Commit Graph

8255 Commits

Author SHA1 Message Date
ulan
aae2c01740 Use atomic operation to read the length of a fixed array.
This fixes a race where
- mutator changes the fixed array length by trimming it,
- sweeper thread reads the length of the fixed array.

Also rename FROM_GC and FROM_MUTATOR to be more precise.

BUG=chromium:462908
LOG=NO

Review URL: https://codereview.chromium.org/1034163002

Cr-Commit-Position: refs/heads/master@{#27869}
2015-04-16 08:39:12 +00:00
yangguo
a5ac029058 Start migrating error message templates to the runtime.
Currently done with two templates, one used from native js, one from runtime.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1087633005

Cr-Commit-Position: refs/heads/master@{#27864}
2015-04-16 07:01:16 +00:00
adamk
b054ff4620 Revert "Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations"
This reverts commit 8c98cc074e
because it causes flaky failures in the dromaeo.jslibeventprototype
benchmark on Linux/Windows and consistent failures on Android.

Also reverts the followup "Remove kForInStatementIsNotFastCase bailout reason"
(commit ba24e67696) to avoid breaking the build.

BUG=chromium:476592
TBR=verwaest@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1066663005

Cr-Commit-Position: refs/heads/master@{#27859}
2015-04-15 21:28:22 +00:00
mvstanton
13459c1ae3 Array() in optimized code can create with wrong ElementsKind in corner cases.
Calling new Array(JSObject::kInitialMaxFastElementArray) in optimized code
makes a stub call that bails out due to the length. Currently, the bailout
code a) doesn't have the allocation site, and b) wouldn't use it if it did
because the length is perceived to be too high.

This CL passes the allocation site to the stub call (rather than undefined),
and alters the bailout code to utilize the feedback.

BUG=

Review URL: https://codereview.chromium.org/1086873003

Cr-Commit-Position: refs/heads/master@{#27857}
2015-04-15 21:02:13 +00:00
arv
79be74364a Fix issues with name and length on poison pill function
In ES6 function name and length are configurable. However, the length
and name properties of the poison pill function must not be
configurable.

BUG=v8:4011
LOG=N
R=adamk@chromium.org, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1061393002

Cr-Commit-Position: refs/heads/master@{#27855}
2015-04-15 17:15:26 +00:00
erikcorry
e0be05036f Reduce regexp compiler stack size when not optimizing regexps
R=jkummerow@chromium.org
BUG=chromium:475705
LOG=y

Review URL: https://codereview.chromium.org/1082763002

Cr-Commit-Position: refs/heads/master@{#27851}
2015-04-15 15:15:52 +00:00
mstarzinger
b807d112d7 [turbofan] Fix ForInStatement that deopts during filter.
This adds a missing bailout id to a ForInStatement for when retrieving
and filtering a property name deoptimizes. This can happen with proxies
that have a getPropertyDescriptor trap.

R=jarin@chromium.org
TEST=mjsunit/for-in-opt

Review URL: https://codereview.chromium.org/1086083002

Cr-Commit-Position: refs/heads/master@{#27846}
2015-04-15 13:12:05 +00:00
mstarzinger
969475b604 [crankshaft] Add missing source position for calls.
R=verwaest@chromium.org
TEST=cctest/test-api
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1058553004

Cr-Commit-Position: refs/heads/master@{#27843}
2015-04-15 12:48:48 +00:00
dcarney
00aec79079 [turbofan] cleanup ParallelMove
- make ParallelMove into a ZoneVector, removing an annoying level of indirection
- make MoveOperands hold InstructionOperands instead of pointers, so there's no more operand aliasing for moves
- opens up possibility of storing MachineType in allocated operands

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1081373002

Cr-Commit-Position: refs/heads/master@{#27842}
2015-04-15 12:36:27 +00:00
yangguo
d96224e858 Abort incremental marking in test-heap/WeakCellsWithIncrementalMarking.
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1089533002

Cr-Commit-Position: refs/heads/master@{#27838}
2015-04-15 10:08:24 +00:00
ulan
68a7773e0f Correctly handle clearing of deprecated field types.
BUG=v8:4027
LOG=NO

Review URL: https://codereview.chromium.org/1086063003

Cr-Commit-Position: refs/heads/master@{#27837}
2015-04-15 09:55:33 +00:00
jkummerow
2ff768b206 Put --noalways-opt flag back into regress-crbug-245480
This is a partial revert of 3eb277f270.

R=machenbach@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1087183002

Cr-Commit-Position: refs/heads/master@{#27835}
2015-04-15 09:31:39 +00:00
machenbach
301151545e Revert of Force full GCwhenever CollectAllGarbage is meant to trigger a full GC. (patchset id:60001 of https://codereview.chromium.org/1082973003/)
Reason for revert:
[Sheriff] Breaks http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/3348 and maybe leads to timeouts/crashes on layout test bots:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064/builds/3002

Original issue's description:
> Force full GC whenever CollectAllGarbage is meant to trigger a full GC.
>
> Add a finalize incremental marking mode for CollectAllGarbage to finalize incremental marking when incremental marking is in progress, but we want a full gc at a given CollectAllGarbage call site.
>
> Default mode for CollectAllGarbage is finalize incremental marking and perform a full GC.
>
> BUG=
>
> Committed: https://crrev.com/9c105f0940ba757364ac18fcdf649815ec5ab2d1
> Cr-Commit-Position: refs/heads/master@{#27831}

TBR=ulan@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1088083002

Cr-Commit-Position: refs/heads/master@{#27834}
2015-04-15 09:07:21 +00:00
hpayer
9c105f0940 Force full GC whenever CollectAllGarbage is meant to trigger a full GC.
Add a finalize incremental marking mode for CollectAllGarbage to finalize incremental marking when incremental marking is in progress, but we want a full gc at a given CollectAllGarbage call site.

Default mode for CollectAllGarbage is finalize incremental marking and perform a full GC.

BUG=

Review URL: https://codereview.chromium.org/1082973003

Cr-Commit-Position: refs/heads/master@{#27831}
2015-04-15 07:10:39 +00:00
svenpanne
83bc009d46 Added Donald Stence to PPC owners.
Review URL: https://codereview.chromium.org/1065443004

Cr-Commit-Position: refs/heads/master@{#27830}
2015-04-15 07:00:11 +00:00
wingo
71d3213a3f Allow eval/arguments in arrow functions
R=arv@chromium.org, adamk@chromium.org, marja@chromium.org
BUG=v8:4020
LOG=N

Review URL: https://codereview.chromium.org/1061983004

Cr-Commit-Position: refs/heads/master@{#27824}
2015-04-14 15:37:18 +00:00
jkummerow
3eb277f270 %GetOptimizationStatus(): Unconditionally return a sentinel when --always-opt is present
Review URL: https://codereview.chromium.org/1086923002

Cr-Commit-Position: refs/heads/master@{#27822}
2015-04-14 14:57:48 +00:00
jarin
31994391ab Insert a filler at the new space top even if the top is at the limit.
BUG=chromium:470390
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1066653003

Cr-Commit-Position: refs/heads/master@{#27819}
2015-04-14 13:42:25 +00:00
mvstanton
2ebb794b4f VectorICs: recreate feedback vector if scoping changes on recompile.
BUG=476488
LOG=N
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1080253003

Cr-Commit-Position: refs/heads/master@{#27817}
2015-04-14 12:31:31 +00:00
yangguo
2c01bd34b0 Fix Math.log10 implementation for 1 - Number.EPSILON.
R=svenpanne@chromium.org
BUG=v8:4025
LOG=N

Review URL: https://codereview.chromium.org/1084853002

Cr-Commit-Position: refs/heads/master@{#27815}
2015-04-14 11:56:02 +00:00
dslomov
3c5218f6fa Add a test for subclass maps.
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1052963002

Cr-Commit-Position: refs/heads/master@{#27812}
2015-04-14 09:59:02 +00:00
dslomov
219f4a9eb4 Avoid modifying the real context chain for debug evaluation.
Instead of modifying a context chain and then modifying it back, causing
potential mismatches, we clone the inner context chain and evaluate
the expression in this cloned context. We then copy all local variable
values back if needed.

R=yangguo@chromium.org,yurys@chromium.org

Review URL: https://codereview.chromium.org/1088503003

Cr-Commit-Position: refs/heads/master@{#27809}
2015-04-14 09:07:55 +00:00
chunyang.dai
31a3d5fcd2 X87: Disable the test case for X87 since f3338dd3b0
The overwrite-builtins test cases will throw one expected exception
  and the exception message should include the source position in the JS
  file. But crankshaft compiler does not generate the source position for
  it when creating the flow graph by default. The source position information
  is always zero. So it failed when comparing with the reference file.

  If we use crankshaft compiler on IA32 platform to run this test case, it
  has the same failure.

BUG=

Review URL: https://codereview.chromium.org/1086503002

Cr-Commit-Position: refs/heads/master@{#27807}
2015-04-14 08:05:35 +00:00
hpayer
8b737395c8 Experiment: reduce heap growing factor to investigate OOM impact.
This CL will be reverted after getting sufficient data.
BUG=

Review URL: https://codereview.chromium.org/1060533003

Cr-Commit-Position: refs/heads/master@{#27804}
2015-04-14 06:58:36 +00:00
adamk
5277c41044 Split TemplateHashMapImpl::Lookup into two methods
This avoids both a mysterious boolean argument ("insert") and lets
non-mutating lookups skip passing an allocator (in one such case,
we were passing a scary-looking ZoneAllocationPolicy(NULL)!).

Review URL: https://codereview.chromium.org/1074943002

Cr-Commit-Position: refs/heads/master@{#27799}
2015-04-13 19:01:15 +00:00
arv
186dd69b3a [es6] Fix length property of collection constructors
{Map, Set, WeakMap, WeakSet}.length should be 0.

BUG=v8:4021
LOG=N
R=adamk@chromium.org

Review URL: https://codereview.chromium.org/1073233002

Cr-Commit-Position: refs/heads/master@{#27798}
2015-04-13 18:59:39 +00:00
conradw
c983689d39 [strong] Implement static restrictions on direct eval
Does not entirely disallow the use of 'eval' as an identifier in strong mode,
as originally proposed.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1059273004

Cr-Commit-Position: refs/heads/master@{#27796}
2015-04-13 17:25:15 +00:00
verwaest
434b456b51 Fix indirect push
BUG=chromium:388665
LOG=n

Review URL: https://codereview.chromium.org/1087463003

Cr-Commit-Position: refs/heads/master@{#27795}
2015-04-13 16:25:33 +00:00
titzer
069e6b2f5f [turbofan] Optimize loads of global constants in JSTypedLowering.
R=mstarzinger@chromium.org,verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1077343002

Cr-Commit-Position: refs/heads/master@{#27792}
2015-04-13 16:22:05 +00:00
arv
0e539d1ca9 Revert "ES6: Number and Boolean prototype should be ordinary objects"
This reverts commit e965a1f84a.

The reason is that it breaks jsfiddle.com

BUG=476437, v8:4001
LOG=N
R=rossberg@chromium.org

Review URL: https://codereview.chromium.org/1086673002

Cr-Commit-Position: refs/heads/master@{#27791}
2015-04-13 16:21:00 +00:00
jochen
ada32ae636 Expose ArrayBufferView::HasBuffer
This allows the embedder to decide whether it's worthwhile to copy the
contents to avoid materializing a buffer.

BUG=v8:3996
R=dslomov@chromium.org,kbr@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1084513002

Cr-Commit-Position: refs/heads/master@{#27782}
2015-04-13 11:27:58 +00:00
vegorov
021f738127 Treat HArgumentsObject as a safe use during Uint32 analysis phase.
Deoptimization infrastructure already handles it correctly.

This change fixes repetitive deoptimizations in the code like this:

    var u32 = new Uint32Array(1);
    u32[0] = -1;

    function tr(x) { return x|0; }
    function ld() { return tr(u32[0]); }

    while (true) ld();

Currently inlined tr will contain HArgumentsObject that is considered uint32-unsafe use and prevents u32[0] from becoming uint32 load - instead a speculative int32 load is generated which just deopts.

BUG=

Review URL: https://codereview.chromium.org/1077113002

Cr-Commit-Position: refs/heads/master@{#27781}
2015-04-13 10:47:15 +00:00
ulan
2f327a5cb4 Do not inline store if field map was cleared.
BUG=v8:4023
LOG=NO

Review URL: https://codereview.chromium.org/1081033004

Cr-Commit-Position: refs/heads/master@{#27779}
2015-04-13 09:43:52 +00:00
yangguo
ea5d68a6ef Blacklist more debugger tests (fail with --always-opt).
TBR=mstarzinger@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1079943003

Cr-Commit-Position: refs/heads/master@{#27776}
2015-04-13 09:09:39 +00:00
mstarzinger
10dd9ce8be Make compilers agree on source position of thrown errors.
This makes the compilers agree on the source position of a message
generated by "throw new Error()", it points to the beginning of the
throw directive.

R=titzer@chromium.org
TEST=message/regress/regress-3995
BUG=v8:3995
LOG=N

Review URL: https://codereview.chromium.org/1049703002

Cr-Commit-Position: refs/heads/master@{#27775}
2015-04-13 09:02:48 +00:00
wingo
1dbc432729 Factor formal argument parsing into ParserBase
This commit is a precursor to making lazy arrow function parsing use
similar logic to function(){} argument parsing.

R=arv@chromium.org
BUG=4020
LOG=N

Review URL: https://codereview.chromium.org/1078093002

Cr-Commit-Position: refs/heads/master@{#27773}
2015-04-13 08:07:06 +00:00
ben
80b7a962b2 Use correct property descriptor in generators test
BUG=

Review URL: https://codereview.chromium.org/1077413002

Cr-Commit-Position: refs/heads/master@{#27771}
2015-04-12 21:18:31 +00:00
mike
0a4881600d Correct property descriptors on GeneratorPrototype
The ES6 specification does not explicitly state the attributes for the
'next' and 'throw' property descriptors, so their values are defined by
Section 17 [1]:

> Every other data property described in clauses 18 through 26 and in
> Annex B.2 has the attributes
> { [[Writable]]: true, [[Enumerable]]: false, [[Configurable]]: true }
> unless otherwise specified.

[1]
https://people.mozilla.org/~jorendorff/es6-draft.html#sec-ecmascript-standard-built-in-objects

BUG=v8:3986
LOG=N
R=wingo,arv

Review URL: https://codereview.chromium.org/1051363003

Cr-Commit-Position: refs/heads/master@{#27770}
2015-04-11 21:14:20 +00:00
Weiliang Lin
38e764f7ac [x86] Introduce vandps/vandpd/vxorps/vxorpd.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1072343002

Cr-Commit-Position: refs/heads/master@{#27768}
2015-04-11 00:58:38 +00:00
fedor
1f85559a69 api: introduce SealHandleScope
When debugging Handle leaks in io.js we found it very convenient to be
able to Seal some specific (root in our case) scope to prevent Handle
allocations in it, and easily find leakage.

R=yangguo
BUG=

Review URL: https://codereview.chromium.org/1079713002

Cr-Commit-Position: refs/heads/master@{#27766}
2015-04-10 23:17:09 +00:00
yangguo
60dc30970c Correctly name memory stat for context snapshot size.
TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1078353002

Cr-Commit-Position: refs/heads/master@{#27765}
2015-04-10 22:36:02 +00:00
caitpotter88
a6ba7ffe36 [cleanup] fix SpreadCalls perf-test names in JSTests.json
BUG=v8:3018
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1079103005

Cr-Commit-Position: refs/heads/master@{#27758}
2015-04-10 18:29:25 +00:00
conradw
3d5717a71b [strong] Implement static restrictions on binding 'undefined' in arrow functions
Implements the strong mode proposal's static restrictions on the use of the
identifier 'undefined', for arrow functions. Assumes these restrictions are
intended to be identical to the restrictions on the use of 'eval and 'arguments'
in strict mode. In addition, Location variables inconsistantly named (e.g.
dupe_error_loc vs dupe_loc) are now consistently named the shorter way.

Baseline: https://codereview.chromium.org/1070633002

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1060883004

Cr-Commit-Position: refs/heads/master@{#27756}
2015-04-10 18:27:05 +00:00
machenbach
7898475e92 Revert of Make full GC reduce memory footprint an explicit event in the idle notification handler. (patchset id:20001 of https://codereview.chromium.org/1072363002/)
Reason for revert:
[Sheriff] breaks nosnap with timeouts:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap/builds/2513
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/6220

Original issue's description:
> Make full GC reduce memory footprint an explicit event in the idle notification handler.
>
> BUG=
>
> Committed: https://crrev.com/845705aa99b6bfa8d264cfda1c3b5f1229802ab5
> Cr-Commit-Position: refs/heads/master@{#27753}

TBR=ulan@chromium.org,rmcilroy@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1081443002

Cr-Commit-Position: refs/heads/master@{#27755}
2015-04-10 18:21:43 +00:00
yangguo
88630d4e54 Use cctest to track memory stats for isolate and context.
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1074143002

Cr-Commit-Position: refs/heads/master@{#27754}
2015-04-10 14:13:25 +00:00
hpayer
845705aa99 Make full GC reduce memory footprint an explicit event in the idle notification handler.
BUG=

Review URL: https://codereview.chromium.org/1072363002

Cr-Commit-Position: refs/heads/master@{#27753}
2015-04-10 14:06:46 +00:00
wingo
fe031978cb Fix some -Werror=sign-compare errors
R=svenpanne@chromium.org
LOG=N
BUG=

Review URL: https://codereview.chromium.org/1072333002

Cr-Commit-Position: refs/heads/master@{#27752}
2015-04-10 13:59:39 +00:00
dcarney
e7ba4791e5 simplify GlobalValueMap calls to DisposeWeak
BUG=

Review URL: https://codereview.chromium.org/1074153002

Cr-Commit-Position: refs/heads/master@{#27750}
2015-04-10 13:40:31 +00:00
titzer
277be506c8 Remove Type::Array bit and replace with Type::GlobalObject
R=rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1074133002

Cr-Commit-Position: refs/heads/master@{#27749}
2015-04-10 13:29:39 +00:00
verwaest
8c98cc074e Add basic crankshaft support for slow-mode for-in to avoid disabling optimizations
BUG=

Review URL: https://codereview.chromium.org/1075933003

Cr-Commit-Position: refs/heads/master@{#27748}
2015-04-10 13:15:31 +00:00
titzer
dee044d601 Add more exhaustive tests for Math.min and Math.max.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1078073002

Cr-Commit-Position: refs/heads/master@{#27747}
2015-04-10 12:35:16 +00:00
jkummerow
c1f28b6c10 Handlify Map::SetPrototype()
Review URL: https://codereview.chromium.org/1005393004

Cr-Commit-Position: refs/heads/master@{#27745}
2015-04-10 12:13:22 +00:00
conradw
8ef7159582 [strong] Implement static restrictions on binding/assignment to 'undefined'
identifier. Delete unused (and now incorrect) function IsValidStrictVariable.

Implements the strong mode proposal's static restrictions on the use of the
identifier 'undefined'. Assumes these restrictions are intended to be identical
to the restrictions on the use of 'eval' and 'arguments' in strict mode. The
AllowEvalOrArgumentsAsIdentifier enum has been renamed to
AllowRestrictedIdentifiers as logic involving it is now also used for this case.

BUG=v8:3956

LOG=N

Review URL: https://codereview.chromium.org/1070633002

Cr-Commit-Position: refs/heads/master@{#27744}
2015-04-10 12:04:55 +00:00
bmeurer
35f6c0fdbf [turbofan] Optimize silent hole checks on legacy const context slots.
Currently we always generate a diamond in the graph builder for every
legacy const context slot, which we cannot get rid of until late control
reduction, even if we know after context specialization that the slot is
already initialized.

Now we generate a select instead, which the CommonOperatorReducer
happily removes during typed lowering. This greatly speeds up asm.js
code generated by Emscripten with the new POINTER_MASKING mode.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1072353002

Cr-Commit-Position: refs/heads/master@{#27739}
2015-04-10 10:28:12 +00:00
yangguo
c0593a1fc8 Add perf test configuration to track memory use of context and isolate.
R=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1075143002

Cr-Commit-Position: refs/heads/master@{#27738}
2015-04-10 09:48:57 +00:00
titzer
ff9eaef188 Split cctest/test-types.cc into heap and zone versions for more parallelism.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1074063004

Cr-Commit-Position: refs/heads/master@{#27737}
2015-04-10 09:26:00 +00:00
mstarzinger
7196ea72c8 [crankshaft] Fix interceptor shadowing constant global property.
This makes sure Crankshaft respects interceptors in the global object
even when they shadow a constant global property.

R=verwaest@chromium.org
TEST=cctest/test-api-interceptors/PrePropertyHandler

Review URL: https://codereview.chromium.org/1070803002

Cr-Commit-Position: refs/heads/master@{#27733}
2015-04-10 08:30:44 +00:00
caitpotter88
9836c34dba [es6] do not add caller/arguments to ES6 function definitions
BUG=v8:3946, v8:3982
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
LOG=N
R=arv@chromium.org, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1027283004

Cr-Commit-Position: refs/heads/master@{#27729}
2015-04-09 22:40:28 +00:00
adamk
52bbb4f609 Collect list of requested modules in ModuleDescriptor while parsing
BUG=v8:1569
LOG=n

Review URL: https://codereview.chromium.org/1078903002

Cr-Commit-Position: refs/heads/master@{#27724}
2015-04-09 22:09:47 +00:00
caitpotter88
48eff34c32 [es6] don't "replace" Object.prototype.toString for --harmony-tostring
When ObjectToString is installed on Object.prototype twice (once in v8natives.js, and once in harmony-tostring.js), this pollutes old code spaces on some devices. To prevent this, the function is only installed once, preventing test failures when the --harmony-tostring flag is flipped on by default.

BUG=v8:3502
LOG=N
R=arv@chromium.org

Review URL: https://codereview.chromium.org/1072083002

Cr-Commit-Position: refs/heads/master@{#27720}
2015-04-09 20:53:46 +00:00
mstarzinger
96ef78aa0b [turbofan] Fix FrameInspector when deoptimizer is disabled.
This is a workaround to make the debugger happy about TurboFan frames
when the debugger causes frame inspection. Note that this can happen
because the debugger can be activated while there still are optimized
TurboFan activations on the stack.

R=ishell@chromium.org
BUG=chromium:465298
TEST=mjsunit/regress/regress-crbug-465298
LOG=N

Review URL: https://codereview.chromium.org/1074793003

Cr-Commit-Position: refs/heads/master@{#27717}
2015-04-09 19:40:49 +00:00
arv
635b5fea98 Lexical arguments for arrow functions
Only allocate 'arguments' if the scope is not an arrow scope.

BUG=v8:2700
LOG=N
R=adamk@chromium.org, wingo@igalia.cmo

Review URL: https://codereview.chromium.org/1078483002

Cr-Commit-Position: refs/heads/master@{#27716}
2015-04-09 19:39:38 +00:00
adamk
9b09a28d5c Remove comparison operator and helper function from AstRawString interface
These comparisons are only meant to be done by AstValueFactory itself (in
its string_table_ operations), so make the Compare() function a private
member of AstValueFactory.

All other clients of AstRawStrings should compare them by pointer value.
There were only two clients which failed to abide by this rule, one
recently-added (in ModuleDescriptor) and the other in Literal::Match
(in ast.cc, added in https://code.google.com/p/v8/source/detail?r=24396).

Review URL: https://codereview.chromium.org/1069423003

Cr-Commit-Position: refs/heads/master@{#27715}
2015-04-09 19:38:34 +00:00
caitpotter88
74c381221c [es6] implement spread calls
BUG=v8:3018
R=
LOG=N

Review URL: https://codereview.chromium.org/938443002

Cr-Commit-Position: refs/heads/master@{#27714}
2015-04-09 19:37:19 +00:00
Adam Klein
9164e0b62c Skip another debug test that fails in always-opt/turbofan
TBR=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/1072143002

Cr-Commit-Position: refs/heads/master@{#27710}
2015-04-09 17:46:14 +00:00
dcarney
572196f6c2 [turbofan] support small immediates
R=titzer@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1075903002

Cr-Commit-Position: refs/heads/master@{#27709}
2015-04-09 14:06:24 +00:00
mstarzinger
63eeab12eb Make TestInternalWeakLists more robust against flags.
This makes some tests in test-heap.cc more robust against flags, now
that top-level code can be optimized by the --always-opt flag.

R=hpayer@chromium.org
TEST=cctest/test-heap/TestInternalWeakLists

Review URL: https://codereview.chromium.org/1071063004

Cr-Commit-Position: refs/heads/master@{#27699}
2015-04-09 11:01:21 +00:00
dcarney
8392d9c43b [turbofan] Make AllocatedOperand an InstructionOperand::Kind.
This is preparatory work to have MachineTypes encoded in AllocatedOperands.

Review URL: https://codereview.chromium.org/1075863002

Cr-Commit-Position: refs/heads/master@{#27698}
2015-04-09 10:40:43 +00:00
dcarney
07ff6d9f22 [turbofan] cleanup InstructionOperand a little
- ConstantOperand was using a too-small field too store its virtual register
- drop ConvertTo, replace it with simple copy
- split AllocatedOperand off from Immediate and Constant to make assignment clearer, also paving the way for small Immediates
- put zone first in *Operand::New
- driveby: drop delayed ssa deconstruction experiment

R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1050803002

Cr-Commit-Position: refs/heads/master@{#27692}
2015-04-09 09:15:32 +00:00
yangguo
fd8d0d1419 Blacklist tests due to optimizing toplevel with --always-opt.
Those two tests fail in gc-stress and custom snapshot (embedding mjsunit.js).
This is likely due to different GC timing with the custom snapshot.

R=mstarzinger@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1078653002

Cr-Commit-Position: refs/heads/master@{#27688}
2015-04-09 08:47:34 +00:00
mstarzinger
dd3067a787 Disable more failing tests after f3338dd3b0.
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1075813002

Cr-Commit-Position: refs/heads/master@{#27687}
2015-04-09 08:21:45 +00:00
jing.bao
dba47f6486 [ia32] Introduce BMI instructions.
BUG=v8:4015
LOG=n

Review URL: https://codereview.chromium.org/1069683002

Cr-Commit-Position: refs/heads/master@{#27683}
2015-04-09 06:50:58 +00:00
arv
e965a1f84a ES6: Number and Boolean prototype should be ordinary objects
BUG=v8:4001
LOG=N
R=adamk@chromium.org, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1051373002

Cr-Commit-Position: refs/heads/master@{#27680}
2015-04-08 21:18:40 +00:00
balazs.kilvady
8c3af6ca03 MIPS: [turbofan] Add new Float32Abs and Float64Abs operators.
Port 9af9f1d026

Original commit message:
These operators compute the absolute floating point value of some
arbitrary input, and are implemented without any branches (i.e. using
vabs on arm, and andps/andpd on x86).

BUG=

Review URL: https://codereview.chromium.org/1073463003

Cr-Commit-Position: refs/heads/master@{#27679}
2015-04-08 19:30:11 +00:00
caitpotter88
ab7d5f9620 [parser] report better errors for multiple ForBindings in ForIn/Of loops
Instead of "unexpected token" errors, report something meatier and more actionable.

BUG=
R=marja@chromium.org, arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1062263002

Cr-Commit-Position: refs/heads/master@{#27677}
2015-04-08 18:47:45 +00:00
mstarzinger
4b5bf1e33c Disable more failing tests after f3338dd3b0.
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1070843002

Cr-Commit-Position: refs/heads/master@{#27675}
2015-04-08 17:28:58 +00:00
loislo
eb95406e2b CpuProfiler: public API for deopt info in cpu profiler.
BUG=chromium:452067
LOG=n

Committed: https://crrev.com/baf927ff5115ec62a6dad684b9232ed9d3960e3a
Cr-Commit-Position: refs/heads/master@{#27626}

Review URL: https://codereview.chromium.org/1045753002

Cr-Commit-Position: refs/heads/master@{#27674}
2015-04-08 16:13:31 +00:00
mvstanton
af293729ad Tests that carefully checks opt/deopt status shouldn't --always-opt.
If we optimize a function before gathering feedback it may be
peppered with soft deoptimizations. So it can't help but deoptimize.
A judicious reading of the code isn't enough to determine what the
optimization state should be in the face of such chaotic gyrations.

BUG=
R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1069363003

Cr-Commit-Position: refs/heads/master@{#27671}
2015-04-08 15:56:01 +00:00
mstarzinger
515e483dd0 Disable more failing tests after f3338dd3b0.
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1067413002

Cr-Commit-Position: refs/heads/master@{#27670}
2015-04-08 14:16:58 +00:00
titzer
1b400a14cb Add more systematic tests for comparisons.
Because, well, JavaScript is tricky and compilers like folding.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1069673002

Cr-Commit-Position: refs/heads/master@{#27668}
2015-04-08 13:15:41 +00:00
titzer
a511c78999 Fix maybe_string_add for adds that have no type feedback where --always-opt is on.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1071473003

Cr-Commit-Position: refs/heads/master@{#27667}
2015-04-08 13:14:30 +00:00
mstarzinger
322cfb3589 [turbofan] Add JSStackCheck into loop bodies.
This allows loopy TurboFan code to be interrupted by placing a stack
check (i.e. JSStackCheck node) into each loop. Note that we currently
limit this to non-asm.js code. Also note that stack checks are actually
placed after loop headers and not at back-branches, which allows us to
reuse existing BailoutIds from Crankshaft.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1065923002

Cr-Commit-Position: refs/heads/master@{#27666}
2015-04-08 12:55:02 +00:00
mstarzinger
d1bcfaf034 [ia32] Fix MacroAssembler::Move for int64 to float64 moves.
R=bmeurer@chromium.org
TEST=test262-es6/language/expressions/addition/S9.3_A4.1_T2

Review URL: https://codereview.chromium.org/1071543003

Cr-Commit-Position: refs/heads/master@{#27663}
2015-04-08 12:06:59 +00:00
Benedikt Meurer
9af9f1d026 [turbofan] Add new Float32Abs and Float64Abs operators.
These operators compute the absolute floating point value of some
arbitrary input, and are implemented without any branches (i.e. using
vabs on arm, and andps/andpd on x86).

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1066393002

Cr-Commit-Position: refs/heads/master@{#27662}
2015-04-08 11:55:04 +00:00
mstarzinger
ed6733e8fd Disable more failing tests after f3338dd3b0.
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1067303003

Cr-Commit-Position: refs/heads/master@{#27661}
2015-04-08 11:42:24 +00:00
yangguo
3a4d073f1d Create result array of %DebugGetLoadedScripts outside the debug context.
R=jarin@chromium.org
BUG=chromium:474297
LOG=N

Review URL: https://codereview.chromium.org/1062143002

Cr-Commit-Position: refs/heads/master@{#27659}
2015-04-08 11:15:02 +00:00
titzer
2b59959c71 [turbofan] Match selects in control reducer (configurable).
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1061303002

Cr-Commit-Position: refs/heads/master@{#27658}
2015-04-08 11:13:49 +00:00
yangguo
5db360dd56 Blacklist failing test on arm64 (issue 4016).
TBR=jkummerow@chromium.org
BUG=v8:4016
LOG=N

Review URL: https://codereview.chromium.org/1071513002

Cr-Commit-Position: refs/heads/master@{#27656}
2015-04-08 11:11:37 +00:00
mstarzinger
ad94e145c3 Disable more failing tests after f3338dd3b0.
TBR=yangguo@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1072433002

Cr-Commit-Position: refs/heads/master@{#27655}
2015-04-08 10:35:16 +00:00
mstarzinger
0716bc3f76 Disable more failing tests after f3338dd3b0.
TBR=yangguo@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1067353002

Cr-Commit-Position: refs/heads/master@{#27652}
2015-04-08 09:51:18 +00:00
mstarzinger
52f1f1458e Disable failing test after f3338dd3b0.
R=yangguo@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1070663002

Cr-Commit-Position: refs/heads/master@{#27651}
2015-04-08 09:25:01 +00:00
mstarzinger
f3338dd3b0 Prevent overzealous bailout due to script context.
This is a follow-up to 2d281e71ac and prevents bailouts on empty
script contexts in Crankshaft, which don't need allocation. Only
non-empty script contexts should cause a bailout.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1063373003

Cr-Commit-Position: refs/heads/master@{#27649}
2015-04-08 09:00:45 +00:00
jing.bao
584a351484 [x64] Introduce BMI instructions.
BUG=v8:4015
LOG=n

Review URL: https://codereview.chromium.org/1040603002

Cr-Commit-Position: refs/heads/master@{#27648}
2015-04-08 07:15:59 +00:00
bmeurer
aa46ebe5e2 [arm] Use position independent table switches.
Performance measurements show that the position independent code is
usually slightly faster than the position dependent code, and there
seems to be no noticable regression.

This also gets rid of a lot of support code that was only required to allow
embedding labels into the code stream. And it implies that neither the GC
nor the deserializer need to do anything for jump tables.

R=svenpanne@chromium.org
BUG=v8:3872
LOG=n

Review URL: https://codereview.chromium.org/1069633002

Cr-Commit-Position: refs/heads/master@{#27646}
2015-04-08 06:50:15 +00:00
adamk
74ef072148 Disable another debug test under turbo always-opt
TBR=mstarzinger@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1064133002

Cr-Commit-Position: refs/heads/master@{#27642}
2015-04-07 20:10:31 +00:00
caitpotter88
1fb76f055a [es6] emit error when for-in loop declarations are initialized in strict mode
The ES6 grammar forbids the initialization of variable declarations in IterationStatements.

This CL will report `for (var x = y in z)` as a SyntaxError in strict mode (as done in JSC). It is possible that this could break sites in sloppy mode, and so that change can wait.

BUG=
R=
LOG=N

Review URL: https://codereview.chromium.org/1033823002

Cr-Commit-Position: refs/heads/master@{#27639}
2015-04-07 19:28:42 +00:00
mstarzinger
77e6efd870 Disabled failing tests after 2d281e71ac.
R=titzer@chromium.org
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1065983002

Cr-Commit-Position: refs/heads/master@{#27636}
2015-04-07 17:06:22 +00:00
mstarzinger
2d281e71ac Make --always-opt also optimize top-level code.
This enables eager optimization of top-level code with TurboFan and
extends test coverage by triggering it with the --always-opt flag.
Script contexts are now also properly allocated in TurboFan.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1053063003

Cr-Commit-Position: refs/heads/master@{#27633}
2015-04-07 15:44:23 +00:00
machenbach
74dc9e1710 Revert of CpuProfiler: public API for deopt info in cpu profiler. (patchset id:150001 of https://codereview.chromium.org/1045753002/)
Reason for revert:
[Sheriff] Breaks compile here:
http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/6115

Original issue's description:
> CpuProfiler: public API for deopt info in cpu profiler.
>
> BUG=chromium:452067
> LOG=n
>
> Committed: https://crrev.com/baf927ff5115ec62a6dad684b9232ed9d3960e3a
> Cr-Commit-Position: refs/heads/master@{#27626}

TBR=alph@chromium.org,jkummerow@chromium.org,svenpanne@chromium.org,yurys@chromium.org,loislo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:452067

Review URL: https://codereview.chromium.org/1062053004

Cr-Commit-Position: refs/heads/master@{#27628}
2015-04-07 13:31:00 +00:00
loislo
baf927ff51 CpuProfiler: public API for deopt info in cpu profiler.
BUG=chromium:452067
LOG=n

Review URL: https://codereview.chromium.org/1045753002

Cr-Commit-Position: refs/heads/master@{#27626}
2015-04-07 12:40:47 +00:00
yangguo
8e723e9892 Debugger: remove debug command API.
Instead, please use v8::Isolate::RequestInterrupt to synchronize
to the main thread.

R=yurys@chromium.org
API=Removed v8::Debug::DebugBreakForCommand
LOG=Y

Review URL: https://codereview.chromium.org/1036863002

Cr-Commit-Position: refs/heads/master@{#27625}
2015-04-07 12:21:42 +00:00
martyn.capewell
8e846a6166 ARM64: Support sign extend for add and subtract
Support sxtb and sxth extend operators on add and subtract, as we've
done for ubtx/h. This is similar to ARM support for sxtab/h.

BUG=

Review URL: https://codereview.chromium.org/1064813003

Cr-Commit-Position: refs/heads/master@{#27624}
2015-04-07 11:34:41 +00:00
hpayer
59be4ba7f4 Reland "Merge old data and pointer space."
This reverts commit cbfcee5575.

BUG=

Review URL: https://codereview.chromium.org/1051233002

Cr-Commit-Position: refs/heads/master@{#27623}
2015-04-07 11:32:10 +00:00
titzer
0b4dfc2312 [turbofan] Rework handling of loop exits in loop peeling.
This CL primarily makes the loop peeling algorithm more robust; it no longer damages the graph if the loops are improperly closed.

R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1052753004

Cr-Commit-Position: refs/heads/master@{#27620}
2015-04-07 11:00:47 +00:00
bmeurer
49bb6617ab [ia32] Match -0 - x with sign bit flip.
We can use xorps/xorpd on Intel CPUs to flip the sign bit. Ideally we'd
use an absolute 128-bit constant in the code object, as OCaml/GCC
does, however that requires 128-bit alignment for code objects,
which is not yet implemented. So for now we materialize the mask
inline.

As drive-by-fix, don't hardcode xmm0 as scratch double register.

R=svenpanne@chromium.org

Review URL: https://codereview.chromium.org/1064833002

Cr-Commit-Position: refs/heads/master@{#27618}
2015-04-07 10:44:03 +00:00
jkummerow
90cbede588 Move prototype metadata from internal properties to prototype maps
The motivation is that we prefer to avoid creating internal properties, and we have a usable field on maps ("transitions", which is not used for prototype maps).
This CL also ensures the invariant that prototype maps are never shared, even if they are in dictionary mode.

Review URL: https://codereview.chromium.org/1033653002

Cr-Commit-Position: refs/heads/master@{#27617}
2015-04-07 10:42:57 +00:00
yangguo
c67cb287a9 Always update raw pointers when handling interrupts inside RegExp code.
R=mstarzinger@chromium.org
BUG=chromium:469480
LOG=N

Review URL: https://codereview.chromium.org/1034173002

Cr-Commit-Position: refs/heads/master@{#27615}
2015-04-07 09:44:57 +00:00
jkummerow
146598f44a JSEntryTrampoline: check for stack space before pushing arguments
Optimistically pushing a lot of arguments can run into the stack limit of the process, at least on operating systems where this limit is close to the limit that V8 sets for itself.

BUG=chromium:469768
LOG=y

Review URL: https://codereview.chromium.org/1056913003

Cr-Commit-Position: refs/heads/master@{#27614}
2015-04-07 09:13:44 +00:00
titzer
13d6de4986 [turbofan] Introduce BranchMatcher and DiamondMatcher helpers.
R=bmeurer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1054963002

Cr-Commit-Position: refs/heads/master@{#27613}
2015-04-07 09:03:37 +00:00
baptiste.afsa
ba41489da5 [turbofan][arm64] Match add with shifted operand for mult by a power of 2 plus 1.
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1056543002

Cr-Commit-Position: refs/heads/master@{#27612}
2015-04-07 08:48:24 +00:00
bmeurer
a1b2c275b7 [x64] Match -0 - x with sign bit flip.
We can use xorps/xorpd on Intel CPUs to flip the sign bit. Ideally we'd
use a RIP-relative 128-bit constant in the code object, as OCaml/GCC
does, however that requires 128-bit alignment for code objects, which is
not yet implemented. So for now we materialize the mask inline.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1046893002

Cr-Commit-Position: refs/heads/master@{#27611}
2015-04-07 07:35:03 +00:00
michael_dawson
c7068b3ee5 PPC: exclude test for AIX due to issue 2857
cctest/test-log/EquivalenceOfLoggingAndTraversal fails on
AIX because it does not correctly handle the full 64 bit
address space supported by AIX.  SKIP until the issue
is resolved.

	modified:   test/cctest/cctest.status

R=danno@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1055183002

Cr-Commit-Position: refs/heads/master@{#27608}
2015-04-07 07:06:47 +00:00
adamk
909500aa1d Reimplement Maps and Sets in JS
Previously, the only optimized code path for Maps and Sets was for String keys.
This was achieved through an implementation of various complex operations
in Hydrogen. This approach was neither scalable nor forward-compatible.

This patch adds the necessary intrinsics to implement Maps and Sets almost entirely
in JS. The added intrinsics are:

  %_FixedArrayGet
  %_FixedArraySet
  %_TheHole
  %_JSCollectionGetTable
  %_StringGetRawHashField

With these additions, as well as a few changes to what's exposed as runtime functions,
most of the C++ code backing Maps and Sets is gone (including both runtime code in
objects.cc and Crankshaft in hydrogen.cc).

Review URL: https://codereview.chromium.org/947683002

Cr-Commit-Position: refs/heads/master@{#27605}
2015-04-07 00:12:04 +00:00
mike
3b624a1796 Re-implement %Generator% intrinsic as an object
From ES6 25.2.3 ("Properties of the GeneratorFunction Prototype
Object"):

> The GeneratorFunction prototype object is an ordinary object. It is
> not a function object and does not have an [[ECMAScriptCode]] internal
> slot or any other of the internal slots listed in Table 27 or Table
> 56.

Introduce one assertion for the value's type and additional tests for its
properties. Remove an invalid assertion that fails as a result of this
fix.

BUG=v8:3991
LOG=N

Review URL: https://codereview.chromium.org/1062633002

Cr-Commit-Position: refs/heads/master@{#27603}
2015-04-06 21:04:51 +00:00
dusan.milosavljevic
4b5af7b32e MIPS: Major fixes and clean-up in asm. for instruction encoding.
- Fixed single float register type instruction en[de]coding in assembler and disassembler.
- Added max and min instructions for r6 and corresponding tests.
- Fixed selection instruction for boundary cases in simulator.
- Update assembler tests to be more thorough wrt boundary cases.

TEST=cctest/test-assembler-mips64/MIPS17, MIPS18
     cctest/test-disasm-mips64/Type1
     cctest/test-assembler-mips/MIPS16, MIPS17
     cctest/test-disasm-mips/Type1
BUG=

Review URL: https://codereview.chromium.org/1057323002

Cr-Commit-Position: refs/heads/master@{#27601}
2015-04-06 11:54:38 +00:00
titzer
fa7c34764c [turbofan] Improve branch folding over phis and ranges.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1057843002

Cr-Commit-Position: refs/heads/master@{#27591}
2015-04-02 15:18:40 +00:00
phajdan.jr
260ab45170 Add missing license headers for some cctests.
BUG=chromium:98597
LOG=N

Review URL: https://codereview.chromium.org/1052943003

Cr-Commit-Position: refs/heads/master@{#27590}
2015-04-02 14:45:45 +00:00
ishell
ffe886de48 Support for typed arrays added to Heap::RightTrimFixedArray().
BUG=chromium:472513
LOG=Y

Review URL: https://codereview.chromium.org/1058793002

Cr-Commit-Position: refs/heads/master@{#27586}
2015-04-02 11:26:19 +00:00
mvstanton
b134ae74b5 v8:3539 - hold constructor feedback in weak cells
BUG=v8:3539
R=verwaest@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1029093002

Cr-Commit-Position: refs/heads/master@{#27581}
2015-04-02 09:39:35 +00:00
jochen
2a5eb8299b Expose an API on ArrayBufferView to copy out content w/o changing the buffer
BUG=v8:3996
LOG=y
R=dslomov@chromium.org,kbr@chromium.org,hpayer@chromium.org

Review URL: https://codereview.chromium.org/1041403003

Cr-Commit-Position: refs/heads/master@{#27580}
2015-04-02 09:36:39 +00:00
svenpanne
1592870822 Fixed the range information for string lengths.
Currently, this doesn't really help to generate better code,
nevertheless this is the right thing to do. When our type system(s)
are fixed, this should avoid falling back to floating point operations
in various cases.

Review URL: https://codereview.chromium.org/1057813002

Cr-Commit-Position: refs/heads/master@{#27578}
2015-04-02 08:32:51 +00:00
Erik Arvidsson
4977a4a83a Disable a new failing test262-es6 test
language/asi/S7.9_A5.7_T1

http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/3024/steps/Test262-es6/logs/S7.9_A5.7_T1

This looks suspicious. Maybe the monkeyYaml is the reason for this?

BUG=None
TBR=adamk

Review URL: https://codereview.chromium.org/1052083002

Cr-Commit-Position: refs/heads/master@{#27577}
2015-04-01 22:28:20 +00:00
arv
5639a767ec Update test262-es6 to 2015-03-31
BUG=None
LOG=N
R=adamk, rossberg

Review URL: https://codereview.chromium.org/1052013002

Cr-Commit-Position: refs/heads/master@{#27576}
2015-04-01 21:51:25 +00:00
arv
18cb17c924 ES6: Error functions should extend Error
The /NativeError/ functions should have Error as their [[Prototype]].

http://people.mozilla.org/~jorendorff/es6-draft.html#sec-properties-of-the-nativeerror-constructors

BUG=v8:3998
LOG=N
R=adamk, dslomov@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1049323003

Cr-Commit-Position: refs/heads/master@{#27572}
2015-04-01 17:29:59 +00:00
erikcorry
5a93a3304c Reland: Fix JSON parser Handle leak (previous CL 1041483004)
R=mstarzinger@chromium.org
BUG=v8:3976
BUG=472504
LOG=y

Review URL: https://codereview.chromium.org/1051833002

Cr-Commit-Position: refs/heads/master@{#27571}
2015-04-01 16:58:47 +00:00
arv
4374941837 [es6] Object.getOwnPropertyDescriptor should wrap primitives
In ES6 Object.getOwnPropertyDescriptor should call ToObject, which
means that primitive values will return descriptors from the wrapper.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/998163004

Cr-Commit-Position: refs/heads/master@{#27569}
2015-04-01 15:45:08 +00:00
mike
30ea626886 Remove invalid assertion
The removed assertion consistently passes not because the invoked
`close` method internally throws a `TypeError` but because the `close`
method does not exist. The ES6 specification does not define a `close`
method on the GeneratorPrototype, so this test is a tautology.

BUG=None
LOG=N
R=arv

Review URL: https://codereview.chromium.org/1046963002

Cr-Commit-Position: refs/heads/master@{#27567}
2015-04-01 15:22:19 +00:00
mike
3badfdcd50 Re-write duplicated assertions
The modified assertions targeted the property descriptor for the
template object's first "cooked" value. The code immediately preceeding
these statements asserts these values.

Update the assertions to instead target the property descriptor for the
template object's first "raw" value (which are otherwise untested).

BUG=

Review URL: https://codereview.chromium.org/1049523003

Cr-Commit-Position: refs/heads/master@{#27566}
2015-04-01 15:13:21 +00:00
kozyatinskiy
66d5519f7e Revert of Correctly compute line numbers in functions from the function constructor. (patchset id:80001 of https://codereview.chromium.org/701093003/)
Reason for revert:
Locations from New Function are broken in DevTools.

Original issue's description:
> Correctly compute line numbers in functions from the function constructor.
>
> R=aandrey@chromium.org
> BUG=chromium:109362
> LOG=Y
>
> Committed: https://code.google.com/p/v8/source/detail?r=25289

TBR=aandrey@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:109362
LOG=Y

Review URL: https://codereview.chromium.org/1053563002

Cr-Commit-Position: refs/heads/master@{#27564}
2015-04-01 10:11:26 +00:00
erikcorry
77dd1f347d Revert of Fix JSON parser Handle leak (patchset id:40001 of https://codereview.chromium.org/1041483004/)
Reason for revert:
Reverting due to JSOn parser failures

Original issue's description:
> Fix JSON parser Handle leak
>
> R=verwaest@chromium.org
> BUG=v8:3976
> LOG=y
>
> Committed: https://crrev.com/1ec850383bb82f6d8bebc7416e5f50b649d1eeaa
> Cr-Commit-Position: refs/heads/master@{#27512}

TBR=verwaest@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3976

Review URL: https://codereview.chromium.org/1052593002

Cr-Commit-Position: refs/heads/master@{#27562}
2015-04-01 09:23:02 +00:00
arv
d4a314f9dc [es6] Object.getPrototypeOf should work with values
This reverts commit 992751d0dc.

The final spec for Object.getPrototypeOf calls ToObject on the
parameter, which means that it should only throw for null and
undefined. For other non object values the prototype of the wrapper
should be used.

Difference from last time: Updated .status and will disable Blink
side tests as needed.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review URL: https://codereview.chromium.org/1051523003

Cr-Commit-Position: refs/heads/master@{#27558}
2015-04-01 00:22:39 +00:00
adamk
729b85ae86 Add a UseCounter for Object.observe
It triggers once per context that calls observe (or attempts to access
any observation metadata, e.g. through Object.getNotifier).

Review URL: https://codereview.chromium.org/1048213002

Cr-Commit-Position: refs/heads/master@{#27557}
2015-03-31 23:03:19 +00:00
dusan.milosavljevic
eb982a1bb1 MIPS: Fix assembler test for selection instructions to be run for r6 only.
TEST=test-assembler-mips/MIPS16
BUG=

Review URL: https://codereview.chromium.org/1047223002

Cr-Commit-Position: refs/heads/master@{#27556}
2015-03-31 22:40:03 +00:00
kozyatinskiy
9f6b1333a1 [V8] Don't ignore sourceURL comment in inline scripts in .stack
In DevTools we've already used sourceURL in inline scripts.
This CL makes the behavior of the V8 in the same for Error.stack property and v8::StackTrace.

BUG=v8:3920
LOG=Y
R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1044173002

Cr-Commit-Position: refs/heads/master@{#27554}
2015-03-31 19:36:06 +00:00
balazs.kilvady
6cb0e87cea Finish 'MIPS: [turbofan] Add backend support for float32 operations.'
Add missing parts of the port to MIPS/MIPS64 implementations.

BUG=

Review URL: https://codereview.chromium.org/1047213002

Cr-Commit-Position: refs/heads/master@{#27551}
2015-03-31 18:26:13 +00:00
arv
bb21979adf ES6: Unscopable should use ToBoolean
The spec settled on ToBoolean instead of only using not undefined.

BUG=v8:3827
LOG=N
R=adamk

Review URL: https://codereview.chromium.org/1045113002

Cr-Commit-Position: refs/heads/master@{#27548}
2015-03-31 15:14:20 +00:00
arv
a373b089e9 Remove --harmony-numeric-literal flag
We have been shipping harmony numeric literals since M41

R=rossberg@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/1024603002

Cr-Commit-Position: refs/heads/master@{#27545}
2015-03-31 14:24:30 +00:00
arv
a56fa150d1 [es6] Update test262 tests
Second try. Disabled the tests that were failing due to
https://github.com/tc39/test262/issues/215

This updates test262 to revision d24fd10 (2015/03/11).

The files moved around in the test repo and a lot of new tests are
failing.

BUG=None
LOG=N
R=adamk, rossberg

Review URL: https://codereview.chromium.org/1040093003

Cr-Commit-Position: refs/heads/master@{#27543}
2015-03-31 13:56:57 +00:00
mstarzinger
48c185fe75 [turbofan] Fix properties of IrOpcode::kThrow operator.
This changes the IrOpcode::kThrow operator to have kNoThrow property,
which sounds unintuitive, but holds for our graphs. The operators is
used to indicate exceptional control flow out of the function, but in
itself does not throw, the throwing is done by a runtime call.

R=titzer@chromium.org
TEST=unittests/CommonOperatorTest/CommonSharedOperatorTest.Properties

Review URL: https://codereview.chromium.org/1046173002

Cr-Commit-Position: refs/heads/master@{#27541}
2015-03-31 13:44:04 +00:00
svenpanne
677f3d5fd7 Added %_Likely/%_Unlikely intrinsics (special cases of GCC's __builin_expect).
Currently this only sets branch hints, so we get unlikely code "out of
the way", but in the long run the register allocator needs some love
to treat the unlikely code as, well, unlikely. :-)

Review URL: https://codereview.chromium.org/1048063002

Cr-Commit-Position: refs/heads/master@{#27540}
2015-03-31 13:23:23 +00:00
dcarney
e39750a26e [turbofan] smash GapInstruction into Instruction
R=titzer@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1041163002

Cr-Commit-Position: refs/heads/master@{#27538}
2015-03-31 13:06:43 +00:00
mstarzinger
e9e8ac7afc [turbofan] Project exception value out of calls.
TEST=cctest/test-run-jsexceptions

Review URL: https://codereview.chromium.org/989123003

Cr-Commit-Position: refs/heads/master@{#27537}
2015-03-31 12:26:39 +00:00
dusan.milosavljevic
f00b4e94fb MIPS: Refactor simulator and add selection instructions for r6.
TEST=
BUG=

Review URL: https://codereview.chromium.org/1046873004

Cr-Commit-Position: refs/heads/master@{#27530}
2015-03-30 17:37:13 +00:00
rmcilroy
00477a5d72 Ensure that GC idle notifications either make progress or stop requesting more GCs.
The V8::IdleNotification will only return 'True' when the gc idle time handler
thinks there is no more GC which can be done. However, the gc idle task handler
can end up repeatedly making no progress (e.g., if it can't finalize a sweep)
which causes idle tasks to be repeatedly scheduled in Chrome which do nothing
but wake up Chrome. Fix this by returning Done if we can't make any progress
within an Idle Round.

BUG=chromium:470615
LOG=Y

Review URL: https://codereview.chromium.org/1042483002

Cr-Commit-Position: refs/heads/master@{#27529}
2015-03-30 17:05:02 +00:00
ishell
3cb9f132ba Layout descriptor must be trimmed when corresponding descriptors array is trimmed to stay in sync.
BUG=chromium:470804
LOG=Y

Review URL: https://codereview.chromium.org/1033273005

Cr-Commit-Position: refs/heads/master@{#27528}
2015-03-30 17:03:50 +00:00
dslomov
50f4964085 Use counter for legacy const.
We only report the usages when full parse is happening, i.e. only when the function that declares a legacy const is compiled. This is an approximation that is easy to implement, but still should reflect the real-world usage.

BUG=v8:3942
LOG=N

Review URL: https://codereview.chromium.org/1041863002

Cr-Commit-Position: refs/heads/master@{#27526}
2015-03-30 16:21:02 +00:00
arv
06a17e54d9 Revert of [es6] Update test262 tests (patchset id:60001 of https://codereview.chromium.org/1025043002/)
Reason for revert:
Bot failed to include verifyNotEnumerable function for some screwed up reason.

Original issue's description:
> [es6] Update test262 tests
>
> This updates test262 to revision d24fd10 (2015/03/11).
>
> The files moved around in the test repo and a lot of new tests are
> failing.
>
> BUG=None
> LOG=N
> R=rossberg
>
> Committed: https://crrev.com/4f2fb3835feff3663146f12be42b01a226d0065e
> Cr-Commit-Position: refs/heads/master@{#27522}

TBR=rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=None

Review URL: https://codereview.chromium.org/1047713002

Cr-Commit-Position: refs/heads/master@{#27525}
2015-03-30 15:22:54 +00:00
mstarzinger
6c19c79f59 [turbofan] Fix test of %_MathClz32 intrinsic.
This test will fail once we optimize top-level code, because the
aforementioned intrinsic doesn't perform a NumberToUint32 conversion.

R=titzer@chromium.org
TEST=mjsunit/asm/math-clz32

Review URL: https://codereview.chromium.org/1041173002

Cr-Commit-Position: refs/heads/master@{#27524}
2015-03-30 15:10:39 +00:00
vogelheim
ee9c738929 Re-work the 'external snapshot' related build rules.
This prepares for re-landing crrev.com/956373002

This pulls all decision about the snapshot [no|internal|external] into one rule. Previously, this logic was in separate places and not /quite/ the same, which causes build problems.

BUG=

Review URL: https://codereview.chromium.org/1016603004

Cr-Commit-Position: refs/heads/master@{#27523}
2015-03-30 14:54:27 +00:00
arv
4f2fb3835f [es6] Update test262 tests
This updates test262 to revision d24fd10 (2015/03/11).

The files moved around in the test repo and a lot of new tests are
failing.

BUG=None
LOG=N
R=rossberg

Review URL: https://codereview.chromium.org/1025043002

Cr-Commit-Position: refs/heads/master@{#27522}
2015-03-30 14:28:15 +00:00
verwaest
87eef73234 Fix speedup of typedarray-length loading in the ICs as well as Crankshaft
BUG=

Review URL: https://codereview.chromium.org/1034393002

Cr-Commit-Position: refs/heads/master@{#27519}
2015-03-30 11:50:23 +00:00
dcarney
97981d9413 fix special index parsing
R=verwaest@chromium.org,dslomov@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1038313004

Cr-Commit-Position: refs/heads/master@{#27518}
2015-03-30 11:41:15 +00:00
hpayer
bffde6f4ab Allow more scavenges in idle notification by increasing the new space limit distance.
BUG=chromium:468554
LOG=n

Review URL: https://codereview.chromium.org/1034403002

Cr-Commit-Position: refs/heads/master@{#27517}
2015-03-30 11:40:06 +00:00
baptiste.afsa
f5a6f73ce6 Reland "Match fneg for -0.0 - x pattern."
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1040053002

Cr-Commit-Position: refs/heads/master@{#27516}
2015-03-30 10:53:02 +00:00
hpayer
eda9a88f2f Finalize sweeping in idle notification when all pages are swept.
A follow-up CL will implement incremental sweeping during idle time.

BUG=

Review URL: https://codereview.chromium.org/1038283003

Cr-Commit-Position: refs/heads/master@{#27513}
2015-03-30 10:05:35 +00:00
erikcorry
1ec850383b Fix JSON parser Handle leak
R=verwaest@chromium.org
BUG=v8:3976
LOG=y

Review URL: https://codereview.chromium.org/1041483004

Cr-Commit-Position: refs/heads/master@{#27512}
2015-03-30 09:55:30 +00:00
mvstanton
7c347c545e Ensure object literal element boilerplates aren't modified.
A bug allows JSObject literals with elements to have the elements in the
boilerplate modified.

BUG=466993
LOG=N

Review URL: https://codereview.chromium.org/1037273002

Cr-Commit-Position: refs/heads/master@{#27511}
2015-03-30 09:20:09 +00:00
bmeurer
8dad78cdbd [turbofan] Add backend support for float32 operations.
This adds the basics necessary to support float32 operations in TurboFan.
The actual functionality required to detect safe float32 operations will
be added based on this later. Therefore this does not affect production
code except for some cleanup/refactoring.

In detail, this patchset contains the following features:
- Add support for float32 operations to arm, arm64, ia32 and x64
  backends.
- Add float32 machine operators.
- Add support for float32 constants to simplified lowering.
- Handle float32 representation for phis in simplified lowering.

In addition, contains the following (related) cleanups:
- Fix/unify naming of backend instructions.
- Use AVX comparisons when available.
- Extend ArchOpcodeField to 9 bits (required for arm64).
- Refactor some code duplication in instruction selectors.

BUG=v8:3589
LOG=n
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1044793002

Cr-Commit-Position: refs/heads/master@{#27509}
2015-03-30 07:34:04 +00:00
svenpanne
0a7d4f496a Added %_NewConsString intrinsic.
No compiler support for now (BTW: %_NewString, doesn't have that,
either), inline allocation will come later. Hopefully the last
intrisic to add for a StringAddStub POC...

Review URL: https://codereview.chromium.org/1041723002

Cr-Commit-Position: refs/heads/master@{#27508}
2015-03-30 06:28:49 +00:00
jkummerow
c24ed0a277 Reland^2 "Filter invalid slots out from the SlotsBuffer after marking."
And reland "Use a slot that is located on a heap page when removing
invalid entries from the SlotsBuffer."

This reverts commits de018fbda3 and
d23a9f7a3e.

Reason for relanding: looking fine on Canary, let's get these fixes back in.

BUG=chromium:454297,chromium:470801
LOG=y
TBR=ishell@chromium.org

Review URL: https://codereview.chromium.org/1043703003

Cr-Commit-Position: refs/heads/master@{#27507}
2015-03-28 18:04:19 +00:00
ishell
9d2d8a9c8d This fixes missing incremental write barrier issue when double fields unboxing is enabled.
This CL also adds useful machinery that helps triggering incremental write barriers.

BUG=chromium:469146
LOG=Y

Review URL: https://codereview.chromium.org/1039733003

Cr-Commit-Position: refs/heads/master@{#27503}
2015-03-27 21:55:36 +00:00
dslomov
15ef61d468 Make sure debugger is ready for breakpoins when we process 'debugger' statement.
On 'debugger' statement, if anything in debugger calls 'EnsureDebugInfo'
on a function, EnsureDebugInfo would compile and substitute code without
debug break slots. This causes weird behavior later when stepping fails
to work (see added test as an example).
This fix is to make sure the debugger is prepared for breakpoints in
that case as well.

Also adds extra testing for bug 468661.

R=yangguo@chromium.org,yurys@chromium.orh
BUG=v8:3990,chromium:468661
LOG=N

Review URL: https://codereview.chromium.org/1032353002

Cr-Commit-Position: refs/heads/master@{#27502}
2015-03-27 18:33:17 +00:00
yangguo
019096f829 Serializer: move to a subfolder and clean up includes.
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1041743002

Cr-Commit-Position: refs/heads/master@{#27501}
2015-03-27 15:29:07 +00:00
dcarney
d76526032f fix reconfigure of indexed integer exotic objects
R=verwaest@chromium.org
BUG=466084
LOG=N

Review URL: https://codereview.chromium.org/1037213002

Cr-Commit-Position: refs/heads/master@{#27498}
2015-03-27 10:12:55 +00:00
svenpanne
bf08ea9929 Add %_IncrementStatsCounter intrinsic.
Review URL: https://codereview.chromium.org/1031383002

Cr-Commit-Position: refs/heads/master@{#27497}
2015-03-27 10:07:03 +00:00
yangguo
98580e4b83 Revert of [turbofan][arm64] Match fneg for -0.0 - x pattern. (patchset id:1 of https://codereview.chromium.org/1013743006/)
Reason for revert:
Revert due to crash.

Original issue's description:
> [turbofan][arm64] Match fneg for -0.0 - x pattern.
>
> Note that this patch add an extra bit to the ArchOpcodeField.
>
> R=bmeurer@chromium.org
>
> Committed: https://crrev.com/fe7441225100660d01e66ce3bcaefe368f62df81
> Cr-Commit-Position: refs/heads/master@{#27494}

TBR=bmeurer@chromium.org,baptiste.afsa@arm.com
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1041633002

Cr-Commit-Position: refs/heads/master@{#27495}
2015-03-27 09:12:07 +00:00
baptiste.afsa
fe74412251 [turbofan][arm64] Match fneg for -0.0 - x pattern.
Note that this patch add an extra bit to the ArchOpcodeField.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1013743006

Cr-Commit-Position: refs/heads/master@{#27494}
2015-03-27 08:32:30 +00:00
hpayer
c293448f3e Simplified garbage collection idle handler.
The current GC idle time handling heuristics are getting too complicated. Moreover, with longer idle time we are getting more full garbage collections. This CL shrinks the idle round window and reduces complexity in the case where we cause a full garbage collection.

BUG=chromium:468554
LOG=n

Review URL: https://codereview.chromium.org/1024043003

Cr-Commit-Position: refs/heads/master@{#27493}
2015-03-27 08:00:51 +00:00
ishell
de018fbda3 Revert of Reland "Filter invalid slots out from the SlotsBuffer after marking." (patchset id:2 of https://codereview.chromium.org/1032833002/)
Reason for revert:
Reverting risky GC changes that block v8 roll.

Original issue's description:
> Reland "Filter invalid slots out from the SlotsBuffer after marking."
>
> > There are two reasons that could cause invalid slots appearance in SlotsBuffer:
> > 1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
> > 2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
>
> > This CL also adds useful machinery that helps triggering incremental write barriers.
>
> > BUG=chromium:454297
> > LOG=Y
>
> NOTRY=true
>
> Committed: https://crrev.com/f86aadd1d45c756467dff8e08a055b462d7a060b
> Cr-Commit-Position: refs/heads/master@{#27433}

TBR=machenbach@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true

Review URL: https://codereview.chromium.org/1041593002

Cr-Commit-Position: refs/heads/master@{#27491}
2015-03-27 06:51:13 +00:00
erikcorry
56ac39757b Disable test on deopt fuzzer that uses a little too much memory
R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1032373002

Cr-Commit-Position: refs/heads/master@{#27485}
2015-03-26 16:53:52 +00:00
dcarney
a45a1de7aa add access checks to receivers on function callbacks
R=verwaest@chromium.org
BUG=468451
LOG=N

Review URL: https://codereview.chromium.org/1036743004

Cr-Commit-Position: refs/heads/master@{#27482}
2015-03-26 15:22:08 +00:00
mstarzinger
fced43a686 [debugger] Make Runtime_DebugEvaluate safe for reentry.
Only one FrameInspector can be active at a time on any given stack,
this ensures that it's lifetime is sufficiently scoped.

R=yangguo@chromium.org
TEST=mjsunit/regress/regress-crbug-259300

Review URL: https://codereview.chromium.org/1034743002

Cr-Commit-Position: refs/heads/master@{#27477}
2015-03-26 12:31:02 +00:00
dcarney
2455aadf7b two pass phantom collection
R=jochen@chromium.org, erikcorry@chromium.org

BUG=

Review URL: https://codereview.chromium.org/998253006

Cr-Commit-Position: refs/heads/master@{#27475}
2015-03-26 11:50:28 +00:00
verwaest
accbe2216e Remove CanRetainOtherContext since embedded objects are now weak.
Instead of CanRetainOtherContext, we now manually blacklist all access-checked objects.

BUG=

Review URL: https://codereview.chromium.org/1020803004

Cr-Commit-Position: refs/heads/master@{#27473}
2015-03-26 11:22:07 +00:00
yangguo
69383d6366 Revert of Revert of Debugger: deduplicate shared function info when setting script break points. (patchset id:1 of https://codereview.chromium.org/999273003/)
Reason for revert:
Reland since the failure has been fixed in https://codereview.chromium.org/1035523005/

Original issue's description:
> Revert of Debugger: deduplicate shared function info when setting script break points. (patchset  id:60001 of https://codereview.chromium.org/998253005/)
>
> Reason for revert:
> Code caching failures.
>
> Original issue's description:
> > Debugger: deduplicate shared function info when setting script break points.
> >
> > Also fix Debug.showBreakPoints for multiple break points at the same location.
> >
> > BUG=v8:3960
> > LOG=N
> >
> > Committed: https://crrev.com/73b17a71a22564c0b66d9aa7c00948c748f5b290
> > Cr-Commit-Position: refs/heads/master@{#27444}
>
> TBR=mstarzinger@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:3960
>
> Committed: https://crrev.com/9b29d008dfcc00bf56be8040add1d2c5e404673b
> Cr-Commit-Position: refs/heads/master@{#27448}

TBR=mstarzinger@chromium.org
BUG=v8:3960
LOG=N

Review URL: https://codereview.chromium.org/1037013002

Cr-Commit-Position: refs/heads/master@{#27472}
2015-03-26 10:43:51 +00:00
yangguo
ed9191221b Serializer: ensure unique script ids when deserializing.
R=jochen@chromium.org

Review URL: https://codereview.chromium.org/1035523005

Cr-Commit-Position: refs/heads/master@{#27471}
2015-03-26 09:50:51 +00:00
yurys
f13d04d28c Return timestamp of the last recorded interval to the caller of HeapProfiler::GetHeapStats
Before this patch the embedder could assign timestamp to the last interval after calling GetHeapStats. This would be slightly different from the timstamps assigned by v8 internally and written into heap snapshot. This patch allow to avoid this small discrepancy by returning timestamp along with last heap stats update.

BUG=chromium:467222
LOG=Y

Review URL: https://codereview.chromium.org/1037803002

Cr-Commit-Position: refs/heads/master@{#27466}
2015-03-26 08:50:02 +00:00
svenpanne
4518e92706 Add full TurboFan support for accessing SeqString contents.
LOG=n

Review URL: https://codereview.chromium.org/1013753016

Cr-Commit-Position: refs/heads/master@{#27465}
2015-03-26 08:36:36 +00:00
yangguo
46cc8740a9 Debugger: remove unused JS Debugger API.
R=ulan@chromium.org

Review URL: https://codereview.chromium.org/1005053004

Cr-Commit-Position: refs/heads/master@{#27464}
2015-03-26 08:15:45 +00:00
kozyatinskiy
aca928b7ad Reland [V8] Removed SourceLocationRestrict
This method uses in messages.js in GetSourceLine and GetPositionInLine. This methods uses in v8::Message API methods and there is no documentation about it.
Method looks obsolete.
One of the strange side effect is shown by attached issue.

BUG=chromium:468781
TBR=yangguo@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/1033973002

Cr-Commit-Position: refs/heads/master@{#27458}
2015-03-25 23:11:12 +00:00
machenbach
f0d555b26d Revert of add access checks to receivers on function callbacks (patchset id:80001 of https://codereview.chromium.org/1036743004/)
Reason for revert:
This seems to lead to lots of timeouts of layout tests, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064/builds/2807

Original issue's description:
> add access checks to receivers on function callbacks
>
> R=verwaest@chromium.org
> BUG=468451
> LOG=N
>
> Committed: https://crrev.com/255528710b0a128eef7b66827d9ac43e44650ff4
> Cr-Commit-Position: refs/heads/master@{#27452}

TBR=verwaest@chromium.org,dcarney@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=468451

Review URL: https://codereview.chromium.org/1023783009

Cr-Commit-Position: refs/heads/master@{#27457}
2015-03-25 18:31:51 +00:00
titzer
9be9e80c9c Disable some flags on threading tests that will break with --turbo-osr.
R=vogelheim@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1023753008

Cr-Commit-Position: refs/heads/master@{#27455}
2015-03-25 18:06:06 +00:00
titzer
ebc5167476 [turbofan] Fix loading of JSFunction from activation in case of adapter frame.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1026023004

Cr-Commit-Position: refs/heads/master@{#27454}
2015-03-25 17:46:16 +00:00
dcarney
255528710b add access checks to receivers on function callbacks
R=verwaest@chromium.org
BUG=468451
LOG=N

Review URL: https://codereview.chromium.org/1036743004

Cr-Commit-Position: refs/heads/master@{#27452}
2015-03-25 16:16:56 +00:00
machenbach
c74d168502 Mark test as flaky.
BUG=v8:3838
LOG=n
TBR=ulan@chromium.org

Review URL: https://codereview.chromium.org/1012993007

Cr-Commit-Position: refs/heads/master@{#27450}
2015-03-25 15:55:57 +00:00
yangguo
9b29d008df Revert of Debugger: deduplicate shared function info when setting script break points. (patchset id:60001 of https://codereview.chromium.org/998253005/)
Reason for revert:
Code caching failures.

Original issue's description:
> Debugger: deduplicate shared function info when setting script break points.
>
> Also fix Debug.showBreakPoints for multiple break points at the same location.
>
> BUG=v8:3960
> LOG=N
>
> Committed: https://crrev.com/73b17a71a22564c0b66d9aa7c00948c748f5b290
> Cr-Commit-Position: refs/heads/master@{#27444}

TBR=mstarzinger@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3960

Review URL: https://codereview.chromium.org/999273003

Cr-Commit-Position: refs/heads/master@{#27448}
2015-03-25 15:19:20 +00:00
mstarzinger
7d0e5593e5 [turbofan] Support initial step-in through debugger statement.
This adapts the debugger so that the first break event starting the
stepping process can come from optimized code. TurboFan supports a
debugger statement and hence can be the top-most frame whenever the
Debug::HandleDebugBreak handler is triggered.

R=yangguo@chromium.org
TEST=mjsunit/debug,cctest/test-debug

Review URL: https://codereview.chromium.org/1038613002

Cr-Commit-Position: refs/heads/master@{#27447}
2015-03-25 15:02:43 +00:00
michael_dawson
5a91597383 PPC: Ensure predictable code size at map_check in LCodeGen::DoInstanceOfKnownGlobal.
R=mbrandy@us.ibm.com, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1035723003

Cr-Commit-Position: refs/heads/master@{#27446}
2015-03-25 14:59:21 +00:00
yangguo
73b17a71a2 Debugger: deduplicate shared function info when setting script break points.
Also fix Debug.showBreakPoints for multiple break points at the same location.

BUG=v8:3960
LOG=N

Review URL: https://codereview.chromium.org/998253005

Cr-Commit-Position: refs/heads/master@{#27444}
2015-03-25 14:53:49 +00:00
dusan.milosavljevic
30dcf800df Make ParameterTraits specializations for 32-bit integers valid for all arches.
TEST=
BUG=

Review URL: https://codereview.chromium.org/1031113002

Cr-Commit-Position: refs/heads/master@{#27441}
2015-03-25 14:21:29 +00:00
mstarzinger
38a719f965 Switch full-codegen from StackHandlers to handler table.
This switches full-codegen to no longer push and pop StackHandler
markers onto the operand stack, but relies on a range-based handler
table instead. We only use StackHandlers in JSEntryStubs to mark the
transition from C to JS code.

Note that this makes deoptimization and OSR from within any try-block
work out of the box, makes the non-exception paths faster and should
overall be neutral on the memory footprint (pros).

On the other hand it makes the exception paths slower and actually
throwing and exception more expensive (cons).

R=yangguo@chromium.org
TEST=cctest/test-run-jsexceptions/DeoptTry

Review URL: https://codereview.chromium.org/1010883002

Cr-Commit-Position: refs/heads/master@{#27440}
2015-03-25 13:14:02 +00:00
dslomov
1f6c46879b Test for access checks on super assignments.
R=verwaest@chromium.org
BUG=chromium:470113
LOG=N

Review URL: https://codereview.chromium.org/1034523002

Cr-Commit-Position: refs/heads/master@{#27438}
2015-03-25 12:52:11 +00:00
mstarzinger
1a1e53a311 [turbofan] Remove obsolete JSDebugger operator.
R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1029583009

Cr-Commit-Position: refs/heads/master@{#27437}
2015-03-25 12:43:47 +00:00
dcarney
637f96b8d3 fix nonmasking interceptor ic with interceptor on receiver
TBR=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1036843002

Cr-Commit-Position: refs/heads/master@{#27436}
2015-03-25 12:34:10 +00:00
mvstanton
d1478f4e4f VectorICs: Address test-heap TODOS
Tests for non-clearing of weak cells in LoadICs weren't running when
vector ICs are enabled.

R=ulan@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1032843002

Cr-Commit-Position: refs/heads/master@{#27435}
2015-03-25 11:15:22 +00:00
ulan
f86aadd1d4 Reland "Filter invalid slots out from the SlotsBuffer after marking."
> There are two reasons that could cause invalid slots appearance in SlotsBuffer:
> 1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
> 2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).

> This CL also adds useful machinery that helps triggering incremental write barriers.

> BUG=chromium:454297
> LOG=Y

NOTRY=true

Review URL: https://codereview.chromium.org/1032833002

Cr-Commit-Position: refs/heads/master@{#27433}
2015-03-25 08:52:58 +00:00
machenbach
4629f8023a Revert of Filter invalid slots out from the SlotsBuffer after marking. (patchset id:220001 of https://codereview.chromium.org/1010363005/)
Reason for revert:
Need to revert in order to revert https://codereview.chromium.org/1029323003/

Original issue's description:
> Filter invalid slots out from the SlotsBuffer after marking.
>
> There are two reasons that could cause invalid slots appearance in SlotsBuffer:
> 1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
> 2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).
>
> This CL also adds useful machinery that helps triggering incremental write barriers.
>
> BUG=chromium:454297
> LOG=Y
>
> Committed: https://crrev.com/5c47c1c0d3e4a488f190c16a64ee02f5a14e6561
> Cr-Commit-Position: refs/heads/master@{#27423}

TBR=hpayer@chromium.org,erik.corry@gmail.com,ishell@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:454297

Review URL: https://codereview.chromium.org/1033453005

Cr-Commit-Position: refs/heads/master@{#27426}
2015-03-24 22:01:40 +00:00
titzer
006ae96dab Set test expectations prior to enabling --turbo-osr.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1018513003

Cr-Commit-Position: refs/heads/master@{#27425}
2015-03-24 19:02:55 +00:00
dslomov
49c3a60651 Do not assign positions to parser-generated desugarings.
The root cause for the bug is that the positions assigned to desugared
code was inconsistent with the source ranges of block scopes.
Since the fact that the position is assigned causes the debugger to
break at the parser-generated statement, the fix is to remove positions
from those nodes that we do not want to break on.

The CL also teaches Hydrogen to tolerate these cases.

R=adamk@chromium.org,rossberg@chromium.org
BUG=chromium:468661
LOG=Y

Review URL: https://codereview.chromium.org/1032653002

Cr-Commit-Position: refs/heads/master@{#27424}
2015-03-24 17:16:53 +00:00
ishell
5c47c1c0d3 Filter invalid slots out from the SlotsBuffer after marking.
There are two reasons that could cause invalid slots appearance in SlotsBuffer:
1) If GC trims "tail" of an array for which it has already recorded a slots and then migrate another object to the "tail".
2) Tagged slot could become a double slot after migrating of an object to another map with "shifted" fields (for example as a result of generalizing immutable data property to a data field).

This CL also adds useful machinery that helps triggering incremental write barriers.

BUG=chromium:454297
LOG=Y

Review URL: https://codereview.chromium.org/1010363005

Cr-Commit-Position: refs/heads/master@{#27423}
2015-03-24 17:07:44 +00:00
marja
cb7279da81 [strong] Check strong mode free variables against the global object.
Gather references to unbound variables where the reference (VariableProxy) is
inside strong mode. Check them against the global object when a script is bound
to a context (during compilation).

This CL only checks unbound variables which are not inside lazy functions - TBD
how do we solve that; alternatives: add developer mode which disables laziness /
do the check whenever lazy functions are really compiled.

BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1005063002

Cr-Commit-Position: refs/heads/master@{#27422}
2015-03-24 16:46:59 +00:00
dcarney
a3b7c8320e fix attribute lookup for all can read indexed interceptors
R=verwaest@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1034513002

Cr-Commit-Position: refs/heads/master@{#27420}
2015-03-24 16:10:06 +00:00
aandrey
fc1689392e Make debugger step into bound callbacks passed to Array.forEach.
BUG=chromium:450004
R=yangguo@chromium.org, kozyatinskiy@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1030673002

Cr-Commit-Position: refs/heads/master@{#27419}
2015-03-24 16:02:12 +00:00
svenpanne
20dce719ee Added %_HeapObjectGetMap and %_MapGetInstanceType intrinsics.
These are needed (among other things) for a TurboFan-generated
StringAddStub. Furthermore, they can be used to nuke the overly
complex %_IsInstanceType intrisic, it's completely expressible in
JavaScript now, but that will be done in a separate CL.

Alpha-sorted things a bit on the way to ease navigation.

Review URL: https://codereview.chromium.org/1010973010

Cr-Commit-Position: refs/heads/master@{#27415}
2015-03-24 15:20:57 +00:00
erikcorry
4c806802b5 Fix OOM bug 3976.
Also introduce --trace-fragmentation-verbose, and fix --always-compact.

R=ulan@chromium.org
BUG=v8:3976
LOG=y

Review URL: https://codereview.chromium.org/1024823002

Cr-Commit-Position: refs/heads/master@{#27414}
2015-03-24 15:02:28 +00:00
ulan
1efcca7f04 Reload length of retained_maps array after GC.
This fixes flaky GC stress failure:

> Fatal error in ../src/heap/mark-compact.cc, line 2127
> Check failed: retained_maps->Get(i)->IsWeakCell().

BUG=
TEST=test-heap/RegressArrayListGC

Review URL: https://codereview.chromium.org/1026113004

Cr-Commit-Position: refs/heads/master@{#27412}
2015-03-24 14:36:09 +00:00
mstarzinger
1fefa31df6 Remove CompilationInfoWithZone from public API.
This removes the CompilationInfoWithZone class from the header file
because it is more than a pure convenience class and shouldn't be used
outside of the compiler at all.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1000353004

Cr-Commit-Position: refs/heads/master@{#27411}
2015-03-24 14:17:17 +00:00
titzer
9ac4ab799c [turbofan] Remove Instruction::IsControl() and Instruction::MarkAsControl()
R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1031803004

Cr-Commit-Position: refs/heads/master@{#27409}
2015-03-24 14:05:35 +00:00
dcarney
adeb82ef23 fix disposal of phantom handles in GlobalValueMap
additionally, add a drive by fix to WeakCallbackInfo

R=jochen@chromium.org, erikcorry@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1026283004

Cr-Commit-Position: refs/heads/master@{#27407}
2015-03-24 13:22:15 +00:00
jarin
0f94c96cbc Test for wrong arguments object materialization.
The test demonstrates a bad interaction between arguments object
materialization, escape analysis and exception handling.

We can return a wrong arguments object if we materialize arguments
object (using f.arguments) and then throw around f's frame so that f
does not clean up the materialized frame information (see the
MaterializedObjectStore in deoptimizer.h/.cc). If we enter another
function that has the same frame pointer and request an arguments object
of (or lazily deoptimize) that function, we can get the materialized
object of the original function.

We should clean up the materialized object store when we unwind the
stack.

BUG=v8:3985
LOG=n

Review URL: https://codereview.chromium.org/1032623003

Cr-Commit-Position: refs/heads/master@{#27406}
2015-03-24 13:20:21 +00:00
loislo
ae461b9ed0 CpuProfiler: push the collected information about deopts to cpu profiler
it is the last patch of https://codereview.chromium.org/1012633002

All that we need here is to push the collected info to the profiler
and convert it into actionable information about deopt.

On the Next: get the info accessible by embedder.

BUG=chromium:452067
LOG=n
TEST=DeoptAtFirstLevelInlinedSource, DeoptAtSecondLevelInlinedSource, DeoptUntrackedFunction

Review URL: https://codereview.chromium.org/1013143003

Cr-Commit-Position: refs/heads/master@{#27403}
2015-03-24 12:46:26 +00:00
caitpotter88
6fcc22dce1 [es6] call ToString() on template substitutions
BUG=v8:3980
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1027183002

Cr-Commit-Position: refs/heads/master@{#27402}
2015-03-24 12:44:01 +00:00
titzer
e62f754de7 [turbofan] Rename Node::RemoveAllInputs() to Node::NullAllInputs().
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1032553006

Cr-Commit-Position: refs/heads/master@{#27401}
2015-03-24 12:40:13 +00:00
machenbach
310d75218e Revert of [V8] Removed SourceLocationRestrict (patchset id:40001 of https://codereview.chromium.org/1022333004/)
Reason for revert:
[Sheriff] This seems to change layout test expectations of some tests, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2317

Expectation example:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/2317/layout-test-results/fast/events/window-onerror-11-pretty-diff.html

Please add a needsmanualrebaseline expectation to the tests affected by this change on the blink side first before relanding.

Original issue's description:
> [V8] Removed SourceLocationRestrict
>
> This method uses in messages.js in GetSourceLine and GetPositionInLine. This methods uses in v8::Message API methods and there is no documentation about it.
> Method looks obsolete.
> One of the strange side effect is shown by attached issue.
>
> BUG=chromium:468781
> R=yangguo@chromium.org
> LOG=Y
>
> Committed: https://crrev.com/b563ceac0f95551a128a1403cdbacc7aefcdabaf
> Cr-Commit-Position: refs/heads/master@{#27374}

TBR=yangguo@chromium.org,kozyatinskiy@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:468781

Review URL: https://codereview.chromium.org/1028413002

Cr-Commit-Position: refs/heads/master@{#27398}
2015-03-24 12:04:43 +00:00
yangguo
992751d0dc Revert of [es6] Object.getPrototypeOf should work with values (patchset id:40001 of https://codereview.chromium.org/1014813003/)
Reason for revert:
Layout test failures. Please update layout test expectations before landing this, in order to not block the roll.

Original issue's description:
> [es6] Object.getPrototypeOf should work with values
>
> The final spec for Object.getPrototypeOf calls ToObject on the
> parameter, which means that it should only throw for null and
> undefined. For other non object values the prototype of the wrapper
> should be used.
>
> BUG=v8:3964
> LOG=N
> R=adamk, rossberg@chromium.org
>
> Committed: https://crrev.com/ea463a916bbe5994b0d2d04e8075058b373b2e2c
> Cr-Commit-Position: refs/heads/master@{#27354}

TBR=adamk@chromium.org,rossberg@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3964

Review URL: https://codereview.chromium.org/1033623002

Cr-Commit-Position: refs/heads/master@{#27389}
2015-03-24 09:19:26 +00:00
jochen
d19d0be8a0 Remove calls to IdleNotification()
All users should use IdleNotificationDeadline() instead

BUG=none
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1028163003

Cr-Commit-Position: refs/heads/master@{#27386}
2015-03-24 08:30:02 +00:00
verwaest
1b16678f25 Properly handle non-JSFunction constructors in CanRetainOtherContext
BUG=

Review URL: https://codereview.chromium.org/1017263003

Cr-Commit-Position: refs/heads/master@{#27379}
2015-03-23 19:24:58 +00:00
mvstanton
6689cc27eb VectorICs: keyed element loads were kicking out non-smi keys unnecessarily
Handlers should be in charge of this work. The change uncovered a bug in
vector-ics related to keyed loads into strings. It's important for
StringCharCodeAtGenerator, a helper used in full code and in
LoadIndexedStringStub (a handler) to protect the vector and slot registers
when it makes a runtime call to convert a HeapNumber to a Smi.

It's still possible for the handler to MISS after this call, perhaps due
to out of bounds access. In that case, the vector and slot registers need
to be delivered safely to the MISS handler.

BUG=

Review URL: https://codereview.chromium.org/1028093002

Cr-Commit-Position: refs/heads/master@{#27377}
2015-03-23 18:50:23 +00:00
mstarzinger
7421c7f598 Remove dangerous constructor from CompilationInfoWithZone.
This removes the stub-based constructor from CompilationInfoWithZone
as this class is more than a pure convenience class and only by chance
doesn't have an effect in the destructor.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1026513004

Cr-Commit-Position: refs/heads/master@{#27376}
2015-03-23 17:30:45 +00:00
kozyatinskiy
b563ceac0f [V8] Removed SourceLocationRestrict
This method uses in messages.js in GetSourceLine and GetPositionInLine. This methods uses in v8::Message API methods and there is no documentation about it.
Method looks obsolete.
One of the strange side effect is shown by attached issue.

BUG=chromium:468781
R=yangguo@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/1022333004

Cr-Commit-Position: refs/heads/master@{#27374}
2015-03-23 16:33:19 +00:00
dcarney
0a835afb29 [turbofan] add non fixed slot constraint to register allocator
R=jarin@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1018853003

Cr-Commit-Position: refs/heads/master@{#27373}
2015-03-23 16:03:21 +00:00
caitpotter88
24a9b8815e [es5] call ToString() on argument in String.prototype.concat() fast case
15.5.4.6 5.b requires each part to be converted using ToString(). This also needs to occur in the single argument fast-case.

BUG=v8:3981
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1029103002

Cr-Commit-Position: refs/heads/master@{#27372}
2015-03-23 15:07:46 +00:00
kozyatinskiy
ed8394f1e3 [V8] Added debug-sourceinfo.js with LF endings back
Readded after https://codereview.chromium.org/1029063002/ with correct line endings.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1032443002

Cr-Commit-Position: refs/heads/master@{#27370}
2015-03-23 14:51:03 +00:00
kozyatinskiy
ec9f0a5307 [V8] Removed debug-sourceinfo.js with CRLF line endings
We can't simple delete and add one file in one CL. This is necessary for replacing this test with version with LF line endings.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1029063002

Cr-Commit-Position: refs/heads/master@{#27368}
2015-03-23 14:31:40 +00:00
titzer
d931700b81 [turbofan] Fix control reducer bug with walking non-control edges during ConnectNTL phase.
R=jarin@chromium.org
BUG=chromium:469605
LOG=Y

Review URL: https://codereview.chromium.org/1030623003

Cr-Commit-Position: refs/heads/master@{#27366}
2015-03-23 14:08:25 +00:00
ulan
c56fa73699 Reland "Fix memory leak caused by field type in descriptor array."
BUG=v8:3877
LOG=NO

Review URL: https://codereview.chromium.org/1018283002

Cr-Commit-Position: refs/heads/master@{#27362}
2015-03-23 11:20:50 +00:00
chunyang.dai
9fe378be22 Remove the check for turbofan unsupported platform.
BUG=

Review URL: https://codereview.chromium.org/1025073004

Cr-Commit-Position: refs/heads/master@{#27359}
2015-03-23 10:06:27 +00:00
arv
ea463a916b [es6] Object.getPrototypeOf should work with values
The final spec for Object.getPrototypeOf calls ToObject on the
parameter, which means that it should only throw for null and
undefined. For other non object values the prototype of the wrapper
should be used.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1014813003

Cr-Commit-Position: refs/heads/master@{#27354}
2015-03-23 08:40:47 +00:00
caitpotter88
fd51f615eb [es6] remove --harmony-templates flag
BUG=v8:3230
R=dslomov@chromium.org, arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1027593005

Cr-Commit-Position: refs/heads/master@{#27352}
2015-03-23 07:01:48 +00:00
Toon Verwaest
0f573464e6 Ensure we don't overflow in BCE
BUG=chromium:469148
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1023123003

Cr-Commit-Position: refs/heads/master@{#27346}
2015-03-20 16:43:05 +00:00
caitpotter88
bef80fcfd7 [es6] generate rest parameters correctly for subclass constructors
BUG=v8:3977
R=dslomov@chromium.org, arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1018043003

Cr-Commit-Position: refs/heads/master@{#27344}
2015-03-20 14:07:16 +00:00
balazs.kilvady
86a6b6ff91 MIPS: [turbofan] Turn Math.clz32 into an inlinable builtin.
Port 3aa206b865

BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/1020223002

Cr-Commit-Position: refs/heads/master@{#27343}
2015-03-20 14:05:36 +00:00
bmeurer
ff89876bb9 [turbofan] Fix lowering of Math.max for integral inputs.
R=jarin@chromium.org
BUG=chromium:468162
LOG=y

Review URL: https://codereview.chromium.org/1027753002

Cr-Commit-Position: refs/heads/master@{#27341}
2015-03-20 12:05:19 +00:00
rossberg
d0e20d8221 [harmony] Move some regression tests to the right place
TBR=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1027693003

Cr-Commit-Position: refs/heads/master@{#27339}
2015-03-20 11:03:14 +00:00
dslomov
af04fdfec8 Remove harmony-strings flag.
String functions are shipping since 4.1/Chrome M41, it is time to unflag.

R=yanngguo@chromium.org,rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1024813002

Cr-Commit-Position: refs/heads/master@{#27337}
2015-03-20 10:43:38 +00:00
bmeurer
d5893cad6b [turbofan] Work-around untagged result of CompareIC in pointer maps.
BUG=chromium:469089
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1026683002

Cr-Commit-Position: refs/heads/master@{#27333}
2015-03-20 09:45:12 +00:00
Benedikt Meurer
3aa206b865 [turbofan] Turn Math.clz32 into an inlinable builtin.
R=dcarney@chromium.org, yangguo@chromium.org
BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/1021183002

Cr-Commit-Position: refs/heads/master@{#27329}
2015-03-20 08:37:34 +00:00
Benedikt Meurer
c16b91e84a [turbofan] Fix unit test coverage for JSIntrinsicLowering.
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1028553002

Cr-Commit-Position: refs/heads/master@{#27328}
2015-03-20 08:26:56 +00:00
aperez
3c3ce1bca8 Parser: Fix crash on stack overflow when lazy-parsing arrow functions
The problem manifests itself when parsing manages to return something
meaningful in the presence of a stack overflow. This happens because
calling ParserBase::Next() will still return one valid token on stack
overflow, before starting to return invalid tokens.

Take the following input as example:

        a.map(v => v + 1);
              | |
       already   next token
        parsed   (which will be an invalid token
  (identifier)   because of a stack overflow)

The "v" may have been already parsed into a VariableProxy, then if a
stack overflow occurs, next token will be an invalid token (instead
of Token::ARROW), but the parser will return the VariableProxy.

This always happens when lazy-parsing arrow functions, so the position
in the input stream where the the arrow function code ends is known.
This fix adds a check that ensures that parsing ended at the end
position of the arrow function.

BUG=465671
LOG=N

Review URL: https://codereview.chromium.org/1023483003

Cr-Commit-Position: refs/heads/master@{#27325}
2015-03-20 00:17:50 +00:00
hpayer
cbfcee5575 Revert "Merge old data and pointer space."
TBR=verwaest@chromium.org,ulan@chromium.org,ishell@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1027463002

Cr-Commit-Position: refs/heads/master@{#27323}
2015-03-19 22:03:32 +00:00
rossberg
74cf8e0122 [strong] Check constructor returns
R=dslomov@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1019283002

Cr-Commit-Position: refs/heads/master@{#27320}
2015-03-19 19:40:04 +00:00
titzer
cd33978480 [turbofan] Remove last_use_ field from Node.
R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1022783002

Cr-Commit-Position: refs/heads/master@{#27319}
2015-03-19 15:44:35 +00:00
caitpotter88
d21fd15467 [es6] implement Reflect.apply() & Reflect.construct()
BUG=v8:3900
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/913073003

Cr-Commit-Position: refs/heads/master@{#27316}
2015-03-19 14:47:27 +00:00
jarin
b7dc9c580a [turbofan] Remember types for deoptimization during simplified lowering.
With this change, we remember the types of frame state inputs (in a new
operator, called TypedStateValues). Instead of inferring the value types
when building translations, we used the recorded types.

The original approach was not reliable because the passes after
simplified lowering can change node types, and this in turn confuses
the translation builder.

BUG=chromium:468727
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1015423002

Cr-Commit-Position: refs/heads/master@{#27310}
2015-03-19 14:00:33 +00:00
jacob.bramley
3fdfe613f8 [ARM64] [turbofan] Support uxtb/uxth for add/sub.
Add support for appending extend modes uxtb or uxth to add and subtract
instructions, and using them in the instruction selector.

BUG=

Review URL: https://codereview.chromium.org/1021533002

Cr-Commit-Position: refs/heads/master@{#27303}
2015-03-19 12:44:23 +00:00
dusan.milosavljevic
a1331af594 MIPS64: Fix bug in jump table test.
TEST=test-assembler-mips64/jump_tables3
BUG=

Review URL: https://codereview.chromium.org/1011383004

Cr-Commit-Position: refs/heads/master@{#27301}
2015-03-19 12:42:11 +00:00
mstarzinger
addca70725 [turbofan] Remove stale TODO from FunctionTester.
R=titzer@chromium.org
TEST=cctest/test-run-jsexceptions

Review URL: https://codereview.chromium.org/1022463003

Cr-Commit-Position: refs/heads/master@{#27300}
2015-03-19 12:41:05 +00:00
rodolph.perfetta
abf78583b9 [arm64] Assembler support for internal references.
BUG=

Review URL: https://codereview.chromium.org/1016073002

Cr-Commit-Position: refs/heads/master@{#27296}
2015-03-19 10:24:54 +00:00
Benedikt Meurer
a75e4cea8f [turbofan] Remove indirection in JSToBoolean/JSUnaryNot lowering.
This reduces the overhead of typed lowering, because we lower
JSToBoolean/JSUnaryNot directly if possible, instead of first lowering
to AnyToBoolean, and then letting the SimplifiedOperatorReducer do the
further lowering.

Also remove some obsolete tests from the cctest suite that have since
been removed by proper unittests. And improve unitttest coverage for the
typed lowering cases.

R=mstarzinger@chromium.org

Review URL: https://codereview.chromium.org/999173003

Cr-Commit-Position: refs/heads/master@{#27295}
2015-03-19 10:13:12 +00:00
yangguo
5383257ecc Do not test debug-scripts-request with TurboFan.
This test has been failing flakily on gc-stress, only with --turbo-filter=*

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1024483002

Cr-Commit-Position: refs/heads/master@{#27294}
2015-03-19 10:07:12 +00:00