Commit Graph

41594 Commits

Author SHA1 Message Date
Deepti Gandluri
ac774a36a7 [wasm] Implement atomic add/sub operations.
- Decode logic for atomic operations
 - Implementations for I32AtomicAdd, I32AtomicAdd8U, I32AtomicAdd16U,
I32AtomicSub, I32AtomicSub8U, I32AtomicSub16U
 - cctest value helpers for Uint16/Uint8 types

R=binji@chromium.org, bbudge@chromium.org, bradnelson@chromium.org

BUG=v8:6532

Change-Id: I710ee8ef566c5e33866afdf5b47375c2ea6fdbe6
Reviewed-on: https://chromium-review.googlesource.com/595241
Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47102}
2017-08-02 22:59:18 +00:00
Ulan Degenbaev
5a506a9a97 Disable mjsunit/wasm/js-api on GC stress bots.
Bug: chromium:751825
No-Tree-Checks: true
Change-Id: I8e9e5c030dca001a8dc881d8fdeefa5c140f3792
Reviewed-on: https://chromium-review.googlesource.com/599047
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47101}
2017-08-02 22:57:24 +00:00
Karl Schimpf
ad49b7b433 Reland "Start migration of try/throw/catch to match proposal."
This is a reland of 470a10015d
Original change's description:
> Start migration of try/throw/catch to match proposal.
> 
> This CL does the first baby steps on moving the current (experimental)
> exception handling to match that of the WebAssembly proposal.
> 
> It does the following:
> 
> 1) Use exception tags instead of integers.
> 
> 2) Only handle empty exception signatures (i.e. no values associated
>    with the exception tag.
> 
> 3) Only handle one catch clause.
> 
> 4) Be sure to rethrow the exception if the exception tag does not match.
> 
> Note: There are many things that need to be fixed, and are too
> numerous to list here. However, the code should have TODO's on each
> missing parts of the implementation.
> 
> Also note that the code currently doesn't handle nested catch blocks,
> nor does it change the throw value being an integer. Rather, the
> integer value is still being thrown, and currently is the exception
> tag. Therefore, we don't build an exception object. This is the reason
> why this CL doesn't handle exceptions that pass values.
> 
> Also, the current implementation still can't handle multiple modules
> because tag resolution (between) modules has not be implemented yet.
> 
> Bug: v8:6577
> Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
> Reviewed-on: https://chromium-review.googlesource.com/591910
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47087}

Bug: v8:6577
Change-Id: I41c3309827c292cb787681a95aaef7cf9b931835
Reviewed-on: https://chromium-review.googlesource.com/598968
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47100}
2017-08-02 22:35:07 +00:00
Jeremy Roman
19fee8b24b Expose v8::TypedArray::kMaxLength.
There is an API check failure if values larger than i::Smi::kMaxValue are
provided, but it is inconvenient for API users to know what this value is
(and SIZE_MAX and INT_MAX are both incorrect).

This is analogous to v8::String::kMaxLength.

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Bug: chromium:750788
Change-Id: Ic3e0da62aeacfeb996122595232aa0ea8744517e
Reviewed-on: https://chromium-review.googlesource.com/594677
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jeremy Roman <jbroman@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47099}
2017-08-02 22:15:57 +00:00
Adam Klein
74edfccd45 Enable --harmony-strict-legacy-accessor-builtins by default
This behavior has been staged successfully without a bug report, and
has been shipped in the latest versions of Firefox and Safari.

Bug: v8:5070
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I084cae2cc303d6a213bd6789297b91656e162d6b
Reviewed-on: https://chromium-review.googlesource.com/595129
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47098}
2017-08-02 21:30:57 +00:00
Alexey Kozyatinskiy
a75517387d [inspector] set last evaluation result on Runtime.evaluate with awaitPromise
If objectGroup is console we should correctly save last evaluated result to expose for next console call in $_ variable.

R=dgozman@chromium.org

Bug: none
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ie0ba2d302606b1c9f096a9a3a107a51a80556c49
Reviewed-on: https://chromium-review.googlesource.com/598936
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47097}
2017-08-02 21:12:42 +00:00
Junliang Yan
6aea7374b7 PPC/s390: fix AssembleTailCallGap cctest.
both arches don't support push anything to stack except registers

R=joransiu@ca.ibm.com, bjaideep@ca.ibm.com

Bug: 
Change-Id: I5682fc1634bc66c8aa28889abe5b977092b004f6
Reviewed-on: https://chromium-review.googlesource.com/598644
Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47096}
2017-08-02 21:02:45 +00:00
Jaideep Bajwa
fb64e4d605 S390: Support circular references between generated builtins.
Port 266be35b3b

    Minor fix to the original CL.

R=yangguo@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I10a4d64aa010118b669374e604fe8ed0104ec77f
Reviewed-on: https://chromium-review.googlesource.com/598808
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47095}
2017-08-02 20:39:19 +00:00
Ulan Degenbaev
74b1cbbd86 Revert "[heap] Add support for atomic access to page flags."
This reverts commit 35c923cc10.

Reason for revert: speculative revert for GC stress failure

Original change's description:
> [heap] Add support for atomic access to page flags.
> 
> This patch renames AsAtomicWord to AsAtomicPointer and
> adds new AsAtomicWord that works with intptr_t.
> 
> Slot recording uses atomic page flag accessors.
> 
> BUG=chromium:694255
> 
> Change-Id: I1c692813244b41320182e9eea50462d1802fcd98
> Reviewed-on: https://chromium-review.googlesource.com/597688
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47086}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Id77ce7970c54a55646c072787e88311f6f3e6e91
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/598967
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47094}
2017-08-02 20:07:08 +00:00
Michael Achenbach
caa513be47 Revert "Start migration of try/throw/catch to match proposal."
This reverts commit 470a10015d.

Reason for revert: Speculative:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/14520
Also flaked later:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/11953

Original change's description:
> Start migration of try/throw/catch to match proposal.
> 
> This CL does the first baby steps on moving the current (experimental)
> exception handling to match that of the WebAssembly proposal.
> 
> It does the following:
> 
> 1) Use exception tags instead of integers.
> 
> 2) Only handle empty exception signatures (i.e. no values associated
>    with the exception tag.
> 
> 3) Only handle one catch clause.
> 
> 4) Be sure to rethrow the exception if the exception tag does not match.
> 
> Note: There are many things that need to be fixed, and are too
> numerous to list here. However, the code should have TODO's on each
> missing parts of the implementation.
> 
> Also note that the code currently doesn't handle nested catch blocks,
> nor does it change the throw value being an integer. Rather, the
> integer value is still being thrown, and currently is the exception
> tag. Therefore, we don't build an exception object. This is the reason
> why this CL doesn't handle exceptions that pass values.
> 
> Also, the current implementation still can't handle multiple modules
> because tag resolution (between) modules has not be implemented yet.
> 
> Bug: v8:6577
> Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
> Reviewed-on: https://chromium-review.googlesource.com/591910
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47087}

TBR=bradnelson@chromium.org,eholk@chromium.org,kschimpf@chromium.org

Change-Id: I91709105fb066c08b43766b0bc76db8a3af5c9d9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6577
Reviewed-on: https://chromium-review.googlesource.com/598947
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47093}
2017-08-02 19:58:39 +00:00
Jaideep Bajwa
57a78181ad PPC/s390: Replacing pc with trampoline on stack (gc-stress fix)
Port 895c321948

Original Commit Message:

    Replacing pc with trampoline on stack
    This CL is the follow up of https://chromium-review.googlesource.com/c/586707/
    which used to crash when running the gc-stress bots.
    It seems to be working now. We now keep the trampoline PC in the Safepoint
    table and use that information to find SafepointEntries.

    There's some refactoring that can be done, such as changing the code for
    exceptions in a similar way and removing the trampoline from the
    DeoptimizationInputData. Will take care of this in the next CL.

R=jupvfranco@google.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I9871d110dcf7e390cf5fb2819ae1fa159c58ae84
Reviewed-on: https://chromium-review.googlesource.com/598768
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47092}
2017-08-02 19:21:31 +00:00
Alexey Kozyatinskiy
cd9e86a59e [inspector] move breakpoint management to native
My goal was to move breakpoint API to native with minimal changes around, so on inspector side we use v8::debug::BreakpointId instead of String16, on v8::internal::Debug we use i::BreakPoint object instead of break point object created inside of debug.js.

There are a lot of opportunities how we can improve breakpoints (at least we can avoid some of linear lookups to speedup implementation) but I think that as first step we need to remove mirrors/debug.js APIs.

Drive by: debugger-script.js and usage of debugger context in inspector code base.

R=yangguo@chromium.org,jgruber@chromium.org,clemensh@chromium.org

Bug: v8:5510,chromium:652939
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I0b17972c39053dd4989bbe26db2bb0b88ca378f7
Reviewed-on: https://chromium-review.googlesource.com/593156
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47091}
2017-08-02 19:20:26 +00:00
Ulan Degenbaev
41daf8a579 Revert "Start migration of try/throw/catch to match proposal."
This reverts commit 470a10015d.

Reason for revert: GC stress bot failures.
https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Mac%20GC%20Stress/builds/14522


Original change's description:
> Start migration of try/throw/catch to match proposal.
> 
> This CL does the first baby steps on moving the current (experimental)
> exception handling to match that of the WebAssembly proposal.
> 
> It does the following:
> 
> 1) Use exception tags instead of integers.
> 
> 2) Only handle empty exception signatures (i.e. no values associated
>    with the exception tag.
> 
> 3) Only handle one catch clause.
> 
> 4) Be sure to rethrow the exception if the exception tag does not match.
> 
> Note: There are many things that need to be fixed, and are too
> numerous to list here. However, the code should have TODO's on each
> missing parts of the implementation.
> 
> Also note that the code currently doesn't handle nested catch blocks,
> nor does it change the throw value being an integer. Rather, the
> integer value is still being thrown, and currently is the exception
> tag. Therefore, we don't build an exception object. This is the reason
> why this CL doesn't handle exceptions that pass values.
> 
> Also, the current implementation still can't handle multiple modules
> because tag resolution (between) modules has not be implemented yet.
> 
> Bug: v8:6577
> Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
> Reviewed-on: https://chromium-review.googlesource.com/591910
> Reviewed-by: Brad Nelson <bradnelson@chromium.org>
> Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47087}

TBR=bradnelson@chromium.org,eholk@chromium.org,kschimpf@chromium.org

Change-Id: I01dc8c40cc1057333a988c1d275ce5f457b0cb64
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6577
Reviewed-on: https://chromium-review.googlesource.com/598847
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47090}
2017-08-02 19:19:20 +00:00
Michael Lippautz
652654291c [heap] MC marking: Refactor roots visitation
Use separate visitors for roots visitation:
- A general RootVisitor for all regular roots
- An ObjectVisitor that is able to process contents of the string table
  and code hanging of the top optimized frame

Bug: chromium:750084
Change-Id: I21aaa18760dede8a9419de2890a47c6dcf7efa3b
Reviewed-on: https://chromium-review.googlesource.com/598239
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47089}
2017-08-02 18:10:22 +00:00
Deepti Gandluri
201bcba2c2 [wasm] Memory.grow(0) should return a new ArrayBuffer when the buffer is empty
R=ahaas@chromium.org

BUG=v8:6546

Change-Id: I2808b78cd047d875d4530c86cc079488a78e5ea1
Reviewed-on: https://chromium-review.googlesource.com/557355
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47088}
2017-08-02 18:02:22 +00:00
Karl Schimpf
470a10015d Start migration of try/throw/catch to match proposal.
This CL does the first baby steps on moving the current (experimental)
exception handling to match that of the WebAssembly proposal.

It does the following:

1) Use exception tags instead of integers.

2) Only handle empty exception signatures (i.e. no values associated
   with the exception tag.

3) Only handle one catch clause.

4) Be sure to rethrow the exception if the exception tag does not match.

Note: There are many things that need to be fixed, and are too
numerous to list here. However, the code should have TODO's on each
missing parts of the implementation.

Also note that the code currently doesn't handle nested catch blocks,
nor does it change the throw value being an integer. Rather, the
integer value is still being thrown, and currently is the exception
tag. Therefore, we don't build an exception object. This is the reason
why this CL doesn't handle exceptions that pass values.

Also, the current implementation still can't handle multiple modules
because tag resolution (between) modules has not be implemented yet.

Bug: v8:6577
Change-Id: Id6d08b641b3c42d1eec7d4db582f2dab35406114
Reviewed-on: https://chromium-review.googlesource.com/591910
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47087}
2017-08-02 17:38:42 +00:00
Ulan Degenbaev
35c923cc10 [heap] Add support for atomic access to page flags.
This patch renames AsAtomicWord to AsAtomicPointer and
adds new AsAtomicWord that works with intptr_t.

Slot recording uses atomic page flag accessors.

BUG=chromium:694255

Change-Id: I1c692813244b41320182e9eea50462d1802fcd98
Reviewed-on: https://chromium-review.googlesource.com/597688
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47086}
2017-08-02 17:13:01 +00:00
Michael Lippautz
bca8409a39 Make CancelableTask ids unique
They were only limited to 32 bit when using the internal Hashmap. Since
this has changed alreay some time ago, we can switch to 64 bit ids and
check that we never overflow.

Bug: 
Change-Id: Ia6c6d02d6b5e555c6941185a79427dc4aa2a1d62
Reviewed-on: https://chromium-review.googlesource.com/598229
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47085}
2017-08-02 16:10:42 +00:00
Ulan Degenbaev
b9acf4eded Revert "Reland^2 "[heap] Add mechanism for tracking invalidated slots per memory chunk.""
This reverts commit 0a9d515095.

Reason for revert: another gc-stress failure

Original change's description:
> Reland^2 "[heap] Add mechanism for tracking invalidated slots per memory chunk."
> 
> This reverts commit 6fde541d4c.
> 
> Bug: chromium:694255
> Change-Id: I4670d0de3d2749afbb3bdb8dc5418822a885330c
> Reviewed-on: https://chromium-review.googlesource.com/597850
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47083}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: Iaabf4586e0297dccb1ab4ef180b6f1eea173273b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/598094
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47084}
2017-08-02 15:12:24 +00:00
Ulan Degenbaev
0a9d515095 Reland^2 "[heap] Add mechanism for tracking invalidated slots per memory chunk."
This reverts commit 6fde541d4c.

Bug: chromium:694255
Change-Id: I4670d0de3d2749afbb3bdb8dc5418822a885330c
Reviewed-on: https://chromium-review.googlesource.com/597850
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47083}
2017-08-02 14:29:31 +00:00
Yang Guo
c924a942e9 [snapshot] initialize padding space.
This is to ensure the snapshot is deterministic.


R=mstarzinger@chromium.org

Bug: v8:4886, v8:3645
Change-Id: I79c8e54ba6b4810f005bc1ece61890790c815cea
Reviewed-on: https://chromium-review.googlesource.com/595740
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47082}
2017-08-02 13:36:11 +00:00
jgruber
062bb7d487 [regexp] Limit ATOM regexps to single-character patterns
There's an inherent trade-off when deciding between ATOM and IRREGEXP
regexps: IRREGEXP is faster at runtime for all but trivial single-character
patterns, while ATOM regexps have a lower memory overhead.

This CL is intended to help investigate impact on benchmarks and real-world
code - if something tanks, it's easy to revert, otherwise it can be a first
step towards a possible removal of ATOM regexps.

Bug: v8:6633
Change-Id: Ia41d8eb28d33952735562d3d4127202746a6ac4e
Reviewed-on: https://chromium-review.googlesource.com/589435
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47081}
2017-08-02 12:25:23 +00:00
Leszek Swirski
069c2ac2a1 [sfi] Move bailout reason into compiler hints
By representing "optimization disabled" with a kNoReason bailout reason,
we have enough spare bits to merge the bailout reason field into
compiler hints. This decreases SFI size by one word.

Change-Id: I0169c91dfbfa443128b060a83e483717ed31a166
Reviewed-on: https://chromium-review.googlesource.com/595980
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47080}
2017-08-02 12:21:30 +00:00
jgruber
7ac416caf7 [coverage] Ensure that closing braces of functions are never uncovered
Consider:

function f() {
  return;
}

This CL ensures that the closing brace is considered as covered by
introducing a special case for open-ended range rewrites when the
parent range is the function range itself.

Bug: v8:6000, v8:6661
Change-Id: I0be307759967e9f4df245a4f367326a37dda86fd
Reviewed-on: https://chromium-review.googlesource.com/597651
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47079}
2017-08-02 12:03:39 +00:00
Ulan Degenbaev
6fde541d4c Revert "Reland "[heap] Add mechanism for tracking invalidated slots per memory chunk.""
This reverts commit d4a742fdf1.

Reason for revert: gc-stress failures

Original change's description:
> Reland "[heap] Add mechanism for tracking invalidated slots per memory chunk."
> 
> This reverts commit c59b81d7b8.
> 
> Original change's description:
> > [heap] Add mechanism for tracking invalidated slots per memory chunk.
> 
> > For correct slots recording in concurrent marker, we need to resolve
> > the race that happens when
> > 1) the mutator is invalidating slots for double unboxing or string
> > conversions
> > 2) and the concurrent marker is recording these slots.
> 
> > This patch adds a data-structure for tracking the invalidated objects.
> > Thus we can allow the concurrent marker to record slots without
> > worrying about clearing them. During old-to-old pointer updating phase
> > we re-check all slots that belong to the invalidated objects.
> 
> BUG=chromium:694255
> 
> Change-Id: Idf8927d162377a7bbdff34f81a87e52db27d6a9f
> Reviewed-on: https://chromium-review.googlesource.com/596868
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47068}

TBR=ulan@chromium.org,mlippautz@chromium.org

Change-Id: I81c6059a092cc5834acd799c51fd30dc0ecf5b27
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:694255
Reviewed-on: https://chromium-review.googlesource.com/597787
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47078}
2017-08-02 11:38:20 +00:00
Leszek Swirski
33cac84c73 [objects] Remove unused bailout reasons
Some bailout reasons are never referenced. Removing these allows us to
decrease the size of bailout reason bit-fields to 7 bits.

Change-Id: Ib5e884d224c12313e06493ed05a18a22b3951665
Reviewed-on: https://chromium-review.googlesource.com/596128
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47077}
2017-08-02 11:28:18 +00:00
Leszek Swirski
87a872da07 [tools] Speed-up check-unused-bailouts.sh
Use some less-known grep flags to avoid the for loop in
check-unused-bailouts.sh, speeding it up considerably.

Before:
    $ time tools/check-unused-bailouts.sh >/dev/null

    real	0m14.717s
    user	0m6.968s
    sys	0m7.128s

After:
    $ time tools/check-unused-bailouts.sh >/dev/null

    real	0m0.514s
    user	0m0.480s
    sys	0m0.028s

Change-Id: I2178e2adaf60282865cf18272246a77bcff9d140
Reviewed-on: https://chromium-review.googlesource.com/597690
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47076}
2017-08-02 11:11:19 +00:00
Benedikt Meurer
71012480b7 [runtime] Properly forward the "interesting symbol" bit.
This fixes a corner case of rewriting the transition trees, where the
"interesting symbols" bit was not properly forwarded.

Drive-by-fix: Introduce additional checking in Map::ConnectTransition to
make it easier for clusterfuzz to detect cases we might have missed.

R=mstarzinger@chromium.org

Bug: chromium:751109
Change-Id: I3f1a1e6232db9b3694064b3d4e9f37255b018acc
Reviewed-on: https://chromium-review.googlesource.com/597669
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47075}
2017-08-02 11:08:38 +00:00
Alexandre Talon
47a15c6293 [Turbofan] New DCHECK to ensure no use is mutated when iterating through them
This CL adds a DCHECK to make the uses() function safer: we store what
the next pointer should be to comparing with the next use (from the 
current element in the linked list). This helps detect code which 
invalidates the use-list iterator, which would otherwise cause 
hard-to-debug errors.

Bug: 
Change-Id: I3875361809ffd55fb8be2cbb15af3250e3fd4c12
Reviewed-on: https://chromium-review.googlesource.com/596030
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Alexandre Talon <alexandret@google.com>
Cr-Commit-Position: refs/heads/master@{#47074}
2017-08-02 10:38:07 +00:00
Ilija Pavlovic
d721a9d406 MIPS[64]: Delete unused code from macro assembler
Port for https://chromium-review.googlesource.com/c/571011/

In macro-assembler-mips64.*, function StubPrologue is left
intentionally. (See: https://codereview.chromium.org/2467513002)

TEST=
BUG=

Change-Id: I95de571c636cce88fc2c40e5d8c60162004634a6
Reviewed-on: https://chromium-review.googlesource.com/591127
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#47073}
2017-08-02 09:58:18 +00:00
Julien Brianceau
b41f857b9e Fix common misspellings
Bug: chromium:750830
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Icab7b5a1c469d5e77d04df8bfca8319784e92af4
Reviewed-on: https://chromium-review.googlesource.com/595655
Commit-Queue: Julien Brianceau <jbriance@cisco.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47072}
2017-08-02 09:35:28 +00:00
Georg Neis
31173f92e5 [modules] Make Evaluate deal with errored dependencies.
Apparently it can happen that Blink calls Evaluate on a module that has
errored dependencies.

R=adamk@chromium.org

Bug: v8:1569, chromium:750024
Change-Id: I44b6dde2d5fe5ca25ca2b8c44ede2683d1be944d
Reviewed-on: https://chromium-review.googlesource.com/596055
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47071}
2017-08-02 09:26:08 +00:00
Ulan Degenbaev
3fe1421858 [heap] Add manual GC scope to test-array-buffer-tracker tests.
These tests perform GC manually which does not work well with concurrent
marking and stress incremental marking flags.

BUG=chromium:694255

Change-Id: I43e32957bf37053e0d3af07afa00b8bb40935ebd
Reviewed-on: https://chromium-review.googlesource.com/596887
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47070}
2017-08-02 08:51:56 +00:00
Yang Guo
3b1bfdecbb Fix test failure in interpreted regexp build.
R=mlippautz@chromium.org

Change-Id: Ic8628a2f9648a662447f4a6350f1466fe9ec69f2
Reviewed-on: https://chromium-review.googlesource.com/596969
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47069}
2017-08-02 08:48:02 +00:00
Ulan Degenbaev
d4a742fdf1 Reland "[heap] Add mechanism for tracking invalidated slots per memory chunk."
This reverts commit c59b81d7b8.

Original change's description:
> [heap] Add mechanism for tracking invalidated slots per memory chunk.

> For correct slots recording in concurrent marker, we need to resolve
> the race that happens when
> 1) the mutator is invalidating slots for double unboxing or string
> conversions
> 2) and the concurrent marker is recording these slots.

> This patch adds a data-structure for tracking the invalidated objects.
> Thus we can allow the concurrent marker to record slots without
> worrying about clearing them. During old-to-old pointer updating phase
> we re-check all slots that belong to the invalidated objects.

BUG=chromium:694255

Change-Id: Idf8927d162377a7bbdff34f81a87e52db27d6a9f
Reviewed-on: https://chromium-review.googlesource.com/596868
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47068}
2017-08-02 08:46:56 +00:00
Michael Starzinger
54bee830dd [deoptimizer] Support materialization in frame summary.
This adds support to materialize objects when generating a frame summary
for an optimized frame via {OptimizedFrame::Summarize}. Note that this
means each summary might re-materialize objects and hence produce new
object identities every time. All use sites need to be able to cope with
such semantics.

R=jarin@chromium.org
BUG=v8:6586

Change-Id: I85c66ad3e7d247cd40f37a0a6e4391c0ee279706
Reviewed-on: https://chromium-review.googlesource.com/595745
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47067}
2017-08-02 08:44:25 +00:00
Juliana Franco
895c321948 Replacing pc with trampoline on stack (gc-stress fix)
Replacing pc with trampoline on stack
 
This CL is the follow up of https://chromium-review.googlesource.com/c/586707/
which used to crash when running the gc-stress bots. 
It seems to be working now. We now keep the trampoline PC in the Safepoint 
table and use that information to find SafepointEntries.

There's some refactoring that can be done, such as changing the code for 
exceptions in a similar way and removing the trampoline from the 
DeoptimizationInputData. Will take care of this in the next CL.
 

Bug: v8:6563
Change-Id: I8c0a2489de19e6d5fb4ebf1de7da1933726265b4
Reviewed-on: https://chromium-review.googlesource.com/596027
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47066}
2017-08-02 08:28:15 +00:00
Ulan Degenbaev
a5230d81d1 [heap] Set initial semi-space size to 512K.
This is a partial reland of "Allow a minimum semi-space size of 512K."
with a heuristic to keep 1MB initial semi-space size for high
memory devices.

Original commit message:
> [heap] Allow a minimum semi-space size of 512K.
> This CL also reduces the minimum semi-space size to 512K.
> BUG=chromium:716032

BUG=chromium:735649,chromium:716032

Change-Id: I5ec851f2380c40dbc34b4576a668f63ae38ac898
Reviewed-on: https://chromium-review.googlesource.com/594387
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47065}
2017-08-02 07:56:10 +00:00
Michael Starzinger
5572a6ec73 [test] Add call-undeclared-constructor message test.
R=rmcilroy@chromium.org

Change-Id: Ie5109ca54917c062ba70d55bd80cfad7832b5ea9
Reviewed-on: https://chromium-review.googlesource.com/595992
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47064}
2017-08-02 07:31:31 +00:00
Michael Achenbach
577cb0aa6b Update V8 DEPS.
Rolling v8/build: ece477b..c15e746

Rolling v8/buildtools: 5ad1454..275b8c4

Rolling v8/third_party/catapult: cc7953a..3ec5781

Rolling v8/tools/clang: 7185692..b18e402

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I7656cce0cbe7d187d8ee25951c25057b540b07ae
Reviewed-on: https://chromium-review.googlesource.com/597389
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47063}
2017-08-02 07:09:50 +00:00
Yang Guo
266be35b3b Support circular references between generated builtins.
Until now, when generating a builtin, it can only embed builtins
(as call targets) that have already been generated. This is either
achieved by reordering the builtins list, or by loading the call
target at runtime from the builtins list (see
MacroAssembler::TailCallBuiltin).

This patch works around this issue by filling the builtins list
with dummy code objects, which are later replaced with the completed
actual builtins. In release mode, this adds around 3ms to 140ms we
previously needed to populate the builtins list. 

Change-Id: I7d451b3c09a1db4b9e755548102a80c7f0dfada2
Reviewed-on: https://chromium-review.googlesource.com/586531
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47062}
2017-08-02 05:47:40 +00:00
Jaroslav Sevcik
b4b32df0b4 Remove the unused hydrogen_track_positions flag.
Change-Id: Ife88feb55f12c592b1c3b4435cd584333953ef6b
Reviewed-on: https://chromium-review.googlesource.com/593619
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47061}
2017-08-02 03:41:30 +00:00
Alexey Kozyatinskiy
f19b889be8 [inspector] support for cases when embedder doesn't call contextDestroyed
Node.js doesn't have good place to call contextDestroyed.
We need to cleanup everything on our side to allow clients to not call
contextDestroyed method.

R=dgozman@chromium.org,eostroukhov@chromium.com

Bug: none
Change-Id: Ibe3f01fd18afbfa579e5db66ab6f174d5fad7c82
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel;master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/575519
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#46849}
Reviewed-on: https://chromium-review.googlesource.com/596549
Cr-Commit-Position: refs/heads/master@{#47060}
2017-08-01 23:06:20 +00:00
Annie Sullivan
25f03308a7 Revert "[wasm] redirect wasm calls to js functions through a GCed table"
This reverts commit eb65f35e96.

Reason for revert: Broke jetstream benchmark on android.

BUG=chromium:750828

Original change's description:
> [wasm] redirect wasm calls to js functions through a GCed table
> 
> With this patch, rather than embedding the JSReceiver address directly
> in the WasmToJS wrappers, we put that in a fixed array with global handle
> scope and instead embed the location of the handle and the index in the
> wrapper. This ensures that the wrapper doesn't need to be patched if the
> GC kicks in. This is needed to get the WASM code off the GCed heap.
> 
> R=​mtrofin@chromium.org
> 
> Bug: 
> Change-Id: Ie5a77a78cdecec51b04f702c63b8e4285e6a2d8d
> Reviewed-on: https://chromium-review.googlesource.com/581682
> Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
> Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46884}

TBR=mtrofin@chromium.org,aseemgarg@google.com,aseemgarg@chromium.org,clemensh@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I26f49ee0a1fe73cc5d8852ded87b56638be39ebf
Reviewed-on: https://chromium-review.googlesource.com/596268
Commit-Queue: Aseem Garg <aseemgarg@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47059}
2017-08-01 21:34:25 +00:00
Caitlin Potter
ac6ed35a31 Reland "[async-iteration] implement spec-change to yield in async generators"
Per https://github.com/tc39/proposal-async-iteration/pull/102/files:

AsyncGeneratorResolve no longer unwraps a value component. Instead, the value is
unwrapped before the builtin call via Await, allowing Promise rejections to
affect the generator control flow.

Thus, all `yield <expr>` implicitly become `yield await <expr>`.

Additionally, `return <expr>` becomes `return await <expr>`. Finally, when the
generator is resumed with `.return()`, the parameter passed to .return() is
awaited before generator execution properly continues).

BUG=v8:6187, v8:5855
R=littledan@chromium.org, neis@chromium.org, adamk@chromium.org
TBR=rmcilroy@chromium.org, neis@chromium.org

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Id7718028fd555481f9f4ca0dbecfa788e3057c48
Reviewed-on: https://chromium-review.googlesource.com/594500
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#47058}
2017-08-01 18:39:26 +00:00
Ulan Degenbaev
638343afd2 [heap] Revert remaining parts of 5337b9
BUG=chromium:694255
TBR=ulan@chromium.org,mlippautz@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I832014d423335514cf1564984832b7a4e2c104ad
Reviewed-on: https://chromium-review.googlesource.com/595984
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47057}
2017-08-01 18:38:20 +00:00
Sathya Gunasekaran
7ff6471c48 [modules] Add comment explaining synchronous error handling
Bug: v8:5785
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I1792c57c37bac996079d5ecce5b61a13b327fb54
Reviewed-on: https://chromium-review.googlesource.com/596467
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47056}
2017-08-01 18:37:13 +00:00
Junliang Yan
04ac652862 s390: Fix lay overflow when too many arguments on stack
R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com

Bug: 
Change-Id: Ia9fa7785b0f508775f38547e56f07bc7ef9ee03d
Reviewed-on: https://chromium-review.googlesource.com/557928
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47055}
2017-08-01 18:23:48 +00:00
Jaideep Bajwa
788d828948 PPC/s390: MIPS[64] Fix SizeOfInitialHeap test failing
Port 316254a710

Original Commit Message:

    Commit 0d833cb94f deleted function call
    that created CEntryStub code in snapshot. So when CEntryStub::GetCode is
    called while initializing V8, the code for it, is not found in shapshot.
    Hence this code has to be generated in new allocation on heap, that is
    why initial heap is above the limit.
    This patch assures that CEntryStub code is in the snapshot.

R=predrag.rudic@imgtec.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I976dacf885e0d4ce8c5446a2c560a00cc0792150
Reviewed-on: https://chromium-review.googlesource.com/596071
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47054}
2017-08-01 18:15:55 +00:00
Ulan Degenbaev
2614b26b44 [heap] Disable compaction for concurrent marking.
7a5a777 is going to be reverted and compaction depends on it.

BUG=chromium:694255
TBR=ulan@chromium.org,mlippautz@chromium.org

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I975ea597860dd63e543b69bdc787c6667b015567
Reviewed-on: https://chromium-review.googlesource.com/595993
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47053}
2017-08-01 18:14:50 +00:00