Commit Graph

19742 Commits

Author SHA1 Message Date
Simon Zünd
b87e762324 [array] Only use fast-path in Array.p.fill for JSArrays
This CL changes Array.p.fill to use the baseline implementation
for everything other than JSArray.

One of the reasons is that shadowing the length property on
TypedArrays (and other ElementsKinds) is allowed and should be
respected by Array.p.fill. The fast-path for fill for TypedArrays
expects the indices to be clamped to the actual length of the
underlying backing store and not to some length property.

While this mismatch (and others) could probably be handled properly,
we do the conservative thing and only use the fast-path for specific
JSArrays.

R=jgruber@chromium.org

Bug: chromium:865312
Change-Id: Ib3050e3bfc22d47ca8597b6df34788dc2b59b6e1
Reviewed-on: https://chromium-review.googlesource.com/1142772
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#54558}
2018-07-19 12:15:42 +00:00
Dan Elphick
1bd483222a [cleanup] Fix uses of V8_DEPRECATE_SOON methods in v8
Change many uses of deprecated methods returning Locals to use the
MaybeLocal versions.

Also fix uses of Utf8Length to use the Isolate versions.

Bug: v8:7754
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ib89df12e6cc5ca50296d21b2bb51a3f3ed065dd4
Reviewed-on: https://chromium-review.googlesource.com/1142779
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54550}
2018-07-19 10:04:07 +00:00
Andreas Haas
4498a28231 [wasm] Make the output of --wasm-trace-memory more understandable
R=clemensh@chromium.org

Change-Id: I21d185c73dc22a79311f3b35b2602a00a4b96112
Reviewed-on: https://chromium-review.googlesource.com/1141743
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54547}
2018-07-19 09:49:36 +00:00
Sigurd Schneider
c7a9af61e6 Revert "[turbofan] Inline Number constructor in certain cases"
This reverts commit 9eca23e9ed.

Reason for revert: Clusterfuzz correctness issue

Original change's description:
> [turbofan] Inline Number constructor in certain cases
> 
> This CL adds inlining for the Number constructor if new.target is not
> present. The lowering is BigInt compatible, i.e. it converts BigInts to
> numbers.
> 
> Bug: v8:7904
> Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82
> Reviewed-on: https://chromium-review.googlesource.com/1118557
> Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54454}

TBR=jarin@chromium.org,neis@chromium.org,sigurds@chromium.org,bmeurer@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7904
Change-Id: Ie5fa6c1262b8acc33edb672a0124f4458fcded86
Reviewed-on: https://chromium-review.googlesource.com/1142777
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54544}
2018-07-19 09:13:26 +00:00
Leszek Swirski
c941f11abd [sfi] Remove SFI function identifier field
Remove the function identifier field from SharedFunctionInfo. This field
would store one of a) the function's inferred name, b) the "builtin
function id", or c) debug info. We remove these in turn:

a) The function's inferred name is available on the ScopeInfo, so like
   the start/end position we read it off either the ScopeInfo (for
   compiled functions) or the UncompiledData (for uncompiled functions).

   As a side-effect, now both UncompiledData and its subclass,
   UncompiledDataWithPreparsedScope, contain a pointer field. To keep
   BodyDescriptors manageable, we introduce a SubclassBodyDescriptor
   which effectively appends two BodyDescriptors together.

b) The builtin function id is < 255, so we can steal a byte from
   expected no. of properies (also <255) and store these together.
   Eventually we want to get rid of this field and use the builtin ID,
   but this is pending JS builtin removal.

   As a side-effect, BuiltinFunctionId becomes an enum class (for better
   storage size guarantees).

c) The debug info can hang off anything (since it stores the field it
   replaces), so we can attach it to the script field instead.

This saves a word on compiled function (uncompiled functions
unfortunately still have to store it in UncompiledData).

Bug: chromium:818642
Change-Id: I8b4b3a070f0fe328aafcaeac58842d144d12d996
Reviewed-on: https://chromium-review.googlesource.com/1138328
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54543}
2018-07-19 09:07:11 +00:00
Andreas Haas
8f07a87df0 [wasm][fuzzer] Do not execute code with potential non-determinism
The WebAssembly spec is not fully deterministic: the sign bit of NaN
can be arbitrary. This sign bit can be observed by several WebAssembly
opcodes. In the testcase the sign bit of NaN makes the difference
between terminating code and an infinite loop.

In the libfuzzer fuzzer we have to prevent infinite loops ourselves.
At the moment we do this by only execute generated code of WebAssembly
modules for which the interpretation of the code ends in a limited
number of steps. With the non-determinism described above we cannot
guarantee the absence of infinite loops with this method. Therefore
we stop now to execute generated code of WebAssembly modules for which
we observe possible non-determinism in the interpreter.

R=clemensh@chromium.org

Bug: chromium:863829
Change-Id: I461d67df87d672bed25d6c915ba7ea5134cb5890
Reviewed-on: https://chromium-review.googlesource.com/1141945
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54541}
2018-07-19 08:55:55 +00:00
Simon Zünd
4a6a631b5d [array] Use Array.p.fill baseline version if object is non-extensible
This CL fixes a bug where a fast-path was used on non-extensible
objects.

R=jgruber@chromium.org

Bug: chromium:865264,chromium:865285
Change-Id: Ie14c95b383a65576799c71576a5c0f9f8e1c29ca
Reviewed-on: https://chromium-review.googlesource.com/1142766
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#54539}
2018-07-19 06:53:11 +00:00
Ben Smith
6525dd1859 [Atomics] Workaround for d8 worker limit
The previous change to futex.js will spawn too many workers in d8 in
some test configurations, which will throw an error.

This CL works around that by spawning fewer workers for the
Atomics.notify tests.

TBR=adamk@chromium.org

Bug: v8:7338
Change-Id: I0f3583781e5352b4d6672d43a087dc56d920122d
Reviewed-on: https://chromium-review.googlesource.com/1142895
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54536}
2018-07-19 02:53:49 +00:00
Jakob Kummerow
8043f283f6 [test] Add test for Turbofan module namespace access
Turbofan support for property loads from module namespace objects
has been tested by the test/js-perf-tests/Modules/basic-namespace
benchmark, but so far not by the mjsunit suite. This CL adds such
a test.
This is a follow-up to 8d7379c066.

Change-Id: I3c4183d761693199e6bc8740b812279efcd791a0
Reviewed-on: https://chromium-review.googlesource.com/1142594
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54535}
2018-07-19 02:28:29 +00:00
Ben Smith
c79206b363 Add Atomics.notify as alias for Atomics.wake
At the May 2018 TC39 meeting, they decided to rename Atomics.wake to
Atomics.notify. This change adds Atomics.notify as an alias, but does
not remove Atomics.wake, which will be removed later.

This allows for embedders to use either name to prevent
breaking tests. When the tests are switched over, we can remove
Atomics.wake.

Bug: v8:7883
Change-Id: If057ebff162bde975c6e1b60d83a4662f144e81f
Reviewed-on: https://chromium-review.googlesource.com/1142290
Commit-Queue: Ben Smith <binji@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54534}
2018-07-19 00:14:29 +00:00
Yang Guo
0dd33901a1 Reland "[builtins] Add %IsTraceCategoryEnabled and %Trace builtins"
This is a reland of 8d4572a22b

Original change's description:
> [builtins] Add %IsTraceCategoryEnabled and %Trace builtins
>
> Adds the builtin Trace and IsTraceCategoryEnabled functions
> exposed via extra bindings. These are intended to use by
> embedders to allow basic trace event support from JavaScript.
>
> ```js
> isTraceCategoryEnabled('v8.some-category')
>
> trace('e'.charCodeAt(0), 'v8.some-category',
>       'Foo', 0, { abc: 'xyz'})
> ```
>
> Bug: v8:7851
> Change-Id: I7bfb9bb059efdf87d92a56a0aae326650730c250
> Reviewed-on: https://chromium-review.googlesource.com/1103294
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Fadi Meawad <fmeawad@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54121}

TBR=cbruni@chromium.org

Bug: v8:7851
Change-Id: Id063754b2834b3b6a2b2654e76e8637bcd6aa5f8
Reviewed-on: https://chromium-review.googlesource.com/1137071
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54532}
2018-07-18 22:49:40 +00:00
Clemens Hammacher
47fdf419f3 [mips][be] Skip test which fails with segfault
TBR=sigurds@chromium.org

No-Try: true
Bug: v8:7953
Change-Id: I188c5b0501c2f0cbf8dacdec21f3e86ebec88cd7
Reviewed-on: https://chromium-review.googlesource.com/1142404
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54528}
2018-07-18 19:17:49 +00:00
Leszek Swirski
6de8560209 [cleanup] Remove unused Isolate parameters
ReadOnlyRoots means that some added Isolate parameters are no longer
needed. So, we can remove them.

This patch was generated mostly automatically with a bespoke tool.

Bug: v8:7786
Bug: v8:7754
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ia44fd2a66652253f780e3674bf7fb431caef0493
Reviewed-on: https://chromium-review.googlesource.com/1136305
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54526}
2018-07-18 16:47:22 +00:00
Leszek Swirski
e8c5a51c3b [liveedit] Fix patching functions with start position zero
For a script '()=>42', the anonymous arrow function has both start and
end position the same as the script function itself. This causes issues
when sorting the SourcePositionEvents of the function, in two ways:

  * If the start positions are the same, we should order by *furthest*
    end position to ensure the stack is in the right order
  * If both start and end are the same, we need to order by function
    literal id to make sure that start order and end order are inversed.

Also, MapLiterals assumes that start+end position uniquely identifies a
function, which is false in this case, so we process the top-level
script function separately in MapLiterals.

Change-Id: I2b2185dc2825018b7ea44c7d0918238e9b1dd972
Reviewed-on: https://chromium-review.googlesource.com/1141741
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54525}
2018-07-18 16:20:22 +00:00
Simon Zünd
eeb583d8b8 [array] Move Array.p.fill to C++
This CL moves Array.p.fill from JavaScript to a C++ builtin. It has
a generic slow-path and fast-paths implemented via ElementsAccessor in
elements.cc.

R=cbruni@chromium.org

Bug: v8:7624
Change-Id: I8820e1195d2cd9b41c254058923ad9875aab067c
Reviewed-on: https://chromium-review.googlesource.com/1131130
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54522}
2018-07-18 14:06:24 +00:00
Yang Guo
a4e0aee306 [snapshot] no longer disable code caching when debugging
This is no longer necessary since we removed the debug context.

R=jgruber@chromium.org

Bug: v8:5530
Change-Id: Ibb9df3a1f139ee076296faedb80204e7fcc23197
Reviewed-on: https://chromium-review.googlesource.com/1134746
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54521}
2018-07-18 13:59:22 +00:00
Frank Tang
b819afeb4f [Intl] Implement Intl.RelativeTimeFormat.prototype.{format, formatToParts}
Spec: http://tc39.github.io/proposal-intl-relative-time/

Design Doc: go/add-intl.relativetimeformat-to-v8

Test: test262/intl402/RelativeTimeFormat/*, intl/relative-time-format/*

R=cira@chromium.org, gsathya@chromium.org

Bug: v8:7869
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ied95d601cf707db5d555f9d963b9b1f206e37331
Reviewed-on: https://chromium-review.googlesource.com/1124728
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54520}
2018-07-18 12:49:22 +00:00
Frank Tang
26c7aa8c86 [Intl] prototype Intl.Locale.prototype.maximize/minimize
Bug: v8:7684
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I8ee5aa4a2f481bbe4e47ab3889a9a6084b6b2943
Reviewed-on: https://chromium-review.googlesource.com/1137927
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54519}
2018-07-18 12:48:12 +00:00
Dan Elphick
4f19dac984 [explicit isolates] Remove final GetIsolate/GetHeaps
Strictly speaking there are some left in api.cc, but they are in
deprecated functions with non-deprecated alternatives.

Apart from changes made using tooling, this also modifies
FieldType::AsClass to return Map* rather than Handle<Map> and converts
its call sites to create the Handle when they need it - currently
several sites immediately dereference the Handle.

Also marks WasmDebugInfo as NeverReadOnlySpaceObject so GetIsolate and
GetHeap remain usable.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I7ea5048f97f140c757f651712b8c33a5c7e0ebc1
Reviewed-on: https://chromium-review.googlesource.com/1140302
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54513}
2018-07-18 08:16:54 +00:00
Marja Hölttä
9991fbd21f [in-place weak refs] Make NormalizedMapCache use in-place weak references.
Now we can finally get rid of Map::weak_cell_cache!

BUG=v8:7308

Change-Id: I87a06509bf638bf6833ea2ba1eca525fb4b15df1
Reviewed-on: https://chromium-review.googlesource.com/1128882
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54511}
2018-07-18 07:35:52 +00:00
Frank Tang
b7e108d601 [Intl] Use correct fallback values for options in Locale constructor
Fixes intl402/Locale/constructor-options-{casefirst,hourcycle,numeric}-invalid

Bug: v8:7684
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I43317f4bb1bb8422940faab1e5afa4162ed9ea11
Reviewed-on: https://chromium-review.googlesource.com/1137476
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54504}
2018-07-17 20:22:06 +00:00
Daniel Clifford
1062ffb958 [torque]: Implement structs
Struct are bundles of value types. They are essentially just shorthand
for passing around a group of individually defined values.

Struct types are declared like this:

  struct A {
    x: Smi;
    y: int32;
  }

and can be constructed explicitly like this:

  A{0, 0}

Structs can be used wherever other types are used (e.g. variables,
parameters, return values) except for parameter/return types of
builtins and runtime functions.

Struct use field access notation to set/get their values like this:

  let a: A = A{0, 0};
  let b: Smi = a.x;
  a.y = 0;

Change-Id: I9fd36a6514c37882831256a49a50809c5db75b56
Reviewed-on: https://chromium-review.googlesource.com/1122133
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54501}
2018-07-17 17:04:55 +00:00
Clemens Hammacher
16af1baac4 [Liftoff] Zero-extend i32 stack parameters
i32 stack parameters can be loaded by Turbofan as 64-bit value, hence
they would not be zero extended. If this loaded value is then passed to
Liftoff (which assumes zero-extended i32 values), we could use it for
memory accesses, which would be out of bounds.

R=mstarzinger@chromium.org

Bug: chromium:864509, v8:6600
Change-Id: I0f45a269b1fb1c2befc2e6bc660c559a88323767
Reviewed-on: https://chromium-review.googlesource.com/1140168
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54500}
2018-07-17 16:59:14 +00:00
Georg Neis
73b3bb5898 [turbofan] Brokerize CompilationDependencies.
Bug: v8:7790
Change-Id: I747dccb8dcae74c5c0837c0cd7f3dd285a4bd9c0
Reviewed-on: https://chromium-review.googlesource.com/1140304
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54497}
2018-07-17 15:02:50 +00:00
Max Moroz
3b0fd6bd24 [fuzzer] Fix OOM in v8_json_parser_fuzzer due to unnecessary long input.
Bug: Chromium:798921
Change-Id: I6cd3dbe49f586cdedfc70c6c6ad83391240a65d9
Reviewed-on: https://chromium-review.googlesource.com/1138550
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54494}
2018-07-17 14:25:27 +00:00
Timothy Gu
9eb96bb431 [api] Avoid needlessly calling descriptor interceptors
Reland part of https://chromium-review.googlesource.com/c/v8/v8/+/816515.

Change-Id: I72ad85ffd162fc0563fc25cdf35189e894f9dc82
Reviewed-on: https://chromium-review.googlesource.com/1138808
Commit-Queue: Timothy Gu <timothygu@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54492}
2018-07-17 14:12:07 +00:00
Dan Elphick
41fe0f2cb7 [explicit isolates] Remove GetIsolate from LayoutDescriptor
Pass Isolate directly into several LayoutDescriptor methods so they
don't call GetIsolate on unsafe objects.

Also marks DebugInfo as non-read-only (so our GetIsolate removal tools
stop trying to change BreakIterator::isolate() to call itself).

Bug: v8:7786
Change-Id: I626a83d603ab74f648c72eb50d027b3866cedceb
Reviewed-on: https://chromium-review.googlesource.com/1138326
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54490}
2018-07-17 13:33:54 +00:00
Clemens Hammacher
b2b2583d79 [turbofan] lea32 must create zero-extended value
The instruction selector currently sometimes emits a lea32 with an
offset of 0, which the code generator just ignores (emits no code at
all). This can result in the result of TruncateInt64ToInt32 to not be
zero extended.
This CL fixes that by disallowing lea32 instructions with 0 offset, and
fixing the instruction selector to generate a movl or just no code for
that case.

R=jarin@chromium.org

Bug: chromium:863810, v8:7947
Change-Id: I1b21fc5f0fda9ca3144917538c3d0bbf46601c33
Reviewed-on: https://chromium-review.googlesource.com/1137825
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54489}
2018-07-17 13:30:04 +00:00
Dan Elphick
55a348ceb4 [explicit isolates] Remove various GetIsolates
Ran GetIsolate/GetHeap removal script over all the header files included
into objects.cc. Affected classes include: ScriptContextTable
RuntimeCallTimerScope GlobalDictionaryShape Map LookupIterator
PrototypeIterator FixedArrayBuilder

Manually fixed up Map to mark its write operations as safe for
GetIsolate since they modify the object as so can't be done in RO_SPACE.

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2fd0960f085d1bcb4cf54b3418899ac0217917ca
Reviewed-on: https://chromium-review.googlesource.com/1138076
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54488}
2018-07-17 11:56:37 +00:00
Sergiy Byelozyorov
b7206fbdfb Reland "Update GN configs for v8_perf target to allow running perf tests in swarming"
This is a reland of f0a9a6a5ad

Original change's description:
> Update GN configs for v8_perf target to allow running perf tests in swarming
>
> This will allow us to migrate our deprecated configs to android_docker.
>
> R=machenbach@chromium.org
>
> Bug: chromium:838864
> Change-Id: I5f7db648520847aa2077e9fc2a5970e63daa9a50
> Reviewed-on: https://chromium-review.googlesource.com/1131944
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54441}

R=machenbach@chromium.org

Bug: chromium:838864
Change-Id: I35e1ab911ac3b5ddd8478faae4799ed5d7bbccbf
Reviewed-on: https://chromium-review.googlesource.com/1139973
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54484}
2018-07-17 08:40:17 +00:00
Marja Hölttä
c3dbef4db6 [in-place weak refs] Add & use PrototypeUsers (a specialized weak data structure)
It's a growing weak array which also has an API for marking slots empty (those
will then be filled before growing the array again).

This is a more efficient implementation than the corresponding feature in
FixedArrayOfWeakCells, because we chain the empty slots together.

BUG=v8:7308

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I335cd3f9cc7838c7f6ca350735b1503b2f5b8eed
Reviewed-on: https://chromium-review.googlesource.com/1090922
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54481}
2018-07-17 07:53:46 +00:00
Simon Zünd
b95def3488 [torque] Add local const bindings
This CL adds local const bindings. This means that instead of
generating TVARIABLEs for variables, we can generate simple TNodes.

Example:

macro FooBar(): {
  const kSomeSmi: Smi = 10;
  ...
}

This CL also enforces that variables with a constexpr type are bound
using 'const' and not 'let'.

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: Id20a18149df9fc374ce718bdb1478e3eabb6e6df
Reviewed-on: https://chromium-review.googlesource.com/1138316
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54479}
2018-07-17 07:21:46 +00:00
Frank Tang
a31bd4cb02 [Intl] Change PluralRules.prototype.resolvedOptions to return newly created array for pluralCategories
Test: test262/intl402/PluralRules/prototype/resolvedOptions/pluralCategories

Bug: v8:7830
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ie527f51fab67e63cf5bf56a1da883a3e16ce48ac
Reviewed-on: https://chromium-review.googlesource.com/1132339
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54477}
2018-07-17 00:40:36 +00:00
Dan Elphick
3dd5c6fe38 [string] deprecate String::Utf8Length
Deprecate String::Utf8Length in favor of a new, similar function that
takes the Isolate used for the String::Flatten call as an argument.

BUG: v8:7786

Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: Icaf04b272679fd853e9cdbe6c7088f63e9aacb95
Reviewed-on: https://chromium-review.googlesource.com/1124724
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54476}
2018-07-16 21:53:26 +00:00
Frank Tang
02fe0c2477 [Intl] Plumb through locale and options from Array#toLocaleString
Use the given locale and options when performing toLocaleString on each
individual element in a given array.

Bug: v8:7832
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I718a33c42e85819065599ee6bad59fb25afa7e15
Reviewed-on: https://chromium-review.googlesource.com/1132464
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54474}
2018-07-16 18:37:25 +00:00
Leszek Swirski
5dee5ade75 [sfi] Remove SFI function literal id field (reland^2)
SharedFunctionInfos store their original function literal's id. This is
also their index in the Script's SFI list.

The function literal id is only needed for lazy compilation and live edit,
and access only has to be fast in the former. So, we can move the SFI
function literal id field to UncompiledData, and if patching with live
edit, or discarding compiled code, we can perform a slower linear search
through the Script's SFI list.

This is a reland of
 1) https://chromium-review.googlesource.com/1082480 and
 2) https://chromium-review.googlesource.com/1128854
the differences being:
 1) caching the literal id on UncompiledData rather than always linearly
    searching the SFI list, and removing the unused runtime-liveedit.cc
    file instead of fixing it to support this change.
 2) clearing padding on UncompiledData now that it has 3 int32 fields,
    making its end unaligned on x64.

TBR=yangguo@chromium.org,marja@chromium.org,ulan@chromium.org,cbruni@chromium.org

Bug: chromium:818642
Change-Id: I58dcb12a2a60a680f662568da428e01189c62638
Reviewed-on: https://chromium-review.googlesource.com/1138325
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54473}
2018-07-16 16:38:28 +00:00
Max Moroz
087cc34788 [fuzzer] Fix timeout in v8_script_parser_fuzzer due to unnecessary long inputs.
Bug: Chromium:841975
Change-Id: Ife77805fa3977dc874087ca7ae810eded2ae1c55
Reviewed-on: https://chromium-review.googlesource.com/1136986
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Max Moroz <mmoroz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54468}
2018-07-16 14:29:24 +00:00
Sigurd Schneider
58578584d6 Revert "[sfi] Remove SFI function literal id field"
This reverts commit 1d4a1172f5.

Reason for revert: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/21989

Original change's description:
> [sfi] Remove SFI function literal id field
> 
> SharedFunctionInfos store their original function literal's id. This is
> also their index in the Script's SFI list.
> 
> The function literal id is only needed for lazy compilation and live edit,
> and access only has to be fast in the former. So, we can move the SFI
> function literal id field to UncompiledData, and if patching with live
> edit, or discarding compiled code, we can perform a slower linear search
> through the Script's SFI list.
> 
> This is a reland of
> https://chromium-review.googlesource.com/c/v8/v8/+/1082480
> but caching the literal id on UncompiledData rather than always linearly
> searching the SFI list. Also, removes the unused runtime-liveedit.cc file
> instead of fixing it to support this change.
> 
> Bug: chromium:818642
> Change-Id: I977bcca0dc72903ca476a7079d156cc8bbe88fde
> Reviewed-on: https://chromium-review.googlesource.com/1128854
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54464}

TBR=ulan@chromium.org,marja@chromium.org,yangguo@chromium.org,kozyatinskiy@chromium.org,cbruni@chromium.org,leszeks@chromium.org,verwaest@chromium.org

Change-Id: Icee5ee3ab7688b93e2963f91debed65a58164534
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:818642
Reviewed-on: https://chromium-review.googlesource.com/1138276
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54466}
2018-07-16 14:24:27 +00:00
Leszek Swirski
1d4a1172f5 [sfi] Remove SFI function literal id field
SharedFunctionInfos store their original function literal's id. This is
also their index in the Script's SFI list.

The function literal id is only needed for lazy compilation and live edit,
and access only has to be fast in the former. So, we can move the SFI
function literal id field to UncompiledData, and if patching with live
edit, or discarding compiled code, we can perform a slower linear search
through the Script's SFI list.

This is a reland of
https://chromium-review.googlesource.com/c/v8/v8/+/1082480
but caching the literal id on UncompiledData rather than always linearly
searching the SFI list. Also, removes the unused runtime-liveedit.cc file
instead of fixing it to support this change.

Bug: chromium:818642
Change-Id: I977bcca0dc72903ca476a7079d156cc8bbe88fde
Reviewed-on: https://chromium-review.googlesource.com/1128854
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54464}
2018-07-16 13:49:20 +00:00
Yang Guo
d5686a74d5 Extend hash seed to 64 bits
R=bmeurer@chromium.org, ulan@chromium.org

Bug: chromium:680662
Change-Id: I5e1486ad2a42db2998d5485a0c4e711378678e6c
Reviewed-on: https://chromium-review.googlesource.com/1136034
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54460}
2018-07-16 11:19:42 +00:00
Michael Starzinger
ed8a119f35 [wasm] Actually run worker-module.js test case.
R=clemensh@chromium.org
TEST=mjsunit/wasm/worker-module

Change-Id: I56c274c67354d534f86312ee8fe7b7761da8ca44
Reviewed-on: https://chromium-review.googlesource.com/1138074
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54456}
2018-07-16 10:46:46 +00:00
Sigurd Schneider
9eca23e9ed [turbofan] Inline Number constructor in certain cases
This CL adds inlining for the Number constructor if new.target is not
present. The lowering is BigInt compatible, i.e. it converts BigInts to
numbers.

Bug: v8:7904
Change-Id: If03b9f872d82e50b6ded7709069181c33dc44e82
Reviewed-on: https://chromium-review.googlesource.com/1118557
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54454}
2018-07-16 10:02:42 +00:00
Michael Starzinger
df7a027fd1 Factor out {CodeTracer} into a separate header file.
R=clemensh@chromium.org

Change-Id: Iab7210eaddb14c9ca8638cbc8d69206bbaf15462
Reviewed-on: https://chromium-review.googlesource.com/1134785
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54451}
2018-07-16 08:24:40 +00:00
Marja Hölttä
f128acee3b [parser] Fix import in arrow function parameters.
BUG=chromium:852765

Change-Id: Iaba84f6e52b08b3aee4c1529701239c049dceb9a
Reviewed-on: https://chromium-review.googlesource.com/1128875
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54450}
2018-07-16 07:57:19 +00:00
Bill Budge
d950fc4705 [wasm simd] Fuzz test the shuffle opcode
- Reorganizes shuffle tests into tabular form.
- Adds a test that composes random numbers of random shuffles to
  make new shuffles.
- Adds a test that generates functions to compute a complex expression
  consisting of shuffles, and compares interpreter results to compiled
  code results.
- Fixes a problem with temp register exhaustion on ARM 32-bit.
- Matches identity shuffles (returning first or second operand
  unchanged) and uses EmitIdentity() for these.

Bug: v8:6020
Change-Id: Ie41c14fee52a7406b1d32e731e050096400e12f5
Reviewed-on: https://chromium-review.googlesource.com/1119567
Commit-Queue: Bill Budge <bbudge@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54446}
2018-07-13 21:51:47 +00:00
Bill Budge
782b793bb6 Revert "Update GN configs for v8_perf target to allow running perf tests in swarming"
This reverts commit f0a9a6a5ad.

Reason for revert: Breaks V8 Android GN (dbg)
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Android%20GN%20%28dbg%29/12328

Original change's description:
> Update GN configs for v8_perf target to allow running perf tests in swarming
> 
> This will allow us to migrate our deprecated configs to android_docker.
> 
> R=​machenbach@chromium.org
> 
> Bug: chromium:838864
> Change-Id: I5f7db648520847aa2077e9fc2a5970e63daa9a50
> Reviewed-on: https://chromium-review.googlesource.com/1131944
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54441}

TBR=machenbach@chromium.org,sergiyb@chromium.org

Change-Id: I81ecd49ed69f2161931fce3836ba66462a101a25
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:838864
Reviewed-on: https://chromium-review.googlesource.com/1136716
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Bill Budge <bbudge@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54442}
2018-07-13 17:12:16 +00:00
Sergiy Byelozyorov
f0a9a6a5ad Update GN configs for v8_perf target to allow running perf tests in swarming
This will allow us to migrate our deprecated configs to android_docker.

R=machenbach@chromium.org

Bug: chromium:838864
Change-Id: I5f7db648520847aa2077e9fc2a5970e63daa9a50
Reviewed-on: https://chromium-review.googlesource.com/1131944
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54441}
2018-07-13 14:01:44 +00:00
Georg Neis
1319680217 [turbofan] Add a few missing AllowHandleAllocation scopes.
Also remove an unnecessary AllowHandleDereference scope.

Bug: chromium:863155, v8:7790
Change-Id: I37a6efb0595d09ccf0a1e653620060a16fc96247
Reviewed-on: https://chromium-review.googlesource.com/1136444
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54440}
2018-07-13 12:51:04 +00:00
Dan Elphick
c55875b493 [explicit isolates] Remove GetIsolate from objects.cc
All auto-generated with some fix-ups including marking the following
classes as NeverReadOnlySpaceObject so their GetIsolate/GetHeap methods
are safe to use:
Code, CodeDataContainer, AbstractCode, DeoptimizationData,
CompilationCacheTable, NormalizedMapCache, Script, SharedFunctionInfo

TBR=yangguo@chromium.org

Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I6cb5dcca88a0bc99b5afe80f553e06a661b5da3c
Reviewed-on: https://chromium-review.googlesource.com/1135306
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54439}
2018-07-13 12:42:14 +00:00
Dan Elphick
b3dbf26de7 [explicit isolates] Remove all GetIsolates from objects-inl.h
Bug: v8:7786
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I195d65ec77a838878db340599fc8a5de1c3e1324
Reviewed-on: https://chromium-review.googlesource.com/1135541
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54437}
2018-07-13 12:15:44 +00:00