Commit Graph

7172 Commits

Author SHA1 Message Date
Eric Holk
c1c93e8246 [wasm] add a test case for 3GB memory
Although we currently only support up to 1GB memory, we want to raise
this issue in the future. This test illustrates several issues we need
to be sure to fix first.

Bug: v8:6306
Change-Id: I362b7a9e51e8eb33a50e3b172a6f01d41995c3cb
Reviewed-on: https://chromium-review.googlesource.com/487047
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44876}
2017-04-26 05:09:03 +00:00
jyan
3be834e876 [deoptimizer] float32 stack on s390 and ppc is on lower 32 bit
Also add more local variables to regress-v8-6077 to force
register spill on platform with 32 float registers.

BUG=

Review-Url: https://codereview.chromium.org/2822073003
Cr-Commit-Position: refs/heads/master@{#44865}
2017-04-25 16:49:33 +00:00
Michael Achenbach
ae1fa3daad Revert "[runtime] Keep FAST_SLOPPY_ARGUMENTS packed"
This reverts commit 28930128ce.

Reason for revert: GC stress failures:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/12958

Original change's description:
> [runtime] Keep FAST_SLOPPY_ARGUMENTS packed
> 
> With this CL SloppyArguments immediately go to dictionary elements on 
> deletion, keeping the arguments backing store packed.
> 
> Bug: v8:6251
> Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330
> Reviewed-on: https://chromium-review.googlesource.com/480379
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44857}

TBR=jkummerow@chromium.org,cbruni@chromium.org,v8-reviews@googlegroups.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Change-Id: I9482bf693a745d1301d068869ddae39f11143827
Reviewed-on: https://chromium-review.googlesource.com/486885
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44863}
2017-04-25 14:43:14 +00:00
Tobias Tebbi
f431b597bf [turbofan] escape analysis: patch for wrong deopt info
Bug: chromium:713367
Change-Id: I3f5960f5b2da22c6468ca5a5ea9dc847b30c7fc7
Reviewed-on: https://chromium-review.googlesource.com/486360
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44862}
2017-04-25 14:20:57 +00:00
Michael Starzinger
d049239ca6 [asm.js] Fix [[Configurable]] attribute of exports.
R=clemensh@chromium.org
TEST=mjsunit/asm/asm-validation
BUG=chromium:715068,v8:5877

Change-Id: I26e0b84c94e5f036336f39e9d764f0588ff3ec0d
Reviewed-on: https://chromium-review.googlesource.com/486882
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44861}
2017-04-25 14:19:52 +00:00
Michael Achenbach
ef99f6667d Revert "[parser] Inital parallel parse tasks implementation."
This reverts commit 56a6fda316.

Reason for revert: Makes tsan flaky:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/15038

Original change's description:
> [parser] Inital parallel parse tasks implementation.
> 
> While parsing top-level code eager functions are skipped just like lazy
> ones, but also a parse task is created for each.
> 
> The parse tasks are run by the compiler dispatcher and can be executed
> either on background thread or in idle time.
> After parsing of top-level code finishes it waits for all unfinished
> parser tasks - possibly picking up and executing them on current thread.
> Afterwards parse task results are stitched together with top-level AST,
> in case of failures eager functions are treated just like lazy -
> parsing/compilation is retriggered for them in the runtime and proper
> errors are generated (performance is not optimized for error case at
> all).
> 
> BUG=v8:6093
> 
> Change-Id: I718dd2acc8a70ae1b09c2dea2616716605d7b05d
> Reviewed-on: https://chromium-review.googlesource.com/483439
> Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44849}

TBR=marja@chromium.org,vogelheim@chromium.org,jochen@chromium.org,wiktorg@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6093

Change-Id: I17e689efee7d216d28a94a5c8147022ae7e830dd
Reviewed-on: https://chromium-review.googlesource.com/486883
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44859}
2017-04-25 14:18:49 +00:00
Camillo Bruni
28930128ce [runtime] Keep FAST_SLOPPY_ARGUMENTS packed
With this CL SloppyArguments immediately go to dictionary elements on 
deletion, keeping the arguments backing store packed.

Bug: v8:6251
Change-Id: I2afa4fb5f0af9942eee0a1606942f5f289539330
Reviewed-on: https://chromium-review.googlesource.com/480379
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44857}
2017-04-25 14:17:27 +00:00
yangguo
95d53ffee1 Revert of [d8] console methods must not throw. (patchset id:1 of https://codereview.chromium.org/2838143002/ )
Reason for revert:
Breaks no-intl builds.

Original issue's description:
> [d8] console methods must not throw.
>
> R=jarin@chromium.org
> BUG=chromium:714696
>
> Review-Url: https://codereview.chromium.org/2838143002
> Cr-Commit-Position: refs/heads/master@{#44854}
> Committed: 87b5b53f6f

TBR=jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:714696

Review-Url: https://codereview.chromium.org/2840853002
Cr-Commit-Position: refs/heads/master@{#44856}
2017-04-25 14:00:56 +00:00
yangguo
87b5b53f6f [d8] console methods must not throw.
R=jarin@chromium.org
BUG=chromium:714696

Review-Url: https://codereview.chromium.org/2838143002
Cr-Commit-Position: refs/heads/master@{#44854}
2017-04-25 13:47:33 +00:00
Michael Starzinger
54818a635f [asm.js] Fix failure propagation of heap access validation.
This fixes propagation of validation failures that happen during the
validation of a heap access expression in {ValidateHeapAccess}.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-crbug-714971
BUG=chromium:714971

Change-Id: I8f91ac1da34ae50fdde2938f61b6468cdac92b6e
Reviewed-on: https://chromium-review.googlesource.com/486801
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44851}
2017-04-25 12:58:26 +00:00
Wiktor Garbacz
56a6fda316 [parser] Inital parallel parse tasks implementation.
While parsing top-level code eager functions are skipped just like lazy
ones, but also a parse task is created for each.

The parse tasks are run by the compiler dispatcher and can be executed
either on background thread or in idle time.
After parsing of top-level code finishes it waits for all unfinished
parser tasks - possibly picking up and executing them on current thread.
Afterwards parse task results are stitched together with top-level AST,
in case of failures eager functions are treated just like lazy -
parsing/compilation is retriggered for them in the runtime and proper
errors are generated (performance is not optimized for error case at
all).

BUG=v8:6093

Change-Id: I718dd2acc8a70ae1b09c2dea2616716605d7b05d
Reviewed-on: https://chromium-review.googlesource.com/483439
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44849}
2017-04-25 12:35:21 +00:00
jgruber
9372dd95d9 [regexp] Fix unicode escapes in test strings
Some of these tests pass the pattern as a string, and in this case
there's a subtle distinction between

"/\u{0041}/"  // Unicode escape interpreted in string literal.

and

"/\\u{0041}/"  // Unicode escape interpreted by regexp parser.

Extend these tests to check both cases.

Thanks littledan@ for pointing this out.

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2839923002
Cr-Commit-Position: refs/heads/master@{#44840}
2017-04-25 11:20:34 +00:00
jgruber
a1af3315a2 [regexp] Fix passing all flags to RegExp construction
Do not bail out when passed a flags string with length > 5, use a
meaningful named constant instead.

Found by https://github.com/tc39/test262/pull/997#issuecomment-296963675

BUG=v8:6300

Review-Url: https://codereview.chromium.org/2841633004
Cr-Commit-Position: refs/heads/master@{#44834}
2017-04-25 09:35:22 +00:00
jarin
d081a6f692 [turbofan] Make sure an inlined call is not resurrected and inlined again.
BUG=chromium:714483

Review-Url: https://codereview.chromium.org/2833423004
Cr-Commit-Position: refs/heads/master@{#44830}
2017-04-25 08:10:32 +00:00
Caitlin Potter
56e07b4a8c [parser] don't treat SuperCall as a valid DestructuringAssignmentTarget
BUG=v8:6291, v8:811
R=marja@chromium.org, vogelheim@chromium.org

Change-Id: I978ea446d7b42092592b0a3ae3c99626e36d40fd
Reviewed-on: https://chromium-review.googlesource.com/485099
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44819}
2017-04-24 20:54:36 +00:00
Caitlin Potter
68235eb936 [parser] don't treat new.target as a valid DestructuringAssignmentTarget
BUG=v8:6291, v8:811
R=marja@chromium.org, vogelheim@chromium.org

Change-Id: Icf18b1cba8562aab87d233d383eb1d73a8e6aa9d
Reviewed-on: https://chromium-review.googlesource.com/485059
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44818}
2017-04-24 20:27:37 +00:00
jkummerow
0f88153075 Reland of [builtins] DeleteProperty: Handle last-added fast properties
In general, deleting a property from a fast-properties object
requires transitioning the object to dictionary mode. However,
when the most-recently-added property is deleted, we can simply
roll back the last map transition that the object went through.

This is a performance experiment: it should make things faster,
but if it turns out to have more negative than positive impact,
we will have to revert it.

TBR=bmeurer@chromium.org (just adding a comment)

Previously reviewed at https://codereview.chromium.org/2830093002
Previously landed as 98acfb36e1 / r44799

Review-Url: https://codereview.chromium.org/2840583002
Cr-Commit-Position: refs/heads/master@{#44808}
2017-04-24 15:59:00 +00:00
machenbach
852a20b08c Revert of [builtins] DeleteProperty: Handle last-added fast properties (patchset id:20001 of https://codereview.chromium.org/2830093002/ )
Reason for revert:
Breaks:
https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/12920
and
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/10281

Original issue's description:
> [builtins] DeleteProperty: Handle last-added fast properties
>
> In general, deleting a property from a fast-properties object
> requires transitioning the object to dictionary mode. However,
> when the most-recently-added property is deleted, we can simply
> roll back the last map transition that the object went through.
>
> This is a performance experiment: it should make things faster,
> but if it turns out to have more negative than positive impact,
> we will have to revert it.
>
> TBR=bmeurer@chromium.org (just adding a comment)
>
> Review-Url: https://codereview.chromium.org/2830093002
> Cr-Commit-Position: refs/heads/master@{#44799}
> Committed: 98acfb36e1

TBR=ishell@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2843473002
Cr-Commit-Position: refs/heads/master@{#44806}
2017-04-24 14:52:56 +00:00
Michael Starzinger
f06db79c67 [asm.js] Treat typed array constructors as stdlib uses.
This makes sure that typed array constructors (e.g. Int8Array, ...) used
within an asm.js module are considered uses of stdlib values, and hence
are checked during module instantiation.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-6280
BUG=v8:6280,chromium:714537

Change-Id: Ic5d689f5319c4dac4e9df3dca4a8cf5a4edd890b
Reviewed-on: https://chromium-review.googlesource.com/485521
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44800}
2017-04-24 13:33:35 +00:00
jkummerow
98acfb36e1 [builtins] DeleteProperty: Handle last-added fast properties
In general, deleting a property from a fast-properties object
requires transitioning the object to dictionary mode. However,
when the most-recently-added property is deleted, we can simply
roll back the last map transition that the object went through.

This is a performance experiment: it should make things faster,
but if it turns out to have more negative than positive impact,
we will have to revert it.

TBR=bmeurer@chromium.org (just adding a comment)

Review-Url: https://codereview.chromium.org/2830093002
Cr-Commit-Position: refs/heads/master@{#44799}
2017-04-24 13:27:41 +00:00
mvstanton
1eb0ef3161 [builtins] Improve performance of array.prototype.filter and map.
BUG=

Review-Url: https://codereview.chromium.org/2775503006
Cr-Commit-Position: refs/heads/master@{#44793}
2017-04-24 12:47:24 +00:00
bmeurer
359b5f93d4 [turbofan] Also constant-fold Object.getPrototypeOf if possible.
We already have an optimization to constant-fold access to an object's
prototype via the special __proto__ accessor (specified in appendix B).
We can use the same optimization to also constant-fold accesses to an
object's prototype via the official Object.getPrototypeOf function.

Also add the optimization for Reflect.getPrototypeOf, which is
equivalent for object inputs.

This is commonly used by Babel to implement various new language
features, for example subclassing and certain property lookups.

R=yangguo@chromium.org
BUG=v8:6292

Review-Url: https://codereview.chromium.org/2841463002
Cr-Commit-Position: refs/heads/master@{#44788}
2017-04-24 05:37:45 +00:00
jkummerow
75ce09b533 Fix HashTable growth strategy to be 2x instead of 4x
Review-Url: https://codereview.chromium.org/2827263004
Cr-Commit-Position: refs/heads/master@{#44783}
2017-04-21 17:31:29 +00:00
Igor Sheludko
2d856544e5 [ic] Fix handling of elements kind transitions in polymorphic keyed ICs.
Ensure source map is not stable if elements kind transitions are expected.

BUG=chromium:700733

Change-Id: Ie937e7064127250b1100109986c3e9b411fae1d6
Reviewed-on: https://chromium-review.googlesource.com/483442
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44780}
2017-04-21 15:14:26 +00:00
Michael Starzinger
ea7064779a [asm.js] Test and fix global variable imports.
This also removes a broken optimization regarding immutable (i.e. const)
global variables. For now mutable and immutable global variables are
treated the same and hence copied during module initialization.

R=rossberg@chromium.org
TEST=mjsunit/asm/global-imports
BUG=v8:6279

Change-Id: I020fc12036dc534f5a62fb43f5c6fdb252314e62
Reviewed-on: https://chromium-review.googlesource.com/483360
Reviewed-by: Andreas Rossberg <rossberg@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44763}
2017-04-21 08:09:04 +00:00
Eric Holk
ec772a4fd8 Restrict range for int64_t to immediate conversions
The included test case illustrates the problem. It subtracts (16 << 27)
from another number. The Machine Operator Reducer would replace the
shift computation with 0x0000000080000000, and then change the subtract
to an add of -(0x0000000080000000), which is 0xffffffff80000000.
The instruction selector would determine that this value could be an
immediate, because it fits in 32 bits, so it would select the lea
instruction. Finally, the code generator would detect that the
immediate was less than 0, flip the sign and replace the add with a
subtract of 0x80000000. Because the x64 subtract instruction's
immediate field is 32 bits, the processor would interpret this as
0xffffffff80000000 instead of an unsigned value.

This change fixes the issue by making the CanBeImmediate check
explicitly compare against INT_MIN and INT_MAX. We disallow INT_MIN
as an immediate precisely because we cannot tell 0x0000000080000000
from 0xffffffff80000000 when truncated to 32 bits.

Bug: chromium:711203
Change-Id: Ie371b8ea290684a6bb723bae9c693a866f961850
Reviewed-on: https://chromium-review.googlesource.com/482448
Commit-Queue: Eric Holk <eholk@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44758}
2017-04-20 21:03:31 +00:00
bmeurer
c9c7dd0d4e [turbofan] Constant-fold certain JSOrdinaryHasInstance nodes.
Move JSOrdinaryHasInstance lowering to JSNativeContextSpecialization,
which was previously mostly done in JSTypedLowering (for no reason).
Add new logic to the lowering to constant-fold OrdinaryHasInstance
checks when the map of the left-hand side and the "prototype" of the
right-hand side is known. This address the performance issue with the
(base) class constructors generated by Babel, i.e.:

  function _classCallCheck(instance, Constructor) {
    if (!(instance instanceof Constructor)) {
      throw new TypeError("Cannot call a class as a function");
    }
  }

  var C = function C() { _classCallCheck(this, C); };

for

  class C {}

Also ensure that a known constructor being used inside an instanceof
get's a proper initial map on-demand.

BUG=v8:6275
R=mstarzinger@chromium.org

Review-Url: https://codereview.chromium.org/2827013002
Cr-Commit-Position: refs/heads/master@{#44727}
2017-04-19 14:38:11 +00:00
jkummerow
34a26e7dc4 [keyed-store-generic] Update protectors if needed
When adding or overwriting properties of an object, the generic
keyed store stub must check if that property's name might have
an associated protector (e.g. the ArraySpeciesProtector) and
take the slow path if so to ensure that the protector is updated
as needed.

BUG=v8:6269

Review-Url: https://codereview.chromium.org/2821213004
Cr-Commit-Position: refs/heads/master@{#44726}
2017-04-19 14:15:34 +00:00
Peter Marshall
356e9246b2 [builtins] Use the ElementsAccessor to copy TypedArrays.
This includes a fastpath in the ElementsAccessor for the source
array being a JSArray with FastSmi or FastDouble packed kinds. This
is probably a pretty common usage, where an array is passed in as
a way of initializing the TypedArray at creation (as there is not other
syntax to do this). e.g. new Float64Array([1.0, 1.0, 1.0]) for some
sort of vector application.

BUG= v8:5977

Change-Id: Ice4ad9fc29f56b1c4b0b30736a1330efdc289003
Reviewed-on: https://chromium-review.googlesource.com/465126
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44722}
2017-04-19 12:45:20 +00:00
Michael Starzinger
950322e070 [asm.js] Fix source positions in for-statement parsing.
This fixes source position tracking within the "increment" expression of
a for-statement. The old {StashCode} method was inherently incompatible
with side tables like the source position table, as it would leave them
untouched while mutating the bytecode stream. It was hence trimmed down
to {DeleteCode}.

R=bradnelson@chromium.org
BUG=v8:6127

Change-Id: I7a5ff60cd5334208c44b165c8b54144d9ae83209
Reviewed-on: https://chromium-review.googlesource.com/480301
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44714}
2017-04-19 08:53:57 +00:00
jgruber
a031ab92ac [errors] Improve NotGeneric error message
This changes the message from

"method_name is not generic"

to

"method_name requires that 'this' be a primitive_name object"

BUG=v8:6206

Review-Url: https://codereview.chromium.org/2814043006
Cr-Original-Commit-Position: refs/heads/master@{#44683}
Committed: 21b104e3b8
Review-Url: https://codereview.chromium.org/2814043006
Cr-Commit-Position: refs/heads/master@{#44713}
2017-04-19 08:34:24 +00:00
bmeurer
b89ddcf1fc [turbofan] Fix typing rule for JSCreateArguments.
The typing rule for JSCreateArguments must properly declare rest
parameters as arrays and only consider sloppy and strict arguments
objects as Type::OtherObject.

TBR=jarin@chromium.org
BUG=v8:6262,chromium:712802

Review-Url: https://codereview.chromium.org/2828573004
Cr-Commit-Position: refs/heads/master@{#44712}
2017-04-19 07:38:20 +00:00
Adam Klein
cd76322817 Add flag to make __defineGetter__ & co. behave as strict functions
When --harmony-strict-legacy-accessor-builtins is enabled, it brings
V8's behavior in line with the spec and more recent versions of
SpiderMonkey and JSC:
  - No implicit receiver coercion
  - Attempting to redefine a non-configurable property throws

Bug: v8:5070
Change-Id: I82b927538604136c0c550e19bcc606fbfea1377e
Reviewed-on: https://chromium-review.googlesource.com/478312
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44703}
2017-04-18 21:40:14 +00:00
machenbach
5971023353 Revert of [errors] Improve NotGeneric error message (patchset id:40001 of https://codereview.chromium.org/2814043006/ )
Reason for revert:
Please schedule rebasing layout test first:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/15036

https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [errors] Improve NotGeneric error message
>
> This changes the message from
>
> "method_name is not generic"
>
> to
>
> "method_name requires that 'this' be a primitive_name object"
>
> BUG=v8:6206
>
> Review-Url: https://codereview.chromium.org/2814043006
> Cr-Commit-Position: refs/heads/master@{#44683}
> Committed: 21b104e3b8

TBR=littledan@chromium.org,yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6206

Review-Url: https://codereview.chromium.org/2825123002
Cr-Commit-Position: refs/heads/master@{#44701}
2017-04-18 19:19:53 +00:00
mtrofin
9cc672911f [wasm] Fix DCHECK handiling pending exceptions.
+ additional fixes uncovered by bug, and addressed remaining feedback
from original CL (https://codereview.chromium.org/2806073002/).

Note that the regression test differs slightly from the bug reported one,
in that it catches the RangeError which will eventually be thrown due
to call stack size being exceeded.

BUG=chromium:712569

Review-Url: https://codereview.chromium.org/2825073002
Cr-Commit-Position: refs/heads/master@{#44700}
2017-04-18 19:15:12 +00:00
Camillo Bruni
1979ab55fb [heap-verification] Increase verification for arguments objects
BUG: v8/6251
Change-Id: I64e6ad220f05384e4cd549c1356fd713423c3044
Reviewed-on: https://chromium-review.googlesource.com/480072
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44695}
2017-04-18 15:55:14 +00:00
Marja Hölttä
7fcf658a7b [parser] Skipping inner funcs: make the flag experimental.
The feature is not quite ready for getting ClusterFuzzed.

BUG=v8:5516

Change-Id: I90a42f950727c8ecf46cb2987c9a459b2ba1f5a7
Reviewed-on: https://chromium-review.googlesource.com/480400
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44693}
2017-04-18 15:16:10 +00:00
Michael Starzinger
e6590a37ba [turbofan] Fix translation containing arguments elements.
This fixes the de-duplication logic used when writing the deoptimizer
translation of a frame-state containing {kArgumentsElementsState}. The
object counts as a captured object and participates in the numbering of
duplicated objects.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-711166
BUG=chromium:711166

Change-Id: I4a3b892017ab8217197e5f94c1a0975d0cd6979f
Reviewed-on: https://chromium-review.googlesource.com/476631
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44692}
2017-04-18 14:44:01 +00:00
bmeurer
245ab01ad4 [turbofan] Inline Array constructor calls with multiple parameters.
BUG=v8:6262
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2821273002
Cr-Commit-Position: refs/heads/master@{#44688}
2017-04-18 14:14:58 +00:00
jgruber
21b104e3b8 [errors] Improve NotGeneric error message
This changes the message from

"method_name is not generic"

to

"method_name requires that 'this' be a primitive_name object"

BUG=v8:6206

Review-Url: https://codereview.chromium.org/2814043006
Cr-Commit-Position: refs/heads/master@{#44683}
2017-04-18 12:23:29 +00:00
yangguo
4f3d859f31 [regexp] explicitly whitelist allowed binary property classes.
BUG=v8:4743
TBR=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2827613002
Cr-Commit-Position: refs/heads/master@{#44677}
2017-04-18 10:01:27 +00:00
gdeepti
78b8d7ed8c [wasm] Handle no initial memory case correctly when memory is exported
Currently when the module has memory specified in the compiled bytes, but with no initial memory
exported memory assigns a bogus buffer to the instance. When grow_memory is called on this buffer, it tries to patch an incorrect address.
 - Fix exported memory to handle no initial memory
 - Fix grow_memory to handle uninitialized buffers

BUG=chromium:710844
R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2820223002
Cr-Commit-Position: refs/heads/master@{#44671}
2017-04-18 06:34:16 +00:00
mtrofin
71cf4890d0 [wasm] instantiate expressed in terms of compile
Today, the semantics of:

WebAssembly.instantiate

and

WebAssembly.compile().then(new WebAssemblyInstance)

are subtly different, to the point where attempting the proposed
change uncovered bugs.

In the future, it's possible that .instantiate actually have different
semantics - if we pre-specialized to the provided ffi, for example.
Right now that's not the case.

This CL:
- gets our implementation closer to what developers may write using
the compile -> new Instance alternative, in particular wrt promise
creation. By reusing code paths, we uncover more bugs, and keep
maintenance cost lower.

- it gives us the response-based WebAssembly.instantiate implicitly.
Otherwise, we'd need that same implementation on the blink side. The
negative is maintenance: imagine if the bugs I mentioned could only be
found when running in Blink.

BUG=chromium:697028

Review-Url: https://codereview.chromium.org/2806073002
Cr-Original-Commit-Position: refs/heads/master@{#44592}
Committed: 7829af3275
Review-Url: https://codereview.chromium.org/2806073002
Cr-Commit-Position: refs/heads/master@{#44669}
2017-04-18 01:31:16 +00:00
Josh Wolfe
1236335551 fix assertion failure with --harmony CreateDynamicFunction() in stack overflow conditions
Bug=chromium:707066
R=littledan@chromium.org, adamk@chromium.org, caitp@igalia.com
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Change-Id: I24ce0a08816940ef4646d0f2de188d4832c823a0
Reviewed-on: https://chromium-review.googlesource.com/474990
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Josh Wolfe <jwolfe@igalia.com>
Cr-Commit-Position: refs/heads/master@{#44668}
2017-04-17 20:06:15 +00:00
Sathya Gunasekaran
484d25d4df [d8] Fix leak in IntializeModuleEmbedderData
If the current context is overwritten by doing Realm.navigate(0) we
fail to delete the module embedder data from the correct current
context, because we have an handle to the old context which was
already cleaned up by calling DisposeRealm in RealmNavigate.

This patch disallows navigation to the first realm.

Bug: chromium:711165
Change-Id: I6b9d3187367dae9d1fe38c0efa361d461c94c917
Reviewed-on: https://chromium-review.googlesource.com/476970
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44656}
2017-04-13 21:52:28 +00:00
Caitlin Potter
fa0066d170 [async-iteration] implement spec update for yield* in async generators
e3246ad69c
removed some redundancies in yield and yield*.

In particular:
- AsyncGeneratorRawYield becomes unnecessary, and is deleted in this CL
- Parser::RewriteYieldStar() is updated to perform the IteratorValue() algorithm as appropriate

BUG=v8:6187, v8:5855
R=rmcilroy@chromium.org, adamk@chromium.org, littledan@chromium.org, vogelheim@chromium.org

Change-Id: I05e8429b9cbd4531c330ee53a05656b90162064c
Reviewed-on: https://chromium-review.googlesource.com/471806
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#44649}
2017-04-13 14:32:30 +00:00
Leszek Swirski
0010be5b23 [compiler] Always use deopt count for disabling optimization
Currently we count optimizations to decide to disable optimization, and
count deopts to detect this decision and allow re-enabling optimizations
after a while.

However, throwing out TurboFan OSR code and GC optimized code evictions
do not count as deopts, which means that the optimization count
increases without increasing the deopt count. This increased optimization
count disables further optimization -- which is bad, because these are
not "true" deopts -- and can stop the optimization from being re-enabled,
because the deopt count can't go high enough.

Instead, we now only ever look at deopts to disable/re-enable
optimization, and opt counts are only used for naming log files and in
tests.

Change-Id: I0c7d6be497545449a38cf952cd2f007ee51982ba
Reviewed-on: https://chromium-review.googlesource.com/468811
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44647}
2017-04-13 13:41:26 +00:00
Michael Starzinger
f09460389b [asm.js] Test and fix "|0" annotation of calls.
This fixes the validation of "|0" annotations of call sites that are
used to indicate a "signed" return type of functions. We use lookahead
during call validation and request deferred validation as part of the
actual OR-expression. Special care has to be taken to get precedence
levels of all involved operators right.

R=clemensh@chromium.org
TEST=mjsunit/asm/call-annotation
BUG=v8:6183

Change-Id: If0586f669e7cee26a13425b0fd9f41098e852d68
Reviewed-on: https://chromium-review.googlesource.com/475871
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44639}
2017-04-13 10:38:22 +00:00
jgruber
876e23c54d [regexp] Fix incorrect DCHECK in FixSingleCharacterDisjunctions
The condition only applies in unicode mode, where any lone surrogates
are desugared into a character class (and will not be considered in this
optimization). Non-unicode mode treats lone surrogates exactly like
any other codepoint.

BUG=chromium:711092

Review-Url: https://codereview.chromium.org/2808403006
Cr-Commit-Position: refs/heads/master@{#44638}
2017-04-13 10:33:08 +00:00
Franziska Hinkelmann
b30503387f [type feedback] Allow position 0.
In eval scripts, the source code position can be 0 rather
than greater than 0.

Add regression test.

Drive-by fix: unrelated typo.

Bug: 707223
Change-Id: If52c0736daac3ad42ac6d324eb8ec5f1798f6f5a
Reviewed-on: https://chromium-review.googlesource.com/476630
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44637}
2017-04-13 09:55:14 +00:00