Commit Graph

37632 Commits

Author SHA1 Message Date
Mike Stanton
291dc3cd1f [Feedback Vector] Coalesce Nexii to Feedback Nexus.
The FeedbackNexus classes initially were one-to-one with IC classes,
but over time this got out of date. We also found Nexus' useful, so
we made more classes even for cases that weren't ICs.

The inheritence and polymorphism became confusing and led to
duplication. Better, to just talk about a (single) FeedbackNexus.

Bug: v8:7344
Change-Id: I509dc9657895d56c3859de6e6589695cdff9e73e
Reviewed-on: https://chromium-review.googlesource.com/890452
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50997}
2018-01-31 14:34:33 +00:00
Jaroslav Sevcik
0cfbaff422 Revert "[turbofan] disable indirect jumps in Turbofan generated switches"
This reverts commit 957ac3641c.

Reason for revert: Breaks roll (crbug.com/v8/7388)

Original change's description:
> [turbofan] disable indirect jumps in Turbofan generated switches
> 
> Bug: 
> Change-Id: I326bf518f895e7c030376210e7797f3dd4a9ae1f
> Reviewed-on: https://chromium-review.googlesource.com/873643
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50984}

TBR=jarin@chromium.org,tebbi@chromium.org

Change-Id: Id2546e722179e6d8f2f102ce02fb18d696a79764
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/894385
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50995}
2018-01-31 13:44:51 +00:00
Camillo Bruni
8361fa5896 [runtime] Fix derived class instantiation
Bug: chromium:806388
Change-Id: Ieb343f0d532c16b6102e85222b77713f23bacf8c
Reviewed-on: https://chromium-review.googlesource.com/894942
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50990}
2018-01-31 12:07:56 +00:00
Clemens Hammacher
160f6009ef [Liftoff] Add support for i64 register pairs
In order to support i64 values on 32 bit platforms, we extend the
{LiftoffRegister} class to support storing pairs of GP registers on
those platforms. On 64 bit platforms, this refactoring should cause no
slowdown, as the compiler can statically determine that
{LiftoffRegister::is_pair()} is always false.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Ie9966d599271b8779959b1809ab4e129b68b80d7
Reviewed-on: https://chromium-review.googlesource.com/890261
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50986}
2018-01-31 10:43:27 +00:00
Tobias Tebbi
957ac3641c [turbofan] disable indirect jumps in Turbofan generated switches
Bug: 
Change-Id: I326bf518f895e7c030376210e7797f3dd4a9ae1f
Reviewed-on: https://chromium-review.googlesource.com/873643
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50984}
2018-01-31 10:31:26 +00:00
Tobias Tebbi
630a992b8d [turbofan] refactor BranchElimination to use a generic stack implementation
Bug: 
Change-Id: Ibd91a61a9fd4b673db1afe13936d68a2b4a096cd
Reviewed-on: https://chromium-review.googlesource.com/892058
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50983}
2018-01-31 10:25:21 +00:00
Ross McIlroy
007a73548b [Flags] Enable background compile of scripts by default.
BUG=v8:5203

Change-Id: I69093626743fa1bb4865129421266f0b1aa26a0f
Reviewed-on: https://chromium-review.googlesource.com/893384
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50982}
2018-01-31 10:20:34 +00:00
Predrag Rudic
d2ad89d846 [cctest] Skip test-run-wasm-simd if SIMD is not supported
For mips, if 'mips_arch_variant=="r6"' and if 'mips_use_msa' flag is set
to 'true', then test-run-wasm-simd tests won't be skipped for mips. It
will also force 'MIPS_SIMD' bit in CpuFeatures to be set.
ARM processors are assumed to support SIMD.

Change-Id: Iea668b97ef995ca4949ddbf2ffc734aad89d3aa3
Reviewed-on: https://chromium-review.googlesource.com/868430
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#50981}
2018-01-31 10:08:14 +00:00
Benedikt Meurer
8e7737cb58 [builtins] Refactor promises to reduce GC overhead.
This implements the ideas outlined in the section "Microtask queue"
of the exploration document "Promise and async/await performance" (at
https://goo.gl/WHRar2), except that the microtask queue stays a linear
FixedArray for now, to avoid running into trouble with the parallel
scavenger. This way we can already save a significant amount of
allocations, thereby reducing the GC frequency quite a bit.

All items on the microtask queue are now proper structs that subclass
Microtask, i.e. we also wrap JSFunction and MicrotaskCallback jobs
into structs. We also consistently remember the context for every
microtask (except for MicrotaskCallback where we don't have a
context), and execute it later in exactly that context (as required
by the spec anyways for the Promise related jobs). Particularly
interesting is the PromiseReactionJobTask and its subclasses, since
they are designed to have the same size as the PromiseReaction. When
we resolve a JSPromise we just take the existing PromiseReaction
instances and morph them into PromiseFulfillReactionJobTask or
PromiseRejectReactionJobTask (depending whether you "Fulfill" or
"Reject"). That way the JSPromise class is now only 6 words instead
of 10 words.

Also the PromiseReaction and the reaction tasks can either carry a
JSPromise (for the fast native case) or a PromiseCapability (for the
generic case), which means we don't always pay the overhead of having
to also remember the "deferred resolve" and "deferred reject" handlers
that are only relevant for the generic case anyways.

It also fixes a spec violation where we called "then" before we actually
enqueued the PromiseResolveThenableJob, which is observably wrong.
Calling it later has the advantage that it should be fairly
straight-forward now to completely avoid it for native Promise
instances.

This seems to save around 10-20% on the various Promise benchmarks and
micro-benchmarks. We expect to gain even more as we're now able to
inline various operations into TurboFan optimized code easily.

Bug: v8:7253
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I893d24ca5bb046974b4f5826a8f6dd22f1210b6a
Reviewed-on: https://chromium-review.googlesource.com/892819
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50980}
2018-01-31 10:05:39 +00:00
sreten.kovacevic
4d130da539 [MIPS64] Use correct register for {kInterpreterTargetBytecodeRegister}
Register t3 is not allocatable, so register a7 is used instead.

Change-Id: Ic198f038a10b4c891b417656d639477aedf6b703
Reviewed-on: https://chromium-review.googlesource.com/891823
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#50979}
2018-01-31 10:04:35 +00:00
Michael Lippautz
768c41c879 [object-stats] Better accounting
- Add WASM types
- Account for FeedbackMetadata
- Account entries in FunctionTemplateInfo

Bug: v8:7266
Change-Id: I527792768bb11a3540a34e7c00db311609a40b01
Reviewed-on: https://chromium-review.googlesource.com/894524
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50977}
2018-01-31 09:06:31 +00:00
Georg Neis
9c4c717b5d Fix bug in async generators.
Async generators didn't correctly handle the situation where one calls
.return on a suspended-at-start async generator and passes a
promise-like object whose awaiting causes a new request to the
generator.

Bug: chromium:805729
Change-Id: I4da13ab5bd97f8c2a2c5373242a2d5e2ab0f7f10
Reviewed-on: https://chromium-review.googlesource.com/891231
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50974}
2018-01-31 07:43:28 +00:00
Malcolm White
1f2442abab Fixes UAF for SAB with failed d8 serialization
Bug=chromium:806582

Change-Id: I0d541903dfd1622ae6d4a2628c41dc28704680e6
Reviewed-on: https://chromium-review.googlesource.com/891626
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Malcolm White <malcolmwhite@google.com>
Cr-Commit-Position: refs/heads/master@{#50972}
2018-01-30 23:12:20 +00:00
Junliang Yan
2de48de771 PPC/s390: [ignition] Fix wide suspends to also return
Port 830e39abae

Original Commit Message:

    Wide suspends have a "wide" (or "extra-wide") bytecode at their offset,
    rather than the suspend itself, so they were failing the return check.

R=leszeks@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I0c95b9fd34df7232ae07fd1e508f40cd139e9734
Reviewed-on: https://chromium-review.googlesource.com/894303
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#50971}
2018-01-30 22:10:30 +00:00
Junliang Yan
be31782314 PPC/s390: [wasm] Implement wasm sign extension opcodes
Port 1abeb5a3b1

Original Commit Message:

     - Shift opcode numbers for asmjs-compat opcodes
     - Add --experimental-wasm-se flag to gate sign extension opccodes
     - Fix codegen for ia32 movsx instructions

R=gdeepti@chromium.org, joransiu@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I3af97112b40d159f9ffc4f465768fc7832485f20
Reviewed-on: https://chromium-review.googlesource.com/893703
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#50969}
2018-01-30 21:03:11 +00:00
Camillo Bruni
718883a9c6 [api] Clean up FunctionCallbackArguments::Call
- Match PropertyCallbackArguments methods

Change-Id: I063a368b186bcca499c8a4a217114227516127e5
Reviewed-on: https://chromium-review.googlesource.com/836891
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50968}
2018-01-30 20:37:06 +00:00
Gabriel Charette
de49b57404 Reland "Smoother distribution of worker assignment in parallel task array."
This is a reland of 76195d9e08.

It was reverted because the new parallel tasks (with higher number
of workers) hang on client.v8.ports bots. Since each test task steals
the worker thread it's assigned but only processes one item before
waiting for completion by others: I think the problem is that there
aren't enough workers in client.v8.ports' config. There aren't any
try bots for this config... reduce the tests to use 4 tasks and
hope for the best (i.e. a 4 core machine that uses "num cores")...

Original change's description:
> Smoother distribution of worker assignment in parallel task array.
>
> This is a merge of https://chromium-review.googlesource.com/c/v8/v8/+/888704
> and https://chromium-review.googlesource.com/c/v8/v8/+/887084
>
> Which implements the fix in CL 887084 correctly in a world where
> there can be more tasks_ than items_ (crbug.com/806237).
>
> Bug: chromium:805932
> Change-Id: I05401be4fdce442644a8973281a9d88bd959b271
> Reviewed-on: https://chromium-review.googlesource.com/892883
> Commit-Queue: Gabriel Charette <gab@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50956}

Reverted-on: https://chromium-review.googlesource.com/893462

Bug: chromium:805932
Change-Id: I4d0bda3b9f52e9160e613a8f34a95e48b814bb9e
Reviewed-on: https://chromium-review.googlesource.com/893362
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50967}
2018-01-30 20:03:53 +00:00
Pierre Langlois
16f2bcdb09 [turbofan] Refactor AssembleMove and AssembleSwap
The way the code generator's AssembleMove and AssembleSwap methods are written
makes it easy to forget which sort of move is being implemented when looking at
a sequence of instructions. This patch is an attempt to address this by
rewriting those methods using switch/case instead of a string of if/else.

To do this, introduce new utility functions to detect what type of move to
perform given a pair of InstructionOperands.

Bug: 
Change-Id: I32b146c86409e595b7b59a66bf43220899024fdd
Reviewed-on: https://chromium-review.googlesource.com/749201
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50966}
2018-01-30 18:46:14 +00:00
Gabriel Charette
396e7bc801 Revert "Smoother distribution of worker assignment in parallel task array."
This reverts commit 76195d9e08.

Reason for revert: New parallel tests timeout on the waterfall (I think because it's configured to use less worker threads and TaskProcessingOneItem is currently designed to steal a worker but only process one item...).

Original change's description:
> Smoother distribution of worker assignment in parallel task array.
> 
> This is a merge of https://chromium-review.googlesource.com/c/v8/v8/+/888704
> and https://chromium-review.googlesource.com/c/v8/v8/+/887084
> 
> Which implements the fix in CL 887084 correctly in a world where
> there can be more tasks_ than items_ (crbug.com/806237).
> 
> Bug: chromium:805932
> Change-Id: I05401be4fdce442644a8973281a9d88bd959b271
> Reviewed-on: https://chromium-review.googlesource.com/892883
> Commit-Queue: Gabriel Charette <gab@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50956}

TBR=gab@chromium.org,hpayer@chromium.org,mlippautz@chromium.org

Change-Id: Icf52eb3afeb9467557c1e0db6922d590466943f0
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:805932
Reviewed-on: https://chromium-review.googlesource.com/893462
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50965}
2018-01-30 16:33:36 +00:00
Michael Starzinger
5113f10d4d Rename {SupportsCrankshaft} to {SupportsOptimizer}.
R=jarin@chromium.org
BUG=v8:6408

Change-Id: I28ac6fa2d47ec14b06e6867b3c605c307549c474
Reviewed-on: https://chromium-review.googlesource.com/890266
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50962}
2018-01-30 13:31:06 +00:00
jgruber
d6f0905fef [snapshot] Add helper to deserialize all builtins
Some tests need to ensure all builtins are deserialized. This adds a
helper to make that easier.

Drive-by-refactoring: Centralize lazy-deserialization tracing.

TBR=rmcilroy@chromium.org

Bug: v8:6624
Change-Id: I1f7caa6c539b12aabcba5b7b28c50ad40355848b
Reviewed-on: https://chromium-review.googlesource.com/891822
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50959}
2018-01-30 13:04:39 +00:00
Camillo Bruni
36d3ec46d8 [runtime] Harden some Map setters
Convert certain DCHECKS into CHECKS for some Map setters. This should have
minimal performance impact at the same time getting us better coverage out
there in the wild.

Change-Id: I9a12f43e1baca15d9bf8b1aed86bb6b0dc13921d
Reviewed-on: https://chromium-review.googlesource.com/866931
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50958}
2018-01-30 12:54:17 +00:00
Michael Starzinger
a5bbea19dc [wasm] Remove dead declarations from {WasmJs} API.
R=clemensh@chromium.org

Change-Id: Ifcd5d58bd27754d5ba7d05b302dc6089af5e3a53
Reviewed-on: https://chromium-review.googlesource.com/892074
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50957}
2018-01-30 12:01:47 +00:00
Gabriel Charette
76195d9e08 Smoother distribution of worker assignment in parallel task array.
This is a merge of https://chromium-review.googlesource.com/c/v8/v8/+/888704
and https://chromium-review.googlesource.com/c/v8/v8/+/887084

Which implements the fix in CL 887084 correctly in a world where
there can be more tasks_ than items_ (crbug.com/806237).

Bug: chromium:805932
Change-Id: I05401be4fdce442644a8973281a9d88bd959b271
Reviewed-on: https://chromium-review.googlesource.com/892883
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50956}
2018-01-30 11:58:24 +00:00
Clemens Hammacher
6c497ee02b [wasm] Fix --dump-wasm-module
The generated file only contained the last section of the module, since
the decoder's range is reset in DecodeSection.
This CL fixes this by remembering the original module bytes and dumping
them instead.

R=ahaas@chromium.org

Change-Id: I5e0f97279886817d58caac6114994bb9c1a147fc
Reviewed-on: https://chromium-review.googlesource.com/892980
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50953}
2018-01-30 11:43:14 +00:00
Choongwoo Han
03da2d8ce9 [typedarray] Reimplement TA.p.slice in CSA
- Port TypedArray.prototype.slice to CSA
- Implement TypedArraySpeciesCreateByLength as a CSA
- Fix spec bugs: Throw if a source typed array is neutered
 after creating a result typed array

Bug: v8:5929
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ia7ce2239d37db6db172c00aa120ef51c31a14bac
Reviewed-on: https://chromium-review.googlesource.com/830991
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50952}
2018-01-30 11:26:22 +00:00
Michael Starzinger
5cc8a2c50b [wasm] Move ScheduledErrorThrower into wasm-js.cc file.
R=clemensh@chromium.org

Change-Id: I9f4fcddca2e478d5074d68870d0293aacdeb4aa1
Reviewed-on: https://chromium-review.googlesource.com/813920
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50951}
2018-01-30 10:57:36 +00:00
jgruber
0c1d27805a [builtins] Add isolate-independence cctest
The test inspects each builtin's RelocInfo. It's isolate-independent, iff there
are no entries for embedded objects, runtime calls, external references (which
could point to addresses on the isolate), or code targets.

Bug: v8:6666
Change-Id: Ie32353db445a9e81e1c9a0a8f1b5ffe1566a0404
Reviewed-on: https://chromium-review.googlesource.com/888639
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50949}
2018-01-30 09:22:35 +00:00
Yang Guo
4f67f022fb Move msvs_dependencies.isolate out of gypfiles.
R=machenbach@chromium.org

Bug: v8:7335
Change-Id: Ib80df7aa269a8e9de7ad739f29883f61f0f0882c
Reviewed-on: https://chromium-review.googlesource.com/892978
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50948}
2018-01-30 09:12:14 +00:00
Philip Jägenstedt
ff05633408 [api] Don't mark as constructible if instance_call_handler is used
This only affects document.all, which is the only user of
|ObjectTemplate::SetCallAsFunctionHandler|, and will mean that
new document.all() will throw TypeError. There are tests for this:
//src/third_party/WebKit/LayoutTests/external/wpt/html/infrastructure/common-dom-interfaces/collections/htmlallcollection.html

(cherry picked from commit 7233447e4ac4587c81e91077857f8a30c4a6d2df)

Change-Id: Ibb39b3c61b688591c781158cf4abc0c2d74c908e
Reviewed-on: https://chromium-review.googlesource.com/882642
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Philip Jägenstedt <foolip@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/890496
Cr-Commit-Position: refs/heads/master@{#50943}
2018-01-30 05:22:33 +00:00
Kanghua Yu
a56d9349a1 [ia32][wasm] Add I8x16 ShiftOp and MulOp.
I8x16Shl/I8x16ShrS/I8x16ShrU,I8x16Mul

R=bbudge@chromium.org, bmeurer@chromium.org

Bug: 
Change-Id: I97d7f077c26fe6f8be6464582f20d4e3c8fd4667
Reviewed-on: https://chromium-review.googlesource.com/853772
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50940}
2018-01-30 04:06:35 +00:00
Jungshik Shin
f5933218d7 Block ICU data override with loading from file
This is a v8-port of
https://chromium-review.googlesource.com/c/chromium/src/+/890176 .

By default, ICU tries to load data items (e.g. brkitr/char.brk)
from individual files before trying the common data. Because
all the ICU data Chrome needs is included in the common ICU data file
that is memory mapped in InitializeICU(), trying to load from the
disk just wastes cycles because there's no file with separate ICU data
items.

Bug: chromium:805694
Test: Intl tests
Change-Id: Ia7e77d658b56d98027336acd2c91fd5f7b2cea3e
Reviewed-on: https://chromium-review.googlesource.com/890343
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jungshik Shin <jshin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50939}
2018-01-29 21:58:39 +00:00
Junliang Yan
7dccb7988f Fix GCC 5.4 error on ubuntu 16.04
The stock GCC on Ubuntu 16.04 complains these constants
are unused (possibly gcc issue). This CL changes these
to constexpr to workaround gcc errors.

R=clemensh@chromium.org, joransiu@ca.ibm.com

Change-Id: I8c1772e91744bc46ace6bee576b90d40c0cdf41f
Reviewed-on: https://chromium-review.googlesource.com/881554
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#50936}
2018-01-29 20:33:41 +00:00
Sathya Gunasekaran
2c5de06c56 [class] Implement private fields runtime semantics
Things that don't work yet:
(a) pre parsed scope data is broken
(b) private fields can be accessed outside classes
(c) no early or runtime error for accessing unknown fields

Things that do work:
everything else

Change-Id: I3d58be44e2be73ec50defb42403112a8a5e68c54
Bug: v8:5368
Reviewed-on: https://chromium-review.googlesource.com/865497
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50935}
2018-01-29 19:34:02 +00:00
Benedikt Meurer
c8da060b37 [builtins] Refactor the Microtask pumping to CSA-only.
This adjusts the RunMicrotask logic to invoke CallHandlerInfo microtasks
from CSA land directly (via a runtime function call), instead of bailing
out to C++ for the rest of the microtask queue entries. Even in simple
micro-benchmarks there doesn't seem to be a huge performance difference.
In fact performance get's better when CallHandlerInfo and promises are
mixed, which makes sense, since calling from C++ to JS land is more
expensive than the other way around.

But just in case the runtime function call overhead ever becomes the
bottleneck we can introduce a direct C++ call and setup a handle scope
around it, much like a very simple version of CallApiFunctionStub.

This greatly simplifies the microtask handling and paves the way for
refactoring the queue to significant reduce the GC overhead associated
with promises currently.

Bug: v8:7253
Change-Id: I33adb62a6bada138674d324f36d4be894e27f3c9
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/890441
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50934}
2018-01-29 19:04:11 +00:00
Benedikt Meurer
9a6c54fc38 [builtins] Use @@species protector for the PromiseResolve fast-path.
The @@species protector guards the following (in case of Promises):

  - The initial Promise.prototype has the initial "constructor"
    pointing to the Promise constructor.
  - No JSPromise instance has a "constructor" property.

So this is sufficient to guard the fast-path in PromiseResolve, given
that we check whether the value is actually a JSPromise and that the
[[Prototype]] of value is the (initial) Promise.prototype.

Also refactor the code a bit and avoid the BranchIfSameValue, which
blows up the builtin quite a lot, since we already know that constructor
must be a valid JSReceiver and thus we can simply use WordEqual to
compare value's "constructor" to the constructor.

Bug: v8:7253
Change-Id: I6413882241c9648c95bb2299100a6c3a7c803110
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/890438
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50933}
2018-01-29 18:22:12 +00:00
Ali Ijaz Sheikh
70c0237578 [heap] do not perform a step while a space is partially mutated
We were starting an allocation step during NewSpace::AddFreshPage. At
this point, we had advanced the page, but not updated allocation_info_.
This ultimately led to assertions as Space::Size was not expecting
to be called when to_space_.page_{high,low} are inconsistent with
allocation_info_.top().

The solution here is to avoid starting the step in the middle of the
space state mutation. We account for memory allocated so far before the
mutation is started, and then start a new step after the mutation has
been completed.

Bug: chromium:806179
Change-Id: I17ee896d80c4ec752baa2b17c3fd2bef7ea2ca33
Reviewed-on: https://chromium-review.googlesource.com/889981
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#50932}
2018-01-29 17:42:46 +00:00
Clemens Hammacher
74915b7306 [simulator] Make SimulatorBase::VariadicCall protected
Even though most compilers accept the method to be private, gcc 4.8
complains about this (which seems to be correct). Thus we make this
method protected.

R=franzih@chromium.org

Change-Id: Ia49b2ddebe1ced7529d4943107a76a909c355b73
Reviewed-on: https://chromium-review.googlesource.com/890449
Reviewed-by: Franziska Hinkelmann <franzih@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50931}
2018-01-29 17:41:41 +00:00
Michael Achenbach
dc210a95d3 [test] Add interrupt-budget fuzzer
This adds back an option for interrupt budget available in no-snap
builds. This also adds a fuzzer configuration for numfuzz that enables
fuzzing the interrupt budget option. A new flag --disable-analysis
allows to generally skip the fuzzer's analysis phase, which can be
chosen for interrupt budget, which doesn't support an analysis phase.

Bug: v8:6917
Change-Id: I546dd9ee41c3e0fb027108ef4606a34514f230d4
Reviewed-on: https://chromium-review.googlesource.com/885805
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50929}
2018-01-29 16:31:40 +00:00
Gabriel Charette
2407b2bd1b Revert "v8::ItemParallelJob : Do not launch more Tasks than there are Items to process."
This reverts commit 8a27c7d396.

Reason for revert: 

Having more tasks then work items is intentional in some use cases, i.e. Scavenging where RunInParallel() does parallel processing on a dynamic workload *after* the initial set of work items:

    {
      barrier_->Start();
      TimedScope scope(&scavenging_time);
      PageScavengingItem* item = nullptr;
      while ((item = GetItem<PageScavengingItem>()) != nullptr) {
        item->Process(scavenger_);
        item->MarkFinished();
      }
      do {
        scavenger_->Process(barrier_);
      } while (!barrier_->Wait());
      scavenger_->Process();
    }

Original change's description:
> v8::ItemParallelJob : Do not launch more Tasks than there are Items to process.
> 
> Except when there are 0 items. For some reason I don't quite understand yet, not
> calling Run() on tasks_[0] when there are 0 items results in DCHECKs...
> 
> Bug: chromium:806237
> Change-Id: I38c8fffde64a42f93f4efda492832651137eebd7
> Reviewed-on: https://chromium-review.googlesource.com/888704
> Commit-Queue: Gabriel Charette <gab@chromium.org>
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#50924}

TBR=gab@chromium.org,mlippautz@chromium.org

Change-Id: Iad2ab16bb41f339de8e3fbca1c08c5d26b8a0111
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:806237
Reviewed-on: https://chromium-review.googlesource.com/891186
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Gabriel Charette <gab@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50928}
2018-01-29 16:03:46 +00:00
Michael Starzinger
b47427740d [arm][arm64] Implement {kSpeculationFence} operator.
R=tebbi@chromium.org

Change-Id: Iae9a3774eb7913388350ce3cd0a96d6a6cca25e8
Reviewed-on: https://chromium-review.googlesource.com/885845
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50926}
2018-01-29 13:43:53 +00:00
Ross McIlroy
c9941af275 [Intepreter] Add poisoning to bytecode operand reads.
BUG=chromium:798964

Change-Id: I63c373ef3f27a3295fc79f5c82d78b5fd89a83da
Reviewed-on: https://chromium-review.googlesource.com/888752
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50925}
2018-01-29 12:56:43 +00:00
Gabriel Charette
8a27c7d396 v8::ItemParallelJob : Do not launch more Tasks than there are Items to process.
Except when there are 0 items. For some reason I don't quite understand yet, not
calling Run() on tasks_[0] when there are 0 items results in DCHECKs...

Bug: chromium:806237
Change-Id: I38c8fffde64a42f93f4efda492832651137eebd7
Reviewed-on: https://chromium-review.googlesource.com/888704
Commit-Queue: Gabriel Charette <gab@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50924}
2018-01-29 12:53:53 +00:00
Leszek Swirski
830e39abae [ignition] Fix wide suspends to also return
Wide suspends have a "wide" (or "extra-wide") bytecode at their offset,
rather than the suspend itself, so they were failing the return check.

Bug: chromium:805765
Change-Id: Iabfc2a2167d09eda2f6885d9100287aadcd8fee9
Reviewed-on: https://chromium-review.googlesource.com/887082
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50923}
2018-01-29 12:38:33 +00:00
Leszek Swirski
3249b162bd [parser] Throw syntax error for %Foo(...spread)
Bug: chromium:806200
Change-Id: If76a8cb5b988321d38d170dfba7c1fc5354e2667
Reviewed-on: https://chromium-review.googlesource.com/888922
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50922}
2018-01-29 09:57:39 +00:00
Daniel Clifford
095e62bfcd Fix bug in ExtractFixedArray
There is currently no test that shows this bug (it was found as part of the DSL
experiment), but it should get fixed anyway and it will eventually be verified
by the A.p.splice CSA builtin port that is in progress.

Change-Id: I9b6da8dc8f3151ad0b0a06c3ca10d604060efef7
Reviewed-on: https://chromium-review.googlesource.com/890580
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50921}
2018-01-29 09:16:47 +00:00
Daniel Clifford
ca1508fc3b Refactor ArrayBuiltinsAssembler to split into a header and source file
This makes the ArrayBuiltinsAssembler consistent with the StringBuiltinsAssembler
and paves the way for tools that expect the assemblers to have a common structure.

Change-Id: I7470fc2cf144f9cc2fdbcee99b31daed267550be
Reviewed-on: https://chromium-review.googlesource.com/889933
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50920}
2018-01-29 09:15:27 +00:00
Jaroslav Sevcik
ff394b4453 [turbofan] Remove unused instruction continuation handling for stack checks.
Bug: v8:5267
Change-Id: I649554733fdbd00c8e82b09aca35b0ff1f823560
Reviewed-on: https://chromium-review.googlesource.com/890262
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50919}
2018-01-29 09:07:07 +00:00
Sathya Gunasekaran
6ff2927523 [ESNext] Ship import() and import.meta
import() is shipping by default in Chrome 63 and import.meta is
shipping in Chrome 64 already.

The flag still exists so that embedders can turn off the feature
if required.

Bug: v8:5785, v8:6693
Change-Id: Ie6c8f90927958022900f677ea5a771527111aece
Reviewed-on: https://chromium-review.googlesource.com/889658
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50913}
2018-01-26 21:40:34 +00:00
Jakob Kummerow
b6e68438c4 Fix parseInt fast-path to return -0 when needed
Bug: v8:7369
Change-Id: I35b69295a4f9ffab0d5d0501f2f0252dee1a48a3
Reviewed-on: https://chromium-review.googlesource.com/887428
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#50911}
2018-01-26 18:17:03 +00:00