Commit Graph

83 Commits

Author SHA1 Message Date
Mike Stanton
fd334b3216 [builtins] Enable Torque Array.prototype.splice
Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

This reland addresses several issues:

* Removed "sparse" array support from splice.
* Addressed ClusterFuzz issue 876443:
  The test and code that uses the fix is in this CL.
  The fix in isolation can be seen here:
  https://chromium-review.googlesource.com/c/v8/v8/+/1199403
* Removed dead code in elements.cc

BUG=chromium:876443, v8:8131, v8:1956, v8:7221

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: I2d4a66c24ba1edabeca34e27e6ff8ee6136ed5f1
Reviewed-on: https://chromium-review.googlesource.com/1201783
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55610}
2018-09-04 13:18:23 +00:00
Simon Zünd
b50fa92a2d Introduce 'kLengthString' in torque code
This CL replaces occurrences of "length" with the CSA macro
LengthStringConstant().

R=jgruber@chromium.org

Bug: v8:8015
Change-Id: Idf095587940f859e4c634865560abae325cd9fb4
Reviewed-on: https://chromium-review.googlesource.com/1201782
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55578}
2018-09-03 06:36:42 +00:00
Simon Zünd
a4f5c6962a [array] Move Array.p.lastIndexOf from JS to Torque
This CL re-implements Array.p.lastIndexOf in Torque. The implementation
consists of a generic baseline path and a fast-path for JSArrays with fast
ElementsKinds.

Sparse support for JSArrays was removed.

Bug: v8:7624
Change-Id: I6ae877aaf99fa97a91763b3d60a0ee05623ab085
Reviewed-on: https://chromium-review.googlesource.com/1190345
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55451}
2018-08-28 12:02:32 +00:00
Simon Zünd
3470086988 [array] Properly handle COW arrays in Array.p.reverse fast-path
Instead of using the slow-path for COW arrays, we now properly copy
them and use the fast-path.

R=jgruber@chromium.org

Change-Id: Iebbad5f761d97c5400c457877571c7930269d52f
Reviewed-on: https://chromium-review.googlesource.com/1188130
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55384}
2018-08-24 09:35:50 +00:00
Simon Zünd
fa11e2ac03 Reland ^2 "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
This is a reland of 9e48a24fd9

Original change's description:
> Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
>
> The CL was reverted because it broke some tests in ChromeOS.
>
> > [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> >
> > This CL changes the sorting algorithm used in Array.p.sort from
> > QuickSort to TimSort (implemented in Torque).
> >
> > Detailed performance results can be found here: https://goo.gl/4E733J
> >
> > To save on code space, fast-paths are implemented as sets of
> > function pointers instead of specializing generics.
> >
> > R=cbruni@chromium.org, jgruber@chromium.org
> >
> > Bug: v8:7382, v8:7624
> > Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> > Reviewed-on: https://chromium-review.googlesource.com/1151199
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55003}
>
> Bug: v8:7382, v8:7624
> Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
> Reviewed-on: https://chromium-review.googlesource.com/1184901
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55325}

Bug: v8:7382, v8:7624
Change-Id: I297611f45c09967e0f6961156b0c9ebdebc7053f
Reviewed-on: https://chromium-review.googlesource.com/1186801
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55360}
2018-08-23 15:43:29 +00:00
Maya Lekova
8e43b9c01d Revert "Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort""
This reverts commit 9e48a24fd9.

Reason for revert: Possibly breaking the V8-Blink Mac bot - https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Mac/15097

Original change's description:
> Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
> 
> The CL was reverted because it broke some tests in ChromeOS.
> 
> > [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> >
> > This CL changes the sorting algorithm used in Array.p.sort from
> > QuickSort to TimSort (implemented in Torque).
> >
> > Detailed performance results can be found here: https://goo.gl/4E733J
> >
> > To save on code space, fast-paths are implemented as sets of
> > function pointers instead of specializing generics.
> >
> > R=cbruni@chromium.org, jgruber@chromium.org
> >
> > Bug: v8:7382, v8:7624
> > Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> > Reviewed-on: https://chromium-review.googlesource.com/1151199
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#55003}
> 
> Bug: v8:7382, v8:7624
> Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
> Reviewed-on: https://chromium-review.googlesource.com/1184901
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55325}

TBR=jgruber@chromium.org,szuend@google.com

Change-Id: Ie7e2af57a6480aa0504ba21ec98ee825d7ac74fe
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382, v8:7624
Reviewed-on: https://chromium-review.googlesource.com/1186601
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55355}
2018-08-23 13:08:13 +00:00
Simon Zünd
28afdca683 Revert "[array] Prepare Array.p.shift for removal of the JavaScript fall-back"
This reverts commit f4ca3fc56e.

Reason for revert: Since TF (js-call-reducer) calls into the C++ builtin, it is easier (cleaner for now) to implement the baseline version in C++ instead of Torque.

Original change's description:
> [array] Prepare Array.p.shift for removal of the JavaScript fall-back
> 
> This CL changes the ArrayPrototypeShift builtin to a CSA macro which
> is used in a newly created Torque builtin.
> 
> This is in preparation for removing the JavaScript fall-back, which
> will be replaced by a baseline Torque implementation.
> 
> R=​cbruni@chromium.org, jgruber@chromium.org
> 
> Bug: v8:7624
> Change-Id: I9b7898beea2802cc02d394e040a1e500387cf108
> Reviewed-on: https://chromium-review.googlesource.com/1169172
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#55036}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7624
Change-Id: I4929eefaa90ff8681bc8ae20e3ea3fe84ee7f1e8
Reviewed-on: https://chromium-review.googlesource.com/1186342
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55345}
2018-08-23 11:34:07 +00:00
Simon Zünd
9e48a24fd9 Reland "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
The CL was reverted because it broke some tests in ChromeOS.

> [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
>
> This CL changes the sorting algorithm used in Array.p.sort from
> QuickSort to TimSort (implemented in Torque).
>
> Detailed performance results can be found here: https://goo.gl/4E733J
>
> To save on code space, fast-paths are implemented as sets of
> function pointers instead of specializing generics.
>
> R=cbruni@chromium.org, jgruber@chromium.org
>
> Bug: v8:7382, v8:7624
> Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> Reviewed-on: https://chromium-review.googlesource.com/1151199
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55003}

Bug: v8:7382, v8:7624
Change-Id: Ic7a3230f3708177774b0760f08b7659d83ec5505
Reviewed-on: https://chromium-review.googlesource.com/1184901
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55325}
2018-08-23 07:33:33 +00:00
Tobias Tebbi
e99a109281 Revert "[builtins] Reland Array.prototype.splice() Torque implementation."
This reverts commit cdaaa31151.

Reason for revert: chromium:876445 chromium:876453 chromium:876443

Original change's description:
> [builtins] Reland Array.prototype.splice() Torque implementation.
> 
> Before, splice was implemented with a C++ fast path and a
> comprehensive JavaScript version.
> 
> This impl. is entirely in Torque with a fastpath for SMI,
> DOUBLE and OBJECT arrays, and a comprehensive slow path.
> The same level of "sparse" array support as given by the
> array.js implementation is included.
> 
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ia7334a30b401988309e9909cfa0069da0bb6fb9f
> Reviewed-on: https://chromium-review.googlesource.com/1169466
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55263}

TBR=mvstanton@chromium.org,jgruber@chromium.org,tebbi@chromium.org

Change-Id: I5b750a98e671b7284474ffcabc6b4d37a9d1219e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1184741
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55289}
2018-08-22 08:57:38 +00:00
Tobias Tebbi
cdaaa31151 [builtins] Reland Array.prototype.splice() Torque implementation.
Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ia7334a30b401988309e9909cfa0069da0bb6fb9f
Reviewed-on: https://chromium-review.googlesource.com/1169466
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55263}
2018-08-21 11:40:19 +00:00
Leszek Swirski
adac1c2ac0 Revert "[array] Move Array.p.sort to Torque and use TimSort instead of QuickSort"
This reverts commit 5a3893958a.

Reason for revert: Breaks some chromium tests. Not your fault, but it's blocking the roll so we have to fix those first -- then you can reland without changes: https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20debug/21727

Original change's description:
> [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
> 
> This CL changes the sorting algorithm used in Array.p.sort from
> QuickSort to TimSort (implemented in Torque).
> 
> Detailed performance results can be found here: https://goo.gl/4E733J
> 
> To save on code space, fast-paths are implemented as sets of
> function pointers instead of specializing generics.
> 
> R=​cbruni@chromium.org, jgruber@chromium.org
> 
> Bug: v8:7382, v8:7624
> Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
> Reviewed-on: https://chromium-review.googlesource.com/1151199
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#55003}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:7382, v8:7624
Change-Id: Id4002d8080648c418639d35e7b82487fa43f463d
Reviewed-on: https://chromium-review.googlesource.com/1174231
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55114}
2018-08-14 10:05:48 +00:00
Tobias Tebbi
2aa47b67dd [torque] only expose safe FixedArray allocation
drive-by change: fix wrong typing in CSA.

Change-Id: I9234306e8568a64157b44a86a58f09e65116b298
Reviewed-on: https://chromium-review.googlesource.com/1172583
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55093}
2018-08-13 15:58:17 +00:00
Simon Zünd
ef3d93edf4 [array] Skip write barrier when sorting packed Smis
R=jgruber@chromium.org

Bug: chromium:873555
Change-Id: I6268bedf47a89194875d1179e603bcfe972c9d68
Reviewed-on: https://chromium-review.googlesource.com/1172282
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55077}
2018-08-13 09:31:59 +00:00
Simon Zünd
1413f07bfd [csa] Add ToObject_Inline macro
This CL adds a ToObject_Inline CSA macro that avoids the "ToObject"
builtin call if the passed argument is already a JSReceiver.

The CL also replaces all occurences of ToObject in Torque code with
ToObject_Inline.

R=jgruber@chromium.org

Change-Id: I1cd66d5d51dde5a93d9a0c55489b13a6f4ba9dc2
Reviewed-on: https://chromium-review.googlesource.com/1169819
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55039}
2018-08-10 09:24:27 +00:00
Simon Zünd
f4ca3fc56e [array] Prepare Array.p.shift for removal of the JavaScript fall-back
This CL changes the ArrayPrototypeShift builtin to a CSA macro which
is used in a newly created Torque builtin.

This is in preparation for removing the JavaScript fall-back, which
will be replaced by a baseline Torque implementation.

R=cbruni@chromium.org, jgruber@chromium.org

Bug: v8:7624
Change-Id: I9b7898beea2802cc02d394e040a1e500387cf108
Reviewed-on: https://chromium-review.googlesource.com/1169172
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55036}
2018-08-10 09:02:52 +00:00
Simon Zünd
27040f9729 [cleanup] Replace runtime call with stub call in Torque code
This CL replaces Delete/SetProperty runtime calls with calls to their
stub version. The stubs will bail to the runtime themselves if they
can't perform the action.

R=jgruber@chromium.org

Bug: v8:8015
Change-Id: I1f141296ee074e028c27a3682e2eb46d9f74c0d9
Reviewed-on: https://chromium-review.googlesource.com/1169810
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#55031}
2018-08-10 07:38:43 +00:00
Simon Zünd
e66824ebc4 [cleanup] Re-order parameters for HasProperty
This CL changes the order of the parameters of HasProperty to be
more consistent with other CSA macros.

Drive-by-change: Use HasProperty stub directly in Torque.

R=jgruber@chromium.org

Bug: v8:8015
Change-Id: I73d1096afbb86d52e2af67c1969549f1158448a7
Reviewed-on: https://chromium-review.googlesource.com/1166831
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55025}
2018-08-09 19:18:24 +00:00
jgruber
3c1f40de25 [builtins] Fix argument order inconsistency in HasProperty
The HasProperty builtin differed in its expected argument order from
the HasProperty runtime function. Like all other related spec
primitives (e.g.: GetProperty, SetProperty, DeleteProperty), it should
take {object} as the first argument and {key} as the second.

This CL changes the builtin and all related spots to use the correct
order.

There was also a tricky bug in interpreter intrinsic rewriting, which
assumes (but does not verify) that the argument order between runtime
function and builtin is identical. Besides cctests, HasProperty
intrinsic rewriting seems to be dead code.

Bug: v8:8036
Change-Id: Ia669fd6f5c73a30df4e4607064603be759ced392
Reviewed-on: https://chromium-review.googlesource.com/1167297
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55022}
2018-08-09 12:30:27 +00:00
Simon Zünd
5a3893958a [array] Move Array.p.sort to Torque and use TimSort instead of QuickSort
This CL changes the sorting algorithm used in Array.p.sort from
QuickSort to TimSort (implemented in Torque).

Detailed performance results can be found here: https://goo.gl/4E733J

To save on code space, fast-paths are implemented as sets of
function pointers instead of specializing generics.

R=cbruni@chromium.org, jgruber@chromium.org

Bug: v8:7382, v8:7624
Change-Id: I7cd4287e4562d84ab7c79c58ae30780630f976de
Reviewed-on: https://chromium-review.googlesource.com/1151199
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#55003}
2018-08-09 08:45:39 +00:00
Michael Hablich
38b1d20d8a Revert "[builtins] Enable Torque Array.prototype.splice"
This reverts commit ff4fa92e88.

Reason for revert: blocks roll: https://chromium-review.googlesource.com/c/chromium/src/+/1167969 ... see https://chromium-swarm.appspot.com/task?id=3f344f7ada4e0110&refresh=10&show_raw=1 for stacktrace.

Original change's description:
> [builtins] Enable Torque Array.prototype.splice
> 
> Before, splice was implemented with a C++ fast path and a
> comprehensive JavaScript version.
> 
> This impl. is entirely in Torque with a fastpath for SMI,
> DOUBLE and OBJECT arrays, and a comprehensive slow path.
> The same level of "sparse" array support as given by the
> array.js implementation is included.
> 
> Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
> Change-Id: Ibfa3407ed75b9ad15ac54cce446b3952e38f90a9
> Reviewed-on: https://chromium-review.googlesource.com/1039190
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> Commit-Queue: Michael Stanton <mvstanton@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#54974}

TBR=danno@chromium.org,yangguo@chromium.org,mvstanton@chromium.org,tebbi@chromium.org,szuend@google.com

Change-Id: I900f667b30a0cf673ead9621618a9988cf85ffdf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/1168902
Commit-Queue: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Hablich <hablich@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54998}
2018-08-09 07:29:14 +00:00
Mike Stanton
ff4fa92e88 [builtins] Enable Torque Array.prototype.splice
Before, splice was implemented with a C++ fast path and a
comprehensive JavaScript version.

This impl. is entirely in Torque with a fastpath for SMI,
DOUBLE and OBJECT arrays, and a comprehensive slow path.
The same level of "sparse" array support as given by the
array.js implementation is included.

Cq-Include-Trybots: luci.v8.try:v8_linux_noi18n_rel_ng
Change-Id: Ibfa3407ed75b9ad15ac54cce446b3952e38f90a9
Reviewed-on: https://chromium-review.googlesource.com/1039190
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54974}
2018-08-08 12:32:35 +00:00
Tobias Tebbi
91ef86f9d1 [torque] add typeswitch statement
This adds a typeswitch statement

typeswitch (e)
case (x1 : Type1) {
  ...
} case (x2 : Type2) {

} ...
... case (xn : TypeN) {
  ...
}

This checks to which of the given types the result of evaluating e can
be cast, in the order in which they are listed. So if an earlier
type matches, a value of this type won't reach a later case.

The type-checks are performed by calling the cast<T>() macro.
The type of the argument passed to the cast macro is dependent on the
case and excludes all types checked earlier. For example, in

const x : Object = ...
typeswitch (x)
case (x : Smi) {
  ...
} case (x : HeapNumber) {
  ...
} case (x : HeapObject) {
  ...
}

there will be calls to cast<Smi>(Object) and
cast<HeapNumber>(HeapObject), because after the Smi check we know that
x has to be a HeapObject. With the refactored base.tq definition of
cast, this will generate efficient code and avoid repeating the Smi
check in the second case.

The type system ensures that all cases are reachable and that the type
given to the last case is safe without a runtime check (in other words,
the union of all checked types covers the type of e).

The cases can also be written as
case (Type) { ... }
, in which case the switched value is not re-bound with the checked
type.

Bug: v8:7793
Change-Id: Iea4aed7465d62b445e3ae0d33f52921912e095e3
Reviewed-on: https://chromium-review.googlesource.com/1156506
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54958}
2018-08-08 07:49:42 +00:00
Mike Stanton
38c664fa9c [Torque] Turn Torque HasProperty usage into builtin calls
The CSA HasProperty has an inlining that makes it rather large.

Also, tighten up some type usage. ToObject() returns a JSReceiver
and we can do with less casting if we make use of this.

Change-Id: I56d2443b5d409314cc3c74a5a079810d857727ad
Reviewed-on: https://chromium-review.googlesource.com/1165241
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54951}
2018-08-07 16:33:51 +00:00
Tobias Tebbi
469522160b [torque] generate implicit_cast according to VisitResult types
In the generated CSA, we called overloaded macros while relying on CSA
subtyping of TNodes. This doesn't work well with overloads, because
for C++ any TNode subtyping is treated as an implicit conversion, which
makes these calls ambiguous for C++.
As a solution, we insert implicit_cast conversions for arguments
according to the type predicted by Torque. This way, a CSA overload is always
called with exactly the signature declared in base.tq.
This has the additional benefit that it validates the signatures declared in
base.tq, which could previously be too permissive.
Also, this triggered a bug in structs, where VisitResult's were
carrying the wrong type.

Bug: v8:7793
TBR: danno@chromium.org
Change-Id: I8ed4bfd04793c8a8805a4a3dd5cf2a85c20ce786
Reviewed-on: https://chromium-review.googlesource.com/1165237
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54948}
2018-08-07 14:28:02 +00:00
Théotime Grohens
3656b4656e [dataview] Fix too tight TNode type in DataView getters
This CL fixes a bug found by Clusterfuzz, in which the functions
LoadDataViewByteOffset and -ByteLength incorrectly had a return
type of TNode<Smi> instead of TNode<Number>.

This caused a CAST() call to fail when the requested byte offset
or byte length did not fit inside a Smi, i.e. when the underlying
ArrayBuffer of the DataView had a length longer than 2^30 on
32-bit platforms.

The CL also includes a new test in mjsunit to test against this.

Bug: chromium:869313
Change-Id: Ibb7d29bda5782a12c4b506c070bb03fef8c3ec70
Reviewed-on: https://chromium-review.googlesource.com/1158582
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54900}
2018-08-03 13:21:16 +00:00
Tobias Tebbi
ed6b11d53f [torque] a new self-contained parser for torque
Bug: v8:7793
Change-Id: I208edf856f0283d840358f3c11bab97af0397056
Reviewed-on: https://chromium-review.googlesource.com/1095192
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54574}
2018-07-20 10:18:25 +00:00
Tobias Tebbi
d2701715f8 [torque] disallow mostly unsupported vararg macros
Bug: v8:7929 v8:7793
Change-Id: I7d9cdd0fb3e36ae6e81683cc4c3746f6ea119d15
Reviewed-on: https://chromium-review.googlesource.com/1138077
Reviewed-by: Daniel Clifford <danno@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54564}
2018-07-19 20:35:46 +00:00
Simon Zünd
efaece9c62 [torque][clenaup] Rename Constant to ExternConstant
This CL renames Constant to ExternConstant (this already happend in the
grammar). It also enforces the rule that such extern constants require
"constexpr" types.

Drive-by-change: Replaced non constexpr extern constants with
module constants.

R=tebbi@chromium.org

Bug: v8:7793
Change-Id: Icb3f75071b15b1fcabbe447941e05dd5a09d4b23
Reviewed-on: https://chromium-review.googlesource.com/1136434
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#54453}
2018-07-16 09:24:42 +00:00
Tobias Tebbi
81186ff41d [torque] fix variables, returns and conditionals with constexpr
Variables/return values with constexpr type cannot have multiple
assignments. We check this now.
For conditionals, it is important to always infer a non-constexpr type.
This CL adds the ability to map any type (including union types) to be
mapped to their non-constexpr variant. Conditionals infer their type as
the non-constexpr version of a combination of the two branch types.

In addition, this improves subtyping for constexpr types:
If A extends B, then constexpr A extends constexpr B.
This makes it necessary to clean up "constexpr String", which has nothing
to do with tagged values.

Bug: v8:7793
Change-Id: Ia4d3cd5dc98f45b0ec89adf05c5c6111a0e51cc6
Reviewed-on: https://chromium-review.googlesource.com/1122864
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54167}
2018-07-03 12:45:40 +00:00
Simon Zünd
93f59deef8 [array] Throw TypeError for read-only properties on fast-path
This CL changes the NumberDictionary fast-path for Array.p.sort to
throw a TypeError when trying to write to a read-only property.

Previously, the fast-path simply bailed to the slow-path which could
swallow the TypeError by accident. I.e. because the fast-path could
leave the array in an inconsistent state that is already sorted.

Example:

let arr = new Array(10);
Object.defineProperty(arr, 0, {value: 2, writable: false});
Object.defineProperty(arr, 2, {value: 1, writable: false});
arr.sort();

The pre-processing step will move the value 1 to index 1: {0: 2, 1: 1}
When trying to swap those 2 values, the fast-path will write the 2 at
index 1, then try to write the 1 at index 0 and fail, bailing to the
slow-path. As the array looks like {0: 2, 1: 2} its already sorted
and the TypeError will not be thrown.

R=jgruber@chromium.org

Bug: v8:7382, v8:7907
Change-Id: I5d2f2d73478fdca066ce1048dcb2b8301751cb1f
Reviewed-on: https://chromium-review.googlesource.com/1122120
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54150}
2018-07-03 06:38:00 +00:00
Daniel Clifford
1d6d89d02b [torque]: Fix sharing of re-opened namespaces
In the process, create a shared array utility GetLengthProperty that fast-paths
accessing the length properties of JSArray.

Bug: v8:7793
Change-Id: I6d7f0007c162794773dc0fc3e8bf12b3adf12fa0
Reviewed-on: https://chromium-review.googlesource.com/1116221
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54133}
2018-07-02 12:16:28 +00:00
Théotime Grohens
3ce52ca3e3 [dataview][cleanup] Encapsulate BigInt allocation logic in data-view.tq
This CL separates the BigInt allocation code in the DataView BigInt
getters from the logic of the getters themselves.

This makes the code much easier to read and understand.

Change-Id: I9f7ee3fb819f0606dc631bac89e386f6fec43655
Reviewed-on: https://chromium-review.googlesource.com/1107632
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54036}
2018-06-26 14:40:55 +00:00
Théotime Grohens
3e78711c21 [dataview] Add fast path for DataView methods
This CL adds a fast path for DataView getters and setters when the
load or store to be performed is aligned and when the requested
endianness matches the platform endianness.

In that case, we can just emit the right load/store instruction
instead of having to read and write data byte by byte.

Change-Id: I10bd95a7fe8d23f695899eb8173bc654fb38fbb0
Reviewed-on: https://chromium-review.googlesource.com/1106168
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#54005}
2018-06-25 14:19:49 +00:00
Clemens Hammacher
8723374b4a Revert "[array] Change QuickSort to TimSort for Array.p.sort"
This reverts commit e3229485a8.

Reason for revert: just landed to gather perf feedback.

Original change's description:
> [array] Change QuickSort to TimSort for Array.p.sort
> 
> R=​jgruber@chromium.org
> 
> Bug: v8:7382
> Change-Id: I95d2187d22c3bea4323789042b3426d65fde4999
> Reviewed-on: https://chromium-review.googlesource.com/1111959
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#53970}

TBR=jgruber@chromium.org,szuend@google.com

Change-Id: I1e150e856a32039eb241a745bd7e6180f2132430
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382
Reviewed-on: https://chromium-review.googlesource.com/1112099
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53974}
2018-06-22 15:32:50 +00:00
Simon Zünd
e3229485a8 [array] Change QuickSort to TimSort for Array.p.sort
R=jgruber@chromium.org

Bug: v8:7382
Change-Id: I95d2187d22c3bea4323789042b3426d65fde4999
Reviewed-on: https://chromium-review.googlesource.com/1111959
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53970}
2018-06-22 14:32:19 +00:00
Simon Zünd
3e41a47c50 [torque] Change syntax for "external constants"
This CL changes the syntax for external constants to better reflect
for what they are actually used.

Drive-by change: Ran the format tool on base.tq.

R=danno@chromium.org, tebbi@chromium.org

Bug: v8:7793
Change-Id: Ie49c28b9c95a05846a2d9801f01b11e5a58d72d9
Reviewed-on: https://chromium-review.googlesource.com/1111706
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53963}
2018-06-22 12:09:10 +00:00
Yang Guo
b413284634 Revert "Reland "[array] Change QuickSort to TimSort for Array.p.sort""
This reverts commit 9d406a0249.

Reason for revert: Layout Test failures: https://ci.chromium.org/buildbot/client.v8.fyi/V8-Blink%20Linux%2064/24236

Original change's description:
> Reland "[array] Change QuickSort to TimSort for Array.p.sort"
> 
> This is a reland of 6bb8236808
> 
> Original change's description:
> > [array] Change QuickSort to TimSort for Array.p.sort
> > 
> > Bug: v8:7382
> > Change-Id: I7f125a62867eb586d2720a2c641fb5f4012b284d
> > Reviewed-on: https://chromium-review.googlesource.com/1100881
> > Commit-Queue: Simon Zünd <szuend@google.com>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#53838}
> 
> Bug: v8:7382
> Change-Id: I499d782feaeb36df154e00a11d3b03cd41442347
> Reviewed-on: https://chromium-review.googlesource.com/1107497
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@google.com>
> Cr-Commit-Position: refs/heads/master@{#53864}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

Change-Id: I877834301d98174b148e42dee42f598a62c544de
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382
Reviewed-on: https://chromium-review.googlesource.com/1107757
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53874}
2018-06-20 11:21:40 +00:00
Théotime Grohens
d020584ac7 [torque] Add constexpr int31 equality operator
This CL adds a constexpr int31 == operator that returns
a constexpr bool value.

It also fixes a bug that this introduces because branch generation
for ternary operators incorrectly assumed that the condition value
was bool, whereas it can also be constexpr bool now.

Change-Id: Ie7d3497c9d1112c121b4a29561fe065b5bf01fb6
Reviewed-on: https://chromium-review.googlesource.com/1106343
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Théotime Grohens <theotime@google.com>
Cr-Commit-Position: refs/heads/master@{#53867}
2018-06-20 09:56:20 +00:00
Simon Zünd
9d406a0249 Reland "[array] Change QuickSort to TimSort for Array.p.sort"
This is a reland of 6bb8236808

Original change's description:
> [array] Change QuickSort to TimSort for Array.p.sort
> 
> Bug: v8:7382
> Change-Id: I7f125a62867eb586d2720a2c641fb5f4012b284d
> Reviewed-on: https://chromium-review.googlesource.com/1100881
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53838}

Bug: v8:7382
Change-Id: I499d782feaeb36df154e00a11d3b03cd41442347
Reviewed-on: https://chromium-review.googlesource.com/1107497
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53864}
2018-06-20 09:44:09 +00:00
Jakob Kummerow
8ea702e668 Revert "[array] Change QuickSort to TimSort for Array.p.sort"
This reverts commit 6bb8236808.

Reason for revert: breaks "nosnap" tests: CSA_ASSERT failure, array OOB read, see:
https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8%20Linux%20-%20nosnap%20-%20debug/19207

Original change's description:
> [array] Change QuickSort to TimSort for Array.p.sort
> 
> Bug: v8:7382
> Change-Id: I7f125a62867eb586d2720a2c641fb5f4012b284d
> Reviewed-on: https://chromium-review.googlesource.com/1100881
> Commit-Queue: Simon Zünd <szuend@google.com>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#53838}

TBR=cbruni@chromium.org,jgruber@chromium.org,szuend@google.com

Change-Id: I986ab4c3a65666bd06be086c1503d01b6e9e34b4
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7382
Reviewed-on: https://chromium-review.googlesource.com/1106717
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53849}
2018-06-19 19:40:09 +00:00
Simon Zünd
6bb8236808 [array] Change QuickSort to TimSort for Array.p.sort
Bug: v8:7382
Change-Id: I7f125a62867eb586d2720a2c641fb5f4012b284d
Reviewed-on: https://chromium-review.googlesource.com/1100881
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53838}
2018-06-19 12:29:03 +00:00
Théotime Grohens
7b417038b1 [torque][cleanup] Move ToBoolean to base.tq
This CL moves the ToBoolean function from data-view.tq to base.tq.

It used to be in data-view.tq because we couldn't call macros
from one file to the other but this has been fixed now, and it
makes more sense to have it there.

Change-Id: Id201979eacbeb4307ff7d515db48377490d5bed7
Reviewed-on: https://chromium-review.googlesource.com/1104683
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Théotime Grohens <theotime@google.com>
Cr-Commit-Position: refs/heads/master@{#53837}
2018-06-19 12:27:58 +00:00
Théotime Grohens
33f45e32fc [torque] Add constexpr String handling to Torque
This CL adds a 'constexpr String' type to Torque, which gets compiled
to 'const char*'.

It makes it easier to pass strings around in Torque files,
especially when trying to Print() them.

Bug: v8:7793
Change-Id: I2d4feac7012f5401f2b467475f8df086e46ac18a
Reviewed-on: https://chromium-review.googlesource.com/1104466
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53814}
2018-06-19 07:27:17 +00:00
Théotime Grohens
e947d21e3d [dataview]: Move DataView setters to Torque.
This CL completely reimplements the DataView setters in Torque, and
removes the former C++ runtime implementation.

Change-Id: I66cdd35712e46f3931d6530a4512fa3c8eb3b3bf
Reviewed-on: https://chromium-review.googlesource.com/1104162
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53800}
2018-06-18 15:02:44 +00:00
Simon Zünd
bef673403e [array] Add fastpath for dictionary elements to Array.p.sort
R=cbruni@chromium.org, jgruber@chromium.org

Bug: v8:7382
Change-Id: I45f2517afa8ecb3ddb1f77f845e9ce88f69d4eef
Reviewed-on: https://chromium-review.googlesource.com/1092500
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Simon Zünd <szuend@google.com>
Cr-Commit-Position: refs/heads/master@{#53788}
2018-06-18 11:31:59 +00:00
Daniel Clifford
267a639b12 [torque]: Fix bug uncovered by Netflix in Canary
Bug: chromium:852685
Change-Id: I0bb6cf433a5ea0a91d77048d3eef0d8077b8208e
Reviewed-on: https://chromium-review.googlesource.com/1102433
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Daniel Clifford <danno@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53766}
2018-06-15 13:12:56 +00:00
Théotime Grohens
5b4e8db550 [dataview] Move DataView BigInt getters to Torque
This CL moves the remaining runtime DataView getters to Torque,
namely DataViewGetBigInt64/BigUint64, and removes the associated
runtime code that is now unneeded.

All of the DataView getters are now implemented in Torque, which brings
a nice performance improvement over the former C++ builtin code.

Change-Id: I35cf2eabce3c79cc0d3200e7f24dbe0c3e5c2804
Reviewed-on: https://chromium-review.googlesource.com/1092736
Commit-Queue: Théotime Grohens <theotime@google.com>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53765}
2018-06-15 13:07:56 +00:00
Daniel Clifford
bbbfd81cfc [torque] Turn implicit converts/unsafe_casts into generics
In the process:
  - Add strict ordering of Types so that name mangling is consistent
    and build time. Previously, the UnionType stored the union's
    types in a std::set<const Type*>, which did not have a consistent
    ordering of the types in the set.
  - Add a int31 type to enable consistency and correctness of
    handling of 'constexpr int31' values on the C++ side.
  - By removing the "implicit" keyword for operators, there is now
    one less difference between operators and calls, another
    incremental step in unifying operators and calls.
  - Enable external (i.e. C++-defined) generic specializations
  - Add CSA support for checking double ElementsKinds, including
    tests.
  - Clean up some constexpr/non-constexpr handling of ElementsKinds.

Bug: v8:7793
Change-Id: I27699aba70b98ebf5466e5b62b045d7b1dad62c8
Reviewed-on: https://chromium-review.googlesource.com/1091155
Commit-Queue: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53664}
2018-06-12 11:54:57 +00:00
Simon Zünd
6b5cd36f37 [csa] Move NumberIsNaN to Torque
This CL implements NumberIsNaN in Torque and removes it from the
CodeStubAssembler. It is currently used in TypedArray.p.sort and
Array.p.sort.

R=jgruber@chromium.org

Change-Id: Iaaa81901f89c0df68997d4501607b302a0449012
Reviewed-on: https://chromium-review.googlesource.com/1092532
Commit-Queue: Simon Zünd <szuend@google.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#53611}
2018-06-08 12:11:58 +00:00
Théotime Grohens
e5318195ac [dataview] Move DataView floating point getters to Torque
This CL moves the DataViewGetFloat32 and DataViewGetFloat64
getters from runtime to Torque.

Change-Id: Ic85ec7bcb4e48f679c24e28121b7c543454e7cde
Reviewed-on: https://chromium-review.googlesource.com/1088919
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Théotime Grohens <theotime@google.com>
Cr-Commit-Position: refs/heads/master@{#53606}
2018-06-08 09:53:55 +00:00