Commit Graph

56438 Commits

Author SHA1 Message Date
Maciej Goszczycki
b5a0e7d942 [heap] Update HeapIterator and space iterator APIs to match other iterators
This makes the API more consistent and reduces the cognitive load of
switching between 'next' and 'Next'.

Bug: v8:9183
Change-Id: Ia81b874374626887d6af8c90f8ac185812f0573f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635689
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#61946}
2019-05-31 12:59:07 +00:00
Milad Farazmand
5d2bebfed8 PPC/s390: [Liftoff] Add histogram for bailout reasons
Port c354fb9cda

Original Commit Message:

    This CL adds a new enum {LiftoffBailoutReason}, and tracks this reason
    for each bailout. This will give us data to prioritize extensions of
    Liftoff for new proposals or last missing instructions. Since we also
    track the {kSuccess} case, we will also see what percentage of
    functions can be compiled with Liftoff overall.

R=clemensh@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: Iaf93d59780f62f03ccdcd5368ce4331e8b496f52
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1638004
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#61945}
2019-05-31 12:55:37 +00:00
Michael Achenbach
9c3f9ef350 [test] Switch off detect_stack_use_after_return on windows asan
Bug: chromium:967663
Change-Id: I1f2176dfeb435d10cc5c24cbba77119575315f03
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635893
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61944}
2019-05-31 12:27:27 +00:00
Maciej Goszczycki
ad6bc4852d [cleanup] Remove unreachable code in PagedSpaces
counter_ could never be RO_SPACE. Make sure RO_SPACE and OLD_SPACE are
marked as unreachable.

Added tests for PagedSpaces and SpaceIterator.

Bug: v8:9183
Change-Id: I97bc2b4e0e5af37363a1c628ca7d69d2790a97b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635696
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61943}
2019-05-31 11:31:17 +00:00
Maciej Goszczycki
f993a9c9cc [roheap] Inform lsan of leaked objects during read-only space set up
Without this, asan (rightfully) complains about read-only space leaking.

Because pages are manually allocated using mmap, a few objects within
them need to be explicitly ignored in addition to the read-only heap
itself.

This change re-adds lsan.h, with tweaks to make the type checking a bit
more lenient.

Bug: v8:7464
Change-Id: I0e2809930f3674e3f891e755b568ebb5194da461
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1622121
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#61942}
2019-05-31 11:14:17 +00:00
Maciej Goszczycki
17f741181c [cleanup] Remove unused 'executable' argument from InitializePage
Bug: v8:9183
Change-Id: I53ad134b6dc8611ba439b78f27bfc8e56a82169e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635697
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#61941}
2019-05-31 10:13:00 +00:00
Maciej Goszczycki
0086810381 [roheap] Switch to ReadOnlyHeap::Contains everywhere
ReadOnlySpace::Contains uses owner() which will eventually be set to
nullptr. Use ReadOnlyHeap::Contains instead.

Bug: v8:7464
Change-Id: I2b33c40b937768ff06536fb17be8d57727a8dd22
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635695
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#61940}
2019-05-31 10:11:50 +00:00
Clemens Hammacher
c354fb9cda [Liftoff] Add histogram for bailout reasons
This CL adds a new enum {LiftoffBailoutReason}, and tracks this reason
for each bailout. This will give us data to prioritize extensions of
Liftoff for new proposals or last missing instructions. Since we also
track the {kSuccess} case, we will also see what percentage of
functions can be compiled with Liftoff overall.

R=mstarzinger@chromium.org
CC=jwd@chromium.org

Change-Id: I42b6a14c5a298ddda7053c195e8b650dc1fe66dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634910
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61939}
2019-05-31 09:22:50 +00:00
Benedikt Meurer
2f37999438 [map] Remove Map::has_hidden_prototype().
The `FunctionTemplate::SetHiddenPrototype()` API was removed in a
previous CL, after being deprecated since beginning of the year. This
removes all the logic behind it, leaving us with just the special case
of the JSGlobalProxy which has the JSGlobalObject as its hidden prototype.

This gives us back one bit in `Map::bit_field2` and removes quite a bit
of complexity from the code base (especially due to previous work from
verwaest@ in this area).

Bug: v8:9267
Change-Id: Id04b59686212fe35a63c9451aa3e045f0766b9cc
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1619752
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61938}
2019-05-31 09:01:00 +00:00
Jaroslav Sevcik
8839d8f6e3 [turbofan] Rename Float64 truncation to OddballAndBigIntToNumber.
Truncation::Float64 is confusing; in reality, we mean that oddballs
and big-ints are identified with their ToNumber counterparts.

Bug: v8:9183
Change-Id: Ibcce990327ac7e01e36a2237ad39c374ac9922aa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632224
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61937}
2019-05-31 08:20:20 +00:00
Yang Guo
088eda6235 Add missing owners files
R=rmcilroy@chromium.org

Bug: v8:9247
Change-Id: I2644436fd44ecf0e206a81cf28071cccb49793df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635690
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61936}
2019-05-31 07:21:01 +00:00
v8-ci-autoroll-builder
dc152a7386 Update wasm-spec.
Rolling v8/test/wasm-js/data: bc7d300..41747be

Remove extraneous copyright from bikeshed document (#1030) (Ben Smith)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/41747be

[test/interpreter] Rounding edge cases for float literals (#1025) (Andreas Rossberg)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/4bf74f6

Editorial: Remove links from Number, Object when checking types (Daniel Ehrenberg)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/b8faae7

[interpreter] Fix edge cases for f32_convert_i64 (#1021) (Andreas Rossberg)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/356886f

[spec] Address feedback on section 4 (#1022) (Andreas Rossberg)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/9fd0547

[spec] Tweak wording (#966) (Andreas Rossberg)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/a0e1a7e

[spec][js-api] Fix some links (#1020) (Ben Smith)
https://chromium.googlesource.com/external/github.com/WebAssembly/spec/+/39646d1

TBR=ahaas@chromium.org,clemensh@chromium.org

Change-Id: I543114a3147fac367f9e03962b7cbbad172c9fd8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1638223
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61935}
2019-05-31 04:38:40 +00:00
v8-ci-autoroll-builder
7a0b4b9f34 Update V8 DEPS.
Rolling v8/build: 19aa2f3..355210a

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/7760fd2..b8451b7

Rolling v8/third_party/depot_tools: 9779b14..bad01ad

Rolling v8/tools/clang: 65e8ecf..1f646a8

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I5cf09857950c36a67630c3ed6e0cdf37202b4141
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1638222
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61934}
2019-05-31 03:36:50 +00:00
Yu Yin
e8ec743bf7 [mips][wasm-c-api] New call descriptor and stackframe kind.
port https://crrev.com/c/1632235 (65f3861) to mips.
Original Commit Message:
    So far, calls to Wasm C/C++ API functions reused the call descriptors
    of WasmImportWrappers, and the stack frame type of regular Wasm
    functions. This CL cleans that up by introducing separate implementations
    for both. No change in functionality or performance is expected.

Change-Id: I1d068e9baab403d714ddb31c26f97fa4e5becb41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635275
Commit-Queue: Yu Yin <xwafish@gmail.com>
Auto-Submit: Yu Yin <xwafish@gmail.com>
Reviewed-by: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61933}
2019-05-31 02:05:49 +00:00
Irina Yatsenko
73ad21b139 (Reland) Torquefy a few more types
WeakFixedArray, WeakArrayList, JSFinalizationGroup, JSFinalizationGroupCleanupIterator, WeakCell, JSWeakRef, BytecodeArray, SourcePositionWithFrameCache

Note: SourcePositionTableWithFrameCache doesn't derive from Tuple2 anymore.
Bug: v8:8952

Original CL: https://chromium-review.googlesource.com/c/v8/v8/+/1504433

Change-Id: I13f102b445c9ff3e1ebabe0cdf013c62bb6d771d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559212
Commit-Queue: Irina Yatsenko <irinayat@microsoft.com>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61932}
2019-05-30 20:35:22 +00:00
Suraj Sharma
d0cfb9d175 [torque] Derive CallHandlerInfo directly from Struct.
Bug: v8:8952
Change-Id: I37410feab6fb24b306ba8712013267ba1ff5bc5d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1618341
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61931}
2019-05-30 18:15:25 +00:00
Johannes Henkel
cb027fdb3e [DevTools] Use the encoding library in third_party/inspector_protocol directly.
This makes it so that v8 stops using the copy of the
endoding library in the template - that is,
third_party/inspector_protocol/lib/encoding_{h,cpp}.template -
and uses the C++ library directly instead. This is done
by having third_party/inspector_protocol/lib/Values_cpp.template
include it, which is configured in the
inspector_protocol_config.json.

Change-Id: I1f8f2541ac2ed588ca35249e383b4c569434022b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635598
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61930}
2019-05-30 17:47:50 +00:00
Dan Elphick
d83e4999f6 [interpreter] Fix LookupNameOfBytecodeHandler
Fixes LookupNameOfBytecodeHandler so it actually returns non-nullptr
values with embedded builtins enabled. Also now correctly handles wide
and extra-wide bytecodes and always works regardless of whether
ENABLE_DISASSEMBLER is set.

Bug: v8:9215
Change-Id: I787134f2145d02daaf5b50ecb6c174dfc129a4fe
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1635890
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61929}
2019-05-30 13:00:51 +00:00
Yang Guo
d64f582ae4 Add OWNERS files for src and test
Bug: v8:9247
Change-Id: Id6860e7b0f932990ac3cda39e369b0809e4f6a2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632072
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61928}
2019-05-30 04:51:21 +00:00
v8-ci-autoroll-builder
4a029a6475 Update V8 DEPS.
Rolling v8/build: c93f946..19aa2f3

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/5db62d3..7760fd2

Rolling v8/third_party/depot_tools: b97d193..9779b14

Rolling v8/third_party/googletest/src: f71fb4f..f5edb4f

Rolling v8/tools/clang: 64bb071..65e8ecf

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: Iafa053df8859ac7040338af3f6655c5c15b2a007
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1636487
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61927}
2019-05-30 03:50:31 +00:00
Yu Yin
a6973730b0 [mips][wasm-c-api] Save PC to the stack.
port https://crrev.com/c/1627539 to mips.

Change-Id: I18029495b6793fa1b981e28505a7c42842dacc97
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634629
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#61926}
2019-05-30 01:14:11 +00:00
Michael Mclaughlin
348cc6f152 Improve toString(radix) for doubles near zero
Currently, Number.prototype.toString(radix) often fails to produce the
least significant bit for doubles near zero. For example, for the
minimum double, 5e-324, toString(2) produces "0". This means that a
user cannot reliably get the exact binary or hexdecimal value of a
double from JavaScript using toString.

This patch makes a slight amendment to the DoubleToRadixCString
function, so that doubles where the gap to the next double is 5e-324
(i.e. doubles less than 2**-1021), are represented exactly in binary and
other power-of-two bases, and close to exactly otherwise. It results
in Number.prototype.toString producing the correct binary value for all
doubles.

R=jkummerow@chromium.org, mathias@chromium.org, yangguo@chromium.org

Bug: v8:9294
Change-Id: I71506149b7c4c0eac8c38675a1ee15fb4f36f9ef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631601
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61925}
2019-05-29 20:45:02 +00:00
Frank Tang
f75c90a6f6 [Intl] Move NumberFormat to LocalizedNumberFormatter
Speed up Intl.PluralRules constructor x3.4

$python -u tools/run_perf.py --binary-override-path  \
   out/x64.release/d8 --filter "JSTests/Intl" \
   test/js-perf-test/JSTests5.json

Score for NewIntlPluralRules
BEFORE  550  581  576
AFTER  1856 1978 1996


Bug: v8:9300
Change-Id: I76b4290aa433b1049e3ee770d391b86e468e967d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630134
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61924}
2019-05-29 19:25:52 +00:00
Johannes Henkel
b179dd8352 [DevTools] Roll inspector_protocol.
New revision: e8ba1a7665bdcd8336915d5ca4b390e0cf6b1f6f

Change-Id: I6a916f003a29b0b9436ad031bbd43eddfa189e63
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634938
Auto-Submit: Johannes Henkel <johannes@chromium.org>
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61923}
2019-05-29 18:53:41 +00:00
Z Duong Nguyen-Huu
211b4e543a Freeze proxy from sealed elements-kind object can normalize elements
Bug: chromium:966460
Change-Id: I418eab656510fe3f799f552e75be10140d25bcab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1625864
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#61922}
2019-05-29 18:05:28 +00:00
Milad Farazmand
863e208568 PPC/s390: s390: [cleanup] Avoid {Object::operator->}
Port 157b9181f4

Original Commit Message:

    Port 878ccb33bd

    Original Commit Message:

        This CL was generated by an automatic clang AST rewriter using this
        matcher expression:

          callExpr(
            callee(
              cxxMethodDecl(
                hasName("operator->"),
                ofClass(isSameOrDerivedFrom("v8::internal::Object"))
              )
            ),
            argumentCountIs(1)
          )

        The "->" at the expression location was then rewritten to ".".

R=miladfar@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I620c2104b649a75a01fd7a92dacadd652b23be7e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634931
Reviewed-by: Milad Farazmand <miladfar@ca.ibm.com>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#61921}
2019-05-29 15:14:30 +00:00
Milad Farazmand
f72c844aa7 PPC/s390: [wasm-c-api] Add tests and fixes
Port f5ab7d38be

Port 65f3861e3b

Original Commit Message:

    In a new test suite: "wasm-api-tests", using a new binary "wasm_api_tests",
    powered by gtest/gmock (like unittests).
    Also fix a bunch of issues that these tests uncovered, mostly to ensure
    that the stack is walkable.

R=jkummerow@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I9ec54193216d1b2024ee9c4f8f6dbda34bbf4586
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632354
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Joran Siu <joransiu@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#61920}
2019-05-29 14:22:59 +00:00
Andreas Haas
32171b40bf [wasm][fuzzer] Enable anyref for the wasm-compile fuzzer
The newly introduced select-with-type instruction is only available when
anyref is enabled.

R=clemensh@chromium.org

Bug: chromium:967998
Change-Id: Idcb9ab447eedb93fe5374726da162ca1c79b3f16
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634927
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61919}
2019-05-29 14:03:19 +00:00
Michael Lippautz
63ee0f2fe4 torque: Fix AccessCheckInfo definition
AccessCheckInfo is a struct which is initialized with undefined values
as placeholders. Update the definiton so that the verifier that could
run between allocation and setting a field is happy.

Bug: chromium:967433
Change-Id: I21b99645c01e109d7ba0b61a5366e1f66a7f98d5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634922
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61918}
2019-05-29 13:48:24 +00:00
Jakob Gruber
0c906df2b0 [inspector] Don't alloc invalid TypedArrays as previews
ArrayBuffer objects have a larger maximal size than TypedArray objects.
The inspector TypedArray objects to preview ArrayBuffer objects; ensure
we don't exceed the maximal size here.

Bug: chromium:964663,v8:9308
Change-Id: Ia787ff87c799a3f2ca073e36cb54e57e86dacae9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634921
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61917}
2019-05-29 13:24:14 +00:00
Maya Lekova
731a370b1f Fix correctness issue in proxy set trap
According to the spec, in case where the property is non-configurable and
non-writable, the value passed to the set trap should be compared to the data.
Instead, the trap result was compared, because of the misleading name of the
CheckGetSetTrapResult parameter.

Regression was introduced in
https://chromium-review.googlesource.com/c/v8/v8/+/1604071

Bug: chromium:966450
Change-Id: I77501980475da3aeb4f6153321da39e6fc2e6bd9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632238
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61916}
2019-05-29 13:16:49 +00:00
Michael Hablich
dadab3c483 Bump version to 7.7
TBR=machenbach@chromium.org
NOTRY=true

Change-Id: I1b095c0957f8cb4282bcd73993e2fd19631ffe86
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634925
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61915}
2019-05-29 12:47:18 +00:00
Jakob Kummerow
65f3861e3b [wasm-c-api] New call descriptor and stackframe kind
So far, calls to Wasm C/C++ API functions reused the call descriptors
of WasmImportWrappers, and the stack frame type of regular Wasm
functions. This CL cleans that up by introducing separate implementations
for both. No change in functionality or performance is expected.

Change-Id: I79301fa81da52283cc776ddf19d4712372f3a58b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632235
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61914}
2019-05-29 11:22:23 +00:00
Andreas Haas
f6e3993825 [wasm][anyref] Change element segment encoding
The proposal is changing accordingly, see
https://github.com/WebAssembly/reference-types/issues/36.

In our tests we were already using the new format implicitly, because
bulk-memory-operations are enabled by default. I noticed the missing
implementation when I executed spec tests with
--no-experimental-wasm-bulk-memory.

R=mstarzinger@chromium.org

Bug: v8:7581
Change-Id: I13aaba9a8d60e8542245aac7f0a072da1be357dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631591
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61913}
2019-05-29 11:08:17 +00:00
Jakob Gruber
b114cb4c64 [regexp] Make the interpreter backtracking stack growable
The backtracking stack (which is actually a generic stack) used to be
statically sized. At 10k elements, it was fairly large, but still easy
to overflow on large subject strings. This CL changes it to a
std::vector-based implementation instead which grows on-demand.

Drive-by: Add braces to the BYTECODE cases to make clang-format
produce a nicer output.

Bug: v8:8776
Change-Id: If41a444fe3d05f6d5be1be019129788a86e6118b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634914
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61912}
2019-05-29 11:00:57 +00:00
Clemens Hammacher
cbc352983e [Liftoff] List unsupported opcodes explicitly
This removes two default switch cases for unsupported opcodes, and
replaces them by explicit lists. This makes it easy to see what is
currently not supported in Liftoff. In a follow-up CL, each bailout
will be associated with a category to track which features currently
cause Liftoff to bailout.
This change also makes Liftoff crash (in UNREACHABLE) if invoked with
asm.js code. Hence, change the asm.js tests to not test Liftoff. In
production, we do not invoke Liftoff for asm.js anyway.

R=mstarzinger@chromium.org

Change-Id: I971c6146ed325103d14008c0e67a973a47a35bc2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634909
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61911}
2019-05-29 09:47:28 +00:00
Michael Starzinger
5b120949d2 Reland "[wasm] Store signature with {WebAssembly.Function} objects."
This is a reland of 8092acbe41

Original change's description:
> [wasm] Store signature with {WebAssembly.Function} objects.
> 
> This adds simple serialization and deserialization of the signature
> provided when a {WebAssembly.Function} object is constructed. For now
> this signature is only used by the {WebAssembly.Function.type} method,
> but will soon be used when importing such functions as well.
> 
> R=jkummerow@chromium.org
> TEST=mjsunit/wasm/type-reflection
> BUG=v8:7742
> 
> Change-Id: If4a687ea537d8c12f4f01a7d3ac5a795ceb999c6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632211
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61898}

Bug: v8:7742
Change-Id: I5d784165c460abd9d7b07f5cdafc746d5380ccd6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632159
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61910}
2019-05-29 08:59:08 +00:00
Yu Yin
f3248c6ef6 [mips64] Corrected grammatical error
see https://crrev.com/c/1630678
that patch modify this by mistake.

Change-Id: I7db0205a08beff3f7e6372d62dd810ef859c9fcc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1633932
Auto-Submit: Yu Yin <xwafish@gmail.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61909}
2019-05-29 07:35:03 +00:00
Benedikt Meurer
985f735323 [cleanup] Remove obsolete ElementsAccessor::kCopyToEnd.
Also generally cleanup the Copy* code in elements.cc a bit.

Bug: v8:9183
Change-Id: I4a56db1f0b382a4b9583cae3b47e4ce572393d9e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634249
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61908}
2019-05-29 06:27:43 +00:00
Georg Neis
060b9ec4a8 Temporarily remove --concurrent-inlining from --future
There's a still a bug in the serializer related to resumables. I know
what the problem is but I may not have time to prepare a fix this week.
Given that --future is enabled on some canaries, let's exclude
--concurrent-inlining for now.

Bug: v8:7790
Change-Id: I78331ae423239ee7f0417a49e9eb58601a9a1590
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1634189
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61907}
2019-05-29 05:35:03 +00:00
v8-ci-autoroll-builder
bb2c7bd330 Update V8 DEPS.
Rolling v8/build: 4cebfa3..c93f946

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/a7b3312..5db62d3

Rolling v8/third_party/depot_tools: 26af0d3..b97d193

Rolling v8/tools/clang: fe8ba88..64bb071

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I74025ba882b945cb2aeae34e9390a4426b8a5a8a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1633599
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#61906}
2019-05-29 03:46:43 +00:00
Georg Neis
b9d55654c8 [turbofan] Don't overwrite jump target serialization environment
A given target offset may already have an environment associated with
it (there can be multiple jumps to the same target). In that case we
used to throw away the previous environment. With this CL we merge the
environments instead.

Bug: v8:7790
Change-Id: I0c22182436fc48e29675e49627729a33cbeaaf4d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631603
Commit-Queue: Georg Neis <neis@chromium.org>
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61905}
2019-05-29 02:08:32 +00:00
Georg Neis
22ae88ad02 [turbofan] Kill serialization environment on Throw bytecodes
Kill the environment when encountering Throw, Rethrow or Abort, because
the following code may be dead.

Also add support for the SwitchOnSmi bytecode.

Bug: v8:7790
Change-Id: Ia925aec854fea031be1df88a6a924e4b0d0406e9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1631602
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61904}
2019-05-29 00:48:24 +00:00
Ross McIlroy
238dab8d2d [Tools] Update tickprocessor entry processing to work on Android symbols.
On Android libraries there are zero length entries within the ranged
symbols which break our range processing. This updates the logic to
only add entries for zero-length entries if they aren't within the range
of the previously added entry.

Change-Id: I511a6221817c535d967a50413948a29d9deb1e85
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627985
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61903}
2019-05-28 17:04:07 +00:00
Ross McIlroy
201c50951d [Tools] Add support to tickprocessor to symbolize libraries embedded in APKs
On Android we load the native library directly from the APK. As such,
we need to convert symbols from the mapped APK to the underlying .so
when symbolizing the ticks.

This CL adds a --apk-embedded-library argument to tick processor to enable
specifying which unstripped library file was embeded in the APK and enable
symbolizing.

Change-Id: Ic992825b831f984a1217eed71847bdb158eb992b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627546
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61902}
2019-05-28 16:18:47 +00:00
Seth Brenith
734c1456d9 [intl] Avoid a temporary allocation while converting to ICU string
If we need to build an icu::UnicodeString for a string that is currently
in one-byte representation, we first have to expand the string's content
into a two-byte representation. Doing so involves allocating an array,
which is slow. With this change, we can convert short strings on the
stack instead to save time. The cutoff length for what counts as "short"
is pretty arbitrary, but we believe many strings fit into an 80-column
line. This increases the score of cdjs in JetStream 2 by 35% on my
machine, because cdjs is basically a test of localeCompare throughput.

Bug: v8:9305

Change-Id: Iba081ac5a8fa7659edf06ac97ba8acf3f8328d59
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1630848
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61901}
2019-05-28 15:51:17 +00:00
Peter Marshall
e5dcf29ab1 [cleanup] Remove the trace_array_abuse flags
These are unused and unmaintained, there are probably a lot of paths by
now which don't funnel through this, so remove them.

Bug: v8:9183
Change-Id: I4b48034e396b3ee481ae87283ab9a860f2f41d1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632155
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61900}
2019-05-28 15:43:47 +00:00
Michael Starzinger
d46d3570cb Revert "[wasm] Store signature with {WebAssembly.Function} objects."
This reverts commit 8092acbe41.

Reason for revert: Causes UBSan warnings:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20UBSan/6436

Original change's description:
> [wasm] Store signature with {WebAssembly.Function} objects.
> 
> This adds simple serialization and deserialization of the signature
> provided when a {WebAssembly.Function} object is constructed. For now
> this signature is only used by the {WebAssembly.Function.type} method,
> but will soon be used when importing such functions as well.
> 
> R=​jkummerow@chromium.org
> TEST=mjsunit/wasm/type-reflection
> BUG=v8:7742
> 
> Change-Id: If4a687ea537d8c12f4f01a7d3ac5a795ceb999c6
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632211
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#61898}

TBR=jkummerow@chromium.org,mstarzinger@chromium.org

Change-Id: I56ea9df5db3f95c05068186097e298cb73a3675d
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7742
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632218
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61899}
2019-05-28 15:41:50 +00:00
Michael Starzinger
8092acbe41 [wasm] Store signature with {WebAssembly.Function} objects.
This adds simple serialization and deserialization of the signature
provided when a {WebAssembly.Function} object is constructed. For now
this signature is only used by the {WebAssembly.Function.type} method,
but will soon be used when importing such functions as well.

R=jkummerow@chromium.org
TEST=mjsunit/wasm/type-reflection
BUG=v8:7742

Change-Id: If4a687ea537d8c12f4f01a7d3ac5a795ceb999c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1632211
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61898}
2019-05-28 14:31:45 +00:00
Georg Schmid
2054dab3bc Add LoadFromObject and StoreToObject nodes, injected via Torque
R=tebbi@chromium.org

Change-Id: I30aab2663180382a078901c10e39cd1ad6c906f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1627541
Commit-Queue: Georg Schmid <gsps@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#61897}
2019-05-28 14:09:25 +00:00