v8:4969,chromium:608636
> LOG=n
>
> Committed: https://crrev.com/7dcb6ad379fbacbc8bdc8e11a6e50d680ffa3f62
> Cr-Commit-Position: refs/heads/master@{#35969}

TBR=mstarzinger@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4969,chromium:608636

Review-Url: https://codereview.chromium.org/1943743003
Cr-Commit-Position: refs/heads/master@{#35983}
2016-05-03 13:45:30 +00:00
jarin
2da181b08b [turbofan] Fix OSR environment in for-in.
BUG=chromium:607493
LOG=n

Review-Url: https://codereview.chromium.org/1949433002
Cr-Commit-Position: refs/heads/master@{#35982}
2016-05-03 13:41:03 +00:00
ahaas
b6db2255e6 [wasm] Mark all 64-bit instructions as supported on 32-bit platforms.
Additionally I removed some stale comments.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1941323002
Cr-Commit-Position: refs/heads/master@{#35976}
2016-05-03 11:47:59 +00:00
titzer
98c2312995 [wasm] Fix bug with empty input to Wasm.instantiateModuleFromAsm()
R=ahaas@chromium.org,bradnelson@chromium.org
BUG=chromium:605488
LOG=Y

Review-Url: https://codereview.chromium.org/1940243002
Cr-Commit-Position: refs/heads/master@{#35974}
2016-05-03 11:15:24 +00:00
bmeurer
7dcb6ad379 [turbofan] Restore basic write barrier elimination.
Restore the basic write barrier elimination that we used to run as part
of the simplified lowering phase (in ChangeLowering actually) before, by
moving the write barrier computation to SimplifiedLowering where we can
still look at types and consider the heap/isolate, and just update the
WriteBarrierKind in the FieldAccess/ElementAccess that we later use when
lowering to a machine Load/Store.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
R=mstarzinger@chromium.org
BUG=v8:4969,chromium:608636
LOG=n

Review-Url: https://codereview.chromium.org/1938993002
Cr-Commit-Position: refs/heads/master@{#35969}
2016-05-03 09:43:46 +00:00
titzer
2949e05d1e [wasm] Remove unnecessary kExprNop from WASM_BR and other macros.
R=ahaas@chromium.org,binji@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1942873002
Cr-Commit-Position: refs/heads/master@{#35964}
2016-05-03 08:20:04 +00:00
adamk
9e9abcfff4 Properly disallow 'yield' in class expressions and arrow parameters
Yield expressions are not allowed in formal parameter initializers of
generators, but we weren't properly catching the case where the yield
expression appeared in the 'extends' clause of a class expression.

They also aren't allowed in arrow functions, which we were failing to
catch due to not looking at the obscurely-named "FormalParameterInitializerError"
bit of ExpressionClassifier.

This patch passes along an ExpressionClassifier when parsing class
expressions and accumulates the proper error for that case.

For the arrow function case, the fix is simply to check for the
"formal parameter initializer" error once we know we've parsed
an arrow function. The error message used for this has also
been made specific to yield expressions.

Tests are added both for the error case and the non-error cases (where
yield is used in such a position inside the class body).

BUG=v8:4966, v8:4968, v8:4974
LOG=n

Review-Url: https://codereview.chromium.org/1941823003
Cr-Commit-Position: refs/heads/master@{#35957}
2016-05-03 01:57:48 +00:00
Adam Klein
5b8845bd9d Skip new module test262 tests that fail on the waterfall
BUG=v8:4985
LOG=n
TBR=littledan@chromium.org

Review URL: https://codereview.chromium.org/1939423002 .

Cr-Commit-Position: refs/heads/master@{#35956}
2016-05-03 01:55:04 +00:00
littledan
c81616fbfe test262 roll
R=adamk

Review-Url: https://codereview.chromium.org/1931653003
Cr-Commit-Position: refs/heads/master@{#35955}
2016-05-02 23:02:38 +00:00
littledan
4f374bbc94 Use InternalArrays from certain Intl code
The ECMA 402 implementation previously pushed directly to real
Arrays, which risks having observably incorrect behavior in the
presence of monkey patching. This patch uses InternalArrays instead
to avoid that hazard.

R=jshin@chromium.org,yangguo@chromium.org
BUG=chromium:604299
LOG=N

Review-Url: https://codereview.chromium.org/1923803002
Cr-Commit-Position: refs/heads/master@{#35949}
2016-05-02 18:19:25 +00:00
kozyatinskiy
f65e06b97c [debugger] Add JSProxy support in Runtime::GetInternalProperties
For proxy object this methods returns target value, handler object and is revoked flag.

R=yangguo@chromium.org,cbruni@chromium.org
BUG=chromium:588705
LOG=Y

Review-Url: https://codereview.chromium.org/1938663002
Cr-Commit-Position: refs/heads/master@{#35948}
2016-05-02 17:46:32 +00:00
adamk
96746cc7c7 Avoid infinite loop in RegExp.prototype[Symbol.split]
Our implementation of the spec got one comparison wrong, at
step 19.d.iii (we were comparing against 'q' instead of 'p').

R=littledan@chromium.org
BUG=chromium:607566
LOG=n

Review-Url: https://codereview.chromium.org/1940643002
Cr-Commit-Position: refs/heads/master@{#35947}
2016-05-02 17:33:32 +00:00
adamk
567aa1be6d [full-codegen] Fix stack depth tracking when reporting unsupported super usages
Also mark VisitSuperCallReference as unreachable, as it's handled by VisitCall.

R=mstarzinger@chromium.org
BUG=v8:4967
LOG=n

Review-Url: https://codereview.chromium.org/1929213002
Cr-Commit-Position: refs/heads/master@{#35945}
2016-05-02 17:28:54 +00:00
titzer
e2f94946a8 [wasm] Remove the module environment and signature as arguments to OpcodeArity.
R=rossberg@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1937083002
Cr-Commit-Position: refs/heads/master@{#35941}
2016-05-02 15:24:54 +00:00
mstarzinger
cbf2a5420e [interpreter] Enable tests that no longer fail.
The compilation pipeline is correctly guarding against accidental
tier-ups by now, the tests in question should no longer fail.

R=yangguo@chromium.org
BUG=v8:4961
LOG=n

Review-Url: https://codereview.chromium.org/1938983002
Cr-Commit-Position: refs/heads/master@{#35934}
2016-05-02 14:01:10 +00:00
machenbach
78cf397def [Interpreter] Skip some tests that fail with --ignition
BUG=v8:4280
LOG=N
TBR=rmcilroy@chromium.org, rmcilroy@chromium.org
NOTRY=true

Review-Url: https://codereview.chromium.org/1934283002
Cr-Commit-Position: refs/heads/master@{#35931}
2016-05-02 12:17:52 +00:00
bmeurer
4aa02441da [turbofan] Remove left-over change bits from ChangeLowering.
Now ChangeLowering is only concerned with lowering memory access and
allocation operations, and all changes are consistently lowered during
the effect/control linearization pass. The next step is to move the
left over lowerings to a pass dedicated to eliminate redundant loads and
stores, eliminate write barriers, fold and inline allocations.

Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
ChangeInt31ToTaggedSigned for consistency.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel

Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0
Cr-Commit-Position: refs/heads/master@{#35924}

Review-Url: https://codereview.chromium.org/1941673002
Cr-Commit-Position: refs/heads/master@{#35929}
2016-05-02 10:23:43 +00:00
machenbach
b4c3864ba4 Revert of [turbofan] Remove left-over change bits from ChangeLowering. (patchset #2 id:20001 of https://codereview.chromium.org/1941673002/ )
Reason for revert:
[Sheriff] Breaks mac gc stress:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/5821

Original issue's description:
> [turbofan] Remove left-over change bits from ChangeLowering.
>
> Now ChangeLowering is only concerned with lowering memory access and
> allocation operations, and all changes are consistently lowered during
> the effect/control linearization pass. The next step is to move the
> left over lowerings to a pass dedicated to eliminate redundant loads and
> stores, eliminate write barriers, fold and inline allocations.
>
> Also remove the atomic regions now that we wire everything into the
> effect chain properly. This is an important step towards allocation
> inlining.
>
> Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
> ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
> ChangeInt31ToTaggedSigned for consistency.
>
> CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
>
> Committed: https://crrev.com/ceca5ae308bddda166651c654f96d71d74f617d0
> Cr-Commit-Position: refs/heads/master@{#35924}

TBR=ishell@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1942733002
Cr-Commit-Position: refs/heads/master@{#35927}
2016-05-02 09:29:19 +00:00
machenbach
8ba46715b0 [Ignition] Test ignition on all bots.
This adds ignition to the testing variants that are run on all
bots.

Failing tests can only be skipped with the NO_IGNITION
keyword in status files. Existing expectations for the
ignition_turbofan variant are all duplicated and use the
NO_IGNITION keyword as well now.

BUG=v8:4280
LOG=N

Committed: https://crrev.com/132c09ed619f23fb7c6d26a4e3552c703389eabd
Cr-Commit-Position: refs/heads/master@{#35865}

Review-Url: https://codereview.chromium.org/1804003002
Cr-Commit-Position: refs/heads/master@{#35926}
2016-05-02 09:25:00 +00:00
bmeurer
ceca5ae308 [turbofan] Remove left-over change bits from ChangeLowering.
Now ChangeLowering is only concerned with lowering memory access and
allocation operations, and all changes are consistently lowered during
the effect/control linearization pass. The next step is to move the
left over lowerings to a pass dedicated to eliminate redundant loads and
stores, eliminate write barriers, fold and inline allocations.

Also remove the atomic regions now that we wire everything into the
effect chain properly. This is an important step towards allocation
inlining.

Drive-by-fix: Rename ChangeBitToBool to ChangeBitToTagged,
ChangeBoolToBit to ChangeTaggedToBit, and ChangeInt31ToTagged to
ChangeInt31ToTaggedSigned for consistency.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel

Review-Url: https://codereview.chromium.org/1941673002
Cr-Commit-Position: refs/heads/master@{#35924}
2016-05-02 08:42:03 +00:00
fedor
aee17a63b3 [prof] export slide offset in profile log
When exporting `shared-library` in profile log, additionally export a
slide offset. This is required to parse profile logs generated on
systems with ASLR (OS X), otherwise it is impossible to assign C++
symbol names to their addresses in the log.

See: https://github.com/nodejs/node/issues/6466

BUG=

Review-Url: https://codereview.chromium.org/1934453003
Cr-Commit-Position: refs/heads/master@{#35921}
2016-05-02 08:03:01 +00:00
bmeurer
d1b3d426ce [turbofan] Run everything after representation selection concurrently.
Further refactor the pipeline to even run the first scheduler (part of
the effect control linearization) concurrently. This temporarily
disables most of the write barrier elimination, but we will get back to
that later.

Drive-by-fix: Remove the dead code from ChangeLowering, and stack
allocate the Typer in the pipeline. Also migrate the AllocateStub to a
native code builtin, so that we have the code object + a handle to it
available all the time.

CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_tsan_rel
R=mstarzinger@chromium.org
BUG=v8:4969
LOG=n

Review-Url: https://codereview.chromium.org/1926023002
Cr-Commit-Position: refs/heads/master@{#35918}
2016-04-30 19:01:01 +00:00
mike
efe5b72d02 [parser] Enforce module-specific identifier restriction
Restrict the use of the `await` token as an identifier when parsing
source text as module code.

From
http://www.ecma-international.org/ecma-262/6.0/#sec-future-reserved-words:

> 11.6.2.2 Future Reserved Words
>
> The following tokens are reserved for used as keywords in future
> language extensions.
>
> Syntax
>
>     FutureReservedWord ::
>         enum
>         await
>
> await is only treated as a FutureReservedWord when Module is the goal
> symbol of the syntactic grammar.

BUG=v8:4767
LOG=N
R=adamk@chromium.org

Review-Url: https://codereview.chromium.org/1723313002
Cr-Commit-Position: refs/heads/master@{#35914}
2016-04-29 18:14:48 +00:00
mbrandy
791c0400cf Avoid reliance on undefined malloc(0) behavior.
AIX returns NULL rather than a valid heap address.

TEST=cctest/test-run-wasm-module/Run_WasmModule_CallAdd_rev
R=titzer@chromium.org, jochen@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/1934633002
Cr-Commit-Position: refs/heads/master@{#35913}
2016-04-29 16:54:53 +00:00
ishell
b83edcc8b1 [runtime] Don't crash when creating an instance of a class inherited from a Proxy.
BUG=v8:4972
LOG=N

Review-Url: https://codereview.chromium.org/1925803005
Cr-Commit-Position: refs/heads/master@{#35911}
2016-04-29 15:07:35 +00:00
mlippautz
45f52fcb60 Reland of "[heap] Uncommit pooled pages concurrently"
- Move the concurrent unmapping to MemoryAllocator
- Hide (private) members where possible
- MemoryAllocator:Free is now the bottleneck for freeing
- Pooled pages are either allocated from a set of pooled pages are obtained
  through work stealing from the concurrent unmapper

BUG=chromium:605866, chromium:581412
LOG=N

This reverts commit 25ff296c4c.

Review-Url: https://codereview.chromium.org/1929503002
Cr-Commit-Position: refs/heads/master@{#35910}
2016-04-29 14:28:18 +00:00
rmcilroy
ac2a17abcb [Interpreter] Use FastCloneShallowObjectStub in CreateObjectLiteral bytecode.
Adapts FastCloneShallowObjectStub to enable it to be used by the
CreateObjectLiteral bytecode.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/1922523002
Cr-Commit-Position: refs/heads/master@{#35909}
2016-04-29 14:21:33 +00:00
clemensh
0d6d0b700f [wasm] Add tests for function name encoding
In order to have a wasm object (as JSObject), this adds a method to
instantiate the TestingModule. In order for this to work, the bytecode
and the function names of the TestingModule are stored for usage during
instantiation.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/1916403002
Cr-Commit-Position: refs/heads/master@{#35906}
2016-04-29 12:43:51 +00:00
clemensh
9fd2650ae0 [wasm] Store function names in the wasm object
We now store the wasm object and the function index in the
deoptimization data of the wasm Code object, and store an array with
function names in the wasm object.

This will make both the wasm module as well as the respective function
name available from the code object.

Tests will follow in https://codereview.chromium.org/1916403002.

R=titzer@chromium.org, mstarzinger@chromium.org, machenbach@chromium.org

Review-Url: https://codereview.chromium.org/1912103002
Cr-Commit-Position: refs/heads/master@{#35905}
2016-04-29 12:26:28 +00:00
mstarzinger
5749d710bc [compiler] Fix TurboFan to respect kOptimizeFromBytecode.
This ensures that the TurboFan pipeline is respecting the flag on the
CompilationInfo controlling whether to use the BytecodeGraphBuilder or
the AstGraphBuilder when ensuring deoptimization support.

R=rmcilroy@chromium.org
BUG=chromium:607871
LOG=n

Review-Url: https://codereview.chromium.org/1934563002
Cr-Commit-Position: refs/heads/master@{#35904}
2016-04-29 12:04:43 +00:00
machenbach
3bf44848c3 [gn] Move build to gypfiles
This prepares for pulling chromium's build as dependency for
gn. After this, the files in build and gypfiles need to stay
in sync until chromium is updated.

BUG=chromium:474921
LOG=n

Review-Url: https://codereview.chromium.org/1848553003
Cr-Commit-Position: refs/heads/master@{#35898}
2016-04-29 10:11:11 +00:00
titzer
ee03b7217b [wasm] Binary 11: Bump module version to 0xB.
[wasm] Binary 11: Swap the order of section name / section length.
[wasm] Binary 11: Shorter section names.
[wasm] Binary 11: Add a prefix for function type declarations.
[wasm] Binary 11: Function types encoded as pcount, p*, rcount, r*
[wasm] Fix numeric names for functions.

R=rossberg@chromium.org,jfb@chromium.org,ahaas@chromium.org
BUG=chromium:575167
LOG=Y

Review-Url: https://codereview.chromium.org/1896863003
Cr-Commit-Position: refs/heads/master@{#35897}
2016-04-29 09:40:24 +00:00
titzer
2aa4656eeb [wasm] Binary 11: WASM AST is now postorder.
[wasm] Binary 11: br_table takes a value.
[wasm] Binary 11: Add implicit blocks to if arms.
[wasm] Binary 11: Add arities to call, return, and breaks
[wasm] Binary 11: Add experimental version.

This CL changes the encoder, decoder, and tests to use a postorder
encoding of the AST, which is more efficient in decode time and
space.

R=bradnelson@chromium.org,rossberg@chromium.org,binji@chromium.org
BUG=chromium:575167
LOG=Y

Review-Url: https://codereview.chromium.org/1830663002
Cr-Commit-Position: refs/heads/master@{#35896}
2016-04-29 09:16:21 +00:00
mstarzinger
b06fa13704 [interpreter] Be explicit when to test BytecodeGraphBuilder.
This adds a dedicated flag for enabling the BytecodeGraphBuilder. The
intention is to be explicit when this variant is being tested and to
avoid unnecessary overhead in production code for a configuration that
is not yet shipping.

R=rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/1925123002
Cr-Commit-Position: refs/heads/master@{#35892}
2016-04-29 08:41:11 +00:00
adamk
f1a0f054fb Several tiny cleanups in test-parsing.cc
R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/1926133003
Cr-Commit-Position: refs/heads/master@{#35890}
2016-04-29 06:44:18 +00:00
machenbach
819371c628 Revert of Remove more dead code after Object.observe removal (patchset #5 id:80001 of https://codereview.chromium.org/1904313004/ )
Reason for revert:
[Sheriff] Looks like this breaks layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/6442

Original issue's description:
> Remove more dead code after Object.observe removal
>
> This moves __{define,lookup}{Getter,Setter}__ to builtins.cc to free up the JavaScript implementation of DefineOwnProperty for deletion.

TBR=verwaest@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1929293002
Cr-Commit-Position: refs/heads/master@{#35886}
2016-04-29 06:31:02 +00:00
littledan
3d66e5d1d7 Add checks for detached ArrayBuffers to ArrayBuffer.prototype.slice
These checks ensure that a TypeError is thrown, per spec, rather than
a runtime assert failure.

BUG=v8:4964
R=adamk
LOG=Y

Review-Url: https://codereview.chromium.org/1929123002
Cr-Commit-Position: refs/heads/master@{#35885}
2016-04-28 22:50:56 +00:00
jkummerow
15e106382e Remove more dead code after Object.observe removal
This moves __{define,lookup}{Getter,Setter}__ to builtins.cc to free up the JavaScript implementation of DefineOwnProperty for deletion.

Review-Url: https://codereview.chromium.org/1904313004
Cr-Commit-Position: refs/heads/master@{#35876}
2016-04-28 18:35:42 +00:00
ivica.bogosavljevic
60497de28c MIPS: Implement unaligned access instruction.
Implement unaligned access instructions, and tests for corresponding
instruction

BUG=

Review-Url: https://codereview.chromium.org/1902743002
Cr-Commit-Position: refs/heads/master@{#35873}
2016-04-28 15:10:12 +00:00
machenbach
af41997177 Revert of [Ignition] Test ignition on all bots. (patchset #4 id:60001 of https://codereview.chromium.org/1804003002/ )
Reason for revert:
Will resubmit with proper fix and more test skips.

Original issue's description:
> [Ignition] Test ignition on all bots.
>
> This adds ignition to the testing variants that are run on all
> bots.
>
> Failing tests can only be skipped with the NO_IGNITION
> keyword in status files. Existing expectations for the
> ignition_turbofan variant are all duplicated and use the
> NO_IGNITION keyword as well now.
>
> BUG=v8:4280
> LOG=N
> NOTRY=true

TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,yangguo@chromium.org,mythria@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4280

Review-Url: https://codereview.chromium.org/1930943002
Cr-Commit-Position: refs/heads/master@{#35871}
2016-04-28 14:53:57 +00:00
rossberg
9e7793eaac Ship for-in initializer deprecation
R=hablich@chromium.org
BUG=v8:4942
LOG=true

Review-Url: https://codereview.chromium.org/1928513004
Cr-Commit-Position: refs/heads/master@{#35868}
2016-04-28 13:39:18 +00:00
mmoroz
6474898082 Add GC request to libFuzzers in attempt to avoid parasitic coverage.
R=aizatsky@chromium.org, jochen@chromium.org, kcc@chromium.org, ochang@chromium.org
BUG=584819
LOG=Y

Review-Url: https://codereview.chromium.org/1927933002
Cr-Commit-Position: refs/heads/master@{#35866}
2016-04-28 13:32:28 +00:00
machenbach
132c09ed61 [Ignition] Test ignition on all bots.
This adds ignition to the testing variants that are run on all
bots.

Failing tests can only be skipped with the NO_IGNITION
keyword in status files. Existing expectations for the
ignition_turbofan variant are all duplicated and use the
NO_IGNITION keyword as well now.

BUG=v8:4280
LOG=N
NOTRY=true

Review-Url: https://codereview.chromium.org/1804003002
Cr-Commit-Position: refs/heads/master@{#35865}
2016-04-28 13:32:27 +00:00
yangguo
5ea8412304 [debugger,interpreter] add source position to stack checks.
DevTools uses the debug interrupt to trap on function entry. Without
source position at the stack check, we would get bogus source positions.

R=mstarzinger@chromium.org
BUG=chromium:595646
LOG=N

Review-Url: https://codereview.chromium.org/1925063002
Cr-Commit-Position: refs/heads/master@{#35864}
2016-04-28 13:16:57 +00:00
machenbach
9212be866d Revert of [turbofan] Run everything after representation selection concurrently. (patchset #2 id:20001 of https://codereview.chromium.org/1926023002/ )
Reason for revert:
[Sheriff] Flaky crashed here and there:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/9867
https://build.chromium.org/p/client.v8/builders/V8%20Linux64/builds/9589
https://build.chromium.org/p/client.v8/builders/V8%20Mac/builds/7679

Original issue's description:
> [turbofan] Run everything after representation selection concurrently.
>
> Further refactor the pipeline to even run the first scheduler (part of
> the effect control linearization) concurrently. This temporarily
> disables most of the write barrier elimination, but we will get back to
> that later.

TBR=mstarzinger@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/1925073002
Cr-Commit-Position: refs/heads/master@{#35863}
2016-04-28 13:14:39 +00:00
bmeurer
e045a06625 [turbofan] Run everything after representation selection concurrently.
Further refactor the pipeline to even run the first scheduler (part of
the effect control linearization) concurrently. This temporarily
disables most of the write barrier elimination, but we will get back to
that later.

Review-Url: https://codereview.chromium.org/1926023002
Cr-Commit-Position: refs/heads/master@{#35861}
2016-04-28 12:54:49 +00:00
yangguo
9a93964503 [debugger,interpreter] tentatively unskip gc-stress tests.
R=machenbach@chromium.org
BUG=v8:4690
LOG=N

Review-Url: https://codereview.chromium.org/1925993002
Cr-Commit-Position: refs/heads/master@{#35856}
2016-04-28 11:19:16 +00:00
balazs.kilvady
5345727935 MIPS: Fix unbounded label counter.
TEST=mjsunit/asm/embenchen/zlib
BUG=

Review-Url: https://codereview.chromium.org/1925543003
Cr-Commit-Position: refs/heads/master@{#35854}
2016-04-28 11:01:12 +00:00
neis
622c92b88f Correctly set the closing condition in array patterns.
This fixes a bug where the iterable's .return method gets called when it
shouldn't.

R=littledan@chromium.org
BUG=v8:4952
LOG=n

Review-Url: https://codereview.chromium.org/1927073002
Cr-Commit-Position: refs/heads/master@{#35850}
2016-04-28 10:01:23 +00:00
yangguo
31182fb2aa Skip more tests for ignition and gc-stress.
NOTRY=true
TBR=machenbach@chromium.org
BUG=v8:4961
LOG=N

Review-Url: https://codereview.chromium.org/1928893002
Cr-Commit-Position: refs/heads/master@{#35849}
2016-04-28 09:34:23 +00:00
verwaest
adc0215072 Propagate not-found on proxy target to GetRealNamedProperty
BUG=v8:4932
LOG=n

Review-Url: https://codereview.chromium.org/1929853002
Cr-Commit-Position: refs/heads/master@{#35846}
2016-04-28 08:26:17 +00:00
yangguo
47ffcac6d5 Skip es6/block-conflicts for ignition and gc-stress.
TBR=machenbach@chromium.org
BUG=v8:4961
LOG=N
NOTRY=true

Review-Url: https://codereview.chromium.org/1924093004
Cr-Commit-Position: refs/heads/master@{#35845}
2016-04-28 08:13:05 +00:00
clemensh
2f1df8a39f Refactoring to use ArrayVector where applicable
It's more readable than the construction
Vector<T>(buffer, arraysize(buffer)).
All those places are now replaced by ArrayVector(buffer).

R=titzer@chromium.org, jarin@chromium.org, rossberg@chromium.org

Review-Url: https://codereview.chromium.org/1916393002
Cr-Commit-Position: refs/heads/master@{#35843}
2016-04-28 08:01:54 +00:00
yangguo
cd3a5ee951 Skip es6/typedarray-copywithin for ignition
R=machenbach@chromium.org
BUG=v8:4961
NOTRY=true
LOG=N
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/1915033008
Cr-Commit-Position: refs/heads/master@{#35842}
2016-04-28 07:33:25 +00:00
yangguo
c218683494 [debugger,interpreter] precisely determine execution tier.
R=mstarzinger@chromium.org
BUG=v8:4690
LOG=N

Review-Url: https://codereview.chromium.org/1921853005
Cr-Commit-Position: refs/heads/master@{#35840}
2016-04-28 06:19:48 +00:00
caitpotter88
ff956f4dee [esnext] implement StringPad spec changes from March TC39 meeting
Return the empty string from StringPad if the filler argument is the empty
string, effectively returning the string unchanged in StringPadStart and
StringPadEnd.

```
"foo".padStart(100000, "") -> "foo"
```

BUG=v8:4957, v8:4954
LOG=N
R=littledan@chromium.org

Review-Url: https://codereview.chromium.org/1926773003
Cr-Commit-Position: refs/heads/master@{#35837}
2016-04-27 22:03:27 +00:00
littledan
63b935428c Disallow generator declarations in certain locations
The legacy function declaration locations from Annex B 3.2 and 3.4 do not
apply for generator declarations. This patch cracks down on those usages,
which is tested for by new incoming test262 tests.

BUG=v8:4824
LOG=Y
R=adamk

Review-Url: https://codereview.chromium.org/1900033003
Cr-Commit-Position: refs/heads/master@{#35835}
2016-04-27 19:18:38 +00:00
adamk
306c412ce0 [api] Expose FunctionCallbackInfo::NewTarget
This is needed by Blink to implement the Custom Elements spec.

BUG=v8:4261
LOG=y

Review-Url: https://codereview.chromium.org/1910253005
Cr-Commit-Position: refs/heads/master@{#35833}
2016-04-27 18:09:05 +00:00
mstarzinger
5a54000eda [compiler] Rename OptimizingCompileJob to CompilationJob.
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/1925743002
Cr-Commit-Position: refs/heads/master@{#35832}
2016-04-27 17:56:16 +00:00
mstarzinger
98ef8a9dac [turbofan] Avoid obsolete steps in FunctionTester.
This makes sure that the testing pipeline withing the FunctionTester
class only performs AST analysis and deoptimization preparation when
graphs are generated from the AST (as opposed to from bytecode).

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/1928523002
Cr-Commit-Position: refs/heads/master@{#35827}
2016-04-27 16:31:11 +00:00
verwaest
41acd51bc3 Remove now-dead DefineDataPropertyUnchecked
BUG=

Review URL: https://codereview.chromium.org/1926493003

Cr-Commit-Position: refs/heads/master@{#35823}
2016-04-27 13:22:17 +00:00
ishell
f95e130b7e [es8] Report proper syntax error for tail call expressions in for-in and for-of bodies.
BUG=v8:4915
LOG=Y

Review URL: https://codereview.chromium.org/1914423002

Cr-Commit-Position: refs/heads/master@{#35822}
2016-04-27 13:03:12 +00:00
neis
42c0e2ec7c [generators] Perform state dispatch in loop header.
This is necessary to eventually build a turbofan graph.

BUG=v8:4907
LOG=n

Review URL: https://codereview.chromium.org/1901713003

Cr-Commit-Position: refs/heads/master@{#35820}
2016-04-27 12:42:10 +00:00
hablich
25ff296c4c Revert of [heap] Uncommit pooled pages concurrently (patchset #5 id:120001 of https://codereview.chromium.org/1913083002/ )
Reason for revert:
Creates a spike of OOM(v8) crashers on Win32.

Original issue's description:
> [heap] Uncommit pooled pages concurrently
>
> - Move the concurrent unmapping to MemoryAllocator
> - Hide (private) members where possible
> - MemoryAllocator:Free is now the bottleneck for freeing
> - Pooled pages are either allocated from a set of pooled pages are obtained
>   through work stealing from the concurrent unmapper
>
> BUG=chromium:605866, chromium:581412
> LOG=N
>
> Committed: https://crrev.com/2158df87116906160cebc3ad20c97f454822da03
> Cr-Commit-Position: refs/heads/master@{#35797}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:605866, chromium:581412

Review URL: https://codereview.chromium.org/1925563003

Cr-Commit-Position: refs/heads/master@{#35819}
2016-04-27 12:40:01 +00:00
bmeurer
ff19726d80 [turbofan] Enable concurrent (re)compilation.
Refactor the TurboFan pipeline to allow for concurrent recompilation in
the same way that Crankshaft does it. For now we limit the concurrent
phases to scheduling, instruction selection, register allocation and
jump threading.

R=mstarzinger@chromium.org, ahaas@chromium.org, jarin@chromium.org

Review URL: https://codereview.chromium.org/1179393008

Cr-Commit-Position: refs/heads/master@{#35818}
2016-04-27 12:40:00 +00:00
ssanfilippo
905becd13b [Interpreter] Add Ignition statistics JavaScript extension.
This commit introduces IgnitionStatisticsExtension, which provides
methods for accessing Ignition statistics and counters from JavaScript.

The extension is registered when FLAG_ignition and
FLAG_trace_ignition_dispatches are both enabled.

For the moment, the only exposed function is
getIgnitionDispatchCounters(), which allows to retrieve Ignition
dispatch counters as a JavaScript object.

BUG=v8:4899
LOG=N

Review URL: https://codereview.chromium.org/1899133004

Cr-Commit-Position: refs/heads/master@{#35816}
2016-04-27 11:11:44 +00:00
yangguo
612985b298 Revert of [debugger] unskip mjsunit/debug-stepin-builtin-callback-opt. (patchset #1 id:1 of https://codereview.chromium.org/1927543002/ )
Reason for revert:
Now we do have a repro!

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/3187/steps/Mjsunit%20-%20ignition%20-%20turbofan/logs/debug-stepin-builtin-..

Original issue's description:
> [debugger] unskip mjsunit/debug-stepin-builtin-callback-opt.
>
> This test does not seem to fail any longer.
>
> R=machenbach@chromium.org
> BUG=v8:4690
> LOG=N
>
> Committed: https://crrev.com/f8e44fb5aaaa80cf2d39bc3164f2c962a6b57f5e
> Cr-Commit-Position: refs/heads/master@{#35814}

TBR=machenbach@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4690

Review URL: https://codereview.chromium.org/1931433002

Cr-Commit-Position: refs/heads/master@{#35815}
2016-04-27 10:54:53 +00:00
yangguo
f8e44fb5aa [debugger] unskip mjsunit/debug-stepin-builtin-callback-opt.
This test does not seem to fail any longer.

R=machenbach@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1927543002

Cr-Commit-Position: refs/heads/master@{#35814}
2016-04-27 10:20:33 +00:00
ishell
813f2778f3 [es6] Don't eliminate tail calls from for-in and for-of bodies.
BUG=v8:4698
LOG=N

Review URL: https://codereview.chromium.org/1914393002

Cr-Commit-Position: refs/heads/master@{#35813}
2016-04-27 09:34:10 +00:00
verwaest
f1cc6e646f Check the state of the current binary op IC before patching smi code
Between the miss and patching, we run user code. That may already patch the same code. IC refactoring broke this (again), so including a regression test this time around.

BUG=chromium:601392
LOG=n

Review URL: https://codereview.chromium.org/1925583002

Cr-Commit-Position: refs/heads/master@{#35811}
2016-04-27 09:19:15 +00:00
ishell
2fb88d617c [js-perf-test] Shorten output of JSTests/PropertyQueries microbenchmark.
Review URL: https://codereview.chromium.org/1922413002

Cr-Commit-Position: refs/heads/master@{#35810}
2016-04-27 09:14:14 +00:00
ahaas
97c357aac1 [x64] Regression test for https://codereview.chromium.org/1877133004
R=jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1919263002

Cr-Commit-Position: refs/heads/master@{#35807}
2016-04-27 07:01:45 +00:00
yangguo
d1e08e7a72 [debugger] do not expose temporary variables introduced by the parser.
R=bmeurer@chromium.org, kozyatinskiy@chromium.org
BUG=chromium:582048
LOG=N

Review URL: https://codereview.chromium.org/1916343002

Cr-Commit-Position: refs/heads/master@{#35805}
2016-04-27 04:49:46 +00:00
jarin
101260d304 Ship try-finally optimization in Turbofan.
Review URL: https://codereview.chromium.org/1920883003

Cr-Commit-Position: refs/heads/master@{#35804}
2016-04-27 04:29:07 +00:00
ishell
ea2fbb7620 [es8] Initial set of changes to support syntactic tail calls.
The syntax is "return continue expr;".

BUG=v8:4915
LOG=Y

Review URL: https://codereview.chromium.org/1917993004

Cr-Commit-Position: refs/heads/master@{#35799}
2016-04-26 17:31:23 +00:00
adamk
967a04634d Forward accept_IN to ParseYieldExpression
This allows "yield 'x' in o" as an expression in a generator.

R=ishell@chromium.org
BUG=v8:4945
LOG=n

Review URL: https://codereview.chromium.org/1916183003

Cr-Commit-Position: refs/heads/master@{#35798}
2016-04-26 17:24:49 +00:00
mlippautz
2158df8711 [heap] Uncommit pooled pages concurrently
- Move the concurrent unmapping to MemoryAllocator
- Hide (private) members where possible
- MemoryAllocator:Free is now the bottleneck for freeing
- Pooled pages are either allocated from a set of pooled pages are obtained
  through work stealing from the concurrent unmapper

BUG=chromium:605866, chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1913083002

Cr-Commit-Position: refs/heads/master@{#35797}
2016-04-26 16:45:40 +00:00
clemensh
af9e4c33ab [wasm] Replace WasmName by Vector<const char>
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1910213004

Cr-Commit-Position: refs/heads/master@{#35796}
2016-04-26 14:47:29 +00:00
clemensh
c32b202014 Pass debug name as Vector instead of const char*
This allows to also pass non-null-terminated values, and values containing null
characters. Both might happen in wasm.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1911313002

Cr-Commit-Position: refs/heads/master@{#35795}
2016-04-26 14:37:05 +00:00
yangguo
eee6ddb2ac [debugger] add test case for debug-evaluate for values in TDZ.
R=jkummerow@chromium.org
BUG=chromium:605581
LOG=N

Review URL: https://codereview.chromium.org/1920953003

Cr-Commit-Position: refs/heads/master@{#35794}
2016-04-26 14:11:21 +00:00
clemensh
91386f0bc0 [wasm] Generate source position information
Annotate call nodes in the TF graph with source code information in the form
of byte offset relative to the wasm function start. The backend finally outputs those positions as RelocInfo.

R=bmeurer@chromium.org, mstarzinger@chromium.org, titzer@chromium.org

Review URL: https://codereview.chromium.org/1890803002

Cr-Commit-Position: refs/heads/master@{#35793}
2016-04-26 12:47:09 +00:00
machenbach
4ffdce65dd [Interpreter] Prepare switching to new ignition testing variant.
This adds a new ignition_turbofan testing variant that'll
allow switching turbofan off in the other ignition variant.

The switch will happen in a follow up after reconfiguring
the bots.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1922623003

Cr-Commit-Position: refs/heads/master@{#35790}
2016-04-26 11:24:34 +00:00
ishell
5796ae9de4 [js-perf-test] Add microbenchmarks for in operator and Object.prototype.hasOwnProperty().
BUG=v8:2472, v8:2743
LOG=N

Review URL: https://codereview.chromium.org/1913813003

Cr-Commit-Position: refs/heads/master@{#35789}
2016-04-26 10:24:24 +00:00
ishell
086fe2199b [es6] Fix tail call elimination in single-expression arrow functions.
BUG=v8:4698
LOG=Y

Review URL: https://codereview.chromium.org/1921083002

Cr-Commit-Position: refs/heads/master@{#35786}
2016-04-26 09:07:51 +00:00
adamk
739947880c Widen --harmony-for-in flag to throw errors in PreParser
The first version of --harmony-for-in avoided throwing PreParser
errors in order to retain use counting. This patch threads
use_counts_ through to the PreParser to allow use counting in
the PreParser while also throwing errors for this case.

Also slightly refactored the Parser code to do a little less
code duplication.

BUG=v8:4942
LOG=y

Review URL: https://codereview.chromium.org/1913203002

Cr-Commit-Position: refs/heads/master@{#35780}
2016-04-26 00:29:50 +00:00
bbudge
d565ba8ff3 RegisterAllocator: Clean up before adding aliasing.
Remove some unused fields in RegisterAllocationData.
Move some DCHECKS about configuration constraints.
Rename kMaxDoubleRegisters -> kMaxFPRegisters

LOG=N
BUG=v8:4124

Review URL: https://codereview.chromium.org/1518573002

Cr-Commit-Position: refs/heads/master@{#35777}
2016-04-25 20:11:40 +00:00
verwaest
1678bb557c MigrateInstance(target) before Object.assign(target, ...)
If the target is deprecated, the object will be updated on first store. If the source for that store equals the target, this will invalidate the cached representation of the source. Preventively upgrade the target.

BUG=chromium:604300
LOG=n

Review URL: https://codereview.chromium.org/1905933002

Cr-Commit-Position: refs/heads/master@{#35770}
2016-04-25 15:41:21 +00:00
jochen
7895b396f8 [api] Introduce MicrotasksScope::IsRunningMicrotasks
Returns true while V8 executes microtasks

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1920813002

Cr-Commit-Position: refs/heads/master@{#35769}
2016-04-25 15:22:32 +00:00
mlippautz
4e8736da2d [heap] Merge NewSpacePage into Page
BUG=chromium:581412
LOG=N

Review URL: https://codereview.chromium.org/1900423002

Cr-Commit-Position: refs/heads/master@{#35768}
2016-04-25 14:53:45 +00:00
mbrandy
3bb5b67204 PPC64: [simulator] Do not sign-extend uint32_t call parameters.
R=bmeurer@chromium.org, titzer@chromium.org, mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1918503002

Cr-Commit-Position: refs/heads/master@{#35766}
2016-04-25 14:03:58 +00:00
mbrandy
36091039b3 Fix cctest/test-run-load-store for big-endian architectures.
R=bmeurer@chromium.org, titzer@chromium.org, ahaas@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1908253007

Cr-Commit-Position: refs/heads/master@{#35765}
2016-04-25 14:01:29 +00:00
yangguo
6f67d171f1 [regexp] Fix non-match and max match length in RegExpCharacterClass.
R=mstarzinger@chromium.org
BUG=chromium:605862
LOG=N

Review URL: https://codereview.chromium.org/1916763002

Cr-Commit-Position: refs/heads/master@{#35764}
2016-04-25 13:32:14 +00:00
bmeurer
dcf178fb29 [turbofan] Move ChangeTaggedToFoo lowerings to EffectControlLinearizer.
These also lower to subgraphs that have to be connected to the effect
and control chains, otherwise removing the atomic regions around heap
allocations would still be unsound.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1916763003

Cr-Commit-Position: refs/heads/master@{#35762}
2016-04-25 12:41:17 +00:00
neis
0ff89ea75b Migrate Object.definePropert{ies,y} from v8natives to builtins.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1919763002

Cr-Commit-Position: refs/heads/master@{#35761}
2016-04-25 12:24:48 +00:00
machenbach
cb855fe728 [build] Prepare moving v8.gyp to src/
This will allow to pull in gyp as a deps to the same location
as chromium (tools/gyp not build/gyp), needed for gn switch.

This is the first step of a 3-way move.
1) Copy v8.gyp in v8
2) Update references in embedders (follow up)
3) Remove old v8.gyp (follow up)

BUG=chromium:474921
LOG=n
NOTRY=true

Review URL: https://codereview.chromium.org/1920793002

Cr-Commit-Position: refs/heads/master@{#35760}
2016-04-25 12:20:24 +00:00
neis
17024be077 Migrate Object.getPrototypeOf from v8natives to builtins.
More v8natives cleanup to come...

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1922453002

Cr-Commit-Position: refs/heads/master@{#35759}
2016-04-25 11:45:40 +00:00
yangguo
3c7391093b [debugger] fix mjsunit/regress/regress-crbug-119800 for ignition.
R=vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1907293002

Cr-Commit-Position: refs/heads/master@{#35758}
2016-04-25 11:37:12 +00:00
jarin
692eec3969 [turbofan] Remove obsolete parts of change lowering.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1917753002

Cr-Commit-Position: refs/heads/master@{#35756}
2016-04-25 09:27:18 +00:00
rmcilroy
c005029aa4 [Interpreter] Use FastNewSloppyArguments when possible.
Use the FastNewSloppyArgumentsStub in the interpreter when function doesn't have
duplicate parameters.

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1909903003

Cr-Commit-Position: refs/heads/master@{#35754}
2016-04-25 09:25:06 +00:00
yangguo
098ff93558 [debugger] make step positions for for-of compatible with interpreter.
R=mstarzinger@chromium.org, rossberg@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1906653004

Cr-Commit-Position: refs/heads/master@{#35750}
2016-04-25 06:53:41 +00:00
jarin
9cae24b8cc [turbofan] Wire in floating control during effect linearization phase.
Review URL: https://codereview.chromium.org/1921483002

Cr-Commit-Position: refs/heads/master@{#35747}
2016-04-25 04:29:23 +00:00
bmeurer
0231a7efa2 [turbofan] Introduce TruncateTaggedToWord32 simplified operator.
This allows us to get rid of the "push TruncateFloat64ToInt32 into Phi"
trick that was used in the MachineOperatorReducer to combine the
ChangeTaggedToFloat64 and TruncateFloat64ToInt32 operations. Instead of
doing that later, we can just introduce the proper operator during the
representation selection directly.

Also separate the TruncateFloat64ToInt32 machine operator, which had two
different meanings depending on a flag (either JavaScript truncation or
C++ style round to zero). Now there's a TruncateFloat64ToWord32 which
represents the JavaScript truncation (implemented via TruncateDoubleToI
macro + code stub) and the RoundFloat64ToInt32, which implements the C++
round towards zero operation (in the same style as the other WebAssembly
driven Round* machine operators).

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1919513002

Cr-Commit-Position: refs/heads/master@{#35743}
2016-04-24 11:41:20 +00:00
Adam Klein
f6c09c893a Remove non-existent object-observe test from mjsunit.status
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1907423002 .

Cr-Commit-Position: refs/heads/master@{#35740}
2016-04-22 18:31:44 +00:00
mbrandy
d0f414dbe6 Reland "Fix interpreter unittest for embedded constant pools."
The offset from fp to the register file is based on the frame size
-- which is one slot larger when embedded constant pools are enabled.

TEST=unittests/DecodeBytecodeAndOperands
TBR=rmcilroy@chromium.org, bmeurer@chromium.org, oth@chromium.org, mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1906963002

Cr-Commit-Position: refs/heads/master@{#35735}

Review URL: https://codereview.chromium.org/1909283003

Cr-Commit-Position: refs/heads/master@{#35737}
2016-04-22 15:32:22 +00:00
mbrandy
2a113b8e2e Revert of Fix interpreter unittest for embedded constant pools. (patchset #2 id:20001 of https://codereview.chromium.org/1906963002/ )
Reason for revert:
Need to fix the #undef logic.

Original issue's description:
> Fix interpreter unittest for embedded constant pools.
>
> The offset from fp to the register file is based on the frame size
> -- which is one slot larger when embedded constant pools are enabled.
>
> TEST=unittests/DecodeBytecodeAndOperands
> R=rmcilroy@chromium.org, bmeurer@chromium.org, oth@chromium.org, mstarzinger@chromium.org
> BUG=

TBR=bmeurer@chromium.org,mstarzinger@chromium.org,oth@chromium.org,rmcilroy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1909323003

Cr-Commit-Position: refs/heads/master@{#35736}
2016-04-22 15:04:50 +00:00
mbrandy
074320ac2d Fix interpreter unittest for embedded constant pools.
The offset from fp to the register file is based on the frame size
-- which is one slot larger when embedded constant pools are enabled.

TEST=unittests/DecodeBytecodeAndOperands
R=rmcilroy@chromium.org, bmeurer@chromium.org, oth@chromium.org, mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1906963002

Cr-Commit-Position: refs/heads/master@{#35735}
2016-04-22 14:50:02 +00:00
epertoso
339000bf3b [turbofan] Add the Verifier to the pipeline for code stubs.
Removes some control edges added from the RawMachineAssembler to the end of the graph.
Adds a parameter that tells the Verifier to ignore effect and control inputs.

Review URL: https://codereview.chromium.org/1912853003

Cr-Commit-Position: refs/heads/master@{#35731}
2016-04-22 13:56:36 +00:00
mike
b86ec74395 [modules] Infer strict mode from within scope object
Refactor the Scope object to automatically enable strict mode when
initialized as a "module" scope, relieving the caller of this
responsibility.

BUG=v8:4941
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1906923002

Cr-Commit-Position: refs/heads/master@{#35730}
2016-04-22 13:38:15 +00:00
yangguo
4b580cad0c [debugger,interpreter] fix source position of compare operation.
R=mstarzinger@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1903223003

Cr-Commit-Position: refs/heads/master@{#35729}
2016-04-22 13:11:48 +00:00
rossberg
9ce87d6772 Add flag for disallowing for-in initializers
This does not affect use counters.

R=nikolaos@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1911963003

Cr-Commit-Position: refs/heads/master@{#35726}
2016-04-22 12:04:15 +00:00
mstarzinger
5c8609de9d [interpreter] Heal closures when bytecode array is gone.
This ensures the InterpreterEntryTrampoline heals code entry fields
inside closures when being called without a valid bytecode array. This
is preparatory work to allow removal of bytecode when switching some
functions to other types of code.

R=rmcilroy@chromium.org
BUG=v8:4280
LOG=n

Review URL: https://codereview.chromium.org/1904093002

Cr-Commit-Position: refs/heads/master@{#35724}
2016-04-22 11:13:28 +00:00
bmeurer
550c0f9f55 [turbofan] Move more type checks to the representation selector.
Get rid of further typing checks from ChangeLowering and put them into
the representation selection pass instead (encoding the information in
the operator instead).

Drive-by-change: Rename ChangeSmiToInt32 to ChangeTaggedSignedToInt32
for consistency about naming Tagged, TaggedSigned and TaggedPointer.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1909343002

Cr-Commit-Position: refs/heads/master@{#35723}
2016-04-22 11:03:17 +00:00
yangguo
672983830f [debugger] Hide scopes that originate from desugaring.
Some scopes are introduced by the parser for desugaring and do not
have any positions associated. The debugger should not make them
visible.

Also add some missing source positions.

R=kozyatinskiy@chromium.org, rossberg@chromium.org
BUG=chromium:604458
LOG=Y

Review URL: https://codereview.chromium.org/1901413002

Cr-Commit-Position: refs/heads/master@{#35721}
2016-04-22 10:48:45 +00:00
rmcilroy
c58f328581 [Interpreter] Introduce IncStub and DecStub.
Adds IncStub and DecStub TurboFan code stubs and hooks them up to the
interpreter's Inc and Dec bytecodes (which are used for count
operations, e.g. i++).

BUG=v8:4280
LOG=N

Review URL: https://codereview.chromium.org/1901083002

Cr-Commit-Position: refs/heads/master@{#35720}
2016-04-22 10:36:33 +00:00
rmcilroy
11e3ba34f5 [Interpreter] Fix incorrect Register OperandSize calculation for ExtraWide.
Fixes a mistake made in r35618 for register OperandSize calculations.

BUG=605470
LOG=N

Review URL: https://codereview.chromium.org/1908033002

Cr-Commit-Position: refs/heads/master@{#35719}
2016-04-22 10:32:14 +00:00
neis
b090715250 Introduce bytecodes for assisting generator suspend and resume.
The new bytecodes replace two runtime functions. They are still unsupported by the bytecode graphbuilder, though.

BUG=v8:4907
LOG=n

Review URL: https://codereview.chromium.org/1904933002

Cr-Commit-Position: refs/heads/master@{#35716}
2016-04-22 09:19:00 +00:00
jkummerow
f4a9a50147 [tests] Add testcase for r35397
This is a follow-up to 58429beb7b
"Fix KeyedStore stub selection for STRING_WRAPPER_ELEMENTS".

BUG=chromium:602184
LOG=n

Review URL: https://codereview.chromium.org/1912443004

Cr-Commit-Position: refs/heads/master@{#35715}
2016-04-22 09:08:46 +00:00
adamk
6a370a6f01 Remove support for Object.observe
The feature was deprecated in M49 and flagged off in M50.
This patch removes it entirely from the codebase.

Review URL: https://codereview.chromium.org/1909433003

Cr-Commit-Position: refs/heads/master@{#35714}
2016-04-22 09:02:41 +00:00
bmeurer
861295bf16 [turbofan] Optimize tagged conversion based on type.
If we have to convert a float64 value to tagged representation and we
already know that the value is either in Signed31/Signed32 or
Unsigned32 range, then we can just convert the float64 to word32 and
use the fast word32 to tagged conversion. Doing this in
ChangeLowering (or the effect linearization pass) would be unsound, as
the types on the nodes are no longer usable.

This removes all Type uses from effect linearization. There's still some
work to be done for ChangeLowering tho.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1908093002

Cr-Commit-Position: refs/heads/master@{#35713}
2016-04-22 08:40:05 +00:00
mstarzinger
82a7c53e97 [interpreter] Enable webkit test that no longer fails.
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1908503003

Cr-Commit-Position: refs/heads/master@{#35710}
2016-04-21 16:35:20 +00:00
jkummerow
9bebebd909 [ic] Restore PROPERTY key tracking in keyed ICs
Non-vectorized KeyedLoadICs used to remember whether they had seen Names
as keys; Crankshaft uses this information to avoid emitting elements
accesses which would always deopt. This CL restores that functionality
for vector ICs.

BUG=chromium:594183
LOG=y
R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1912593002

Cr-Commit-Position: refs/heads/master@{#35706}
2016-04-21 13:18:28 +00:00
yangguo
ff2a04bbb9 [debugger] fix mjsunit/es6/debug-promises/stepin-constructor.js for ignition.
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1907973002

Cr-Commit-Position: refs/heads/master@{#35704}
2016-04-21 13:16:04 +00:00
yangguo
4d824551c7 [debugger] fix mjsunit/debug-allscopes-on-debugger.js for ignition.
R=vogelheim@chromium.org
BUG=v8:4690
LOG=N

Review URL: https://codereview.chromium.org/1910813002

Cr-Commit-Position: refs/heads/master@{#35701}
2016-04-21 11:30:44 +00:00
verwaest
7dfb5beeec Fix 'typeof null' canonicalization in crankshaft
BUG=

Review URL: https://codereview.chromium.org/1912553002

Cr-Commit-Position: refs/heads/master@{#35699}
2016-04-21 11:24:31 +00:00