Commit Graph

37189 Commits

Author SHA1 Message Date
mstarzinger
e752bcc216 [turbofan] Ensure {CheckMaps} is not used accross mutations.
This makes sure that static guarantees about object maps are not used
accross operations on the effect chain that might trigger a map change.
Such operations are missing the {Operator::kNoWrite} property.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-685506
BUG=chromium:685506

Review-Url: https://codereview.chromium.org/2653273004
Cr-Commit-Position: refs/heads/master@{#42697}
2017-01-26 12:57:04 +00:00
marja
03e4381106 [parser] Skipping inner funcs: add variable names into the data for test purposes.
(Only in debug mode.)

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2657943003
Cr-Commit-Position: refs/heads/master@{#42696}
2017-01-26 12:55:53 +00:00
cbruni
439a8edcf7 [builtins] Add String.prototype.indexOf fast path in TF
Review-Url: https://codereview.chromium.org/2638393002
Cr-Commit-Position: refs/heads/master@{#42695}
2017-01-26 12:46:44 +00:00
ahaas
55aed78210 [wasm] Fix constant folding with signalling NaN.
According to the WebAssembly spec no arithmetic operation should ever
return a signalling NaN. With the constant folding in V8, however, it
was possible that some arithmetic operations were elided, and if the
input of the arithmetic operation was a signalling NaN, then also the
result was the same signalling NaN. This CL removes some constant
folding optimizations and adjusts others so that even with constant
folding the result of an arithmetic operation is never a signalling NaN.

R=titzer@chromium.org, rossberg@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2647353007
Cr-Commit-Position: refs/heads/master@{#42694}
2017-01-26 12:45:33 +00:00
mstarzinger
01d051ff33 [turbofan] Remove dead {is_liveness_analysis_enabled}.
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2655533003
Cr-Commit-Position: refs/heads/master@{#42693}
2017-01-26 12:24:10 +00:00
mvstanton
73980ae4a1 [TypeFeedbackVector] Remove unnecessary Parameters metadata
This is a remnant of a previous design to a solution yet to be
checked in.

BUG=v8:5456
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2650853008
Cr-Commit-Position: refs/heads/master@{#42692}
2017-01-26 12:08:35 +00:00
bmeurer
ec00a78f3f [turbofan] Assign proper type to Object.prototype.toString().
BUG=v8:5267
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2652273003
Cr-Commit-Position: refs/heads/master@{#42691}
2017-01-26 12:07:22 +00:00
mvstanton
76850146bf PrintFixedArrayElements should avoid peeking into empty arrays.
Small bugfix.

BUG=

Review-Url: https://codereview.chromium.org/2656903003
Cr-Commit-Position: refs/heads/master@{#42690}
2017-01-26 12:06:13 +00:00
petermarshall
2db0e8cbcf [Test] Add micro-benchmarks for super-calls with spread.
We compare ES5, ES6 and a Babel transpilation of the ES6 test.

BUG=v8:5894

Review-Url: https://codereview.chromium.org/2655063003
Cr-Commit-Position: refs/heads/master@{#42689}
2017-01-26 11:31:05 +00:00
ahaas
98fa962e5f [wasm] Turn on trap-if by default.
This CL turns on trap-if by default, and it changes the tests so that
traps in the cctests are also tested without trap-if.

R=titzer@chromium.org, clemensh@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2647323002
Cr-Original-Commit-Position: refs/heads/master@{#42603}
Committed: 01c87ebe70
Review-Url: https://codereview.chromium.org/2647323002
Cr-Commit-Position: refs/heads/master@{#42688}
2017-01-26 11:29:23 +00:00
ahaas
967c1a4ed7 [wasm] For trap-if, always record a reference map on ia32.
The reference map was only recorded when a frame was entered for the
runtime call, but it is also needed when the frame already exists.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2655243002
Cr-Commit-Position: refs/heads/master@{#42687}
2017-01-26 10:50:05 +00:00
rmcilroy
647d7b6c33 [Compiler] Put background compilation of eager inner functions behind a flag.
Disabled until clusterfuzz issues are sorted.

BUG=v8:5203, v8:5215, chromium:685515, chromium:685476

Review-Url: https://codereview.chromium.org/2658803002
Cr-Commit-Position: refs/heads/master@{#42686}
2017-01-26 10:27:40 +00:00
marja
d4507a6cf9 [parser] Skipping inner funcs: add info about variables.
- Declaring a variable called "this" for preparsed functions was unnecessary;
  DeclarationScope ctor already adds the variable.

- "arguments" for preparsed scopes need to be declared after parsing the
  function, like it's done in the parser.

- Now arguments_ can be the dummy variable, so adapted code to it.

- A previous refactoring CL ( https://codereview.chromium.org/2638333002 ) was
  incomplete; it had added ParserBase::ParseFunctionBody but
  PreParser::ParseFunction didn't call it. This CL completes that work. This is
  needed for getting "arguments" declared properly for preparsed functions.

- AllocateVariablesRecursively is already called for preparsed scopes (without
  this CL, that is), and it bails out early. However, before the bailout it used
  to dcheck num_stack_slots_ == 0; that is no longer true since we've done scope
  analysis for preparsed scopes.

- Test fix: we cannot have any lazy inner functions in the test, except the
  topmost lazy inner function. Such functions would also be lazy in the parser
  case, and the parser would just throw away their variables. Then the test
  tries to verify the preparsed data against the scopes without variables and fails.

- Disabled a test w/ a sloppy block function, will get that working again in the
  upcoming CLs.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2655623005
Cr-Commit-Position: refs/heads/master@{#42685}
2017-01-26 10:14:40 +00:00
mvstanton
d24ce605c9 Interpreter tester should accept metadata instead of a vector
The InterpreterTester class cobbles together a JSFunction from
a manually created bytecode and feedback vector. However it's
fragile against design changes in the way literal arrays and
feedback vectors are handled. It's better to let it hand in
a feedback vector metadata object, and allow the system to
create the vector from that.

BUG=v8:5456

Review-Url: https://codereview.chromium.org/2652893010
Cr-Commit-Position: refs/heads/master@{#42684}
2017-01-26 10:03:00 +00:00
ahaas
a5e7382d84 [wasm] Do the default int64-lowering for all non-i64 stores.
First issue I found with my local fuzzing.

R=titzer@chromium.org
BUG=v8:5884

Review-Url: https://codereview.chromium.org/2656563003
Cr-Commit-Position: refs/heads/master@{#42683}
2017-01-26 09:38:13 +00:00
kozyatinskiy
b98dd0af92 [inspector] added creation frame for async call chains for promises
With creation frame we can show additional information with description of each async stack trace, which could help user to understand where promises were chained.
At least in case of Promise.resolve().then(foo1).then(foo2) we would be able to show following stack trace for break in foo2 callback:

foo2 (test.js:14:2)
-- Promise.resolve (test.js:29:14)--
-- Promise.resolve (test.js:28:14)--
promiseThen (test.js:30:2)

More details: https://docs.google.com/document/d/1u19N45f1gSF7M39mGsycJEK3IPyJgIXCBnWyiPeuJFE

BUG=v8:5738
R=dgozman@chromium.org,gsathya@chromium.org

Review-Url: https://codereview.chromium.org/2648873002
Cr-Commit-Position: refs/heads/master@{#42682}
2017-01-26 09:32:37 +00:00
jgruber
25bfdf1b46 Revert of [regexp] Create property on result for each named capture (patchset #9 id:160001 of https://codereview.chromium.org/2630233003/ )
Reason for revert:
Some heap tests are broken leading to failures on nosnap builds:

https://build.chromium.org/p/client.v8.ports/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20nosnap%20-%20debug/builds/3677

Reverting again until tests are fixed to keep bots green.

Original issue's description:
> [regexp] Store named captures on the regexp result
>
> This implements storing named captures on the regexp result object.
> For instance, /(?<a>.)/u.exec("b") will return a result such that:
>
> result.group.a  // "b"
>
> https://tc39.github.io/proposal-regexp-named-groups/
>
> BUG=v8:5437
>
> Review-Url: https://codereview.chromium.org/2630233003
> Cr-Original-Original-Commit-Position: refs/heads/master@{#42532}
> Committed: 70000946eb
> Review-Url: https://codereview.chromium.org/2630233003
> Cr-Original-Commit-Position: refs/heads/master@{#42570}
> Committed: ee94fa11ed
> Review-Url: https://codereview.chromium.org/2630233003
> Cr-Commit-Position: refs/heads/master@{#42676}
> Committed: 8bf52534f6

TBR=yangguo@chromium.org,littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5437

Review-Url: https://codereview.chromium.org/2654233002
Cr-Commit-Position: refs/heads/master@{#42681}
2017-01-26 09:31:08 +00:00
bmeurer
69747e2658 [turbofan] Introduce JSCallForwardVarargs operator.
We turn a JSCallFunction node for

  f.apply(receiver, arguments)

into a JSCallForwardVarargs node, when the arguments refers to the
arguments of the outermost optimized code object, i.e. not an inlined
arguments, and the apply method refers to Function.prototype.apply,
and there's no other user of arguments except in frame states.

We also replace the arguments node in the graph with a marker for
the Deoptimizer similar to Crankshaft to make sure we don't materialize
unused arguments just for the sake of deoptimization. We plan to replace
this with a saner EscapeAnalysis based solution soon.

R=jarin@chromium.org
BUG=v8:5267,v8:5726

Review-Url: https://codereview.chromium.org/2655233002
Cr-Commit-Position: refs/heads/master@{#42680}
2017-01-26 09:29:56 +00:00
mstarzinger
7376e12e00 [deoptimizer] Preserve double bit patterns correctly.
This makes sure that the deoptimizer preserves the exact bit pattern of
floating-point values (both 32-bit and 64-bit) up to the point where a
potential {HeapNumber} is allocated. It in turn allows us to correctly
recognize the {hole_nan_value} when stored into a {FixedDouleArray}.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-684208
BUG=chromium:684208

Review-Url: https://codereview.chromium.org/2652303002
Cr-Commit-Position: refs/heads/master@{#42679}
2017-01-26 09:25:59 +00:00
bradnelson
f6d0dc6d88 [wasm][asm.js] Add wasm module size to asm debug measurements.
Also show size when --trace-asm-time is on.

BUG=
R=mtrofin@chromium.org

Review-Url: https://codereview.chromium.org/2658703003
Cr-Commit-Position: refs/heads/master@{#42678}
2017-01-26 08:17:06 +00:00
bradnelson
d0befa956f [wasm][asm.js] Permit ternary operator in asm.js returns in some cases.
In practice, Emscripten seems to emit cond?+a:+b type return
expressions. This is not allowed by the spec or errata, but we need
to support it for compatibility.

Similar patterns with ints / signed, do not seem to be supported.

BUG=v8:5891
R=mtrofin@chromium.org,aseemgarg@chromium.org

Review-Url: https://codereview.chromium.org/2648353010
Cr-Commit-Position: refs/heads/master@{#42677}
2017-01-26 08:12:07 +00:00
jgruber
8bf52534f6 [regexp] Store named captures on the regexp result
This implements storing named captures on the regexp result object.
For instance, /(?<a>.)/u.exec("b") will return a result such that:

result.group.a  // "b"

https://tc39.github.io/proposal-regexp-named-groups/

BUG=v8:5437

Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Original-Commit-Position: refs/heads/master@{#42532}
Committed: 70000946eb
Review-Url: https://codereview.chromium.org/2630233003
Cr-Original-Commit-Position: refs/heads/master@{#42570}
Committed: ee94fa11ed
Review-Url: https://codereview.chromium.org/2630233003
Cr-Commit-Position: refs/heads/master@{#42676}
2017-01-26 07:59:21 +00:00
v8-autoroll
f1ebb1d9c5 Update V8 DEPS.
Rolling v8/build: 24cce87..6f17189

Rolling v8/buildtools: 8e94621..a7cc7a3

Rolling v8/tools/clang: 68adbeb..017f4e5

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2651303002
Cr-Commit-Position: refs/heads/master@{#42675}
2017-01-26 04:23:49 +00:00
bbudge
c5bdbbbebe [Turbofan] Add other integer SIMD types, add more integer ops.
- Adds Int16x8, Int8x16 types.
- Adds neg, abs unary ops.
- Adds add, sub, mul, and signed / unsigned min / max, comparison ops.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2638133002
Cr-Commit-Position: refs/heads/master@{#42674}
2017-01-26 02:18:00 +00:00
jing.bao
d28c04486b [x64] Fix REX prefix in shufps
BUG=

Review-Url: https://codereview.chromium.org/2652793004
Cr-Commit-Position: refs/heads/master@{#42673}
2017-01-26 01:38:17 +00:00
luoe
a81fbe802a Fix uncaught exception bug from liveEditScriptSource
BUG=chromium:683335
CQ_INCLUDE_TRYBOTS=master.tryserver.blink:linux_trusty_blink_rel

Review-Url: https://codereview.chromium.org/2651153004
Cr-Commit-Position: refs/heads/master@{#42672}
2017-01-26 01:29:01 +00:00
gsathya
c6f925d7ed [ast] Annotate Runtime ast nodes
Changes output from
CALL RUNTIME (context function) code = 0x3e9ea90a2049 at -1
to
CALL RUNTIME async_function_promise_create code = 0x3e9ea90a2049 at -1

This makes the ast more useful. I didn't annotate all the runtime calls,
only some for now. We can annotate others if necessary.

Review-Url: https://codereview.chromium.org/2654113002
Cr-Commit-Position: refs/heads/master@{#42671}
2017-01-26 00:02:03 +00:00
kozyatinskiy
bc7eb04d92 [debug] remove StepFrame
This action was used by inspector for blackboxing and isn't needed with new blackboxing implementation inside V8.

BUG=none
R=yangguo@chromium.org,clemensh@chromium.org
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2650943011
Cr-Commit-Position: refs/heads/master@{#42670}
2017-01-25 23:50:57 +00:00
jyan
f7a3ede082 s390: TF Codegen Optimization
List of items:
  1. Avoid zero-extending for subsequent 32-bit operations if current operation does not change upper 32-bit or does zero-extending.
  2. Match complex address mode for binary operation where possible (eg. use Add R,MEM).
  3. Detect instruction forms in selector. Eg. kAllowRRR, kAllowRM
  4. Optimize sequence for Int32MulWithOverflow, Int32Div, etc.
  5. Remove Not32/Not64 which is the same as XOR

R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2649113007
Cr-Commit-Position: refs/heads/master@{#42669}
2017-01-25 23:42:14 +00:00
kozyatinskiy
c8691efb38 [inspector] ignores debugger; in blackboxed code
Current state and proposed changes for blackboxing: https://docs.google.com/document/d/1hnzaXPAN8_QC5ENxIgxgMNDbXLraM_OXT73rAyijTF8/edit?usp=sharing

BUG=v8:5842,chromium:583193
R=yangguo@chromium.org,dgozman@chromium.org,alph@chromium.org

Review-Url: https://codereview.chromium.org/2648353006
Cr-Commit-Position: refs/heads/master@{#42668}
2017-01-25 23:30:40 +00:00
rmcilroy
6d42c4504a [complier] Enable parallel eager inner function compilation with compiler dispatcher.
Enable enqueueing of eager inner function compilation onto the compiler
dispatcher. This enables these tasks to be performed in parallel to
compilation of the outer functio (only for Ignition functions).
We currently synchronize to ensure all inner function compilations
 are complete before executing the outer function - future work will
allow outer function execution to happenin parallel to inner function
compilation.

BUG=v8:5203,v8:5215

Review-Url: https://codereview.chromium.org/2611313002
Cr-Commit-Position: refs/heads/master@{#42667}
2017-01-25 22:41:57 +00:00
pfeldman
76e31da4f6 V8 Inspector: remove V8ConsoleAPIType from the API, reuse v8::Isolate::MessageErrorLevel instead.
BUG=chromium:682521

Review-Url: https://codereview.chromium.org/2656613004
Cr-Commit-Position: refs/heads/master@{#42666}
2017-01-25 22:23:18 +00:00
Michael Achenbach
64b9aec06c Whitespace change to trigger bots
Cr-Commit-Position: refs/heads/master@{#42665}
2017-01-25 19:43:09 +00:00
Michael Achenbach
232a363f57 Whitespace change to trigger bots
Cr-Commit-Position: refs/heads/master@{#42664}
2017-01-25 19:35:55 +00:00
jyan
05426a0de3 s390: Fix DoArgumentsElements where should use CmpP
R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com
BUG=

Review-Url: https://codereview.chromium.org/2651673009
Cr-Commit-Position: refs/heads/master@{#42663}
2017-01-25 18:46:02 +00:00
leszeks
03a2b3a1a3 [ignition] Expect 'I' for signed bytecode operands
Because it was confusing seeing U8(negative value).

Review-Url: https://codereview.chromium.org/2640273002
Cr-Commit-Position: refs/heads/master@{#42662}
2017-01-25 17:39:24 +00:00
jyan
dde145054f [turbofan] Allow TempReg to be SameAsFirst and FromVreg
BUG=

Review-Url: https://codereview.chromium.org/2650813003
Cr-Commit-Position: refs/heads/master@{#42661}
2017-01-25 16:11:07 +00:00
caitp
c18d4216a4 [csa] add utilities for printf-style debugging
Adds CSA::Print(const char* s), which generates a runtime call to
Runtime::kGlobalPrint with a line-terminated ASCII string constant,
and CSA::DebugPrint(const char* prefix, Node* tagged_value), which
emits a runtime call to Runtime::kDebugPrint() with the tagged
value, optionally prefixed by an ascii string constant.

These simplify debugging TF builtins by providing a tool to easily
observe the contents of values at arbitrary points in a program,
without stepping endlessly through assembly in a debugger, and to
easily observe the path taken through a TF builtin.

These methods do not generate code in release builds.

BUG=v8:5268
R=ishell@chromium.org, danno@chromium.org, bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2651673003
Cr-Commit-Position: refs/heads/master@{#42660}
2017-01-25 15:45:57 +00:00
machenbach
7c30fcf22d [foozzie] Fix mock variables that leaked into the global object
Also tidy some JS style in the file.

BUG=chromium:673246
NOTRY=true

Review-Url: https://codereview.chromium.org/2650353004
Cr-Commit-Position: refs/heads/master@{#42659}
2017-01-25 14:59:39 +00:00
ahaas
1c1742f38d [wasm] Fix the --wasm_code_fuzzer_gen_test again.
R=titzer@chromium.org, clemensh@chromium.org

Review-Url: https://codereview.chromium.org/2657443003
Cr-Commit-Position: refs/heads/master@{#42658}
2017-01-25 14:10:04 +00:00
petermarshall
bf782ec512 [Builtins] Smi-check the spread and go to runtime in CheckSpreadAndPushToStack.
We did not smi-check the spread argument here, meaning we tried to take the map
of a smi, resulting in segfaults which clusterfuzz found.

Also added tests that exercise this path.

BUG=685086

Review-Url: https://codereview.chromium.org/2655013002
Cr-Commit-Position: refs/heads/master@{#42657}
2017-01-25 13:55:58 +00:00
marja
6053f4a331 [parser]: Skipping inner funcs / initial implemetation of storing scope analysis data from preparsed scopes.
The data produced at the moment only contains information about scope type +
positions, and only the most trivial tests pass.

Upcoming CLs will extend the data to contain information about variables (once
PreParser can produce it) and add more test cases.

BUG=v8:5516

Review-Url: https://codereview.chromium.org/2650703003
Cr-Commit-Position: refs/heads/master@{#42656}
2017-01-25 13:03:19 +00:00
titzer
f51a5f732c [wasm-test] WasmModuleBuilder.addCustomSection in the JS builder API.
R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2650053005
Cr-Commit-Position: refs/heads/master@{#42655}
2017-01-25 11:53:09 +00:00
clemensh
0ec3a264bc [wasm] Fix check failure on invalid name section
After decoding an invalid function name (e.g. OOB), we stored the parsed
offset and length into the WasmFunction anyway, resulting in a runtime
CHECK failure later on.
This CL fixes this, and adds a regression test.

R=titzer@chromium.org
CC=mtrofin@chromium.org, bradnelson@chromium.org
BUG=chromium:684858

Review-Url: https://codereview.chromium.org/2656713003
Cr-Commit-Position: refs/heads/master@{#42654}
2017-01-25 11:37:48 +00:00
v8-autoroll
fdc5cd7987 Update V8 DEPS.
Rolling v8/build: dbe38ca..24cce87

Rolling v8/tools/clang: 58fecbe..68adbeb

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review-Url: https://codereview.chromium.org/2653123004
Cr-Commit-Position: refs/heads/master@{#42653}
2017-01-25 11:09:32 +00:00
mlippautz
f392922b4a [tests] Fix use-after-scope errors related to weak refs
BUG=v8:5887

Review-Url: https://codereview.chromium.org/2655533004
Cr-Commit-Position: refs/heads/master@{#42652}
2017-01-25 10:46:01 +00:00
titzer
1cbb690366 [wasm] Use ErrorThrower more uniformly in wasm-js.cc
R=rossberg@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2650073003
Cr-Commit-Position: refs/heads/master@{#42651}
2017-01-25 10:40:11 +00:00
rmcilroy
8bae36f963 [Platform] Increase default stack size on Mac OS X to 1MB.
The default stack size of a background thread is 512KB on MacOSX. We default to
1MB stack checks when compiling JS code, so we need to increase this limit
to enable compilation of JS code onto background threads.

Corresponding Chromium CL is https://codereview.chromium.org/2640803002/

BUG=v8:5203

Review-Url: https://codereview.chromium.org/2653673007
Cr-Commit-Position: refs/heads/master@{#42650}
2017-01-25 10:35:12 +00:00
jgruber
a4183e59a7 [stubs] Add initializing constructor to CSA::Variable
It's a common pattern to create a Variable and immediately initialize
it. This adds a new constructor to make that pattern more natural.

BUG=

Review-Url: https://codereview.chromium.org/2657533003
Cr-Commit-Position: refs/heads/master@{#42649}
2017-01-25 10:00:38 +00:00
mstarzinger
efc8cb16d7 [turbofan] Fix accumulator use in bytecode analysis.
This fixes the checks of accumulator usage flags in the computation of
the interpreter register liveness during bytecode analysis. The usage
flags at hand are bit patterns as opposed to flat enum values. Use the
safe accessors instead of plain comparison.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-683581
BUG=chromium:683581

Review-Url: https://codereview.chromium.org/2651653005
Cr-Commit-Position: refs/heads/master@{#42648}
2017-01-25 09:14:41 +00:00