Commit Graph

55396 Commits

Author SHA1 Message Date
Sathya Gunasekaran
5b6291c50e Revert "[parser] Skip TDZ Checks in more cases of let and const"
This reverts commit f4a747b72d.

Reason for revert: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite%20-%20debug/3001

Original change's description:
> [parser] Skip TDZ Checks in more cases of let and const
> 
> The parser can now skip TDZ checks for cases when a reference is in,
> or nested in, a scope that's both a sibling of the declaration and
> created by a function expression.
> 
> Bug: v8:7331
> Change-Id: Ia9748b5a8faa3037873efe5081837f5d0aa74115
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1542042
> Commit-Queue: Suraj Sharma <surshar@microsoft.com>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60853}

TBR=adamk@chromium.org,verwaest@chromium.org,surshar@microsoft.com

Change-Id: Iaa34b1f7cafcc0e77cd7cc20372885b1904bd827
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7331
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1568078
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60854}
2019-04-15 23:52:19 +00:00
Suraj Sharma
f4a747b72d [parser] Skip TDZ Checks in more cases of let and const
The parser can now skip TDZ checks for cases when a reference is in,
or nested in, a scope that's both a sibling of the declaration and
created by a function expression.

Bug: v8:7331
Change-Id: Ia9748b5a8faa3037873efe5081837f5d0aa74115
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1542042
Commit-Queue: Suraj Sharma <surshar@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60853}
2019-04-15 23:13:17 +00:00
Bill Ticehurst
02703a099a Fix Wasm trap handler recursion on exceptions raised early
Check if storage for thread_local variables has been allocated before
attempting to access such variables, as exceptions may be raised in the
thread before this initializion is complete, causing an infinite loop.

Bug: v8:8966
Change-Id: Ifc6223b74999a55bfd0ed2d6ebf054bbffd7e809
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1507714
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60852}
2019-04-15 20:14:47 +00:00
Tom Anderson
4dd01774c6 Avoid libc++ assert failure when building with _LIBCPP_DEBUG=0
libc++ will assert when indexing one element past the end of a vector, but V8
uses this as the end iterator for ScopedPtrList.  Similarly, when there's no
elements in the vector, v[0] will also assert, so ScopedPtrList::begin() needs
to be updated too.  This CL changes ScopedPtrList to use std::vector::data() to
get the iterators.

BUG=chromium:923166
TBR=machenbach

Change-Id: Ic6a5176611d52ed592da743ecce44287c452b379
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565543
Commit-Queue: Thomas Anderson <thomasanderson@chromium.org>
Reviewed-by: Nico Weber <thakis@chromium.org>
Auto-Submit: Thomas Anderson <thomasanderson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60851}
2019-04-15 17:35:57 +00:00
Clemens Hammacher
e6e349dc7d [wasm][gc] Add missing code refs for code logging
We are missing wasm code ref scopes, and fail layout tests:
https://ci.chromium.org/p/chromium/builders/try/linux-rel/69013
This CL fixes this by managing ref counts explicitly in the
LogCodesTask.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: I86ee09da7b36abf184c5a64a5b0648a3e39c1bb4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565902
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60850}
2019-04-15 15:09:26 +00:00
Michael Lippautz
225c062d52 heap-snapshot-generator: Get copy of edge name
Edge names are not always string constants and have to be deleted at
some point. Copy them over to StringStorage to allow the embedder
freeing up their copy.

Bug: chromium:936797
Change-Id: I1c1a617c79c2016b3bd30c3460bb7a47edce1b95
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565903
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60849}
2019-04-15 15:03:04 +00:00
Michael Hablich
d03c6b1712 Revert "[wasm] Add off-by-default runtime flag for growing shared memory"
This reverts commit 656f57bd78.

Reason for revert: This blocks lkgr advancement/rolling, see https://ci.chromium.org/p/v8/builders/luci.v8.ci/V8-Blink%20Linux%2064/31263. Please fix upstream tests first.

Original change's description:
> [wasm] Add off-by-default runtime flag for growing shared memory
> 
> Grow memory isn't ready to ship in M75.
> 
> Bug: v8:8564, chromium:951795
> Change-Id: I75602bce833653b7943f5606236a97ca6dbad5c9
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566239
> Reviewed-by: Ben Smith <binji@chromium.org>
> Commit-Queue: Adam Klein <adamk@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60836}

TBR=binji@chromium.org,adamk@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8564, chromium:951795
Change-Id: If212f1b21699394b66e9e306d12a3baf37ccf4b6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565901
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60848}
2019-04-15 14:22:14 +00:00
Dan Elphick
f12e8d64ab [compiler] Don't collect source positions when throwing exceptions
While crrev.com/c/1520721 tried to avoid collecting source positions
when throw exceptions, it failed because they were still collected in
Isolate::CaptureStackTrace.

This removes that collection point and lets SetStackFrameCacheCommon
bail out when trying to set the stack frame cache for a bytecode that
doesn't have source positions.

It also adds tests that ensure source positions are not collected when
an exception is thrown (although one is disabled as it does not yet
work).

Bug: v8:8510
Change-Id: Id5caf579dda549d637fa9b3129c419d524be5ff2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565898
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60847}
2019-04-15 14:10:15 +00:00
Frederik Gossen
87792715c9 [wasm-hints] Add Tests for Lazy Modules
Added test cases for entirely lazily compiled modules. They are treated
just like empty modules are.

Bug: v8:9003
Change-Id: Ic0fcae7de32e50a0aac271567c18159bf8154028
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562130
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60846}
2019-04-15 13:35:14 +00:00
Clemens Hammacher
71ed7f4b32 [wasm][gc] Decrement ref count when replacing code
This CL introduces the first (and most important) place where we need
to decrement the ref count of wasm code. When installing new code in
the code table and jump table, the prior code becomes unreachable via
new function calls.
This change executes many code paths that were unreachable before,
since the ref count was never decremented.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: Ibe33df562f240f7cd5996f6061809e93838be425
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566512
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60845}
2019-04-15 12:42:34 +00:00
Michael Starzinger
97bad6be44 Make {StackFrame::unchecked_code} fail gracefully.
This makes sure that all overrides of {StackFrame::unchecked_code}
return a value, even if there is no {Code} object associated with the
frame. This ensures debug functions like {StackTraceFailureMessage}
continue working for all stack traces.

R=neis@chromium.org
BUG=chromium:952761

Change-Id: Ie42b301e4d43ebf67acc80e6c1b7bcb4cdc7c947
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566515
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60844}
2019-04-15 12:40:54 +00:00
Clemens Hammacher
c7b43ae5f3 [wasm][gc] Add code ref on NativeModule::GetCode
Since {NativeModule::GetCode} returns a raw pointer to {WasmCode}, it
needs to increment the reference counter on that code object.
{HasCode} on the other hand does not return a code pointer, so it's
implemented separately now.

R=mstarzinger@chromium.org

Bug: v8:8217
Change-Id: I812981aaf89281fb0296682114f248079e57a5e3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566514
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60843}
2019-04-15 12:34:14 +00:00
Peter Marshall
a32c97cca1 [cleanup] Clean up space names in the heap
- Remove AllocationSpaceName() which was in SHOUTY_CASE and did not
  actually handle CODE_LO_SPACE.
- Make GetSpaceName() static because it is.
- Change callers of old AllocationSpaceName() to use GetSpaceName().
- Change the input type to a AllocationSpace rather than int given the
  function crashes on invalid values.

Space::name() now returns a lower case result but this is only used by
functions guarded by gc_verbose or trace_fragmentation so I don't think
this will break anything.

Change-Id: Ice9a955365d4a22233af7ba39126ad8e5cff2aab
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565474
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Auto-Submit: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60842}
2019-04-15 12:17:14 +00:00
Sergiy Belozorov
fd8ce36550 [tools] Enable vpointer-sanitation on UBSan bots
Even though we override chromiums UBSan settings in our own BUILD.gn to
include all sanitizers, vptr is still excluded. The reason is that
the vptr sanitizer requires RTTI to be enabled.

The "is_ubsan_vptr" flag will enable RTTI as well as some linker flags
to export libc++abi symbols. Both are required by the vptr sanitizer.

Change-Id: I803ed71781bb3edc824bbe5d1aaa830841b4b304
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566511
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60841}
2019-04-15 11:54:24 +00:00
Sergiy Belozorov
b7af29cfdf Update V8 DEPS.
Rolling v8/build: bee1272..a7f62a0

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/2309843..b614c56

Rolling v8/third_party/icu: 4ae7482..35f7e13

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Bug: v8:9131
Change-Id: Ie342eb673ea4c987bc8f2010e37e15a6626ae9d6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1567282
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#60840}
2019-04-15 11:23:24 +00:00
Frederik Gossen
25d6ba73a2 [wasm-hint] Add Test Cases for Streaming Compilation
Tests streaming compilation with Wasm compilation hints enabled. In
particular, validation errors in lazily compiled functions are covered.

Bug: v8:9003
Change-Id: I81611988b8451ce2f6562962dbd50561f5086aef
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561310
Commit-Queue: Frederik Gossen <frgossen@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60839}
2019-04-15 10:35:14 +00:00
v8-ci-autoroll-builder
8aabeffde5 Update V8 DEPS.
Rolling v8/build: f10a653..bee1272

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/095babf..2309843

Rolling v8/third_party/depot_tools: 1de3cd4..db58954

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: Ice4dafc17dcddb8f9a6026ce4f4bca8f3ec1cd67
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566248
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#60838}
2019-04-13 03:27:05 +00:00
Yu Yin
c5033ebc93 [mips64][heap] Clean-up keys of oldspace weakmaps during scavenge
port https://crrev.com/c/1541476

Original Commit Message:

     This CL adds handling for cleaning up weakmap (EphemeronHashTable)
     keys during scavenge, even if the weakmap resides in oldspace.

Change-Id: If0598a499641ba502b00857204e32ca63e0712c3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564320
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Yu Yin <xwafish@gmail.com>
Cr-Commit-Position: refs/heads/master@{#60837}
2019-04-13 01:15:12 +00:00
Adam Klein
656f57bd78 [wasm] Add off-by-default runtime flag for growing shared memory
Grow memory isn't ready to ship in M75.

Bug: v8:8564, chromium:951795
Change-Id: I75602bce833653b7943f5606236a97ca6dbad5c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1566239
Reviewed-by: Ben Smith <binji@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60836}
2019-04-13 00:05:03 +00:00
Sathya Gunasekaran
f1a30b740b [ESNext] Stage Promise.allSettled
Bug: v8:9060
Change-Id: Ibea24457354a6b7d32449ae41c680ff37481341e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565541
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60835}
2019-04-12 23:25:32 +00:00
Z Duong Nguyen-Huu
56873d9616 Handle COW map for sealed, frozen object
Basically, SetPropertyInternal is called without handling COW map.

Improve test coverage as well.

Bug: chromium:951438
Change-Id: Iea8c818ab6a8ddea204f86a9d676a1ea42fd07f0
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562731
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60834}
2019-04-12 19:43:39 +00:00
Ross McIlroy
e65e50142c [Test] Re-enable math-floor-global.js on gc-stress
Should no longer be flaky since bug is fixed.

BUG=v8:8964
TBR=machenbach@chromium.org

Change-Id: I3fc124aca8bcfc16ddf7560d48d84dc01d4ce332
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564069
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60833}
2019-04-12 19:08:09 +00:00
Sathya Gunasekaran
40004881f6 Revert "Fix array.concat with double for sealed, frozen object"
This reverts commit 68ba8574f6.

Reason for revert: breaks windows builds https://ci.chromium.org/p/v8/builders/ci/V8%20Win32%20-%20builder/27839

Original change's description:
> Fix array.concat with double for sealed, frozen object
> 
> Treat packed sealed, frozen element as packed element.
> Also rename to IsPackedFrozenOrSealedElementsKind.
> 
> Bug: chromium:951988
> Change-Id: Ia636f0a14a229e4c44772627728927db1b877f27
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565470
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
> Cr-Commit-Position: refs/heads/master@{#60831}

TBR=jarin@chromium.org,ishell@chromium.org,verwaest@chromium.org,duongn@microsoft.com

Change-Id: I84caf106dbdd2209aef0a994173e1c3982e9f7b1
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:951988
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565542
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60832}
2019-04-12 18:00:09 +00:00
Z Duong Nguyen-Huu
68ba8574f6 Fix array.concat with double for sealed, frozen object
Treat packed sealed, frozen element as packed element.
Also rename to IsPackedFrozenOrSealedElementsKind.

Bug: chromium:951988
Change-Id: Ia636f0a14a229e4c44772627728927db1b877f27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565470
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60831}
2019-04-12 17:50:23 +00:00
Sathya Gunasekaran
1f6d27e8df [ESNext] Implement Promise.allSettled
Bug: v8:9060
Change-Id: Ia58f7f9e19726f26dd09665d32efc1037f71e7e2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1560409
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60830}
2019-04-12 17:49:17 +00:00
Z Duong Nguyen-Huu
b151cd2f7f Fix array.includes undefined for sealed/frozen object
For slow-path of array.includes, it should be able to handle if arguments is undefined for sealed/frozen object

Bug: chromium:951780
Change-Id: I42dcf1e23ab07bfcd87e7a5d27b52e66b2d1d2ae
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565031
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#60829}
2019-04-12 17:36:32 +00:00
Georg Neis
d7fb4a64c1 [turbofan] Basic brokerization for ReduceNamedAccess
Bug: v8:7790
Change-Id: I65e050929a45c3391c5c9c9b0d814ae536664cf4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564067
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60828}
2019-04-12 17:35:28 +00:00
Santiago Aboy Solanes
20a93efef5 [Turbofan][ptr-compr] Change native context specialisation for Compressed (Any)
This CL can be used as a base for specialising CompressedSigned and
CompressedPointer.

B

Cq-Include-Trybots: luci.v8.try:v8_linux64_pointer_compression_rel_ng,v8_linux64_arm64_pointer_compression_rel_ng
Bug: v8:8977, v8:7703
Change-Id: I43c8e7f57021ac506822aba5bbd4bdf6cc3159ba
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1543731
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60827}
2019-04-12 17:34:24 +00:00
Georg Neis
549031b44f [interpreter] Add a comment regarding CreateArrayFromIterable
R=rmcilroy@chromium.org

Change-Id: I41739db4d6cb06e798ff6a323a526329b4ac0af4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562132
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60826}
2019-04-12 17:33:18 +00:00
Clemens Hammacher
6832f29250 Revert "[heap] Skip ro-space from heap iterators, add CombinedHeapIterator."
This reverts commit 3d1d8eae77.

Reason for revert: Speculative revert; seems to break all nosnap bots, e.g. https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap/25240

Original change's description:
> [heap] Skip ro-space from heap iterators, add CombinedHeapIterator.
> 
> Read-only space sharing requires an iterator independent of heap. This
> also enables future removal of read-only space from heap.
> 
> Bug: v8:7464
> Change-Id: Ia07a9369494ea2c547d12c01ffa1d7b8b6bbeabc
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552795
> Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60819}

TBR=ulan@chromium.org,hpayer@chromium.org,delphick@chromium.org,goszczycki@google.com

Change-Id: I64b58b1b0c5eb073a6d2cfae81bb4de65f0511bf
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565895
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60825}
2019-04-12 16:38:00 +00:00
Sergiy Belozorov
168c186c4b [tools] Add a log line when retrying runnables
TBR=machenbach@chromium.org, tmrts@chromium.org

No-Try: true
No-Tree-Checks: true
Bug: chromium:872257
Change-Id: I12a61a7e09ab240a9ee0f3e4a06f1190583075c9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565894
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60824}
2019-04-12 15:46:57 +00:00
Maciej Goszczycki
6b82682561 [cleanup] Remove out of date comment
Bug: v8:8834
Change-Id: I76d952685f5172844fb0f3189078c0a0bc764b41
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1559746
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#60823}
2019-04-12 14:44:18 +00:00
Benedikt Meurer
f11ba854e5 [map] Support in-place field representation changes.
This adds a new flag --modify-field-representation-inplace (enabled by
default), which lets the runtime perform field representation changes
for Smi to Tagged or for HeapObject to Tagged in-place instead of
creating new maps and marking the previous map tree as deprecated.

That means we create (a lot) fewer Maps and DescriptorArrays in the
beginning and also need to self-heal fewer objects later (migrating
off the deprecated maps). In TurboFan we just take the "field owner
dependency" whenever we use the field representation, which is very
similar to what we already do for the field types. That means if we
change the representation of a field that we used in optimized code,
we will simply deoptimize that code and have TurboFan potentially
later optimize it again with the new field representation.

On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
time from around 415ms to around 352ms, which corresponds to a **15%**
improvement. The overall Speedometer2 score improves from around 74.1
to around 78.3 (on local runs with content_shell), corresponding to a
**5.6%** improvement here. 🎉

On the CNN desktop browsing story, it seems that we reduce map space
utilization/fragmentation by about 4-5%. But since we allocate a lot
less (fewer Maps and DescriptorArrays) we also significantly change
the GC timing, which heavily influences the results here. So take this
with a grain of salt. 🤷

Note: For Double fields, this doesn't change anything, meaning they
still create new maps and deprecate the previous map trees.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: Ibd70efcb59be982863905663dbfaa89aa5b31e14
Cq-Include-Trybots: luci.chromium.try:linux-rel,win7-rel
Doc: http://bit.ly/v8-in-place-field-representation-changes
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565891
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60822}
2019-04-12 14:37:07 +00:00
Clemens Hammacher
4515df1aed [wasm] Avoid busy-waiting on foreground thread
When all units started compiling, but not all are finished yet, the
main thread waits in a busy loop.
This CL fixes that by introducing a semaphore which is signalled when
baseline compilation finishes or compilation fails. The foreground
thread waits on this semaphore if there are no more units to start.

R=mstarzinger@chromium.org

Bug: v8:8916
Change-Id: I7351c0b777f008fef3aa1d1d16089c4e6fd91106
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564055
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60821}
2019-04-12 14:06:47 +00:00
Mythri Alle
63856ed612 Revert "[ic] Remove the check for fast prototypes in LoadIC_Uninitialized"
This reverts commit d14ed12e56.

Reason for revert: breaks mjsunit tests in lite mode: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/3557

Original change's description:
> [ic] Remove the check for fast prototypes in LoadIC_Uninitialized
> 
> When handling load named properties (without feedback vectors) we used
> to miss to runtimes if the prototypes aren't set. This was because we
> wanted to give the prototype a chance to become fast, since most prototypes
> start in slow mode but move to fast after the initial setup. Though this
> check is not really useful when we don't have feedback vectors, and once
> feedback vectors are allocated we will turn the prototypes fast anyway.
> 
> Bug: v8:8394, v8:8860
> Change-Id: Ib2247e5e921f6375bda65310560ac832fd0339bf
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561316
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60818}

TBR=mythria@chromium.org,verwaest@chromium.org

Change-Id: I28e420951483c93363e8a78621a247a7723d735f
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8394, v8:8860
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565893
Reviewed-by: Mythri Alle <mythria@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60820}
2019-04-12 13:45:39 +00:00
Maciej Goszczycki
3d1d8eae77 [heap] Skip ro-space from heap iterators, add CombinedHeapIterator.
Read-only space sharing requires an iterator independent of heap. This
also enables future removal of read-only space from heap.

Bug: v8:7464
Change-Id: Ia07a9369494ea2c547d12c01ffa1d7b8b6bbeabc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1552795
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60819}
2019-04-12 13:26:34 +00:00
Mythri A
d14ed12e56 [ic] Remove the check for fast prototypes in LoadIC_Uninitialized
When handling load named properties (without feedback vectors) we used
to miss to runtimes if the prototypes aren't set. This was because we
wanted to give the prototype a chance to become fast, since most prototypes
start in slow mode but move to fast after the initial setup. Though this
check is not really useful when we don't have feedback vectors, and once
feedback vectors are allocated we will turn the prototypes fast anyway.

Bug: v8:8394, v8:8860
Change-Id: Ib2247e5e921f6375bda65310560ac832fd0339bf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561316
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60818}
2019-04-12 13:24:44 +00:00
Georg Neis
45df2e8a10 [turbofan] Teach the serializer about many more bytecodes
... all of the kind that modifies the accumulator but no other
registers. Also move a few of that kind out of the IGNORED_BYTECODES
list, where they didn't belong.

R=mslekova@chromium.org

Bug: v8:7790
Change-Id: I67189750e5e01fc8a3b6b5117b61a0d21837693a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561320
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60817}
2019-04-12 12:56:14 +00:00
Michael Achenbach
1ea09f0b4f [test] Ignore optimization state in tests on number fuzzer
This enable test suites to check which test driver framework is used.
When using number fuzzer on mjsunit, we add a JS file that
switches off the optimization-state assertions.

Checking intrinsic state is not feasible on the number fuzzer and in
the past, we needed to skip tests on demand, which is a maintenance
burden. The main function of the fuzzer, to check for dcheck errors and
tsan issues, is retained.

Bug: v8:9127
Change-Id: I699b85d5f7c9aaed337a2130d9eddc160c059d7b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565892
Reviewed-by: Sergiy Belozorov <sergiyb@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60816}
2019-04-12 12:50:55 +00:00
Georg Neis
9f37b2f74b [turbofan] Lift incorrect restriction in serializer
Bug: v8:7790
Change-Id: Iab5df5e0f387612dfdb1f68b34941e65fe8e256c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561314
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60815}
2019-04-12 12:43:54 +00:00
Sergiy Belozorov
3478f053d4 [tools] Implement retry mechanism for failures and use it for some flaky tests
This is not fixing the root cause of the flakiness, but prevents us from loosing
data in the short to medium term as investigation proved to be difficult and
will likely take even more time.

R=machenbach@chromium.org, tmrts@chromium.org

Bug: chromium:872257
Change-Id: Id5fbd0a00058f8612089ee4d6a858193924bd868
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564204
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60814}
2019-04-12 12:25:44 +00:00
Benedikt Meurer
3a7ce5decc [debug] Forcibly instantiate lazy accessor pairs when setting break points.
Previously we had some kind of self-healing when calling lazy accessor
pairs via InvokeApiFunction(), but we also have other paths for calling
into FunctionTemplateInfos directly, which didn't do this check. Since
we already walk the heap when installing the DebugBreakTrampoline, and
compile all uncompiled functions, we can also just forcibly instantiate
all the lazy accessor pairs at that time and not have to worry about the
break-at-entry later.

Bug: v8:178, v8:7596, v8:8834
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Change-Id: I514392cf328fc8ed0b80ad19009f32e20ff850b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1565890
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Auto-Submit: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60813}
2019-04-12 12:12:35 +00:00
Nico Weber
0c08a7565e Remove explicit -Wextra-semi, -Winconsistent-missing-override flags.
They're  enabled via the chromium_code config already these days.
No intended behavior change.

Bug: chromium:926235,chromium:428099
Change-Id: I4f7024ab78cb9672ec3db686e0155b2d835a4790
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564694
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Nico Weber <thakis@chromium.org>
Auto-Submit: Nico Weber <thakis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60812}
2019-04-12 11:56:04 +00:00
Igor Sheludko
c359728085 [ptr-compr] Fix handling of compressed spill slots
To keep things simple, we just ensure that the spill slots always
contain full uncompressed pointers before GC sees them.

Bug: v8:8977, v8:7703
Change-Id: I54eab1b3e79e8525200139e487ff64d82ae157e5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564198
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60811}
2019-04-12 11:43:55 +00:00
Sergiy Belozorov
f7afe0087e [tools] Refactor run_perf.py and run_perf_test.py
- Remove all relative imports from mock and os
- Fix mocking in a few tests to prevent cross-test side-effects
- Add run_perf_test.py to v8_presubmit.py
- The vpython config was not added since root .vpython already includes
  coverage and mock libraries
- Convert all double-quoted strings to single-quoted (PS8->PS9)

R=sergiyb@chromium.org

Bug: chromium:123456
Change-Id: I7b3a08dc5d950b0f51cc7a5eb3a012ea953ca824
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564206
Commit-Queue: Sergiy Belozorov <sergiyb@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60810}
2019-04-12 11:34:54 +00:00
Simon Zünd
0c1d1a4094 Reland "Reserve two in-object properties slots for JSErrors"
This is a reland of 21adacab88

The failure that caused this revert is unrelated to this change
and is fixed in a separate CL (https://crbug.com/v8/9123).

Original change's description:
> Reserve two in-object properties slots for JSErrors
>
> The most common use-case for creating errors is "new Error('message')".
> The resulting JSError object has two properties. The message passed to
> the constructor and an accessor for the stack.
>
> This CL reserves two in-object property slots for these two, so no
> PropertyArray has to be created.
>
> Bug: v8:9116
> Change-Id: I84467453446f333bf65425807707ee6581894e61
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564195
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60791}

Bug: v8:9116
Change-Id: I5b0e0183ca0cbc55739aae9097c08aee34b4fa54
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564059
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60809}
2019-04-12 11:10:24 +00:00
Jaroslav Sevcik
d1e849ef00 Expose the bytecode limit for optimization as a flag
Bug: v8:9119, v8:8598
Change-Id: Ia4765c19e60b58d938fe778776ee654b60631e39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564203
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60808}
2019-04-12 10:58:14 +00:00
Michael Hablich
48efe388d8 Revert "[map] Support in-place field representation changes."
This reverts commit 1416d5a565.

Reason for revert: blocks roll https://chromium-review.googlesource.com/c/chromium/src/+/1564550

Original change's description:
> [map] Support in-place field representation changes.
> 
> This adds a new flag --modify-field-representation-inplace (enabled by
> default), which lets the runtime perform field representation changes
> for Smi to Tagged or for HeapObject to Tagged in-place instead of
> creating new maps and marking the previous map tree as deprecated.
> 
> That means we create (a lot) fewer Maps and DescriptorArrays in the
> beginning and also need to self-heal fewer objects later (migrating
> off the deprecated maps). In TurboFan we just take the "field owner
> dependency" whenever we use the field representation, which is very
> similar to what we already do for the field types. That means if we
> change the representation of a field that we used in optimized code,
> we will simply deoptimize that code and have TurboFan potentially
> later optimize it again with the new field representation.
> 
> On the Speedometer2/ElmJS-TodoMVC test, this reduces the total execution
> time from around 415ms to around 352ms, which corresponds to a **15%**
> improvement. The overall Speedometer2 score improves from around 74.1
> to around 78.3 (on local runs with content_shell), corresponding to a
> **5.6%** improvement here. 🎉
> 
> On the CNN desktop browsing story, it seems that we reduce map space
> utilization/fragmentation by about 4-5%. But since we allocate a lot
> less (fewer Maps and DescriptorArrays) we also significantly change
> the GC timing, which heavily influences the results here. So take this
> with a grain of salt. 🤷‍♂️
> 
> Note: For Double fields, this doesn't change anything, meaning they
> still create new maps and deprecate the previous map trees.
> 
> Bug: v8:8749, v8:8865, v8:9114
> Change-Id: I694a53f87ae5caeb868fd98a21809b66d4297d35
> Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
> Doc: http://bit.ly/v8-in-place-field-representation-changes
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1561132
> Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60764}

TBR=jarin@chromium.org,neis@chromium.org,ishell@chromium.org,bmeurer@chromium.org,verwaest@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:8749, v8:8865, v8:9114
Change-Id: I666975d08d51bbe7ab4faec9428b9a1f88e9b322
Cq-Include-Trybots: luci.chromium.try:linux-blink-rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564208
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60807}
2019-04-12 10:37:04 +00:00
Frank Tang
e4b5fcebdf Make Date.to(Date|UTC|)String use 4 digits for negative year
Bug: v8:9081
Change-Id: I505e8ee4bf58f2da09962ae9a7056931435c10f9
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1562587
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Frank Tang <ftang@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60806}
2019-04-12 10:00:39 +00:00
Simon Zünd
d78014455b Revert "Reland^2 "[torque] Throw exception instead of aborting if something goes wrong""
This reverts commit ffe6940fbc.

Reason for revert: Breaks UBSan bot

Original change's description:
> Reland^2 "[torque] Throw exception instead of aborting if something goes wrong"
> 
> This is a reland of 251d1623f3
> 
> The reland fixes ASAN component builds by adding RTTI build config to both
> torque executables. Big thanks to sigurds for finding the fix.
> 
> Original change's description:
> > Reland "[torque] Throw exception instead of aborting if something goes wrong"
> >
> > This is a reland of 3bd49f9b90
> >
> > The issue on the windows bot is apparently a compiler bug in MSVC related to
> > move construction. The fix seems to be to change the order of the fields in
> > "JsonParseResult" (go figure).
> >
> > Drive-by-change: Fix LS on windows by emitting correct line endings and
> > enabling exceptions for the LS executable as well.
> >
> > Original change's description:
> > > [torque] Throw exception instead of aborting if something goes wrong
> > >
> > > This CL enables exceptions for the Torque compiler and Torque language
> > > server. Instead of aborting when something goes wrong during
> > > compilation, a TorqueError is thrown, containing the error message
> > > and a source position. The compiler executable still prints the error
> > > and aborts, while the language server will pass this information
> > > along to the client (not included in this CL).
> > >
> > > R=danno@chromium.org
> > >
> > > Bug: v8:8880
> > > Change-Id: Iad83c46fb6a91c1babbc0ae7dbd94fbe4e7f1663
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1526003
> > > Reviewed-by: Daniel Clifford <danno@chromium.org>
> > > Commit-Queue: Simon Zünd <szuend@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#60512}
> >
> > Bug: v8:8880
> > Change-Id: I00e6591bbb4c516dd7540a7e27196853bc637f11
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1545995
> > Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
> > Commit-Queue: Simon Zünd <szuend@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#60736}
> 
> Bug: v8:8880
> Change-Id: Iba198d771169283e83e74324f27aa9e90b8d8975
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1563770
> Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
> Commit-Queue: Simon Zünd <szuend@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#60804}

TBR=sigurds@chromium.org,tebbi@chromium.org,szuend@chromium.org

Change-Id: I30ccec8ac28158c102a4e9a01074432172685f96
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8880
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1564207
Reviewed-by: Simon Zünd <szuend@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#60805}
2019-04-12 09:59:36 +00:00