Commit Graph

42142 Commits

Author SHA1 Message Date
Camillo Bruni
dbaafb76c7 [literals] No longer use a FeedbackVectorSlot for the empty object literal
Bug: v8:6211
Change-Id: I0f15c59b7b786ab327e4ab548523095dd85ba83e
Reviewed-on: https://chromium-review.googlesource.com/637835
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47650}
2017-08-28 16:08:38 +00:00
Yang Guo
8fb5000e86 [snapshot] improve API references.
We now only require API references to be provided when we
actually deserialize them. Also changed the internal implementation
to avoid copying API references into V8.

R=petermarshall@chromium.org

Bug: v8:6448
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iddb0465ff6e95020006d41b5e87614dce8f0140b
Reviewed-on: https://chromium-review.googlesource.com/632098
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47649}
2017-08-28 15:37:58 +00:00
Michael Hablich
a588411e96 Revert "[snapshot] Move builtins to dedicated snapshot area"
This reverts commit 49e3bfd572.

Reason for revert: Primary suspect for blocked roll: 759552

Original change's description:
> [snapshot] Move builtins to dedicated snapshot area
> 
> As a first step towards lazy builtin deserialization, this CL moves
> builtins to their own dedicated area in the snapshot blob, physically
> located after startup data and before context-specific data.
> 
> The startup- and partial serializers now serialize all seen builtins as
> references, i.e. they only encode the relevant builtin id (taking care
> to preserve special behavior around the interpreter trampoline and
> CompileLazy). Builtins are later fully serialized by the
> BuiltinSerializer. The separate blobs are finally glued together by
> CreateSnapshotBlob.
> 
> Deserialization takes the same steps: when we see builtin reference
> bytecodes before builtins have been deserialized, we push to a list of
> deferred builtin references. After builtin deserialization, this list is
> iterated and all builtin references are fixed up.
> 
> Bug: v8:6624
> Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
> Change-Id: Idee42fa9c92bdbe8d5b8c4b8bf3ca9dd39634004
> Reviewed-on: https://chromium-review.googlesource.com/610225
> Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47596}

TBR=yangguo@chromium.org,mlippautz@chromium.org,jgruber@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: v8:6624
Change-Id: I9906c9ea15a623226b890f63bc65876a6f5203f8
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/638331
Reviewed-by: Michael Hablich <hablich@chromium.org>
Commit-Queue: Michael Hablich <hablich@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47648}
2017-08-28 15:26:08 +00:00
Michael Lippautz
b014f6300c [heap] Scavenger: Sweep already-locked page first avoiding deadlocks
The deadlock can happen when we lock a page for processing old to new
references as part of the scavenger while at the same time trying to
lazily sweep another page for retrieving memory. If two tasks decide to
sweep each others pages they will deadlock.

Bug: v8:6754
Change-Id: Ic9fae0eafa5b5a5cb5eaa1c0aac61de24d1b9486
Reviewed-on: https://chromium-review.googlesource.com/636371
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47647}
2017-08-28 15:12:39 +00:00
Michael Starzinger
89f839e5d0 [asm.js] Correctly set minimum memory size to zero.
This makes sure the minimum memory size for WebAssembly modules derived
from asm.js is set to zero. It allows instatiation without allocating an
underlying memory, when such memory is unused. It also fixes a bug in
patching of embedded memory sizes for asm.js modules.

R=ahaas@chromium.org
TEST=mjsunit/regress/regress-crbug-759327
BUG=chromium:759327

Change-Id: If5a965b96a03cbb5ba15bc41fbaf359f74961f41
Reviewed-on: https://chromium-review.googlesource.com/637912
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47646}
2017-08-28 15:01:30 +00:00
Michael Lippautz
539900374a [heap] Use std::vector for storing AllocationObserver
Bug: v8:6333
Change-Id: Ic47c1f60d32b9dabfcbe85f5b6e2586dd7e1fd11
Reviewed-on: https://chromium-review.googlesource.com/637995
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47645}
2017-08-28 13:52:03 +00:00
Michael Lippautz
bc13af929f [heap] LargeObjectSpace: Move chunk map from HashMap to unordered_map
Bug: 
Change-Id: Ied0ef1fc7fbcd9f58d793b9b2ecd87ae6c549dca
Reviewed-on: https://chromium-review.googlesource.com/635590
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47644}
2017-08-28 12:56:12 +00:00
Michael Starzinger
a33b0d2509 [objects] Remove dangerous arguments accessors.
This removes dangerous accessors method from the arguments object
accessor classes. The shape of an arguments object might transition,
turning the fields into dictionary mode, making the accessors invalid.

It also fixes a bug in the reported number of embedder fields on the
arguments object.

R=ishell@chromium.org
TEST=cctest/test-api/InternalFieldsOfRegularObjects

Change-Id: Ib7a73608c6236fe8864434e0cfdcb754ae012a75
Reviewed-on: https://chromium-review.googlesource.com/636368
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47643}
2017-08-28 12:19:11 +00:00
Georg Neis
b4712d52ea Revert "Remove obsolete kNumber binop feedback."
This reverts commit 1169f55bbc.

Reason for revert: http://crbug.com/758994

Original change's description:
> Remove obsolete kNumber binop feedback.
> 
> With the removal of Crankshaft, kNumber has become obsolete as
> BinaryOperationFeedback. Turbofan uses kNumberOrOddball.
> 
> Bug: 
> Change-Id: If577f5efcc81d7c08f43908f2764ff0ec6f8747c
> Reviewed-on: https://chromium-review.googlesource.com/628376
> Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
> Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47555}

TBR=jkummerow@chromium.org,jarin@chromium.org,neis@chromium.org,mythria@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I1b33f572f3e6865e00d2468bffcce2ea466814b3
Reviewed-on: https://chromium-review.googlesource.com/637711
Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47642}
2017-08-28 12:12:11 +00:00
Choongwoo Han
c65792128c [wasm] get length at the right time Table.p.grow
Get the old table size after converting integer of 'delta' argument.
Converting integer of the argument can execute another javascript code,
and the code can trigger mismatching between table sizes of instance and
table object, which causes redundant memory allocation.

http://webassembly.org/docs/js/#webassemblytableprototypegrow

Bug: chromium:752423
Change-Id: If9a576d20625d0c39342ea5de114e9fc9f230125
Reviewed-on: https://chromium-review.googlesource.com/627248
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47641}
2017-08-28 11:27:46 +00:00
Jaroslav Sevcik
0fd8c41847 [turbofan] Introduce SpeculativeSafeInteger(Add|Subtract) operators.
This is just a refactoring in preparation for typing the speculative
integer operation as safe integers.

Bug: v8:5267
Change-Id: I56da91a72655a0733b2cf04afcf33cb1d2aa1415
Reviewed-on: https://chromium-review.googlesource.com/637830
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47640}
2017-08-28 11:06:16 +00:00
Jakob Gruber
3168a963ff Revert "[csa] Refactor large-object handling in string allocation"
This reverts commit f6d735095f.

Reason for revert: Perf regressions https://crbug.com/758126

Original change's description:
> [csa] Refactor large-object handling in string allocation
> 
> CSA::AllocateSeq{One,Two}ByteString used its own home-grown handling to
> allocate very large strings. This CL refactors both methods to use
> AllocationFlags::kAllowLargeObjectAllocation instead. Callers now need
> to specify explicitly if large-object allocation is possible or not.
> 
> Bug: chromium:636391
> Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
> Change-Id: I0b7ffb0b083f4e977cea42c500f8f2ee1c60519f
> Reviewed-on: https://chromium-review.googlesource.com/625738
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47504}

TBR=cbruni@chromium.org,jgruber@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:636391
Change-Id: Iab88ce400f489a677df821d4053bd3678289ae2e
Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/637392
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47639}
2017-08-28 11:02:27 +00:00
Sergei D
837b801666 Export default implementation of getting wall-clock time.
Derived projects need easy access to the original V8's implementation of
time to implement Platform interface.

Bug: chromium:751993
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I97ee77929fda5930e7d75ca8609797673485cec3
Reviewed-on: https://chromium-review.googlesource.com/636884
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Sergei Datsenko <dats@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47638}
2017-08-28 09:28:23 +00:00
Ulan Degenbaev
5bd5fd45c2 [heap] Disable concurrent marking on GYP builds.
Bug: chromium:694255
Change-Id: I58be876aa6db2e528f7d2e045e042657354575c7
Reviewed-on: https://chromium-review.googlesource.com/637393
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47637}
2017-08-28 09:14:32 +00:00
jgruber
4735f85f7c [regexp] Shortcut case-folding of entire non-bmp range
When the range of all non-bmp characters is passed to
AddUnicodeCaseEquivalents, icu::UnicodeSet::closeOver dutifully tries to
case-fold every single character in that range. Since we already know
this to be a nop, we can simply return instead.

This improves compilation time of /ui regexps by around 100x.

Bug: v8:6727
Change-Id: I79d73c77d6a54cbb5ad2cad0355214ed712b59b9
Reviewed-on: https://chromium-review.googlesource.com/635303
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47636}
2017-08-28 08:54:08 +00:00
Benedikt Meurer
8f1a92ce71 [turbofan] Introduce a dedicated CompareMaps operator.
Instead of introducing a lot of explicit branching in the
JSNativeContextSpecialization for polymorphic property accesses
that cannot be folded into a single LoadField/StoreField, and which
are mostly invisible and not optimizable for later passes, we now
have a single CompareMaps operator that takes a set of maps (like the
CheckMaps operator) and produces a boolean indicating the result of
the comparison.

R=jarin@chromium.org

Bug: v8:6761
Change-Id: Iee8788e915b762d542acb54feb9931346e442dc0
Reviewed-on: https://chromium-review.googlesource.com/636365
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47635}
2017-08-28 08:44:28 +00:00
jgruber
3dbc04f72f [regexp] Propagate exception to TryCatch in fuzzer
TryCatch only clears the pending exception if it has been propagated
through OptionalRescheduleException. This is another tentative fix for
https://crbug.com/754422.

Bug: chromium:754422
Change-Id: Ifbbeed8ef44131a0a010ac6bde3adbbf9fb4c4af
Reviewed-on: https://chromium-review.googlesource.com/637305
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47634}
2017-08-28 08:15:07 +00:00
Benedikt Meurer
9be4b61007 [cleanup] Make StringLengthProtector into a Cell.
There's no need to have the StringLengthProtector as a PropertyCell,
since it's only used to guard against deoptimization loops. This also
allows us to remove the use of the CompilationDependencies from the
JSTypedLowering.

R=jarin@chromium.org

Bug: v8:6759
Change-Id: I54a37be6b8064ca3475e3b321f928b6a9903f209
Tbr: mstarzinger@chromium.org
Reviewed-on: https://chromium-review.googlesource.com/637303
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47633}
2017-08-28 06:26:17 +00:00
Benedikt Meurer
06753c64eb [turbofan] Optimize O.p.hasOwnProperty inside for-in.
Optimize the common pattern

  for (var i in o) {
    if (Object.prototype.hasOwnProperty.call(o, i)) {
      // do something
    }
  }

which is part of the guard-for-in style in ESLint (see the documentation
at https://eslint.org/docs/rules/guard-for-in for details). This pattern
also shows up in React and Ember applications quite a lot (and is tested
by the appropriate Speedometer benchmarks, although not dominating those
benchmarks, since they spent a lot of time in non-TurboFan'ed code).

This improves the forInHasOwnProperty and forInHasOwnPropertySafe micro-
benchmarks in v8:6702, which look like this

  function forInHasOwnProperty(o) {
    var result = 0;
    for (var i in o) {
      if (o.hasOwnProperty(i)) {
        result += 1;
      }
    }
    return result;
  }

  function forInHasOwnPropertySafe(o) {
    var result = 0;
    for (var i in o) {
      if (Object.prototype.hasOwnProperty.call(o, i)) {
        result += 1;
      }
    }
    return result;
  }

by around 4x and allows for additional optimizations in the future, by
also elimiating the megamorphic load when accessing the enumerated
properties.

This changes the interpreter ForInNext bytecode to collect more precise
feedback about the for-in state, which now consists of three individual
states: UNINITIALIZED, MEGAMORPHIC and GENERIC. The MEGAMORPHIC state
means that the ForInNext has only seen objects with a usable enum cache
thus far, whereas GENERIC means that we have seen some slow-mode for..in
objects as well.

R=jarin@chromium.org

Bug: v8:6702
Change-Id: Ibcd75ea9b58c3b4f9219f11bc37eb04a2b985604
Reviewed-on: https://chromium-review.googlesource.com/636964
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47632}
2017-08-28 06:00:47 +00:00
Alexei Filippov
d176882326 Revert "[runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave"
This reverts commit 9b15760286.

Reason for revert:
Seems to be the cause of 100% crashes of runtime-call-stats layout_test on Windows. https://build.chromium.org/p/chromium.webkit/builders/WebKit%20Win7/builds/54947

Original change's description:
> [runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave
> 
> There must be a matching Leave for each Enter. Otherwise it ends up
> with a dead stack-allocated object in the timer chain.
> 
> Drive-by: There was also a bug in
> RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* ...) did create a
> local object instead of calling an overloaded constructor.
> 
> BUG=chromium:669329
> 
> Change-Id: I9aa1c574a854af8beab3d8097efab3a726ad1c8d
> Reviewed-on: https://chromium-review.googlesource.com/634511
> Commit-Queue: Alexei Filippov <alph@chromium.org>
> Reviewed-by: Camillo Bruni <cbruni@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47613}

TBR=rmcilroy@chromium.org,alph@chromium.org,cbruni@chromium.org,rmcilroy@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:669329
Change-Id: I57b4fcd2e7bf92a68824d2ac5f40cc74deee0b25
Reviewed-on: https://chromium-review.googlesource.com/636762
Reviewed-by: Alexei Filippov <alph@chromium.org>
Commit-Queue: Alexei Filippov <alph@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47631}
2017-08-28 05:53:02 +00:00
v8-autoroll
7e11781bdd Update V8 DEPS.
Rolling v8/build: 8e7ce53..2887ee5

Rolling v8/third_party/catapult: 123b9d8..68a8df6

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I4cf915cd7b117abab676e263f8f4e69857ca3b55
Reviewed-on: https://chromium-review.googlesource.com/636279
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47630}
2017-08-28 03:51:03 +00:00
Yang Guo
6cd99b38b9 [coverage] clear call counts for precise coverage.
This is so that precise coverage starts with a clean slate.
The old behavior can be emulated by calling getBestEffortCoverage
before starting precise coverage.

R=jgruber@chromium.org

Bug: chromium:757998
Change-Id: Ib3ee2316966f676456198159bdcf8ba8b9d3896f
Reviewed-on: https://chromium-review.googlesource.com/635084
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47629}
2017-08-28 03:49:59 +00:00
Sathya Gunasekaran
e2ebb2be1c [promises] Reduce size of JSPromise by 1 word
Instead of using a word to store the status of the promise, this
patch uses 2 bit on flags.

Bug: v8:5046
Change-Id: Ic651338230dbe1704c68de8652676f236a3298f0
Reviewed-on: https://chromium-review.googlesource.com/634623
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47628}
2017-08-28 03:48:53 +00:00
v8-autoroll
70881da0b0 Update V8 DEPS.
Rolling v8/build: a2b7113..8e7ce53

Rolling v8/third_party/catapult: e37aa9d..123b9d8

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: Ie53cd86e6b8aed971b8a67bb1ee2f4cb881c8623
Reviewed-on: https://chromium-review.googlesource.com/636266
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47627}
2017-08-26 03:59:42 +00:00
Alexey Kozyatinskiy
b61a729fd1 [inspector] added missing tryCatch in InjectedScript::create
R=dgozman@chromium.org

Bug: chromium:752019
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I1a64a26e5e5d44757edd5b887d140b6b855cecab
Reviewed-on: https://chromium-review.googlesource.com/636300
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47626}
2017-08-26 01:35:42 +00:00
Jakob Kummerow
24b88776aa [modules] Speed up access to module exports
By adding LoadIC support for JSModuleNamespace objects. The index
of the corresponding slot in the Module's "exports" dictionary is
cached in the feedback vector, so the value can be loaded directly,
without having to call the C++ accessor.
This speeds up the "foo" property access in code like the following
snippet by about 10x:
  import * as m from "module.js"
  m.foo;

Bug: v8:1569
Change-Id: I152abedcbdc6f90b5bedd203cfdf97ed88d1137c
Reviewed-on: https://chromium-review.googlesource.com/631136
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47625}
2017-08-26 00:58:02 +00:00
Andrey Lushnikov
109e8b98f5 Inspector: support simple objects for Runtime.callFunctionOn arguments
This patch adds objects support for Runtime.callFunctionOn arguments.

R=kozy

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I9e9ad000482aa556f10a632b89c2f91fdc21ff1e
Reviewed-on: https://chromium-review.googlesource.com/636353
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Commit-Queue: Andrey Lushnikov <lushnikov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47624}
2017-08-25 23:59:11 +00:00
Alexey Kozyatinskiy
0bdc7bbabc [inspector] improved injected-script-source
setupInjectedScriptEnvironment should check array getters/setters as well.

R=dgozman@chromium.org

Bug: none
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: I72b03f62980e339d83bcfda55f1d35135b23da3b
Reviewed-on: https://chromium-review.googlesource.com/636469
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47623}
2017-08-25 23:43:42 +00:00
Erik Luo
8aed7767d6 [inspector] send internal properties first, remove unnecessary props
Currently, injected script source adds natural object properties before
internal properties. This can result in important ones such as
"[[PrimitiveValue]]" being left out. This CL
- makes sure internal properties are always added to preview
- removes unused "[[Iterator*]]" properties from preview
- boxed strings (e.g. new String("foo")) will not send unnecessary
properties 0:"f", 1:"o", 2:"o" if the [[PrimitiveValue]] is sent.

Bug: chromium:567265
Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Icd5c7410351f371055277ce471226cc6fb5a861f
Reviewed-on: https://chromium-review.googlesource.com/634584
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Erik Luo <luoe@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47622}
2017-08-25 23:12:22 +00:00
Andrey Lushnikov
7bf549a44b Inspector: re-write the test to be modern
This patch re-writes the call-function-on-async.js test according
to the new style.

R=kozy

Change-Id: I0541d336fe2bba3197170b0cc22c70e96d8543aa
Reviewed-on: https://chromium-review.googlesource.com/636691
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Andrey Lushnikov <lushnikov@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47621}
2017-08-25 23:01:22 +00:00
Deepti Gandluri
9c0f98c6a4 [wasm] Implement atomics Exchange, CompareExchange
BUG=v8:6532

R=binji@chromium.org, bradnelson@chromium.org

Change-Id: I376dd8e4d27cac657d5a7c05a50a0477963da7b7
Reviewed-on: https://chromium-review.googlesource.com/627476
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47620}
2017-08-25 22:09:01 +00:00
Mircea Trofin
2809fdbdd1 [wasm] separate code table from export wrappers
We're moving the code table off the heap, while the export wrappers
are instance-specific, and, thus, won't move off the heap.

Bug: 
Change-Id: I392fb537c7708a0a06f3468f714335df29bc401b
Reviewed-on: https://chromium-review.googlesource.com/636309
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Commit-Queue: Mircea Trofin <mtrofin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47619}
2017-08-25 21:41:41 +00:00
Adam Klein
0f0e274b1b [js-perf-tests] Bring basic-import and basic-export in line with basic-namespace
All microbenchmarks now add 20 variables together per iteration, rather than
just a single variable.

Also re-add a sanity check after the loop, and fix a missing variable add (a15)
from the loop.

Bug: v8:1569
Change-Id: Ie54357b5cedaafd85f01c699c08b24a5ee6468c9
Reviewed-on: https://chromium-review.googlesource.com/636284
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47618}
2017-08-25 21:38:22 +00:00
Ross McIlroy
51a1514016 [Interpreter] Adapt Call bytecode handlers to drop their stack-frame.
This change adapts the Call bytecode handlers such that they don't require
a stack frame. It does this by modifying the call bytecode handler to
tail-call the Call or InterpreterPushArgsAndCall builtins. As a result, the
callee function will return to the InterpreterEntryTrampoline when it returns
(since this is the return address on the interpreter frame), which is
adapted to dispatch to the next bytecode handler. The return bytecode
handler is modified to tail-call a new InterpreterExitTramoline instead
of returning to the InterpreterEntryTrampoline.

Overall this significanlty reduces the amount of stack space required for
interpreter frames, increasing the maximum depth of recursive calls from
around 6000 to around 12,500 on x64.

BUG=chromium:753705

Change-Id: I23328e4cef878df3aca4db763b47d72a2cce664c
Reviewed-on: https://chromium-review.googlesource.com/634364
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47617}
2017-08-25 21:32:09 +00:00
Jaideep Bajwa
c67cb26555 [wasm] fix SimdLoadStoreLoad on big endian
WasmGraphBuilder::StoreMem is called with the last argument
as default with machine rep = kNode, which causes
BuildChangeEndiannessStore(val, memtype, type) to fail.

R=gdeepti@google.com, binji@chromium.org, jyan@ca.ibm.com
BUG=v8:6752
LOG=N

Change-Id: I0633982ff4b5a93551b4765ca8df50073010f3ca
Reviewed-on: https://chromium-review.googlesource.com/633755
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#47616}
2017-08-25 19:16:37 +00:00
Caitlin Potter
cb387bc121 [parser] parse MemberExpression continuation after new.target
Keep parsing the rest of the MemberExpression after `new.target`

BUG=v8:6745
R=marja@chromium.org, adamk@chromium.org

Change-Id: I53cc370766e72ed9e36c5c7aa150a3ad9a6062f8
Reviewed-on: https://chromium-review.googlesource.com/627756
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Caitlin Potter <caitp@igalia.com>
Cr-Commit-Position: refs/heads/master@{#47615}
2017-08-25 18:37:37 +00:00
Adam Klein
d0d84a5f3b Change default bug component for src/parsing/ to Blink>JavaScript>Parser
Change-Id: Ic3812d16a4e8449ac9619981719e997c90300ee7
Reviewed-on: https://chromium-review.googlesource.com/634254
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47614}
2017-08-25 18:16:27 +00:00
Alexei Filippov
9b15760286 [runtime-call-stats] Fix a long standing crash in RuntimeCallStats::Leave
There must be a matching Leave for each Enter. Otherwise it ends up
with a dead stack-allocated object in the timer chain.

Drive-by: There was also a bug in
RuntimeCallTimerScope::RuntimeCallTimerScope(HeapObject* ...) did create a
local object instead of calling an overloaded constructor.

BUG=chromium:669329

Change-Id: I9aa1c574a854af8beab3d8097efab3a726ad1c8d
Reviewed-on: https://chromium-review.googlesource.com/634511
Commit-Queue: Alexei Filippov <alph@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47613}
2017-08-25 18:06:36 +00:00
Leszek Swirski
e5df5bd044 [ignition] Always write the deferred command result register
For deferred commands (such as in try-finally), some deferred commands
save and restore the accumulator using a result register (e.g. return,
throw, rethrow), while others don't (e.g. break, continue,
fall-through).

However, conditionally reading this result register that may not ever be
written caused it to be considered live from the start of the function,
as far as the liveness analysis could statically tell.

Now, we write the result register for all deferred commands, including
the fall-through. As a micro-optimization, we re-use the Smi command
tokeen to clobber the result, rather than emitting an LdaUndefined.

Bug: chromium:758472
Change-Id: I2ea65e2249b40ee6403216e654a8bb88d50bec3b
Reviewed-on: https://chromium-review.googlesource.com/635592
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47612}
2017-08-25 16:31:24 +00:00
Jakob Gruber
6af8ca5e82 Fix type conversions in JSStackFrame accessors
We cannot assume that the receiver is a JSObject, nor can we assume
ToObject() completes successfully.

TBR=yangguo@chromium.org

Bug: chromium:739954
Change-Id: Id55571131ef8755e86f15cd2acb918ff0f1b7788
Reviewed-on: https://chromium-review.googlesource.com/632376
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47611}
2017-08-25 15:32:54 +00:00
Michael Lippautz
f152f83224 [heap] Fix dead-lock between scavenger and sweeper
The deadlock can happen when two scavenging tasks process two different
pages for their old->new sets and at the same time try to allocate in
old space which triggers sweeping of the other task's page.

Bug: v8:6754
Change-Id: I6087553631e198d5ecfb8ab37925ac41cd6995bd
Reviewed-on: https://chromium-review.googlesource.com/635843
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47610}
2017-08-25 14:54:15 +00:00
Jakob Gruber
c7a7bf6af0 [regexp] Pass correct limit to Runtime::kRegExpSplit
The Uint32(limit) conversion can end up transitioning the regexp
instance to slow mode. In this case we need to bail out to runtime while
ensuring that ToUint32 is not observably called a second time. We do
this by passing the already-converted value to runtime.

This particular path was broken and we ended up passing the original
maybe_limit value to runtime instead.

TBR=yangguo@chromium.org

Bug: chromium:758763
Change-Id: If7f23b452d2e134ad9be3d4ef1d78d1c946fcef0
Reviewed-on: https://chromium-review.googlesource.com/635588
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47609}
2017-08-25 13:59:43 +00:00
Albert Mingkun Yang
b20390c0a1 [Fix] Allow LazyInstance to support classes with virtual members
Change the signature of `Construct` so that no casting is required on
calling it. The casting would fire control flow integrity check if the
class contains virtual members.

Bug: chromium:758925
Change-Id: Iefc711c634b36efd051e245e2df13b28d5563f45
Reviewed-on: https://chromium-review.googlesource.com/635563
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
Cr-Commit-Position: refs/heads/master@{#47608}
2017-08-25 12:45:24 +00:00
Michael Lippautz
f048b4b18e [heap] ExternalStringTable: Replace List with std::vector
Bug: v8:6333
Change-Id: I0f5a21a66bbad6c56b3dd84d301b85e64f05cbc1
Reviewed-on: https://chromium-review.googlesource.com/635683
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47607}
2017-08-25 12:33:03 +00:00
Michael Lippautz
234d4307d7 [heap] Refactor and simplify pretenuring infrastructure
Bug: 
Change-Id: I81132af45d8fb649d4239fa0e0ef75b95e148208
Reviewed-on: https://chromium-review.googlesource.com/633604
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47606}
2017-08-25 11:51:03 +00:00
Mythri
08bfcb293c [TurboFan] Do not allow direct recursive inlining
Do not allow recursive inlining when function calls itself. i.e.f() -> f()
This is because we only get some static information for the first level
of inlining and it may not be very beneficial to just duplicate the entire
function. However, we still allow indirect recursion f() -> g() -> f() -> g1().
This helps in cases where f() is a small dispatch function. For example,
in rayTrace class.create -> obj.initialize -> class.create -> obj1.initialize.

Bug: chromium:757798
Change-Id: I0a5d9e62eabd7681849f900997b4df061b5f8ed5
Reviewed-on: https://chromium-review.googlesource.com/632622
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47605}
2017-08-25 11:24:45 +00:00
Georg Neis
fdecfd7f5c Fix comments on AccessorPair.
R=ishell@chromium.org

Bug: 
Change-Id: I7175176900c95fb676f633b405fffd5a55ffa4b5
Reviewed-on: https://chromium-review.googlesource.com/635323
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47604}
2017-08-25 11:15:24 +00:00
Camillo Bruni
8a7ce927a6 Don't look at abandoned prototype maps when looking for root maps
Bug: chromium:757199, chromium:758773, chromium:758821
Change-Id: I70644853770501b13992bd7bf78d168ca2308d64
Reviewed-on: https://chromium-review.googlesource.com/635223
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47603}
2017-08-25 10:44:29 +00:00
Clemens Hammacher
c8543c1f71 [wasm] [cleanup] More constexpr, less lazy initialization
The allocator for determining the location (reg/stack) for parameters
and return values can be constexpr. This avoids lazy initialization,
saving code size and execution time, and simplifying the implementation
significantly.

R=ahaas@chromium.org
CC=titzer@chromium.org

Change-Id: I295623cb1dad0f1537f7292dcf044f3d509588bb
Reviewed-on: https://chromium-review.googlesource.com/635163
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47602}
2017-08-25 10:36:39 +00:00
Michael Lippautz
b6158eb6be [heap] Move gc callbacks from List to std::vector
Bug: v8:6333
Change-Id: I4434c6cc59f886f1e37dfd315a3ad5fee28d3f63
Reviewed-on: https://chromium-review.googlesource.com/634907
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47601}
2017-08-25 10:28:59 +00:00