Commit Graph

16533 Commits

Author SHA1 Message Date
Clemens Hammacher
1bf5ac8cd9 [wasm] Extract WasmVal to own header and rename to WasmValue
This allows to reuse the class e.g. in the baseline compiler.

R=titzer@chromium.org

Change-Id: I7251af16e8c74f267834a9cefb676edf3c9f3a07
Reviewed-on: https://chromium-review.googlesource.com/570020
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46735}
2017-07-18 13:12:56 +00:00
Camillo Bruni
10c6fb566f [mjsunit] Harden prepareStackTrace against Array.prototype corruption
Change-Id: I50ae9d96545f63bdb5ca27a23ea3a04c8764678a
Reviewed-on: https://chromium-review.googlesource.com/574533
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46734}
2017-07-18 12:14:14 +00:00
Yang Guo
a2ab1353f6 [snapshot] Rehash strings after deserialization.
See https://goo.gl/6aN8xA

Bug: v8:6593
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic8b0b57195d01d41591397d5d45de3f0f3ebc3d9
Reviewed-on: https://chromium-review.googlesource.com/574527
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46732}
2017-07-18 10:48:43 +00:00
Clemens Hammacher
0725ff15e7 [wasm] Make signature map move-only
Signature maps should only be updated, but never copied. We had a bug
because we accidentally updated a copy of the map. This refactoring
prevents any such bugs in the future, and fixes more occurences where
we accidentally copied structs containing a signature map (the move-only
constraint also extends to all structs containing a signature map).

Drive-by: Make InstanceBuilder::NeedsWrappers const.

R=titzer@chromium.org

Bug: chromium:741750
Change-Id: Id919203d8c4078e608a1163e5c790c97d06a9753
Reviewed-on: https://chromium-review.googlesource.com/571791
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46728}
2017-07-18 07:20:19 +00:00
jgruber
989d7b96f8 [error] Lazy stack trace formatting for Error.captureStackTrace
This reinstates the old behavior of Error.captureStackTrace prior to
4feafee9d9.  Like the builtin Error constructors, captureStackTrace now formats
the stack trace lazily once it is accessed.

Bug: v8:5962
Change-Id: I03821b73d26b7b40809a1fea98f9c820bfa05d6b
Reviewed-on: https://chromium-review.googlesource.com/574530
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46727}
2017-07-18 06:40:39 +00:00
Sathya Gunasekaran
94ce16b704 Fix error message while array destructuring undefined
Previously,
  ➜  v8 (master) ✔ ./out.gn/x64.optdebug/d8
  V8 version 6.1.0 (candidate)
  d8> var x = undefined
  undefined
  d8> var [a] = x
  (d8):1: TypeError: Cannot read property 'Symbol(Symbol.iterator)' of undefined
  var [a] = x
            ^
  TypeError: Cannot read property 'Symbol(Symbol.iterator)' of undefined
      at (d8):1:11

Now,
  ➜  v8 (fix-iterator) ✔ ./out.gn/x64.optdebug/d8
  V8 version 6.1.0 (candidate)
  d8> var x = undefined
  undefined
  d8> var [a] = x
  (d8):1: TypeError: x is not iterable
  var [a] = x
            ^
  TypeError: x is not iterable
      at (d8):1:11


Bug: v8:6599, v8:6513
Change-Id: I71287a19166af0289e8f7708b8f41ad003ae87ae
Reviewed-on: https://chromium-review.googlesource.com/571175
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46723}
2017-07-17 22:18:19 +00:00
Sathya Gunasekaran
c45b2291a7 [modules] Propogate scheduled exception on ToString failure
Also, add a couple of macros to handle error cases.

R=adamk@chromium.org

Bug: chromium:744292
Change-Id: I5dcb19ce67ec1aa4318d68d973d304cb07a65b80
Reviewed-on: https://chromium-review.googlesource.com/575394
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46722}
2017-07-17 22:07:41 +00:00
Benedikt Meurer
42a648c586 Revert "[arm] Restrict grouping pushes before a TailCall to registers only"
This reverts commit a72b2f88a8.

Reason for revert: Breaks https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20debug/builds/7093

Original change's description:
> [arm] Restrict grouping pushes before a TailCall to registers only
> 
> We optimize parallel moves performed before a TailCall by grouping adjacent
> pushes. This way, we may use a single instruction to push multiple registers at
> once. However, we also have support for pushing immediates and stack slots for
> which the benefit is questionnable therefore this patch removes support for
> them.
> 
> Concerning immediate pushes, it looks like a mistake since we do not have
> support for this case in `AssembleMove` so this patch removes it. Furthermore,
> if we add a test for this case, we see that a `push ip` instruction is
> generated, effectively pushing whatever was in `ip` at the time instead of
> pushing a constant.
> 
> Concerning stack slot pushes, we generate a more or less equivalent sequence of
> instructions.
> 
> Finally, grouping floating point pushes is not used anywhere so this patch
> removes support for this also.
> 
> Bug: v8:6553
> Change-Id: I9b820d33361fc442dd813f66e1f96cda41009110
> Reviewed-on: https://chromium-review.googlesource.com/567191
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
> Cr-Commit-Position: refs/heads/master@{#46718}

TBR=danno@chromium.org,jarin@chromium.org,pierre.langlois@arm.com,bmeurer@chromium.org

Change-Id: Ib9db9e6e4f033aeea32741e04b1b884429acc800
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6553
Reviewed-on: https://chromium-review.googlesource.com/574908
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46719}
2017-07-17 18:12:09 +00:00
Pierre Langlois
a72b2f88a8 [arm] Restrict grouping pushes before a TailCall to registers only
We optimize parallel moves performed before a TailCall by grouping adjacent
pushes. This way, we may use a single instruction to push multiple registers at
once. However, we also have support for pushing immediates and stack slots for
which the benefit is questionnable therefore this patch removes support for
them.

Concerning immediate pushes, it looks like a mistake since we do not have
support for this case in `AssembleMove` so this patch removes it. Furthermore,
if we add a test for this case, we see that a `push ip` instruction is
generated, effectively pushing whatever was in `ip` at the time instead of
pushing a constant.

Concerning stack slot pushes, we generate a more or less equivalent sequence of
instructions.

Finally, grouping floating point pushes is not used anywhere so this patch
removes support for this also.

Bug: v8:6553
Change-Id: I9b820d33361fc442dd813f66e1f96cda41009110
Reviewed-on: https://chromium-review.googlesource.com/567191
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#46718}
2017-07-17 17:21:36 +00:00
Ross McIlroy
259bf74df0 [Compiler] Fix setting shared function info flags from literal for asm_wasm.
BUG=chromium:743622

Change-Id: Ic29a39d5976425eda2358c7e5ace0efa1b78a718
Reviewed-on: https://chromium-review.googlesource.com/574604
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46714}
2017-07-17 16:08:17 +00:00
Andreas Haas
2064c1f920 [wasm][ia32] Add an additional stack check for functions with big frames
This is the ia32 implementation of the CL
https://codereview.chromium.org/2763593002

Original message:

[wasm][arm] Add an additional stack check for functions with big frames.

Stack overflow checks are typically implemented as part of the TurboFan
graph of a function. This means that the stack check code is executed
after frame construction. When a frame is too big, though, there may not
be enough space on the stack anymore to throw the stack overflow
exception after frame construction. With this CL we do an additional
stack check before frame construction for functions with big frames.

As discussed offline with mstarzinger, I do this change currently only
for WebAssembly.

This CL contains only the changes for arm. I will do the other platforms
in separate CLs.

Bug:v8:6318

R=neis@chromium.org, titzer@chromium.org

Change-Id: Ibeedc5c4c4571cffd3a9c58016ddc44b64e2bf02
Reviewed-on: https://chromium-review.googlesource.com/568305
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46711}
2017-07-17 15:21:34 +00:00
Daniel Clifford
9a0403a679 Don't add dependencies on prototype chain when inlining forEach
Bug=chromium:740784
LOG=N

Change-Id: I61fe1b07426d0b1e5131687c9ce99a8dbfa09781
Reviewed-on: https://chromium-review.googlesource.com/574175
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46706}
2017-07-17 12:54:32 +00:00
Ulan Degenbaev
ce04f26abb [heap] Reschedule concurrent marking tasks.
If the incremental marker discovers more marking work and the concurrent
marking tasks have already exited, then new concurrent marking tasks
are scheduled to help the main thread marker.

BUG=chromium:694255

Change-Id: I559af62790e6034b23a412d3308ba8b6ae3d27c9
Reviewed-on: https://chromium-review.googlesource.com/574170
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46703}
2017-07-17 11:53:22 +00:00
Leszek Swirski
14c5c4fde7 Revert "[runtime] Move profiler ticks from SFI to feedback vector"
This reverts commit a2fcdc7cc8.

Reason for revert: Large regressions in RCS (https://chromeperf.appspot.com/group_report?bug_id=740126)

Original change's description:
> [runtime] Move profiler ticks from SFI to feedback vector
> 
> Instead of counting profiler ticks on the shared function info (which is
> shared between native contexts), count them on the feedback vector
> (which is not). This allows us to continue pushing optimization
> decisions off the SFI, onto the feedback vector.
> 
> Note that a side-effect of this is that ICs don't have to walk the stack
> to reset profiler ticks, as they can access the feedback vector directly
> from their feedback nexus.
> 
> Change-Id: I232ae9e759fca75cd89d393148a4ff42caa2646f
> Reviewed-on: https://chromium-review.googlesource.com/544888
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46411}

TBR=rmcilroy@chromium.org,leszeks@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: Id587e4172e300c420f93c49744a2a0e66696edf8
Reviewed-on: https://chromium-review.googlesource.com/574227
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46702}
2017-07-17 11:51:32 +00:00
Georgia Kouveli
c12a595a95 Call the right functions in bitwise bytecode handlers benchmarks.
Some of the benchmarks were pointing to the wrong test functions.

Bug: 
Change-Id: I6f7850feec1da61bea7b8c1ac03c00d75400f458
Reviewed-on: https://chromium-review.googlesource.com/574023
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georgia Kouveli <georgia.kouveli@arm.com>
Cr-Commit-Position: refs/heads/master@{#46701}
2017-07-17 10:58:47 +00:00
jgruber
b34023e876 [coverage] Recognize binary block mode as block coverage
Bug: v8:6000
Change-Id: I2853d44d8bcf34b28630594cc9c2782046bd4b28
Reviewed-on: https://chromium-review.googlesource.com/573900
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46700}
2017-07-17 10:57:43 +00:00
Clemens Hammacher
0a3a52c569 [wasm] Fix decoder unit tests
There are wasm tests which are supposed to fail, but they fail for the
wrong reason (because blocks do not declare their type).
This CL fixes this, and changes the error output to contain the
expected and observed results for better debuggability.

R=titzer@chromium.org

Change-Id: Ibbd7883e43677a91f858575578586c9e9d1641d5
Reviewed-on: https://chromium-review.googlesource.com/571810
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46698}
2017-07-17 10:05:31 +00:00
Michael Lippautz
7a49c94c25 [heap] Make page promotion tests more robust against fragmentation
Bug: chromium:738865
Change-Id: If710b60d33eea94bff7b621910006c2d941a7670
Reviewed-on: https://chromium-review.googlesource.com/571900
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46697}
2017-07-17 08:52:13 +00:00
Michael Starzinger
bf10f65976 [turbofan] Better recognize AstGraphBuilder'ed code.
This makes the runtime rely on the {HasBytecodeArray} predicate to
determine whether code generated by TurboFan was build without any
deoptimization support, as opposed to {asm_function}.

R=rmcilroy@chromium.org
BUG=v8:6589

Change-Id: Id124bed47a5fa02d31ff8fd3eee561b2df6c9226
Reviewed-on: https://chromium-review.googlesource.com/571786
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46694}
2017-07-17 08:15:31 +00:00
Alexey Kozyatinskiy
0896586083 [inspector] improve return position of explicit return in non-async function
Goal of this CL: explicit return from non-async function has position after
return expression as return position (will unblock [1]).

BytecodeArrayBuilder has SetStatementPosition and SetExpressionPosition methods.
If one of these methods is called then next generated bytecode will get passed
position. It's general treatment for most cases.
Unfortunately it doesn't work for Returns:
- debugger requires source positions exactly on kReturn bytecode in stepping
  implementation,
- BytecodeGenerator::BuildReturn and BytecodeGenerator::BuildAsyncReturn
  generates more then one bytecode and general solution will put return position
  on first generated bytecode,
- it's not easy to split BuildReturn function into two parts to allow something
  like following in BytecodeGenerator::VisitReturnStatement since generated
  bytecodes are actually controlled by execution_control().
..->BuildReturnPrologue();
..->SetReturnPosition(stmt);
..->Return();

In this CL we pass ReturnStatement through ExecutionControl and use it for
position when we emit return bytecode right here.

So this CL only will improve return position for returns inside of non-async
functions, I'll address async functions later.

[1] https://chromium-review.googlesource.com/c/543161/

Change-Id: Iede512c120b00c209990bf50c20e7d23dc0d65db
Reviewed-on: https://chromium-review.googlesource.com/560738
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46687}
2017-07-14 19:10:13 +00:00
Caitlin Potter
53553f5dcb [generators] remove SuspendFlags enum and related code
SuspendFlags was originally used by the suspend operation to determine
which field to record the bytecode offset of a suspended generator, and
the value the generator was resumed with. For async generators, await
operations would use a separate field, in order to preserve the previous
yield input value. This was important to ensure `function.sent`
continued to function correctly.

As function.sent is being retired, this allows the removal of support
for that. Given that this was the only real need for SuspendFlags in the
first place (with other uses tacked on as a hack), this involves several
other changes as well:

- Modification of MacroAssembler AssertGeneratorObject. No longer
  accepts a SuspendFlags parameter to determine which type of check to
  perform.
- Removal of `flags` operand from SuspendGenerator bytecode, and the
  GeneratorStore js-operator.
- Removal of `flags` parameter from ResumeGeneratorTrampoline builtins.
- Removal of Runtime functions, interpreter intrinsics and
  AccessBuilders associated with the [[await_input_or_debug_pos]] field
  in JSAsyncGeneratorObject, as this field no longer exists.
- Addition of a new `Yield` AST node (subclass of Suspend) in order to
  prevent the need for the other SuspendFlag values.

BUG=v8:5855
TBR=bmeurer@chromium.org

Change-Id: Iff2881e4742497fe5b774915e988c3d9d8fbe487
Reviewed-on: https://chromium-review.googlesource.com/570485
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46683}
2017-07-14 16:09:53 +00:00
Ben L. Titzer
ecbbc58ec6 [wasm] Reduce run-time of GC stress test.
R=clemensh@chromium.org

Bug: 
Change-Id: I0fb6bdba7462acd1a6f86a9a378238dcb466a9e1
Reviewed-on: https://chromium-review.googlesource.com/571012
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46682}
2017-07-14 16:02:42 +00:00
Enrico Bacis
d594a6d9cd [turbofan] Remove ToFloat64AsInt and make ToFloat64 return a Double
Returning a double from ToFloat64 could lead to problems. If value_ has the bit
representation of a signaling NaN (sNaN), then returning it as double can cause
the signaling bit to flip, and value_ is returned as a quiet NaN (qNaN).

The usage of the Double wrapper also, makes the function ToFloat64AsInt
redundant, since the Double wrapper already has the AsUint64() method,
which returns an uint64_t.

R=ahaas@chromium.org

Change-Id: I1e627b97b2fb6110fc702fe58f2b83eb343e9ca2
Reviewed-on: https://chromium-review.googlesource.com/563215
Commit-Queue: Enrico Bacis <enricobacis@google.com>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46680}
2017-07-14 15:01:02 +00:00
Clemens Hammacher
b53141eca3 Reland "[wasm] Don't store global handles in the interpreter"
This is a reland of 5648aad553.
Previous compile error should be fixed by disabling strict aliasing
assumptions on gyp: https://chromium-review.googlesource.com/c/571806

Original change's description:
> [wasm] Don't store global handles in the interpreter
> 
> Storing global handles in the interpreter is dangerous, because the
> global handles are strong roots into the heap. The interpreter itself is
> referenced from the heap via a Managed. Hence the interpreter keeps the
> instance alive, while the instance keeps the Managed alive. So the GC
> will never collect them.
> 
> This CL refactors this to only store the handle to the instance object
> while executing in the interpreter, and clearing it when returning.
> It also removes the cache of import wrappers, as it should not be
> performance critical, but keeps lots of objects alive. If it turns out
> to be performance critical, we will have to reintroduce such a cache
> stored in the WasmDebugInfo object.
> 
> R=titzer@chromium.org
> CC=ahaas@chromium.org
> 
> Bug: chromium:610330
> Change-Id: I54b489dadc16685887c0c1a98da6fd0df5ad7cbb
> Reviewed-on: https://chromium-review.googlesource.com/567058
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46629}

TBR=titzer@chromium.org

Bug: chromium:610330
Change-Id: Ic7836b1b1a044a89f2138f0c76f92acd3a1b2f2b
Reviewed-on: https://chromium-review.googlesource.com/570578
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46679}
2017-07-14 14:37:22 +00:00
jgruber
8f6303fb6e [coverage] Support conditional expressions
Bug: v8:6000
Change-Id: I8c068383300ba869a87f836504c84ea08fcff87e
Reviewed-on: https://chromium-review.googlesource.com/568307
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46675}
2017-07-14 11:47:51 +00:00
Maya Lekova
7f50476b83 [builtins] Introduce CallProxy builtin based on CSA
- Add more conformance tests for proxy call and calling undetectable
- This improves the performance of calling a proxy by ~5x

Bug: v8:6558, v8:6557
Change-Id: I5fe78d7ca703cfe86a2a14e39f0b6d88bb8c8e03
Reviewed-on: https://chromium-review.googlesource.com/570023
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#46673}
2017-07-14 11:22:48 +00:00
Michael Starzinger
3876999572 [turbofan] Remove dead tail call optimization support.
R=bmeurer@chromium.org
BUG=v8:4698

Change-Id: I8917315d913f908b1631e82357a94f2f6cf0026f
Reviewed-on: https://chromium-review.googlesource.com/571781
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46672}
2017-07-14 11:21:41 +00:00
Ulan Degenbaev
065c47dedd Revert "[heap] Keep concurrent marking tasks running until marking is completed."
This reverts commit 20d5048a6f.

Revert "[heap] Ensure that concurrent marking tasks exit before heap tear down."

This reverts commit 387f65d41a.

Reason: concurrent marking tasks waiting for a signal from the main thread
is susceptible to deadlocks. We should instead re-schedule concurrent marking
threads once they exit.

BUG=chromium:694255

Change-Id: I20db2f26b42e960f4cc04506d9598c1187b8a003
Reviewed-on: https://chromium-review.googlesource.com/571800
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46671}
2017-07-14 10:39:20 +00:00
Maya Lekova
e24abc9d1c Add micro-benchmark for Proxy call and constructor to the suite
Bug: v8:6558, v8:6557
Change-Id: Ibda4ac02f7c8f28b6e37664c10ffae34124c79b0
Reviewed-on: https://chromium-review.googlesource.com/571703
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#46669}
2017-07-14 10:28:10 +00:00
Caitlin Potter
8b5b444a4c [async-await] desugar Await in BytecodeGenerator
This includes several changes. From most to least interesting:

- No longer implement AwaitExpressions using a do-expression.
- Reduces frame-size of async generators by not allocating temporary
  variables to hold results of Await epxressions.
- Streamline and reduce generated bytecodes for Await.
- Debugger no longer emits a debug::kCallBreakLocation breakpoint for
the JS-builtin call performed for Await, and instead only emits such
a breakpoint if the operand of Await is actually a call.
- Push fewer parameters to Await* builtins, using the receiver for the
  first parameter (possible now that the CallRuntime invocation not
  part of the AST).
- Adds a new Await AST node. No new members or anything, but it seemed
  palatable to avoid having `if (is_await())` in a number of
  VisitSuspend functions.

BUG=v8:5855, v8:5099, v8:4483
R=rmcilroy@chromium.org, kozyatinskiy@chromium.org, yangguo@chromium.org
TBR=bmeurer@chromium.org

Change-Id: I9cd3fda99cd40295c04fdf1aea01b5d83fac6caf
Reviewed-on: https://chromium-review.googlesource.com/558806
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46666}
2017-07-14 08:57:51 +00:00
Clemens Hammacher
883db26e6f [wasm] Update signature map on indirect calls
The code was already there, but there was a bug in it: Because of the
missing reference, we were only updating a *copy* of the signature map,
hence the update had no effect.
This intentially is a minimal CL, in order to allow for easy
backmerging.
More mitigations and tests are coming in a separate CL.

R=titzer@chromium.org

Change-Id: Ifb462093f4b8f4d5380b6774636537c67c2b676c
Reviewed-on: https://chromium-review.googlesource.com/570278
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46664}
2017-07-14 08:42:40 +00:00
Pierre Langlois
527f541fe8 [arm64][cctest] Fix disassembly debug test on hardware.
The "test-disasm-arm64/DISASM_debug" test would fail on hardware because we
expected a "hlt" instruction instead of "brk". The former is specific to running
inside the simulator.

Bug: 
Change-Id: I7a5a3d4c1a93d03bbf4c934037c565d27379c2b5
Reviewed-on: https://chromium-review.googlesource.com/570442
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#46663}
2017-07-14 08:39:32 +00:00
Michael Achenbach
682832a0f5 Revert "[runtime] Add shortcuts for elements kinds transitions."
This reverts commit b90e83f5da.

Reason for revert: Blocks roll:
https://chromium-review.googlesource.com/c/570002/

Confirmed by:
https://chromium-review.googlesource.com/c/571700/2

Original change's description:
> [runtime] Add shortcuts for elements kinds transitions.
> 
> The shortcuts ensure that field type generalization is properly
> propagated in the transition graph.
> 
> Bug: chromium:738763
> Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
> Reviewed-on: https://chromium-review.googlesource.com/567992
> Commit-Queue: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46622}

TBR=jkummerow@chromium.org,ishell@chromium.org

Change-Id: I5ede80db6bc209f16c6fd43f6bf3c8865c9577d8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:738763
Reviewed-on: https://chromium-review.googlesource.com/571741
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46660}
2017-07-14 08:04:05 +00:00
jgruber
5162488ae1 [coverage] Support for-of and for-in loops
Bug: v8:6000
Change-Id: Ia50108ebbf838e210d95cb268858394e6a66c88d
Reviewed-on: https://chromium-review.googlesource.com/567990
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46658}
2017-07-14 07:30:20 +00:00
Ulan Degenbaev
0640cbf378 [heap] Rework ASLR for base::Platform::VirtualMemory
Currently every VirtualMemory allocation on 64-bit systems
uses a random 46-bit address hint for ASLR.

This leads to wired page leak on MacOS discovered by Erik Chen (see
crbug.com/700928 and https://chromium-review.googlesource.com/c/557958/):
"The Darwin kernel [as of macOS 10.12.5] does not clean up page directory
entries [PDE] created from mmap or mach_vm_allocate, even after
the region is destroyed. Using a virtual address space that is too large
causes a leak of about 1 wired [can never be paged out] page per call to
mmap(). The page is only reclaimed when the process is killed."

This patch changes VirtualMemory to accept the hint parameter explicitly.

On MacOS the hints are confined to 4GB contiguous region. Algorithm:
- On startup, set heap.mmap_region_base_ to a random address.
- For each mmap use heap.mmap_region_base_ + (random_offset % (4*GB)).

BUG=chromium:700928

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I2ae6a024e02fbe63f940105d7920b57c19abacc6
Reviewed-on: https://chromium-review.googlesource.com/558876
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46656}
2017-07-14 07:15:40 +00:00
Benedikt Meurer
1287688ca7 [turbofan] Inline Map and Set iterators into optimized code.
This CL inlines the following builtins into TurboFan

  - %MapIteratorPrototype%.next
  - %SetIteratorPrototype%.next

following the design that we are using for Array iteration already
(different instance types for the different kinds of iterators). Details
can be found in the relevant design document at:

  https://docs.google.com/document/d/13z1fvRVpe_oEroplXEEX0a3WK94fhXorHjcOMsDmR-8

The key to great performance here is to ensure that the inlined code
allows escape analysis and scalar replacement of aggregates to remove
the allocations for the iterator itself as well as the iterator results
and potential key/value arrays in the simple case of a for-of loop (and
by extension also in other constructs that reduce to for-of loops
internally), i.e.:

  const s = new Set;
  // ... do something with s
  for (const x of s) {
    // ...
  }

Here the for-of loop shouldn't perform any allocations of helper
objects.

Drive-by-fix: Replace the ExistsJSMapWithness in JSBuiltinReducer with a more
general HasInstanceTypeWitness, similar to what's in JSCallReducer. Also
migrate the {Map,Set}.prototype.size getter inlining to the
JSBuiltinReducer, so that everything is in a single place.

R=jgruber@chromium.org

Bug: v8:6344, v8:6571, chromium:740122
Change-Id: I09cb506fe26ed3e10d7dcb2f95ec4415e639582d
Reviewed-on: https://chromium-review.googlesource.com/570159
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46655}
2017-07-14 07:02:00 +00:00
Sathya Gunasekaran
755d09e671 [parser] Update {Binding,Assignment}RestPattern
Only allow BindingIdentifier in BindingRestPattern and 
ValidReferenceExpression in AssignmentRestPattern.

Also updated to a better, actionable error message.

Bug: v8:6500, v8:6513
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ifaba2f85c20bc20e263267e8c76d50a27075b87d
Reviewed-on: https://chromium-review.googlesource.com/550559
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46653}
2017-07-14 00:10:06 +00:00
Adam Klein
1769f892ce [cleanup] Remove always-off support for tail calls
The tail call implementation is hidden behind the --harmony-tailcalls
flag, which is off-by-default (and has been unstaged since February).
It is known to be broken in a variety of cases, including clusterfuzz
security issues (see sample Chromium issues below). To avoid letting
the implementation bitrot further on trunk, this patch removes it.

Bug: v8:4698, chromium:636914, chromium:724746
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng;master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I9cb547101456a582374fdf7b1a3f044a9ef33e5c
Reviewed-on: https://chromium-review.googlesource.com/569069
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46651}
2017-07-13 19:29:05 +00:00
Ross McIlroy
c445e1e96b [Compiler] Remove EnsureBaseline.
We only optimize functions which are already compiled, so there is no need
to ensure baseline in pipeline.cc, and since ast-graph-builder doesn't
do inlining, there are no other uses.

BUG=v8:5203, v8:6409

Change-Id: I830c8868d50363f61193a96d9a5774e059a1af0e
Reviewed-on: https://chromium-review.googlesource.com/570033
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46649}
2017-07-13 16:59:06 +00:00
Ross McIlroy
632221acc5 [Compiler] Remove unnecessary UseTurboFan function and turbo_asm flag.
These are no longer necessary since we only have one optimizing compiler.
Also avoid changing --turbo-filter when --no-opt is set, and instead
explicitly check both the FLAG_opt and FLAG_turbo_filter in 
GetOptimizedCode to check whether optimization is disabled.

BUG=v8:6408

Change-Id: I0948f788e8ff111c08022270d86c22f848da300a
Reviewed-on: https://chromium-review.googlesource.com/568484
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46648}
2017-07-13 16:53:46 +00:00
jgruber
2941d76cd7 [coverage] Support for labeled blocks and blocks containing jumps
Both labeled blocks:

l0: { break l0; }

and blocks containing jump statements (break, return, continue) require a
continuation counter to correctly display coverage.

Bug: v8:6000
Change-Id: I3ae8ddd3d9f6c087622482b86014dd583b774b71
Reviewed-on: https://chromium-review.googlesource.com/568024
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46644}
2017-07-13 15:24:26 +00:00
Andreas Haas
a03f445106 [wasm][x64] Add an additional stack check for functions with big frames
This is the x64 implementation of the CL
https://codereview.chromium.org/2763593002

Original message:

[wasm][arm] Add an additional stack check for functions with big frames.

Stack overflow checks are typically implemented as part of the TurboFan
graph of a function. This means that the stack check code is executed
after frame construction. When a frame is too big, though, there may not
be enough space on the stack anymore to throw the stack overflow
exception after frame construction. With this CL we do an additional
stack check before frame construction for functions with big frames.

As discussed offline with mstarzinger, I do this change currently only
for WebAssembly.

This CL contains only the changes for arm. I will do the other platforms
in separate CLs.

R=titzer@chromium.org

Bug: v8:6318
Change-Id: Id4a8ea3ee76c37132e86a7c4e5d05d3bd86df44a
Reviewed-on: https://chromium-review.googlesource.com/565562
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46640}
2017-07-13 13:43:04 +00:00
Ulan Degenbaev
20d5048a6f [heap] Keep concurrent marking tasks running until marking is completed.
BUG=chromium:694255

Change-Id: Id874d7427b52f5c2d1d7ae72d321cad8277f8082
Reviewed-on: https://chromium-review.googlesource.com/570035
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46639}
2017-07-13 13:33:54 +00:00
Igor Sheludko
42ba9ef724 [runtime] Use custom maps for function closures ...
... that have computed name and/or require home object.

This should give us the opportunity to implement initialization
of name and home object values in a stub.

Bug: v8:6459
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I47a1a2c185e120e86c793733cce737811f895291
Reviewed-on: https://chromium-review.googlesource.com/512802
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46638}
2017-07-13 13:23:06 +00:00
Michael Starzinger
05f3b27cdd Reland "[flags] Remove some dead Crankshaft flags."
This is a reland of ec6da23bfe
Original change's description:
> [flags] Remove some dead Crankshaft flags.
> 
> R=bmeurer@chromium.org
> BUG=v8:6408
> 
> Change-Id: I34abbcdc2fc47df44938bac0e59f9982c935c657
> Reviewed-on: https://chromium-review.googlesource.com/569963
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46631}

Bug: v8:6408
Change-Id: I8a856e25d56e27bccb79588b2e5ee4369d7c5fe5
Reviewed-on: https://chromium-review.googlesource.com/570050
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46637}
2017-07-13 13:15:34 +00:00
Ross McIlroy
05207b098a [Interpreter] Replace --ignition flag with a --stress-fullcodegen
Removes the --ignition flag which is now on by default. Adds a
--stress-fullcodegen flag which enables running all functions supported
by fullcodegen to be compiled by fullcodegen.

This will enable moving parser internalization later when we are not
stressing fullcodegen or compiling asm.js functions.

BUG=v8:5203, v8:6409, v8:6589

Change-Id: I7fa68016d4e734755434ec0b4e749ef65ffa7f4e
Reviewed-on: https://chromium-review.googlesource.com/565569
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46635}
2017-07-13 13:05:00 +00:00
Daniel Ehrenberg
4b58b82992 [test] test262 roll
Additionally, drive-by add a test inspired by a worrying TODO
in the parser.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng,master.tryserver.v8:v8_linux64_msan_rel,v8_linux64_tsan_rel,v8_linux_arm64_dbg,v8_linux_gc_stress_dbg,v8_linux_noi18n_rel_ng,v8_linux_nosnap_rel

Change-Id: I693a858a638753f8c1091f2f9086710f628b40dd
Reviewed-on: https://chromium-review.googlesource.com/553677
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46634}
2017-07-13 13:03:56 +00:00
Michael Starzinger
5d16e866e7 Revert "[flags] Remove some dead Crankshaft flags."
This reverts commit ec6da23bfe.

Reason for revert: Requires infrastructure changes first. Will reland after changes have happened.

Original change's description:
> [flags] Remove some dead Crankshaft flags.
> 
> R=​bmeurer@chromium.org
> BUG=v8:6408
> 
> Change-Id: I34abbcdc2fc47df44938bac0e59f9982c935c657
> Reviewed-on: https://chromium-review.googlesource.com/569963
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46631}

TBR=mstarzinger@chromium.org,bmeurer@chromium.org

Change-Id: Iee077911ae7d877c6a9d2edb548e3c04345b47ce
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6408
Reviewed-on: https://chromium-review.googlesource.com/570049
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46632}
2017-07-13 12:24:56 +00:00
Michael Starzinger
ec6da23bfe [flags] Remove some dead Crankshaft flags.
R=bmeurer@chromium.org
BUG=v8:6408

Change-Id: I34abbcdc2fc47df44938bac0e59f9982c935c657
Reviewed-on: https://chromium-review.googlesource.com/569963
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46631}
2017-07-13 11:56:14 +00:00
Clemens Hammacher
199a26f735 Revert "[wasm] Don't store global handles in the interpreter"
This reverts commit 5648aad553.

Reason for revert: Compile error on mips:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/10732

Original change's description:
> [wasm] Don't store global handles in the interpreter
> 
> Storing global handles in the interpreter is dangerous, because the
> global handles are strong roots into the heap. The interpreter itself is
> referenced from the heap via a Managed. Hence the interpreter keeps the
> instance alive, while the instance keeps the Managed alive. So the GC
> will never collect them.
> 
> This CL refactors this to only store the handle to the instance object
> while executing in the interpreter, and clearing it when returning.
> It also removes the cache of import wrappers, as it should not be
> performance critical, but keeps lots of objects alive. If it turns out
> to be performance critical, we will have to reintroduce such a cache
> stored in the WasmDebugInfo object.
> 
> R=​titzer@chromium.org
> CC=ahaas@chromium.org
> 
> Bug: chromium:610330
> Change-Id: I54b489dadc16685887c0c1a98da6fd0df5ad7cbb
> Reviewed-on: https://chromium-review.googlesource.com/567058
> Reviewed-by: Ben Titzer <titzer@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46629}

TBR=titzer@chromium.org,clemensh@chromium.org

Change-Id: Ifadfb885f937f37bb3eab4732a97f20ff40c2583
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:610330
Reviewed-on: https://chromium-review.googlesource.com/569962
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46630}
2017-07-13 11:04:36 +00:00
Clemens Hammacher
5648aad553 [wasm] Don't store global handles in the interpreter
Storing global handles in the interpreter is dangerous, because the
global handles are strong roots into the heap. The interpreter itself is
referenced from the heap via a Managed. Hence the interpreter keeps the
instance alive, while the instance keeps the Managed alive. So the GC
will never collect them.

This CL refactors this to only store the handle to the instance object
while executing in the interpreter, and clearing it when returning.
It also removes the cache of import wrappers, as it should not be
performance critical, but keeps lots of objects alive. If it turns out
to be performance critical, we will have to reintroduce such a cache
stored in the WasmDebugInfo object.

R=titzer@chromium.org
CC=ahaas@chromium.org

Bug: chromium:610330
Change-Id: I54b489dadc16685887c0c1a98da6fd0df5ad7cbb
Reviewed-on: https://chromium-review.googlesource.com/567058
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46629}
2017-07-13 10:56:34 +00:00
Pierre Langlois
f30ce4e4c1 [arm] Use the converter when printing general registers
When disassembling some instructions we would print `r12`, which can be
confusing when the rest of the disassembly consistently uses `ip`.

Bug: 
Change-Id: Id4cfc5805ef102a0845cdaaa8390e618ee981b19
Reviewed-on: https://chromium-review.googlesource.com/570038
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#46628}
2017-07-13 10:52:29 +00:00
Clemens Hammacher
7c00e15bc9 [base] Consolidate IsPowerOfTwo{32,64} and IS_POWER_OF_TWO
There is just one version now, called IsPowerOfTwo. It accepts any
integral type.
There is one slight semantical change: Called with kMinInt, it
previously returned true, because the argument was implicitly casted to
an unsigned. It's now (correctly) returning false, so I had to add
special handlings of kMinInt in machine-operator-reducer before calling
IsPowerOfTwo on that value.

R=mlippautz@chromium.org,mstarzinger@chromium.org,jgruber@chromium.org,ishell@chromium.org,yangguo@chromium.org

Change-Id: Idc112a89034cdc8c03365b778b33b1c29fefb38d
Reviewed-on: https://chromium-review.googlesource.com/568140
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46627}
2017-07-13 10:49:09 +00:00
Clemens Hammacher
69e7be8539 [base] Accept several values for USE
This CL changes the USE macro to accept more than one parameter.
This is particularly interesting for calling a method on each type in a
parameter pack, as in:

template<typename... T>
void foo(T&&... ts) {
  USE(do_something(ts)...);
}

Drive-by fix: Allow to pass arbitrary types to USE, including
references. This might prevent a copy for pass-by-value.

R=ishell@chromium.org, tebbi@chromium.org

Also-by: tebbi@chromium.org
Change-Id: I544e83bb996aaa638e7512295973dd3e742254bc
Reviewed-on: https://chromium-review.googlesource.com/567507
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46626}
2017-07-13 10:15:06 +00:00
Clemens Hammacher
485786b43a [wasm] Fix wrong DCHECK
It's ok that the instance of the called code object is different from
the caller instance. This happens if one instance calls an exported
function of another instance.

R=ahaas@chromium.org

Bug: chromium:739768
Change-Id: I6afa8332a9b33fe32e9332cdca573053f058421d
Reviewed-on: https://chromium-review.googlesource.com/568494
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46624}
2017-07-13 09:35:36 +00:00
Igor Sheludko
b90e83f5da [runtime] Add shortcuts for elements kinds transitions.
The shortcuts ensure that field type generalization is properly
propagated in the transition graph.

Bug: chromium:738763
Change-Id: Id701a6f95ed6ea093c707fbe0bac228f1f856e9f
Reviewed-on: https://chromium-review.googlesource.com/567992
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46622}
2017-07-13 09:16:56 +00:00
Michael Starzinger
533f0e3f7b [turbofan] Fix type for HOLEY_DOUBLE_ELEMENTS loads.
This correctly types values loaded via {LoadElement} nodes from arrays
of HOLEY_DOUBLE_ELEMENTS elements kind as {Type::NumberOrHole}. Even
though "the hole" is still encoded as a tagged NaN, the type system
still needs to consider it as a potential hole value.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-736575
BUG=chromium:736575

Change-Id: Ib869284900a4affb2ddaa1d2a96df9443dba6921
Reviewed-on: https://chromium-review.googlesource.com/567180
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46620}
2017-07-13 09:04:10 +00:00
Mike Stanton
acca8e287d [Turbofan] Inline Array.prototype.map
Bug: v8:1956
Change-Id: I41af0cf5eb2fbb9f1d9d4172f3f546bcc2a715dc
Reviewed-on: https://chromium-review.googlesource.com/548639
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46618}
2017-07-13 09:00:22 +00:00
Peter Marshall
d11da5891f [builtins] Allow TypedArray constructor to accept big negative numbers.
Previously we enforced that all lengths for ArrayLike objects must
be within Smi range, but all negative numbers should actually be first
converted to +0.

Bug: chromium:740372
Change-Id: If50de9ce0eeb7cb09e14b8e8803f434350d00508
Reviewed-on: https://chromium-review.googlesource.com/566867
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46615}
2017-07-13 06:43:53 +00:00
Ben Noordhuis
de3a85d1c1 Fix v8::Value::IsExternal() map check.
Insertion into a collection changes the map because of the addition of
the hash value property.  Check the root map, not the current map.

Fixes: https://github.com/nodejs/node/issues/14139
Change-Id: Iabcea5337323b9b6deffa1a06892c1cb749f2065
Reviewed-on: https://chromium-review.googlesource.com/566833
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46614}
2017-07-13 06:37:13 +00:00
agrieve
19ffed65ba Add js-perf-test to exercise v8_inspector::String16
BUG=chromium:738469

Review-Url: https://codereview.chromium.org/2962213002
Cr-Commit-Position: refs/heads/master@{#46612}
2017-07-13 00:22:02 +00:00
Sathya Gunasekaran
ea632716d7 [d8] Fix stack overflow when importing modules
Bug: chromium:740694
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ib23bca1942c25d8a9f32e12be3f7b50fc3ab55c8
Reviewed-on: https://chromium-review.googlesource.com/568222
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46611}
2017-07-12 23:39:51 +00:00
Ross McIlroy
aa69a48f78 Disable StringConcat bytecode.
Didn't seem to help and caused a couple of regressions.

BUG=v8:6243,chromium:740124

Change-Id: I72887ba245a524211dbf181c77d0cdc6d917d090
Reviewed-on: https://chromium-review.googlesource.com/568480
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46608}
2017-07-12 21:51:20 +00:00
Adam Klein
b56c0f7a7e [scope] Null out rare_data_ when aborting preparsing
When we abort preparsing, we have to reset the Scope state, to ensure
re-parsing will leave us in the proper Zone. Resetting of rare_data_
was missing, causing this to fail in some cases.

Bug: chromium:740803
Change-Id: I7ce70f9c4670eaf1b76745ae8231eb95625b0f4b
Reviewed-on: https://chromium-review.googlesource.com/568784
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46607}
2017-07-12 20:26:10 +00:00
Adam Klein
53fa87354e [tests] Skip slow test debug-step-prefix-bytecodes in debug mode
It's been regularly timing out on the Linux debug bot.

TBR=machenbach@chromium.org

Change-Id: I250fc55acb5d714c7060edb691eb9759a7d38a15
Reviewed-on: https://chromium-review.googlesource.com/568794
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46606}
2017-07-12 20:22:04 +00:00
Camillo Bruni
36421dc467 [literals] Disable double lazy boilerplate for literals containing Arrays
By creating the boilerplate only on the second instantiation we cannot
propagate back the elements transitions early enough. The resulting literals
would change the initial ElementsKind one step too late and already pollute
ICs that went to monomorphic state.

- Disable lazy AllocationSites for literals containing arrays
- Introduce new ComplexLiteral class to share code between ObjectLiteral
  and ArrayLiteral
- RegexpLiteral now no longer needs a depth_ field

Bug: v8:6517, v8:6519, v8:6211
Change-Id: Ia88d1878954e8895c3d00a7dda8d71e95bba005c
Reviewed-on: https://chromium-review.googlesource.com/563305
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46603}
2017-07-12 19:11:04 +00:00
Camillo Bruni
34874b3b19 Reland "[mjsunit] Improve mjsunit stracktrace readability"
This is a reland of f720d024dc
Original change's description:
> [mjsunit] Improve mjsunit stracktrace readability
> 
> Format the function name and file-position into proper columns to easily spot
> where the test code ends and the mjsunit framework code starts.
> 
> BEFORE:
> Stack: Error
>     at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
>     at failWithMessage (test/mjsunit/mjsunit.js:310:11)
>     at fail (test/mjsunit/mjsunit.js:327:12)
>     at assertEquals (test/mjsunit/mjsunit.js:398:7)
>     at closure (test/mjsunit/regress/regress-4121.js:20:7)
>     at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
>     at test (test/mjsunit/regress/regress-4121.js:37:5)
>     at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
>     at test/mjsunit/regress/regress-4121.js:49:6
>     at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
>     throw new MjsUnitAssertionError(message);
> 
> AFTER:
> Stack: MjsUnitAssertionError
>     at assertEquals          test/mjsunit/mjsunit.js 398:7
>     at closure               test/mjsunit/regress/regress-4121.js 20:7
>     at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
>     at test                  test/mjsunit/regress/regress-4121.js 37:5
>     at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
>     at                       test/mjsunit/regress/regress-4121.js 49:6
>     at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
>     throw new MjsUnitAssertionError(message);
> 
> 
> Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
> Reviewed-on: https://chromium-review.googlesource.com/563627
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46589}

Change-Id: I44bf07f7be4114369315605542cafd17345b4397
Reviewed-on: https://chromium-review.googlesource.com/567063
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46602}
2017-07-12 19:01:21 +00:00
Adam Klein
873d51673a Propagate exceptions from JSFunction::SetName as needed
JSFunction::SetName can fail if it tries to create a string with
length > String::kMaxLength (either by prepending "set "/"get " or
by surrounding a Symbol descriptor with "["/"]").

This patch propagates that exception to the surrounding code rather
than CHECK-failing.

Bug: chromium:740398
Change-Id: I394943af481f3147387dd82ec5862d7071d57827
Reviewed-on: https://chromium-review.googlesource.com/566092
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46601}
2017-07-12 18:32:39 +00:00
Daniel Clifford
1f9734d5d7 Disambiguate DCHECKs from CHECKs in their output message
This makes it possible for automated tests to distinguish between CHECK
failures and DCHECK failures, the latter of which will continue to run
in release builds after the assertion failure point.

Change-Id: Ie26978c0342d401a8c85f3261749739195087579
Reviewed-on: https://chromium-review.googlesource.com/565515
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46596}
2017-07-12 14:54:34 +00:00
Georg Neis
c86ad81b5b Revert "[mjsunit] Improve mjsunit stracktrace readability"
This reverts commit f720d024dc.

Reason for revert: Bot failure at
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/15690

Original change's description:
> [mjsunit] Improve mjsunit stracktrace readability
> 
> Format the function name and file-position into proper columns to easily spot
> where the test code ends and the mjsunit framework code starts.
> 
> BEFORE:
> Stack: Error
>     at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
>     at failWithMessage (test/mjsunit/mjsunit.js:310:11)
>     at fail (test/mjsunit/mjsunit.js:327:12)
>     at assertEquals (test/mjsunit/mjsunit.js:398:7)
>     at closure (test/mjsunit/regress/regress-4121.js:20:7)
>     at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
>     at test (test/mjsunit/regress/regress-4121.js:37:5)
>     at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
>     at test/mjsunit/regress/regress-4121.js:49:6
>     at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
>     throw new MjsUnitAssertionError(message);
> 
> AFTER:
> Stack: MjsUnitAssertionError
>     at assertEquals          test/mjsunit/mjsunit.js 398:7
>     at closure               test/mjsunit/regress/regress-4121.js 20:7
>     at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
>     at test                  test/mjsunit/regress/regress-4121.js 37:5
>     at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
>     at                       test/mjsunit/regress/regress-4121.js 49:6
>     at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
>     throw new MjsUnitAssertionError(message);
> 
> 
> Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
> Reviewed-on: https://chromium-review.googlesource.com/563627
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46589}

TBR=machenbach@chromium.org,cbruni@chromium.org,ishell@chromium.org

Change-Id: I631cec7f318637ce2f60500e2bf0ab7fe1f6d09e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/567062
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46592}
2017-07-12 14:02:36 +00:00
jgruber
645a1ea5dd [coverage] Move source ranges out of AST
This CL moves collected source range information out of AST nodes
and into a side table stored on ParseInfo. The side table is only 
created if block coverage is enabled, so there's almost no memory
overhead in the standard case.

Change-Id: I41871b8425ebbc6217d82d3ad26b5fc9e5d68ecb
Reviewed-on: https://chromium-review.googlesource.com/566808
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46590}
2017-07-12 13:36:24 +00:00
Camillo Bruni
f720d024dc [mjsunit] Improve mjsunit stracktrace readability
Format the function name and file-position into proper columns to easily spot
where the test code ends and the mjsunit framework code starts.

BEFORE:
Stack: Error
    at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
    at failWithMessage (test/mjsunit/mjsunit.js:310:11)
    at fail (test/mjsunit/mjsunit.js:327:12)
    at assertEquals (test/mjsunit/mjsunit.js:398:7)
    at closure (test/mjsunit/regress/regress-4121.js:20:7)
    at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
    at test (test/mjsunit/regress/regress-4121.js:37:5)
    at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
    at test/mjsunit/regress/regress-4121.js:49:6
    at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
    throw new MjsUnitAssertionError(message);

AFTER:
Stack: MjsUnitAssertionError
    at assertEquals          test/mjsunit/mjsunit.js 398:7
    at closure               test/mjsunit/regress/regress-4121.js 20:7
    at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
    at test                  test/mjsunit/regress/regress-4121.js 37:5
    at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
    at                       test/mjsunit/regress/regress-4121.js 49:6
    at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
    throw new MjsUnitAssertionError(message);


Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
Reviewed-on: https://chromium-review.googlesource.com/563627
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46589}
2017-07-12 13:30:24 +00:00
Maya Lekova
7280d03b98 Implement micro-benchmark for Proxy call and construct
Bug: v8:6558, v8:6557
Change-Id: Ife58f78d00bfd53d6b904e838cbd028f039945b4
Reviewed-on: https://chromium-review.googlesource.com/567501
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46588}
2017-07-12 13:27:54 +00:00
Daniel Ehrenberg
cad3c5a166 [parser] Disallow async functions as destructuring targets
This patch teaches the parser that async functions are not valid
destructuring targets so that it can cleanly exit with a SyntaxError.
Previously, async functions used in the wrong position would lead
to a check failure.

Bug: chromium:740366
Change-Id: Ie5b0cf50326c3f96174c6b29d0ccedb5da4f75a2
Reviewed-on: https://chromium-review.googlesource.com/567002
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46587}
2017-07-12 13:21:54 +00:00
Michael Starzinger
0a4ad44050 [turbofan] Fix inline JSGeneratorObject allocation.
This makes sure the inline allocation of generator objects only shrinks
initial maps when slack tracking is actually in progress. Shrinking all
unused properties unconditionally is bogus because instances using them
might have become unreachable and collected by the GC.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-741078
BUG=chromium:741078

Change-Id: Iaf2f08a4fa82c820a945bf012d24c760a6b4f514
Reviewed-on: https://chromium-review.googlesource.com/567982
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46585}
2017-07-12 12:47:22 +00:00
Daniel Ehrenberg
8345cd3e09 [tests] Fix timezone dependence in an intl test
In certain timezones, being at noon UTC doesn't guarantee that
you'll be the same day in local time. This patch fixes that
false assumption. Thanks to Holmes He for reporting the issue.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I7432c0eb1e13fdf11c665e59dabaebeb79bff8c8
Reviewed-on: https://chromium-review.googlesource.com/568021
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46584}
2017-07-12 12:23:22 +00:00
Michael Starzinger
4a4bcda388 [turbofan] Introduce upper limit for table switch size.
This introduces 2^16 as an upper limit for the allowed value range of a
table switch on all architectures. It also fixes several overflows in
the table size calculation.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-736633
BUG=chromium:736633

Change-Id: I931bd226c99eb8a1ae1770c159fc314ff650bf57
Reviewed-on: https://chromium-review.googlesource.com/566829
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46575}
2017-07-12 08:35:26 +00:00
jgruber
3c260762da [string] Handle two-byte contents in String.p.toLowerCase
Previously (since f0e95769), this toLowerCase fast-path assumed
it would only see one-byte flat contents. Unfortunately, it's 
possible to have a one-byte sliced string that has a two-byte parent.

This CL ensures that String.p.toLowerCase handles such cases
correctly.

BUG=chromium:736451

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Iae056b3db5535bb5665439a5cc8282a51571a548
Reviewed-on: https://chromium-review.googlesource.com/565559
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46574}
2017-07-12 06:25:26 +00:00
Alexey Kozyatinskiy
292e96709c [inspector] catch exception during object.toString() call for console
Console methods should never throw an exception.

R=jgruber@chromium.org

Bug: chromium:736302
Change-Id: I05791b366d46a43b2a78825cbb8a82bb049110e6
Reviewed-on: https://chromium-review.googlesource.com/567434
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46573}
2017-07-12 06:01:42 +00:00
Sathya Gunasekaran
892d49a695 [runtime] Introduce PropertyArray
This patch changes the backing store of slow properties to be a
new instance type called PropertyArray.

Currently the only difference between this and a FixedArray is
the map. A future patch will change the length property to store
the hash code.

Bug: v8:5717, v8:6404
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iaebc98f42e6d93c1392772e6f837787beb64afec
Reviewed-on: https://chromium-review.googlesource.com/539028
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46569}
2017-07-11 22:48:54 +00:00
Michael Achenbach
c917ecfe4e Revert "[inspector] doesn't run user code to stringify console method arg"
This reverts commit 82451d45a7.

Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16923

Original change's description:
> [inspector] doesn't run user code to stringify console method arg
> 
> Otherwise user code can produce an exception and we will crash.
> 
> R=​jakob@chromium.org
> 
> Bug: chromium:736302
> Change-Id: I078150909b0348a63e8c375b508e34fc4751b4ab
> Reviewed-on: https://chromium-review.googlesource.com/565628
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46566}

TBR=kozyatinskiy@chromium.org,jgruber@chromium.org,jakob@chromium.org

Change-Id: I6d7e06fad2ab6c1c894c199fe7b3b6afb2930734
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:736302
Reviewed-on: https://chromium-review.googlesource.com/567060
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46567}
2017-07-11 19:27:49 +00:00
Alexey Kozyatinskiy
82451d45a7 [inspector] doesn't run user code to stringify console method arg
Otherwise user code can produce an exception and we will crash.

R=jakob@chromium.org

Bug: chromium:736302
Change-Id: I078150909b0348a63e8c375b508e34fc4751b4ab
Reviewed-on: https://chromium-review.googlesource.com/565628
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46566}
2017-07-11 17:18:42 +00:00
Clemens Hammacher
94d1509e7c [wasm] [fuzzer] Also test validation
After compiling a function, check that validation produces the same
success/error result.

R=ahaas@chromium.org

Change-Id: I617881e125dccff485f5572557b19709de488d55
Reviewed-on: https://chromium-review.googlesource.com/565722
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46561}
2017-07-11 13:43:32 +00:00
Michael Starzinger
933a874e1d [turbofan] Fix Reflect.getPrototypeOf on primitives.
This fixes the lowering of Reflect.getPrototypeOf and friends to not
perform a [[ToObject]] coercion, but bailout instead. We ensure to
exclude primitive values from the lowering. This makes the lowering
uniform between "Reflect.getPrototypeOf" and "Object.getPrototypeOf".

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-740116
BUG=chromium:740116

Change-Id: If986ee2a3ae4e8f1fd227bdeb4668f523b0dea84
Reviewed-on: https://chromium-review.googlesource.com/565295
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46556}
2017-07-11 12:45:12 +00:00
Ben L. Titzer
88c61f7b10 [mjsunit] Reenable wasm/gc-frame test in predictable mode.
Bug: v8:5803
Change-Id: Ib5a4af363057d217a269b38ef5c54b0399a2aa55
Reviewed-on: https://chromium-review.googlesource.com/566803
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46554}
2017-07-11 12:25:11 +00:00
Alexandre Talon
7a75da342f [Turbofan] Enable reducers to report their name to make reducer tracing clearer
Each reducer now has a virtual reducer_name function, returning its name
(the name of the class containing this reducer). This gets displayed when
using the --trace_turbo_reduction flag. Also when using this flags more
messages are displayed.

Actually when a node is replaced in-place (which is called an update
of the node), other reducers can still update it right after the
in-place replacement. When a node is really replaced (not in-place),
then we stop trying to apply reducers to it before we propagate the
reduction through the relevant nodes.

Before a message got printed only for the last reduction it went
through. So in case a node was reduced in-place several times
in a row, only the last update was printed, or none at all if after
being reduced in-place it got reduced by being replaced by another
node: only the non-in-place replacement was showed. 

Now each time an in-place reduction is applied to a node, a message
gets printed.

Bug: 
Change-Id: Id0f816fecd44c01d0253966c6decc4861be0c2fa
Reviewed-on: https://chromium-review.googlesource.com/563365
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Alexandre Talon <alexandret@google.com>
Cr-Commit-Position: refs/heads/master@{#46552}
2017-07-11 10:40:23 +00:00
Camillo Bruni
f8a7b0e99b [cleanup] Move mjsunit regression tests into test/mjsunit/regress
Change-Id: Ib1ce302489196b2fe98558cafe31d1f60a18db12
Reviewed-on: https://chromium-review.googlesource.com/566820
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46551}
2017-07-11 10:02:43 +00:00
jgruber
480b182f1a [coverage] Support switch statements
Switch statements generate a counter for each clause plus a continuation
counter.

Bug: v8:6000
Change-Id: Ic55a7efda54de1152bd5283d753119aa2764afbd
Reviewed-on: https://chromium-review.googlesource.com/558249
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46550}
2017-07-11 08:47:33 +00:00
Igor Sheludko
e2bf619127 [parser] Fix spread properties parsing.
Bug: chromium:734395
Change-Id: Ieb45948f6efd2ccecd3d1ed761eb9e4614903480
Reviewed-on: https://chromium-review.googlesource.com/563661
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46546}
2017-07-11 07:33:33 +00:00
Deepti Gandluri
c44228b78c [wasm] WebAssembly.Memory constructor should accept SharedArrayBuffers.
- Implement js-api changes for WebAssembly.Memory to accept a shared parameter
 - Update allocation to use SharedArrayBuffers

BUG=v8:6532

R=binji@chromium.org, bradnelson@chromium.org

Change-Id: I021491217568751b06fbd7b4b08b1dd88910e21d
Reviewed-on: https://chromium-review.googlesource.com/564058
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46543}
2017-07-10 22:37:48 +00:00
Alexey Kozyatinskiy
61ea32436d Reland "[parser] moved load property position after dot"
This is a reland of 5b44ba0e34
Original change's description:
> (Reland) [parser] moved load property position after dot
> 
> Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
> It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.
> 
> R=jgruber@chromium.org
> TBR=marja@chromium.org
> 
> Bug: v8:6425
> Change-Id: I05c21ca5e018da9c432c6bc963c7a96799336d1c
> Reviewed-on: https://chromium-review.googlesource.com/562879
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46484}

TBR=marja@chromium.org,jgruber@chromium.org
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng

Bug: v8:6425
Change-Id: I5eba5fe43ad31c5c781ffcc8c604cd9c98baa57e
Reviewed-on: https://chromium-review.googlesource.com/565907
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46542}
2017-07-10 22:17:58 +00:00
Karl Schimpf
0a5cbce468 Complete set of exception handling opcodes in decoder.
Adds missing opcodes for exception handling for the function body decoder.
Also adds error messages if the exception handling construct is not yet
functional.

Note that the previous prototype for catch and throw have been marked
as not yet functional. This was done because it doesn't model
exceptions the way the proposal suggests. Rather, they implement a
hard-coded (c++ model) of exceptions.

Bug: v8:6577
Change-Id: Ife170b9f0cb2be91b11082e43c4795ce81a427dc
Reviewed-on: https://chromium-review.googlesource.com/564138
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46540}
2017-07-10 20:03:28 +00:00
Karl Schimpf
9c43150541 Decode the exception section.
Modifies V8 to be able to parse the exception section (defining
exception types), when the experimental_wasm_eh flag is true.

Bug: v8:6577
Change-Id: I5d8b3fddaf5b0dec6b14ddd0992f9fb883e8dc90
Reviewed-on: https://chromium-review.googlesource.com/561757
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46539}
2017-07-10 19:49:58 +00:00
Benedikt Meurer
1edb46cc04 [turbofan] Widen the fast-path for JSCreateArray.
This improves the general Array constructor call performance (w/o
usable AllocationSite feedback) in TurboFan by ~2x, i.e. for example
invoking the Array constructor like this

  var a = Array.call(undefined, n);

instead of

  var a = Array(n);

such that the CallIC doesn't know that it's eventually calling the
Array constructor.

It also thus changes the single argument Array constructor to always
return holey arrays. Previously the single argument case for the Array
constructor was somehow trying to dynamically detect 0 and in that case
returned a packed array instead of a holey one. That adds quite a lot
of churn, and doesn't seem to be very useful, especially since this
might lead to unnecessary feedback pollution later.

R=mvstanton@chromium.org

Bug: v8:2229, v8:5269, v8:6399
Change-Id: I3d7cb9bd975ec0e491e3cdbcf1230185cfd1e3de
Reviewed-on: https://chromium-review.googlesource.com/565721
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46538}
2017-07-10 19:16:38 +00:00
Adam Klein
be8983da7b [mjsunit] Skip regress-430201 on tsan builds due to timeouts
It's already skipped (for slowness) in debug, asan, and msan builds.

TBR=machenbach@chromium.org

Change-Id: I1d7cb38d88e621f6d14344426bc5f931b1d6ffcd
Reviewed-on: https://chromium-review.googlesource.com/565741
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46537}
2017-07-10 18:45:38 +00:00
Caitlin Potter
10b9c019ce [parser] avoid for-loop desugaring unless loop var may be captured
In https://chromium-review.googlesource.com/c/472247/, I avoided
running DesugarLexicalBindingsInForStatement() if there were no lexical
loop variables, the function was not resumable, and the variables are
not captured by eval or a function declaration.

I think it's now possible to limit this further, and only do the more
extensive desugaring if there's a function declaration / eval() call
in the loop body. `yield` and `await` are not an issue as those loop
variables are written to the register file and not lost.

This change just removes the `is_resumable()` condition. If it passes
tests, I think it's safe.

BUG=v8:4762, v8:5460, v8:6579

Change-Id: I92d0308ad9401c1338411bc9ae9021f978803d3a
Reviewed-on: https://chromium-review.googlesource.com/563587
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46536}
2017-07-10 18:06:18 +00:00
Benedikt Meurer
b707c602f0 Revert "[base] Make USE a variadic template"
This reverts commit 39e335c7cc.

Reason for revert: Breaks debug builds on Linux, especially mksnapshot fails now, i.e.:

FAILED: mksnapshot
python "../../build/toolchain/gcc_link_wrapper.py" --output="./mksnapshot" -- ../../third_party/llvm-build/Release+Asserts/bin/clang++ -pie -Wl,--fatal-warnings -fPIC -Wl,-z,noexecstack -Wl,-z,now -Wl,-z,relro -Wl,-z,defs -Wl,--no-as-needed -lpthread -Wl,--as-needed -fuse
-ld=gold -B../../third_party/binutils/Linux_x64/Release/bin -Wl,--threads -Wl,--thread-count=4 -Wl,--icf=all -m64 -Werror -Wl,--gdb-index --sysroot=../../build/linux/debian_jessie_amd64-sysroot -L../../build/linux/debian_jessie_amd64-sysroot/lib/x86_64-linux-gnu -Wl,-rpat
h-link=../../build/linux/debian_jessie_amd64-sysroot/lib/x86_64-linux-gnu -L../../build/linux/debian_jessie_amd64-sysroot/usr/lib/x86_64-linux-gnu -Wl,-rpath-link=../../build/linux/debian_jessie_amd64-sysroot/usr/lib/x86_64-linux-gnu -Wl,-rpath-link=. -Wl,--disable-new-dt
ags -rdynamic -nodefaultlibs -o "./mksnapshot" -Wl,--start-group @"./mksnapshot.rsp"  -Wl,--end-group   -ldl -lpthread -lrt -lc -lm -lgcc_s
../../src/elements.cc:3362: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)7>::Kind'
../../src/elements.cc:3362: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)8>::Kind'
../../src/elements.cc:3953: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)9>::Kind'
../../src/profiler/heap-snapshot-generator.cc:187: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<4ul>::kExpectedHeapGraphEdgeSize'
../../src/elements.cc:3953: error: undefined reference to 'v8::internal::(anonymous namespace)::ElementsKindTraits<(v8::internal::ElementsKind)10>::Kind'
../../src/profiler/heap-snapshot-generator.cc:198: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<4ul>::kExpectedHeapEntrySize'
../../src/profiler/heap-snapshot-generator.cc:199: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<8ul>::kExpectedHeapGraphEdgeSize'
../../src/profiler/heap-snapshot-generator.cc:200: error: undefined reference to 'v8::internal::(anonymous namespace)::SnapshotSizeConstants<8ul>::kExpectedHeapEntrySize'
clang: error: linker command failed with exit code 1 (use -v to see invocation)
ninja: build stopped: subcommand failed.

Original change's description:
> [base] Make USE a variadic template
> 
> This will allow for passing more than one variable. This is
> particularly interesting for calling a method on each type in a
> parameter pack, as in:
> 
> template<typename... T>
> void foo(T&&... ts) {
>   USE(do_something(ts)...);
> }
> 
> Drive-by fix: Allow to pass arbitrary types to USE, including
> references. This might prevent a copy for pass-by-value.
> 
> R=​ishell@chromium.org
> 
> Change-Id: I8f894d730bbcd195ed83705f98771994b4bc906f
> Reviewed-on: https://chromium-review.googlesource.com/565561
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46527}

TBR=clemensh@chromium.org,ishell@chromium.org

Change-Id: Ibd3f0529e7a3136c4bcac15443da3d9f8dde8510
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/565141
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46534}
2017-07-10 17:19:30 +00:00
Clemens Hammacher
39e335c7cc [base] Make USE a variadic template
This will allow for passing more than one variable. This is
particularly interesting for calling a method on each type in a
parameter pack, as in:

template<typename... T>
void foo(T&&... ts) {
  USE(do_something(ts)...);
}

Drive-by fix: Allow to pass arbitrary types to USE, including
references. This might prevent a copy for pass-by-value.

R=ishell@chromium.org

Change-Id: I8f894d730bbcd195ed83705f98771994b4bc906f
Reviewed-on: https://chromium-review.googlesource.com/565561
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46527}
2017-07-10 15:47:46 +00:00
titzer
11484e7e9b [wasm] Improve precision of slow DCHECK for WebAssembly-constructed internal objects.
BUG=chromium:740325
R=ahaas@chromium.org,mlippautz@chromium.org

Review-Url: https://codereview.chromium.org/2972353002
Cr-Commit-Position: refs/heads/master@{#46518}
2017-07-10 13:49:34 +00:00
jgruber
14e80e5c91 Add Smi::ToInt helper method
This adds a convenience method for the common Smi to int conversion
pattern.

Bug: 
Change-Id: I7d7b171c36cfec5f6d10c60f1d9c3e06e3aed0fa
Reviewed-on: https://chromium-review.googlesource.com/563205
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46516}
2017-07-10 13:33:03 +00:00
Daniel Clifford
f6d1dc40c8 Support holey elements kind (not double) in TF-inlined forEach
BUG=v8:1956
LOG=N
R=bmeurer@chromium.org

Change-Id: I190002227d3321df0f68e77f3b7b0a468446c493
Reviewed-on: https://chromium-review.googlesource.com/561011
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46513}
2017-07-10 13:09:53 +00:00
Maya Lekova
f2af839b19 [builtins] Port Proxy constructor to CSA.
Rename builtins-proxy.cc to builtins-proxy-gen.cc.

Bug: v8:6557, v8:6567
Change-Id: I0e52a0c0c6c9b307c33bb18ec36079bdfd4a89ef
Reviewed-on: https://chromium-review.googlesource.com/565278
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46511}
2017-07-10 12:15:53 +00:00
titzer
0c22df6555 [wasm] Allow full u32 range for table maximum in WebAssembly.Table constructor.
R=clemensh@chromium.org
BUG=chromium:740199

Review-Url: https://codereview.chromium.org/2977543002
Cr-Commit-Position: refs/heads/master@{#46508}
2017-07-10 11:18:45 +00:00
Ulan Degenbaev
5359d8680a [heap] Add support for multiple concurrent marking tasks.
BUG=chromium:694255

Change-Id: Ib0403a2d406428d2cd7896521abb6e95c3841c1c
Reviewed-on: https://chromium-review.googlesource.com/563364
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46505}
2017-07-10 10:16:52 +00:00
Andreas Haas
b2133cd615 [wasm] Handle invalid function index in the elements section correctly
An invalid I32V value as index could be used to get a valid
WasmFunction.

R=clemensh@chromium.org

Bug: chromium:735887
Change-Id: I5fbfa01fc3300d86a4a2ba9bcbb86fc02f231ef9
Reviewed-on: https://chromium-review.googlesource.com/561536
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46504}
2017-07-10 10:08:42 +00:00
Clemens Hammacher
5b11996a97 [wasm] Fix error output for duplicate exports
There are other things to export beside functions. Thus, also print the
export kind when printing an error for duplicate export names.

R=titzer@chromium.org

Change-Id: I7477040dda274a16cfd776d7ac8db6e50a197b97
Reviewed-on: https://chromium-review.googlesource.com/564940
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46503}
2017-07-10 09:53:32 +00:00
Igor Sheludko
fa41e3b218 [runtime] Create only one instance of %ThrowTypeError%.
... according to the spec ES#sec-%throwtypeerror%

Bug: v8:4034
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ia4f2d228397edf55447fe3e71402c8fc4589369a
Reviewed-on: https://chromium-review.googlesource.com/563214
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46498}
2017-07-10 08:26:02 +00:00
Benedikt Meurer
3b84cbfeb0 [builtins] Port Map and Set iterators to CodeStubAssembler.
This is the next step towards faster Map and Set iteration. It
introduces the appropriate instance types for Map and Set
iterators (following the pattern for Array iterators) and migrates
the following builtins to the CodeStubAssembler:

  - Set.prototype.entries
  - Set.prototype.values
  - Map.prototype.entries
  - Map.prototype.keys
  - Map.prototype.values
  - %SetIteratorPrototype%.next
  - %MapIteratorPrototype%.next

This already provides a significant performance boost for regular
for-of iteration of Sets and Maps, by a factor of 5-10 depending
on the input. The final step will be to inline some fast-paths
into TurboFan.

Drive-by-fix: Remove obsolete %IsJSSetIterator and %IsJSMapIterator
intrinsics and runtime functions.

TBR=jgruber@chromium.org

Bug: v8:6344, v8:6571, chromium:740122
Change-Id: I3ab0ee49e2afe8d4295707a5ecbd51adda621918
Reviewed-on: https://chromium-review.googlesource.com/563626
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46497}
2017-07-10 07:57:02 +00:00
Michael Achenbach
ed8df4dd4c Revert "(Reland) [parser] moved load property position after dot"
This reverts commit 5b44ba0e34.

Reason for revert: Layout tests:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16841

Original change's description:
> (Reland) [parser] moved load property position after dot
> 
> Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
> It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.
> 
> R=​jgruber@chromium.org
> TBR=marja@chromium.org
> 
> Bug: v8:6425
> Change-Id: I05c21ca5e018da9c432c6bc963c7a96799336d1c
> Reviewed-on: https://chromium-review.googlesource.com/562879
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46484}

TBR=kozyatinskiy@chromium.org,jgruber@chromium.org

Change-Id: If9d5fa5f46ed10a407559e9cf10d2a6a54dbe163
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6425
Reviewed-on: https://chromium-review.googlesource.com/564418
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46491}
2017-07-08 11:37:12 +00:00
Ben Smith
d433911c5d Make test262 agent more strict in broadcast/report
BUG=v8:6231

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I326ace8ee27e5347d26bae11b8061f4fe524db53
Reviewed-on: https://chromium-review.googlesource.com/562744
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46488}
2017-07-07 21:38:31 +00:00
Igor Sheludko
47dc8702fd [runtime] Don't swap function maps during bootstrapping.
... but use proper map for functions with readonly prototype from the start.

Bug: v8:6459
Change-Id: I432d4969822e7cc4c2ba83e103f550d1c4f2e234
Reviewed-on: https://chromium-review.googlesource.com/563199
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46487}
2017-07-07 18:29:01 +00:00
Alexey Kozyatinskiy
5b44ba0e34 (Reland) [parser] moved load property position after dot
Currently LdaNamedProperty bytecode for expressions like a.b has position before dot. This CL moves this location after dot.
It's important for later removing of Nop bytecodes in expressions like a.b() where a is local variable, property call and property load should have the same position.

R=jgruber@chromium.org
TBR=marja@chromium.org

Bug: v8:6425
Change-Id: I05c21ca5e018da9c432c6bc963c7a96799336d1c
Reviewed-on: https://chromium-review.googlesource.com/562879
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46484}
2017-07-07 14:57:10 +00:00
Alexey Kozyatinskiy
49ad05f68f [inspector] improved exception details for Runtime.evaluate with awaitPromise
Fetch message and stack trace from error object if Promise is rejected with native JS error.

Bug: v8:6249
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Icf84205eb9d16e860600b7cc916ddcb1922be040
Reviewed-on: https://chromium-review.googlesource.com/563096
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46483}
2017-07-07 14:23:32 +00:00
titzer
0a61361e47 [wasm] Use WeakFixedArray for list of instances sharing a WasmMemoryObject.
This CL refactors the WasmMemoryObject and WasmInstanceObject classes to
use WeakFixedArray instead of using a doubly-linked list of instances. This
simplifies the lifetime management of instances by not requiring them to
be unlinked from this list upon GC. It also simplifies the iteration over
the instances using a given WasmMemoryObject.

Note that, contrary to my naive assumption at the outset, it is still necessary for the InstanceFinalizer (called upon a WasmInstanceObject death) to unlink itself from a WasmMemoryObject's instances list, due to finalizer ordering.

R=deepti@chromium.org, mlippautz@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2972803002
Cr-Commit-Position: refs/heads/master@{#46482}
2017-07-07 13:52:21 +00:00
jgruber
b82f34e17d [coverage] Support throw/try/catch/finally
This adds support for exception control flow by adding a counter behind throw
statements (never incremented), as well as a counter for catch and finally
blocks.

Bug: v8:6000
Change-Id: I3959772c889b543ab5e186ad7cd710e55a8aec23
Reviewed-on: https://chromium-review.googlesource.com/558993
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46476}
2017-07-07 12:38:01 +00:00
titzer
17001a05c8 [wasm] Introduce instance types for WebAssembly.* objects.
This CL refactors the internal representation of JavaScript-exposed
WebAssembly objects to be more like other such objects in V8. By introducing
a new instance type for each of the JS-exposed types, we get more robust
typechecking without using embedder fields (which were previously used
when these objects where instance type JS_API_OBJECT).

In addition to the new instance types, the subclasses X of JSObject
(WasmInstanceObject, WasmMemoryObject, WasmModuleObject, WasmTableObject)
now have appropriate Is##X() methods on Object and are now robust.

BUG=v8:6547
CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2964943002
Cr-Commit-Position: refs/heads/master@{#46475}
2017-07-07 12:27:56 +00:00
Dusan Simicic
c16a39f23e MIPS[64]: Implement vector MSA instructions in simulator
Add support for and.v, or.v, nor.v, xor.v, bmnz.v, bmz.v, bsel.v MSA
instructions in mips32 and mips64 simulator.

Bug: 
Change-Id: Idf092a1c211959a096694485268fff379b612b77
Reviewed-on: https://chromium-review.googlesource.com/533075
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46474}
2017-07-07 12:10:51 +00:00
Andreas Haas
08688b3953 [arm] Pass float immediates to vmov as uint32_t
This CL changes for floats what https://chromium-review.googlesource.com/c/558964/
changed for doubles.

Original message:
On x86, signalling NaNs get converted to quiet NaNs when they get push
on the stack and popped again. This happens in the code generation for
arm, specifically for the vmov instruction with the immediate parameter.
This CL replaces the vmov function in assembler-arm to take the
immediate as a uint64_t instead of a double, to guarantee that the bit
pattern does not change even if the parameter is a signalling NaN.

New in this CL:
Although src/double.h existed already, src/float.h did not exist yet.
I created the file in this CL, and moved the classes Float32 and
Float64 there, which already existed in src/deoptimizer.h.

R=titzer@chromium.org, martyn.capewell@arm.com, v8-arm-ports@googlegroups.com

BUG=v8:6564

Change-Id: I6a3f1f154af9c8cd4bb8e7e856235d3eee5e9edd
Reviewed-on: https://chromium-review.googlesource.com/561009
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46473}
2017-07-07 11:58:10 +00:00
Ross McIlroy
d425306d53 Reland: Enable StringConcat bytecode.
BUG=v8:6243
TBR=jgruber@chromium.org,leszeks@chromium.org

Change-Id: Ib830681073f4d3de4e500bf6144c0df2f9f4873f
Reviewed-on: https://chromium-review.googlesource.com/562775
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46469}
2017-07-07 10:19:39 +00:00
Ilija Pavlovic
fe37d91345 MIPS[64]: Add tests for INS and EXT instructions.
This CL contains new created tests for instructions INS and EXT.

TEST=cctest/test-assembler-mips[64]/Ins,
     cctest/test-assembler-mips[64]/Ext
BUG=

Change-Id: Ie62037ee425a5cba3700c5025608fdada144add5
Reviewed-on: https://chromium-review.googlesource.com/561319
Commit-Queue: Miran Karić <Miran.Karic@imgtec.com>
Reviewed-by: Miran Karić <Miran.Karic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46468}
2017-07-07 08:37:57 +00:00
Georg Neis
4693278467 [mjsunit] SKIP a test that takes too long in arm64.debug simulator.
R=danno@chromium.org

Bug: 
Change-Id: Ic7017f4bbcdd23c157f8fdece7b960549d20e313
Reviewed-on: https://chromium-review.googlesource.com/561145
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46467}
2017-07-07 08:21:56 +00:00
Raphael Kubo da Costa
b9b8cc9bad Expose %ErrorPrototype% as an intrinsic in the public API.
Blink needs %ErrorPrototype% in order to properly set up the inheritance
chain from DOMException, as specified in WebIDL:
https://heycam.github.io/webidl/#es-DOMException-specialness

This patch is similar to commit 5ec1cddcd ("Expose %IteratorPrototype% as an
intrinsic in the public API"), with the difference that there was no entry
for %ErrorPrototype% in any of the mappings in contexts.h.

Bug: chromium:556950, chromium:737497
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iadc5b2b844f29f6c9640b6a89769d233931366e9
Reviewed-on: https://chromium-review.googlesource.com/559058
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Raphael Kubo da Costa (rakuco) <raphael.kubo.da.costa@intel.com>
Cr-Commit-Position: refs/heads/master@{#46464}
2017-07-07 06:42:59 +00:00
jgruber
bfc0bc8f83 [coverage] Add binary block coverage
This adds a new binary block coverage mode (in addition to the existing count
block coverage), as well as a few transformation passes to reduce the number of
uselessly reported ranges.

Bug: v8:6000
Change-Id: I4fb234ca015990d00aa2f1dccb87f76ba4748994
Reviewed-on: https://chromium-review.googlesource.com/552642
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46463}
2017-07-07 06:27:28 +00:00
Ross McIlroy
d8d8f8b316 [TurboFan] Add constant folding for StringConcat to NativeContextSpecialization.
Adds constant folding for the StringConcat bytecode to
NativeContextSpecialization. Can reduce operator to either a fully folded
constant string, or a JSAdd or a StringConcat with a reduced number of
operators.

BUG=v8:6243, chromium:738312

Change-Id: I6b2be6a3d95230a23f3c7390a4f7be5181c49a2a
Reviewed-on: https://chromium-review.googlesource.com/559146
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46461}
2017-07-06 22:37:32 +00:00
Ross McIlroy
a8dc60b429 [Interpreter] Fix issue with StringConcat dereferencing external thin strings.
If a thin string can be dereferenced for StringConcat we still need to check
whether the dereferenced string is a sequential string itself (it could be
an external string).

BUG=v8:6243

Change-Id: I146541512525726f092580512c0b5f02d33685a7
Reviewed-on: https://chromium-review.googlesource.com/558994
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46459}
2017-07-06 20:52:14 +00:00
Sathya Gunasekaran
d8e1c4840c [parser] Improve error message for destructuring non iterable
Print the object that is being destructured and update the error 
message.

Previously,
  d8> var [a] = {}
  (d8):1: TypeError: [Symbol.iterator] is not a function

Now,
  d8> var [a] = {}
  (d8):1: TypeError: {} is not iterable

Bug: v8:6513, v8:5532
Change-Id: I5cbfe7c7e20632bce1a48bd38a1b0c98d0ff0660
Reviewed-on: https://chromium-review.googlesource.com/557370
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#46457}
2017-07-06 19:57:44 +00:00
Josh Wolfe
aeb8f33204 [api] remove --harmony-function-tostring behavior from CompileFunctionInContext
The ')'-in-parameter checking is not necessary for
CompileFunctionInContext. The arguments array is expected to be an
array of identifiers, not an array of arbitrary strings that get
concatenated.

Furthermore, there's no reason to have the .toString() representation
look like it came from CreateDynamicFunction(), and in fact inserting
line breaks makes it more complicated to map line and column numbers
correctly.

Overall, the --harmony-function-tostring behavior only makes
CompileFunctionInContext worse, so this CL removes it.

R=littledan@chromium.org, adamk@chromium.org, caitp@igalia.com
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Bug: v8:4958
Change-Id: Ifbc8a83216ca6a6979da1199972aa65f4bee36c3
Reviewed-on: https://chromium-review.googlesource.com/558220
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Josh Wolfe <jwolfe@igalia.com>
Cr-Commit-Position: refs/heads/master@{#46456}
2017-07-06 18:55:04 +00:00
Andreas Haas
28cc5dc672 Reland [wasm] Allow the initialization of a single compilation unit
Tsan figured out that I called compilation_units_.empty() outside a
lock.

Original message:
This CL adds a new function {InitializeCompilationUnit} to initialize
a single compilation unit and not just all compilation units at once.
This is necessary for streaming compilation eventually. This also
required some refactoring on how the working queue for compilation units
works. Previously the synchronization was done with an atomic counter,
now it is done with a lock. Note that the code to finish compilation
of a module still only works if the working queue gets only empty when
all work is done. I plan to change this in a different CL.

Since the code would not be tested without streaming compilation, I added
an experimental flag and a test to test the new code.

R=clemensh@chromium.org, mtrofin@chromium.org

Change-Id: Ia83560d1c70f0802271a88c514e0d1cb0458f6c4
Reviewed-on: https://chromium-review.googlesource.com/561458
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46454}
2017-07-06 17:39:47 +00:00
Andreas Haas
641705e0c0 Reland [wasm] Check the size of a function body before storing it
In the original CL I moved an error check backwards, unfortunately
behind a vector lookup which should not happen when there is an error.
Now I also move the vector lookup backwards.

Original message:
We stored the size of a function body before we check that
these values are valid. This caused a failing DCHECK in the constructor
of WireBytesRef which checked for integer overflows. With this CL we
check the size of the function body before we create the WireBytesRef.

R=clemensh@chromium.org

Bug: chromium:738097
Change-Id: Ie65b3cfcbcd6bdb3f04b0760673d9c7b7a0d1057
Reviewed-on: https://chromium-review.googlesource.com/561519
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46453}
2017-07-06 17:37:57 +00:00
jgruber
8e17c151d3 [coverage] Reduce the number of reported ranges
This CL adds a few transformations that clean up the set of reported
source ranges. Duplicates, empty, and uncovered ranges are removed, and
nested/consecutive ranges are merged if possible.

BUG=v8:6000

Change-Id: I421ee35ce8292cfe84c1eea4f653762cea5d909d
Reviewed-on: https://chromium-review.googlesource.com/558411
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46450}
2017-07-06 15:42:05 +00:00
Michael Lippautz
94b1b48b38 [heap] Introduce PromtionWorklist
Replaces the old PromotionQueue that was kept at the end of to space.

This change allows a future implementation to use 
(a) a thread-local promotion list and 
(b) enables work stealing for concurrent scenarios.

Bug: chromium:738865
Change-Id: I4c983a36e69ad4a9462eb9a59f586a85e51acbde
Reviewed-on: https://chromium-review.googlesource.com/561141
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46446}
2017-07-06 13:39:38 +00:00
Michael Achenbach
2f8bb6cdf4 Revert "[wasm] Check the size of a function body before storing it"
This reverts commit 6c8aed76ff.

Reason for revert: Breaks some debug bots:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug/builds/16754
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/17654

Original change's description:
> [wasm] Check the size of a function body before storing it
> 
> We stored the size of a function body before we check that
> these values are valid. This caused a failing DCHECK in the constructor
> of WireBytesRef which checked for integer overflows. With this CL we
> check the size of the function body before we create the WireBytesRef.
> 
> R=​clemensh@chromium.org
> 
> Bug: chromium:738097
> Change-Id: I18f8b628c1499aae9c8e9340ea73c87f19e6f1d7
> Reviewed-on: https://chromium-review.googlesource.com/561000
> Commit-Queue: Andreas Haas <ahaas@chromium.org>
> Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46442}

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: Ifd533c0dee369c746bc97fea13275ebc09ed5eff
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:738097
Reviewed-on: https://chromium-review.googlesource.com/561517
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46445}
2017-07-06 12:52:00 +00:00
Andreas Haas
6c8aed76ff [wasm] Check the size of a function body before storing it
We stored the size of a function body before we check that
these values are valid. This caused a failing DCHECK in the constructor
of WireBytesRef which checked for integer overflows. With this CL we
check the size of the function body before we create the WireBytesRef.

R=clemensh@chromium.org

Bug: chromium:738097
Change-Id: I18f8b628c1499aae9c8e9340ea73c87f19e6f1d7
Reviewed-on: https://chromium-review.googlesource.com/561000
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46442}
2017-07-06 12:03:09 +00:00
Andreas Haas
124ff5322d [arm64] Clear the upper 32 bits after a TruncateDoubleToI
TruncateDoubleToI generated a 32-bit result but did not clear the upper
32 bits. This violated the invariant that the upper 32 bits should be
cleared when the result is 32 bits. This change fixes the bug mentioned
below. Clearing the upper 32 bits is also done on x64.

R=v8-arm-ports@googlegroups.com, titzer@chromium.org, martyn.capewell@arm.com

Bug: chromium:738952
Change-Id: I7e23e03fbed380ff08803db41fbae6382957ba08
Reviewed-on: https://chromium-review.googlesource.com/559671
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46440}
2017-07-06 11:29:18 +00:00
Camillo Bruni
78c74e68f7 [runtime] Fix Array.prototype.sort for large entries
Bug: chromium:737645
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Ib02b3082cec82dfbbc48b21609dde7499e87042e
Reviewed-on: https://chromium-review.googlesource.com/558868
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46438}
2017-07-06 10:45:52 +00:00
Georg Neis
9b3174b295 Don't dereference handles in (macro-)assembler functions used by TF.
Remove all IsHeapObject/IsSmi checks from assembler and also from
the macro-assembler functions that Turbofan code generation uses.

Note for porters: In case it's unclear which macro-assembler
functions need to be modified, it may be best to wait until I
split MacroAssembler in a followup-CL, which will make that clear.

Bug: v8:6048
Change-Id: Ife0735cc6f48713c9ec493faf2dac5e553d1c06b
Reviewed-on: https://chromium-review.googlesource.com/561015
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46436}
2017-07-06 10:33:18 +00:00
Juliana Franco
6cbeead055 Remove broken/unsafe FLAG_deopt_every_n_garbage_collections flag.
Also nuke the disabled test that still uses --deopt-every-n-garbage-collections.

Bug: v8:3389
Change-Id: I254f544b73271e768e7619e578535aaf7cef0530
Reviewed-on: https://chromium-review.googlesource.com/561005
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Cr-Commit-Position: refs/heads/master@{#46431}
2017-07-06 08:48:31 +00:00
Igor Sheludko
6cb999b97b [ic] Properly handle loads from global interceptor via prototype chain.
... when receiver is in dictionary mode.

Bug: v8:6490
Change-Id: Ic5a8d214adcc4efd4cb163cbc6b351c4e6b596af
Reviewed-on: https://chromium-review.googlesource.com/559548
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46428}
2017-07-06 08:09:12 +00:00
Pierre Langlois
8e84b715b2 [arm] Introduce UseScratchRegisterScope
Introduce a stripped down version of UseScratchRegisterScope for ARM and use it
inside the assembler and macro-assembler. At the exception of the Call
instructions, we now use this scope instead of using the ip register
directly. This is inspired from how the ARM64 backend works.

In general, the benefit of doing this is we can catch cases where ip is being
used both by the caller and by the assembler. But more specifically, TurboFan
reserves r9 as an extra scratch register because ip can already be used by the
assembler. With this utility, we can isolate the cases in the code generator
which need an extra register and potentially fix them, allowing us to give r9
back to the register allocator.

This patch uncovered places in the assembler where we were using ip
unconditionally when we could have re-used the destination register instead.

Bug: v8:6553
Change-Id: Ib7134e3ed64dd1f90baf209ae831ed8f644cac78
Reviewed-on: https://chromium-review.googlesource.com/544956
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46425}
2017-07-06 07:55:12 +00:00
Andreas Haas
00f4b33a65 [arm][turbofan] Pass double immediate to vmov as uint64_t
On x86, signalling NaNs get converted to quiet NaNs when they get push
on the stack and popped again. This happens in the code generation for
arm, specifically for the vmov instruction with the immediate parameter.
This CL replaces the vmov function in assembler-arm to take the
immediate as a uint64_t instead of a double, to guarantee that the bit
pattern does not change even if the parameter is a signalling NaN.

BUG=v8:6564

Change-Id: I062559f9a7ba8b0f560628e5c39621ca578c3e7d
Reviewed-on: https://chromium-review.googlesource.com/558964
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Reviewed-by: Martyn Capewell <martyn.capewell@arm.com>
Cr-Commit-Position: refs/heads/master@{#46418}
2017-07-05 14:17:38 +00:00
Mike Stanton
c633282daf [builtins] Array.map should transition output arrays.
If the input array is small, then the cost of a trip to the
runtime to transition the ElementsKind is too expensive.

Bug: 
Change-Id: Ib04f8567674a6f1f66f4c7263eba5fb4c58987aa
Reviewed-on: https://chromium-review.googlesource.com/544866
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46417}
2017-07-05 14:08:08 +00:00
Maya Lekova
02ce935ad3 Implement micro-benchmark for Proxies constructor
Bug: 
Change-Id: I95285260b0848c4c876498bfef0b13ffbe6855ad
Reviewed-on: https://chromium-review.googlesource.com/558297
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#46415}
2017-07-05 13:36:10 +00:00
Benedikt Meurer
01f6d352c9 [test] Add micro-benchmarks for Map and Set iterators.
Change-Id: I5fc90147ee7526b8b66d04f38e5e225741cf4642
Bug: v8:6571
Reviewed-on: https://chromium-review.googlesource.com/559342
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46412}
2017-07-05 12:22:17 +00:00
Leszek Swirski
a2fcdc7cc8 [runtime] Move profiler ticks from SFI to feedback vector
Instead of counting profiler ticks on the shared function info (which is
shared between native contexts), count them on the feedback vector
(which is not). This allows us to continue pushing optimization
decisions off the SFI, onto the feedback vector.

Note that a side-effect of this is that ICs don't have to walk the stack
to reset profiler ticks, as they can access the feedback vector directly
from their feedback nexus.

Change-Id: I232ae9e759fca75cd89d393148a4ff42caa2646f
Reviewed-on: https://chromium-review.googlesource.com/544888
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46411}
2017-07-05 12:04:50 +00:00
Dusan Simicic
6886f2ceed MIPS[64]: Implement MSA 2R instructions in simulator
Add support for pcnt.df, nlzc.df, nloc.df MSA instructions in mips32 and
mips64 simulator.

Bug: 
Change-Id: I15c2e832c317ff81ce3615b7bd269e039c978e93
Reviewed-on: https://chromium-review.googlesource.com/538654
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#46410}
2017-07-05 11:58:57 +00:00
machenbach
653f43d579 Revert of Set the current context to the function's context when entering to LAP. (patchset #14 id:540001 of https://codereview.chromium.org/2770003002/ )
Reason for revert:
Speculative: Seems to break webkit_unit_tests:
https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/23247
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Mac/builds/11038

Original issue's description:
> Set the current context to the function's context when entering to LAP.
>
> In case of LAP(lazy accessor pair), the function's creation context
> must be equal to the accessor holder's creation context, so this CL
> changes the current context to the accessor holder's creation context.
>
> BUG=v8:6156
>
> Review-Url: https://codereview.chromium.org/2770003002
> Cr-Commit-Position: refs/heads/master@{#46406}
> Committed: 18e73287dc

TBR=jochen@chromium.org,verwaest@chromium.org,mstarzinger@chromium.org,tebbi@google.com,yukishiino@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6156

Review-Url: https://codereview.chromium.org/2973593002
Cr-Commit-Position: refs/heads/master@{#46408}
2017-07-05 10:41:22 +00:00
Michael Lippautz
660fb963b1 [heap] Templatize worklist for arbitrary entry types
To be used with tuples of heap objects and sizes.

Bug: chromium:738865
Change-Id: I29d9cf98bb2097cc8e1616aaf19a251507ffbd9e
Reviewed-on: https://chromium-review.googlesource.com/559050
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46407}
2017-07-05 10:13:33 +00:00
yukishiino
18e73287dc Set the current context to the function's context when entering to LAP.
In case of LAP(lazy accessor pair), the function's creation context
must be equal to the accessor holder's creation context, so this CL
changes the current context to the accessor holder's creation context.

BUG=v8:6156

Review-Url: https://codereview.chromium.org/2770003002
Cr-Commit-Position: refs/heads/master@{#46406}
2017-07-05 09:57:31 +00:00
Georg Neis
eaaff1ade0 [macro-assembler] Remove unused Movupd.
R=jarin@chromium.org,bmeurer@chromium.org

Bug: 
Change-Id: Id22b6890723d0366e6f3db0bdbad40660f524b59
Reviewed-on: https://chromium-review.googlesource.com/558070
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46405}
2017-07-05 09:54:37 +00:00
Igor Sheludko
b78511bd4e [runtime] Cleanup JSFunction creation in bootstrapper.
This is a preliminary step before we stop swapping maps in the bootstrapper
(strict/sloppy map with writable prototype <-> readonly prototype).

Bug: v8:6459
Change-Id: I120550c10e98a234e283d79a8d408096601c92af
Reviewed-on: https://chromium-review.googlesource.com/558879
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46403}
2017-07-05 09:06:12 +00:00