Commit Graph

12505 Commits

Author SHA1 Message Date
oth
4edebb1cd8 [interpreter] Reduce dependencies in bytecodes.{h,cc}
This CL reduces the number of dependencies bytecodes.{h,cc} to facilitate
generating the bytecode peephole optimizer table during build. Specifically,
it avoids depending on v8_base.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2135273002
Cr-Commit-Position: refs/heads/master@{#37715}
2016-07-13 14:01:02 +00:00
bbudge
26ecb4a1d7 [Turbofan] Add ia32 support for 4 and 16 byte moves and swaps.
- Adds move/swap handling for 4 and 16 bytes to ia32.
- Register allocator now only requests 4 bytes for floats on ia32 and arm.
- We probably need similar support in mips.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2027043002
Cr-Commit-Position: refs/heads/master@{#37714}
2016-07-13 13:54:39 +00:00
ishell
b9a7b28163 [ic] Initialize feedback slots for LoadGlobalIC in Runtime::kDeclareGlobals when possible to avoid misses.
BUG=chromium:576312

Review-Url: https://codereview.chromium.org/2107193002
Cr-Commit-Position: refs/heads/master@{#37709}
2016-07-13 11:34:24 +00:00
ishell
b449dc0b6f [ic] Split megamorphic stub cache in two caches (for loads and for stores).
After this CL we can avoid using Code::flags in hash computations for megamorphic
stub caches and therefore the unused ICState field can be finally removed from flags.

BUG=chromium:618701

Review-Url: https://codereview.chromium.org/2123983004
Cr-Commit-Position: refs/heads/master@{#37708}
2016-07-13 10:27:32 +00:00
ssanfilippo
b413f0ebe1 Reland Implement .eh_frame writer and disassembler.
Original commit message:

  Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
  to a EhFrameWriter and will attach unwinding information to the code
  object when passed one.

Reason for reverting:

  The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc
  causes a compiler error on V8 Win64 - clang buildbot.

  Removing that bit.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/2023503002
Cr-Commit-Position: refs/heads/master@{#37707}
2016-07-13 10:18:01 +00:00
marija.antic
edf8c03547 MIPS64: Implement Mips64And32, Mips64Or32, Mips64Nor32 and Mips64Xor32 operators.
If operands are loaded as unsigned 32-bit integer, they need to be sign extended to 64 bits.

TEST=cctest/test-run-machops/RunWord32AndAndWord32ShrP, cctest/test-run-machops/RunWord32OrP,
cctest/test-run-machops/RunWord32ShrP, cctest/test-run-machops/RunWord32XorP

BUG=

Review-Url: https://codereview.chromium.org/2147883002
Cr-Commit-Position: refs/heads/master@{#37705}
2016-07-13 09:04:33 +00:00
mstarzinger
04062e92cc [runtime] Fully remove RUNTIME_ASSERT for good.
This fully deprecates all uses of the RUNTIME_ASSERT macro and removes
the macro and underlying logging function in question. All uses have
been replaces with CHECK macros which crash safely even in production.

It makes sure we discover abuse of runtime functions in the wild early
and also abort the process safely. Breaking assumptions in any runtime
function can no longer accidentally be caught by JavaScript.

R=yangguo@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2132493002
Cr-Commit-Position: refs/heads/master@{#37704}
2016-07-13 08:36:04 +00:00
mstarzinger
08843650db [turbofan] Respect catch prediction provided by parser.
This makes sure the {AstGraphBuilder} respects the catch-prediction that
is provided by the parser along with each {TryStatement}. This is needed
for try-blocks materialized by the parser not to influence predictions
users expect when using the debugger.

R=neis@chromium.org
TEST=mjsunit/debug-exceptions
BUG=v8:5183

Review-Url: https://codereview.chromium.org/2147573002
Cr-Commit-Position: refs/heads/master@{#37702}
2016-07-13 08:13:18 +00:00
danno
574f6fe127 [turbofan] Support subtraction displacements in BaseWithIndexAndDisplacementMatcher
Previously, the following schedule fragment:

 1: Parameter[0](0)
 2: Parameter[1](0)
 7: Int32Constant[1]
 8: Int32Sub(2, 7)
 9: Load[kRepTagged|kTypeAny](1, 8)

would generate the following code (on ia32):

 mov eax,[ebp+0x8]
 mov ecx,[ebp+0xc]
 sub eax,0x1
 mov eax,[eax+ecx*1]

Now it generates:

 mov eax,[ebp+0x8]
 mov ecx,[ebp+0xc]
 mov eax,[eax+ecx*1-1]

Similar pattern matching also now works on x64.

BUG=v8:5192
LOG=N

Review-Url: https://codereview.chromium.org/2137323003
Cr-Commit-Position: refs/heads/master@{#37701}
2016-07-13 08:03:38 +00:00
mythria
fd420203ec [Interpreter] Collect type feedback for calls in the bytecode handler
Collect type feedback in the call bytecode handler. The current
implementation only collects feedback for JS function objects. The other
objects and Array functions do not collect any feedback. They will be
marked Megamorphic.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2122183002
Cr-Commit-Position: refs/heads/master@{#37700}
2016-07-13 08:00:23 +00:00
bmeurer
3861e51322 [turbofan] Properly optimize JSToBoolean with Number inputs.
For JSToBoolean with Number inputs we still called out to the
ToBooleanStub, even though we easily handle them inline nowadays.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2145923002
Cr-Commit-Position: refs/heads/master@{#37699}
2016-07-13 08:00:22 +00:00
jpp
974f4a8059 V8. ASM-2-WASM. Validator V2.
This is a rewrite of the ASM validator. This one follows the spec instead of using the AST visitors.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=cctest/asmjs/test-asm-typer
TEST=cctest/asmjs/test-typing-asm
LOG=N

Review-Url: https://codereview.chromium.org/2071343003
Cr-Commit-Position: refs/heads/master@{#37694}
2016-07-12 23:12:08 +00:00
aseemgarg
cd95c600be [wasm] allow array access with unsigned indices
BUG=618608
R=bradnelson@chromium.org
TEST=regress-618608.js

Review-Url: https://codereview.chromium.org/2138243002
Cr-Commit-Position: refs/heads/master@{#37693}
2016-07-12 21:56:38 +00:00
mtrofin
81f42220a6 [wasm] cloning compiled module before instantiation
To correctly support instantiating a compiled module multiple times, we clone the
compiled module each time we create an instance, since some of the data is specific
to the instance - e.g. export code, wasm functions, indirect table.

BUG=v8:5072

Review-Url: https://codereview.chromium.org/2134593002
Cr-Commit-Position: refs/heads/master@{#37692}
2016-07-12 21:37:21 +00:00
littledan
117fda1401 [parser] report errors for invalid binding patterns in async formal parameters
BUG=v8:4483, v8:5190

R=caitp@igalia.com, nikolaos@chromium.org

Review-Url: https://codereview.chromium.org/2139063002
Cr-Commit-Position: refs/heads/master@{#37691}
2016-07-12 19:50:09 +00:00
neis
457c02573c Make toLocaleString on arrays always call toLocaleString on its elements.
As required by the spec.

BUG=v8:5113

Review-Url: https://codereview.chromium.org/2141603002
Cr-Commit-Position: refs/heads/master@{#37689}
2016-07-12 17:33:36 +00:00
ssanfilippo
9b9f885e99 Revert of Implement .eh_frame writer and disassembler. (patchset #72 id:2030001 of https://codereview.chromium.org/2023503002/ )
Reason for revert:
The STATIC_CONST_MEMBER_DEFINITION in eh-frame-writer-unittest.cc causes a compiler error on V8 Win64 - clang buildbot. Removing that bit should be sufficient.

Original issue's description:
> Implement .eh_frame writer and disassembler.
>
> Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
> to a EhFrameWriter and will attach unwinding information to the code
> object when passed one.
>
> BUG=v8:4899
> LOG=N
>
> Committed: https://crrev.com/27d810e63b744b5b3d9aa28ff21413247773e6c2
> Cr-Commit-Position: refs/heads/master@{#37683}

TBR=rmcilroy@chromium.org,jarin@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4899

Review-Url: https://codereview.chromium.org/2143033002
Cr-Commit-Position: refs/heads/master@{#37688}
2016-07-12 16:17:34 +00:00
epertoso
60c95d85ab [turbofan] Move TryCloneBranch in the EffectControlLinearizer pass.
When trying to clone a branch, the ControlFlowOptimizer gave up as soon as it found a Phi/EffectPhi node that could not be placed directly below the IfTrue or IfFalse control paths.

Moving the step in the EffectControlLinearizer phase, after the first schedule, works around the problem by looking at the successor blocks.

BUG=

Review-Url: https://codereview.chromium.org/2139593002
Cr-Commit-Position: refs/heads/master@{#37687}
2016-07-12 15:23:36 +00:00
neis
8f1f1cb1c7 Move catch prediction into frontend and make it aware of rethrows.
This solves an issue with throws inside for-of always being marked as caught.

BUG=v8:5183

Review-Url: https://codereview.chromium.org/2146493002
Cr-Commit-Position: refs/heads/master@{#37686}
2016-07-12 15:23:35 +00:00
hpayer
ea90556a2f [heap] Untangle Marking and friends from heap dependencies.
BUG=

Review-Url: https://codereview.chromium.org/2139133003
Cr-Commit-Position: refs/heads/master@{#37685}
2016-07-12 15:10:52 +00:00
ssanfilippo
27d810e63b Implement .eh_frame writer and disassembler.
Also, CodeGenerator::MakeCodeEpilogue now accepts an optional pointer
to a EhFrameWriter and will attach unwinding information to the code
object when passed one.

BUG=v8:4899
LOG=N

Review-Url: https://codereview.chromium.org/2023503002
Cr-Commit-Position: refs/heads/master@{#37683}
2016-07-12 15:04:29 +00:00
cbruni
d234118e29 Revert of making heap verification more aggressive (patchset #7 id:120001 of https://codereview.chromium.org/2126613002/ )
Reason for revert:
failing gc stress tests: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/7223/steps/Mjsunit/logs/stdio

Original issue's description:
> [runtime] making heap verification more aggressive
>
> - check that packed elements do not contain the_hole (with fix)
> - verify argument objects with elements kind
> - use JSObjectVerifiy in all JSObject "subclasses"
> - change initialization order for ArrayLiteralBoilerplate to simplify verification
>
> BUG=v8:5188
>
> Committed: https://crrev.com/599aa2e106ca8ab79f5cc489d1b93b6a26b19714
> Cr-Commit-Position: refs/heads/master@{#37680}

TBR=ishell@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5188

Review-Url: https://codereview.chromium.org/2140163002
Cr-Commit-Position: refs/heads/master@{#37682}
2016-07-12 14:07:17 +00:00
cbruni
599aa2e106 [runtime] making heap verification more aggressive
- check that packed elements do not contain the_hole (with fix)
- verify argument objects with elements kind
- use JSObjectVerifiy in all JSObject "subclasses"
- change initialization order for ArrayLiteralBoilerplate to simplify verification

BUG=v8:5188

Review-Url: https://codereview.chromium.org/2126613002
Cr-Commit-Position: refs/heads/master@{#37680}
2016-07-12 13:32:03 +00:00
mstarzinger
6e38f4270a [test] Remove NaCl support from test runner harness.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141013002
Cr-Commit-Position: refs/heads/master@{#37678}
2016-07-12 13:18:49 +00:00
mstarzinger
88402eccc7 [turbofan] Re-enable tests no longer failing on ARM hardware.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141563002
Cr-Commit-Position: refs/heads/master@{#37677}
2016-07-12 12:44:11 +00:00
oth
b215c9e5b8 Address compilation warnings for android build.
LOG=N
BUG=

Review-Url: https://codereview.chromium.org/2135573002
Cr-Commit-Position: refs/heads/master@{#37676}
2016-07-12 11:21:56 +00:00
jgruber
a0c7ab6306 Remove detailed from simple stack trace functionality
This is another point where we add inconsistent behavior between simple and
detailed stack traces. The functionality also does not seem to be used in
chrome anymore when uncaught exceptions are thrown.  Remove it to reduce
maintenance burden.

BUG=624285
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2141523002
Cr-Commit-Position: refs/heads/master@{#37673}
2016-07-12 10:24:57 +00:00
ahaas
b571026f26 [test] Change or replace unrepresentable number in the lists of float test values.
I removed or replaced some values in the list of float and double values
in value-helper.h which cannot be represented precisely as floats or
doubles, respectively.

R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2135243004
Cr-Commit-Position: refs/heads/master@{#37671}
2016-07-12 10:09:06 +00:00
mstarzinger
f3ca214222 [turbofan] Speed up structural graph verification.
This removes the checking for use-def and def-use chain links from the
graph verification. Presence of such links can only be violated by a bug
in the actual {Node} implementation itself. That container class is also
covered by unit tests.

The verification in question was useful in the early days when the graph
implementation itself was prone to bugs. By now it has stabilized and
spending O(n^2) time during graph verification is too wasteful to still
be considered a reasonable trade-off.

R=jarin@chromium.org
TEST=unittests/NodeTest.*

Review-Url: https://codereview.chromium.org/2140973003
Cr-Commit-Position: refs/heads/master@{#37670}
2016-07-12 09:31:12 +00:00
bmeurer
85969edead [turbofan] Unify BooleanToNumber, StringToNumber and PlainPrimitiveToNumber.
The PlainPrimitiveToNumber operator performs a superset of the operations
previously performed by the BooleanToNumber and StringToNumber operators,
so we can just use the special lowering rules for PlainPrimitiveToNumber
based on the input type and get rid of the specialized operators.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2139183002
Cr-Commit-Position: refs/heads/master@{#37669}
2016-07-12 09:15:11 +00:00
danno
e92e911814 [turbofan] Robustify tail parameter stack size computations
This CL separates the check whether something is tail-callable from
the computation of the size of the stack parameters that a function
takes.

In order to track this precisely, the stack parameter size calculation
uses the recently landed MachineType information that's embedded
in return and parameter value LinkageLocations.

Review-Url: https://codereview.chromium.org/2121753002
Cr-Commit-Position: refs/heads/master@{#37668}
2016-07-12 08:40:49 +00:00
bmeurer
4e862dd964 [intrinsics] Remove obsolete intrinsics.
Remove obsolete definitions from macros.py, and drop the now obsolete
%_ToPrimitive, %_ToPrimitive_Number, %_ToPrimitive_String, %_ToName
and the %ToPrimitive_String intrinsics/runtime entries.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2137203002
Cr-Commit-Position: refs/heads/master@{#37665}
2016-07-12 06:41:23 +00:00
yangguo
bbb2159d4c [regexp] Fix regexp source escaping with preceding backslashes.
R=franzih@chromium.org
BUG=chromium:515897

Review-Url: https://codereview.chromium.org/2137033002
Cr-Commit-Position: refs/heads/master@{#37664}
2016-07-12 05:36:17 +00:00
jochen
992e34c216 Don't compile functions in a context the caller doesn't have access to
Instead just return undefined

A side effect of this is that it's no longer possible to compile
functions in a detached context.

BUG=chromium:541703
R=verwaest@chromium.org,bmeurer@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2034083002
Cr-Commit-Position: refs/heads/master@{#37657}
2016-07-11 20:11:51 +00:00
jwolfe
b8668fa846 Recognize HTMLCloseComment after multiline comment
When the scanner finds a '-->', it's either part of an HTMLCloseComment
or a '--' followed by a '>'. Previously, only a preceding newline would
make it an HTMLCloseComment. Now, a preceding multiline comment also
makes it an HTMLCloseComment. The effect is that now the following is
not a SyntaxError:

x/*
*/-->this is now a comment

BUG=v8:5142
LOG=y

Review-Url: https://codereview.chromium.org/2119763003
Cr-Commit-Position: refs/heads/master@{#37656}
2016-07-11 20:05:24 +00:00
littledan
77cbe27689 Narrowly address async function stack overflow parsing case
This patch just checks for a stack overflow and returns failure
from the cases which Clusterfuzz found. However, there may be
more locations in the parser which need similar treatment.

R=caitpotter88@gmail.com,neis
BUG=v8:4483,chromium:624300

Review-Url: https://codereview.chromium.org/2135503002
Cr-Commit-Position: refs/heads/master@{#37655}
2016-07-11 19:33:43 +00:00
bbudge
56d013d481 [Turbofan] Support 128 bit moves/swaps for x64.
LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2139513002
Cr-Commit-Position: refs/heads/master@{#37654}
2016-07-11 18:21:50 +00:00
aseemgarg
8474f24450 [wasm] throw in case of assignment to module parameters
BUG=613928
R=bradnelson@chromium.org
TEST=regress-613928.js

Review-Url: https://codereview.chromium.org/2123283007
Cr-Commit-Position: refs/heads/master@{#37653}
2016-07-11 17:41:30 +00:00
ishell
b030a6f59d [runtime] Follow-up fix for "Better encapsulation of dictionary objects handling in lookup iterator."
BUG=chromium:626715

Review-Url: https://codereview.chromium.org/2135253002
Cr-Commit-Position: refs/heads/master@{#37651}
2016-07-11 15:51:58 +00:00
hpayer
8551daee4d TestCodeFlushingIncrementalScavenge should not allocate on black pages.
BUG=

Review-Url: https://codereview.chromium.org/2138783002
Cr-Commit-Position: refs/heads/master@{#37648}
2016-07-11 15:20:05 +00:00
mstarzinger
136e60a7ce [turbofan] Remove eager frame state from comparisons.
This removes the frame state input representing the before-state from
nodes having any comparison operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2134173002
Cr-Commit-Position: refs/heads/master@{#37646}
2016-07-11 14:25:42 +00:00
mstarzinger
ecfec3b039 [turbofan] Respect pretenuring of heap numbers.
This extends pretenuring decisions based on allocation sites to heap
numbers that are allocated as part of object literals. It ensures memory
locality of a bigger enclosure of the deep copy of an object literal.

R=bmeurer@chromium.org
TEST=cctest/test-heap/OptimizedPretenuringMixedInObjectProperties

Review-Url: https://codereview.chromium.org/2135933002
Cr-Commit-Position: refs/heads/master@{#37645}
2016-07-11 14:15:24 +00:00
titzer
9be74f6687 [wasm] Add a BytecodeIterator and use in non-performance-critical situations.
R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2135693002
Cr-Commit-Position: refs/heads/master@{#37642}
2016-07-11 13:00:27 +00:00
peterssen
e28b16265a Fix FastAccessorAssembler inverted jump conditions
BUG=chromium:508898

Review-Url: https://codereview.chromium.org/2135153002
Cr-Commit-Position: refs/heads/master@{#37640}
2016-07-11 12:38:17 +00:00
rmcilroy
4f2d37da0c [Interpreter] Add ClassOf intrinsic.
BUG=v8:4280

Review-Url: https://codereview.chromium.org/2128233002
Cr-Commit-Position: refs/heads/master@{#37637}
2016-07-11 11:48:21 +00:00
mstarzinger
f57b0604ed [crankshaft] Re-enable Math.min/max tests that no longer fail.
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2132373002
Cr-Commit-Position: refs/heads/master@{#37635}
2016-07-11 11:14:00 +00:00
caitp
08d0012dda [keys] propagate PropertyFilter to proxy targets in KeyAccumulator
BUG=v8:5174, v8:1543
R=cbruni@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2129193003
Cr-Commit-Position: refs/heads/master@{#37634}
2016-07-11 10:39:35 +00:00
danno
3e2085eba4 [turbofan] Add MachineType to LinkageLocation
By adding MachineType to LinkageLocation, it is possible not only to reason
about the location of a LinkageLocation on the stack, but also about it's
size. This will be useful in follow-on CLs that attempt to merge some of the
parameter passing logic of tail calls and normal (non-tail) calls.

As a nice side-effect, it is no longer necessary to separately keep a
MachineSignature in a CallDescriptor, because the MachineTypes contianed in
LinkageLocation for all of the Descriptor's parameters and return types are
sufficient. This CL therefore removes the MachineSignature from the
CallDescriptor and adjusts all the calling code accordingly, simplifying and
de-duplicating code in a bunch of places.

R=titzer@chromium.org, bmeurer@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2124023003
Cr-Commit-Position: refs/heads/master@{#37633}
2016-07-11 10:39:34 +00:00
jgruber
be5808bff8 Correctly format builtin constructors in stack traces
CallSite::IsConstructor() was unable to recognize builtin construct stubs
(NumberConstructor_ConstructStub and StringConstructor_ConstructStub) as
constructors, and thus these frames were not formatted correctly in stack
traces.

Fix this by explicitly marking their Code objects as construct stubs and
passing along a special receiver value when we encounter such cases in
CaptureSimpleStackTrace.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2125163004
Cr-Commit-Position: refs/heads/master@{#37631}
2016-07-11 10:05:03 +00:00
mstarzinger
7dbc223983 [turbofan] Enable pretenuring tests for optimized code.
This enables tests which verify allocation site feedback is used and
influences pretenuring decisions. By now TurboFan is respecting such
feedback. Ignition however doesn't provide such feedback yet.

R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2135563003
Cr-Commit-Position: refs/heads/master@{#37628}
2016-07-11 08:40:58 +00:00
machenbach
4af2bb9e38 Revert three commits due to cpu-profiler failures.
Revert "Move SimulatorHelper into V8 out of profiler clients."

This reverts commit b837241150.

Revert "Make use of v8::TickSample instead of v8::internal::TickSample in logger."

This reverts commit c3a16f0a9f.

Revert "Clean up SimulatorHelper code."

This reverts commit 8ee236e144.

BUG=v8:5193
TBR=alph@chromium.org, yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2138643003
Cr-Commit-Position: refs/heads/master@{#37626}
2016-07-11 08:03:26 +00:00
yangguo
dfcc5d4ee8 [debugger] omit exception events for rethrown exceptions in async.
R=bmeurer@chromium.org, littledan@chromium.org
BUG=v8:5167

Review-Url: https://codereview.chromium.org/2124813002
Cr-Commit-Position: refs/heads/master@{#37623}
2016-07-11 05:50:03 +00:00
bmeurer
03bde2660a [turbofan] Introduce CheckedInt32Div and CheckedInt32Mod operators.
Consume Smi/Signed32 feedback for division and modulus and introduce
appropriate checked operators. This is especially important for modulus
where the Float64Mod operator is significantly slower than Int32Mod on
most platforms. For division it's mostly important to propagate
integerness, i.e. to avoid follow-up conversions between float and
int32.

Drive-by-fix: Use Int32Mod for the ModulusStub (and the bytecode handler)
when the inputs are both Smi.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2138633002
Cr-Commit-Position: refs/heads/master@{#37621}
2016-07-11 05:27:55 +00:00
alph
b837241150 Move SimulatorHelper into V8 out of profiler clients.
Clients should not know about the simulator.

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2128613004
Cr-Commit-Position: refs/heads/master@{#37617}
2016-07-08 23:52:49 +00:00
littledan
97e8046e44 Avoid calling the builtin String.prototype.split in Intl
The Intl code previously called the initial value of String.prototype.split
for some internal operations. However, this did not have the intended effect
as Intl only needs to split strings by strings, but String.prototype.split
has integration with Symbol.split for RegExps.

This patch replaces the calls of StringSplit in the Intl implementation
with direct calls to the %StringSplit runtime function to avoid the issue.

R=yangguo@chromium.org
BUG=v8:5179

Review-Url: https://codereview.chromium.org/2126073002
Cr-Commit-Position: refs/heads/master@{#37615}
2016-07-08 16:53:09 +00:00
alph
120b753f71 Introduce v8::CpuProfiler::New and v8::CpuProfiler::Dispose API.
Isolate is not going to retain a CPU profiler.
The client will be creating an instance of profiler when needed.

Deprectate v8::Isolate::GetCpuProfiler()

BUG=v8:4789

Review-Url: https://codereview.chromium.org/2117343006
Cr-Commit-Position: refs/heads/master@{#37613}
2016-07-08 15:01:10 +00:00
mstarzinger
3660505e5f [turbofan] Re-enable debugger tests that no longer fail.
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2127423002
Cr-Commit-Position: refs/heads/master@{#37609}
2016-07-08 12:49:53 +00:00
Michael Starzinger
2c09760ac4 [turbofan] Re-enable test that no longer fails.
This enables tests which rely on the context available at "debugger"
statements to be accurate. This is the case by now when deoptimization
information is available.

R=yangguo@chromium.org
BUG=v8:4055

Review URL: https://codereview.chromium.org/2129123002 .

Cr-Commit-Position: refs/heads/master@{#37604}
2016-07-08 09:52:07 +00:00
yangguo
3885fa0974 Do not record source positions for non-script or native script compiles.
R=bmeurer@chromium.org, mstarzinger@chromium.org, rmcilroy@chromium.org

Review-Url: https://codereview.chromium.org/2112853002
Cr-Commit-Position: refs/heads/master@{#37602}
2016-07-08 08:49:45 +00:00
lpy
4e53b1a1a7 Remove v8- prefix of file name in libsampler.
BUG=

Review-Url: https://codereview.chromium.org/2125023004
Cr-Commit-Position: refs/heads/master@{#37599}
2016-07-08 06:47:54 +00:00
jgruber
d49d3864d7 [builtins] Construct builtin frame in String/Number ctors
BUG=v8:5173
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2118283003
Cr-Commit-Position: refs/heads/master@{#37598}
2016-07-08 06:38:19 +00:00
ben
1f53e42bd6 Handle symbols in FrameMirror#invocationText().
Fix a TypeError when putting together the invocationText for a symbol
method's stack frame.

See https://github.com/nodejs/node/issues/7536.

Review-Url: https://codereview.chromium.org/2122793003
Cr-Commit-Position: refs/heads/master@{#37597}
2016-07-07 21:32:03 +00:00
franzih
2f36ee7176 [builtins] Migrate SharedArrayBuffer.byteLength to C++.
Drive-by-fix: hydrogen code does not blindly return the
byteLength offset, instead it executes what is defined
in the byteLength getter.

BUG=

Review-Url: https://codereview.chromium.org/2123263002
Cr-Commit-Position: refs/heads/master@{#37595}
2016-07-07 19:44:23 +00:00
jochen
0058f82e2c Add an API to create a detached global object
Such an object can be used to later create a context from it. It has to
have access checks with handlers enabled, as it cannot be accessed
otherwise.

BUG=chromium:618305
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2107673003
Cr-Commit-Position: refs/heads/master@{#37594}
2016-07-07 19:38:08 +00:00
mstarzinger
b3b1bf279a [turbofan] Context in debugger is accurate by now.
This enables tests which rely on the context available at "debugger"
statements to be accurate. This is the case by now when deoptimization
information is available.

R=mvstanton@chromium.org
BUG=v8:4035

Review-Url: https://codereview.chromium.org/2125773005
Cr-Commit-Position: refs/heads/master@{#37590}
2016-07-07 14:26:52 +00:00
mstarzinger
67efc381b0 [turbofan] Re-enable tests that no longer fail.
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2127093002
Cr-Commit-Position: refs/heads/master@{#37589}
2016-07-07 13:40:00 +00:00
mstarzinger
07612e0d35 [test] Remove obsolete mjsunit/call-counts test.
R=mvstanton@chromium.org
BUG=v8:4458

Review-Url: https://codereview.chromium.org/2129903002
Cr-Commit-Position: refs/heads/master@{#37584}
2016-07-07 12:04:11 +00:00
mstarzinger
bae7870c41 [turbofan] Re-enable tests that are not longer too slow.
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2132503002
Cr-Commit-Position: refs/heads/master@{#37583}
2016-07-07 11:30:15 +00:00
jkummerow
b36237b8a3 [ForIn] Fix HasEnumerableProperty for Proxies with null prototype
BUG=v8:5181

Review-Url: https://codereview.chromium.org/2129563002
Cr-Commit-Position: refs/heads/master@{#37577}
2016-07-07 10:12:06 +00:00
neis
d3aefe8cc3 [parser] Fix bug in for-of desugaring.
When reading the value property of an iterator result fails, we must not close the iterator.
This was not discovered earlier because the tests had a subtle bug.

This CL fixes both the desugaring and the tests.

BUG=

Review-Url: https://codereview.chromium.org/2119353002
Cr-Commit-Position: refs/heads/master@{#37571}
2016-07-07 08:16:13 +00:00
neis
4a4f7175df [parser] Fix bug in destructuring binding for catch.
For variables introduced as part of a catch pattern, we used to set their
"initializer position" to the beginning of the pattern.  This lead to
full-codegen eliminating crucial hole checks when reading such variables
inside the pattern itself.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:5178

Review-Url: https://codereview.chromium.org/2123953002
Cr-Commit-Position: refs/heads/master@{#37569}
2016-07-07 07:31:16 +00:00
lpy
3172f6a9ce Expose TickSample and its APIs in v8-profiler.h
We want to eventually move the profiling functionality out of V8 as library,
this patch exposes TickSample and its APIs in v8-profiler.h so that when
embedders use library, they can have more details.

Minor change: Rename tick-sample.[h|cc] to simulator-helper.[h|cc].

BUG=v8:4789
LOG=N

Review-Url: https://codereview.chromium.org/2105943002
Cr-Commit-Position: refs/heads/master@{#37564}
2016-07-06 18:40:31 +00:00
mvstanton
a80164ec43 [TurboFan] Improve Array constructor optimization
And in so doing, enable a handful of excluded tests.

BUG=

Review-Url: https://codereview.chromium.org/2127713003
Cr-Commit-Position: refs/heads/master@{#37559}
2016-07-06 15:17:10 +00:00
mlippautz
9f7fd3a554 [heap] Remove test running OOM on some bots
While the test was useful to reproduce the issue locally it creates a lot of
heap pressure and causes all sorts of troubles (OOM, slowness) on the bots, so
let's drop it.

R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2127803002
Cr-Commit-Position: refs/heads/master@{#37551}
2016-07-06 13:09:03 +00:00
mstarzinger
c4781e344c [runtime] Deprecate RUNTIME_ASSERT from debugger methods.
This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=yangguo@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2053573004
Cr-Commit-Position: refs/heads/master@{#37545}
2016-07-06 09:06:58 +00:00
neis
45a8167477 [debugger] Don't leak holes from generator arguments.
This is a quick fix for the hole leaking from generators via the debugger's frame
inspection feature: when collecting the arguments, convert each hole to undefined.
In the long term, we probably want to remember and restore the actual arguments
rather than pushing these dummy arguments on each resume.

BUG=v8:5164

Review-Url: https://codereview.chromium.org/2122923003
Cr-Commit-Position: refs/heads/master@{#37544}
2016-07-06 08:11:29 +00:00
jarin
7614362b7e [turbofan] Set elements kind to holey if constructing array of possibly non-zero length.
BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2126623003
Cr-Commit-Position: refs/heads/master@{#37543}
2016-07-06 07:55:36 +00:00
mlippautz
da3745d8d9 Reland "[heap] Track length for array buffers to avoid free-ing dependency"
The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

This reverts commit 1791d7bb9a.

Review-Url: https://codereview.chromium.org/2127643002
Cr-Commit-Position: refs/heads/master@{#37537}
2016-07-05 16:32:17 +00:00
verwaest
c2eb07505c Abort if we ever allocate a non-0-sized packed array
BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2122943002
Cr-Commit-Position: refs/heads/master@{#37535}
2016-07-05 15:52:09 +00:00
machenbach
1791d7bb9a Revert of [heap] Track length for array buffers to avoid free-ing dependency (patchset #2 id:20001 of https://codereview.chromium.org/2122603004/ )
Reason for revert:
[Sheriff] This makes mjsunit/regress/regress-625752 extremely slow on all gc stress bots and leads to timeouts with custom snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/6602

Original issue's description:
> [heap] Track length for array buffers to avoid free-ing dependency
>
> The dependency would only happen if we have a smi overflow for the length and
> have create a heap number. In this case the heap number would've to survive
> until the array buffer is collected.
>
> To avoid this dependency we track the length (as we previously used to).
>
> BUG=chromium:625748,chromium:625752
> LOG=N
> TEST=test/mjsunit/regress/regress-625752.js
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/ddc75cc1356a58b6cfd63f9da0586e1150496b3d
> Cr-Commit-Position: refs/heads/master@{#37530}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:625748,chromium:625752

Review-Url: https://codereview.chromium.org/2127483003
Cr-Commit-Position: refs/heads/master@{#37533}
2016-07-05 14:43:24 +00:00
oth
40511877eb [interpreter] Introduce binary op bytecodes for Smi operand.
Introduces fused bytecodes for fusing LdaSmi followed by a binary op bytecode.
The chosen bytecodes are used frequently in Octane: AddSmi, SubSmi,
BitwiseOrSmi, BitwiseAndSmi, ShiftLeftSmi, ShiftRightSmi.

There are additional code stubs for these operations that are biased towards
both the left hand and right hand operands being Smis.

BUG=v8:4280
LOG=N

Review-Url: https://codereview.chromium.org/2111923002
Cr-Commit-Position: refs/heads/master@{#37531}
2016-07-05 13:46:11 +00:00
mlippautz
ddc75cc135 [heap] Track length for array buffers to avoid free-ing dependency
The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625748,chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2122603004
Cr-Commit-Position: refs/heads/master@{#37530}
2016-07-05 13:15:22 +00:00
bmeurer
d70dc1ace4 [turbofan] Initial version of the new LoadElimination.
This adds a new optimization phase to the TurboFan pipeline, which walks
over the effect chain and tries to eliminate redundant loads (and even
some stores) of object fields. We currently ignore element access, but
that will probably need to be handled as well at some point. We also
don't have any special treatment to properly track object maps, which is
also on the list of things that will happen afterwards.

The implementation is pretty simple currently, and probably way to
inefficient. It's meant to be a proof-of-concept to iterate on.

R=jarin@chromium.org
BUG=v8:4930,v8:5141

Review-Url: https://codereview.chromium.org/2120253002
Cr-Commit-Position: refs/heads/master@{#37528}
2016-07-05 12:20:18 +00:00
mstarzinger
ee2d06e65f [unittests] Remove spurious language mode test dimension.
This just removes some left-overs from when the {JSTypedLoweringTest}
covered strong mode and an iteration over all language modes was used
for testing all binary operations. The language mode in question has
been removed since then.

R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2121113002
Cr-Commit-Position: refs/heads/master@{#37526}
2016-07-05 12:10:28 +00:00
mstarzinger
2620c4264a [turbofan] Remove eager frame state from add and subtract.
This removes the frame state input representing the before-state from
nodes having the {JSAdd} or the {JSSubtract} operator. Lowering that
inserts number conversions of the inputs has to be disabled when
deoptimization is enabled, because the frame state layout is no longer
known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2125593002
Cr-Commit-Position: refs/heads/master@{#37522}
2016-07-05 10:46:34 +00:00
yangguo
7a834e8b69 [debugger] add test case for throwing in generators.
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2117303003
Cr-Commit-Position: refs/heads/master@{#37520}
2016-07-05 10:12:33 +00:00
bmeurer
72275e6620 [intrinsic] Drop the %_ValueOf intrinsic.
This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
Review-Url: https://codereview.chromium.org/2126453002
Cr-Original-Commit-Position: refs/heads/master@{#37512}
Cr-Commit-Position: refs/heads/master@{#37519}
2016-07-05 10:05:40 +00:00
bmeurer
f50721d56d [turbofan] Recognize fast path for Number.parseInt.
The Number.parseInt (and therefore the parseInt function on the global
object) are often used instead of Math.floor or just plain int32
truncation, and we can easily recognize those cases and provide a fast
path in TurboFan.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2125583002
Cr-Commit-Position: refs/heads/master@{#37518}
2016-07-05 09:52:41 +00:00
mstarzinger
277fac44ff [turbofan] Remove eager frame state from JSMultiply.
This removes the frame state input representing the before-state from
nodes having the {JSMultiply} operator. Lowering that inserts number
conversions of the inputs has to be disabled when deoptimization is
enabled, because the frame state layout is no longer known.

R=jarin@chromium.org
BUG=v8:5021

Review-Url: https://codereview.chromium.org/2111193002
Cr-Commit-Position: refs/heads/master@{#37517}
2016-07-05 09:05:31 +00:00
zhengxing.li
f310a82952 X87: disable Acosh/ASinh test cases for x87.
The reason:
    same as the CL #37371 (Issue 2111493002: X87: disable some sin/cos/expm1/tan test cases for x87.), please
    refer https://codereview.chromium.org/2111493002 for more details.

    For Acosh/ASinh test cases, the expected values are pre-defined double precision values, the results
    generated by C++ function are extended double precision as the extended double precision is default for x87
    Gcc compiler and std lib on linux platform. The comparison of different precisons caused some of those test
    cases failed.

    This CL disables Acosh/ASinh test cases for x87.

BUG=

Review-Url: https://codereview.chromium.org/2122593002
Cr-Commit-Position: refs/heads/master@{#37516}
2016-07-05 08:59:09 +00:00
zhengxing.li
bf4ef548cc X87: disable test-gap-resolver/FuzzResolver test case for x87.
The reason:
  In CreateRandomOperand(), It used the register index 1 for ExplicitOperand(LocationOperand::REGISTER, rep,
  GetRegisterCode(rep, 1)).

  For x87 turbofan compiler, there's only 1 allocatable Float/Double register, i.e.: register index 0. the
  GetRegisterCode(rep, 1) in ExplicitOperand() always return false when rep is MachineRepresentation::kFloat32/kFloat64.

  It caused the test-gap-resolver/FuzzResolver failed at DCHECK_IMPLIES(kind == REGISTER && rep == MachineRepresentation::kFloat32,
  FloatRegister::from_code(index).IsAllocatable(RegisterConfiguration::TURBOFAN)), src/compiler/instruction.cc, line 259, under
  debug mode.

  This CL disable test-gap-resolver/FuzzResolver test case for x87.

BUG=

Review-Url: https://codereview.chromium.org/2120203002
Cr-Commit-Position: refs/heads/master@{#37515}
2016-07-05 08:55:56 +00:00
machenbach
0960beb0ef Revert of [intrinsic] Drop the %_ValueOf intrinsic. (patchset #2 id:20001 of https://codereview.chromium.org/2126453002/ )
Reason for revert:
[Sheriff] Breaks without i18n:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/8466

Original issue's description:
> [intrinsic] Drop the %_ValueOf intrinsic.
>
> This drops the %_ValueOf intrinsic, but keeps the runtime entry
> %ValueOf for now, by either migrating the functionality (mostly
> Debug mirror or toString/valueOf methods) to C++ or TurboFan
> builtins, or switching to the %ValueOf runtime call when it's
> not performance critical anyways.
>
> The %_ValueOf intrinsic was one of the last blockers for fixing
> the unsound machine operator typing in TurboFan.
>
> R=yangguo@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
> Cr-Commit-Position: refs/heads/master@{#37512}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2117273002
Cr-Commit-Position: refs/heads/master@{#37514}
2016-07-05 08:01:06 +00:00
jgruber
971468031a Use toString tag to format receiver in stack traces
This concerns formatting of calls to, e.g., Math.acos in stack traces,
in which the receiver is an object with an attached toString tag. If
such a tag exists, use it to format the receiver typename to ensure that
the stack trace includes 'Math.acos' instead of 'Object.acos'.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2110683007
Cr-Commit-Position: refs/heads/master@{#37513}
2016-07-05 07:42:53 +00:00
bmeurer
293bd78829 [intrinsic] Drop the %_ValueOf intrinsic.
This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2126453002
Cr-Commit-Position: refs/heads/master@{#37512}
2016-07-05 06:47:53 +00:00
lpy
3ca49d9aec Split Ticker into two samplers.
Currently there are two logic in Ticker, one is to try to request a
pre-allocated TickSample from CpuProfiler and then initialize it, and if the
request fails, it will initialize a local TickSample. The other is it will pass
an initialized TickSample to Profiler to log into v8.log.

This patch splits Ticker into two samplers, the first one remains in log.cc to
collect samples and pass to Profiler for logging, the second one will be called
by ProfilerEventsProcessor, and only use the circular queue only.

BUG=v8:4789
LOG=N

Review-Url: https://codereview.chromium.org/2108393002
Cr-Commit-Position: refs/heads/master@{#37506}
2016-07-04 19:23:03 +00:00
caitpotter88
8134986917 [builtins] don't create keys for undefined property descriptors in O.gOPDs
Implements the change proposed at https://github.com/tc39/ecma262/pull/593.

In summary, Object.getOwnPropertyDescriptors can produce results which cause
Object.defineProperties() to throw, by inserting a property with an undefined
descriptor into the result object. This change to the algorithm requires that
the descriptor only be added to the result object if it is not undefined.

BUG=v8:4725
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118613003
Cr-Commit-Position: refs/heads/master@{#37504}
2016-07-04 18:04:05 +00:00
jgruber
f59a23356b [builtins] Add receiver to builtin exit frames
Stack trace generation requires access to the receiver; and while the
receiver is already on the stack, we cannot determine its position
during stack trace generation (it's stored in argv[0], and argc is only
stored in a callee-saved register).

This patch grants access to the receiver by pushing argc onto builtin
exit frames as an extra argument. Compared to simply pushing the
receiver, this requires an additional dereference during stack trace
generation, but one fewer during builtin calls.

BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106883003
Cr-Commit-Position: refs/heads/master@{#37500}
2016-07-04 12:46:47 +00:00
ishell
43aee0331d [fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a keyed store to a super.
BUG=chromium:625590

Review-Url: https://codereview.chromium.org/2120963002
Cr-Commit-Position: refs/heads/master@{#37497}
2016-07-04 11:42:39 +00:00
ishell
acd674db10 [crankshaft] Use canonical nan_value or minus_zero_value objects instead of constant heap numbers with NaN or -0.0 values.
BUG=chromium:625547

Review-Url: https://codereview.chromium.org/2115413002
Cr-Commit-Position: refs/heads/master@{#37495}
2016-07-04 09:59:26 +00:00
jarin
9fdacb9e55 [turbofan] Better handling of empty type in simplified lowering.
The re-typer now only types a node if its inputs are all typed with the
exception of phi nodes. This works because all cycles in the graph have
to contain a phi node.

BUG=chromium:625558

Review-Url: https://codereview.chromium.org/2120243002
Cr-Commit-Position: refs/heads/master@{#37493}
2016-07-04 08:43:12 +00:00
zhengxing.li
a21bc23d53 X87: [ia32] Fixes a wrong use of Operand in a test.
port c0d4bb89a1 (r37370)

  original commit message:
  Operand(reg) -> reg
  Operand(reg, 0) -> [reg]

BUG=

Review-Url: https://codereview.chromium.org/2119103002
Cr-Commit-Position: refs/heads/master@{#37489}
2016-07-04 04:23:19 +00:00
hablich
9c0aef52fa Revert of Amends the TypedArray constructor to use the path for primitives for all (patchset #4 id:60001 of https://codereview.chromium.org/2096873002/ )
Reason for revert:
Speculative revert to unblock roll https://codereview.chromium.org/2114113002/

Original issue's description:
> Amends the TypedArray constructor to use the path for primitives for all
> types of primitives, not just undefined, booleans, numbers, and strings.
> (The missing cases were null and Symbol.) This is required by the
> specification, and there are test262 tests which we were failing due to
> this bug.
>
> BUG=v8:5124
>
> Committed: https://crrev.com/f788bd9cce19815cba746e47bb65abfe25c16208
> Committed: https://crrev.com/f772c22cd1c492aa0235a8e6012d0386146d2eb2
> Cr-Original-Commit-Position: refs/heads/master@{#37234}
> Cr-Commit-Position: refs/heads/master@{#37407}

TBR=littledan@chromium.org,bakkot@google.com
NOTREECHECKS=true
BUG=v8:5124

Review-Url: https://codereview.chromium.org/2120763002
Cr-Commit-Position: refs/heads/master@{#37487}
2016-07-02 14:53:11 +00:00
caitpotter88
cd9e5f30ea [builtins] make AsyncFunction constructor a subclass of Function
Corrects a small problem with the current implementation of the AsyncFunction
constructor.

See https://tc39.github.io/ecmascript-asyncawait/#async-function-constructor for
details.

BUG=v8:4483
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118653004
Cr-Commit-Position: refs/heads/master@{#37484}
2016-07-01 22:52:40 +00:00
littledan
0ff7b4830c Implement immutable prototype chains
This patch implements "immutable prototype exotic objects" from the ECMAScript
spec, which are objects whose __proto__ cannot be changed, but are not otherwise
frozen. They are introduced in order to prevent a Proxy from being introduced
to the prototype chain of the global object.

The API is extended by a SetImmutablePrototype() call in ObjectTemplate, which
can be used to vend new immutable prototype objects. Additionally, Object.prototype
is an immutable prototype object.

In the implementation, a new bit is added to Maps to say whether the prototype is
immutable, which is read by SetPrototype. Map transitions to the immutable prototype
state are not saved in the transition tree because the main use case is just for
the prototype chain of the global object, which there will be only one of per
Context, so no need to take up the extra word for a pointer in each full transition
tree.

BUG=v8:5149

Review-Url: https://codereview.chromium.org/2108203002
Cr-Commit-Position: refs/heads/master@{#37482}
2016-07-01 19:20:11 +00:00
mstarzinger
a757a62bf5 [turbofan] Broaden checkpoint elimination on returns.
This makes the elimination of checkpoints flowing effect-wise into nodes
having the {Return} operator more permissive. We can cut out checkpoints
even when they are not wholly owned by the return. This also alleviates
a problem where TCO no longer applies.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624747
BUG=chromium:624747

Review-Url: https://codereview.chromium.org/2118793002
Cr-Commit-Position: refs/heads/master@{#37480}
2016-07-01 13:53:45 +00:00
bmeurer
9c281f2407 [turbofan] Properly lower NumberSinh, NumberCosh and NumberTanh.
R=jarin@chromium.org
BUG=chromium:625121

Review-Url: https://codereview.chromium.org/2116533004
Cr-Commit-Position: refs/heads/master@{#37479}
2016-07-01 12:53:04 +00:00
titzer
ac4fdca6c9 [wasm] Dont ship by default.
R=mstarzinger@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2118733003
Cr-Commit-Position: refs/heads/master@{#37478}
2016-07-01 11:37:47 +00:00
danno
bd0d9e7d87 [turbofan]: Support using push instructions for setting up tail call parameters
This optimizes the passing of stack parameters in function calls.

For some architectures (ia32/x64), using pushes when possible instead
of bumping the stack and then storing parameters generates much
smaller code, and in some cases is faster (e.g. when a push of a memory
location can implement a memory-to-memory copy and thus elide an
intermediate load. On others (e.g. ARM), the benefit is smaller, where
it's only possible to elide direct stack pointer adjustment in certain cases
or combine multiple register stores into a single instruction in other limited
situations. On yet other platforms (ARM64, MIPS), there are no push instructions,
and this optimization isn't used at all.

Ideally, this mechanism would be used for both tail calls and normal calls,
but "normal" calls are currently pretty efficient, and tail calls are very
inefficient, so this CL sets the bar low for building a new mechanism to
handle parameter pushing that only needs to raise the bar on tail calls for now.

The key aspect of this change is that adjustment to the stack pointer
for tail calls (and perhaps later real calls) is an explicit step separate from
instruction selection and gap resolution, but aware of both, making it possible
to safely recognize gap moves that are actually pushes.

Review-Url: https://codereview.chromium.org/2082263002
Cr-Commit-Position: refs/heads/master@{#37477}
2016-07-01 11:28:19 +00:00
bmeurer
0a0fe8fb8b [builtins] Unify most of the remaining Math builtins.
Import fdlibm versions of acos, acosh, asin and asinh, which are more
precise and produce the same result across platforms (we were using
libm versions for asin and acos so far, where both speed and precision
depended on the operating system so far). Introduce appropriate TurboFan
operators for these functions and use them both for inlining and for the
generic builtin.

Also migrate the Math.imul and Math.fround builtins to TurboFan builtins
to ensure that their behavior is always exactly the same as the inlined
TurboFan version (i.e. C++ truncation semantics for double to float
don't necessarily meet the JavaScript semantics).

For completeness, also migrate Math.sign, which can even get some nice
love in TurboFan.

Drive-by-fix: Some alpha-sorting on the Math related functions, and
cleanup the list of Math intrinsics that we have to export via the
native context currently.

BUG=v8:3266,v8:3496,v8:3509,v8:3952,v8:5169,v8:5170,v8:5171,v8:5172
TBR=rossberg@chromium.org
R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2116753002
Cr-Commit-Position: refs/heads/master@{#37476}
2016-07-01 11:13:02 +00:00
mstarzinger
920bc17c97 [turbofan] Fix eager bailout point after comma expression.
This ensures no eager bailout point is emitted after a comma expression
in test context where the right-hand side omitted an eager bailout point
as well. This is to stay in sync with full-codegen.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624919
BUG=chromium:624919

Review-Url: https://codereview.chromium.org/2113893004
Cr-Commit-Position: refs/heads/master@{#37475}
2016-07-01 09:51:50 +00:00
neis
9f5f31800e [modules] Refactor parsing of anonymous declarations in default exports.
BUG=

Review-Url: https://codereview.chromium.org/2111153002
Cr-Commit-Position: refs/heads/master@{#37474}
2016-07-01 09:21:32 +00:00
zhengxing.li
5a2f5c128f [x87] Enable test cases which failed at know issue that x87 change sNaN to qNaN by default.
Since the workaround (CL 36697 : 22a73e0d85) for sNaN issue works, enable those test cases.

BUG=

Review-Url: https://codereview.chromium.org/2114853002
Cr-Commit-Position: refs/heads/master@{#37472}
2016-07-01 07:35:58 +00:00
bradnelson
f20323dce2 Hooking up asm-wasm conversion.
Directs 'use asm' traffic through asm-wasm conversion when --validate-asm is passed.

Adds a builtin that handles the fallback to JS.

BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=asm-wasm
R=mstarzinger@chromium.org,titzer@chromium.org
LOG=N

Review-Url: https://codereview.chromium.org/2057403003
Cr-Commit-Position: refs/heads/master@{#37470}
2016-07-01 05:28:43 +00:00
zhengxing.li
d781b95619 X87: [ia32] Fixes a bug in cmpw.
port 588e15c034 (r37345)

  original commit message:
  The opcodes for 'cmpw r/m16, r16' and 'cmpw r16, r/m16' were swapped, causing a few issues when less than/greater than comparison were performed.

  Adds a regression test.

BUG=

Review-Url: https://codereview.chromium.org/2119793002
Cr-Commit-Position: refs/heads/master@{#37469}
2016-07-01 05:01:33 +00:00
bakkot
8834d5ecb5 Revert of Add errors for declarations which conflict with catch parameters. (patchset #6 id:100001 of https://codereview.chromium.org/2109733003/ )
Reason for revert:
Fuzzer claims `try {  \"\" ; } catch(x) { let x1 = [1,,], x = x; }` causes a crash.

Original issue's description:
> Add errors for declarations which conflict with catch parameters.
>
> Catch parameters are largely treated as lexical declarations in the
> block which contains their body for the purposes of early syntax errors,
> with some exceptions outlined in B.3.5. This patch introduces most of
> those errors, except those from `eval('for (var e of ...);')` inside of
> a catch with a simple parameter named 'e'.
>
> Note that annex B.3.5 allows var declarations to conflict with simple
> catch parameters, except when the variable declaration is the init of a
> for-of statement.
>
> BUG=v8:5112,v8:4231
>
> Committed: https://crrev.com/2907c726b2bb5cf20b2bec639ca9e6a521585406
> Cr-Commit-Position: refs/heads/master@{#37462}

TBR=littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2112223002
Cr-Commit-Position: refs/heads/master@{#37464}
2016-07-01 04:28:57 +00:00
bakkot
2907c726b2 Add errors for declarations which conflict with catch parameters.
Catch parameters are largely treated as lexical declarations in the
block which contains their body for the purposes of early syntax errors,
with some exceptions outlined in B.3.5. This patch introduces most of
those errors, except those from `eval('for (var e of ...);')` inside of
a catch with a simple parameter named 'e'.

Note that annex B.3.5 allows var declarations to conflict with simple
catch parameters, except when the variable declaration is the init of a
for-of statement.

BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2109733003
Cr-Commit-Position: refs/heads/master@{#37462}
2016-07-01 00:01:31 +00:00
adamk
54ce1935b5 [intl] Clean up function name handling in AddBoundMethod
AddBoundMethod, in i18n.js, returns functions all of which share the
same backing SharedFunctionInfo, which means that its calls to
InstallGetter were causing all such functions to have a single name
(that of the last caller, "get breakType").

This patch skips calling InstallGetter and instead directly calls
%DefineGetterPropertyUnchecked, which itself sets the name property
on the JSFunction instance (it knows how to do this in order to handle
getters that have computed property names).

Also takes care of a TODO having to do with the inner boundMethod:
its name is now made empty, by using a new macro that gets around
ES2015's function name inference.

Finally, removes a redundant %FunctionRemovePrototype: arrow functions
have no prototypes to begin with.

R=littledan@chromium.org
BUG=v8:4778

Review-Url: https://codereview.chromium.org/2109223002
Cr-Commit-Position: refs/heads/master@{#37459}
2016-06-30 20:10:42 +00:00
lpy
f20d6788e7 Enable ThreadTicks on Windows.
BUG=v8:5000

Review-Url: https://codereview.chromium.org/2106243002
Cr-Commit-Position: refs/heads/master@{#37454}
2016-06-30 15:36:08 +00:00
rmcilroy
02c3414d62 [Interpereter] Inline FastNewClosure into CreateClosure bytecode handler
BUG=v8:4280

Review-Url: https://codereview.chromium.org/2113613002
Cr-Commit-Position: refs/heads/master@{#37453}
2016-06-30 15:32:59 +00:00
verwaest
c17b44bd3a Fix double canonicalization
This turns the blacklist back into a white-list adding all binary operations as allowed operations. The one known fix is that it forces canonicalization of the double-hole as double constant.

BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2106393002
Cr-Commit-Position: refs/heads/master@{#37452}
2016-06-30 15:18:16 +00:00
ulan
5a8cfaf06d Fix clearing of slots on large page uncommit
BUG=chromium:624544
LOG=NO

Review-Url: https://codereview.chromium.org/2110213003
Cr-Commit-Position: refs/heads/master@{#37451}
2016-06-30 15:03:17 +00:00
littledan
34880eb3dc Revert of Put RegExp js code in strict mode (patchset #2 id:20001 of https://codereview.chromium.org/1776883005/ )
Reason for revert:
Found to break SAP Web IDE, and these semantics are not shipped in any other browser.
Revert to legacy semantics while assessing web compatibility.

BUG=chromium:624318

Original issue's description:
> Put RegExp js code in strict mode
>
> src/js/regexp.js was one of the few files that was left in sloppy
> mode. The ES2017 draft specification requires that writes to
> lastIndex throw when the property is non-writable, and test262
> tests enforce this behavior. This patch puts that file in strict
> mode.
>
> BUG=v8:4504
> R=yangguo@chromium.org
> LOG=Y
>
> Committed: https://crrev.com/80b1b2a45bbd9bf3d08e4e6516acfaaa8f438213
> Cr-Commit-Position: refs/heads/master@{#34801}

TBR=yangguo@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2112713003
Cr-Commit-Position: refs/heads/master@{#37449}
2016-06-30 14:36:34 +00:00
ahaas
de369129d2 [wasm] Detect unrepresentability in the float32-to-int32 conversion correctly on arm.
In the current implementation of wasm an unrepresentable input of the
float32-to-int32 conversion is detected by first truncating the input, then
converting the truncated input to int32 and back to float32, and then checking
whether the result is the same as the truncated input.

This input check does not work on arm and arm64 for an input of (INT32_MAX + 1)
because on these platforms the float32-to-int32 conversion results in INT32_MAX
if the input is greater than INT32_MAX.  When INT32_MAX is converted back to
float32, then the result is (INT32_MAX + 1) again because INT32_MAX cannot be
represented precisely as float32, and rounding-to-nearest results in (INT32_MAX
+ 1). Since (INT32_MAX + 1) equals the truncated input value, the input appears
to be representable.

With the changes in this CL, the result of the float32-to-int32 conversion is
incremented by 1 if the original result was INT32_MAX. Thereby the detection of
unrepresenable inputs in wasm works. Note that since INT32_MAX cannot be
represented precisely in float32, it can also never be a valid result of the
float32-to-int32 conversion.

@v8-mips-ports, can you do a similar implementation for mips?

R=titzer@chromium.org, Rodolph.Perfetta@arm.com

Review-Url: https://codereview.chromium.org/2105313002
Cr-Commit-Position: refs/heads/master@{#37448}
2016-06-30 14:30:44 +00:00
titzer
fa69cbb86b [turbofan] Allow OptionalOperator to return a placeholder.
R=bmeurer@chromium.org, ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2112733003
Cr-Commit-Position: refs/heads/master@{#37445}
2016-06-30 14:18:35 +00:00
bbudge
aca3716a50 [Turbofan] Add Simd128 registers to RegisterConfiguration.
-Defines SIMD128_REGISTERS for all platforms.
-Adds Simd128 register information to RegisterConfiguration, and implements
aliasing calculations.

LOG=N
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2092103004
Cr-Commit-Position: refs/heads/master@{#37437}
2016-06-30 11:29:36 +00:00
franzih
203391bcc0 [builtins] Migrate Math.abs() to TurboFan builtins.
Like the other Math builtins, Math.abs() is now a TurboFan builtin.
It uses RawMachineAssembler::Float64Abs().

R=bmeurer@chromium.org
BUG=v8:5163, v8:5086
LOG=N

Review-Url: https://codereview.chromium.org/2115493002
Cr-Commit-Position: refs/heads/master@{#37433}
2016-06-30 10:27:09 +00:00
bmeurer
bbc44c2696 [intrinsics] Drop the now obsolete %_DoubleHi and %_DoubleLo intrinsics.
These are no longer used, except in tests that test these intrinsics.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2114613002
Cr-Commit-Position: refs/heads/master@{#37432}
2016-06-30 10:21:13 +00:00
titzer
d249efd705 [wasm] Disassemble wasm code from script
This stores the wasm object and the function index in the script, and
adds functions to get the disassembled wasm code as well as the offset
table mapping from byte position to line and column in the disassembly
solely from the script.
This will be used to show "ui source code" in DevTools, and map raw
locations from the stack trace into this code view.

R=yangguo@chromium.org, ahaas@chromium.org, titzer@chromium.org
BUG=chromium:613110

patch from issue 2063013004 at patchset 80001 (http://crrev.com/2063013004#ps80001)

Review-Url: https://codereview.chromium.org/2105303002
Cr-Commit-Position: refs/heads/master@{#37430}
2016-06-30 09:57:07 +00:00
titzer
971731f354 [wasm] Fix receiver conversion for WASM->JS calls.
R=yangguo@chromium.org,ahaas@chromium.org
BUG=chromium:624713
LOG=Y

Review-Url: https://codereview.chromium.org/2111843002
Cr-Commit-Position: refs/heads/master@{#37428}
2016-06-30 09:41:43 +00:00
yangguo
141cddc720 Move RelocInfo::kNoPosition.
R=mstarzinger@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2109773004
Cr-Commit-Position: refs/heads/master@{#37426}
2016-06-30 09:29:30 +00:00
mvstanton
cede9ce5e1 [builtins] Unify Cosh, Sinh and Tanh as exports from flibm
BUG=v8:5086

Review-Url: https://codereview.chromium.org/2083573002
Cr-Commit-Position: refs/heads/master@{#37424}
2016-06-30 08:44:46 +00:00
hablich
b1f7f1f4e4 Revert of Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex. (patchset #8 id:140001 of https://codereview.chromium.org/2090353003/ )
Reason for revert:
Speculative revert to unblock roll: https://codereview.chromium.org/2107223003/

Original issue's description:
> Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex.
>
> The spec was modified to relax some requirements which implementors had not been
> enforcing. Part of this process involved introducing a new abstract operation
> ToIndex, which had partial overlap with our existing semantics as well as some
> differences (most notably treating undefined as 0). Test262 tests were introduced to
> check for the new semantics, some of which we were failing. This patch amends the
> parts of our implementation corresponding to specification algorithms which use
> ToIndex to follow its semantics precisely.
>
> BUG=v8:4784,v8:5120
>
> Committed: https://crrev.com/09720349ea058d178521ec58d0a5676443a5a132
> Cr-Commit-Position: refs/heads/master@{#37406}

TBR=littledan@chromium.org,adamk@chromium.org,bakkot@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2113593002
Cr-Commit-Position: refs/heads/master@{#37417}
2016-06-30 07:39:09 +00:00
jgruber
5febc27b5d [builtins] New frame type for exits to C++ builtins
Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel;tryserver.v8:v8_linux_nosnap_dbg

Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
Review-Url: https://codereview.chromium.org/2090723005
Cr-Original-Commit-Position: refs/heads/master@{#37384}
Cr-Commit-Position: refs/heads/master@{#37416}
2016-06-30 06:58:23 +00:00
adamk
7166503f6e Do all parsing for try/catch destructuring inside the appropriate scopes
Previously, any expressions inside destructuring patterns in a catch
would be parsed in the surrounding scope, instead of in the catch's
scope. This change fixes that by entering not only the catch scope,
but also the block scope inside it.

R=neis@chromium.org
BUG=v8:5106, v8:5112

Review-Url: https://codereview.chromium.org/2110193002
Cr-Commit-Position: refs/heads/master@{#37415}
2016-06-30 06:52:13 +00:00
gdeepti
8bd1e0dc88 [wasm] Explicitly Disallow heap allocation when wasm memory references are updated
- Enable grow memory tests on 32 bit windows
 - Use handles to module JSObject instead of object pointers

R=ahaas@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2105013004
Cr-Commit-Position: refs/heads/master@{#37409}
2016-06-29 23:42:42 +00:00
bakkot
f772c22cd1 Amends the TypedArray constructor to use the path for primitives for all
types of primitives, not just undefined, booleans, numbers, and strings.
(The missing cases were null and Symbol.) This is required by the
specification, and there are test262 tests which we were failing due to
this bug.

BUG=v8:5124

Committed: https://crrev.com/f788bd9cce19815cba746e47bb65abfe25c16208
Review-Url: https://codereview.chromium.org/2096873002
Cr-Original-Commit-Position: refs/heads/master@{#37234}
Cr-Commit-Position: refs/heads/master@{#37407}
2016-06-29 22:23:18 +00:00
bakkot
09720349ea Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex.
The spec was modified to relax some requirements which implementors had not been
enforcing. Part of this process involved introducing a new abstract operation
ToIndex, which had partial overlap with our existing semantics as well as some
differences (most notably treating undefined as 0). Test262 tests were introduced to
check for the new semantics, some of which we were failing. This patch amends the
parts of our implementation corresponding to specification algorithms which use
ToIndex to follow its semantics precisely.

BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2090353003
Cr-Commit-Position: refs/heads/master@{#37406}
2016-06-29 21:18:59 +00:00
bakkot
9bbba1441a Sloppy-mode function declarations in blocks are now hoisted appropriately.
In ES2016, function declarations nested in blocks are formally allowed. This was
never a part of ECMAScript, but was a common extension. Unfortunately
implementations differed in the exact semantics. Annex B.3.3 in the spec tries
to standardize the parts which are common to different implementations, but does
so with some fairly complicated semantics.

This CL addresses three issues related to annex B.3.3:
* When the outer function had a complex parameter list, no hoisting whatsoever was
  being performed.
* Hoisting was not blocked by parameters of the same name.
* Hoisting was not blocked by nested lexical declarations of the same name.

We had tests which checked for the second, but they were incorrectly passing due to
the first. This CL adds more complete tests.

BUG=v8:5151, v8:5111

Review-Url: https://codereview.chromium.org/2099623003
Cr-Commit-Position: refs/heads/master@{#37405}
2016-06-29 20:55:35 +00:00
bradnelson
b218d6448a Adding a few more owners to the wasm directory.
Mircea and Andreas have been making changes to wasm.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2103793006
Cr-Commit-Position: refs/heads/master@{#37401}
2016-06-29 17:38:30 +00:00
georgia.kouveli
317dc0578f [arm64] Generate adds/ands.
Perform the following transformation:

    | Before           | After               |
    |------------------+---------------------|
    | add w2, w0, w1   | adds w2, w0, w1     |
    | cmp w2, #0x0     | b.<cond'> <addr>    |
    | b.<cond> <addr>  |                     |
    |------------------+---------------------|
    | add w2, w0, w1   | adds w2, w0, w1     |
    | cmp #0x0, w2     | b.<cond'> <addr>    |
    | b.<cond> <addr>  |                     |

and the same for and instructions instead of add.  When the result of the
add/and is not used, generate cmn/tst instead. We need to take care with which
conditions we can handle and what new condition we map them to.

BUG=

Review-Url: https://codereview.chromium.org/2065243005
Cr-Commit-Position: refs/heads/master@{#37400}
2016-06-29 14:57:49 +00:00
yangguo
d5b89c28cf Remove position info from relocation info.
R=mstarzinger@chromium.org
BUG=v8:5117

Review-Url: https://codereview.chromium.org/2109613004
Cr-Commit-Position: refs/heads/master@{#37397}
2016-06-29 13:49:50 +00:00
bmeurer
5927deaaf1 Revert of [builtins] New frame type for exits to C++ builtins (patchset #5 id:80001 of https://codereview.chromium.org/2090723005/ )
Reason for revert:
Looks like this breaks on nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/7626

Original issue's description:
> [builtins] New frame type for exits to C++ builtins
>
> Prior to this commit, calls to C++ builtins created standard exit
> frames, which are skipped when constructing JS stack traces. In order to
> show these calls on traces, we introduce a new builtin exit frame type.
>
> Builtin exit frames contain target and new.target on the stack and are
> not skipped during stack trace construction.
>
> BUG=v8:4815
> R=bmeurer@chromium.org, yangguo@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
> Cr-Commit-Position: refs/heads/master@{#37384}

TBR=yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106113002
Cr-Commit-Position: refs/heads/master@{#37394}
2016-06-29 12:39:36 +00:00
bmeurer
89c9fc73be [turbofan] Fix non-termination in RedundancyElimination.
A pointer comparison on the effect path states is not sufficient to
guarantee termination; we really need to check the actual nodes to
make sure we terminate properly, similar to what BranchElimination
does.

R=jarin@chromium.org
BUG=v8:5161

Review-Url: https://codereview.chromium.org/2112463002
Cr-Commit-Position: refs/heads/master@{#37389}
2016-06-29 11:58:03 +00:00
titzer
c4588df160 [wasm] Cleanup AST decoder. Remove Tree and TreeResult.
R=ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2110053002
Cr-Commit-Position: refs/heads/master@{#37387}
2016-06-29 11:40:11 +00:00
bmeurer
e0c87cfce6 [turbofan] Don't eagerly introduce machine operators in JSTypedLowering.
This functionality is duplicated with the same functionality in
SimplifiedLowering, which is kinda premature and doesn't seem to
be useful.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2103323003
Cr-Commit-Position: refs/heads/master@{#37386}
2016-06-29 11:13:31 +00:00
jgruber
3c60c6b105 [builtins] New frame type for exits to C++ builtins
Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2090723005
Cr-Commit-Position: refs/heads/master@{#37384}
2016-06-29 11:10:27 +00:00
bmeurer
6f920d7d59 [turbofan] Disallow typing for change/checked operators.
There are no useful typing rules for Change and Checked operators, so we
better make sure we don't run them through the Typer at all.

R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2107783004
Cr-Commit-Position: refs/heads/master@{#37382}
2016-06-29 10:32:19 +00:00
mlippautz
67b5a501db Remove SealHandleScope from TryNumberToSize conversion
This function should also be callable from a concurrent thread, so we cannot use
the scope here. Instead, provide a test that checks that no handles are created.

R=ulan@chromium.org
TEST=cctest/test-conversions/NoHandlesForTryNumberToSize
BUG=

Review-Url: https://codereview.chromium.org/2106083002
Cr-Commit-Position: refs/heads/master@{#37381}
2016-06-29 10:29:16 +00:00
titzer
2f8ed90582 [wasm] Enable wasm frame inspection for debugging
This changes many interfaces to accept StandardFrames instead of
JavaScriptFrames, and use the StackTraceFrameIterator instead of the
JavaScriptFrameIterator.
Also, the detailed frame information array now contains the script in
addition to the function, as wasm frames are not associated to any
javascript function.

This is a rebase of (https://codereview.chromium.org/2069823003/), since clemensh's internship has ended.

R=yangguo@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2109093003
Cr-Commit-Position: refs/heads/master@{#37379}
2016-06-29 10:23:09 +00:00
neis
f96be554b9 Fix order of conversions in String.prototype.substr.
The start argument must be converted to an integer before the length argument is
converted.  (Consequently, the start argument is converted even when the length
is 0.)  This matters because conversion is observable.

Also rewrite the function in a way that closely resembles the spec text.

R=littledan@chromium.org
BUG=v8:5140

Review-Url: https://codereview.chromium.org/2109583002
Cr-Commit-Position: refs/heads/master@{#37378}
2016-06-29 09:53:48 +00:00