Commit Graph

40608 Commits

Author SHA1 Message Date
Toon Verwaest
cbaae3b6e0 [runtime] Use IsDecimalDigit in StringHasher rather than manual check
Bug: 
Change-Id: Ia347ed26ae93730a6bc58bcd6f5edb19b8ded5a9
Reviewed-on: https://chromium-review.googlesource.com/533413
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45916}
2017-06-13 15:45:59 +00:00
Ulan Degenbaev
7eaf3a01e0 [debugger] Abort incremental marking in debug::GetLoadedScripts.
The GC performed in GetLoadedScripts currently finalizes incremental
marking, which fails in some tests due to floating garbage.

BUG=chromium:694255

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ic1fdd2fb123c02ed7bea4c9fb53024574758b536
Reviewed-on: https://chromium-review.googlesource.com/533334
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45915}
2017-06-13 15:29:25 +00:00
hpayer
ded5a1933e [heap] Retire V8_MAX_SEMISPACE_SIZE compile time flag.
Use the flags to configure the maximum semi-space size instead.

BUG=

Review-Url: https://codereview.chromium.org/2941473003
Cr-Commit-Position: refs/heads/master@{#45914}
2017-06-13 15:28:33 +00:00
Ulan Degenbaev
eb6b3408dc [heap] TSAN annotation for mark-bits initialization.
This patch also fixes several cctests that require manual GC.

BUG=chromium:694255

Change-Id: Ida93ed2498a6c5b0187ee78d2b1da27d2ff1906a
Reviewed-on: https://chromium-review.googlesource.com/533233
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45913}
2017-06-13 15:17:45 +00:00
Andreas Haas
70c6830795 [wasm] Add a fuzzer for async compilation
The new fuzzer takes the fuzzer input as module bytes and compiles them
with WebAssembly asynchronous compilation.

R=mtrofin@chromium.org

Change-Id: I9740edec68e26c04d011d85c68521e340be13c4c
Reviewed-on: https://chromium-review.googlesource.com/506156
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45912}
2017-06-13 15:13:06 +00:00
martyn.capewell
849a08b871 [arm64] Fix pre-shifted immediate generation involving csp.
The function that generated a pre-shifted immediate didn't account for the
instruction with post-shift being unencodable. Fix this by passing
information about the target instruction, and use it to limit the application
of pre-shift.

BUG=chromium:725858

Change-Id: Ia0f70b2ea057975d90162aa6889f15b553acd321
Review-Url: https://codereview.chromium.org/2922173004
Cr-Commit-Position: refs/heads/master@{#45911}
2017-06-13 15:04:13 +00:00
Toon Verwaest
c878302006 [runtime] Devirtualize StringTableKey::HashField and HashTableKey::Hash
Bug: 
Change-Id: I1a7bd12b39678c926cc74729cc0005e01c487bd9
Reviewed-on: https://chromium-review.googlesource.com/532901
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45910}
2017-06-13 14:47:24 +00:00
Clemens Hammacher
51a48c8a87 [cleanup] Make V8_NORETURN use the [[noreturn]] annotation
Since we require C++11 support now, there is no need to use
__attribute__ or __declspec, all compilers should support the
[[noreturn]] attribute.

R=jarin@chromium.org
BUG=v8:6474

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I6c478c69658fd23c1c8ca468fbf3c6a36474ef66
Reviewed-on: https://chromium-review.googlesource.com/529072
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45909}
2017-06-13 14:27:56 +00:00
Andreas Haas
adad7e6ee6 [wasm] Remove the state from tasks of an AsyncCompileJob
There exists a hidden assumption in V8 that neither foreground nor
background tasks own any memory. For asynchronous WebAssembly
compilation this assumption was wrong, which causes crashes when V8 shut
down before the compilation finished.

With this CL I change the way asynchrous compilation happens. In the
existing implementation each compilation stage provided its own task
which could be spawned either in foreground or background. With this CL
each stage only provides a state, and a generic CompileTask executes on
that state. There exists exactly one state at a time.

To have exactly one state at a time I combined the stages
ExecuteCompilationUnits and FinishCompilationUnits to a single stage. In
addition I removed the WaitForBackgroundTasks stage and added a
CancelableTaskManager to the AsyncCompileJob instead to do the waiting.

BUG=v8:6436
R=clemensh@chromium.org, mtrofin@chromium.org

Change-Id: I2eb61f74235c65524ce720c474eaf99ae7472c81
Reviewed-on: https://chromium-review.googlesource.com/532993
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45908}
2017-06-13 14:26:51 +00:00
Sathya Gunasekaran
2c65b0be97 [Collections] Move size, clear, forEach to C++
Bug: v8:5717
Change-Id: I0e900b46a314a272206798aab8af5ccbb7f91fd3
Reviewed-on: https://chromium-review.googlesource.com/528315
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45907}
2017-06-13 14:10:03 +00:00
jarin
814d08a6af Move closing of generators upon final return to the generator-resume builtin.
Review-Url: https://codereview.chromium.org/2936813002
Cr-Commit-Position: refs/heads/master@{#45906}
2017-06-13 13:49:45 +00:00
Jochen Eisinger
322b2d7d14 Pass the string we're about to compile to embedder
This gives the embedder more context for deciding whether code
generation should be allowed or not, or they can chose to include the
code in a report.

BUG=chromium:732736
R=ahaas@chromium.org

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ibbaa3d0574319d290f15565be3eed2ee4d3dda36
Reviewed-on: https://chromium-review.googlesource.com/532875
Commit-Queue: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45905}
2017-06-13 13:39:27 +00:00
jgruber
935593d760 [cleanup] Refactor CodeStubArguments::GetOptionalArgumentValue uses
Use the simpler variant (that defaults to UndefinedConstant()) when
possible.

Bug: v8:6474
Change-Id: I46c6d5c2ffb98cb05f2db003d159dcd9113db085
Reviewed-on: https://chromium-review.googlesource.com/532977
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45904}
2017-06-13 13:35:58 +00:00
Leszek Swirski
58978da698 Revert "[compiler] Drive optimizations with feedback vector"
This reverts commit e39c9e020f.

Reason for revert: Breaks https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug/builds/15561

Original change's description:
> [compiler] Drive optimizations with feedback vector
> 
> For interpreted functions, use the optimized code slot in the feedback vector
> to store an optimization marker (optimize/in optimization queue) rather than
> changing the JSFunction's code object. Then, adapt the self-healing mechanism
> to also dispatch based on this optimization marker. Similarly, replace SFI
> marking with optimization marker checks in CompileLazy.
> 
> This allows JSFunctions to share optimization information (replacing shared
> function marking) without leaking this information across native contexts. Non
> I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
> generalises the old CompileOptimized/InOptimizationQueue builtins and also
> checks the same optimization marker as CompileLazy and
> InterpreterEntryTrampoline.
> 
> Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
> Reviewed-on: https://chromium-review.googlesource.com/509716
> Commit-Queue: Leszek Swirski <leszeks@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#45901}

TBR=rmcilroy@chromium.org,mstarzinger@chromium.org,leszeks@chromium.org
No-Presubmit: true
No-Tree-Checks: true
No-Try: true

Change-Id: Ib6c2b4d90fc5f659a6dcaf3fd30321507ca9cb94
Reviewed-on: https://chromium-review.googlesource.com/532916
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45903}
2017-06-13 13:24:20 +00:00
Toon Verwaest
9cae2e8c97 [runtime] Cache hash on HashTableKey and hash_field on StringTableKey
This CL
- removes InternalizeStringIfExists/LookupStringIfExists
- makes the distinction between hash_field and hash clear to AstRawString

Bug: 
Change-Id: Ia98c2236be4154a7db2741f2cf73681cfdcf03c7
Reviewed-on: https://chromium-review.googlesource.com/532954
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Marja Hölttä <marja@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45902}
2017-06-13 12:32:07 +00:00
Leszek Swirski
e39c9e020f [compiler] Drive optimizations with feedback vector
For interpreted functions, use the optimized code slot in the feedback vector
to store an optimization marker (optimize/in optimization queue) rather than
changing the JSFunction's code object. Then, adapt the self-healing mechanism
to also dispatch based on this optimization marker. Similarly, replace SFI
marking with optimization marker checks in CompileLazy.

This allows JSFunctions to share optimization information (replacing shared
function marking) without leaking this information across native contexts. Non
I+TF functions (asm.js or --no-turbo) use a CheckOptimizationMarker shim which
generalises the old CompileOptimized/InOptimizationQueue builtins and also
checks the same optimization marker as CompileLazy and
InterpreterEntryTrampoline.

Change-Id: I6826bdde7ab9a919cdb6b69bc0ebc6174bcb91ae
Reviewed-on: https://chromium-review.googlesource.com/509716
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45901}
2017-06-13 12:27:40 +00:00
Ivica Bogosavljevic
3929560b7e MIPS[64]: Skip built-ins/RegExp/property-escapes/generated/* due to timeout
These CL skips the tests the same way it is done on ARM.

Bug: 
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I03b5b6cb2c69a4838c649ce7beee6283f3324e6d
Reviewed-on: https://chromium-review.googlesource.com/532876
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#45900}
2017-06-13 12:09:53 +00:00
Michael Achenbach
795f753075 [release] Fix merge_to_branch regarding gerrit bug footer.
Also only use unique bug numbers in generated commit message.

NOTRY=true

Bug: v8:6482
Change-Id: Ie0d14640053bacb907d18e6ccb5b4d0b6ecbf661
Reviewed-on: https://chromium-review.googlesource.com/532914
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45899}
2017-06-13 10:55:05 +00:00
Alexey Kozyatinskiy
f52c8f9f28 [inspector] console.context should be ready for GC
context_name pointer can be changed after GC triggered by AddProperty.

R=ishell@chromium.org

Bug: chromium:732717
Change-Id: Ie8e2497fa9f3bac80e0ad68153956e382731e284
Reviewed-on: https://chromium-review.googlesource.com/532994
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45898}
2017-06-13 10:38:15 +00:00
Peter Marshall
5b427ad2d1 [builtins] Add a fast-path for Apply with double elements.
Double element types were much slower than Smi/Object previously.
We can box each double in a HeapNumber and push them into a new
FixedArray to save going into the runtime.

Bug: v8:4826, chromium:704966
Change-Id: I7f15d0d636a52760daefed722265c696c1ebb13e
Reviewed-on: https://chromium-review.googlesource.com/531004
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45897}
2017-06-13 10:24:35 +00:00
jgruber
b0c70d55c1 [string] Don't adapt arguments for split, substr & substring
Mechanical change to remove argument adaption (should be a tad faster
this way).

BUG=v8:6369

Change-Id: Ibc3dfa1161115e3feb5407615410c596698b5e44
Reviewed-on: https://chromium-review.googlesource.com/527440
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45896}
2017-06-13 10:07:44 +00:00
Ulan Degenbaev
9bdae1a13a [heap] Use atomic length accessors in body descriptors.
BUG=chromium:694255

Change-Id: I87bfe8eee853ece1260ffc34b61213720ef3e5fa
Reviewed-on: https://chromium-review.googlesource.com/531008
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45895}
2017-06-13 10:04:44 +00:00
Ulan Degenbaev
35391e4363 [heap] Refactor JSFunction body descriptor.
Since code flushing is gone, we treat the code entry as a strong field.

Change-Id: Idfcaf6fbfd84f7e4435b81d30a2a0e1be71ec89d
Reviewed-on: https://chromium-review.googlesource.com/531285
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45894}
2017-06-13 10:00:25 +00:00
Ulan Degenbaev
28810a2aa6 [heap] More cctest fixes for concurrent marker.
BUG=chromium:694255

Change-Id: Ia985a00fe2193bac96057994d93718224706ca04
Reviewed-on: https://chromium-review.googlesource.com/531168
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45893}
2017-06-13 09:55:17 +00:00
Leszek Swirski
09637ab3ce [runtime] Don't count profiler ticks on Code objects
With the deprecation of Crankshaft, it's no longer necessary for
FullCodeGen to keep track of its runtime profiler ticks on the code
object, and we can instead unify the behaviour of FCG and Ignition to
both increment the SFI counter instead.

Bug: v8:6408
Change-Id: Idcdd673aa39af06fe15a0fc14dfda2afafb5e417
Reviewed-on: https://chromium-review.googlesource.com/528117
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45892}
2017-06-13 09:54:13 +00:00
Toon Verwaest
522bc812db [runtime] Move virtual AsHandle from HashTableKey to StringTableKey
Bug: 
Change-Id: I9f0329b69693749c243c05b27c542c4ccdd71a11
Reviewed-on: https://chromium-review.googlesource.com/531244
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45891}
2017-06-13 09:33:07 +00:00
Michael Lippautz
1b4934b9ce Reland "[heap] Use partial free when shrinking instead of uncommitting"
This fixes the counter inconsistencies and makes use of the already existing
mechanism for partially releasing memory.

This reverts commit c8e6cdfdce.

Bug: chromium:724947
Change-Id: I2a7b52a28654fd2524df502a353997393d4f53ac
Reviewed-on: https://chromium-review.googlesource.com/530369
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45890}
2017-06-13 09:30:30 +00:00
Marja Hölttä
b490fd66b8 [objects.h splitting] Move argument-related classes.
This is an unexciting CL (doesn't make the build step situation any better)
but enables moving FixedArray & co next.

BUG=v8:5402,v8:6474

Change-Id: Ia36eb3973e6242f6f68e02b9f583dc552d48422f
Reviewed-on: https://chromium-review.googlesource.com/529168
Commit-Queue: Marja Hölttä <marja@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45889}
2017-06-13 09:06:00 +00:00
Clemens Hammacher
1597023859 [wasm] [cleanup] Remove origin test methods
This removes the {IsWasm} and {IsAsmJs} methods, which tested a
ModuleOrigin for a specific constant.
These methods do not comply with our naming conventions, and we don't
have such methods for other enums.

Drive-by: Refactor the code which used these methods for better
readability and maintainability.

R=ahaas@chromium.org, kschimpf@chromium.org
BUG=v8:6474

Change-Id: I98eb4dba5420eaa9452ae6f27598ec8b581a0984
Reviewed-on: https://chromium-review.googlesource.com/530229
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45888}
2017-06-13 08:28:42 +00:00
Michael Starzinger
9d23ec9f69 [turbofan] Remove deoptimization support from AstGraphBuilder.
The AST-based graph builder is by now only used for asm.js code. This
change hard-codes this assumption into the compilation pipeline and
hence allows us to remove support pertaining to deoptimization from
optimized code that was not derived from bytecode.

R=jarin@chromium.org
BUG=v8:6409

Change-Id: I1138f16f663db5b9ee34e3110184067b8fcffc8b
Reviewed-on: https://chromium-review.googlesource.com/531026
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45887}
2017-06-13 08:13:31 +00:00
addaleax
f14d1b6231 [api] Fix compilation error for UNIMPLEMENTED() method
Return `nullptr` from `ArrayBuffer::Allocator::Reserve` because
apparently not doing so results in compile errors for some people.

BUG=

Ref: https://github.com/nodejs/node/issues/13392
Review-Url: https://codereview.chromium.org/2929993003
Cr-Commit-Position: refs/heads/master@{#45886}
2017-06-13 08:04:42 +00:00
hpayer
91fb26ec83 [heap] Retire the twin brother of CollectGarbage.
BUG=

Review-Url: https://codereview.chromium.org/2936713002
Cr-Commit-Position: refs/heads/master@{#45885}
2017-06-13 07:54:55 +00:00
v8-autoroll
d7ad99ffdc Update V8 DEPS.
Rolling v8/build: bb21bc0..05cc70d

Rolling v8/third_party/android_tools: https://chromium.googlesource.com/android_tools/+log/cb6bc21..023e2f6

Rolling v8/third_party/catapult: 36e1cda..e6b02f2

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Change-Id: I2cfea0bc5a985014d488d1f32ddd68a5105a74b3
Reviewed-on: https://chromium-review.googlesource.com/532553
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45884}
2017-06-13 03:33:56 +00:00
jing.bao
f8df405cf3 [ia32] Add pextrb/pextrw, pinsrb, pshufb/pshuflw and AVX version
Also add vpinsrw

BUG=

Review-Url: https://codereview.chromium.org/2931333002
Cr-Commit-Position: refs/heads/master@{#45883}
2017-06-13 02:06:17 +00:00
Eric Holk
51acfb044f [wasm] Do not free externalized buffers when detaching
Once a buffer has been externalized, V8 is no longer responsible for managing
the memory. The fact that V8 was freeing was leading to double free errors once
Blink's GC got around to freeing the buffer too.

Bug: chromium:730171, chromium:731046
Change-Id: Ib18a7e37cafd51bce0c5a983d5cf8f3e64eb2c13
Reviewed-on: https://chromium-review.googlesource.com/530132
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45882}
2017-06-13 01:14:55 +00:00
Adam Klein
1c7e463962 [cleanup] Remove on-by-default --harmony-trailing-commas flag
This feature has been on by default without incident
since V8 5.8.

Bug: v8:5051
Change-Id: I1baf81922efd87e07448955147c50a5ba5a0aa42
Reviewed-on: https://chromium-review.googlesource.com/532214
Reviewed-by: Daniel Ehrenberg <littledan@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45881}
2017-06-13 00:09:23 +00:00
Mircea Trofin
b29bfffdf9 [wasm] Initialize parallel jobs with less memory.
Avoid constructing zones and large zone objects when initializing
WasmCompilationUnit. The main reason we did that is so we can cache
the CEntryStub node, which requires a code object, obtainable only
on the main thread. We need that value, however, on background threads,
which is also where we need the aforementioned large objects. We only
need that for the WasmCompilationUnits being currently compiled, which
is a number proportional to the number of background threads provided
by the embedder. Specifically, one zone is needed only for the duration
of the background compilation, while the second zone needs to survive 
past that, so the compilation results may be committed to the GC heap
as Code objects.

The problem with these large objects is that the first allocation
in a Zone is at minimum 8KB. We used to allocate 2 zones. For
modules with 200K functions, that means 3.2GB of memory pre-allocated
before any of it is actually needed.

This change attaches a Handle to the CEntryStub on the WasmCompilationUnits,
and delays zone creation to when needed. The change also adds a way to 
cache CEntryStubs in a JSGraph from a given Code handle - limited to the
scenario needed by wasm (and removable once we get wasm off the GC heap,
which subsumes removing this dependency on CEntryStubs)

An additional constraint for this change is that we want it to be easily 
back-mergeable to address chromium:723899.

For the wasm payload in question, collecting the max memory used by d8
using /usr/bin/time --format='(%Xtext+%Ddata %Mmax)', we get the 
following numbers (in KB):

- unchanged: 3307480
- patch 1: 1807140 (45% reduction)
- patch 3: 1230320 (62% reduction from first)
- patch 5/6: 519368 (84% reduction from first)

Bug: chomium:732010, chromium:723899
Change-Id: I45b96792daf8a9c8dc47d45fb52da75945a41401
Reviewed-on: https://chromium-review.googlesource.com/530193
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45880}
2017-06-12 18:29:36 +00:00
Adam Klein
57f0ca07da [parser|cleanup] Remove Variable* accessors from FunctionState
These accessors are only called from the Parser, never ParserBase, so
there's no need to expose them in parser-base.h. Instead, access them
through FunctionState::scope().

This also allows removal of the Types::Variable typedefs.

Bug: v8:6460
Change-Id: I01186c53d3cc2a2737f3c07169fdd122dff5b174
Reviewed-on: https://chromium-review.googlesource.com/530034
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45879}
2017-06-12 17:55:01 +00:00
scottmg
2094202be2 Fuchsia: implement OS::Allocate
Fix v8 link errors (in component_build=true)
https://build.chromium.org/p/chromium.fyi/builders/Fuchsia%20(dbg)

BUG=chromium:731217

Review-Url: https://codereview.chromium.org/2930343002
Cr-Commit-Position: refs/heads/master@{#45878}
2017-06-12 17:50:06 +00:00
Jaideep Bajwa
dbe87c6632 PPC: [runtime] Cleanup SharedFunctionInfo fields definitions (5).
Minor fix to original CL https://chromium-review.googlesource.com/528120

R=joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: If94e74e9ce97dfbddd578a60d1cfce1fe2b9265d
Reviewed-on: https://chromium-review.googlesource.com/531524
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Commit-Queue: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#45877}
2017-06-12 17:48:40 +00:00
Ulan Degenbaev
d906f81502 [heap] Fix a map creation data race with concurrent marking.
The race happens when an object transitions to a newly created map.
The map initializing stores can be reordered after object->set_map(map),
which will cause the concurrent marker to observe inconsistent map.

The fix is to use store-release when setting the map pointer and
acquire-load when reading the map in the concurrent marker.

BUG=chromium:694255

Change-Id: I4fd6bc27dd70ff1a30f56a4cec13310ccdd627c8
Reviewed-on: https://chromium-review.googlesource.com/528118
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45876}
2017-06-12 17:32:58 +00:00
hpayer
0aa78b9e5b [heap] Schedule idle embedder garbage collection when starting incremental marking from idle task.
BUG=chromium:728228

Review-Url: https://codereview.chromium.org/2930333002
Cr-Commit-Position: refs/heads/master@{#45875}
2017-06-12 17:05:33 +00:00
Michael Lippautz
6713a76b06 [cctest] Fix SetJitCodeEventHandler
- Remove commented out line
- Simulate full space properly, independently of flags set

Bug: 
Change-Id: I6013caae43eb40dd568fbd872eb0ee78288c61bf
Reviewed-on: https://chromium-review.googlesource.com/531084
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45874}
2017-06-12 17:04:39 +00:00
Toon Verwaest
dda2b5b1ec [runtime] Devirtualize CompilationCacheKey::HashForObject
Distinguish the compilation caches instead by the shape of the key (cow fixed
array map meaning eval or script cache). This allows us to remove the odd "key"
argument from Shrink, EnsureCapacity and Rehash.

Bug: v8:6474
Change-Id: Ibcad22813063c3a9050da13dc51359f5b59e1254
Reviewed-on: https://chromium-review.googlesource.com/531184
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45873}
2017-06-12 17:00:52 +00:00
Sathya Gunasekaran
49ecce8ad6 [collections] Port AllocateOrderedHashTable to CSA
Bug: v8:5717, v8:6354
Change-Id: I4ae2a0b629ca8fe03fb8f645aa5f22cf7f2e4a20
Reviewed-on: https://chromium-review.googlesource.com/515024
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45872}
2017-06-12 16:53:55 +00:00
Igor Sheludko
ec69ad7262 [builtins] Simplify FastNewClosure builtin.
... by reading the |map_index| value from the SharedFunctionInfo's
|compiler_hints| field directly.

Bug: v8:6459
Change-Id: I32c4c903b16fa9f7e7da755667dadef7fadfc5e0
Reviewed-on: https://chromium-review.googlesource.com/531024
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45871}
2017-06-12 16:44:35 +00:00
Michael Starzinger
b17dee636f [deoptimizer] Handle Generator object in-object properties.
This adds missing support for in-object properties within objects having
the {JSGeneratorObject} type to materialization during deoptimization.
For corner-cases where the implicit generator object is statically known
not to escape, object layout might still be arbitrarily complex.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-732169
BUG=chromium:732169,v8:6481

Change-Id: I32f373913d60af64981dc4ed66873cc8a1dbe872
Reviewed-on: https://chromium-review.googlesource.com/530230
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45870}
2017-06-12 16:27:10 +00:00
Igor Sheludko
66c39dea4e [runtime] Cleanup SharedFunctionInfo fields definitions (8).
Reshuffle |compiler_hints| bits to allow using smaller mask constants
when generating code that checks if certain bit is set.

Bug: v8:6470
Change-Id: I4c5de882405a575200a49355065dc5909ad88f58
Reviewed-on: https://chromium-review.googlesource.com/530309
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45869}
2017-06-12 16:13:49 +00:00
Ulan Degenbaev
711073a340 [heap] Add memory fence after mark-bit range update operations.
The fence ensures that the concurrent marker observes consistent state
of mark-bits for newly allocated objects.

The patch also moves Bitmap functions to cc file and removes non-atomic
versions of SetRange and ClearRange.

BUG=chromium:694255

Change-Id: I466bef654f3d4a21b7aaebdfd6d5a39ddb5f2a0a
Reviewed-on: https://chromium-review.googlesource.com/530367
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45868}
2017-06-12 16:11:19 +00:00
Igor Sheludko
1ae0e66312 [runtime] Cleanup SharedFunctionInfo fields definitions (7).
Use new macros for defining bit fields.

Bug: v8:6470
Change-Id: Ie580ba7fc64f9958a3d4586d54d67e5dc66f1b53
Reviewed-on: https://chromium-review.googlesource.com/529824
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#45867}
2017-06-12 16:04:48 +00:00