Commit Graph

56940 Commits

Author SHA1 Message Date
Ng Zhi An
d353d61857 Fix macro to generate SIMD instructions for test
Bug: v8:6020
Change-Id: Ic33f698973edd8b6bcb8725cc86b4431374fb7b8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666450
Auto-Submit: Zhi An Ng <zhin@chromium.org>
Reviewed-by: Deepti Gandluri <gdeepti@chromium.org>
Commit-Queue: Zhi An Ng <zhin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62298}
2019-06-19 20:44:52 +00:00
Ben Smith
b7a7e2fb89 [wasm] Call OnAfterCompile when cloning Module
The debugger should be notified whenever a new Module is created so it
displayed properly. Without this change, the Module is only displayed once,
regardless of the number of times it is referenced (by other Workers, say).
That is potentially reasonable behavior, but it doesn't match the way
JavaScript does it.

With this change, the debugger will display the sources like this:

```
▼ top
  ▶ localhost
  ▼ wasm
    ▼ wasm-82570336
        wasm-82570336-0

▼ worker.js
  ▶ localhost
  ▼ wasm
    ▶ wasm-82570336
```

Change-Id: I61177e8a07e36ea8e2234aa25e75b1489c9da95f
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666616
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Ben Smith <binji@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62297}
2019-06-19 18:51:41 +00:00
Daniel Clark
8d8215504b [modules] Introduce SourceTextModule class
Introduce SourceTextModule as a subclass of Module.  Move all the
JavaScript-module-specific code down from Module to
SourceTextModule, with all code applicable to other future
module types remaining in Module.

With this change, Module is roughly equivalent to the spec's
Abstract Module Record and SourceTextModule is roughly equivalent
to Source Text Module Record.

Bug: v8:9292
Change-Id: I6e9cd3ece9d0c1da57e52f8af8ed5848d87dd22d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1633154
Commit-Queue: Dan Clark <daniec@microsoft.com>
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62296}
2019-06-19 17:54:52 +00:00
Adam Klein
abacacddd7 Revert "[csa] add hint to CAST error message to break in mksnapshot"
This reverts commit 93b6c866f3.

Reason for revert: Breaks on nosnap debug:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20nosnap%20-%20debug/24470

Original change's description:
> [csa] add hint to CAST error message to break in mksnapshot
> 
> Change-Id: I51a22de5d6367c38056ea91eface4f69f6651993
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664069
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Reviewed-by: Michael Stanton <mvstanton@chromium.org>
> Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62274}

TBR=ulan@chromium.org,mvstanton@chromium.org,tebbi@chromium.org

Change-Id: I778b3a2c79776575efc8de43cf25e19ae301fca9
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667484
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62295}
2019-06-19 17:14:45 +00:00
Dan Elphick
96577220d7 Revert "Reland "Enable lazy source positions by default""
This reverts commit ccf0d80261.

Reason for revert: Breaks https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20debug/26472

Original change's description:
> Reland "Enable lazy source positions by default"
> 
> This is a reland of 69fafb5fe3
> after fixing the in crash with
> https://chromium-review.googlesource.com/c/v8/v8/+/1664334
> 
> Original change's description:
> > Enable lazy source positions by default
> >
> > Also adds a compile time flag which allows the default to be configured
> > so node can disable it since it hangs the node cpu profiler tests.
> >
> > Bug: v8:8510
> > Change-Id: Idf4785036dc6242769410091518a67ac9179b718
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1491491
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Commit-Queue: Dan Elphick <delphick@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#62089}
> 
> Bug: v8:8510
> Change-Id: I81b36dbba3cc7b9a99dc5cc4ea72040fabfec97e
> Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg,v8_linux64_gc_stress_custom_snapshot_dbg_ng
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660484
> Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
> Auto-Submit: Dan Elphick <delphick@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62288}

TBR=rmcilroy@chromium.org,delphick@chromium.org

Change-Id: Icbe93550850f79d1c29bed3e8084676c453cdf06
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:8510
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg, v8_linux64_gc_stress_custom_snapshot_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667419
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62294}
2019-06-19 15:54:34 +00:00
Tobias Tebbi
20d29a3617 [torque] check TNode return types of CSA macros
This disallows using CSA macros from Torque that have a Node* return
type instead of TNode<>. By enforcing CSA types at the boundary between
CSA and Torque, we can ensure that the Torque types and the CSA types
match.

As a drive-by, this CL adds a bit more of CSA typing where it made sense.

Bug: v8:7793, v8:6949

Change-Id: I12ea0337c628105ea3c420be747ae50d3a172547
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660481
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62293}
2019-06-19 15:50:11 +00:00
Joyee Cheung
31a951d875 [class] implement access of private methods
This patch implements the access of private methods:

- When building property loads, check whether it requires
  a brand check. If so, build the brand check and load the
  property (the method) from the context instead.
- Throw type errors when there is an attempted write to private
  methods.

Design: https://docs.google.com/document/d/1T-Ql6HOIH2U_8YjWkwK2rTfywwb7b3Qe8d3jkz72KwA/edit#

Bug: v8:8330
Change-Id: Ic917d2a0030196c1940b0c0ba65a340af736c769
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1610383
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62292}
2019-06-19 15:38:21 +00:00
Igor Sheludko
b4e9d6c0a8 [ptr-compr] Remove i::GetIsolateFromWritableObject(HeapObject, Isolate*)
... and add i::GetIsolateFromHeapObject(HeapObject, Isolate*) and
i::IsReadOnlyHeapObject(HeapObject) instead.

Previously the removed function was also used for checking if given heap
object is a read only object. But if pointer compression is enabled
the i::GetIsolateFromHeapObject() will succeed for both read only and
writable heap objects.

Bug: v8:9379, v8:7703
Change-Id: Ib0a9babafe32f43716dac70620b51657dfb97d7c
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667416
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62291}
2019-06-19 15:22:11 +00:00
Maciej Goszczycki
05f56d94e3 [heap] Set code_object_registry_ to nullptr after deleting it
Prevents potential double free if
ReleaseAllocatedMemoryNeededForWritableChunk were to be called twice.

Change-Id: I97f0b3e6a279297faa37d541b81f465fec68b894
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667414
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#62290}
2019-06-19 15:21:02 +00:00
Leszek Swirski
bc532e5f5c [ic] Fix normalization cache lookup with elements kind
The map in the cache is the LHS, not the RHS.

Change-Id: Idf6b4fafc8c62aea5b8f5f55258241939cf9829d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667410
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62289}
2019-06-19 14:39:46 +00:00
Dan Elphick
ccf0d80261 Reland "Enable lazy source positions by default"
This is a reland of 69fafb5fe3
after fixing the in crash with
https://chromium-review.googlesource.com/c/v8/v8/+/1664334

Original change's description:
> Enable lazy source positions by default
>
> Also adds a compile time flag which allows the default to be configured
> so node can disable it since it hangs the node cpu profiler tests.
>
> Bug: v8:8510
> Change-Id: Idf4785036dc6242769410091518a67ac9179b718
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1491491
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Commit-Queue: Dan Elphick <delphick@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62089}

Bug: v8:8510
Change-Id: I81b36dbba3cc7b9a99dc5cc4ea72040fabfec97e
Cq-Include-Trybots: luci.v8.try:v8_linux_gc_stress_dbg,v8_linux64_gc_stress_custom_snapshot_dbg_ng
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660484
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62288}
2019-06-19 14:32:41 +00:00
Dan Elphick
668650574a Fix use of raw object in JSSegmentIterator
Fix JSSegmentIterator::Create getting the unicode string as a raw object
pointer and then performing memory allocation which then invalidates it.
This changes SetTextToBreakIterator to return a handle instead.

Bug: v8:6891
Change-Id: I57e175b31e78a074a0b3c5a8fc26b4af05b4a752
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667409
Commit-Queue: Dan Elphick <delphick@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62287}
2019-06-19 13:58:48 +00:00
Leszek Swirski
82bc7d1a89 [map] Make NextFreePropertyIndex search backwards
Now that fields are always in the same order as descriptors, we can
change the property scan during NextFreePropertyIndex into a faster
reverse search that simply tries to find the last field.

Change-Id: I24d0781cd7d7c5b15998c35f281be69cd492d5ee
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667402
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62286}
2019-06-19 13:49:45 +00:00
Darius Mercadier
8cad802ec6 [heap] Add --trace-evacuation-candidates flag
This flag will be useful to analyze (and then improve) fragmentation
and compaction.

Bug: v8:9329
Change-Id: Ie3c5b618fa5717277cf2b9617e2d8f9dc2138056
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664333
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Cr-Commit-Position: refs/heads/master@{#62285}
2019-06-19 13:34:15 +00:00
Leszek Swirski
e41bdb5eb1 [tools] Remove chrome-specific gdbinit code
Change-Id: Ie38c77aafbe75f61fc568f1013ca5815d6750364
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662289
Auto-Submit: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62284}
2019-06-19 12:34:05 +00:00
Igor Sheludko
77476cb278 Temporarily disable frozen/sealed elements kinds
... to prepare for merging this back to stable chanel.

Bug: chromium:972921
Change-Id: I04ced1c81b5f8730014ecee8935799fccc377a49
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667006
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62283}
2019-06-19 12:07:35 +00:00
Leszek Swirski
1e37ca26cc [parser] Fix reindexing of functions inside classes
A class's fields can appear twice in the class AST, via the properties
array and the synthetised initializer method. This means that the
reindexer can end up visiting the same function literal twice, since the
T in AST is no longer a T but rather a DAG.

Now, we special case the class visitor in the reindexer to avoid these
double visits where appropriate. We know what kinds of fields can be
double visisted, so we don't need a visited set, but we now also have
one for debug builds to verify that each function is visited exactly
once.

Bug: chromium:974627
Change-Id: Ib531becc6e3f3c73f420b5fb49790fe4a2022d65
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667003
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62282}
2019-06-19 11:27:55 +00:00
Igor Sheludko
5d95930142 Make some runtime functions ClusterFuzz friendly
Bug: chromium:974086
Change-Id: Id5a8db8c921958bfdb0b1ec8b1a50edaef6c5acf
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667007
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62281}
2019-06-19 11:23:25 +00:00
Igor Sheludko
de6382dfc8 Make frozen/sealed elements kinds disablable
Bug: chromium:972921
Change-Id: Ieb13c2f18714abc60aeb4a6a77c1e43b88681f43
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667005
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62280}
2019-06-19 11:19:15 +00:00
Leszek Swirski
7325d4ae98 [ic] Replace CopyGeneralize with Normalize
Rather than starting a new, orphaned transition tree in various bailout
cases, simply drop down into dictionary mode.

Aside from potential memory benefits, this allows us to remove
CopyGeneralizeAllFields, which was the only path along which fields
could end up in a different order than their descriptors.

Change-Id: I5577e8a1ca51f0ffdadd7504e7895f367605aa27
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662298
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62279}
2019-06-19 11:15:23 +00:00
Mythri A
15709b5a3e [cleanup] Add %PrepareFunctionForOptimization for few more tests
Bug: v8:8394, v8:8801, v8:9183
Change-Id: Ia5169541ada58bf2bea64e720cae5e5c04617cbd
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1667001
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62278}
2019-06-19 10:17:52 +00:00
Jakob Gruber
4fe611ec58 [regexp] Refactor OutSet and BoyerMoorePositionInfo
Outset:
The more advanced features of OutSet are no longer used, thus the
rename to DynamicBitSet to reflect its current purpose.

BoyerMoorePositionInfo:
Use bitset backing store in BoyerMoorePositionInfo (previously this
was based on a (statically-sized) ZoneList<bool>).

Bug: v8:9359
Change-Id: I40ca89467ae90ee90c616be5fd0d51e54e94e157
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664064
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62277}
2019-06-19 09:57:52 +00:00
Jakob Gruber
983ab01a68 [utils,diagnostics] Remove SplayTree and its last use
The last use of V8's SplayTree was in diagnostics and is now replaced
by std::map.

Bug: v8:9359
Change-Id: I7b79fe619eb734343579652058be4d2b81fd4a1e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664060
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62276}
2019-06-19 09:48:02 +00:00
Mythri A
4c3775203d Reland "Reland "Enable lazy feedback allocation""
This is a reland of 333615cfc2 after
disabling the failing layout test. I am still investigating the failure
and will re-enable the test as soon as I find a fix. The related bug
is here: crbug.com/976587

Original change's description:
> Reland "Enable lazy feedback allocation"
>
> This is a reland of 8c10501be5.
> Reland after fixing test failures.
>
> Original change's description:
> > Enable lazy feedback allocation
> >
> > Bug: v8:8394
> > Change-Id: I29ffd38725bdcaa9dd11221045dba681eb0d567b
> > Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1643430
> > Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> > Commit-Queue: Mythri Alle <mythria@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#61991}
>
> Bug: v8:8394
> Change-Id: Icc9e276ab22ca6455b775f3c27e0d43c3f08b887
> TBR: rmcilroy@chromium.org
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1647161
> Reviewed-by: Mythri Alle <mythria@chromium.org>
> Commit-Queue: Mythri Alle <mythria@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#62018}

Bug: v8:8394
Change-Id: I014b14933bfa7f98a2c3666ba5a650917e96a819
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666999
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62275}
2019-06-19 09:18:32 +00:00
Tobias Tebbi
93b6c866f3 [csa] add hint to CAST error message to break in mksnapshot
Change-Id: I51a22de5d6367c38056ea91eface4f69f6651993
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664069
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62274}
2019-06-19 09:00:52 +00:00
Simon Zünd
b37f1c0a0d [array] Use 'strict' DeleteProperty in Array#sort
This CL changes the generic version of Array#sort to use 'strict'
DeleteProperty when "moving" holes to the end of the sort range.

This brings V8 not only in line with the proposed Array#sort spec
change, but also closer to what other engines do. Now all engines
throw a TypeError when the new test case is run.

R=jgruber@chromium.org, mathias@chromium.org

Bug: v8:8714
Change-Id: Ic5bcd152ad55fd534c1e9e3218393bfe4a50667e
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666995
Commit-Queue: Simon Zünd <szuend@chromium.org>
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Mathias Bynens <mathias@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62273}
2019-06-19 08:47:42 +00:00
Daniel Bratell
2603fad259 Clarify RegExp namespace (v8::RegExp or v8::internal::RegExp)
There are two RegExp classes, one in v8 and one in
v8::internal and in some Windows jumbo builds the compiler
tried to use v8::internal when v8 was intended. In normal builds
the compiler does not know about v8::internal::RegExp so
it works anyway.

Bug: v8:9359
Change-Id: I9a39d342ddefd6570d5d070b7c073dc257705969
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666992
Commit-Queue: Daniel Bratell <bratell@opera.com>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Auto-Submit: Daniel Bratell <bratell@opera.com>
Cr-Commit-Position: refs/heads/master@{#62272}
2019-06-19 08:39:53 +00:00
Yang Guo
b72addcf23 Correctly use new path to js_protocol.pdl
TBR=pfeldman@chromium.org

Bug: v8:9247
Change-Id: Icda672d6add5f4ff522706c8c4cb0f907bcff1b4
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666991
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62271}
2019-06-19 08:26:02 +00:00
Michael Achenbach
21eb5e9dba Whitespace change to trigger builders
Change-Id: Ic31d8fbffe57a477298ea0ecd870babdafd18823
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666996
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62270}
2019-06-19 08:18:16 +00:00
Simon Zünd
6df0af84e2 Fix flaky Array#reduce mjsunit test
This CL fixes a flaky mjsunit test, that exercises Array#reduce with
sealed arrays in TurboFan. The flake was caused by temporary objects,
whos maps didn't live long enough. The code object of the function
under test holds weakly onto this maps. With a low enough gc interval,
the maps, and thus the code object, get cleaned up before the
{assertOptimized} can execute.

The fix is simply to assign these temporary objects to variables.

Bug: v8:9374
Change-Id: I43da8ba6b0194872b176e27617d9ca7fbfe43ec2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666989
Auto-Submit: Simon Zünd <szuend@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Simon Zünd <szuend@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62269}
2019-06-19 07:26:09 +00:00
Jakob Gruber
3663e83424 [regexp] Remove unused DispatchTable and ZoneSplayTree
Bug: v8:9359
Change-Id: I237f16324ff036f2cbfb7ca97b4ac208442b06cc
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664056
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62268}
2019-06-19 07:19:38 +00:00
Mike Stanton
b3ce13f424 [Turbofan] Fix crash in MapInference::~MapInference
CL https://chromium-review.googlesource.com/c/v8/v8/+/1660623
("[Turbofan] Brokerize more promise reductions in JSCallReducer")
introduced a bug where we bail out of a call reduction but failed
to remove graph constructs added by the MapInference class.

R=jarin@chromium.org

Bug: chromium:976256, chromium:976524
Change-Id: I97f142fe6c1caba5e679f7df742893536c83b2d8
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666990
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62267}
2019-06-19 06:53:38 +00:00
Jaroslav Sevcik
bb7bb8b78b Introduce bytecode array abstraction.
This is to allow instantiating things like bytecode array iterator for
accessing both on-heap and off-heap bytecode arrays.

Bug: v8:7790
Change-Id: I8dbd0884f79923d69dbc8b168d3a4a200eab14b2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1640199
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62266}
2019-06-19 06:15:19 +00:00
v8-ci-autoroll-builder
bd88c759fd Update V8 DEPS.
Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/f6c289d..26377fc

Rolling v8/third_party/depot_tools: 2313020..764ec87

Rolling v8/third_party/fuchsia-sdk: ae68779..5fd2915

Rolling v8/tools/clang: 96bccf1..3937806

TBR=machenbach@chromium.org,sergiyb@chromium.org,tmrts@chromium.org

Change-Id: I3ce8d8da07240ccace20933273c03fd1e633891d
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666829
Reviewed-by: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com>
Cr-Commit-Position: refs/heads/master@{#62265}
2019-06-19 03:44:48 +00:00
Adam Klein
1eab04b726 Revert "[roheap] Check that ro-heap is always passed the same read-only snapshot"
This reverts commit a5fa211f30.

Reason for revert: breaks ARM Lite builder:
https://ci.chromium.org/p/v8/builders/ci/V8%20Linux%20-%20arm%20-%20sim%20-%20lite/4843

Original change's description:
> [roheap] Check that ro-heap is always passed the same read-only snapshot
> 
> Previously the ReadOnlyHeap simply discarded all but the first
> ReadOnlyDeseralizer. ClearSharedHeapForTest should be called if using a
> new ReadOnlyDeserializer (this might change in the future).
> 
> Remove an obsolete 'StartupSerializerRootMapDependencies' test. It used
> to test Map::WeakCellForMap which doesn't exist anymore and was
> difficult to adapt to a shared read-only heap.
> 
> Bug: v8:7464
> Change-Id: I64b8e953b0e3466e003541ec8a9321e439a01d33
> Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660612
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Reviewed-by: Dan Elphick <delphick@chromium.org>
> Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
> Cr-Commit-Position: refs/heads/master@{#62250}

TBR=yangguo@chromium.org,delphick@chromium.org,goszczycki@google.com

Change-Id: I099544913bec3bbd67840b1818a6ad6029fdf380
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:7464
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1666453
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62264}
2019-06-18 23:14:11 +00:00
Seth Brenith
e620ba139b [torque] Address remaining usages of @noVerifier in base.tq
For every @noVerifier in base.tq, this change either removes it or
ensures that it has some annotation explaining why it can't be removed.
The @noVerifier usages that can't be removed fall into the following
categories:
1. Classes that don't have their own instance types and therefore have
   no meaningful way to do an Is...() check
2. Fields that might not exist
3. Fields that are waiting for MaybeObject support in Torque

Bug: v8:9311
Change-Id: Id452d4151ec07347ae96a9b5f3b26e2ac8065d31
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1659134
Reviewed-by: Daniel Clifford <danno@chromium.org>
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Seth Brenith <seth.brenith@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#62263}
2019-06-18 22:44:58 +00:00
Dan Elphick
d8164d5906 Fix crash when reporting exceptions
Handlifies exception object as CollectSourcePositions can trigger GCs.

Bug: v8:8510
Change-Id: I29579b200af28bda30ccb5f2cf2e5a48f502c8f2
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664334
Commit-Queue: Dan Elphick <delphick@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Auto-Submit: Dan Elphick <delphick@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62262}
2019-06-18 20:52:38 +00:00
Yang Guo
76784275d9 Fix inspector preview for detached JSTypedArray
R=petermarshall@chromium.org

Bug: chromium:952455
Change-Id: Ib08a20e1d1fac7ef943f15ff524ee4e7c1c15507
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662290
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62261}
2019-06-18 20:26:48 +00:00
Jakob Gruber
83da1c2d4c [regexp] Simplify UnicodeRangeSplitter
This class used to be based on DispatchTable, which itself uses an
interval tree to both categorize and canonicalize ranges
(i.e. such that no overlap and all immediately adjacent ranges are
merged). The produced ranges were then entered into lists for
{bmp,lead_surrogate,trail_surrogate,non_bmp} splits.

With this CL, we simplify to a plain loop over all character range
kinds instead. The dispatch table (and ZoneSplayList, perhaps
SplayList) can be removed in follow-ups.

Bug: v8:9359
Change-Id: I9c6b72f3bc44d1557af7c74419709ae5662611f1
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664053
Auto-Submit: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62260}
2019-06-18 20:18:18 +00:00
Milad Farazmand
ea82d1c4a5 [counters]: solving endianness issue when API calls are made via the CallApiCallback builtin
Consistently using word sized loads on all architectures.

Original port: ea4206556e


Change-Id: I1083b977eb3c1688e67d68a69a9311bafbb52584
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1663994
Commit-Queue: Milad Farazmand <miladfar@ca.ibm.com>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Junliang Yan <jyan@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#62259}
2019-06-18 18:25:16 +00:00
Yang Guo
632239011d Move inspector protocol definitions to include/
This does not delete the files in the old locations yet since we need
to fix up the references in Chrome and Node.js.

Bug: v8:9247
Change-Id: I75dd469e19b6d4249ed187dd6d095d306f1b6c45
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1649355
Reviewed-by: Pavel Feldman <pfeldman@chromium.org>
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62258}
2019-06-18 17:59:36 +00:00
Ben L. Titzer
b9bc81d6cf [typed-arrays] Introduce JSTypedArray::kMaxSizeInHeap constant
Extract the maximum on-heap typed array size to a constant in the
JSTypedArray class. Add tests for allocating typed arrays of various
sizes and validate through the API whether they are allocated on heap.
It is not possible to observe from JavaScript.

R=mstarzinger@chromium.org

Change-Id: I1298e0a49010de829edaad32b7d6c6c9c52704fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1662572
Commit-Queue: Ben Titzer <titzer@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62257}
2019-06-18 17:19:19 +00:00
Z Nguyen-Huu
4e17a6beb4 Implement fastpath for proxy trap getPrototypeOf
ObjectGetPrototypeOf and ReflectGetPrototypeOf are now Torque builtins (previously CPP) and the Proxy path is implemented completely in Torque while everything else calls into runtime (and is thus a bit slower than previously).

Perf improvement in micro-benchmark JSTests/Proxies
Before:
GetPrototypeOfWithoutTrap-Proxies(Score): 1876
GetPrototypeOfWithTrap-Proxies(Score): 857

After:
GetPrototypeOfWithoutTrap-Proxies(Score): 2810
GetPrototypeOfWithTrap-Proxies(Score): 3197

Bug: v8:6664
Change-Id: If60dda67d6e90c2d6f0ec743f6cb7c0fff54d607
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1658717
Commit-Queue: Z Nguyen-Huu <duongn@microsoft.com>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Maya Lekova <mslekova@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62256}
2019-06-18 17:14:59 +00:00
Joyee Cheung
259d0acee5 [ast] add PRIVATE_METHOD assign type and PRIVATE_CALL call type
This patch adds a new assign type `PRIVATE_METHOD`. We now use this
for private method references in the form `obj.#key` when `#key`
resolves to a private method.

To obtain the type of the key variables after scope analysis, this
patch add a bit to Variable to recognize private method variables
whose load requires a brand check.

Also renamed `PropertyExpressionWithPrivateFieldKey` in ExpressionType
to `PrivateReference` and added `PRIVATE_CALL` to `CallType` - we'll
use the new types later when we implement private methods, which
require special brand checking semantics to load methods directly
from the context instead of from the object in order to save memory.

Bug: v8:8330
Change-Id: Idc1dcd4d514c1b3f8a31c99e49e34249449f0677
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1642772
Commit-Queue: Joyee Cheung <joyee@igalia.com>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62255}
2019-06-18 16:57:09 +00:00
Mythri A
ae1af6a568 [cleanup] Add %PrepareFunctionForOptimize for tests that use %OptimizeOsr
Bug: v8:8394, v8:8801, v8:9183
Change-Id: I29ff1a6dda97e89335b30fcc8c380bcb4055e1fb
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664690
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62254}
2019-06-18 16:47:29 +00:00
Maciej Goszczycki
89e44e2438 [cleanup] Remove MemoryChunk::kOwnerOffset
kOwnerOffset is redundant after 8a437788b9
since we check the READ_ONLY_HEAP bit instead of MemoryChunk::owner_ in
heap-write-barrier-inl.h

Bug: v8:9183
Change-Id: Ia0fbb530c088b8a87c551a99cc29d8cf7bd118f5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664341
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Auto-Submit: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#62253}
2019-06-18 16:13:39 +00:00
Maciej Goszczycki
d970f5b68f [cleanup] Remove unused heap.h declarations and FRIEND_TESTs
HeapControllerTest no longer exists while the other HeapTests use
IsolateData instead of Heap.

Bug: v8:9183
Change-Id: I1d17dfb9edb167147e2434bc4097147cea7e277b
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664339
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Auto-Submit: Maciej Goszczycki <goszczycki@google.com>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62252}
2019-06-18 16:07:20 +00:00
Darius Mercadier
031b753a4b [heap] Add length_ field to FreeListCategory
Having O(1) access to the length of the free lists on a given Page
will be useful to compute fragmentation and to implement efficient
heuristics to select evacuation candidates.

Bug: v8:9329
Change-Id: I92c7fcc38c89dcb18fef4ce7cc9ebf0b83d03dc5
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1664065
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Darius Mercadier <dmercadier@google.com>
Cr-Commit-Position: refs/heads/master@{#62251}
2019-06-18 15:50:59 +00:00
Maciej Goszczycki
a5fa211f30 [roheap] Check that ro-heap is always passed the same read-only snapshot
Previously the ReadOnlyHeap simply discarded all but the first
ReadOnlyDeseralizer. ClearSharedHeapForTest should be called if using a
new ReadOnlyDeserializer (this might change in the future).

Remove an obsolete 'StartupSerializerRootMapDependencies' test. It used
to test Map::WeakCellForMap which doesn't exist anymore and was
difficult to adapt to a shared read-only heap.

Bug: v8:7464
Change-Id: I64b8e953b0e3466e003541ec8a9321e439a01d33
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1660612
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Dan Elphick <delphick@chromium.org>
Commit-Queue: Maciej Goszczycki <goszczycki@google.com>
Cr-Commit-Position: refs/heads/master@{#62250}
2019-06-18 15:48:39 +00:00
Thibaud Michaud
79e8e3ec65 [wasm] Parallelize JS to WASM wrapper compilation
R=ahaas@chromium.org
CC=titzer@chromium.org

Bug: v8:9231
Change-Id: I209f7c89c99408a53a8db6a6af1ed795f6668a1d
Cq-Include-Trybots: luci.v8.try:v8_linux64_tsan_rel
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/1655653
Commit-Queue: Thibaud Michaud <thibaudm@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#62249}
2019-06-18 15:00:05 +00:00