Commit Graph

23869 Commits

Author SHA1 Message Date
Shu-yu Guo
c9600b4b3d Roll test262
21195de..1bc19352

Bug: v8:7834, v8:9808
Change-Id: I97b26749acf56f3db63b3989441ac4c2b8642807
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1910859
Reviewed-by: Sathya Gunasekaran  <gsathya@chromium.org>
Commit-Queue: Shu-yu Guo <syg@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64900}
2019-11-12 00:29:02 +00:00
Joyee Cheung
572234aa6b [class] exclude brand symbols in JSReceiver::GetPrivateEntries
This patch excludes brand symbols from the result of
JSReceiver::GetPrivateEntries so that the brands do not show up
when the instances are inspected from the DevTools (e.g. via
`Runtime.getProperties()`).

To implement this, we use a bit in the Symbols to denote whether
it's a brand symbol. A brand symbol is also a private name
symbol so that we can just reuse the IC for accessing private
names and do not need to jump through extra ORs.

Design doc: https://docs.google.com/document/d/1N91LObhQexnB0eE7EvGe57HsvNMFX16CaWu-XCTnnmY/edit

Bug: v8:8671, v8:9839, v8:8330
Change-Id: I24346aeedce3602395289052d1e1350ae9390354
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1909757
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Cr-Commit-Position: refs/heads/master@{#64899}
2019-11-11 23:40:47 +00:00
Igor Sheludko
6ff3b3703e [builtins] Allow 2Gb TypedArrays on 64-bit architectures
... even with ptr-compr.

Although full uintptr-sized TypedArrays are not supported yet
we may already start using uint32-sized typed arrays as we no
longer rely on TypedArray length to be a Smi.

Bug: v8:4153
Change-Id: If179541ad4f02c4ec7de9d1f3836138fe526d8a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1905847
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64897}
2019-11-11 21:42:56 +00:00
Sathya Gunasekaran
1a1a9cca42 [ic] Do string to array index conversion in element loads only
Instead of changing all of TryToName to do the conversion to array
index, this patch narrows this fast path just to the element load IC
handler.

This patch also restores the HeapNumber conversion in TryToIntPtr and
in Turbofan inlining as per the original state of things.

Bug: v8:9449, chromium:1016738, chromium:1016709
Change-Id: Ibf3a2c38637fc36e0ee037dc740f273848d1e8a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1902386
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64896}
2019-11-11 21:02:49 +00:00
Jakob Gruber
cebfde6769 [interpreter] Move function-entry stack check to start of bytecode array
The function-entry stack check should dominate all other
instructions in a function. Prior to this CL it was possible to create
paths not including a stack check due to SwitchOnGeneratorState: the
generator-creation branch had a stack check, while generator-resume
branches did not.

  0 : af fb 00 01       SwitchOnGeneratorState r0, [0], [1] { 0: @22 }
  4 : 27 fe fa          Mov <closure>, r1
  7 : 27 02 f9          Mov <this>, r2
 10 : 64 0a fa 02       InvokeIntrinsic [_CreateJSGeneratorObject], r1-r2
 14 : 26 fb             Star r0
 16 : a7                StackCheck
 17 : b0 fb fb 01 00    SuspendGenerator r0, r0-r0, [0]
 22 : b1 fb fb 01       ResumeGenerator r0, r0-r0
                        [... no stack check here ...]

This CL moves the stack check to the beginning of the bytecode array,
i.e. before SwitchOnGeneratorState.

Bug: chromium:1020031
Change-Id: I8ba8cba99611ddbe50c76023129d926cc84b1d5e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903440
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64888}
2019-11-11 15:00:09 +00:00
Santiago Aboy Solanes
421eaeefb9 [CSA][cleanup] TNodify builtins-string-gen
Bug: v8:9810
Change-Id: I915e0b1f903e8c5aa75280965819b2efb9fdc6dd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1906206
Reviewed-by: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64887}
2019-11-11 14:57:29 +00:00
Maya Lekova
db49e2238c [turbofan] Add serializer support for JSCreate
When the serializer encounters a JSConstruct, it now serializes the
initial map of the new_target to enable further opitmizations in
JSNativeContextSpecialization.

Add regression tests as well.

Bug: v8:7790
Change-Id: Ifab2b58c64a341744e833ed063e9695d74a5cdce
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900457
Commit-Queue: Maya Lekova <mslekova@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64886}
2019-11-11 14:43:59 +00:00
Santiago Aboy Solanes
6e90f2f292 [ptr-compr] Remove Compressed mentions from in the pipeline
Including but not limiting to removing:
 * BitcastCompressedXXX
 * CheckedCompressedXXX
 * ChangeXXXToCompressedYYY
 * ChangeCompressedXXX

As a note, ChangeTaggedToCompressed can't be removed just yet as it
is still in use.

Bug: v8:7703
Change-Id: I98cf88a32adfa976d419e69702d1cac4d3e811a5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903435
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64880}
2019-11-11 12:23:41 +00:00
Andreas Haas
dc1d0796d5 [turbofan] Optimize verification of switch nodes
I changed the verification algorithm of switch nodes from a quadratic
algorithm to a linear one. On my machine this speeds up the test from
17 seconds to 2 seconds in the x64.optdebug build.

R=mslekova@chromium.org

Bug: v8:9810
Change-Id: I952d3fcc641b4e269b8ebac8f65fe545c6062587
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1905768
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64877}
2019-11-11 11:06:31 +00:00
Tobias Tebbi
1b04772f7f [torque] weak pointer type Weak<T> + port CreateObjectWithoutProperties
Overview:
- Change basic type hierarchy to split Tagged into StrongTagged (= Object) and
  and WeakHeapObject. This enables to emit the right CSA types (Object, MaybeObject).
- The new Weak<T> type encodes a possibly cleared weak bit pattern that
  points to type T if it's not cleared.
- Make TNode<Object> a subtype of TNode<MaybeObject> so that the generated code
  compiles on the C++ side. Drive-by change: simplify a few CSA helpers by using
  MaybeObject as a common supertype of MaybeObject and Object.
- Port CreateObjectWithoutProperties and LoadMapPrototypeInfo.

Bug: v8:7793
Change-Id: I895a6501ce3e287ea8cf4065aaff3a5535245ab4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1889870
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Nico Hartmann <nicohartmann@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64876}
2019-11-11 11:04:46 +00:00
Ng Zhi An
43244a06c9 [wasm-simd] Implement remaining load_splat for x64
Implements v32x4.load_splat and v64x2.load_splat.

Bug: v8:9886
Change-Id: I18f3b012f9980d258985edf2ff26577fe495eff5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903747
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64866}
2019-11-08 18:07:33 +00:00
David Carlier
a494bcfc88 Introducing trap handler support for FreeBSD x64.
Using proper register (RIP) on this platform.

Change-Id: Iaa0a25e328bd82c152db0ef3632523fd7d621020
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1857221
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64863}
2019-11-08 16:46:05 +00:00
Clemens Backes
fa056cd088 [utils] Move {WhichPowerOf2} to base::bits
{WhichPowerOf2} is basically the same as {CountTrailingZeros}, with a
restriction to powers of two. Since it does not use or depend on any v8
internals, it can be moved to src/base/bits.h.
This CL also changes the implementation to use the CTZ builtin if
available, and falls back to popcnt otherwise.

Drive-by: Make it constexpr, and rename to {WhichPowerOfTwo}.

R=sigurds@chromium.org

Bug: v8:9810, v8:8912
Change-Id: I8368d098f9ab1247f3b9f036f1385a38de10cc6a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903966
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64851}
2019-11-08 09:45:50 +00:00
Clemens Backes
77a2b4c18b [wasm] Improve code size estimate for streaming
In streaming compilation, we were computing a way too low code size
estimate, since all {WasmFunction::code} fields were still zero when we
were calling {EstimateNativeModuleCodeSize}. This lead to many separate
code spaces being created during compilation, creating significant
performance and memory overhead.

This CL fixes this by passing the code section length when creating the
{NativeModule}. From this, we can compute the code size estimate just as
before.

Drive-by: Rename "functions_count" to "num_functions" in
{ProcessCodeSectionHeader} to be consistent with the declaration.

R=ahaas@chromium.org

Bug: v8:9950
Change-Id: I30a54c01ed24d0dfecb8a4b6d123015f1803ddeb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903439
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64849}
2019-11-08 08:28:11 +00:00
Ng Zhi An
5e514a9693 [wasm-simd] Implement i64x2 splat extract replace for arm
Bug: v8:9813
Change-Id: Ie99fdbf5307a1515a1838ac6902a5bcd99d11e14
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900660
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64846}
2019-11-07 21:28:39 +00:00
Clemens Backes
dde3166beb [wasm] Remove one {NewNativeModule} method
This makes the {code_size_estimate} computation explicit in the caller,
and removes one of the two {NewNativeModule} constructors. It turns out
that the calculation is totally off in the streaming calculation phase,
since no function bodies have been parsed yet. So all
{WasmFunction::code} fields are still empty, and we compute an estimate
that is way too low.
This CL prepares the actual fix for that (by computing a better estimate
at specific call sites).

R=ahaas@chromium.org

Bug: v8:9950
Change-Id: I68a891c97e5f65a9c7e73e21684bdfa7e261e216
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901273
Commit-Queue: Clemens Backes <clemensb@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64845}
2019-11-07 18:07:29 +00:00
Santiago Aboy Solanes
1bafcc6b99 [test] MultipleIsolates is only slow when not in pointer compression
Change-Id: Ia6b805c48f71cea7a0f0ada06c9a35713ed49f28
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903968
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64843}
2019-11-07 16:56:26 +00:00
Nico Hartmann
0fc1f3a9b7 Fixes argument CHECKs in serializer that are too strict
Bug: chromium:1021712
Change-Id: I9523760f2fa11726dd7015058b2267035f3f9f7a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903442
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64842}
2019-11-07 16:51:16 +00:00
Sigurd Schneider
0dfd9ea512 [coverage] Fix coverage with default arguments
In the presence of default arguments, the body of the function gets
wrapped into another block. This caused our trailing-range-after-return
optimization to not apply, because the wrapper block had no source
range assigned. This CL correctly assignes a source range to that block,
which allows already present code to handle it correctly.

Note that this is not a real coverage bug; we've just been reporting
whitespace as uncovered. We're fixing it for consistency.

Originally reported on github.com/bcoe/c8/issues/66

Bug: v8:9952
Change-Id: Iab3905f558eb99126e0dad8072d03d0a312fdcd3
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903430
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64836}
2019-11-07 12:34:35 +00:00
Santiago Aboy Solanes
07f26fc606 [ptr-compr] Remove the DecompressionElimination Reducer
Since the turbo_decompression_elimination flag is removed, there
are several methods in machine-type.h that get simplified, e.g
TypeCompressedTaggedPointer() can be replaced by just
"TaggedPointer()".

Also Removing the creation of Change to/from Compressed nodes.
Removing these Change nodes' logic is left to a follow-up CL.

Bug: v8:7703
Change-Id: Iff1f9aa8361189cf781a26317fd342b942fd5aa4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1897537
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64834}
2019-11-07 11:42:45 +00:00
Dominik Inführ
51dbe16ce0 Increase old space size for regress-678917.js
When --always-promote-young-mc is enabled, this test becomes more
flaky. Increase old space size, such that objects fit into the
old generation during mark-compact.

Bug: v8:9192
Change-Id: Iad3b914c7d5b7bafa752f3b6178684a137bd8dad
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1890101
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Dominik Inführ <dinfuehr@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64830}
2019-11-07 10:19:45 +00:00
Jakob Gruber
98b76b4607 Re-enable mjsunit/big-object-literal in non-debug builds
Runtime of this test has improved since we initially skipped it. Let's
attempt unskipping on all non-debug builds.

Bug: v8:8411
Change-Id: I5d409f7359532e3d7d18f5b0a77765165478d44a
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1903426
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64825}
2019-11-07 07:35:55 +00:00
Francis McCabe
7361981276 Mark try.js as a slow test in arm64 simulator
Bug:
Change-Id: I19a549f773d5a6ce9ffc5b869215e3bad9aebac6

Failing test: https://ci.chromium.org/p/v8/builders/ci/V8%20Linux64%20-%20arm64%20-%20sim%20-%20pointer%20compression/3128

Change-Id: I19a549f773d5a6ce9ffc5b869215e3bad9aebac6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1897248
Commit-Queue: Francis McCabe <fgm@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64822}
2019-11-06 21:59:13 +00:00
Ulan Degenbaev
b33a8508cc [heap]: Make addition of detached contexts robust for GC
The (age, context) pair has to be added atomically in to the weak
array of detached contexts. Otherwise, GC may happen after insertion
of age and observe inconsistent state.

Bug: chromium:1016703
Change-Id: Icb20bed4359904b2d976986a236558542e314bbf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1895573
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64820}
2019-11-06 17:59:21 +00:00
Ng Zhi An
465c97fe22 [wasm-simd] Implement load_splat and load_extend
Introduce new operator LoadTransform that holds a LoadTransformInfo param,
which describes the kind of load (normal, unaligned, protected), and a
transformation (splat or extend, signed or unsigned).

We have a new method that a full decoder needs to implement, LoadTransform,
which resuses the existing LoadType we have, but also takes a LoadTransform,
to distinguish between splats and extends at the decoder level.

This implements 4 out of the 10 suggested load splat/extend operations
(to keep the cl smaller), and is also missing interpreter support (will
be added in the future).



Change-Id: I1e65c693bfbe30e2a511c81b5a32e06aacbddc19
Bug: v8:9886
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1863863
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64819}
2019-11-06 17:42:22 +00:00
Sathya Gunasekaran
bebe6314b8 [test] Skip slow MultipleIsolates test on arm64
Change-Id: Idc0cd3a96ba329cf8175f22eea60b7614d73d929
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901272
Commit-Queue: Sathya Gunasekaran  <gsathya@chromium.org>
Reviewed-by: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64818}
2019-11-06 17:08:18 +00:00
Michael Starzinger
125f727c72 [wasm][test] Remove obsolete TODO from interpreter cctest.
The test coverage in question is by now provided by a different set of
mjsunit tests, namely the "mjsunit/wasm/anyref-globals-interpreter"
suite which run all globals tests in --wasm-interpret-all mode.

R=ahaas@chromium.org
TEST=cctest/test-run-wasm-interpreter/ReferenceTypeLocals

Change-Id: I439b1ee74da3c36995bb3d5819e35d4074400868
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901266
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64812}
2019-11-06 14:53:14 +00:00
Santiago Aboy Solanes
5f84573003 [ptr-compr] Add int comparison cases in DecompressionOptimizer
There is at least one case where a Load output flows into an
In32LessThanOrEqual node without any bitcasts or truncations in the
middle. We have to consider these cases in the reducer.

Bug: v8:7703
Change-Id: I1ed9c41e80c0603fd287d096c3050c5ae27c2b3e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879945
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64811}
2019-11-06 14:52:09 +00:00
Michael Starzinger
330445cee4 [test][x64] Test disassembly of indirect call again.
R=clemensb@chromium.org
TEST=cctest/test-disasm-x64/DisasmX64

Change-Id: I011d0d5e25c472c5a62ad73edd42165e55b34e2b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900460
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64809}
2019-11-06 14:38:41 +00:00
Igor Sheludko
94a8519a9a [tests] Skip tests that timeouts with --force-slow-path pt.2
No-Tree-Checks: true
No-Try: true
Change-Id: Ic756f1716a9667f10970e35992db5399ed54cacc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1901267
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64808}
2019-11-06 14:28:58 +00:00
Michael Starzinger
2679ebdc5f [wasm][test] Introduce separate test-api-wasm.cc file.
R=clemensb@chromium.org
TEST=cctest/test-api-wasm

Change-Id: I4f3c7e215304bd9b89bb7fd21cda06fa3a18abac
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900458
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64805}
2019-11-06 14:11:43 +00:00
Igor Sheludko
56dd1fec8b [tests] Skip tests that timeouts with --force-slow-path
No-Tree-Checks: true
No-Try: true
Change-Id: Ibf9af30908eac161827b77052582c5c8a86ce401
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1900463
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64803}
2019-11-06 14:02:33 +00:00
Santiago Aboy Solanes
c7a7ed22b3 [ptr-compr] Add Phi case in DecompressionOptimizer
Phis act as proxys: a phi's input has only 32 bits observed iff
the phi's output has only 32 bits observed. When the Tagged Phi
has only 32 bits observed, the Phi's MachineRepresentation
changes to the Compressed counterpart.

Also, update machine graph verifier so that Phis of Compressed
accept Tagged inputs as well.

Bug: v8:7703
Change-Id: I365d0b38f76edbaecbfea29f603abd2ce2224878
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879943
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64802}
2019-11-06 13:19:41 +00:00
Simon Zünd
702f2bad8b Connect REPL mode to the V8 inspector
There already exists a optional boolean flag 'replMode' for the
'Runtime.evaluate' command. This CL ferries the flag from the inspector
to DebugEvaluate::Global.

The existing DebugEvaluate::GlobalREPL is removed in favor of a
the REPLMOde enum to reduce code duplication.

Bug: chromium:1018158
Change-Id: Iafb43a3015b6876a02ac0db6cdfcac2cfa388862
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1881149
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64801}
2019-11-06 13:12:11 +00:00
Igor Sheludko
e309b2d995 [builtins] Port %TypedArray%.prototype.set to Torque
... in an uintptr friendly way.

Drive-by-fix:
1) IsForceSlowPath() check is integrated into Cast<FastJSArray>
2) disable tests incompatible with --force-slow-path in "slow_path" variant

Bug: v8:8906, v8:4153
Change-Id: I427f117073bc295120aa52fb3fe023ee04d58302
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1899988
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64799}
2019-11-06 12:51:21 +00:00
Victor Gomes
8534e52d41 [compiler] Fallback to slow path for any unexpected opcode in TryGetScopeInfo
The bug is due to an unexpected opcode. To avoid similar issues in the future, we fallback to CheckContextExtensionSlowPath. This was the default behaviour before the CL (https://chromium-review.googlesource.com/c/v8/v8/+/1876051).

Bug: chromium:1020983
Change-Id: Ia7f0f2986ec0008d1128ad3856efbb5d9e52dfc6
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1899989
Commit-Queue: Victor Gomes <victorgomes@chromium.org>
Auto-Submit: Victor Gomes <victorgomes@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64794}
2019-11-06 09:31:24 +00:00
Simon Zünd
fbcc2e874d Introduce REPL mode
Design doc: bit.ly/v8-repl-mode

This CL adds a new REPL mode that can be used via
DebugEvaluate::GlobalREPL. REPL mode only implements re-declaration
of 'let' bindings at the moment. Example:

REPL Input 1: let x = 21;
REPL Input 2: let x = 42;

This would normally throw a SyntaxError, but works in REPL mode.

The implementation is done by:
  - Setting a 'repl mode' bit on {Script}, {ScopeInfo}, {ParseInfo}
    and script {Scope}.
  - Each global let declaration still gets a slot reserved in the
    respective {ScriptContext}.
  - When a new REPL mode {ScriptContext} is created, name clashes
    for let bindings are not reported as errors.
  - Declarations, loads and stores for global let in REPL mode are
    now "load/store global" instead of accessing their respective
    context slot directly. This causes a lookup in the ScriptContextTable
    where the found slot for each name is guaranteed to be the same
    (the first one).

Bug: chromium:1004193, chromium:1018158
Change-Id: Ia6ab526b9f696400dbb8bfb611a4d43606119a47
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876061
Commit-Queue: Simon Zünd <szuend@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64793}
2019-11-06 09:17:04 +00:00
Joshua Litt
31813fbf61 Revert "[hole-check-elimination] Simplest possible hole check elimination"
This reverts commit 10883f561a.

Reason for revert: Causes bytecode mismatch

Bug:chromium:1020538, chromium:1021457

Original change's description:
> [hole-check-elimination] Simplest possible hole check elimination
>
> doc: https://docs.google.com/document/d/1Y9uF3hS2aUrwKU56vGxlvEs_IiGgmWSzau8097Y-XBM/edit
>
> Bug: v8:7427
> Change-Id: Iedd36c146cefff7e6687fdad48d263889c5c8347
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1778902
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Reviewed-by: Toon Verwaest <verwaest@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#63913}

TBR=rmcilroy@chromium.org,leszeks@chromium.org,verwaest@chromium.org,joshualitt@chromium.org

Bug: v8:7427
Change-Id: Ib4369a3560e929692585c4546435684deae5ee9b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1899163
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64789}
2019-11-05 22:22:54 +00:00
Ng Zhi An
b6edadc09b [wasm-simd] Implement f64x2 comparisons for arm
Bug: v8:9813
Change-Id: I716ed7c2802c38a4b4c8973db4e3bc50e16cec39
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1872930
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64788}
2019-11-05 22:05:54 +00:00
Ng Zhi An
92a5b3998d [wasm-simd] Implement i64x2 add sub mul for ia32
Bug: v8:9728
Change-Id: I6d8f096adc42a6d417f876d5805302b3bea3308b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1867381
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64787}
2019-11-05 22:01:54 +00:00
Joshua Litt
94890a0d46 [replaceAll] Implement String.prototype.replaceAll.
Implements TC39 String.prototype.replaceAll as a torque
builtin per the https://github.com/tc39/proposal-string-replaceall
proposal.

Note: matchAll changes were already added to V8 in https://chromium-review.googlesource.com/c/v8/v8/+/1846067

Bug: v8:9801
Change-Id: Ib8158eb39c854202d04710d6f9c33dcdd93fad93
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1877054
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64785}
2019-11-05 19:00:29 +00:00
Peter Kvitek
91c8be9599 [DevTools] Implemented DevTools protocol API to retrieve V8 RunTime Call Stats.
The new APIs are:
enableRuntimeCallStats
disableRuntimeCallStats
getRuntimeCallStats

The RunTime Call Stats are collected per isolate.

Change-Id: I7e520e2c866288aa9f9dc74f12572abedf0d3ac8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1881601
Commit-Queue: Peter Kvitek <kvitekp@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64784}
2019-11-05 18:59:24 +00:00
Eric Leese
5c23e6b5f2 V8 Wasm locations should always be based on byte offsets
Currently there are two ways wasm locations are represented in the
inspector. This remains unchanged for now. Also, currently there are
multiple ways location is represented within V8, with the line number
sometimes being a function index and sometimes being 0, and the column
number being a byte offset which is sometimes function relative and
sometimes module relative. With this change, the line number is never
used within V8 (it is always 0), and the column number is always a
byte offset from the beginning of the module. This simplifies
translation logic and keeps it in one place, and will simplify future
changes to wasm location representation in the inspector API.

Bug: chromium:1013527
Change-Id: I8813d47c881988f9ab49d7529fb81fe10dbbccff
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1886915
Commit-Queue: Eric Leese <leese@chromium.org>
Reviewed-by: Simon Zünd <szuend@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Clemens Backes <clemensb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64774}
2019-11-05 14:53:45 +00:00
Santiago Aboy Solanes
9716206049 [cleanup] Re-mark compiler/osr-big as SLOW for arm64 sim builds
Bug: v8:9937
Change-Id: Ia0ad5def3cf8e5b9209b546e1d3fb9213bbfa810
Fixed: v8:9937
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1899622
Auto-Submit: Santiago Aboy Solanes <solanes@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64771}
2019-11-05 14:03:50 +00:00
Pierre Langlois
d8dd3d65bc [cctest] Use 'strtoull' when decoding an address from the log.
We were using 'strtoll' which returns a signed integer, we should have used
'strtoull' instead.

Change-Id: Ie2e48ecc1fa58cff4b61fcea30087608769a80bb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893333
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#64765}
2019-11-05 12:46:39 +00:00
Stefano Sanfilippo
6c0825aaa7 [compiler, api] Allow modifying codegen hook to block non-strings.
Instead of inferring allow_codegen from the state of MaybeLocal<String>, return it separately. This allows to distinguish "could not stringify this object" from "block execution of this object", regardless of whether the object is a string or not. Currently, the hook can trigger an EvalError only if the original source was a string.

Modify the logic so that one of the three mechanisms (unconditional, non-modifying, modifying) decides alone. Before, if the non-modifying callback rejected a value, the value would be forwarded to the modifying callback, but the unconditional would not forward to the non-modifying callback. This introduces a more uniform behaviour where the three mechanisms act in decreasing priority.

Change-Id: Iaaa9873227052653d714df65f31c4de914f48b7d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1776082
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64763}
2019-11-05 11:49:19 +00:00
Joshua Litt
1a6ffffb30 Revert "Reland "[regexp] Clone match info for match indices.""
This reverts commit d4574d186f.

Reason for revert: In addition to the earlier octane regression, this cl also created a regression in desktop browsing

Bug: chromium:1019601

Original change's description:
> Reland "[regexp] Clone match info for match indices."
> 
> This reverts commit d7793c0684.
> 
> Reason for revert: This cl *will* cause regexp regressions. We are trying to gauge the real world impact.
> 
> Original change's description:
> > Revert "[regexp] Clone match info for match indices."
> >
> > This reverts commit dfd9ceb984.
> >
> > Reason for revert: Regressions https://chromeperf.appspot.com/group_report?rev=64356 https://crbug.com/1015749
> >
> > Original change's description:
> > > [regexp] Clone match info for match indices.
> > >
> > > The current behavior for generating match indices simply stashes a
> > > pointer to the match info and then constructs the indices lazily.
> > > However, it turns out the match info object used to create the result
> > > object is the regexp_last_match_info living on native context, and thus
> > > it can change between the creation of the result object and the generation
> > > of indices. This cl clones the match info which will be safer.
> > >
> > > Bug: v8:9548
> > > Change-Id: Ia6f26f88fbc22fd09671bf4c579d39a1510b552d
> > > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1864585
> > > Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> > > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > > Cr-Commit-Position: refs/heads/master@{#64356}
> >
> > TBR=jgruber@chromium.org,joshualitt@chromium.org
> >
> > # Not skipping CQ checks because original CL landed > 1 day ago.
> >
> > Bug: v8:9548, chromium:1015749
> > Change-Id: I9c30b8fb459cf2aa89d920bf061614441250844d
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1870236
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#64407}
> 
> TBR=jgruber@chromium.org,joshualitt@chromium.org
> 
> 
> Bug: v8:9548, chromium:1015749
> Change-Id: I151511307e3d8752fdbde4b8247514031b141b08
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1879587
> Reviewed-by: Joshua Litt <joshualitt@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Joshua Litt <joshualitt@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#64587}

TBR=jgruber@chromium.org,joshualitt@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:9548, chromium:1015749
Change-Id: Ie5a8e55338728aae33102d82e60a188f6440e8f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1898030
Reviewed-by: Joshua Litt <joshualitt@chromium.org>
Commit-Queue: Joshua Litt <joshualitt@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64749}
2019-11-04 18:32:16 +00:00
Santiago Aboy Solanes
b01d5be96f Re-marking two tests as SLOW
Bug: v8:6949
Change-Id: If147de926cdc0b03f1bba17974edfce21d7fb256
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1897887
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Santiago Aboy Solanes <solanes@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64747}
2019-11-04 17:22:17 +00:00
Nico Hartmann
ab9cd1ab6f Regression test for word64-lowered BigInt accumulator
This issue was fixed in https://chromium-review.googlesource.com/c/v8/v8/+/1873692

Bug: chromium:1016450
Change-Id: I56e1c504ae6876283568a88a9aa7d24af3ba6474
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1876057
Commit-Queue: Nico Hartmann <nicohartmann@chromium.org>
Auto-Submit: Nico Hartmann <nicohartmann@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#64738}
2019-11-04 14:04:22 +00:00
Milad Farazmand
0c3906f4dc Fix an error caused by a bug in Python < 2.7.9
There seems to be a bug in Python versions prior
to 2.7.9 where running exec could produce the following error:

SyntaxError: unqualified exec is not allowed in function
'_ParsePythonTestTemplates' it contains a nested function
with free variables (testcfg.py, line 71)

https://bugs.python.org/issue21591

It's causing an issue on all Ubuntu 14 and RHEL 7 machines.

The proposed change is an equivalent syntax which doesn't
produce an error:
https://docs.python.org/2/reference/simple_stmts.html#the-exec-statement


Change-Id: I159cc1be58ff375f313ae5c4fb814763704b880e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1893647
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#64736}
2019-11-04 13:42:10 +00:00