Commit Graph

15442 Commits

Author SHA1 Message Date
Clemens Hammacher
95c5c76fe3 [wasm] [fuzzer] Bound the number of steps to execute
To avoid running infinitely or hitting the stack size limit, bound the
number of steps to execute in the interpreter to 16k.

R=ahaas@chromium.org
BUG=chromium:708457

Change-Id: Ib101bbbc06627641dae2fd1cd1a8d950aa504eaf
Reviewed-on: https://chromium-review.googlesource.com/469609
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44446}
2017-04-06 14:20:18 +00:00
domenic
0d25fee308 Add isPromise V8 extras util
This is used by streams in
https://streams.spec.whatwg.org/commit-snapshots/1375e266b2fe8246bd95cb9d8a49876ba9359dc9/#rs-pipe-through

This also fixes an omission in a6e635d692
that did not properly update the
%OptimizeObjectForAddingMultipleProperties call in prologue.js.

BUG=chromium:668951
R=gsathya@chromium.org,littledan@chromium.org

Review-Url: https://codereview.chromium.org/2796243002
Cr-Commit-Position: refs/heads/master@{#44442}
2017-04-06 13:16:35 +00:00
bmeurer
dd7ce93ce0 [turbofan] Collect and use type feedback on ToNumber.
Make Ignition collect BinaryOperationFeedback on ToNumber, using the
shared type feedback slot with the following Inc/Dec bytecode, and use
this feedback in TurboFan to turn the ToNumber(x) operation into a
SpeculativeNumberMultiply(x,1) with the feedback hint.

R=jarin@chromium.org, mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=v8:6214,v8:5267

Review-Url: https://codereview.chromium.org/2804813003
Cr-Commit-Position: refs/heads/master@{#44440}
2017-04-06 11:54:44 +00:00
Camillo Bruni
98d1d4ec9b [tests] Introduce %HeapObjectVerify runtime function for tests
Bug: v8/6024
Change-Id: Iff8a1b7a75e9f8f18ac24f31a5275e91aa16a272
Reviewed-on: https://chromium-review.googlesource.com/469347
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44439}
2017-04-06 11:16:43 +00:00
rossberg
0344b73e66 [wasm] Fix typing of loop labels in br_table
R=ahaas@chromium.org
BUG=v8:6204

Review-Url: https://codereview.chromium.org/2799753003
Cr-Commit-Position: refs/heads/master@{#44435}
2017-04-06 10:25:55 +00:00
Andreas Haas
22615158ed Reland [wasm] Make WebAssembly.compile() asynchronous
The following aspects were changed for the reland:

* The DeferredHandleScope is supposed with a specific pattern,
  i.e. allocate handles in a normal HandleScope and then 
  reopen them in the DeferredHandleScope.
* Set the native_context when it is used in a task.

Change-Id: Ia42c46ec6bc73179cb1f458e36658414ff85cc23
Reviewed-on: https://chromium-review.googlesource.com/468809
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44434}
2017-04-06 10:13:08 +00:00
machenbach
e4bb01b760 Revert of [inspector] move console to builtins (patchset #9 id:180001 of https://codereview.chromium.org/2785293002/ )
Reason for revert:
Seems to block roll:
https://codereview.chromium.org/2801013002/

See also:
https://build.chromium.org/p/client.v8.fyi/builders/Linux%20Tests%20%28dbg%29%281%29/builds/2731

Original issue's description:
> [inspector] move console to builtins
>
> What will we get:
> - console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
> - it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
> - console calls are ~ 15% faster.
>
> BUG=v8:6175
> R=dgozman@chromium.org
>
> Review-Url: https://codereview.chromium.org/2785293002
> Cr-Original-Original-Commit-Position: refs/heads/master@{#44353}
> Committed: 55905f85d6
> Review-Url: https://codereview.chromium.org/2785293002
> Cr-Original-Commit-Position: refs/heads/master@{#44355}
> Committed: cc74ea0bc4
> Review-Url: https://codereview.chromium.org/2785293002
> Cr-Commit-Position: refs/heads/master@{#44416}
> Committed: f5dc738cda

TBR=dgozman@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6175

Review-Url: https://codereview.chromium.org/2801023003
Cr-Commit-Position: refs/heads/master@{#44429}
2017-04-06 08:38:14 +00:00
jgruber
ae45935646 [regexp] Ensure there are no shape changes on the fast path
BUG=v8:5437,chromium:708247

Review-Url: https://codereview.chromium.org/2797993002
Cr-Commit-Position: refs/heads/master@{#44428}
2017-04-06 08:12:56 +00:00
Ross McIlroy
108e96a4fc [Interpreter] Move ToName elision into BytecodeGenerator.
Moves the ToName elision out of the peephole optimizer and into the
BytecodeGenerator.

BUG=v8:6194

Change-Id: Ic355adbe21f967dc5d52babdd37100a260c62c26
Reviewed-on: https://chromium-review.googlesource.com/467466
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44427}
2017-04-06 08:01:02 +00:00
kozyatinskiy
ba9fc3d7bc Revert of [snapshot] Move builtins generation into mksnapshot (patchset #8 id:160001 of https://codereview.chromium.org/2760233005/ )
Reason for revert:
I think that this CL breaks chromium compilation on windows with clang (). All other CLs in the list looks trivial and don't change test/unittest/BUILD.gn.

[42456/47924] CXX obj/v8/test/unittests/unittests/value-serializer-unittest.obj
[42457/47924] LINK unittests.exe unittests.exe.pdb
FAILED: unittests.exe unittests.exe.pdb
E:/b/depot_tools/python276_bin/python.exe ../../build/toolchain/win/tool_wrapper.py link-wrapper environment.x64 False link.exe /nologo /OUT:./unittests.exe /PDB:./unittests.exe.pdb @./unittests.exe.rsp
bitmap-unittest.obj : error LNK2019: unresolved external symbol "public: void __cdecl v8::internal::List<class v8::internal::AllocationObserver *,class v8::internal::FreeStoreAllocationPolicy>::Add(class v8::internal::AllocationObserver * const &,class v8::internal::FreeStoreAllocationPolicy)" (?Add@?$List@PEAVAllocationObserver@internal@v8@@VFreeStoreAllocationPolicy@23@@internal@v8@@QEAAXAEBQEAVAllocationObserver@23@VFreeStoreAllocationPolicy@23@@Z) referenced in function "public: virtual void __cdecl v8::internal::Space::AddAllocationObserver(class v8::internal::AllocationObserver *)" (?AddAllocationObserver@Space@internal@v8@@UEAAXPEAVAllocationObserver@23@@Z)

slot-set-unittest.obj : error LNK2001: unresolved external symbol "public: void __cdecl v8::internal::List<class v8::internal::AllocationObserver *,class v8::internal::FreeStoreAllocationPolicy>::Add(class v8::internal::AllocationObserver * const &,class v8::internal::FreeStoreAllocationPolicy)" (?Add@?$List@PEAVAllocationObserver@internal@v8@@VFreeStoreAllocationPolicy@23@@internal@v8@@QEAAXAEBQEAVAllocationObserver@23@VFreeStoreAllocationPolicy@23@@Z)

bitmap-unittest.obj : error LNK2019: unresolved external symbol "public: bool __cdecl v8::internal::List<class v8::internal::AllocationObserver *,class v8::internal::FreeStoreAllocationPolicy>::RemoveElement(class v8::internal::AllocationObserver * const &)" (?RemoveElement@?$List@PEAVAllocationObserver@internal@v8@@VFreeStoreAllocationPolicy@23@@internal@v8@@QEAA_NAEBQEAVAllocationObserver@23@@Z) referenced in function "public: virtual void __cdecl v8::internal::Space::RemoveAllocationObserver(class v8::internal::AllocationObserver *)" (?RemoveAllocationObserver@Space@internal@v8@@UEAAXPEAVAllocationObserver@23@@Z)

slot-set-unittest.obj : error LNK2001: unresolved external symbol "public: bool __cdecl v8::internal::List<class v8::internal::AllocationObserver *,class v8::internal::FreeStoreAllocationPolicy>::RemoveElement(class v8::internal::AllocationObserver * const &)" (?RemoveElement@?$List@PEAVAllocationObserver@internal@v8@@VFreeStoreAllocationPolicy@23@@internal@v8@@QEAA_NAEBQEAVAllocationObserver@23@@Z)

./unittests.exe : fatal error LNK1120: 2 unresolved externals

Original issue's description:
> [snapshot] Move builtins generation into mksnapshot
>
> and out of the main library. This saves about 5% of binary size
> (800KB on x64, 373KB on android_arm).
>
> Only the GN build is supported; the GYP build is maintained working
> but does not support the feature.
>
> BUG=v8:6055
> CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_nosnap_rel;
>
> Review-Url: https://codereview.chromium.org/2760233005
> Cr-Commit-Position: refs/heads/master@{#44412}
> Committed: 4782bc0df8

TBR=jgruber@chromium.org,rmcilroy@chromium.org,machenbach@chromium.org,jkummerow@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6055

Review-Url: https://codereview.chromium.org/2803903002
Cr-Commit-Position: refs/heads/master@{#44422}
2017-04-05 23:53:11 +00:00
Michael Achenbach
d96fbee9aa [build] Remove remaining disable-inspector options in GN
Bug: chromium:645890
Change-Id: I9856712ca8694b3447a611c3555c42145f449b11
Reviewed-on: https://chromium-review.googlesource.com/464726
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44417}
2017-04-05 17:59:07 +00:00
kozyatinskiy
f5dc738cda [inspector] move console to builtins
What will we get:
- console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
- it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
- console calls are ~ 15% faster.

BUG=v8:6175
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2785293002
Cr-Original-Original-Commit-Position: refs/heads/master@{#44353}
Committed: 55905f85d6
Review-Url: https://codereview.chromium.org/2785293002
Cr-Original-Commit-Position: refs/heads/master@{#44355}
Committed: cc74ea0bc4
Review-Url: https://codereview.chromium.org/2785293002
Cr-Commit-Position: refs/heads/master@{#44416}
2017-04-05 16:55:19 +00:00
Ross McIlroy
7bedd1111d [Interpreter] Move ToBoolean elision in BytecodeGenerator.
Move the ToBoolean elision in the BytecodeGenerator instead of the
peephole optimizer. Adds a TypeHint mechanism to the ExpressionResult
to enable passing of type hints through the ast visitor.

BUG=v8:6194

Change-Id: Ic55506ba11b213f7459250004d3f18cab04ee9b3
Reviewed-on: https://chromium-review.googlesource.com/467208
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44415}
2017-04-05 16:51:28 +00:00
Michael Starzinger
5e8eb624fa [asm.js] Prevent throwing of asm.js warning messages.
This fixes a corner case which allowed warnings during the asm.js
instantiation to be promoted to actual exceptions. Even instantiation
attempts that fail are not allowed to throw exceptions observable by
JavaScript, but need to fall back to JavaScript execution.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-6203
BUG=v8:6203

Change-Id: I86f5a3adda4bcfe63b5cddc42d8ae1c3dbb88147
Reviewed-on: https://chromium-review.googlesource.com/468808
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44414}
2017-04-05 14:41:52 +00:00
jkummerow
4782bc0df8 [snapshot] Move builtins generation into mksnapshot
and out of the main library. This saves about 5% of binary size
(800KB on x64, 373KB on android_arm).

Only the GN build is supported; the GYP build is maintained working
but does not support the feature.

BUG=v8:6055
CQ_INCLUDE_TRYBOTS=master.tryserver.v8:v8_linux_nosnap_rel;

Review-Url: https://codereview.chromium.org/2760233005
Cr-Commit-Position: refs/heads/master@{#44412}
2017-04-05 13:28:48 +00:00
Wiktor Garbacz
4f8b76068d [compiler-dispatcher] Use an integer job id.
It enables jobs without a SharedFunctionInfo.

BUG=v8:6093

Change-Id: I70e226638fdb5b3a0634cc4437d128771c838eee
Reviewed-on: https://chromium-review.googlesource.com/468966
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Cr-Commit-Position: refs/heads/master@{#44411}
2017-04-05 12:50:11 +00:00
Michael Starzinger
42b179c4e5 [asm.js] Fix source positions of ToNumber conversions.
This extends the test coverage for source position tracking of ToNumber
conversion to also test conversion to "double" type. It also fixes the
discovered inconsistencies. Note that the conversion to "float" remains
untested as imported functions are not allowed have "float" return type.

R=clemensh@chromium.org
TEST=mjsunit/wasm/asm-wasm-exception-in-tonumber
BUG=v8:6127

Change-Id: I6c59b7a24456a585a814f19a86eb9447ac5098ab
Reviewed-on: https://chromium-review.googlesource.com/467251
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44409}
2017-04-05 12:34:55 +00:00
Clemens Hammacher
eeaceccbc6 [wasm] [decoder] Templatize decode function for unchecked decoding
In the C++ wasm interpreter, we decode LEB encoded immediates each time
we execute the respective instruction. The whole instruction sequence
was validated before, thus we know that all integers are valid.
This CL refactors several Decoder methods to allow for either checked
or unchecked decoding. In the checked case, an error is set if a check
fails, in the unchecked case, a DCHECK will fail.

This improves performance of the interpreter by 20.5%.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: If69efd4f6fbe19d84bfc2f4aa000f429a8e22bf5
Reviewed-on: https://chromium-review.googlesource.com/468786
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44406}
2017-04-05 11:14:32 +00:00
Clemens Hammacher
02b4d0e675 [wasm] [decoder] Merge checked_read_leb and consume_leb
Both methods decoded a LEB128 encoded integer, but only consume_leb
incremented the pc pointer accordingly.
This CL implements consume_leb by using checked_read_leb.

It also refactors a few things:
1) It removes error_pt, which was only avaible in checked_read_leb.
2) It renames the error method to errorf, since it receives a format
   string. This also avoids a name clash.
3) It implements sign extension directly in checked_read_leb instead of
   doing this in the caller.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: I8058f57418493861e5df26d4949041f6766d5138
Reviewed-on: https://chromium-review.googlesource.com/467150
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44405}
2017-04-05 10:31:38 +00:00
Michael Achenbach
0ed2f1784d Revert "[compiler-dispatcher] Use an integer job id."
This reverts commit 4bca9dc701.

Reason for revert: Breaks mips builder:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20builder/builds/8600

Original change's description:
> [compiler-dispatcher] Use an integer job id.
> 
> It enables jobs without a SharedFunctionInfo.
> 
> BUG=v8:6093
> 
> Change-Id: Icc5f01512c270a55349087d418b6be82ad5c6cb4
> Reviewed-on: https://chromium-review.googlesource.com/467148
> Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Jochen Eisinger <jochen@chromium.org>
> Reviewed-by: Marja Hölttä <marja@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#44402}

TBR=rmcilroy@chromium.org,marja@chromium.org,jochen@chromium.org,rmcilroy@google.com,wiktorg@google.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6093

Change-Id: Ie8d26f4e2d42f67a1cfa91269e80e407ed3f0799
Reviewed-on: https://chromium-review.googlesource.com/468887
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44404}
2017-04-05 10:25:12 +00:00
Wiktor Garbacz
4bca9dc701 [compiler-dispatcher] Use an integer job id.
It enables jobs without a SharedFunctionInfo.

BUG=v8:6093

Change-Id: Icc5f01512c270a55349087d418b6be82ad5c6cb4
Reviewed-on: https://chromium-review.googlesource.com/467148
Commit-Queue: Wiktor Garbacz <wiktorg@google.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44402}
2017-04-05 10:19:58 +00:00
mlippautz
a0655790ae Reland of [heap] Fix CompactionSpace test and move to unittests
This reverts commit eddf90c4a7.

BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2792063004
Cr-Commit-Position: refs/heads/master@{#44398}
2017-04-05 07:36:15 +00:00
jgruber
d890ec3261 [regexp] Disallow '\' in capture names
IdentifierStart::Is and IdentifierContinue::Is both return true for '\'.
The reason for this is lost to history.

Special-case '\' in the regexp parser to handle this.

BUG=v8:5437,v8:5868

Review-Url: https://codereview.chromium.org/2795093003
Cr-Commit-Position: refs/heads/master@{#44396}
2017-04-05 07:01:50 +00:00
mtrofin
026ce28532 [wasm] Further simplify WasmCompiledModule.
Better demarcation between what's mutable because it is code-
specialization specific, and what is provided at initialization.

BUG=

Review-Url: https://codereview.chromium.org/2784233004
Cr-Commit-Position: refs/heads/master@{#44395}
2017-04-05 05:58:47 +00:00
Caitlin Potter
5f782db954 [parser] don't rewrite destructuring assignments in params for lazy top level arrow functions
Remove destructuring assignments (parsed during arrow function formal
parameters) from queue for rewriting if parsing a lazy top-level arrow function.

Built ontop of https://chromium-review.googlesource.com/c/464769/

BUG=chromium:706234, chromium:706761, v8:6182
R=marja@chromium.org, adamk@chromium.org, vogelheim@chromium.org

Change-Id: Ib35196b907350d1d78e4c3fcbf4cc971bf200948
Reviewed-on: https://chromium-review.googlesource.com/465415
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44393}
2017-04-04 20:35:03 +00:00
Adam Klein
8b8295dbb9 [regexp] Handle a function Proxy passed to String.prototype.replace
Bug: v8:6186
Change-Id: If460313ee861f826a89bc7390a5e35d43d175622
Reviewed-on: https://chromium-review.googlesource.com/466549
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44390}
2017-04-04 18:48:56 +00:00
mtrofin
0bd9f1b8e6 [wasm] Module Builder v8 API: bytes passed in are owned by caller.
This reflects both the contract in blink, as well as what we
plan to do in streamed compilation, where we'll want to lay out
bytes received such that each section and each function body is
contiguous, but they may all be separate - which entails a copy.

BUG=chromium:697028

Review-Url: https://codereview.chromium.org/2797653002
Cr-Commit-Position: refs/heads/master@{#44387}
2017-04-04 16:22:46 +00:00
mlippautz
eddf90c4a7 Revert of [heap] Fix CompactionSpace test and move to unittests (patchset #3 id:40001 of https://codereview.chromium.org/2796033002/ )
Reason for revert:
Breaks
https://uberchromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20shared/builds/17291

Original issue's description:
> [heap] Fix CompactionSpace test and move to unittests
>
> BUG=chromium:651354
>
> Review-Url: https://codereview.chromium.org/2796033002
> Cr-Commit-Position: refs/heads/master@{#44382}
> Committed: ce9a2db1e1

TBR=ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2793033004
Cr-Commit-Position: refs/heads/master@{#44383}
2017-04-04 14:47:06 +00:00
mlippautz
ce9a2db1e1 [heap] Fix CompactionSpace test and move to unittests
BUG=chromium:651354

Review-Url: https://codereview.chromium.org/2796033002
Cr-Commit-Position: refs/heads/master@{#44382}
2017-04-04 14:28:21 +00:00
jgruber
10e77dfbaf Revert "Skip flaky debug-scopes test"
This reverts 1c1edda7db. I can't reproduce
the flakes locally anymore, let's see if this sticks.

BUG=v8:5619

Review-Url: https://codereview.chromium.org/2796053002
Cr-Commit-Position: refs/heads/master@{#44381}
2017-04-04 14:27:12 +00:00
Michael Achenbach
164c4298b0 [test] Skip flaky cpu profiler tests
Bug: v8:5193
NOTRY=true
TBR=hablich@chromium.org

Change-Id: I54861956c1a7b3c3e5048946618ea98fbe0a7066
Reviewed-on: https://chromium-review.googlesource.com/467246
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44380}
2017-04-04 14:26:20 +00:00
Loo Rong Jie
2b1b32253b [typedarray] ToNumber coercion is done only once for TA.p.fill
Update according to new spec change at
https://github.com/tc39/ecma262/pull/856

- Call ToNumber only once in BUILTIN
- Remove unused FillNumberSlowPath
- FillImpl assumes obj_value->IsNumber() is true
- Update test

Bug:v8:5929,chromium:702902

Change-Id: Ic83e6754d043582955b81c76e68f95e1c6b7e901
Reviewed-on: https://chromium-review.googlesource.com/465646
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44373}
2017-04-04 12:51:56 +00:00
Franziska Hinkelmann
f9d2c5123e [cleanup] Make ArrayList functions const.
Getting elements, querying length or copying elements
are now const functions.

Drive-by fix: Noticed a few more getters that should be const.
Add a comment to ArrayList functions that are static functions. 
BUG=

Change-Id: I5de1aed97510dea4e47cb974b3259da51ae663af
Reviewed-on: https://chromium-review.googlesource.com/467249
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44372}
2017-04-04 12:06:56 +00:00
Clemens Hammacher
d1b4d4fea6 [wasm] [interpreter] Fix GC issue
Make sure that we call the destructors on all embedded object by
replacing the WasmInterpreterInternals::Delete method by an actual
destructor. This way, the compiler automatically calls destructors on
all embedded objects, in particular the IdentityMap in the CodeMap.

This change also requires to release managed objects *before*
tearing down the heap, because the wasm interpreter, referenced via
Managed<>, contains global handles. When those are destroyed, the
isolate still needs to be intact.

Drive-by: Fix include guard in managed.h.

R=ahaas@chromium.org, ulan@chromium.org, mvstanton@chromium.org
BUG=v8:5822

Change-Id: I9a067f037e013c84e4d697a1e913b27c683bb529
Reviewed-on: https://chromium-review.googlesource.com/466187
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44368}
2017-04-04 10:39:57 +00:00
Michael Starzinger
ce06d1f232 [asm.js] Fix nested function table calls.
This makes temporary variables nestable and fixes borked nesting with
function table calls by introducing a {TemporaryVariableScope} helper.

R=clemensh@chromium.org
TEST=mjsunit/regress/regress-6196
BUG=v8:6196

Change-Id: Ie760f27ce9ede3d4d5dacdebdc295c56cc666970
Reviewed-on: https://chromium-review.googlesource.com/467327
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44367}
2017-04-04 10:28:06 +00:00
Franziska Hinkelmann
28a3e34bdd [type-profile] Return type profile object.
Return a structured objet with the type profile
information.

Move the test from message to mjsunit.

BUG=v8:5933

Change-Id: I3e1c592697924d87f82d46b0ddbdb6d82d9c8467
Reviewed-on: https://chromium-review.googlesource.com/464847
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44364}
2017-04-04 09:02:49 +00:00
machenbach
68c14892cb Revert of [typedarrays] Check detached buffer at start of typed array methods (patchset #10 id:180001 of https://codereview.chromium.org/2778623003/ )
Reason for revert:
Breaks layout tests:
https://build.chromium.org/p/tryserver.v8/builders/v8_linux_blink_rel/builds/18499

Changes:
https://storage.googleapis.com/chromium-layout-test-archives/v8_linux_blink_rel/18499/layout-test-results/results.html

See:
https://github.com/v8/v8/wiki/Blink-layout-tests

Original issue's description:
> [typedarrays] Check detached buffer at start of typed array methods
>
> - Throw TypeError in ValidateTypedArray, matching JSC, SpiderMonkey
>   and ChakraCore.
> - Validate typed arrays at start of each typed array prototype
>   methods in src/js/typedarrays.js
> - Add tests to check detached buffers
> - Remove an unnecessary parameter of TypedArraySpeciesCreate
>   in src/js/typedarrays.js
> - Standardize TypedArray.prototype.subarray
> - Update test262.status to pass detached buffer tests
>
> BUG=v8:4648,v8:4665,v8:4953
>
> Review-Url: https://codereview.chromium.org/2778623003
> Cr-Commit-Position: refs/heads/master@{#44357}
> Committed: 238d5b4453

TBR=cbruni@chromium.org,adamk@chromium.org,bmeurer@chromium.org,littledan@chromium.org,petermarshall@chromium.org,cwhan.tunz@gmail.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4648,v8:4665,v8:4953

Review-Url: https://codereview.chromium.org/2793233003
Cr-Commit-Position: refs/heads/master@{#44362}
2017-04-04 08:01:02 +00:00
Michael Starzinger
6a3756f9de [asm.js] Fix names for forward declared functions.
This fixes the name stored with functions where the declaration was
hoisted above the actual function definition. It also extends test
coverage and emits proper source position mapping for such cases.

R=clemensh@chromium.org
TEST=mjsunit/wasm/asm-wasm-stack
BUG=v8:6127

Change-Id: I675a98b244fe2157925e799b5c46b7f6bd53c9da
Reviewed-on: https://chromium-review.googlesource.com/466247
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44361}
2017-04-04 07:55:54 +00:00
jgruber
31700b7fbd [regexp] Stage the dotall flag
BUG=v8:6172

Review-Url: https://codereview.chromium.org/2795693002
Cr-Commit-Position: refs/heads/master@{#44360}
2017-04-04 07:04:20 +00:00
dusan.simicic
5606d50ff6 MIPS[64]: Support for some SIMD operations (2)
Add support for F32x4Splat, F32x4ExtractLane,
F32x4ReplaceLane, F32x4SConvertI32x4, F32x4UConvertI32x4
operations for mips32 and mips64 architectures.

BUG=

Note: Depends on https://codereview.chromium.org/2753903004/
Review-Url: https://codereview.chromium.org/2780503002
Cr-Commit-Position: refs/heads/master@{#44359}
2017-04-04 07:03:06 +00:00
machenbach
7c10795209 Revert of [inspector] move console to builtins (patchset #7 id:140001 of https://codereview.chromium.org/2785293002/ )
Reason for revert:
http://crbug.com/v8/6198

Original issue's description:
> [inspector] move console to builtins
>
> What will we get:
> - console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
> - it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
> - console calls are ~ 15% faster.
>
> BUG=v8:6175
> R=dgozman@chromium.org
>
> Review-Url: https://codereview.chromium.org/2785293002
> Cr-Original-Commit-Position: refs/heads/master@{#44353}
> Committed: 55905f85d6
> Review-Url: https://codereview.chromium.org/2785293002
> Cr-Commit-Position: refs/heads/master@{#44355}
> Committed: cc74ea0bc4

TBR=dgozman@chromium.org,kozyatinskiy@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6175

Review-Url: https://codereview.chromium.org/2790343002
Cr-Commit-Position: refs/heads/master@{#44358}
2017-04-04 06:48:04 +00:00
cwhan.tunz
238d5b4453 [typedarrays] Check detached buffer at start of typed array methods
- Throw TypeError in ValidateTypedArray, matching JSC, SpiderMonkey
  and ChakraCore.
- Validate typed arrays at start of each typed array prototype
  methods in src/js/typedarrays.js
- Add tests to check detached buffers
- Remove an unnecessary parameter of TypedArraySpeciesCreate
  in src/js/typedarrays.js
- Standardize TypedArray.prototype.subarray
- Update test262.status to pass detached buffer tests

BUG=v8:4648,v8:4665,v8:4953

Review-Url: https://codereview.chromium.org/2778623003
Cr-Commit-Position: refs/heads/master@{#44357}
2017-04-04 03:48:48 +00:00
kozyatinskiy
cc74ea0bc4 [inspector] move console to builtins
What will we get:
- console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
- it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
- console calls are ~ 15% faster.

BUG=v8:6175
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2785293002
Cr-Original-Commit-Position: refs/heads/master@{#44353}
Committed: 55905f85d6
Review-Url: https://codereview.chromium.org/2785293002
Cr-Commit-Position: refs/heads/master@{#44355}
2017-04-04 00:38:38 +00:00
kozyatinskiy
6ecbb8572a Revert of [inspector] move console to builtins (patchset #6 id:120001 of https://codereview.chromium.org/2785293002/ )
Reason for revert:
console.toString() should return "[object Object]"

Original issue's description:
> [inspector] move console to builtins
>
> What will we get:
> - console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
> - it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
> - console calls are ~ 15% faster.
>
> BUG=v8:6175
> R=dgozman@chromium.org
>
> Review-Url: https://codereview.chromium.org/2785293002
> Cr-Commit-Position: refs/heads/master@{#44353}
> Committed: 55905f85d6

TBR=dgozman@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:6175

Review-Url: https://codereview.chromium.org/2795003003
Cr-Commit-Position: refs/heads/master@{#44354}
2017-04-03 23:29:34 +00:00
kozyatinskiy
55905f85d6 [inspector] move console to builtins
What will we get:
- console would be included into snapshot and allow us to reduce time that we spent in contextCreated function (~5 times faster),
- it allows us to make further small improvement of console methods, e.g. we can implement super quick return from console.assert if first argument is true,
- console calls are ~ 15% faster.

BUG=v8:6175
R=dgozman@chromium.org

Review-Url: https://codereview.chromium.org/2785293002
Cr-Commit-Position: refs/heads/master@{#44353}
2017-04-03 23:00:49 +00:00
Josh Wolfe
0bd428ffea [api] Fix harmony formatting for CompileFunctionInContext
Add newline at the start of the function body.

BUG=v8:6190, v8:4958
R=littledan@chromium.org, adamk@chromium.org, caitp@igalia.com

Change-Id: I10db088ac9807a503382fd5080ad955e418d8b45
Reviewed-on: https://chromium-review.googlesource.com/466566
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Josh Wolfe <jwolfe@igalia.com>
Cr-Commit-Position: refs/heads/master@{#44352}
2017-04-03 20:05:06 +00:00
Caitlin Potter
44b5be0473 Reland Stage --harmony-function-tostring"
Relanding now that v8:6190 has been fixed

BUG=v8:4958
R=adamk@chromium.org, littledan@chromium.org, jwolfe@igalia.com

Change-Id: I2732dbf96c5f9f899cee826dd2fdc621098a87e5
Reviewed-on: https://chromium-review.googlesource.com/466226
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44351}
2017-04-03 16:50:55 +00:00
Michael Starzinger
0cb5ba0ef0 [asm.js] Fix function table call position tracking.
This adds test coverage for the source position tracking of function
table calls in asm.js and fixes the discovered issues. It also fixes
function start positions (used by errors thrown at stack checks).

R=clemensh@chromium.org
TEST=mjsunit/wasm/asm-wasm-stack
BUG=v8:6127,v8:6166

Change-Id: Id6ab6dc72bcedb0d838eed315e2a05fbc59039f4
Reviewed-on: https://chromium-review.googlesource.com/465949
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44348}
2017-04-03 15:33:53 +00:00
cwhan.tunz
8c2af03791 Use internal byteOffset in TypedArray.prototype.set
Since byteOffset is configurable, we need to access byteOffset by
%_ArrayBufferViewGetByteOffset, instead of accessing .byteOffset
property.

BUG=v8:6120

Review-Url: https://codereview.chromium.org/2761673003
Cr-Commit-Position: refs/heads/master@{#44347}
2017-04-03 15:21:18 +00:00
Clemens Hammacher
d38334c575 [wasm] [interpreter] Fix integer underflow in mem access
For OOB checks on memory accesses, we first subtracted the size of the
type to load/store from the memory size, and then compared against this
effective_size. If the memory size is smaller than the size of the type,
this would lead to an integer underflow, and we would try to load the
value.
This CL fixes this, and adds a test case for this.

R=ahaas@chromium.org
BUG=v8:5822

Change-Id: I26fcba0be7343c88b8459d029b0c0af095d2466a
Reviewed-on: https://chromium-review.googlesource.com/465946
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#44345}
2017-04-03 15:00:00 +00:00