Commit Graph

6536 Commits

Author SHA1 Message Date
bmeurer
a639f7df04 [test] Remove useless test code.
That ADD builtin is gone for a long time.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2547423002
Cr-Commit-Position: refs/heads/master@{#41473}
2016-12-05 07:01:59 +00:00
gdeepti
6454102c5b [wasm] Fix WasmInstanceWrapper allocation.
In the current implementation, WasmInstanceWrapper is allocated after the imports for the instance are processed, and before the InstanceFinalizer callback is associated with the instance. This raises the possibility of triggering a gc in the middle of the instantiate flow which is incorrect.

BUG=5707

R=titzer@chromium.org, petermarshall@chromium.org

Review-Url: https://codereview.chromium.org/2544273002
Cr-Commit-Position: refs/heads/master@{#41464}
2016-12-03 01:29:49 +00:00
enne
0ea4a54220 Revert of [typedarrays] remove invalid optimization in NAMEConstructor() (patchset #1 id:1 of https://codereview.chromium.org/2544503002/ )
Reason for revert:
Speculative revert for causing timeouts on Win Debug gpu fyi bot

Nothing else looks even remotely relevant in the list of changes.
Will reland if this doesn't fix the issues.

BUG=670396

Original issue's description:
> [typedarrays] remove invalid optimization in NAMEConstructor()
>
> Before, we were treating objects with the builtin ArrayValues iterator
> method as array-like, where the iterator would iterate through to the
> full length of the object.
>
> This optimization was not sound, because it does not ensure that the
> next method hasn't been modified. Even if it hasn't been modified,
> it's entirely possible to be modified during iteration. Thus, this
> optimization has been removed due to its observability.
>
> BUG=v8:5699
> R=littledan@chromium.org, cbruni@chromium.org
>
> Committed: https://crrev.com/77df8c67d9609ada3b7d79e8e6d33f198bbad5a1
> Cr-Commit-Position: refs/heads/master@{#41394}

TBR=cbruni@chromium.org,littledan@chromium.org,caitp@igalia.com
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=v8:5699

Review-Url: https://codereview.chromium.org/2548583003
Cr-Commit-Position: refs/heads/master@{#41461}
2016-12-02 18:48:35 +00:00
ishell
e7a51fff24 [ic] Ensure state of load/store ICs always progresses.
... even when a receiver is not an object.

BUG=v8:5697

Review-Url: https://codereview.chromium.org/2548753003
Cr-Commit-Position: refs/heads/master@{#41458}
2016-12-02 15:07:31 +00:00
bmeurer
6e2bb99738 [test] Skip regress/regress-2185-2 with msan.
TBR=machenbach@chromium.org
BUG=v8:5666

Review-Url: https://codereview.chromium.org/2542843008
Cr-Commit-Position: refs/heads/master@{#41457}
2016-12-02 14:30:38 +00:00
titzer
e454742d7c [wasm] Avoid using const that triggers ignition and flakes on ARM.
R=machenbach@chromium.org,jarin@chromium.org
BUG=v8:5710

Review-Url: https://codereview.chromium.org/2551433002
Cr-Commit-Position: refs/heads/master@{#41454}
2016-12-02 13:54:43 +00:00
mstarzinger
651c1b86a2 [compiler] Make --debug-code the default in debug builds.
This enables {FLAG_debug_code} by default in debug builds. The advantage
is that generated code contained within the snapshot will contain such
debug code. Before we would only get coverage for these pieces with the
no-snapshot builds, which have a meager coverage. One can still pass the
inverse --no-debug-code flag to ensure generated code remains readable
within debug builds as well.

R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2528913002
Cr-Commit-Position: refs/heads/master@{#41451}
2016-12-02 11:36:55 +00:00
ishell
39e6f2ca4a [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, chromium:669411, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
Review-Url: https://codereview.chromium.org/2534613002
Cr-Original-Commit-Position: refs/heads/master@{#41332}
Cr-Commit-Position: refs/heads/master@{#41449}
2016-12-02 10:03:33 +00:00
mstarzinger
f8fec66f0b [turbofan] Workaround for unknown array literal length.
This fixes the existing workaround in {BytecodeGraphBuilder} where the
number of elements in an array literal is unknown just from the bytecode
alone and needs to be deduced from the constant elements.

Note that this is just a quick fix to prevent calling the fast-clone
stub for boilerplates that are too big to fit on a regular page. In the
long run we need something more solid here.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-669850
BUG=chromium:669850

Review-Url: https://codereview.chromium.org/2542633002
Cr-Commit-Position: refs/heads/master@{#41420}
2016-12-01 12:01:00 +00:00
bradnelson
71cc94dae3 [wasm][asm.js] Allow a function to be exported more than once.
Allow a function to be exported multiple times in a asm.js
module.
Remarkably, this had not been working before.

BUG=670057
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2535723009
Cr-Commit-Position: refs/heads/master@{#41416}
2016-12-01 10:13:01 +00:00
jgruber
2c3fe6d961 [regexp] Migrate @@split to TurboFan
This shows around a 2.2x speedup compared to the old JS implementation (and
3.5x compared to CPP) for the fast path.

Adds ToUint32 to CodeStubAssembler.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2532403002
Cr-Commit-Position: refs/heads/master@{#41408}
2016-12-01 08:25:20 +00:00
bradnelson
00ec48335e [wasm] [asm.js] Ignore unused function tables in AsmWasmBuilder.
Incremental parsing of asm.js means we can see function tables that
are unused in the AsmWasmBuilder before they've been initialized.

BUG=669899
R=aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2546553002
Cr-Commit-Position: refs/heads/master@{#41403}
2016-12-01 02:27:30 +00:00
caitp
d4918463a9 [accessors] handle writable changing during ArrayLengthSetter
The "writable" property descriptor may legally change during the call to
AnythingToArrayLength(). This change needs to be honoured before calling
JSArray::SetLength(). The change is only honoured when the "length"
property was previously writable, so that changes during a call to
DefineOwnPropertyIgnoreAttributes() is ignored.

BUG=v8:5688
R=cbruni@chromium.org, verwaest@chromium.org, jkummerow@chromium.org

Review-Url: https://codereview.chromium.org/2543553002
Cr-Commit-Position: refs/heads/master@{#41396}
2016-11-30 19:13:51 +00:00
caitp
77df8c67d9 [typedarrays] remove invalid optimization in NAMEConstructor()
Before, we were treating objects with the builtin ArrayValues iterator
method as array-like, where the iterator would iterate through to the
full length of the object.

This optimization was not sound, because it does not ensure that the
next method hasn't been modified. Even if it hasn't been modified,
it's entirely possible to be modified during iteration. Thus, this
optimization has been removed due to its observability.

BUG=v8:5699
R=littledan@chromium.org, cbruni@chromium.org

Review-Url: https://codereview.chromium.org/2544503002
Cr-Commit-Position: refs/heads/master@{#41394}
2016-11-30 17:13:31 +00:00
jarin
e19f43df61 [crankshaft] Disable escape analysis of nested objects.
BUG=chromium:669024

Review-Url: https://codereview.chromium.org/2531163006
Cr-Commit-Position: refs/heads/master@{#41389}
2016-11-30 15:07:16 +00:00
rmcilroy
6d90507a7c [Turbofan] Disable JSFrameSpecialization for interpreted frames.
JSFrameSpecialization depends on the layout of the frame and doesn't work
with interpreted frames. Disable it since it is only used for OSR from asmjs code, which shouldn't go through the bytecode graph builder in many cases.

BUG=669517

Review-Url: https://codereview.chromium.org/2538823002
Cr-Commit-Position: refs/heads/master@{#41387}
2016-11-30 14:03:51 +00:00
rmcilroy
8037e98e44 [Interpreter] Remove skips for tests that no longer seem to be flaky.
BUG=v8:4680

Review-Url: https://codereview.chromium.org/2541563002
Cr-Commit-Position: refs/heads/master@{#41378}
2016-11-30 09:21:37 +00:00
bradnelson
14e05c1046 [wasm] asm.js - Parse and convert asm.js to wasm a function at a time.
Make the AsmWasmBuilder drive the process of typing and potentially parsing
function bodies. This will allow us to keep only a single asm.js function's
AST in memory as we convert to WebAssembly.
This is needed to keep our memory footprint low.

Add some additional output to a few tests that's helpful to see which stage they fail at.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
LOG=N
R=marja@chromium.org,adamk@chromium.org,aseemgarg@chromium.org,titzer@chromium.org

Review-Url: https://codereview.chromium.org/2398023002
Cr-Commit-Position: refs/heads/master@{#41372}
2016-11-30 00:26:05 +00:00
danno
df2578d2ec [stubs] Port builtin for Array.push fast-case from Crankshaft to TF
Improves performance in simple, single element case by 5% and in multiple
elements cases by 2%.

BUG=chromium:608675
LOG=N

Review-Url: https://codereview.chromium.org/2497243002
Cr-Commit-Position: refs/heads/master@{#41368}
2016-11-29 16:58:30 +00:00
vogelheim
b1b7d19610 Cleanup: Move mjsunit/regress-*.js into mjsunit/regress/.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2531983004
Cr-Commit-Position: refs/heads/master@{#41362}
2016-11-29 14:20:53 +00:00
bmeurer
d6752d94a8 [turbofan] Teach escape analysis about ConvertTaggedHoleToUndefined.
The EscapeStatusAnalysis didn't know anything about the simplified
operator ConvertTaggedHoleToUndefined, thus leading to a crash. We
now just handled it by pretending that any allocation that goes into
such a node escapes.

BUG=chromium:669451
R=tebbi@chromium.org

Review-Url: https://codereview.chromium.org/2533263002
Cr-Commit-Position: refs/heads/master@{#41359}
2016-11-29 13:13:55 +00:00
leszeks
2bf71f888f [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41355}
2016-11-29 12:27:15 +00:00
verwaest
73a2d63df8 [scopes] Propagate inner-scope-calls-eval to make sure we context allocate in inserted scopes
BUG=v8:5664

Review-Url: https://codereview.chromium.org/2536153002
Cr-Commit-Position: refs/heads/master@{#41353}
2016-11-29 12:01:34 +00:00
bmeurer
719d6c1d58 [turbofan] Also optimize instanceof with bound functions.
For bound functions on the right-hand side of instanceof we can
constant-fold to the actual [[BoundTargetFunction]], actually
instance OrdinaryHasInstance. Move the Function.prototype[@@hasInstance]
reduction up to the JSCallReducer to allow this optimization to become
effective (and also enable other optimizations).

BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2537763002
Cr-Commit-Position: refs/heads/master@{#41352}
2016-11-29 11:58:55 +00:00
mstarzinger
204babf5a0 [deoptimizer] Fix deoptimization in {TranslatedState}.
This ensures the deoptimization triggered due to materialization of
objects by the {TranslatedState} works in conjunction with OSR. The
optimized code used for OSR is not installed on the function, hence
needs to be specified explicitly when requesting deoptimization for
specific stack frames.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-668795
BUG=chromium:668795

Review-Url: https://codereview.chromium.org/2534143002
Cr-Commit-Position: refs/heads/master@{#41348}
2016-11-29 11:34:22 +00:00
leszeks
a2e2a39ff1 Revert of [ignition/turbo] Perform liveness analysis on the bytecodes (patchset #17 id:320001 of https://codereview.chromium.org/2523893003/ )
Reason for revert:
Breaks the build:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20shared/builds/14886

Original issue's description:
> [ignition/turbo] Perform liveness analysis on the bytecodes
>
> Replaces the graph-based liveness analyzer in the bytecode graph builder
> with an initial bytecode-based liveness analysis pass, which is added to
> the existing loop extent analysis.
>
> Now the StateValues in the graph have their inputs initialised to
> optimized_out, rather than being modified after the graph is built.
>
> Committed: https://crrev.com/1852300954c216c29cf93444430681d213e87925
> Cr-Commit-Position: refs/heads/master@{#41344}

TBR=jarin@chromium.org,rmcilroy@chromium.org,yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2541443002
Cr-Commit-Position: refs/heads/master@{#41346}
2016-11-29 10:51:45 +00:00
bmeurer
777e142ca1 [turbofan] Add appropriate types to express Callable.
This introduces three new types OtherCallable, CallableProxy (and OtherProxy),
and BoundFunction to make it possible to express Callable in the Type system.
It also forces all undetectable receivers to be Callable, which matches the
use case for undetectable, namely document.all (guarded by proper checks and
tests).

It also uses these new types to properly optimize instanceof (indirectly via
OrdinaryHasInstance) based on the type of the constructor and the object. So
we are able to constant-fold certain instanceof expressions based on types
and completely avoid the builtin call.

R=jarin@chromium.org
BUG=v8:5267

Review-Url: https://codereview.chromium.org/2535753004
Cr-Commit-Position: refs/heads/master@{#41345}
2016-11-29 10:48:13 +00:00
leszeks
1852300954 [ignition/turbo] Perform liveness analysis on the bytecodes
Replaces the graph-based liveness analyzer in the bytecode graph builder
with an initial bytecode-based liveness analysis pass, which is added to
the existing loop extent analysis.

Now the StateValues in the graph have their inputs initialised to
optimized_out, rather than being modified after the graph is built.

Review-Url: https://codereview.chromium.org/2523893003
Cr-Commit-Position: refs/heads/master@{#41344}
2016-11-29 10:46:20 +00:00
ahaas
68f89a07c0 [wasm] Skip mjsunit/wasm/import-memory on gc-stress
BUG=v8:5683
NOTRY=true
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2541433002
Cr-Commit-Position: refs/heads/master@{#41340}
2016-11-29 09:24:15 +00:00
machenbach
9c0e2a6723 Revert of [ic] Use validity cells to protect keyed element stores against object's prototype chain modificati… (patchset #2 id:40001 of https://codereview.chromium.org/2534613002/ )
Reason for revert:
Layout test crashes:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/11691

Original issue's description:
> [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
>
> ... instead of clearing of all the KeyedStoreICs which didn't always work.
>
> BUG=chromium:662907, v8:5561
> TBR=verwaest@chromium.org, bmeurer@chromium.org
>
> Committed: https://crrev.com/a39522f44f7e0be4686831688917e9675255dcaf
> Cr-Commit-Position: refs/heads/master@{#41332}

TBR=jkummerow@chromium.org,ishell@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:662907, v8:5561

Review-Url: https://codereview.chromium.org/2538693002
Cr-Commit-Position: refs/heads/master@{#41337}
2016-11-29 08:49:48 +00:00
henrique.ferreiro
bc1a3820c2 Implement DefineOwnProperty for TypedArrays
TypedArrays need specific checks before calling OrdinaryDefineOwnProperty.

BUG=v8:5328

Review-Url: https://codereview.chromium.org/2431223005
Cr-Commit-Position: refs/heads/master@{#41333}
2016-11-29 00:07:58 +00:00
ishell
a39522f44f [ic] Use validity cells to protect keyed element stores against object's prototype chain modifications.
... instead of clearing of all the KeyedStoreICs which didn't always work.

BUG=chromium:662907, v8:5561
TBR=verwaest@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2534613002
Cr-Commit-Position: refs/heads/master@{#41332}
2016-11-28 22:56:52 +00:00
ishell
a814b8aeaf [heap] Clear recorded slots for inobject properties when migrating fast object to slow mode.
BUG=chromium:666046

Review-Url: https://codereview.chromium.org/2539493002
Cr-Commit-Position: refs/heads/master@{#41327}
2016-11-28 20:11:30 +00:00
zhengxing.li
0c6b6138bf X87: [test] disable number-tostring test case for x87.
The reason:
  The CL #41255 (https://codereview.chromium.org/2520363002 ) reimplemnt the Number.prototype.toString and the added number-tostring test cases failed at x87.

  Similar to many previos fixing CLs, i.e.: CL #37371 (https://codereview.chromium.org/2111493002 ), the root reason is:
  The Gcc compiler and it's dependent C++ libraris on linux platform use x87 in extended 80-bit double precision by default.
  So the reimplemented DoubleToRadixCString() will generate extended 80-bit double precision result which isn't the expected standard 64-bit double precision
  value.

  Although modifying DoubleToRadixCString() function to manually do the 80-bit <--> 64-bit conversion for each double/float computation step can fix this issue,
  but it wll drop the DoubleToRadixCString() function's performance of other architectures.

  This CL put the failed number-tostring test cases into number-tostring-big-integer.js and disables it for x87.

BUG=

Review-Url: https://codereview.chromium.org/2532073002
Cr-Commit-Position: refs/heads/master@{#41322}
2016-11-28 15:31:20 +00:00
vogelheim
e0d608a2b1 Fix 'combo breaker' in CreateDynamicFunction to handle template literals.
BUG=chromium:663410

Review-Url: https://codereview.chromium.org/2533463002
Cr-Commit-Position: refs/heads/master@{#41320}
2016-11-28 14:44:13 +00:00
jarin
72b5a0d40e [deoptimizer] Use the correct function for handler lookup for bytecode.
BUG=chromium:668760

Review-Url: https://codereview.chromium.org/2530403002
Cr-Commit-Position: refs/heads/master@{#41314}
2016-11-28 12:45:29 +00:00
yangguo
ee84d9f7f9 [debug] remove debug command processor from regress tests.
BUG=v8:5510
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2535733002
Cr-Commit-Position: refs/heads/master@{#41312}
2016-11-28 12:02:44 +00:00
yangguo
0398e5d5e4 [debug] remove debug command processor from scope tests.
BUG=v8:5510
R=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2536573002
Cr-Commit-Position: refs/heads/master@{#41311}
2016-11-28 12:01:44 +00:00
yangguo
e1470db7a3 [debug] remove debug command processor from debug evaluate tests.
R=jgruber@chromium.org
BUG=v8:5510

Review-Url: https://codereview.chromium.org/2532893002
Cr-Commit-Position: refs/heads/master@{#41308}
2016-11-28 11:38:15 +00:00
ahaas
5d5ccb6e45 [mjsunit] Change assertThrows such that it can check the exception message.
Up until now assertThrows allows to check the type field of an
exception, which is, however, a custom field introduced in a single
regression test. With the change assertThrows allows to check the
message field of an exception, which is set for standard V8 exceptions
by default.

I use the new assertThrows to refactor test/mjsunit/wasm/divrem-trap.js

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2525313003
Cr-Commit-Position: refs/heads/master@{#41302}
2016-11-28 10:26:44 +00:00
cbruni
a09e5eda26 [runtime] Add missing @@IsConcatSpreadable check for FAST_DOUBLE_ELEMENTS
A missing @@IsConcatSpreadable check caused the fast path inside the slow path
to be incorrect and follow the default concat strategy when the arguments
arrays contain only doubles.

BUG=chromium:668414

Review-Url: https://codereview.chromium.org/2527173002
Cr-Commit-Position: refs/heads/master@{#41301}
2016-11-28 10:06:17 +00:00
yangguo
b6d2bacd66 Fix Number.prototype.toString with non-default radix wrt modulo.
TBR=tebbi@chromium.org
BUG=chromium:668510

Review-Url: https://codereview.chromium.org/2526223003
Cr-Commit-Position: refs/heads/master@{#41280}
2016-11-25 07:46:40 +00:00
jkummerow
9be747666c Reland^2 of [stubs] KeyedStoreGeneric: inline dictionary property stores
For dictionary-mode receivers, the KeyedStoreGeneric stub can store
properties directly in most cases. Doing so avoids the need to have
an entry in the stub cache for every map/property combination.

Original review: https://codereview.chromium.org/2504403005/

Review-Url: https://codereview.chromium.org/2528883003
Cr-Commit-Position: refs/heads/master@{#41272}
2016-11-24 16:23:12 +00:00
neis
cde9f7bfed [modules] Propagate module status when creating ParseInfo from SFI.
In the ParseInfo constructor that takes a SharedFunctionInfo, we must
set the module flag when the function represents a module.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2525013002
Cr-Commit-Position: refs/heads/master@{#41257}
2016-11-24 10:49:03 +00:00
yangguo
21b0dbedfd Reimplement Number.prototype.toString with non-default radix.
The old algorithm produces unnecessary decimal digits. The new one
converts the significand of the input double into an uint64_t to be
just as precise as necessary.

R=tebbi@chromium.org
BUG=chromium:658712,chromium:666376

Review-Url: https://codereview.chromium.org/2520363002
Cr-Commit-Position: refs/heads/master@{#41255}
2016-11-24 10:30:46 +00:00
neis
b481afd893 [parser] Fix scopes in rewriting of for-of and destructuring assignments.
The catch scopes were created with the wrong parent scope.

R=littledan@chromium.org
BUG=v8:5648

Committed: https://crrev.com/f385268d11d6da9508e481202b39f75f4b56afdd
Review-Url: https://codereview.chromium.org/2520883002
Cr-Original-Commit-Position: refs/heads/master@{#41222}
Cr-Commit-Position: refs/heads/master@{#41253}
2016-11-24 09:48:21 +00:00
hablich
474bbec73d Revert of [stubs] KeyedStoreGeneric: inline dictionary property stores (patchset #2 id:10002 of https://codereview.chromium.org/2524943002/ )
Reason for revert:
Blocks current roll:
https://codereview.chromium.org/2526753003/

Bisect results:
https://codereview.chromium.org/2531483002

Original issue's description:
> Reland of [stubs] KeyedStoreGeneric: inline dictionary property stores
>
> For dictionary-mode receivers, the KeyedStoreGeneric stub can store
> properties directly in most cases. Doing so avoids the need to have
> an entry in the stub cache for every map/property combination.
>
> Original review: https://codereview.chromium.org/2504403005/
>
> Committed: https://crrev.com/7a963deb85a0cc04623947a759534c48e2871901
> Cr-Commit-Position: refs/heads/master@{#41218}

TBR=ishell@chromium.org,machenbach@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2522393002
Cr-Commit-Position: refs/heads/master@{#41251}
2016-11-24 08:43:22 +00:00
hablich
e461facff2 Revert of [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric (patchset #1 id:1 of https://codereview.chromium.org/2525913002/ )
Reason for revert:
Needed to revert 2661b3e8a5

Original issue's description:
> [stubs] Fix AccessorInfo mixup in KeyedStoreGeneric
>
> BUG=chromium:668101
>
> Committed: https://crrev.com/2661b3e8a5447773a23a219ba085454c459b654b
> Cr-Commit-Position: refs/heads/master@{#41223}

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:668101

Review-Url: https://codereview.chromium.org/2525253002
Cr-Commit-Position: refs/heads/master@{#41250}
2016-11-24 08:41:29 +00:00
bmeurer
76fd6f25a9 [turbofan] Remove inlining support for the deprecated pipeline.
The deprecated pipeline is used for asm.js only, where we forcibly
disable inlining anyways (for performance reasons), so inlining via
the AstGraphBuilder is essentially dead code by now, thus there's no
point in trying to keep that around in the code base.

Also nuke the test-run-inlining.cc file, which would require some heavy
surgery (for probably little benefit), and move the useful tests for
mjsunit tests instead.

BUG=v8:2206,v8:5657
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2527053002
Cr-Commit-Position: refs/heads/master@{#41245}
2016-11-24 07:59:59 +00:00
gdeepti
e108f90d5c [wasm] WebAssembly.Memory object can be referenced by multiple Instance objects.
Add support for WebAssembly.Memory objects to be simultaneously referenced by multiple Instance objects. GrowingMemory should maintain a consistent view of memory across instances.
 - Store a link to instances that share WebAssembly.Memory in the WasmMemoryObject, updated on instantiate.
 - Implement WasmInstanceWrapper as a wrapper around the instance object to keep track of previous/next instances, instance object is stored as a WeakCell that can be garbage collected.
 - MemoryInstanceFinalizer maintains a valid list of instances when an instance is garbage collected.
 - Refactor GrowInstanceMemory to GrowMemoryBuffer that allocates a new buffer, and UncheckedUpdateInstanceMemory that updates memory references for an instance.

 R=titzer@chromium.org, mtrofin@chromium.org, bradnelson@chromium.org

Committed: https://crrev.com/30ef8e33f3a199a27ca8512bcee314c9522d03f6
Committed: https://crrev.com/3c98e339599b068f1ed630afb7601ff942424d31
Review-Url: https://codereview.chromium.org/2471883003
Cr-Original-Original-Commit-Position: refs/heads/master@{#41121}
Cr-Original-Commit-Position: refs/heads/master@{#41198}
Cr-Commit-Position: refs/heads/master@{#41234}
2016-11-23 20:44:29 +00:00