Commit Graph

42579 Commits

Author SHA1 Message Date
Deepti Gandluri
bdb9e7a517 Revert "[wasm-simd] Implement remaining I8x16 SIMD ops on x64"
This reverts commit de88bfb270.

Reason for revert: Breaks msvc build https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20msvc/5765

Original change's description:
> [wasm-simd] Implement remaining I8x16 SIMD ops on x64
> 
>  - Implementation for I8x16 Shifts, and Mul
>  - Fix convert bug
>  - Enable all tests except for shuffle tests
> 
> Change-Id: Id1a469d2883c30ea782c51d21dc462d211f94420
> Reviewed-on: https://chromium-review.googlesource.com/c/1318609
> Reviewed-by: Bill Budge <bbudge@chromium.org>
> Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57254}

TBR=bbudge@chromium.org,gdeepti@chromium.org

Change-Id: I09efd8002e27f457e89250336e6c3a12d8d9682c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/1318097
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57257}
2018-11-06 00:02:03 +00:00
Deepti Gandluri
de88bfb270 [wasm-simd] Implement remaining I8x16 SIMD ops on x64
- Implementation for I8x16 Shifts, and Mul
 - Fix convert bug
 - Enable all tests except for shuffle tests

Change-Id: Id1a469d2883c30ea782c51d21dc462d211f94420
Reviewed-on: https://chromium-review.googlesource.com/c/1318609
Reviewed-by: Bill Budge <bbudge@chromium.org>
Commit-Queue: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57254}
2018-11-05 23:30:16 +00:00
Jakob Kummerow
6d706ae3a0 [ubsan] Port Smi to the new design
and split Smi out of objects.h into smi.h.

Bug: v8:3770, v8:5402
Change-Id: I5ff7461495d29c785a76c79aca2616816a29ab1e
Reviewed-on: https://chromium-review.googlesource.com/c/1313035
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57252}
2018-11-05 20:52:51 +00:00
Frank Tang
31ee18096e [Intl] Stage Intl.ListFormat
This will give us some clusterfuzz coverage.

Bug: v8:7871
Change-Id: I670572454e196b7617a446769216722302f697a9
Reviewed-on: https://chromium-review.googlesource.com/c/1306973
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57250}
2018-11-05 19:55:14 +00:00
Georg Neis
c0ca982ca5 [turbofan] Remove redundant call to SerializePrototype.
The maps in question are already processed in
NativeContextData::Serialize.

R=jarin@chromium.org

Bug: v8:7790
Change-Id: Ifbbff64e10458605b09c74fe09e574b2f2659839
Reviewed-on: https://chromium-review.googlesource.com/c/1317809
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57247}
2018-11-05 17:37:56 +00:00
Toon Verwaest
20ce2c6f87 [parser] Use ScopedPtrList for more statement lists
In particular FunctionLiteral body. Now clients cannot use
function_literal->body() == nullptr anymore to figure out whether it was
preparsed; but have to check the eager compile hint.

Change-Id: Ia0d3a6b51c6fb7e803157e98a9d224224e03c8a7
Reviewed-on: https://chromium-review.googlesource.com/c/1317811
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57246}
2018-11-05 16:21:28 +00:00
Clemens Hammacher
2d7b85a526 [wasm][cleanup] Avoid return-after-else
Use early returns instead. The general scheme is to return early in the
abnormal case (e.g. error) and fall through to the end of the method in
the normal case.

R=ahaas@chromium.org

Bug: v8:8238
Change-Id: I281d35f5aad1f51b6d476fdc685565d9819397bb
Reviewed-on: https://chromium-review.googlesource.com/c/1317812
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57245}
2018-11-05 15:57:40 +00:00
Toon Verwaest
c28ecb1a86 [parser] Fix IsValidReferenceExpression
A Property access is only a valid reference expression if the accessed object
is a valid expression.

Bug: v8:8409
Change-Id: I9bc9ac60ca3bf4e261d10af97aba18e9db2085ea
Reviewed-on: https://chromium-review.googlesource.com/c/1317816
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57244}
2018-11-05 15:54:00 +00:00
Michael Starzinger
fc755be9da [wasm] Enable node splitting during scheduling.
R=herhut@chromium.org

Change-Id: Ice45defac8f065b6b1c848fd42ead6ab46da89ab
Reviewed-on: https://chromium-review.googlesource.com/c/1317573
Reviewed-by: Stephan Herhut <herhut@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57243}
2018-11-05 15:52:51 +00:00
Marja Hölttä
a51f3fc652 [js weak refs] Add WeakRef
- Add the WeakRef class and its deref() function.

- Add WeakFactory.prototype.makeRef

- Implement the "keep during job" behavior for WeakRef constructor and deref().

- Here we keep the targets alive longer than until the end of the job
  (microtask), contradicting the spec. However, this is probably the indended
  behavior, see https://github.com/tc39/proposal-weakrefs/issues/39 .

BUG=v8:8179

Change-Id: I41990d41ac1799e34f675d8431b9a7aa7ed3d48d
Reviewed-on: https://chromium-review.googlesource.com/c/1306435
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57242}
2018-11-05 15:10:46 +00:00
peterwmwong
986aa36b1f [builtins] Add Array.p.join fastpath for single element array.
This is resurrecting an optimization from the pre-torque version.
Avoid allocating another sequential string for the result when there's only one
element, just return the ToString-ed element.  This not only saves time writing
to this destination string, but also reduce GC pressure.

The System Health Memory Benchmark (load:media:google_images) exposed this missing
optimization with a 15% regression in memory usage.  Very large external strings
were being copied into V8's heap as sequential string.

Bug: chromium:896612
Change-Id: Ieb61906f64100cdc15bf96f3ebcccb1207f75356
Reviewed-on: https://chromium-review.googlesource.com/c/1316620
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Peter Wong <peter.wm.wong@gmail.com>
Cr-Commit-Position: refs/heads/master@{#57241}
2018-11-05 14:45:34 +00:00
Georg Neis
87e1b85d9f Reland "Add fast paths to Array.from."
This is a reland of 7bd9eb7e1e. No changes
to that patch other than adding a test case. The bug that lead to the
revert has been fixed in 9bf8f72c5b.

Original change's description:
> Add fast paths to Array.from.
>
> This reuses the fast path from IterableToList for Array.from. The fast
> paths are taken when .from is called with the receiver Array and the only
> argument is the iterable (no mapping function or thisArg).
>
> Bug: v8:7980
> Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746
> Reviewed-on: https://chromium-review.googlesource.com/c/1297322
> Commit-Queue: Hai Dang <dhai@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56993}

Bug: v8:7980
Change-Id: Id081837946c0989ec2b31ce991f48d09e0219b09
Reviewed-on: https://chromium-review.googlesource.com/c/1317586
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57240}
2018-11-05 14:24:04 +00:00
Michael Starzinger
fbeaeb26ef [wasm] Remove test-only {RelocInfo::JS_TO_WASM_CALL}.
The relocation mode in question was by now only used in tests to model a
wrapper call from wrapper code (on the GC'ed heap) to a non-movable wasm
code object. Instead of using a special relocation mode, we switch to
using the existing {EXTERNAL_REFERENCE} mode similar to other static C++
functions called from generated code.

R=sigurds@chromium.org
BUG=v8:8238

Change-Id: I30af98b92aed207c52ccccaf018a455ecac39c2b
Reviewed-on: https://chromium-review.googlesource.com/c/1309821
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57239}
2018-11-05 13:49:18 +00:00
Tobias Tebbi
ece9156c4c [torque] allow qualified access to different modules/namespaces
This introduces a new syntax for identifiers and calls: modulename::foo.
Such a name is resolved by trying to find a module modulename in one of
the parent scopes and looking for foo there. So this roughly corresponds
to C++ qualified namespace lookup.

Bug: v8:7793
Change-Id: Iedc43e6ebe125cd74575cbbcbf990bbcc0155a1f
Reviewed-on: https://chromium-review.googlesource.com/c/1309818
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57238}
2018-11-05 13:34:03 +00:00
Clemens Hammacher
75da45ff4b [wasm][iwyu] Remove unneeded heavy-weight includes
R=ahaas@chromium.org

Bug: v8:8238, v8:7490
Change-Id: I27a57a43ad767d77e64764eda1d9017db87bdfcb
Reviewed-on: https://chromium-review.googlesource.com/c/1317588
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57237}
2018-11-05 13:31:18 +00:00
Jakob Gruber
166e74d581 [snapshot] Rename allocators
There's only one allocator kind left post-builtin-snapshot-removal,
so the 'Default' prefix can be removed.

Bug: v8:6666, v8:7990
Change-Id: Ib3c3eeb121792708591ca7be1e30adef77d3c111
Reviewed-on: https://chromium-review.googlesource.com/c/1309638
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57236}
2018-11-05 13:22:58 +00:00
Tobias Tebbi
23b4892060 [torque] qualified access to CSA assemblers
No longer use inheritance to associate Torque-generated assemblers
with corresponding CSA subclasses. Instead, all references to CSA
and CSA-derived assemblers are now explicitly qualified, by generating
a short-lived assembler instance in-place. As a consequence, Torque
files have to mention the assembler external macros live in.
The CodeStubAssembler is the default for this and can be omitted.
As a drive-by cleanup, also distinguish between names that are emitted
in C++ and names that are intended to be read in error messages. This
is relevant for generic instantiations, where the generated names are
rather unreadably mangled.

As a follow-up, it will be easy to allow for qualified access to
different modules, thus implementing full namespace semantics for
modules.

Bug: v8:7793
Change-Id: Ie6f1b6b549b510fb49be2442393d898d5f130950
Reviewed-on: https://chromium-review.googlesource.com/c/1309636
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57235}
2018-11-05 12:47:57 +00:00
Camillo Bruni
7621325d79 [runtime] Harden OptimizeFunctionOnNextCall
Ignore invalid input for all arguments of OptimizeFunctionOnNextCall
potentially produced by fuzzers.

Bug: chromium:901645
Change-Id: Ic185812c228a92f8dbb48212c45685bd14892947
Reviewed-on: https://chromium-review.googlesource.com/c/1317567
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57234}
2018-11-05 12:32:05 +00:00
Michael Starzinger
f86ee274b7 [wasm] Fix missing {CompilationState} field initialization.
R=clemensh@chromium.org

Change-Id: Icba445650131dcd54495f40f194ffe64cce24f94
Reviewed-on: https://chromium-review.googlesource.com/c/1317587
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57233}
2018-11-05 12:16:23 +00:00
Georg Neis
9bf8f72c5b Fix array spread on large sets and maps.
The fast paths for sets and maps did not support allocation in
large object space, yet they were taken in these cases. This CL
adds support, simply by passing the kAllowLargeObjectAllocation
argument to AllocateJSArray.

It also changes the fast path for strings to use this argument
rather than take the slow path.

Bug: v8:7980, v8:8410
Change-Id: I18e88cb4ceb7ebeca250edd8b8b0eb401fdbd6e4
Reviewed-on: https://chromium-review.googlesource.com/c/1317507
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57232}
2018-11-05 12:03:35 +00:00
Tobias Tebbi
06c8ce5957 [torque] cleanup generics and scopes
- Name lookup in module scopes has namespace semantics now: All
  overloads from all parent modules are combined before overload
  resolution.
- Allow overloads of different callables: runtime-functions,
  macros, builtins, and generics.
- The duplication between the DeclarationVisitor and the
  ImplementationVisitor is removed: The DeclarationVisitor creates
  declarables for everything except for implicit generic specializations.
  The ImplementationVisitor iterates over declarables.
  The DeclarationVisitor only looks at the header of declarations, not
  at the body.
- Modules become Declarable's, which will enable them to be nested.
- Modules replace the existing Scope chain mechanism, which will make it
  easier to inline macros.
- The DeclarationVisitor and Declarations become stateless. All state is
  moved to contextual variables and the GlobalContext.
- Implicit specializations are created directly from the
  ImplementationVisitor. This will enable template parameter inference.
- As a consequence, the list of all builtins is only available after the
  ImplementationVisitor has run. Thus GenerateBuiltinDefinitions has to
  move to the ImplementationVisitor. Also, this makes it necessary to
  resolve the link from function pointer types to example builtins only
  at this point.


Bug: v8:7793
Change-Id: I61cef2fd3e954ab148c252974344a6e38ee2d01d
Reviewed-on: https://chromium-review.googlesource.com/c/1304294
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57231}
2018-11-05 11:49:40 +00:00
Takuto Ikuta
d4219df603 Remove V8_INLINE from non-inlineable function from parser.h
I will enable /Zc:DllexportInlines- flags for faster build time on windows.
But the flag makes clang's -Wundefined-inline check more strict as a secondary effect.

Actually, having inline function specifier for the function not defined in header file seems bit strange.
Let me remove inline specifier from such functions.

Bug: chromium:857548, chromium:901709
Change-Id: Ic06d10e2445cfedc7af67b72154f93a51ac26853
Reviewed-on: https://chromium-review.googlesource.com/c/1186017
Commit-Queue: Takuto Ikuta <tikuta@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57229}
2018-11-05 08:56:26 +00:00
Jakob Kummerow
15c9b8535a [cleanup] De-templatize CopyWords, drop MoveWords
CopyWords, as the name implies, copies raw words anyway, so there
is no need for type specialization.
MoveWords was dead code.

Bug: v8:8238
Change-Id: Ib497cfbabdcf8bac672ac74ef69f679b50ddfd6e
Reviewed-on: https://chromium-review.googlesource.com/c/1316609
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57226}
2018-11-04 03:53:09 +00:00
Jakob Kummerow
ad8169a0c3 [ubsan] Replace Object** in StrongRootsList with ObjectSlot
as part of the ongoing quest to get rid of Object*/Object** entirely.

Bug: v8:3770
Change-Id: Id3c6112a48a7a7ddb5441c72d81f4e4be61e3eae
Reviewed-on: https://chromium-review.googlesource.com/c/1316610
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57225}
2018-11-04 03:44:32 +00:00
Adam Klein
f88a1d87d6 Revert "Add fast paths to Array.from."
This reverts commit 7bd9eb7e1e.

Reason for revert: crashes on canary, see https://crbug.com/901010

Original change's description:
> Add fast paths to Array.from.
>
> This reuses the fast path from IterableToList for Array.from. The fast
> paths are taken when .from is called with the receiver Array and the only
> argument is the iterable (no mapping function or thisArg).
>
> Bug: v8:7980
> Change-Id: I975b0c5e3f838262d7b71ad4dec5111fb031d746
> Reviewed-on: https://chromium-review.googlesource.com/c/1297322
> Commit-Queue: Hai Dang <dhai@google.com>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#56993}

TBR=neis@chromium.org,dhai@google.com
Bug: v8:7980, chromium:901010, v8:8410

Change-Id: I5e73267f0b3a905582c57a6fad1459c031600a73
Reviewed-on: https://chromium-review.googlesource.com/c/1315935
Commit-Queue: Adam Klein <adamk@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57221}
2018-11-02 21:52:07 +00:00
Toon Verwaest
f5cf90cc14 Reland "[parser] Optimize directive parsing especially for preparser"
This is a reland of 9d34fa0c51

TBR=ishell@chromium.org

Original change's description:
> [parser] Optimize directive parsing especially for preparser
>
> - Avoid allocating AstRawString in the preparser
> - Use fast LiteralEquals to compare the directive.
>
> Bug: chromium:901250
> Change-Id: I178aca812f6c0ffa28d7f48b707316a5a99a2ac0
> Reviewed-on: https://chromium-review.googlesource.com/c/1314570
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57217}

Bug: chromium:901250
Change-Id: I01dfd882923d3f37a08ca0be193474d38e273927
Reviewed-on: https://chromium-review.googlesource.com/c/1314578
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57220}
2018-11-02 17:41:51 +00:00
Ross McIlroy
3530998c0d Reland "Get BytecodeArray via current frame where possible."
This is a reland of 7350e7b220

Disabled LayoutTest that was causing issues and will rebaseline once this has rolled.

Original change's description:
> Get BytecodeArray via current frame where possible.
>
> With BytecodeArray flushing the SFI->BytecodeArray pointer will become pseudo weak.
> Instead of getting the bytecode array from the SFI, get it from the frame instead
> (which is a strong pointer). Note: This won't actually change behaviour since the
> fact that the bytecode array was on the frame will retain it strongly, however it
> makes the contract that the BytecodeArray must exist at these points more explicit.
>
> Updates code in runtime-profiler.cc, frames.cc and runtime-test.cc to do this.
>
> BUG=v8:8395
>
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: Id7a3e6857abd0e89bf238e9b0b01de4461df54e1
> Reviewed-on: https://chromium-review.googlesource.com/c/1310193
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57198}

TBR=mythria@chromium.org

Bug: v8:8395
Change-Id: I63044138f876a1cdfb8bb71499732a257f30d29a
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/c/1314336
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57219}
2018-11-02 16:49:08 +00:00
Maya Lekova
70e6ffcc46 Revert "[parser] Optimize directive parsing especially for preparser"
This reverts commit 9d34fa0c51.

Reason for revert: Breaking test-parsing tests, see
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20gcc%204.8/22942
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Win64%20-%20msvc/5731

Original change's description:
> [parser] Optimize directive parsing especially for preparser
> 
> - Avoid allocating AstRawString in the preparser
> - Use fast LiteralEquals to compare the directive.
> 
> Bug: chromium:901250
> Change-Id: I178aca812f6c0ffa28d7f48b707316a5a99a2ac0
> Reviewed-on: https://chromium-review.googlesource.com/c/1314570
> Commit-Queue: Toon Verwaest <verwaest@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57217}

TBR=ishell@chromium.org,verwaest@chromium.org

Change-Id: I47381358c5a8e9c39fe2af6e72481ebfe9d74a55
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:901250
Reviewed-on: https://chromium-review.googlesource.com/c/1314577
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57218}
2018-11-02 16:47:49 +00:00
Toon Verwaest
9d34fa0c51 [parser] Optimize directive parsing especially for preparser
- Avoid allocating AstRawString in the preparser
- Use fast LiteralEquals to compare the directive.

Bug: chromium:901250
Change-Id: I178aca812f6c0ffa28d7f48b707316a5a99a2ac0
Reviewed-on: https://chromium-review.googlesource.com/c/1314570
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57217}
2018-11-02 16:09:46 +00:00
Ivica Bogosavljevic
d8a958f584 MIPSR6: Fix compilation failure due to missing instruction patching
On MIPS32R6, instruction JIC and JIALC where not properly
patched and this caused compilation failure in snapshot
generating phase

Change-Id: I29d8323faf22f825116e295cd2a2d55e714e61ed
Reviewed-on: https://chromium-review.googlesource.com/c/1314118
Reviewed-by: Sreten Kovacevic <skovacevic@wavecomp.com>
Commit-Queue: Ivica Bogosavljevic <ibogosavljevic@wavecomp.com>
Cr-Commit-Position: refs/heads/master@{#57216}
2018-11-02 15:22:52 +00:00
Georg Neis
95b5e9bd31 [turbofan] Introduce JSDataViewRef class.
... and use it in JSCallReducer.

Bug: v8:7790
Change-Id: If8ed329fef4a4de8938a2d7009cb94c0e85242f0
Reviewed-on: https://chromium-review.googlesource.com/c/1314568
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57214}
2018-11-02 14:18:46 +00:00
Georg Neis
0d5164323b [turbofan] Brokerize SFI arguments in JSCallReducer.
Bug: v8:7790
Change-Id: Ifbcfaa3ae0cc8bef119da52e66a2b9371d6ecf03
Reviewed-on: https://chromium-review.googlesource.com/c/1314548
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57212}
2018-11-02 13:46:41 +00:00
Tobias Tebbi
b24e4a1be5 [torque] use same mechanism as CSA_ASSERT for asserts and checks
Bug: v8:8393
Change-Id: I6ab34cbe6c17f358c570e0bd27bf2de917f71b71
Reviewed-on: https://chromium-review.googlesource.com/c/1309764
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57211}
2018-11-02 13:40:57 +00:00
Georg Neis
0b4350aef0 [turbofan] Introduce JSBoundFunctionRef class.
... and use it in JSCallReducer.

Bug: v8:7790
Change-Id: I1ff3d8d4d4a2936e6184ae5e842674117a96c7e2
Reviewed-on: https://chromium-review.googlesource.com/c/1314335
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57210}
2018-11-02 13:12:50 +00:00
Georg Neis
db239849fa [turbofan] More JSCallReducer brokerization.
Bug: v8:7790
Change-Id: Ida292949c2a7f39726941ac4540569bf82487a3b
Reviewed-on: https://chromium-review.googlesource.com/c/1314334
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57209}
2018-11-02 11:46:36 +00:00
Toon Verwaest
9884930b32 [parser] Simplify Scope::DeclareVariable
Restructure the code a little, and change how we detect sloppy block function
redeclaration so we don't dereference a possibly nullptr function.

Bug: chromium:900786
Change-Id: Ief124fe767603ca36f4dc8865c4aeb3e0635b4cf
Reviewed-on: https://chromium-review.googlesource.com/c/1314331
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57206}
2018-11-02 10:27:23 +00:00
Maya Lekova
ea27a244c3 Revert "Get BytecodeArray via current frame where possible."
This reverts commit 7350e7b220.

Reason for revert: Braking layout test, blocking the roll, see
https://bugs.chromium.org/p/v8/issues/detail?id=8405

Original change's description:
> Get BytecodeArray via current frame where possible.
> 
> With BytecodeArray flushing the SFI->BytecodeArray pointer will become pseudo weak.
> Instead of getting the bytecode array from the SFI, get it from the frame instead
> (which is a strong pointer). Note: This won't actually change behaviour since the
> fact that the bytecode array was on the frame will retain it strongly, however it
> makes the contract that the BytecodeArray must exist at these points more explicit.
> 
> Updates code in runtime-profiler.cc, frames.cc and runtime-test.cc to do this.
> 
> BUG=v8:8395
> 
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
> Change-Id: Id7a3e6857abd0e89bf238e9b0b01de4461df54e1
> Reviewed-on: https://chromium-review.googlesource.com/c/1310193
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57198}

TBR=rmcilroy@chromium.org,mythria@chromium.org

Change-Id: Ie5db0ec1d68ca01d62e9880a4476704ad4d013b5
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8395
Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Reviewed-on: https://chromium-review.googlesource.com/c/1314330
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57205}
2018-11-02 08:17:51 +00:00
Benedikt Meurer
b8a911314d [builtins] Fix out-of-bounds in Array#lastIndexOf().
The fast-path in the `ArrayPrototypeLastIndexOf` torque implementation
didn't check that the `fromIndex` is within the bounds of the JSArray
_AFTER_ the call to ToInteger, which can have arbitrary side-effects,
i.e. it can change the length of the array.

R=yangguo@chromium.org

Bug: chromium:898785
Change-Id: I7ef84143ec8c33148f6e9d451bd52769d5074fb4
Reviewed-on: https://chromium-review.googlesource.com/c/1314329
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57204}
2018-11-02 07:42:50 +00:00
Frank Tang
dffaff7769 [Intl] Move cachedOrNewService to C++ w/o caching
Stage 1 of https://goo.gl/ooFdqJ

Bug: v8:7958,v8:7960,v8:7961
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Iabc69e547760122699a526a1255cb42bf9ddacb4
Reviewed-on: https://chromium-review.googlesource.com/c/1212466
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57203}
2018-11-02 07:08:26 +00:00
Frank Tang
d44ed132d1 [Intl] Clean up Intl::GetStringOption
Add a templates: Intl::GetStringOptionTo<> to simplify the reading
of string from options.
Add GetCaseFirst and GetHourCycle into Intl for later reuse
by different Intl objects
Move some enum shared by Intl object into Intl::

Bug: v8:5751
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: If9ed1889a594f7c0ee6669b4679dda9169e4a771
Reviewed-on: https://chromium-review.googlesource.com/c/1297772
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57201}
2018-11-01 23:08:42 +00:00
Frank Tang
7ac25c0eae [Intl] Fix order of DateTimeFormat resolvedOptions
To fix the to-be-landed-soon test262 test failure in
test262/intl402/DateTimeFormat/prototype/resolvedOptions/order
The spec change from "any order" to "table " order
in https://github.com/tc39/ecma402/pull/279
Change the order of creating each property
Move the code inside SetPropertyFromPattern into ResolvedOptions
so we can easily follow the spec.

Bug: v8:8379
Change-Id: Ibe9ea72a2557474fd81a9f350fffa298f4b7738f
Reviewed-on: https://chromium-review.googlesource.com/c/1302803
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57200}
2018-11-01 21:07:12 +00:00
Frank Tang
071accdf52 [Intl] Implement formatToParts of Intl.ListFormat
Change ListFormat.prototype.formatToParts to use FieldPositionIterator

Bug: v8:8152
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I03e64f9843e55e624fa9ec090f5b3db7b4949f47
Reviewed-on: https://chromium-review.googlesource.com/c/1215273
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57199}
2018-11-01 20:13:12 +00:00
Ross McIlroy
7350e7b220 Get BytecodeArray via current frame where possible.
With BytecodeArray flushing the SFI->BytecodeArray pointer will become pseudo weak.
Instead of getting the bytecode array from the SFI, get it from the frame instead
(which is a strong pointer). Note: This won't actually change behaviour since the
fact that the bytecode array was on the frame will retain it strongly, however it
makes the contract that the BytecodeArray must exist at these points more explicit.

Updates code in runtime-profiler.cc, frames.cc and runtime-test.cc to do this.

BUG=v8:8395

Cq-Include-Trybots: luci.chromium.try:linux_chromium_headless_rel;master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Id7a3e6857abd0e89bf238e9b0b01de4461df54e1
Reviewed-on: https://chromium-review.googlesource.com/c/1310193
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57198}
2018-11-01 16:12:27 +00:00
Jakob Kummerow
6b226ea2ff [ubsan] Replace AtomicElement with UB-safe alternative
The previous AtomicElement wrapper fundamentally relied on
reinterpret_casting a heap address to an instance of a C++
object, which is an invalid cast. This patch replaces that
pattern with an ObjectSlot-based alternative that does not
rely on UB.

Bug: v8:3770
Change-Id: I62fb3c7589ac59e9e18139b525174de77e0e2149
Reviewed-on: https://chromium-review.googlesource.com/c/1309297
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57197}
2018-11-01 05:20:04 +00:00
Frank Tang
511b7cb5b6 [Intl] Fix order of NumberFormat resolvedOptions
Change the order of creating property for the return object
of Intl.NumberFormat.property.resolvedOptions()
according to the table in the spec.
This is due to spec change in from "any order" to "table "
in https://github.com/tc39/ecma402/pull/279
Failure w/o fixing it will happen once we land
test262/intl402/NumberFormat/prototype/resolvedOptions/order

Bug: v8:8378
Change-Id: Ic68fcfeba78af87d9bbd13c935ad9a91e76f4965
Reviewed-on: https://chromium-review.googlesource.com/c/1303195
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57195}
2018-11-01 00:02:23 +00:00
Jakob Kummerow
18ac14688d Reland "[ubsan] Replace Object** in GlobalHandles"
and reland "[ubsan] More Object** replacements"

This reverts commit 162d4e6de8.

Reason for revert: Not the culprit, test failed before.

Original change's description:
> Revert "[ubsan] Replace Object** in GlobalHandles"
> 
> This reverts commit 9392727982.
> 
> Reason for revert: Speculative revert, seems the most probable cause of
> https://bugs.chromium.org/p/v8/issues/detail?id=8396
> 
> Revert "[ubsan] More Object** replacements"
> 
> This reverts commit 5cce694d60.
> 
> Speculative revert.
> 
> NOTRY=true
> 
> Bug: v8:8396
> Change-Id: I9c2866a9db707cd03e4cf90822acde20813cebf0
> Reviewed-on: https://chromium-review.googlesource.com/c/1309761
> Commit-Queue: Maya Lekova <mslekova@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#57174}

TBR=yangguo@chromium.org,mstarzinger@chromium.org,mslekova@chromium.org

Bug: v8:8396
Change-Id: I64fc80804b4ec324cef80ac528d08b724963f7f7
Reviewed-on: https://chromium-review.googlesource.com/c/1311813
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57194}
2018-10-31 23:56:23 +00:00
Daniel Clifford
2e3ba516cf Add a Torque module exposing iterators
This is preparation to support the Torque port of Object.fromEntries,
including tests to make sure that the interface of the iterator functions
is correct and compiles when used.

Change-Id: I2a30ef80a80f42d4744a92746c8cd383abc10c19
Reviewed-on: https://chromium-review.googlesource.com/c/1303726
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57192}
2018-10-31 22:20:01 +00:00
Frank Tang
77d65f9a1f [Intl] Fix ListFormat.resolvedOptions order
Fix the broken test of the to-be-landed
test262/intl402/ListFormat/prototype/resolvedOptions/order
The ecma402 spec change from "any order" to "table " order
in https://github.com/tc39/ecma402/pull/279 the intl* proposals
will follow.

Bug: v8:7871
Change-Id: If47ab44791920c23fe2e1101e60205589d0ac093
Reviewed-on: https://chromium-review.googlesource.com/c/1302058
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57191}
2018-10-31 21:39:12 +00:00
Tobias Tebbi
d63fb52095 [builtins] fix Array.of performance regression
Bug: chromium:899029
Change-Id: I0fc724d5c77e5cbf2580de53f48934ae6f968934
Reviewed-on: https://chromium-review.googlesource.com/c/1310196
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57189}
2018-10-31 20:56:28 +00:00
Frank Tang
91a5b3a73a [Intl] Fix RelativeTimeFormat formatToParts
The Intl.RelativeTimeFormat.prototype.formatToParts does not
correctly implement the spec. Change the implementation by refactoring
the JSNumber::FormatToParts and delegate part of the

JSRelativeTimeFormat::FormatToParts to call the new refactored function.

Bug: v8:8382
Change-Id: Ie153aa256ca78ce71c92efcdad55262564349ca9
Reviewed-on: https://chromium-review.googlesource.com/c/1305936
Commit-Queue: Frank Tang <ftang@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#57188}
2018-10-31 20:18:36 +00:00