Commit Graph

837 Commits

Author SHA1 Message Date
legendecas
cd77eb7bd7 [builtins] Fixes TypedArray ops behavior when the buffer was detached
After the parameter processing, the arraybuffer may have been detached.
TypedArray copyWithin/fill should throw in that condition. TypedArray
includes should return false if the search element is not undefined.

Change-Id: If507d0efa1dafbe3dcefcd368e5ea27406bb3df8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3144315
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#77103}
2021-09-27 19:08:20 +00:00
Georg Neis
165e725da8 Reland "[compiler] Fix a few test flakes and reenable the tests"
This is a reland of 5dde281c87,
after also fixing the ic-migrated-... test, in which an object died
too early.

Original change's description:
> [compiler] Fix a few test flakes and reenable the tests
>
> Bug: v8:12173
> Change-Id: I2983be9133f8ff4d1740e8eba05a3c29d603dfc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168270
> Auto-Submit: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76939}

Bug: v8:12173
Change-Id: If385e5c826b8470ef67f12705c5171f330f6cd57
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171353
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76946}
2021-09-20 18:16:06 +00:00
Clemens Backes
02505fd37b Revert "[compiler] Fix a few test flakes and reenable the tests"
This reverts commit 5dde281c87.

Reason for revert: Test still fails on gc-stress: https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Mac64%20GC%20Stress/19821/overview

Original change's description:
> [compiler] Fix a few test flakes and reenable the tests
>
> Bug: v8:12173
> Change-Id: I2983be9133f8ff4d1740e8eba05a3c29d603dfc3
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168270
> Auto-Submit: Georg Neis <neis@chromium.org>
> Reviewed-by: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#76939}

Bug: v8:12173
Change-Id: I402982540d6a06dc1ca8bbd87ae5f58a000f0c1a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3171352
Auto-Submit: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/main@{#76941}
2021-09-20 16:29:07 +00:00
Georg Neis
5dde281c87 [compiler] Fix a few test flakes and reenable the tests
Bug: v8:12173
Change-Id: I2983be9133f8ff4d1740e8eba05a3c29d603dfc3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3168270
Auto-Submit: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76939}
2021-09-20 15:23:37 +00:00
legendecas
4dc425c5f9 [builtins] TypedArray.prototype.set with number
Removes outdated type-error throwing on TypedArray.prototype.set
when the first argument is a number.

Bug: v8:11294
Change-Id: Ida3a46dec154b645620e2b064ded7a18de238649
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3136773
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76631}
2021-09-02 00:06:23 +00:00
legendecas
3926d6cde4 [builtins] typed array detaching in builtin iterations
%TypedArray.prototype% methods that receive a user callback
fn should not break in the mid-way of the iteration when the
backing array buffer was been detached. Instead, the iteration
should continue with the value set to undefined.

Notably, %TypedArray.prototype%.filter was throwing when the
backing buffer was detached during iteration. This should not
throw now.

Refs: https://github.com/tc39/ecma262/pull/2164
Bug: v8:4895
Change-Id: Ia7fab63264c8148a11f8f123b43c7b3ee0893300
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3066941
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/main@{#76611}
2021-08-31 21:32:17 +00:00
legendecas
8db991a042 [runtime] throw a realm type error when constructors are called
Each time a constructor is being called without new operator, a TypeError
is thrown. The TypeError should be the realm's one according to 10.2.1.5.b.

Refs: https://tc39.es/ecma262/#sec-ecmascript-function-objects-call-thisargument-argumentslist
Refs: https://github.com/tc39/ecma262/pull/2216
Bug: v8:11530
Change-Id: Iff10a78e96fb547fe2062c86b9f93a30d2a8be20
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3056830
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#76002}
2021-07-29 14:34:22 +00:00
Jakob Gruber
e268f3abac Revert "Fix map-constructor-entry-side-effect2 test"
This reverts commit 337d53e654.

Reason for revert: <REASONING>

Original change's description:
> Fix map-constructor-entry-side-effect2 test
>
> Bytecode flushing interferes with IsOptimized expectations.
>
> Bug: v8:7790,v8:11939
> Change-Id: I4aaf827cb198d0a93f18e106a95d72b143c79dfc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2999092
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75508}

Bug: v8:7790,v8:11939
Change-Id: Ie85acc3ec98a823186ecfb982f1d5310bce81d7b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/3000923
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75510}
2021-07-01 14:33:39 +00:00
Jakob Gruber
337d53e654 Fix map-constructor-entry-side-effect2 test
Bytecode flushing interferes with IsOptimized expectations.

Bug: v8:7790,v8:11939
Change-Id: I4aaf827cb198d0a93f18e106a95d72b143c79dfc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2999092
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75508}
2021-07-01 13:21:57 +00:00
Maya Lekova
1f80a41fb8 Revert "Reland: ScopeInfo, SharedFunctionInfo never-ever serialized"
This reverts commit d3cacbbbd5.

Reason for revert: Breaks gc stress again - https://ci.chromium.org/ui/p/v8/builders/ci/V8%20Linux%20-%20gc%20stress/34248/overview

Original change's description:
> Reland: ScopeInfo, SharedFunctionInfo never-ever serialized
>
> This relands squashed CLs:
>
> 59b9aaf7db
> 8f84d0bb8f
>
> The revert was at crrev.com/c/2996198.
>
> Changed: Fixed a test in which bytecode flushing caused a behavioral
> change between serialized- and unserialized SFI Refs. The serialized
> SFI ref kept bytecode alive while unserialized SFIs allow flushing.
> The test was fixed by adding a %PrepareFunctionForOptimization
> annotation.
>
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Bug: v8:7790, v8:11939
> Change-Id: I170f8085bd7454a2a5f2bb03c8824e2862857827
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2999089
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Auto-Submit: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#75504}

Bug: v8:7790, v8:11939
Change-Id: Icf8858fda38e4ce28080dc254beb7a42444e9784
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2999868
Auto-Submit: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#75507}
2021-07-01 13:21:30 +00:00
Jakob Gruber
d3cacbbbd5 Reland: ScopeInfo, SharedFunctionInfo never-ever serialized
This relands squashed CLs:

59b9aaf7db
8f84d0bb8f

The revert was at crrev.com/c/2996198.

Changed: Fixed a test in which bytecode flushing caused a behavioral
change between serialized- and unserialized SFI Refs. The serialized
SFI ref kept bytecode alive while unserialized SFIs allow flushing.
The test was fixed by adding a %PrepareFunctionForOptimization
annotation.

No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7790, v8:11939
Change-Id: I170f8085bd7454a2a5f2bb03c8824e2862857827
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2999089
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75504}
2021-07-01 12:06:38 +00:00
Timothy Gu
224b659cd4 Install class "name" accessor before methods
https://github.com/tc39/ecma262/pull/1490 changed the spec so that the
"name" property of a class should be installed after "length" but before
"prototype". This CL adapts accordingly.

After this change, there is now no need for the separate code path to
set the "name" accessor at runtime. Delete the relevant runtime code as
well.

Bug: v8:8771
Change-Id: I8f809b45bf209c899cf5df76d0ebf6d9a45a6d4e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2974772
Commit-Queue: Timothy Gu <timothygu@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75340}
2021-06-23 18:05:30 +00:00
Toon Verwaest
a71ab76a60 [interpreter] Remove %_Call
This isn't used outside of tests, so let's just remove it.

Change-Id: I06b7ec11911fd8ebc3bbabcba16d0c2a3fafddab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2968413
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#75220}
2021-06-17 15:16:41 +00:00
Camillo Bruni
a345a442d3 [d8][mjsunit][tools] Improve d8 file API
- Add d8.file.read() and d8.file.execute() helpers
- Change tools and tests to use new d8.file helper
- Unify error throwing in v8::Shell::ReadFile

Change-Id: I5ef4cb27f217508a367106f01e872a4059d5e399
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2928505
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#74883}
2021-06-01 13:37:57 +00:00
Frank Emrich
c9b4f3c4a7 [dict-proto] TF support for constants in dictionary mode protos, pt. 4
This CL is part of a  series that implements Turbofan support for
property accesses satisfying the following conditions:
1. The holder is a dictionary mode object.
2. The holder is a prototype.
3. The access is a load.

This feature will only be enabled if the build flag
v8_dict_property_const_tracking is set.

This particular CL modifies existing mjsunit tests whose assumptions
don't hold if v8_dict_property_const_tracking is enabled. This is
done by adding special handling for the case that
%IsDictPropertyConstTrackingEnabled() holds.

Bug: v8:11248
Change-Id: Ia36be73e4659a988b2471f0c8151b0442f3a98f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2780292
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73745}
2021-03-31 14:53:45 +00:00
Mythri A
3329cbc8eb Enable FLAG_feedback_allocation_on_bytecode_size
This flag enables feedback allocation heuristics to be based on the
function size. The threshold for feedback allocation is set to
12 * bytecode size to roughly mimic the allocation after 12 invocations.

We tried 4 * bytecode size earlier and there were few memory regressions
on real world pages. Speedometer improved by ~1% [1, 2]. This time
trying with a higher factor this time to see if we still have
speedometer improvements without any memory regressions.

[1] https://bugs.chromium.org/p/chromium/issues/detail?id=1177124
[2] https://bugs.chromium.org/p/chromium/issues/detail?id=1177241

Change-Id: I39c7d4aaf90b948b07419e4598e2193b8355c067
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2752150
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#73369}
2021-03-12 14:25:52 +00:00
Seth Brenith
7be64db45f Reland "[interpreter] Short Star bytecode"
This is a reland of cf93071c91

Original change's description:
> [interpreter] Short Star bytecode
>
> Design doc:
> https://docs.google.com/document/d/1g_NExMT78II_KnIYNa9MvyPYIj23qAiFUEsyemY5KRk/edit
>
> This change adds 16 new interpreter opcodes, kStar0 through kStar15, so
> that we can use a single byte to represent the common operation of
> storing to a low-numbered register. This generally reduces the quantity
> of bytecode generated on web sites by 8-9%.
>
> In order to not degrade speed, a couple of other changes are required:
>
> The existing lookahead logic to check for Star after certain other
> bytecode handlers is updated to check for these new short Star codes
> instead. Furthermore, that lookahead logic is updated to contain its own
> copy of the dispatch jump rather than merging control flow with the
> lookahead-failed case, to improve branch prediction.
>
> A bunch of constants use bytecode size in bytes as a proxy for the size
> or complexity of a function, and are adjusted downward proportionally to
> the decrease in generated bytecode size.
>
> Other small drive-by fix: update generate-bytecode-expectations to emit
> \n instead of \r\n on Windows.
>
> Change-Id: I6307c2b0f5794a3a1088bb0fb94f6e1615441ed5
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2641180
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#72773}

Change-Id: I1afb670c25694498b3989de615858f984a8c7f6f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2698057
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72821}
2021-02-17 16:18:26 +00:00
Leszek Swirski
c053419e8c [sparkplug] Upstream Sparkplug
Sparkplug is a new baseline, non-optimising second-tier compiler,
designed to fit in the compiler trade-off space between Ignition and
TurboProp/TurboFan.

Design doc:
https://docs.google.com/document/d/13c-xXmFOMcpUQNqo66XWQt3u46TsBjXrHrh4c045l-A/edit?usp=sharing

Bug: v8:11420
Change-Id: Ideb7270db3d6548eedd8337a3f596eb6f8fea6b1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2667514
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72686}
2021-02-12 09:31:06 +00:00
Marja Hölttä
31d2bb8670 Reland2 [super] Store home object in Context instead of JSFunction
Fix 1: Track Scope::needs_home_object and Scope::uses_super_property
accurately. When "eval" is seen, figure out whether it can access
"super" and if yes, set the corresponding home object as needed.

Fix 2: The object literal scope shouldn't be entered for things
inside spreads.

Original: https://chromium-review.googlesource.com/c/v8/v8/+/2563275
Previous reland: https://chromium-review.googlesource.com/c/v8/v8/+/2637220

This saves memory (the home object doesn't need to be stored for each
method, but only once per class) and hopefully makes the home object
a constant in the optimized code.

Detailed documentation of the changes:
https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing

Bug: v8:9237
Bug: chromium:1167918
Bug: chromium:1167981
Bug: chromium:1167988
Bug: chromium:1168055
Bug: chromium:1171195
Bug: chromium:1171600
Change-Id: I9686e0d90cd0c1128757eca440a88748897ee91e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2655509
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72422}
2021-01-29 09:19:23 +00:00
Marja Hölttä
12f8ac4713 Revert "Reland [super] Store home object in Context instead of JSFunction"
This reverts commit f6450b97ec.

Reason for revert: ClusterFuzz bugs

Original change's description:
> Reland [super] Store home object in Context instead of JSFunction
>
> 1) Computed property keys (esp functions in them) shouldn't be inside
> the object literal scope.
>
> 2) I was using an imprecise "maybe uses super" and storing it to
> preparse data. This won't fly, since it pollutes sister scopes and
> leads to confusion wrt whether an object literal needs a home object
> or not. Made it precise (mostly cancelling changes in the original CL).
>
> 3) PreParser::NewSuperPropertyReference was creating a VariableProxy for
> this_function (which made it used) -> inconsistent scopes between
> parsing and preparsing.
>
> 4) MultipleEntryBlockContextScope was messing up the accumulator
>
> Original: https://chromium-review.googlesource.com/c/v8/v8/+/2563275
>
> This saves memory (the home object doesn't need to be stored for each
> method, but only once per class) and hopefully makes the home object
> a constant in the optimized code.
>
> Detailed documentation of the changes:
> https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing
>
> Bug: v8:9237, chromium:1167918, chromium:1167981, chromium:1167988, chromium:1168055
> Change-Id: I4f53f18cc18762c33e53d8c802909b42f1c33538
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2637220
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72169}

TBR=marja@chromium.org,leszeks@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9237
Bug: chromium:1167918
Bug: chromium:1167981
Bug: chromium:1167988
Bug: chromium:1168055
Bug: chromium:1171195
Bug: chromium:1171600
Change-Id: I15209f50c3fc8acf385a23f031ebb64139e2f519
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2653158
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72391}
2021-01-28 10:39:41 +00:00
Mythri A
aa4ee8d534 Add option to allocate feedback vector based on bytecode size
Currently, feedback vectors are allocated on a fixed budget of 1024.
In some cases it might be beneficial to allocate feedback vectors based
on invocation count rather than fixed budget. For example, if we have
a large function that is only run once. This cl adds an option to
use interrupt budget based on the bytecode size. It kind of mimics
invocation count. We would allocate feedback vectors early when we
have loops which is also required.

This flag is turned off by default. In followup cl, we will enable it
and if the memory / performance tradeoff is good we might make it
default.

Change-Id: I9f7231119b5fd65fb3268e665e2e315fb2625e1b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2584960
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72371}
2021-01-27 16:36:28 +00:00
Marja Hölttä
f6450b97ec Reland [super] Store home object in Context instead of JSFunction
1) Computed property keys (esp functions in them) shouldn't be inside
the object literal scope.

2) I was using an imprecise "maybe uses super" and storing it to
preparse data. This won't fly, since it pollutes sister scopes and
leads to confusion wrt whether an object literal needs a home object
or not. Made it precise (mostly cancelling changes in the original CL).

3) PreParser::NewSuperPropertyReference was creating a VariableProxy for
this_function (which made it used) -> inconsistent scopes between
parsing and preparsing.

4) MultipleEntryBlockContextScope was messing up the accumulator

Original: https://chromium-review.googlesource.com/c/v8/v8/+/2563275

This saves memory (the home object doesn't need to be stored for each
method, but only once per class) and hopefully makes the home object
a constant in the optimized code.

Detailed documentation of the changes:
https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing

Bug: v8:9237, chromium:1167918, chromium:1167981, chromium:1167988, chromium:1168055
Change-Id: I4f53f18cc18762c33e53d8c802909b42f1c33538
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2637220
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72169}
2021-01-19 17:05:01 +00:00
Maya Lekova
e3dbd69fea Revert "[super] Store home object in Context instead of JSFunction"
This reverts commit 4d5b878b61.

Reason for revert: Suspected to cause a failure on ChromeOS, which is blocking the roll - https://chromium-review.googlesource.com/c/chromium/src/+/2636263

Original change's description:
> [super] Store home object in Context instead of JSFunction
>
> This saves memory (the home object doesn't need to be stored for each
> method, but only once per class) and hopefully makes the home object
> a constant in the optimized code.
>
> Detailed documentation of the changes:
> https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing
>
> Bug: v8:9237
> Change-Id: Ia0925bdc8bfe54cbefcba6d10f64746d63a530c7
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563275
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Leszek Swirski <leszeks@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#72137}

TBR=marja@chromium.org,leszeks@chromium.org

Change-Id: Idc5a8240cef4da8893ccc608ee4ae0d7206a1ba8
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2637215
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72142}
2021-01-19 08:38:40 +00:00
Marja Hölttä
4d5b878b61 [super] Store home object in Context instead of JSFunction
This saves memory (the home object doesn't need to be stored for each
method, but only once per class) and hopefully makes the home object
a constant in the optimized code.

Detailed documentation of the changes:
https://docs.google.com/document/d/1ZVXcoQdf9IdMsnRI9iyUjyq9NDoEyx9nA3XqMgwflMs/edit?usp=sharing

Bug: v8:9237
Change-Id: Ia0925bdc8bfe54cbefcba6d10f64746d63a530c7
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2563275
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#72137}
2021-01-18 15:47:06 +00:00
Shu-yu Guo
d485af5644 Make TypedArray elements configurable
This implements the spec change in
https://github.com/tc39/ecma262/pull/2164

Making TA elements configurable has interaction with delete. While
the elements are configurable, they are only "deletable" via detaching
the underlying ArrayBuffer, not via `delete`. That is, `delete ta[idx]`
for an in-bounds `idx` still returns false.

Bug: v8:11281
Change-Id: I2e9348a7ec3c3239a92cc35e51b7182423736834
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2605234
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71955}
2021-01-07 17:10:04 +00:00
Frank Emrich
300573aca8 [classes] Fix enumeration order bugs when accessors shadow dynamic prop.
AddToDictionaryTemplate in literal-objects.cc was missing several
cases when handling the overwriting between properties with statically
known and dynamically computed names. This led to wrong enumeration
orders in class prototypes created from class templates.

Bug: v8:11158
Change-Id: I7381b4680ec533bd307a6c32d75c8a66394869df
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2536464
Commit-Queue: Frank Emrich <emrich@google.com>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71266}
2020-11-18 16:47:21 +00:00
Jakob Gruber
3edf54337a [compiler] Rename --turboprop-dynamic-map-checks
... to --turbo-dynamic-map-checks. With the upcoming use in NCI code,
this feature is no longer used exclusively by Turboprop.

Bug: v8:8888
Change-Id: I61e01db086fd2e8566d2e2a09574be74b6e5a7bd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2546693
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71263}
2020-11-18 15:52:55 +00:00
Marja Hölttä
cdcf3c3134 [super] Use a feedback-collecting builtin in JSGenericLowering
Bug: v8:9237
Change-Id: I1e308a5a325b01fcdc9236f13080653f3be6d328
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527095
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71155}
2020-11-12 15:06:39 +00:00
Shu-yu Guo
f1ae68351f [flags] Remove --harmony-promise-any
It's shipped since M85.

Bug: v8:9808
Change-Id: I0c2dcda601aad33d4acb379b242799f9b09e8930
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2510869
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71137}
2020-11-12 01:09:38 +00:00
Marja Hölttä
04f5085dfe [super] Disable --deopt-every-n-times in super property optimization tests
The tests assert that funcs are optimized / deoptimized a certain way.

Bug: v8:9237, v8:11138
Change-Id: Ia4879e722e442be52de0bf93919eb03fecb88147
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2529136
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71087}
2020-11-10 13:50:07 +00:00
Marja Hölttä
0be88a57e5 [super] Optimize super property access in JSNativeContextSpecialization
This is the second reland of
https://chromium-review.googlesource.com/c/v8/v8/+/2487122 , this time
without RuntimeCallStats in the tests.

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I782df6e032ff8191082b425e68d68b69cef0a560
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527092
Auto-Submit: Marja Hölttä <marja@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71077}
2020-11-10 11:24:44 +00:00
Shu-yu Guo
d9a0b7b11e Revert "[super] Optimize super property access in JSNativeContextSpecialization"
This reverts commit 30ca51ec48.

Reason for revert: TSAN failures https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34104

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#71052}

TBR=marja@chromium.org,neis@chromium.org

Change-Id: I2b10963a9a99f7b482f1014472a6a281fcf9b8c1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2527184
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71058}
2020-11-09 17:42:41 +00:00
Marja Hölttä
30ca51ec48 [super] Optimize super property access in JSNativeContextSpecialization
This is a reland of https://chromium-review.googlesource.com/c/v8/v8/+/2487122

Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: Ia8e79b00f7720f4e3e90801e49a0106e03b4767d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2523197
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#71052}
2020-11-09 15:28:09 +00:00
Clemens Backes
fe0c98a36b Revert "[super] Optimize super property access in JSNativeContextSpecialization"
This reverts commit 0147db5a4a.

Reason for revert: Data races: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20TSAN/34056

Original change's description:
> [super] Optimize super property access in JSNativeContextSpecialization
>
> Generalize the existing property lookup machinery
> (JSNCS::ReduceNamedAccess) to handle the case where the
> lookup_start_object and the receiver are different objects.
>
> Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l
>
> Bug: v8:9237
> Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70988}

TBR=marja@chromium.org,mvstanton@chromium.org,neis@chromium.org

Change-Id: Ib5ddb919ae569fe5ddf266d986f1c8bc0fe9621a
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:9237
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2520908
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70992}
2020-11-05 16:31:04 +00:00
Marja Hölttä
0147db5a4a [super] Optimize super property access in JSNativeContextSpecialization
Generalize the existing property lookup machinery
(JSNCS::ReduceNamedAccess) to handle the case where the
lookup_start_object and the receiver are different objects.

Design doc: https://docs.google.com/document/d/1b_wgtExmJDLb8206jpJol-g4vJAxPs1XjEx95hwRboI/edit#heading=h.xqthbgih7l2l

Bug: v8:9237
Change-Id: I28b6d87ce6537acd8cf972bbe7dc6d63d581aadc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2487122
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70988}
2020-11-05 13:58:11 +00:00
Camillo Bruni
46be10d188 [runtime] Don't normalize JSGlobalProxy
Object.assign should not normalize JSGlobalProxy objects.

Bug: chromium:1139769
Change-Id: Ie7e24f6498267966b7553b0c5994307f5b632b0d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2485505
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70713}
2020-10-22 16:02:06 +00:00
Marja Hölttä
3773e46e3e [super ic] Fix receiver type
With non-super loads (receiver == lookup_start_object), we don't hit
the code in AccessorAssembler::GenericPropertyLoad calling
CSA::TryGetOwnProperty if the receiver (the lookup_start_object) is a
SMI.

But with super property loads, if we set up lookup_start_object the
right way, we will hit this code.

The code was assuming receiver is a HeapObject, which is too
restrictive. The receiver is only used for the accessor call, so
it's ok to make the type more generic.

Bug: v8:9237, chromium:1139786
Change-Id: I3167ccfb54a49ac1c401040a6f02fc1f3b98d9d1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2484366
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70647}
2020-10-20 09:05:24 +00:00
Camillo Bruni
28c2e433d0 [runtime] Fix global_dictionary case in SetOrCopyDataProperties
Bug: chromium:1133210
Change-Id: Ic60e88ab3c50602a71387f7c3a1253d70a7c69fa
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2450061
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70341}
2020-10-06 12:27:15 +00:00
Marja Hölttä
24fbcf8847 Try 2: [super ic] Fix more receiver vs lookup start object vs holder confusion
The actual fix is in LoadIC::ComputeHandler (checking
lookup_start_object == holder instead of receiver == holder) + the
LookupIterator changes for preserving lookup_start_object.

The rest is renaming / refactoring.

Reland: not relying on the prototype validity cell after all

Previous version: https://chromium-review.googlesource.com/c/v8/v8/+/2414039

Bug: v8:9237, chromium:1127653
Change-Id: I1949442f8ddcecb776f0c5d2cf737cb75f80e313
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2428588
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70112}
2020-09-24 11:45:18 +00:00
Marja Hölttä
8443390f71 Revert "[super ic] Fix more receiver vs lookup start object vs holder confusion"
This reverts commit ab7e6df074.

Reason for revert: Several fuzz bugs: chromium:1131469, chromium:1131525, chromium:1131779

Original change's description:
> [super ic] Fix more receiver vs lookup start object vs holder confusion
>
> The actual fix is in LoadIC::ComputeHandler (checking
> lookup_start_object == holder instead of receiver == holder) + the
> LookupIterator changes for preserving lookup_start_object.
>
> The rest is renaming / refactoring.
>
> Bug: v8:9237, chromium:1127653
> Change-Id: Ieef46fb46ababa79623951c48639429c5b552d2d
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414039
> Commit-Queue: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#70045}

TBR=marja@chromium.org,ishell@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9237
Bug: chromium:1127653, chromium:1131469, chromium:1131525, chromium:1131779
Change-Id: I1bad5ba1dcfe9a0de8ce775feac2d3bfd7264c8c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2426620
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70107}
2020-09-24 09:07:25 +00:00
Jakob Gruber
5b42e3f334 [regexp] Assign proper flags to TextNode
This fixes a case in which we forgot to assign flags to TextNodes
created through

AddBmpCharacters
AddNonBmpSurrogatePairs
AddLoneLeadSurrogates
AddLoneTrailSurrogates

functions. If these initially had a flag (e.g. case-insensitive 'i')
set, that information was lost. This bug resulted in missing case
folding in no_i18n builds (perhaps other things as well that just
aren't covered by our test suite).

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Bug: v8:10131,v8:10120
Change-Id: Icef4f0dbd47971a538e07bab2f1067c383fd59c6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2423718
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70106}
2020-09-24 08:51:15 +00:00
Marja Hölttä
ab7e6df074 [super ic] Fix more receiver vs lookup start object vs holder confusion
The actual fix is in LoadIC::ComputeHandler (checking
lookup_start_object == holder instead of receiver == holder) + the
LookupIterator changes for preserving lookup_start_object.

The rest is renaming / refactoring.

Bug: v8:9237, chromium:1127653
Change-Id: Ieef46fb46ababa79623951c48639429c5b552d2d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2414039
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#70045}
2020-09-22 11:03:50 +00:00
Marja Hölttä
3d40ec8d99 [super property speed] Add an IC for super property loads
Bug: v8:9237
Change-Id: I06d7e74ba0360334e6fa65c19f24548e220e4c69
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2349297
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69735}
2020-09-08 12:28:05 +00:00
Shu-yu Guo
985a9ddaa1 Fix "name" property of %ThrowTypeError% to be spec-conformant
This is a normative PR that reached consensus at the June 2019 TC39:
https://github.com/tc39/test262/pull/2299

Bug: v8:9646
Change-Id: Idbeea703fe264da43825729e7b37a08a1bb10001
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2360907
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69466}
2020-08-18 19:36:53 +00:00
Shu-yu Guo
048761aa0f Install "name" property on anonymous classes
This is a normative PR that reached consensus at the June 2019 TC39:
https://github.com/tc39/test262/pull/2299

Bug: v8:9646
Change-Id: I8cb927b9e9231dfb71ebf47171205a096350e38b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2360905
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69460}
2020-08-18 16:41:23 +00:00
Shu-yu Guo
c19e57ee82 Disallow \8 and \9 in strict mode and template literals
This reached consensus in the July 2020 TC39:
https://github.com/tc39/ecma262/pull/2054

Bug: v8:10769
Change-Id: Iecea1d9d9c9be5c2fbfb820aed2285719c4e6382
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2333350
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#69206}
2020-08-03 18:05:14 +00:00
Camillo Bruni
1335b1ec36 [d8] Exit with error code upon unhandled promise rejection
With this CL d8 exits with an error code if there is an unhandled
promise rejection, e.g. due tue a failed assertion in a promise. Up
until now these assertions were just ignored.

Bug: v8:10556
Change-Id: I25f20e4be45a2de130562deb15f6a144f0ac976f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2238569
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68503}
2020-06-24 07:21:58 +00:00
Dan Elphick
6574a7133d [Respect] Rename lists
This changes black/white list to block/allow list.

Bug: v8:10619
Change-Id: Id55d72f90891670ca57b62dfeb6b3251025927dc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2257228
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68464}
2020-06-22 15:15:31 +00:00
Marja Hölttä
539979f4a9 [Promise combinators] Spec change: check "resolve" early
Promise.{all,allSettled,any,race} should check resolve is a function before
opening their iteratable.

PR: https://github.com/tc39/ecma262/pull/1912

PR for Promise.any: https://github.com/tc39/proposal-promise-any/pull/65

This CL includes the following cleanup changes:
- Made it more explicit that the constructor is a Constructor.
- Removed unnecessary nested try blocks (a try can have both a catch and a label).
- Moved commonly used definitions out of promise-race.tq where they don't belong.
- Made the parameter order of PerformPromiseAll match the spec.


Bug: v8:10578
Change-Id: I9deb5d5106db7350a0d0ad52f165ff2469e7074b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2232544
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#68260}
2020-06-09 13:48:22 +00:00
Shu-yu Guo
abfdb819ce [builtins] Fix optional arguments for %TypedArray%.from
Since ES6, optional arguments are treated the same as undefined. This
was recently cleaned up in https://github.com/tc39/ecma262/pull/1411.
The current Torque implementation of %TypedArray%.from incorrectly
interpreted the old (and confusing) language of a parameter being "not
present" as testing using arguments.length instead of testing directly
for undefined.

Bug: v8:10458
Change-Id: I055f1fa3be570a31a4f7369ba5b51b7d6b022f0a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/2168674
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#67454}
2020-04-28 16:32:25 +00:00