Commit Graph

6460 Commits

Author SHA1 Message Date
jgruber
16310b2e39 [debugger] Ensure debug listeners do not throw
This exposes a couple of broken tests that used to silently throw within
the listener. Mark these as failing for now

BUG=v8:5330, v8:5581

Review-Url: https://codereview.chromium.org/2460833002
Cr-Commit-Position: refs/heads/master@{#40672}
2016-10-31 14:56:44 +00:00
neis
6442156635 [test] Skip the debug-liveedit-double-call mjsunit test.
It's marked as [PASS, FAIL] but keeps showing up as a test failure for me.

R=mstarzinger@chromium.org
BUG=v8:5587

Review-Url: https://codereview.chromium.org/2461343002
Cr-Commit-Position: refs/heads/master@{#40668}
2016-10-31 12:22:33 +00:00
mstarzinger
b4b436de6a [compiler] Ship Ignition for all TurboFan code.
This enables Ignition unconditionally for all code that is destined for
optimization with TurboFan. This ensures all optimization attempts will
go through the BytecodeGraphBuilder and that the AstGraphBuilder pipe is
dried out in practice.

patch from issue 2427953002 at patchset 120001 (http://crrev.com/2427953002#ps120001)

R=mvstanton@chromium.org,rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2453973004
Cr-Commit-Position: refs/heads/master@{#40663}
2016-10-31 09:43:43 +00:00
bmeurer
7201bad99d [turbofan] Properly deal with out-of-bounds fields in EscapeAnalysis.
Conflicting type feedback on Load/StoreICs can lead to out-of-bounds
field access, which is essentially dead code, but EscapeAnalysis was
confused about those. For now, mark the objects as escaping in these
cases, middle-term we want to deal better with this kind of compile-
time known dead code.

BUG=chromium:658185,v8:4586
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2459273002
Cr-Commit-Position: refs/heads/master@{#40662}
2016-10-31 06:43:25 +00:00
titzer
b7aff1ff64 [wasm] Support for restricted table imports.
This CL implements basic table import functionality.

Missing: growing of tables (WebAssembly.Grow) doesn't change dispatch tables
Missing: allowing larger table imports than minimum size

R=rossberg@chromium.org,bradnelson@chromium.org
BUG=v8:5507

Review-Url: https://codereview.chromium.org/2454503005
Cr-Commit-Position: refs/heads/master@{#40661}
2016-10-29 21:07:38 +00:00
machenbach
9b25707b2a [test] Fix a few flag configurations to make fuzzer happy.
BUG=chromium:660457
TBR=mbarbella@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2464453002
Cr-Commit-Position: refs/heads/master@{#40657}
2016-10-28 20:14:13 +00:00
machenbach
bc0ee727df Revert of [wasm] Support for restricted table imports. (patchset #7 id:120001 of https://codereview.chromium.org/2454503005/ )
Reason for revert:
GC stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8857

Original issue's description:
> [wasm] Support for restricted table imports.
>
> This CL implements basic table import functionality.
>
> Missing: growing of tables (WebAssembly.Grow) doesn't change dispatch tables
> Missing: allowing larger table imports than minimum size
>
> R=rossberg@chromium.org,bradnelson@chromium.org
> BUG=v8:5507

TBR=bradnelson@chromium.org,rossberg@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5507

Review-Url: https://codereview.chromium.org/2456193006
Cr-Commit-Position: refs/heads/master@{#40656}
2016-10-28 18:58:54 +00:00
eholk
96d12ac6dd [wasm] make WebAssembly.Instance require a WebAssembly.Memory
BUG=

Review-Url: https://codereview.chromium.org/2460773003
Cr-Commit-Position: refs/heads/master@{#40654}
2016-10-28 18:13:28 +00:00
titzer
404e215458 [wasm] Support for restricted table imports.
This CL implements basic table import functionality.

Missing: growing of tables (WebAssembly.Grow) doesn't change dispatch tables
Missing: allowing larger table imports than minimum size

R=rossberg@chromium.org,bradnelson@chromium.org
BUG=v8:5507

Review-Url: https://codereview.chromium.org/2454503005
Cr-Commit-Position: refs/heads/master@{#40652}
2016-10-28 18:03:50 +00:00
ahaas
aff3ef2108 [wasm] Start function must not have a return value.
R=titzer@chromium.org
TEST=mjsunit/wasm/start-function

Review-Url: https://codereview.chromium.org/2458983002
Cr-Commit-Position: refs/heads/master@{#40646}
2016-10-28 13:36:03 +00:00
mstarzinger
ae24992839 [turbofan] Remove deprecated --turbo-from-bytecode flag.
This flag is on by default for now. Whenever heuristics in the compiler
pipeline decide to use Ignition+TurboFan, then {BytecodeGraphBuilder} is
active. Removing the flag reduces maintenance overhead.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2437103002
Cr-Commit-Position: refs/heads/master@{#40639}
2016-10-28 09:54:04 +00:00
jgruber
83b560b0e5 [debugger] Various break-related functionality in test wrapper
This CL adds simple implementation of break and stepping-related functionality
as required by the debug-step.js test. This includes

* stepOver, stepInto, stepOut
* setBreakPoint
* clearBreakPoint
* evaluate

Some of these, e.g. setBreakPoint are not fully implemented for all cases but
only for the ones we need right now.

One interesting result of this is that using the inspector protocol is roughly
14x slower for debug-step.js (14s instead of 0.5s). One cause of this seems to
be iteration over all object properties in toProtocolValue, which is used to
serialize JS objects before being sent over the wire (e.g. FrameMirrors).  This
is something that should be fixed at some point. In the meantime, the test now
runs 100 instead of 1000 iterations.

BUG=v8:5530

Review-Url: https://codereview.chromium.org/2447073007
Cr-Commit-Position: refs/heads/master@{#40636}
2016-10-28 08:18:34 +00:00
jgruber
534222d117 [regexp] Use SameValue in @@search as specced
BUG=v8:5339

Review-Url: https://codereview.chromium.org/2452923002
Cr-Commit-Position: refs/heads/master@{#40634}
2016-10-28 07:14:42 +00:00
ishell
6ea4061b8d [ic] Load IC data handlers now support prototype chain checks with global and dictionary objects.
BUG=v8:5561

Review-Url: https://codereview.chromium.org/2449463002
Cr-Commit-Position: refs/heads/master@{#40626}
2016-10-27 15:32:51 +00:00
mstarzinger
375afe2acf [turbofan] Adapt test assumptions about OSR.
The assumptions that OSR code is installed on {JSFunction} objects no
longer holds with TurboFan and hence {assertOptimized} can report a
different result dependeing on how OSR code is treated. This is working
as intended.

R=mythria@chromium.org

Review-Url: https://codereview.chromium.org/2453313002
Cr-Commit-Position: refs/heads/master@{#40624}
2016-10-27 14:07:47 +00:00
jarin
21d55e2166 [turbofan] Relax a too-strict dcheck.
BUG=v8:5573

Review-Url: https://codereview.chromium.org/2458623002
Cr-Commit-Position: refs/heads/master@{#40619}
2016-10-27 12:33:19 +00:00
bmeurer
305948fa76 [ic] Properly deal with all oddballs when updating BinaryOpIC state.
R=jarin@chromium.org
BUG=chromium:659967

Review-Url: https://codereview.chromium.org/2453633005
Cr-Commit-Position: refs/heads/master@{#40616}
2016-10-27 12:16:13 +00:00
jgruber
88c5a300c5 [regexp] Set static property attributes as in spec proposal
'[...] accessor properties who have the attributes { [[Enumerable]]:
false, [[Configurable]]: true } [...]'

BUG=v8:5566

Review-Url: https://codereview.chromium.org/2452913002
Cr-Commit-Position: refs/heads/master@{#40609}
2016-10-27 08:26:05 +00:00
bmeurer
7d383be9da [crankshaft] Support all oddballs for truncating TaggedToI changes.
For inputs to truncating binary operations like <<, | or >>>, support
all Oddballs not just undefined, true and false. This unifies treatment
of these truncations in Crankshaft and TurboFan, and is very easy
nowadays, since the memory layout of Oddball and HeapNumber is
compatible.

R=yangguo@chromium.org
BUG=v8:5400

Review-Url: https://codereview.chromium.org/2452193003
Cr-Commit-Position: refs/heads/master@{#40608}
2016-10-27 06:00:05 +00:00
titzer
24d38be132 [wasm] Remove the "Wasm" object.
BUG=chromium:575167, v8:5507

R=rossberg@chromium.org,bradnelson@chromium.org
CC=ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2447013004
Cr-Commit-Position: refs/heads/master@{#40601}
2016-10-26 16:58:53 +00:00
titzer
3f207617d7 [wasm] Binary 0xD: update encoding of opcodes, types, and add immediates.
R=ahaas@chromium.org,rossberg@chromium.org,binji@chromium.org,bradnelson@chromium.org
BUG=chromium:575167, chromium:659591

Review-Url: https://codereview.chromium.org/2440953002
Cr-Commit-Position: refs/heads/master@{#40600}
2016-10-26 16:56:49 +00:00
neis
038a81976e [modules] Improve error messages.
For instance, when an import cannot be resolved, actually
point at the corresponding import statement.

BUG=v8:1569

Review-Url: https://codereview.chromium.org/2451153002
Cr-Commit-Position: refs/heads/master@{#40594}
2016-10-26 15:10:24 +00:00
bmeurer
2bd7464ec1 [compiler] Properly validate stable map assumption for globals.
For global object property cells, we did not check that the map on the
previous object is still the same for which we actually optimized. So
the optimized code was not in sync with the actual state of the property
cell. When loading from such a global object property cell, Crankshaft
optimizes away any map checks (based on the stable map assumption),
leading to arbitrary memory access in the worst case.

TurboFan has the same bug for stores, but is safe on loads because we
do appropriate map checks there. However mixing TurboFan and Crankshaft
still exposes the bug.

R=yangguo@chromium.org
BUG=chromium:659475

Review-Url: https://codereview.chromium.org/2444233004
Cr-Commit-Position: refs/heads/master@{#40592}
2016-10-26 13:44:03 +00:00
mstarzinger
2ab2ec2243 [turbofan] Disable bogus lowering of builtin tail-calls.
The TurboFan backends currently don't support tail-calls to CPP builtins
because the semantics of kJavaScriptCallArgCountRegister has different
semantics for stub call descriptors versus JavaScript call descriptors.
This is actually a short-coming of the backends and follow-up work will
make the backends more robust in that regard to fail hard on unsupported
constructs like that. This just disables the lowering creating such a
tail-call.

R=bmeurer@chromium.org
BUG=chromium:658691
TEST=mjsunit/regress/regress-crbug-658691

Review-Url: https://codereview.chromium.org/2447383002
Cr-Commit-Position: refs/heads/master@{#40590}
2016-10-26 12:49:06 +00:00
bmeurer
d0a047d440 Revert of [compiler] Properly validate stable map assumption for globals. (patchset #3 id:40001 of https://codereview.chromium.org/2444233004/ )
Reason for revert:
Breaks tree: http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8789

Original issue's description:
> [compiler] Properly validate stable map assumption for globals.
>
> For global object property cells, we did not check that the map on the
> previous object is still the same for which we actually optimized. So
> the optimized code was not in sync with the actual state of the property
> cell. When loading from such a global object property cell, Crankshaft
> optimizes away any map checks (based on the stable map assumption),
> leading to arbitrary memory access in the worst case.
>
> TurboFan has the same bug for stores, but is safe on loads because we
> do appropriate map checks there. However mixing TurboFan and Crankshaft
> still exposes the bug.
>
> R=yangguo@chromium.org
> BUG=chromium:659475

TBR=yangguo@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:659475

Review-Url: https://codereview.chromium.org/2454513003
Cr-Commit-Position: refs/heads/master@{#40582}
2016-10-26 11:11:43 +00:00
neis
f33a4078e8 [runtime] Let native setters have a return value.
Native setters (see AccessorInfo in accessors.h) didn't have the ability
to return a result value. As a consequence of this, for instance, Reflect.set
on the length property of arrays had the wrong behavior:

var y = [];
Object.defineProperty(y, 0, {value: 42, configurable: false})
Reflect.set(y, 'length', 0)

The Reflect.set call used to return true. Now it returns false as
required by the spec.

BUG=v8:5401

Review-Url: https://codereview.chromium.org/2397603003
Cr-Commit-Position: refs/heads/master@{#40579}
2016-10-26 09:00:08 +00:00
bmeurer
3aa57eb920 [compiler] Properly validate stable map assumption for globals.
For global object property cells, we did not check that the map on the
previous object is still the same for which we actually optimized. So
the optimized code was not in sync with the actual state of the property
cell. When loading from such a global object property cell, Crankshaft
optimizes away any map checks (based on the stable map assumption),
leading to arbitrary memory access in the worst case.

TurboFan has the same bug for stores, but is safe on loads because we
do appropriate map checks there. However mixing TurboFan and Crankshaft
still exposes the bug.

R=yangguo@chromium.org
BUG=chromium:659475

Review-Url: https://codereview.chromium.org/2444233004
Cr-Commit-Position: refs/heads/master@{#40578}
2016-10-26 08:55:10 +00:00
cbruni
58e0e3f635 [builtins] Fix Object.create(null) special case
Fix failing assertions in the CodeStubAssembler that cause Object.create(null,
global) fail.
Drive-by-fix: convert some Assert to CSA_ASSERT.

BUG=chromium:657692

Review-Url: https://codereview.chromium.org/2446203003
Cr-Commit-Position: refs/heads/master@{#40576}
2016-10-26 07:21:46 +00:00
neis
9c558d7bd9 Reland: [modules] Add partial support for debug-scopes.
Setting variables is not yet implemented.

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2445683002
Cr-Commit-Position: refs/heads/master@{#40566}
2016-10-25 14:39:29 +00:00
machenbach
de52faf948 Revert of [modules] Add partial support for debug-scopes. (patchset #1 id:1 of https://codereview.chromium.org/2445683002/ )
Reason for revert:
Breaks https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/9349

Original issue's description:
> [modules] Add partial support for debug-scopes.
>
> Setting variables is not yet implemented..
>
> R=adamk@chromium.org
> BUG=v8:1569

TBR=adamk@chromium.org,yangguo@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2449883002
Cr-Commit-Position: refs/heads/master@{#40564}
2016-10-25 12:56:02 +00:00
neis
ee2f80c6bd [modules] Add partial support for debug-scopes.
Setting variables is not yet implemented..

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2445683002
Cr-Commit-Position: refs/heads/master@{#40559}
2016-10-25 12:30:15 +00:00
adamk
56626f302d [ignition] Use more-targeted check for CONST-this-initialization hole check
This brings the BytecodeGenerator in line with FullCodeGenerator, now that
more requests for hole checks are flowing through BuildVariableAssignment.

BUG=chromium:658528

Review-Url: https://codereview.chromium.org/2447783002
Cr-Commit-Position: refs/heads/master@{#40557}
2016-10-25 11:08:06 +00:00
titzer
ad9cf53473 [wasm] Add support for exporting WebAssembly.Table instances.
R=bradnelson@chromium.org, rossberg@chromium.org
BUG=v8:5507

Review-Url: https://codereview.chromium.org/2443353002
Cr-Commit-Position: refs/heads/master@{#40554}
2016-10-25 09:44:51 +00:00
clemensh
5452f97ede [wasm] Fix binary search for asm.js offsets
And add a test case for more than one entry ;)

R=titzer@chromium.org,ahaas@chromium.org

Review-Url: https://codereview.chromium.org/2448833004
Cr-Commit-Position: refs/heads/master@{#40553}
2016-10-25 09:00:57 +00:00
cbruni
532c16eca0 [runtime] Object.create(null) creates a slow object
Object.create(null) is most likely to be used for dictionary-like objects.
Hence it would be beneficial to directly create a slow-mode object and avoid
additional overhead later-on.

BUG=

Review-Url: https://codereview.chromium.org/2430273007
Cr-Commit-Position: refs/heads/master@{#40551}
2016-10-25 08:30:50 +00:00
yangguo
baba15223c [debugger] fix stepping out of across throwing.
R=jgruber@chromium.org
BUG=v8:5559

Review-Url: https://codereview.chromium.org/2445233004
Cr-Commit-Position: refs/heads/master@{#40549}
2016-10-25 08:00:52 +00:00
jgruber
77ddcfb3e0 [regexp] Remove unused code
This CL removes code that is now unused since the port of regexp.js has been
completed. Removed functions / classes are:

* regexp.js (GetSubstitution moved to string.js)
* RegExpConstructResult stub
* RegExpFlags intrinsic
* RegExpSource intrinsic
* RegExpInitializeAndCompile runtime function

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2448463002
Cr-Commit-Position: refs/heads/master@{#40547}
2016-10-25 07:19:13 +00:00
verwaest
caba112d03 Simplify and fix the rewriter
Now we
- always set .result to undefined before a visited loop and switch since we can't know whether they will set a value,
- only visit finally if it can break/continue; and only store/restore .result in that case

BUG=

Review-Url: https://codereview.chromium.org/2427253003
Cr-Commit-Position: refs/heads/master@{#40542}
2016-10-24 19:23:03 +00:00
rmcilroy
381b5437b2 Don't call FastNewFunctionContextStub if context is bigger than kMaxRegularHeapObjectSize.
CL https://codereview.chromium.org/2177273002 changed FastNewFunctionContextStub
to take a number of slots parameter and in-doing so removed the maximum slot
count for FastNewFunctionContextStub. This made it possible to create a
closure which is larger than kMaxRegularHeapObjectSize and so can't be
allocated by FastNewFunctionContextStub.

Reintroduce FastNewFunctionContextStub::kMaxSlots (but make the limit much
larger) to ensure we call the runtime for contexts which need to be
allocated in the LO space.

BUG=chromium:655573

Review-Url: https://codereview.chromium.org/2445703002
Cr-Commit-Position: refs/heads/master@{#40541}
2016-10-24 17:23:21 +00:00
jgruber
ae3357d216 [regexp] Move RegExp.prototype.test to TF
This results in a speedup of around 2x. RegExpExec is also ported in
this CL.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2441993002
Cr-Commit-Position: refs/heads/master@{#40532}
2016-10-24 12:41:29 +00:00
jgruber
f87d73c7cf [regexp] Add regression test for v8:5434
The test ensures that in RegExp.prototype[@@split], exec is neither
accessed too early nor too often.

BUG=v8:5339,v8:5434

Review-Url: https://codereview.chromium.org/2440413002
Cr-Commit-Position: refs/heads/master@{#40526}
2016-10-24 10:39:01 +00:00
bmeurer
6c5fa8b49e [turbofan] Fix deopt loop in out-of-bounds string element access.
We need to check the KeyedLoadIC state to guard against potential
deoptimization loops due to out-of-bounds accesses, because the IC
system uses the MEGAMORPHIC state to also signal that there was an
out-of-bounds access already.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2443893002
Cr-Commit-Position: refs/heads/master@{#40525}
2016-10-24 10:32:36 +00:00
bmeurer
a58d7907ea [turbofan] Fix typed lowering of JSToLength.
When lowering JSToLength, we cannot just smash arbitrary bounds on the
Select nodes, as that will confuse the representation selection later.
Instead properly rename the input using NumberMax and NumberMin.

R=jarin@chromium.org
BUG=chromium:657478

Review-Url: https://codereview.chromium.org/2440333002
Cr-Commit-Position: refs/heads/master@{#40519}
2016-10-24 06:37:22 +00:00
mtrofin
91a5a219d4 [wasm] Avoid double-serializing the wire bytes
Since the public API for deserialization is now just DeserializeOrCompile,
we can trickle down the wire bytes to the deserialization logic, and
avoid the need for duplicating the wire bytes when serializing.

BUG=chromium:657316

Review-Url: https://chromiumcodereview.appspot.com/2433273002
Cr-Commit-Position: refs/heads/master@{#40516}
2016-10-22 15:15:04 +00:00
titzer
71b63a95fa [wasm] Enable all WASM tests (experiment).
R=bradnelson@chromium.org
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2436953004
Cr-Commit-Position: refs/heads/master@{#40513}
2016-10-21 18:16:11 +00:00
neis
cadfe092a2 [modules] Fix bugs in assignments to exported variables.
- Add hole check if needed.
- Preserve the accumulator so that the result is the rhs.

R=adamk@chromium.org
BUG=v8:1569,v8:5547

Review-Url: https://chromiumcodereview.appspot.com/2438653003
Cr-Commit-Position: refs/heads/master@{#40510}
2016-10-21 14:24:31 +00:00
jgruber
eb10dc4c91 [regexp] Use consistent map checks for fast paths
These map checks were implemented for TF code already. This CL makes
sure that parts implemented in C++ follow the same logic, which is:

An object is an unmodified regexp if:
1) it's a receiver,
2) its map is the initial regexp map,
3) its prototype is a receiver,
4) and its prototype's map is the initial prototype's initial map.

We can now be smarter in @@replace and @@split since checking maps
(unlike the previous check of RegExp.prototype.exec) is not observable,
so we can perform fast-path checks at a time of our choosing.

BUG=v8:5339,v8:5434,v8:5123

Review-Url: https://chromiumcodereview.appspot.com/2434983002
Cr-Commit-Position: refs/heads/master@{#40501}
2016-10-21 11:58:50 +00:00
machenbach
0b7e35ff16 Revert of [regexp] Use consistent map checks for fast paths (patchset #7 id:120001 of https://chromiumcodereview.appspot.com/2434983002/ )
Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/10853

Original issue's description:
> [regexp] Use consistent map checks for fast paths
>
> These map checks were implemented for TF code already. This CL makes
> sure that parts implemented in C++ follow the same logic, which is:
>
> An object is an unmodified regexp if:
> 1) it's a receiver,
> 2) its map is the initial regexp map,
> 3) its prototype is a receiver,
> 4) and its prototype's map is the initial prototype's initial map.
>
> We can now be smarter in @@replace and @@split since checking maps
> (unlike the previous check of RegExp.prototype.exec) is not observable,
> so we can perform fast-path checks at a time of our choosing.
>
> BUG=v8:5339,v8:5434,v8:5123

TBR=yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5339,v8:5434,v8:5123

Review-Url: https://chromiumcodereview.appspot.com/2438283002
Cr-Commit-Position: refs/heads/master@{#40499}
2016-10-21 11:15:20 +00:00
jgruber
bac992a114 [regexp] Use consistent map checks for fast paths
These map checks were implemented for TF code already. This CL makes
sure that parts implemented in C++ follow the same logic, which is:

An object is an unmodified regexp if:
1) it's a receiver,
2) its map is the initial regexp map,
3) its prototype is a receiver,
4) and its prototype's map is the initial prototype's initial map.

We can now be smarter in @@replace and @@split since checking maps
(unlike the previous check of RegExp.prototype.exec) is not observable,
so we can perform fast-path checks at a time of our choosing.

BUG=v8:5339,v8:5434,v8:5123

Review-Url: https://chromiumcodereview.appspot.com/2434983002
Cr-Commit-Position: refs/heads/master@{#40495}
2016-10-21 09:58:38 +00:00
machenbach
53aa05cdff [test] Skip flaky test.
BUG=v8:5553
NOTRY=true
TBR=hablich@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2440693003
Cr-Commit-Position: refs/heads/master@{#40491}
2016-10-21 08:40:12 +00:00
gdeepti
5afa8ed77a [wasm] GrowMemory should update imported memory objects.
When the instance has imported memory, calling GrowMemory should update the memory object to have a consistent view of the memory. This fixes the failing emscripten test case, added a reduced test that simulates the same behavior.

R=titzer@chromium.org, dschuff@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2438673006
Cr-Commit-Position: refs/heads/master@{#40490}
2016-10-21 08:38:52 +00:00
neis
209e57e98d [test] Fix typo in assertInstanceOf in mjsunit.js.
R=adamk@chromium.org, marja@chromium.org
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2436073002
Cr-Commit-Position: refs/heads/master@{#40482}
2016-10-20 17:55:52 +00:00
jpp
5331e3b616 [V8][asm.js] Adds support to global const variables.
This CL adds support for:
https://discourse.wicg.io/t/allow-const-global-variables/684

It allows global const variables to be used as if they were numeric
literals. For example:

  const f0 = fround(0);
  ...
  function foo() {
    var v = f0;  // no type annotation.
    ...
    return f0;  // no return type annotation.
  }

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5540

Review-Url: https://chromiumcodereview.appspot.com/2435823002
Cr-Commit-Position: refs/heads/master@{#40477}
2016-10-20 15:48:41 +00:00
mstarzinger
510b56d3f2 Revert "[compiler] Ship Ignition for all TurboFan code."
Breaks layout tests on Blink builders.

TBR=machenbach@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2428413004
Cr-Commit-Position: refs/heads/master@{#40471}
2016-10-20 14:09:29 +00:00
mstarzinger
2b11a0b92d [interpreter] Enable tests that no longer fail.
R=mythria@chromium.org
BUG=v8:5038

Review-Url: https://chromiumcodereview.appspot.com/2437023002
Cr-Commit-Position: refs/heads/master@{#40470}
2016-10-20 12:48:08 +00:00
mstarzinger
20d29ff036 [compiler] Ship Ignition for all TurboFan code.
This enables Ignition unconditionally for all code that is destined for
optimization with TurboFan. This ensures all optimization attempts will
go through the BytecodeGraphBuilder and that the AstGraphBuilder pipe is
dried out in practice.

R=mvstanton@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2427953002
Cr-Commit-Position: refs/heads/master@{#40462}
2016-10-20 10:57:58 +00:00
gdeepti
e936685b0d [wasm] Remove incorrect assembler check.
BUG=chromium:644670
R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2438593003
Cr-Commit-Position: refs/heads/master@{#40451}
2016-10-20 07:39:15 +00:00
titzer
418b239f0b [wasm] Use a Managed<WasmModule> to hold metadata about modules.
This CL refactors the handling of metadata associated with WebAssembly
modules to reduce the duplicate marshalling of data from the C++ world
to the JavaScript world. It does this by wrapping the C++ WasmModule*
object in a Foreign that is rooted from the on-heap WasmCompiledModule
(which is itself just a FixedArray). Upon serialization, the C++ object
is ignored and the original WASM wire bytes are serialized. Upon
deserialization, the C++ object is reconstituted by reparsing the bytes.

This is motivated by increasing complications in implementing the JS
API, in particular WebAssembly.Table, which must perform signature
canonicalization across instances.

Additionally, this CL implements the proper base + offset initialization
behavior for tables.

R=rossberg@chromium.org,bradnelson@chromium.org,mtrofin@chromium.org,yangguo@chromium.org
BUG=v8:5507, chromium:575167, chromium:657316

Review-Url: https://chromiumcodereview.appspot.com/2424623002
Cr-Commit-Position: refs/heads/master@{#40434}
2016-10-19 13:07:22 +00:00
yangguo
61dc1de0f6 [debugger] remove test for legacy JSON API to return V8's version.
R=jgruber@chromium.org
BUG=v8:5510

Review-Url: https://chromiumcodereview.appspot.com/2430673002
Cr-Commit-Position: refs/heads/master@{#40432}
2016-10-19 12:35:34 +00:00
cbruni
b7ff0d7136 [stubs] Implement TF builtin for Object.create fast paths
BUG=

Review-Url: https://chromiumcodereview.appspot.com/2385423005
Cr-Commit-Position: refs/heads/master@{#40429}
2016-10-19 11:34:04 +00:00
ahaas
2f3ca961c7 [turbofan] Use uint32 to store the number of control outputs instead of uint16.
Using uint32 to store the the number of control outputs allows WebAssembly switches to have more than 2^16 case.

BUG=v8:5531
TEST=mjsunit/regress/wasm/regression-5531
R=titzer@chromium.org

Review-Url: https://chromiumcodereview.appspot.com/2425983002
Cr-Commit-Position: refs/heads/master@{#40420}
2016-10-19 07:25:51 +00:00
bmeurer
3a7eac15e8 [turbofan] Fix invalid Number.parseInt inlining.
The inlined version of Number.parseInt did a ToInt32 truncation, which
is not what the EcmaScript specification says.

R=jarin@chromium.org
BUG=v8:5538

Review-Url: https://chromiumcodereview.appspot.com/2432143002
Cr-Commit-Position: refs/heads/master@{#40418}
2016-10-19 05:17:52 +00:00
gdeepti
0c6354e03b [wasm] GrowMemory should use maximum size declared in WebAssembly.Memory
BUG=

Review-Url: https://codereview.chromium.org/2410763002
Cr-Commit-Position: refs/heads/master@{#40411}
2016-10-18 22:19:53 +00:00
jpp
07ac97835d [V8][asm.js] Fixes a bug in comma-expression validation.
Comma expressions need to special-handle function calls. When validating
the rhs of a Comma, the validatior needs to ensure that it returns
AsmType::Float() if the function being called is fround().

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=5528

Review-Url: https://chromiumcodereview.appspot.com/2426473007
Cr-Commit-Position: refs/heads/master@{#40408}
2016-10-18 19:05:42 +00:00
mythria
cad36659b1 [turbofan] When inlining JSCallConstruct receiver should be set to the hole.
When inlining JSCallConstruct in turbofan, receiver is initialized to model
the behaviour of constructor. When an implicit receiver is not required the
receiver value should be set to the hole value instead of undefined value.
When initializing the receiver via super calls, we check that the receiver
is the hole value.

BUG=chromium:653407

Review-Url: https://codereview.chromium.org/2424123002
Cr-Commit-Position: refs/heads/master@{#40396}
2016-10-18 11:48:15 +00:00
bmeurer
85844420a2 [turbofan] Fix return value of Array.prototype.push.
The inlined version of Array.prototype.push returned the value that was
pushed instead of the new "length" property value.

R=jarin@chromium.org
BUG=chromium:656037

Review-Url: https://codereview.chromium.org/2425903002
Cr-Commit-Position: refs/heads/master@{#40384}
2016-10-18 08:02:25 +00:00
rossberg
4a90e7220c [wasm] Implement Table#set and Table#grow
R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2414053002
Cr-Commit-Position: refs/heads/master@{#40357}
2016-10-17 11:39:34 +00:00
marja
e27ef0a603 Fix mjsunit oddities (new try).
1) assertInstanceOf(o, Foo, Bar) used to produce this error message:

Failure: expected <o> is not an instance of <Foo> but of < Bar>> found <undefined>

Fixed:

Failure: <o> is not an instance of <Foo> but of <Bar>

2) assertDoesNotThrow("throw 1") used to produce this error message:

Failure: expected <threw an exception: > found <1>

Fixed:

Failure: threw an exception: 1

3) assertDoesNotThrow("...", SomeError) was not doing what you'd
think it does, so removed the last parameter.

BUG=

Review-Url: https://codereview.chromium.org/2424743003
Cr-Commit-Position: refs/heads/master@{#40347}
2016-10-17 09:34:58 +00:00
bmeurer
96f1327a93 [turbofan] Add missing Float32 -> TaggedSigned conversion.
There are a couple of operators that can indeed produce Float32
representation, which we might end up using in a TaggedSigned
context, so add the missing conversion (indirectly via Float64).

BUG=chromium:656275
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2421193002
Cr-Commit-Position: refs/heads/master@{#40334}
2016-10-17 05:41:09 +00:00
marja
7d1a7df120 Revert of mjsunit: Fix the error message produced by assertInstanceof. (patchset #1 id:1 of https://codereview.chromium.org/2413153004/ )
Reason for revert:
This is probably not working for falsey values. I cannot JavaScript :P

Original issue's description:
> mjsunit: Fix the error message produced by assertInstanceof.
>
> Used to be:
>
> Failure: expected <foo> is not an instance of <Bar> but of < Baz>> found <undefined>
>
> Should be:
>
> Failure: <foo> is not an instance of <Bar> but of <Baz>
>
> BUG=
>
> Committed: https://crrev.com/2a480eff395756f36eb0ae2fc0a573454b394268
> Cr-Commit-Position: refs/heads/master@{#40319}

TBR=verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2421033003
Cr-Commit-Position: refs/heads/master@{#40331}
2016-10-15 06:34:19 +00:00
gdeepti
3d6f774352 [wasm] Fix bounds check for zero initial memory.
Currently when memory size references are updated with zero initial memory during GrowMemory/Relocation of Instance objects, the bounds check does not take into account the size of memtype.

R=titzer@chromium.org, bradnelson@chromium.org

Committed: https://crrev.com/70416a2b360c0d993cffb48284b143d484d1e290
Review-Url: https://codereview.chromium.org/2416543002
Cr-Original-Commit-Position: refs/heads/master@{#40326}
Cr-Commit-Position: refs/heads/master@{#40329}
2016-10-14 23:54:50 +00:00
gdeepti
2c4563003c Revert of [wasm] Fix bounds check for zero initial memory. (patchset #11 id:200001 of https://codereview.chromium.org/2416543002/ )
Reason for revert:
Reverting because of failure on V8 Linux64 GC Stress

http://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/8572

Original issue's description:
> [wasm] Fix bounds check for zero initial memory.
>
> Currently when memory size references are updated with zero initial memory during GrowMemory/Relocation of Instance objects, the bounds check does not take into account the size of memtype.
>
> R=titzer@chromium.org, bradnelson@chromium.org
>
> Committed: https://crrev.com/70416a2b360c0d993cffb48284b143d484d1e290
> Cr-Commit-Position: refs/heads/master@{#40326}

TBR=bradnelson@chromium.org,titzer@chromium.org,bradnelson@google.com,mtrofin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2416393002
Cr-Commit-Position: refs/heads/master@{#40328}
2016-10-14 22:43:24 +00:00
gsathya
b122da39d0 [async await] Fix debug async task event
If the catch prediction machinery in the middle of some async op, we
shouldn't send invalid events to the debugger.

Instead of sending events with an undefined id, we don't send them at
all.

Review-Url: https://codereview.chromium.org/2417093003
Cr-Commit-Position: refs/heads/master@{#40327}
2016-10-14 21:16:58 +00:00
gdeepti
70416a2b36 [wasm] Fix bounds check for zero initial memory.
Currently when memory size references are updated with zero initial memory during GrowMemory/Relocation of Instance objects, the bounds check does not take into account the size of memtype.

R=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2416543002
Cr-Commit-Position: refs/heads/master@{#40326}
2016-10-14 21:01:55 +00:00
marja
2a480eff39 mjsunit: Fix the error message produced by assertInstanceof.
Used to be:

Failure: expected <foo> is not an instance of <Bar> but of < Baz>> found <undefined>

Should be:

Failure: <foo> is not an instance of <Bar> but of <Baz>

BUG=

Review-Url: https://codereview.chromium.org/2413153004
Cr-Commit-Position: refs/heads/master@{#40319}
2016-10-14 14:12:04 +00:00
titzer
88a8cc7f22 [test] Disable regress-599717 on TSAN.
R=machenbach@chromium.org
BUG=v8:5513

Review-Url: https://codereview.chromium.org/2416433005
Cr-Commit-Position: refs/heads/master@{#40283}
2016-10-13 17:32:29 +00:00
titzer
283b31f57c [wasm] Reduce usage of old Wasm.* API in JS tests.
BUG=

Review-Url: https://codereview.chromium.org/2417773004
Cr-Commit-Position: refs/heads/master@{#40282}
2016-10-13 16:55:57 +00:00
rossberg
fb5b2f5241 [wasm] Implement {Compile,Runtime}Error; fix traps from start function
R=ahaas@chromium.org, titzer@chromium.org
BUG=v8:5507

Review-Url: https://codereview.chromium.org/2421453002
Cr-Commit-Position: refs/heads/master@{#40280}
2016-10-13 16:18:10 +00:00
rossberg
d95b754319 Implement Table#length and Table#get
R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2411963003
Cr-Commit-Position: refs/heads/master@{#40273}
2016-10-13 14:43:46 +00:00
ahaas
fa1f9c37d1 [wasm] Do not generate a loop stack check upon a decoder error.
A decoder error sets builder_ to null, which causes builder_->StackCheck
to segfault.

R=titzer@chromium.org

TEST=mjsunit/regress/wasm/loop-stack-check

Review-Url: https://codereview.chromium.org/2416873002
Cr-Commit-Position: refs/heads/master@{#40271}
2016-10-13 14:33:11 +00:00
clemensh
e902b69d88 [wasm] Stack inspection support for asm.js frames
This CL fixes the debugger interface to provide correct (high-level)
information for asm.js frames.
It moves the computation of the source position from the FrameInspector
to the individual StackFrame implementations, such that we can easily
specualize it for certain frame types, and can potentially reuse this
in other locations.

Also, we are finalizing the setup of the wasm module earlier, before
executing the start function. This is required for correct stack traces
during the execution of the start function.

R=titzer@chromium.org, yangguo@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2413693003
Cr-Commit-Position: refs/heads/master@{#40268}
2016-10-13 13:55:07 +00:00
neis
dafe6867f3 [modules] Implement @@iterator on namespace objects.
As part of this, introduce a new JSObject for iterating over the elements of a
FixedArray.

R=adamk@chromium.org,bmeurer@chromium.org
TBR=ulan@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2407423002
Cr-Commit-Position: refs/heads/master@{#40265}
2016-10-13 13:35:06 +00:00
jgruber
33a4faa47d [regexp] Port RegExp.prototype[@@replace]
This moves the implementation of @@replace from regexp.js to builtins-regexp.cc
(the TurboFan fast path) and runtime-regexp.cc (slow path). The fast path
handles all cases in which the regexp itself is an unmodified JSRegExp
instance, the given 'replace' argument is not callable and does not contain any
'$' characters (i.e. we are doing a string replacement).

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2398423002
Cr-Commit-Position: refs/heads/master@{#40253}
2016-10-13 11:27:50 +00:00
jgruber
e89eef3029 [regexp] Fix fallback path in RegExpExec
This fixes the code-path in RegExpExec in which both the passed exec
argument and regexp.exec are not callable and regexp is a JSRegExp.

In this case, we fall back to the default RegExp.prototype.exec
implementation. The arguments for Execution::call were incorrect.

BUG=v8:5339

Review-Url: https://codereview.chromium.org/2415073002
Cr-Commit-Position: refs/heads/master@{#40249}
2016-10-13 10:43:32 +00:00
verwaest
2325ad7e62 Allow lazy parsing of eval-created functions
I don't see a reason why we can't benefit from preparsing such functions. We don't necessarily compile them, so fully parsing them when unnecessary is just additional overhead.

BUG=v8:5501

Review-Url: https://codereview.chromium.org/2413213002
Cr-Commit-Position: refs/heads/master@{#40248}
2016-10-13 10:08:18 +00:00
ahaas
0e1f6d8bfc [wasm] Do not create TF nodes during verification
BUG=chromium:654377
TEST=mjsunit/regress/wasm/regression-654377
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2403013002
Cr-Commit-Position: refs/heads/master@{#40246}
2016-10-13 08:21:47 +00:00
gsathya
bacd0db4f2 [mjsunit] remove unnecessary AsyncFunction
Review-Url: https://codereview.chromium.org/2405173005
Cr-Commit-Position: refs/heads/master@{#40236}
2016-10-12 18:35:24 +00:00
dschuff
9b55c07698 Imported and defined globals share an index space, but previously the decoder clobbered the imported global indices with the defined globals.
BUG=none

Review-Url: https://codereview.chromium.org/2410953003
Cr-Commit-Position: refs/heads/master@{#40230}
2016-10-12 15:19:41 +00:00
clemensh
5d9fa102a7 [wasm] Provide better stack traces for asm.js code
For the asm.js to WASM pipeline, the current stack traces only show
low-level WASM information.
This CL maps this back to asm.js source positions.
It does so by attaching the asm.js source Script to the compiled WASM
module, and emitting a delta-encoded table which maps from WASM byte
offsets to positions within that Script. As asm.js code does not throw
exceptions, we only store a mapping for call instructions.

The new AsmJsWasmStackFrame implementation inherits from
WasmStackFrame, but contains the logic to provide the source script and
the position inside of it.
What is still missing is the JSFunction object returned by
CallSite.getFunction(). We currently return null.

R=jgruber@chromium.org, titzer@chromium.org
BUG=v8:4203

Review-Url: https://codereview.chromium.org/2404253002
Cr-Commit-Position: refs/heads/master@{#40205}
2016-10-12 09:17:28 +00:00
ishell
9a0109d72e [crankshaft] Range analysis should not rely on overflowed ranges.
BUG=chromium:645438

Review-Url: https://codereview.chromium.org/2412853002
Cr-Commit-Position: refs/heads/master@{#40202}
2016-10-12 09:06:32 +00:00
bmeurer
edfe391ef5 [turbofan] Fix effect chain for polymorphic array access.
We accidently dropped the effect on the floor that we have for the
polymorphic map check in case of array elements access.

BUG=chromium:655004
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2411273002
Cr-Commit-Position: refs/heads/master@{#40201}
2016-10-12 08:31:55 +00:00
adamk
1eaf2927ba Change TF regression test to not trigger tons of allocation
Instead of allocating an ArrayBuffer in the test, use a different example
from the original bug.

R=bmeurer@chromium.org
BUG=chromium:644631, v8:5504

Review-Url: https://codereview.chromium.org/2408403002
Cr-Commit-Position: refs/heads/master@{#40195}
2016-10-12 07:33:29 +00:00
bmeurer
a4f37da86f [turbofan] Respect ConsString invariant.
For ConsString, the left hand side must be either sequential or external
if the right hand side is empty.

R=jarin@chromium.org
BUG=chromium:654723
NOTRY=true

Review-Url: https://codereview.chromium.org/2410893003
Cr-Commit-Position: refs/heads/master@{#40192}
2016-10-12 07:00:52 +00:00
adamk
d4c4618174 Remove --harmony-for-in flag which is always false
The ES spec has been updated to include this legacy syntax in Annex B:
https://tc39.github.io/ecma262/#sec-initializers-in-forin-statement-heads

R=neis@chromium.org
BUG=v8:4942

Review-Url: https://codereview.chromium.org/2407863003
Cr-Commit-Position: refs/heads/master@{#40189}
2016-10-11 23:20:58 +00:00
titzer
ff6941966e [wasm] Canonicalize function signature indices for matching in indirect calls.
R=bradnelson@chromium.org, ahaas@chromium.org, clemensh@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2403093002
Cr-Commit-Position: refs/heads/master@{#40169}
2016-10-11 12:40:33 +00:00
petermarshall
08217e45a7 [builtins] Move StringStartsWith to a C++ builtin.
BUG=v8:5364

Review-Url: https://codereview.chromium.org/2407173002
Cr-Commit-Position: refs/heads/master@{#40165}
2016-10-11 11:36:12 +00:00
petermarshall
5af6ec76b2 [builtins] Move StringEndsWith to a C++ builtin.
BUG=v8:5364

Review-Url: https://codereview.chromium.org/2406873002
Cr-Commit-Position: refs/heads/master@{#40164}
2016-10-11 11:28:12 +00:00
jgruber
effb8def76 [regexp] Skip regexp-property-lu-ui test in gc-stress
This test is timing out in gc-stress mode since RegExp.prototype.test
was moved to C++. RE.proto.test will be improved shortly, and this test
should be reenabled then.

BUG=v8:5339
NOTRY=true

Review-Url: https://codereview.chromium.org/2407133002
Cr-Commit-Position: refs/heads/master@{#40150}
2016-10-11 07:19:45 +00:00
yangguo
0d8e52123e [Math] implement Math.random as TFJ builtin.
R=bmeurer@chromium.org
BUG=v8:5049, v8:5086

Review-Url: https://codereview.chromium.org/2402363002
Cr-Commit-Position: refs/heads/master@{#40149}
2016-10-11 06:47:15 +00:00
bradnelson
b884a51ff2 Re-enable fasta on gc_stress.
BUG=v8:5053
TEST=None
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2395333003
Cr-Commit-Position: refs/heads/master@{#40136}
2016-10-10 17:59:32 +00:00
neis
9606a938a6 [modules] Extend a namespace test.
Extend a test of namespace imports such that it accesses the object inside a
with statement (inside a sloppy function).

Drive-by-fix: remove duplicate initialization of embedder data (probably due to
bad merge).

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2405603003
Cr-Commit-Position: refs/heads/master@{#40129}
2016-10-10 16:56:36 +00:00
petermarshall
8b48aa1cda [builtins] Move StringIncludes to a builtin.
Also add a test for when the first argument is null or undefined, as there are no tests that cover this currently.

BUG=v8:5364

Review-Url: https://codereview.chromium.org/2399423003
Cr-Commit-Position: refs/heads/master@{#40127}
2016-10-10 15:01:32 +00:00
mtrofin
b75a0c4a55 [wasm] Fix wasm instantiation flakes
The spurious failures were caused by the compiled module
template and its corresponding owning object getting out of
sync due to memory allocations (which may trigger GC)
between the points each were fetched.

Specifically, the {original} was first obtained; then a GC
may happen when cloning the {code_table}. At this point,
the {original}'s owner may have been collected, getting us
down the path of not cloning. When time comes to patch up
globals, we incorrectly try to patch them assuming the
global start is at 0 (nullptr), which in fact it isn't.

This change roots early, in a GC-free area, both objects.
Additionally, it avoids publishing to the instances chain
the new instance until the very end. This way:
- the objects used to create the new instance offer a
consistent view
- the instances chain does not see the object we try to
form. If something fails, we can safely retry.
- since the owner is rooted, the state of the front of the
instances chain stays unchanged - with the same compiled
module we started from. So the early belief that we needed
to clone is not invalidated by any interspersed GC.

This situation suffers from a sub-optimality discussed in
the design document, in that, in a memory constrained
system, the following snippet may surprisingly fail:

var m = new WebAssembly.Module(...);
var i1 = new WebAssembly.Instance(m);
i1 = null;
var i2 = new WebAssembly.Instance(m); //may fail.

This will be addressed subsequently.

BUG=v8:5451

Review-Url: https://codereview.chromium.org/2395063002
Cr-Commit-Position: refs/heads/master@{#40126}
2016-10-10 14:53:58 +00:00
titzer
d20dabb090 [wasm] Base address for data segments can also be the value of a global variable.
R=rossberg@chromium.org
BUG=chromium:575167
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux64_msan_rel

Committed: https://crrev.com/640ae3f9d20dcae915dbfa978bf48944cd4d0dc3
Review-Url: https://codereview.chromium.org/2403823002
Cr-Original-Commit-Position: refs/heads/master@{#40121}
Cr-Commit-Position: refs/heads/master@{#40125}
2016-10-10 14:42:10 +00:00
machenbach
a6fb296a78 Revert of [wasm] Base address for data segments can also be the value of a global variable. (patchset #1 id:1 of https://codereview.chromium.org/2403823002/ )
Reason for revert:
msan not happy:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/11332

Original issue's description:
> [wasm] Base address for data segments can also be the value of a global variable.
>
> R=rossberg@chromium.org
> BUG=chromium:575167
>
> Committed: https://crrev.com/640ae3f9d20dcae915dbfa978bf48944cd4d0dc3
> Cr-Commit-Position: refs/heads/master@{#40121}

TBR=rossberg@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2402373002
Cr-Commit-Position: refs/heads/master@{#40123}
2016-10-10 14:12:52 +00:00
titzer
640ae3f9d2 [wasm] Base address for data segments can also be the value of a global variable.
R=rossberg@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2403823002
Cr-Commit-Position: refs/heads/master@{#40121}
2016-10-10 13:26:26 +00:00
marja
e474e5ffc8 PreParsing inner functions: Fix declaration-only variables, part 2.
If an inner function only declares a variable but doesn't use it, Parser
and PreParser produced different unresolved variables, and that confused
the pessimistic context allocation.

This is continuation to https://codereview.chromium.org/2388183003/

This CL fixes more complicated declarations (which are not just one
identifier). For this, PreParser needs to accumulate identifiers used
in expressions.

In addition, this CL manifests FLAG_lazy_inner_functions in tests, so that
we get clusterfuzz coverage for it.

BUG=chromium:650969, v8:5501

Review-Url: https://codereview.chromium.org/2400613003
Cr-Commit-Position: refs/heads/master@{#40112}
2016-10-10 09:22:34 +00:00
bmeurer
f6bd23f244 [turbofan] Enforce native context specialization.
There were once plans to generate cross-context code with TurboFan,
however that doesn't fit into the model anymore, and so all of this
is essentially dead untested code (and thus most likely already broken
in subtle ways). With this mode still in place it would also be a lot
harder to make inlining based on SharedFunctionInfo work.

BUG=v8:2206,v8:5499
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2406803002
Cr-Commit-Position: refs/heads/master@{#40109}
2016-10-10 05:53:51 +00:00
neis
57ba0ae10e [modules] Implement namespace imports.
This implements namespace imports (import * as foo from "bar"), except for the
@@iterator property on namespace objects (to be done later).

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2388153003
Cr-Commit-Position: refs/heads/master@{#40096}
2016-10-07 19:37:28 +00:00
machenbach
b072d014d8 [test] Skip more flaky wasm tests for gc stress
BUG=v8:5451,v8:5496
TBR=mtrofin@chromium.org, titzer@chromium.org, ahaas@chromium.org
NOTRY=true
NOTREECHECKS=true

Review-Url: https://codereview.chromium.org/2399343003
Cr-Commit-Position: refs/heads/master@{#40091}
2016-10-07 16:36:57 +00:00
titzer
e3ff4cf8c9 [wasm] Implement importing of WebAssembly.Memory.
R=mtrofin@chromium.org,gdeepti@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2392943006
Cr-Commit-Position: refs/heads/master@{#40076}
2016-10-07 09:34:27 +00:00
gdeepti
19dab886a4 [wasm] Simd128 types should not be available in asmjs modules.
- Added gating code in the module-decoder to allow SIMD code only when
 it can be decoded correctly
 - SIMD128 values should not be exported to JS
 - Try/Catch should not be available in asmjs modules
 - Trivial fixes for S128  values

BUG=chromium:648079

R=ahaas@chromium.org, titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2400863003
Cr-Commit-Position: refs/heads/master@{#40067}
2016-10-07 07:52:19 +00:00
adamk
3aeaf49781 [modules] Add basic path normalization to d8's module loader
d8 now elides './' when constructing absolute paths.
'../' is still not normalized.

R=neis@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2393243002
Cr-Commit-Position: refs/heads/master@{#40057}
2016-10-06 19:32:37 +00:00
gsathya
9d836ec64a [promises] fix deferred object leak
This patch sets `this` to be undefined when calling resolve and reject
functions attached to the deferred.

BUG=v8:5476

Review-Url: https://codereview.chromium.org/2399053003
Cr-Commit-Position: refs/heads/master@{#40056}
2016-10-06 18:29:35 +00:00
titzer
e97ca6ec47 [wasm] Refactor import handling for 0xC.
Imports and exports in 0xC can be much more than functions, including
tables, memories, and globals. This CL refactors the underlying
organization of imports and exports to support these new import types.

BUG=

Committed: https://crrev.com/599f8a83420346d9cba5ff97bd2a7520468207b6
Review-Url: https://codereview.chromium.org/2390113003
Cr-Original-Commit-Position: refs/heads/master@{#40033}
Cr-Commit-Position: refs/heads/master@{#40050}
2016-10-06 15:43:22 +00:00
hablich
3b1b544c20 Revert of [wasm] Refactor import handling for 0xC. (patchset #10 id:180001 of https://codereview.chromium.org/2390113003/ )
Reason for revert:
Failes a few GC stress tests.https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/6253

Original issue's description:
> [wasm] Refactor import handling for 0xC.
>
> Imports and exports in 0xC can be much more than functions, including
> tables, memories, and globals. This CL refactors the underlying
> organization of imports and exports to support these new import types.
>
> BUG=
>
> Committed: https://crrev.com/599f8a83420346d9cba5ff97bd2a7520468207b6
> Cr-Commit-Position: refs/heads/master@{#40033}

TBR=mtrofin@chromium.org,ahaas@chromium.org,bradnelson@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2395133002
Cr-Commit-Position: refs/heads/master@{#40038}
2016-10-06 13:43:23 +00:00
titzer
599f8a8342 [wasm] Refactor import handling for 0xC.
Imports and exports in 0xC can be much more than functions, including
tables, memories, and globals. This CL refactors the underlying
organization of imports and exports to support these new import types.

BUG=

Review-Url: https://codereview.chromium.org/2390113003
Cr-Commit-Position: refs/heads/master@{#40033}
2016-10-06 12:30:50 +00:00
jarin
5d6b514192 Reland of "[turbofan] Osr value typing + dynamic type checks on entry. (patchset #5 id:80001 of https://codereview.chromium.org/2384113002/ )"
Fixes:

- Remove OsrGuards on frame specialization (for asm.js).
- Handle the rename in the walk for native context.
- Fix LoadContext effect wiring for Osr context chains.

Review-Url: https://codereview.chromium.org/2388303006
Cr-Commit-Position: refs/heads/master@{#40021}
2016-10-06 06:42:29 +00:00
bradnelson
e901ccdd18 [wasm] [asm.js] Fix asm.js issues around floating point globals.
Allow fround to take values without dots for globals (the spec allows this
subtly).

Drop over-restrictive assert preventing floating point globals from working.

BUG=v8:4203
R=jpp@chromium.org,aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2397823003
Cr-Commit-Position: refs/heads/master@{#40013}
2016-10-05 19:46:25 +00:00
mstarzinger
c22e4278ec [interpreter] Module tests in all Ignition variants.
This makes sure we run the module tests against all variants using
Ignition as the first compilation tier. It will henceforth extend the
test coverage to the BytecodeGraphBuilder as well.

R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2397733002
Cr-Commit-Position: refs/heads/master@{#39992}
2016-10-05 13:06:09 +00:00
machenbach
9fc7bbb13e [test] Skip asm-wasm for gc_stress and ignition
BUG=v8:5451
NOTRY=true
TBR=titzer@chromium.org, ahaas@chromium.org, rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2389703006
Cr-Commit-Position: refs/heads/master@{#39989}
2016-10-05 12:12:02 +00:00
jarin
ff81734cb9 Revert of [turbofan] Osr value typing + dynamic type checks on entry. (patchset #5 id:80001 of https://codereview.chromium.org/2384113002/ )
Reason for revert:
Tanks the world.

Original issue's description:
> [turbofan] Osr value typing + dynamic type checks on entry.
>
> This introduces a new OsrGuard node that is inserted during graph building
> to guard the inferred type of the OSR value.
>
> The type of the OSR value is inferred by running the typer before OSR
> deconstruction, and then taking the type from the phi that takes the
> OSR value. After the deconstruction, we throw the types away.
>
> At the moment we only support the SignedSmall OSR type and we always
> pick the tagged representation. Later, we might want to support more
> types (such as Number) and pick better representations (int32/float64).
>
> This CL also removes the OSR deconstruction tests because they build
> unrealistic graph (no effect chain, no loop termination). I considered
> adding the effect chains to the tests, but this would make the tests
> even more brittle.
>
> Committed: https://crrev.com/1f5dc90a900d222da44bee3eff171a2ba1e3c076
> Cr-Commit-Position: refs/heads/master@{#39971}

TBR=bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2395783002
Cr-Commit-Position: refs/heads/master@{#39985}
2016-10-05 10:34:33 +00:00
ahaas
aa93e6ca95 [wasm] Call a runtime function for a MemorySize instruction.
The implementation of MemorySize with RelocatableInt32Constants is
problematic if MemorySize is placed close to a GrowMemory instruction in
the code. The use of a runtime function guarantees that the order in
which MemorySize and GrowMemory is executed is correct.

R=titzer@chromium.org
BUG=chromium:651961
TEST=mjsunit/regress/wasm/regression-651961

Committed: https://crrev.com/2c12a9a42d454a36fcd2931fa458d72832eeb689
Review-Url: https://codereview.chromium.org/2386183004
Cr-Original-Commit-Position: refs/heads/master@{#39972}
Cr-Commit-Position: refs/heads/master@{#39980}
2016-10-05 09:12:08 +00:00
ahaas
9701e79127 Revert of [wasm] Call a runtime function for a MemorySize instruction. (patchset #2 id:20001 of https://codereview.chromium.org/2386183004/ )
Reason for revert:
Patch problem

Original issue's description:
> [wasm] Call a runtime function for a MemorySize instruction.
>
> The implementation of MemorySize with RelocatableInt32Constants is
> problematic if MemorySize is placed close to a GrowMemory instruction in
> the code. The use of a runtime function guarantees that the order in
> which MemorySize and GrowMemory is executed is correct.
>
> R=titzer@chromium.org
> BUG=chromium:651961
> TEST=mjsunit/regress/wasm/regression-651961
>
> Committed: https://crrev.com/2c12a9a42d454a36fcd2931fa458d72832eeb689
> Cr-Commit-Position: refs/heads/master@{#39972}

TBR=titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:651961

Review-Url: https://codereview.chromium.org/2391223002
Cr-Commit-Position: refs/heads/master@{#39973}
2016-10-05 06:12:18 +00:00
ahaas
2c12a9a42d [wasm] Call a runtime function for a MemorySize instruction.
The implementation of MemorySize with RelocatableInt32Constants is
problematic if MemorySize is placed close to a GrowMemory instruction in
the code. The use of a runtime function guarantees that the order in
which MemorySize and GrowMemory is executed is correct.

R=titzer@chromium.org
BUG=chromium:651961
TEST=mjsunit/regress/wasm/regression-651961

Review-Url: https://codereview.chromium.org/2386183004
Cr-Commit-Position: refs/heads/master@{#39972}
2016-10-05 06:06:58 +00:00
jarin
1f5dc90a90 [turbofan] Osr value typing + dynamic type checks on entry.
This introduces a new OsrGuard node that is inserted during graph building
to guard the inferred type of the OSR value.

The type of the OSR value is inferred by running the typer before OSR
deconstruction, and then taking the type from the phi that takes the
OSR value. After the deconstruction, we throw the types away.

At the moment we only support the SignedSmall OSR type and we always
pick the tagged representation. Later, we might want to support more
types (such as Number) and pick better representations (int32/float64).

This CL also removes the OSR deconstruction tests because they build
unrealistic graph (no effect chain, no loop termination). I considered
adding the effect chains to the tests, but this would make the tests
even more brittle.

Review-Url: https://codereview.chromium.org/2384113002
Cr-Commit-Position: refs/heads/master@{#39971}
2016-10-05 05:56:54 +00:00
jarin
a974970cff [turbofan] Check instruction input/output count limits in instruction selector.
BUG=chromium:625966

Review-Url: https://codereview.chromium.org/2390303002
Cr-Commit-Position: refs/heads/master@{#39970}
2016-10-05 05:43:35 +00:00
mtrofin
c938f0df22 [wasm] explicitly mark off unlinked wasm module instances
This fixes a gc stress bug. We cannot rely on an ordering of
clearing of the weak cells, so we explicitly reset the weak
link to the owning instance, when finalizing a compiled
module. In turn, this serves as a reliable signal when GCs
happen while instantiating, allowing us to correctly link the
new instance.

BUG=chromium:652425

Review-Url: https://codereview.chromium.org/2393443003
Cr-Commit-Position: refs/heads/master@{#39964}
2016-10-04 21:23:24 +00:00
adamk
3c39bac440 Don't skip hole checks inside patterns in parameter lists
Previously, b6e9f625c1 fixed self-assignment
in parameters to throw. But it failed to deal with the case of
destructuring with defaults. This patch extends that previous approach
to always treat the end of a parameter as its initializer position,
whether it has an initializer or not.

This is the minimal change to make it easy to merge; a follow-up
will rename the field of Parameter from "initializer_end_position"
to "end_position".

BUG=v8:5454

Review-Url: https://codereview.chromium.org/2390943002
Cr-Commit-Position: refs/heads/master@{#39962}
2016-10-04 17:04:19 +00:00
jgruber
7d26871d2d [stubs] Port String.prototype.substr to TurboFan
BUG=v8:5415

Review-Url: https://codereview.chromium.org/2373493002
Cr-Commit-Position: refs/heads/master@{#39951}
2016-10-04 12:00:28 +00:00
leszeks
4ad3579119 [ignition] Fix building lookup graph when search depth is 0
In some (rare) cases, the context depth passed to a dynamic variable lookup can
be zero. In these cases, the fast path for the lookup (i.e. load from context or
global) can always be taken, as there is no need to search the current context.

However, with no slow path checks, the bytecode graph builder had a null
environment for the slow path, causing segfaults when this graph was built.

This patch adds a null check for the slow path environment, and skips building
the slow path if the environment is null.

BUG=chromium:652186

Review-Url: https://codereview.chromium.org/2385123002
Cr-Commit-Position: refs/heads/master@{#39949}
2016-10-04 11:08:11 +00:00
marja
22ff09e06a PreParsing inner functions: Fix declaration-only variables.
If an inner function only declares a variable but doesn't use it, Parser
and PreParser produced different unresolved variables, and that confused
the pessimistic context allocation.

BUG=chromium:650969

Review-Url: https://codereview.chromium.org/2388183003
Cr-Commit-Position: refs/heads/master@{#39947}
2016-10-04 09:38:46 +00:00
verwaest
9feab2d208 Mark param as used when we force context allocation due to implement access through arguments
Currently the parameter is first parsed as a reference, and then translated into a parameter. The reference stays around though, and gets resolved to the parameter. That automatically creates a use. Now that I drop all unresolved references when we abort preparsing, that also drops the unresolved reference.

Instead, mark the variable as used when its marked as forced context allocation. That's what happens in almost all other cases.

This raises the question: does it really make sense to parse parameters this ways? It seems pretty generic, but neither fast nor memory-efficient ... Did I misunderstand something?

Just land if you think the CL looks good as is.

BUG=chromium:651613

Review-Url: https://codereview.chromium.org/2386623002
Cr-Commit-Position: refs/heads/master@{#39935}
2016-10-03 17:21:20 +00:00
jpp
7ed565b6a5 [WASM] Implements catch for the wasm low level exception mechanism.
This is essentially CL/2275293002, with the difference that the effect
dependencies are now updated correctly.

BUG=

Review-Url: https://codereview.chromium.org/2378773013
Cr-Commit-Position: refs/heads/master@{#39919}
2016-09-30 16:09:32 +00:00
neis
427242326c Reland: [modules] Properly initialize declared variables.
Before evaluating a module, all variables declared at the top-level
in _any_ of the modules in the dependency graph must be initialized.
This is observable because a module A can access a variable imported
from module B (e.g. a function) at a point when module B's body hasn't
been evaluated yet.

We achieve this by implementing modules internally as generators with
two states (not initialized, initialized).

R=adamk@chromium.org
BUG=v8:1569
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg

Committed: https://crrev.com/f4dfb6fbe1cdd9a0f287a1a9c496e1f69f6f5d20
Committed: https://crrev.com/8c52a411583e870bd5ed100864caa58f491c5d88
Review-Url: https://codereview.chromium.org/2375793002
Cr-Original-Original-Commit-Position: refs/heads/master@{#39871}
Cr-Original-Commit-Position: refs/heads/master@{#39892}
Cr-Commit-Position: refs/heads/master@{#39900}
2016-09-30 07:53:57 +00:00
bmeurer
669cb71e60 Revert of Reland: [modules] Properly initialize declared variables. (patchset #6 id:100001 of https://codereview.chromium.org/2375793002/ )
Reason for revert:
Speculative revert for christmas tree

Original issue's description:
> Reland: [modules] Properly initialize declared variables.
>
> Before evaluating a module, all variables declared at the top-level
> in _any_ of the modules in the dependency graph must be initialized.
> This is observable because a module A can access a variable imported
> from module B (e.g. a function) at a point when module B's body hasn't
> been evaluated yet.
>
> We achieve this by implementing modules internally as generators with
> two states (not initialized, initialized).
>
> R=adamk@chromium.org
> BUG=v8:1569
> CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg
>
> Committed: https://crrev.com/f4dfb6fbe1cdd9a0f287a1a9c496e1f69f6f5d20
> Committed: https://crrev.com/8c52a411583e870bd5ed100864caa58f491c5d88
> Cr-Original-Commit-Position: refs/heads/master@{#39871}
> Cr-Commit-Position: refs/heads/master@{#39892}

TBR=adamk@chromium.org,mstarzinger@chromium.org,machenbach@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2387593002
Cr-Commit-Position: refs/heads/master@{#39896}
2016-09-30 04:22:41 +00:00
neis
8c52a41158 Reland: [modules] Properly initialize declared variables.
Before evaluating a module, all variables declared at the top-level
in _any_ of the modules in the dependency graph must be initialized.
This is observable because a module A can access a variable imported
from module B (e.g. a function) at a point when module B's body hasn't
been evaluated yet.

We achieve this by implementing modules internally as generators with
two states (not initialized, initialized).

R=adamk@chromium.org
BUG=v8:1569
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_win_dbg

Committed: https://crrev.com/f4dfb6fbe1cdd9a0f287a1a9c496e1f69f6f5d20
Review-Url: https://codereview.chromium.org/2375793002
Cr-Original-Commit-Position: refs/heads/master@{#39871}
Cr-Commit-Position: refs/heads/master@{#39892}
2016-09-29 22:24:56 +00:00
adamk
a2a9b4a7ea Revert of [wasm] Remove improper assembler check for grow memory. (patchset #2 id:20001 of https://codereview.chromium.org/2376153003/ )
Reason for revert:
grow-memory test now fails on Linux dbg, blocking the CQ:

https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/11217

Original issue's description:
> [wasm] Remove improper assembler check for grow memory.
>
> Note that the offset can still be out of bounds, even after grow memory. The calculation of the remaining size can overflow.
>
> R=gdeepti@chromium.org
> BUG=chromium:644670
>
> Committed: https://crrev.com/e6071a9c067e07304329250e040b652fb82e9b5e
> Cr-Commit-Position: refs/heads/master@{#39886}

TBR=gdeepti@chromium.org,titzer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:644670

Review-Url: https://codereview.chromium.org/2378973003
Cr-Commit-Position: refs/heads/master@{#39889}
2016-09-29 21:54:57 +00:00
titzer
e6071a9c06 [wasm] Remove improper assembler check for grow memory.
Note that the offset can still be out of bounds, even after grow memory. The calculation of the remaining size can overflow.

R=gdeepti@chromium.org
BUG=chromium:644670

Review-Url: https://codereview.chromium.org/2376153003
Cr-Commit-Position: refs/heads/master@{#39886}
2016-09-29 18:04:00 +00:00
titzer
424cd4cf84 [wasm] Implement WebAssembly.validate()
R=bradnelson@chromium.org,mtrofin@chromium.org
BUG=chromium:575167

Review-Url: https://codereview.chromium.org/2384513002
Cr-Commit-Position: refs/heads/master@{#39885}
2016-09-29 18:02:58 +00:00
machenbach
5bb978461f Revert of [WASM] Implements catch for the wasm low level exception mechanism. (patchset #16 id:300001 of https://codereview.chromium.org/2275293002/ )
Reason for revert:
nosse4 errors:
https://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/13524
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/11215

Original issue's description:
> [WASM] Implements catch for the wasm low level exception mechanism.
>
> BUG=
>
> Committed: https://crrev.com/93e5425c46453764779bd557628d61fae670027a
> Cr-Commit-Position: refs/heads/master@{#39881}

TBR=titzer@chromium.org,bradnelson@chromium.org,jpp@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2383613002
Cr-Commit-Position: refs/heads/master@{#39884}
2016-09-29 18:00:52 +00:00
jpp
93e5425c46 [WASM] Implements catch for the wasm low level exception mechanism.
BUG=

Review-Url: https://codereview.chromium.org/2275293002
Cr-Commit-Position: refs/heads/master@{#39881}
2016-09-29 15:59:29 +00:00
caitp
3c52ac79cd Reland "[builtins] migrate C++ String Iterator builtins to baseline TurboFan"
Migrate newly added C++ String Iterator builtins to TFJ builtins, per
step 4. of the String Iterator Baseline Implementation section of the design doc

BUG=v8:5388
R=bmeurer@chromium.org, mstarzinger@chromium.org, jkummerow@chromium.org

Committed: https://crrev.com/f9a2c8b1112c4e915df8bc5f7ea1fccdf7a33ff8
Cr-Commit-Position: refs/heads/master@{#39765}

patch from issue 2358263002 at patchset 260001 (http://crrev.com/2358263002#ps260001)

Review-Url: https://codereview.chromium.org/2381053002
Cr-Commit-Position: refs/heads/master@{#39879}
2016-09-29 15:49:19 +00:00
leszeks
537c855882 [ignition] BytecodeGraphBuilder: Merge correct environment in try block
Making new nodes inside of exception-handled blocks fiddles around with the
current environment to merge the exception paths. In particular, the current
environment pointer is mutated. This patch ensures that when we merge the fast
and slow paths of the LdaContextLookup, we actually merge the correct
environment and do not accidentally merge the exceptional environment.

BUG=chromium:651394

Review-Url: https://codereview.chromium.org/2379043002
Cr-Commit-Position: refs/heads/master@{#39878}
2016-09-29 15:18:06 +00:00
machenbach
7496c9de94 Revert of [modules] Properly initialize declared variables. (patchset #5 id:80001 of https://codereview.chromium.org/2375793002/ )
Reason for revert:
Suspect for causing win64 debug problems:
https://build.chromium.org/p/client.v8/builders/V8%20Win64%20-%20debug/builds/12646

Original issue's description:
> [modules] Properly initialize declared variables.
>
> Before evaluating a module, all variables declared at the top-level
> in _any_ of the modules in the dependency graph must be initialized.
> This is observable because a module A can access a variable imported
> from module B (e.g. a function) at a point when module B's body hasn't
> been evaluated yet.
>
> We achieve this by implementing modules internally as generators with
> two states (not initialized, initialized).
>
> R=adamk@chromium.org
> BUG=v8:1569
>
> Committed: https://crrev.com/f4dfb6fbe1cdd9a0f287a1a9c496e1f69f6f5d20
> Cr-Commit-Position: refs/heads/master@{#39871}

TBR=adamk@chromium.org,mstarzinger@chromium.org,neis@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2379063002
Cr-Commit-Position: refs/heads/master@{#39873}
2016-09-29 15:10:30 +00:00
neis
f4dfb6fbe1 [modules] Properly initialize declared variables.
Before evaluating a module, all variables declared at the top-level
in _any_ of the modules in the dependency graph must be initialized.
This is observable because a module A can access a variable imported
from module B (e.g. a function) at a point when module B's body hasn't
been evaluated yet.

We achieve this by implementing modules internally as generators with
two states (not initialized, initialized).

R=adamk@chromium.org
BUG=v8:1569

Review-Url: https://codereview.chromium.org/2375793002
Cr-Commit-Position: refs/heads/master@{#39871}
2016-09-29 14:20:56 +00:00
verwaest
fecd09ce32 Readd default function variables upon scope reset for preparse abort
BUG=chromium:651327

Review-Url: https://codereview.chromium.org/2380993003
Cr-Commit-Position: refs/heads/master@{#39864}
2016-09-29 13:29:15 +00:00
mtrofin
aff5ab1132 [wasm] fix for GC during instantiation.
BUG=chromium:651070

Review-Url: https://codereview.chromium.org/2371403003
Cr-Commit-Position: refs/heads/master@{#39848}
2016-09-29 04:24:42 +00:00
mtrofin
df490c3484 [wasm] Fix for cloning module heap size value
The module size is encoded as a HeapNumber, and needs to be
explicitly cloned.

BUG=chromium:647649

Review-Url: https://codereview.chromium.org/2347333002
Cr-Commit-Position: refs/heads/master@{#39845}
2016-09-29 00:48:28 +00:00
gdeepti
64e43be959 Fix bounds check of a store instruction after a grow_memory instruction
- Store instruction with an offset bigger than GrowMemory offset should handle out of bounds correctly
 - Refactor to separate runnning from compile so arguments can be passed in to module builder tests.

BUG=chromium:644670

R=ahaas@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/2373613004
Cr-Commit-Position: refs/heads/master@{#39840}
2016-09-28 20:56:01 +00:00