Commit Graph

42628 Commits

Author SHA1 Message Date
Albert Mingkun Yang
eeebbbcf7f Revert "[heap] Turn on v8_enable_csa_write_barrier"
This reverts commit dbfdd4f9e9.

Reason for revert: https://clusterfuzz.com/v2/testcase-detail/5493096547876864?noredirect=1

Original change's description:
> [heap] Turn on v8_enable_csa_write_barrier
> 
> With this commit, write barrier is switched to use CodeStubAssembler.
> 
> Bug: chromium:749486
> Change-Id: I7e0914bee971e4f3a3257740ae7c83b31f791bd9
> Reviewed-on: https://chromium-review.googlesource.com/598088
> Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
> Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
> Cr-Commit-Position: refs/heads/master@{#48006}

TBR=ulan@chromium.org,albertnetymk@google.com

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:749486
Change-Id: I8cf6a3f1d2ea607a0160b37b797d743b88b004b5
Reviewed-on: https://chromium-review.googlesource.com/667018
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
Cr-Commit-Position: refs/heads/master@{#48036}
2017-09-15 11:25:36 +00:00
Toon Verwaest
dbd3d58ffc [ic] Move tuple3 elements transition handler creation to ic-configuration
Bug: 
Change-Id: I7ac2f30c70c76ea7c3156750b53ad34baeb046cb
Reviewed-on: https://chromium-review.googlesource.com/667113
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48035}
2017-09-15 11:14:36 +00:00
Ulan Degenbaev
8d1ad4b8aa [heap] Remove adhoc weakness in TransitionArray.
Currently transition array targets have conditional weakness depending
on the type of the target. Map targets are weak and all other targets
are strong. This patch wraps maps in transitions arrays in weak cells,
which allows us to treat all elements of transition arrays strongly.

Conditional weakness is unsafe for concurrent marking because the
condition can change during marking.

Bug: chromium:694255
Change-Id: I64e5d0699698fc7c1758f3fbc52da43014c247af
Reviewed-on: https://chromium-review.googlesource.com/641271
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48034}
2017-09-15 11:08:16 +00:00
Juliana Franco
c87f8954cc Deoptimization and multithreading.
When using Lockers and Unlockers it is possible to create a 
scenario where multiple threads point to the same optimized 
code object. When that happens, if one of the threads triggers
deoptimization, then the stack replacement needs to happen in 
the stacks of all threads.
With this CL, the deoptimizer visits all threads to do so.
The CL also adds three tests where V8 used to crash.

Bug: v8:6563
Change-Id: Iea88f47af2f31181c0ef06d898faccde9ad14432
Reviewed-on: https://chromium-review.googlesource.com/657423
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Cr-Commit-Position: refs/heads/master@{#48033}
2017-09-15 11:01:46 +00:00
Jaroslav Sevcik
2b15425b0c [turbofan] Temporarily turn off escape analysis.
Bug: chromium:765433
Change-Id: Iecc9540f6305bc24a0a5210c149b55403b9ce09d
Reviewed-on: https://chromium-review.googlesource.com/667106
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48032}
2017-09-15 10:59:26 +00:00
Jaideep Bajwa
34bc3cb4af [cctest] fix CustomSnapshotDataBlobSharedArrayBuffer on Big Endian
When accessing the buffer in 1 byte increments, the order should
be reversed for BE.

R=petermarshall@chromium.org, yangguo@chromium.org
BUG=
LOG=N

Change-Id: I27a57e12479d1c00488546a92428b9183d87f8bf
Reviewed-on: https://chromium-review.googlesource.com/667902
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#48031}
2017-09-15 10:56:12 +00:00
sreten.kovacevic
aada6a3a29 MIPS[64]: Fixed issue with atomics test
Fixed issue with UseScratchRegisterScope that made test fail on r1
and wrong register usage on all arch variants.

Bug: 
Change-Id: Id89ff84046d012dd0767b9031b2719f9a95a08b8
Reviewed-on: https://chromium-review.googlesource.com/667139
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@imgtec.com>
Cr-Commit-Position: refs/heads/master@{#48030}
2017-09-15 10:54:56 +00:00
Michael Starzinger
c886dfd311 [wasm] Fix build failure in tracing code.
R=ahaas@chromium.org

Change-Id: Ifadde080f27e6cf37e1b72d656e3ff91d5f2ba15
Reviewed-on: https://chromium-review.googlesource.com/668359
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48029}
2017-09-15 10:24:06 +00:00
Mathias Bynens
a10e4a179e [js] Check comparefn in (Typed)Array#sort
This patch ensures a `TypeError` is thrown when the argument passed to
`Array.prototype.sort` or `%TypedArray%.prototype.sort` is neither a
function nor `undefined`.

Every other major JavaScript engine already threw in this case. Making
V8’s behavior match increases interoperability.

https://github.com/tc39/ecma262/pull/785

BUG=v8:6542

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I412a59810abdd118217c8d8361389ec6c2f640bd
Reviewed-on: https://chromium-review.googlesource.com/668356
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48028}
2017-09-15 10:08:06 +00:00
Jakob Gruber
01dcb1ef26 [bootstrapper] Mark helper functions V8_NOINLINE
Don't inline these functions to avoid regressions in APK size.

Bug: chromium:763185
Change-Id: I0a1ca16661a460728e56b67a7109be943397cbf5
Reviewed-on: https://chromium-review.googlesource.com/667109
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48027}
2017-09-15 09:43:16 +00:00
Peter Marshall
3a4f9b10f1 [build] Change Typed Array threshold to an actual build time flag.
This was supposedly a runtime flag, but we baked it into the snapshot
anyway.

Change-Id: I09d43183c4c2d59336c1077089119d6cb65dfd87
Reviewed-on: https://chromium-review.googlesource.com/664721
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48026}
2017-09-15 08:55:06 +00:00
Michael Starzinger
79a35ebca0 [parser] Remove obsolete "asm_function_scope".
R=marja@chromium.org

Change-Id: I91da3f653cda2ca428be578b4cf9a37e784c70d8
Reviewed-on: https://chromium-review.googlesource.com/667108
Reviewed-by: Marja Hölttä <marja@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48025}
2017-09-15 08:46:36 +00:00
Jakob Gruber
1420e44db0 [coverage] Correctly free DebugInfo in the absence of breakpoints
It's quite possible for DebugInfos to exist without the presence of a
bytecode array, since DebugInfos are created for all functions for which
we have a CoverageInfo. Free such objects properly.

Also move the corresponding deletion of CoverageInfos on unload up
before the early exit.

Bug: v8:6000
Change-Id: Idde45b222290aa8b6828b61ff2251918b8ed2aed
Reviewed-on: https://chromium-review.googlesource.com/664811
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48024}
2017-09-15 07:29:26 +00:00
peterwmwong
78446a8afd [builtins] Port String.prototype.repeat to CSA
- Removes S.p.repeat from string.js
  - Adds StringPrototypeRepeat TFJ

Bug: v8:5049
Change-Id: I0b2d512bffd97dfc2c3ba6783e2e41c4db6c8faa
Reviewed-on: https://chromium-review.googlesource.com/659097
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48023}
2017-09-15 06:51:56 +00:00
Andreas Haas
549692cbc0 [wasm] Streaming compilation for WebAssembly.
In this CL I implement streaming compilation for WebAssembly,
as described in the design doc I have sent out already.

In this implementation the decoding of sections other than the
code section is done immediately on the foreground thread.
Eventually all decoding should happen in the background. I
think it is acceptable to do the decoding on the foreground
thread for now because I have finished it already, and
decoding in the background would add even more complexity to
this CL.

Bug:v8:6785

Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: I285e1e5e1a5a243113c92571b25ee9bae551d0ed
Reviewed-on: https://chromium-review.googlesource.com/631721
Reviewed-by: Mircea Trofin <mtrofin@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Andreas Haas <ahaas@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48022}
2017-09-15 06:36:25 +00:00
cjihrig
2c6641edf8 Add postmortem metadata for Node.js on TurboFan.
See: https://github.com/nodejs/llnode/pull/130
Change-Id: Ibce294f7620cd6ab0db4408a8c2b457c3a5aebcd
Reviewed-on: https://chromium-review.googlesource.com/650746
Commit-Queue: Yang Guo <yangguo@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48021}
2017-09-15 05:05:10 +00:00
Jakob Kummerow
a12f05e8fc [bigint] Implement .toString for power-of-2 radixes
Other radixes require Divide/Remainder to be implemented first.

Bug: v8:6791
Change-Id: I95f1fad39a0a4df556a194094805ed93bd46d0db
Reviewed-on: https://chromium-review.googlesource.com/664037
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48020}
2017-09-14 21:25:41 +00:00
Deepti Gandluri
0202a040c9 [wasm] Module bytes can set shared attribute on memory
- Validate that atomic ops can only be called when shared memory is declared
- Throw Compile/Link erros on mismatch between declared, imported memory
- Test harness helpers for setting shared memory, tests

BUG=v8:6532

R=binji@chromium.org, bradnelson@chromium.org

Change-Id: I43fe3d04bb7e3e0a2cecca0528578f98844d2608
Reviewed-on: https://chromium-review.googlesource.com/665379
Commit-Queue: Brad Nelson <bradnelson@chromium.org>
Reviewed-by: Brad Nelson <bradnelson@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48019}
2017-09-14 18:16:31 +00:00
Sigurdur Asgeirsson
70372dfc64 Convert CHECK under #if(def) DEBUG to DCHECK.
Bug: chromium:763010
Change-Id: Iafed5a0e8087f415cd2c11a0b1326c04bd01ef80
Reviewed-on: https://chromium-review.googlesource.com/665351
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Sigurður Ásgeirsson <siggi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48018}
2017-09-14 15:08:27 +00:00
Myles Borins
3449d470d0 [test] upstream msjunit.status skip for Node.js
Change-Id: I9778ce93243d434683e774e5bf9b7014a25e9b96

Bug: v8:6824
Change-Id: I9778ce93243d434683e774e5bf9b7014a25e9b96
Reviewed-on: https://chromium-review.googlesource.com/666961
Commit-Queue: Myles Borins <mborins@google.com>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48017}
2017-09-14 13:23:28 +00:00
Michael Starzinger
8898e57644 [iwyu] Make "stub-cache.h" header stand-alone.
R=ishell@chromium.org

Change-Id: I3e69c94d43d4db7255ec46f94c43f1411795ca9d
Reviewed-on: https://chromium-review.googlesource.com/666957
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48016}
2017-09-14 13:21:27 +00:00
Georg Neis
9ba8c3374d [collections] Avoid repeatedly loading same map and instance type.
The difference seems to matter at least in one benchmark.

R=jarin@chromium.org

Bug: chromium:764644
Change-Id: I6d74fbbd8026942637d2301da805b003a9e58af7
Reviewed-on: https://chromium-review.googlesource.com/666922
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48015}
2017-09-14 12:41:21 +00:00
Jaideep Bajwa
b1cd08daf7 PPC/s390: [iwyu] Remove illegal inline include from "macro-assembler.h"
Port bc69f3450b

R=mstarzinger@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I88f0167a43fb7eb7967169a84466de3aedf00125
Reviewed-on: https://chromium-review.googlesource.com/666299
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48014}
2017-09-14 12:23:51 +00:00
Franziska Hinkelmann
b069315832 [type-profile] Use shared_ptr instead of raw pointer
If TypeProfile goes out of scope, ScriptData and Entry still rely on
TypeProfiles's type_profile_. Make type_profile_ a shared_ptr owned by all
three classes to prevent use after free.

Bug: v8:5933
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Ida7d66dadc17a816cf4439a25e6f714edccffa2c
Reviewed-on: https://chromium-review.googlesource.com/659937
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48013}
2017-09-14 11:52:51 +00:00
Jaroslav Sevcik
7540e841fa Revert "[turbofan] Lower monomorphic loads during graph building."
This reverts commit 14b424c308.

Reason for revert: Regresses benchmarks, e.g., Octane/gameboy

Original change's description:
> [turbofan] Lower monomorphic loads during graph building.
> 
> We introduce an explicit LoweringResult data structure. Until this change,
> the lowering result could be recovered from the node. However, lowering
> monomorphic loads requires wiring different value and effect, so we need
> a structure that can express such lowering result.
> 
> Bug: v8:6357
> Change-Id: I92655800890b744d9203a778a1936a8dcd465ed3
> Reviewed-on: https://chromium-review.googlesource.com/637304
> Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#47992}

TBR=mstarzinger@chromium.org,jarin@chromium.org,bmeurer@chromium.org

Change-Id: I2b7db0278c13414e20c94a34d215ed92bd0d412b
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6357
Reviewed-on: https://chromium-review.googlesource.com/667016
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48012}
2017-09-14 11:18:12 +00:00
Franziska Hinkelmann
b88adb28d1 [cleanup] Delete default destructor.
Bug: 
Change-Id: I597b2c1067e309c2545daef4223b3b883d15a6c1
Reviewed-on: https://chromium-review.googlesource.com/657761
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48011}
2017-09-14 11:08:01 +00:00
Yang Guo
bebaffb944 [serialize] explicitly serialize code content upfront.
The serializer performs two passes over the code. The first pass copies out the
code content verbatim, the second pass visits references recorded in the reloc
info.

So far the first pass is implicit and happens as part of the second pass, when
we encounter a non-HeapObject reference when iterating the code object.  That
however does not work for internal references. So we hit an assertion if the
first non-HeapObject reference we see is an internal reference.

This change explicitly triggers the first pass.

R=petermarshall@chromium.org

Bug: v8:6817
Change-Id: I1ee9949e10b7d9409986da83be22ac6287785f9f
Reviewed-on: https://chromium-review.googlesource.com/663867
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48010}
2017-09-14 11:05:58 +00:00
Michael Starzinger
b45a27373d [iwyu] Turn inclusion presubmit warning into and error.
R=machenbach@chromium.org

Change-Id: I9adf50ef62abf310a0722160ff7997b87e1733f6
Reviewed-on: https://chromium-review.googlesource.com/664800
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48009}
2017-09-14 10:17:58 +00:00
Michael Starzinger
725c15c794 [iwyu] Make "access-info.h" header stand-alone.
R=jarin@chromium.org

Change-Id: Idf47ac88099915bd6db3621230c4f93f2bd7d3bd
Reviewed-on: https://chromium-review.googlesource.com/665117
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48008}
2017-09-14 09:56:09 +00:00
Mythri
d7894b2d6d [TurboFan] Remove absolute limit from inlining heuristics.
We have an absolute limit beyond which we don't inline small funcions as
well. The idea behind inlining small functions is that it is cheaper to
inline small functions rather than incurring the overhead due to the call.
Hence it is better not to have a hard limit on inlining small functions.
We have a limit on the number of levels of nesting to avoid really large
graphs in some corner cases.

Bug: v8:6682
Change-Id: If74f666996fe4a42bf266a4e87caabfd7c614b12
Reviewed-on: https://chromium-review.googlesource.com/648975
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48007}
2017-09-14 09:12:09 +00:00
Albert Mingkun Yang
dbfdd4f9e9 [heap] Turn on v8_enable_csa_write_barrier
With this commit, write barrier is switched to use CodeStubAssembler.

Bug: chromium:749486
Change-Id: I7e0914bee971e4f3a3257740ae7c83b31f791bd9
Reviewed-on: https://chromium-review.googlesource.com/598088
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
Cr-Commit-Position: refs/heads/master@{#48006}
2017-09-14 09:10:09 +00:00
Ulan Degenbaev
97b2a814e4 [heap] Fix black allocation.
This patch ensures that an object returned by AllocateRaw is marked
black if black allocation starts during the object allocation.

This fixes the following issue:
1) Generated code requests allocation of size N for folded allocation.
2) Runtime gets a free list node at address A of size N+M and sets up
   a linear allocation area with top = A+N and limit = A+N+M.
3) Runtime invokes the allocation observer that starts incremental marking
   and start black allocation. The area [A+N, A+N+M) is marked black.
4) Runtime returns a white object at address A as the allocation result.
5) Generated code moves the top pointer to A and does bump pointer
   allocations of white objects from A to A+N+M.
6) Object allocated new A+N can have the impossible marbit pattern.

Bug: chromium:694255
Change-Id: I09ceebc97a510fa5fe4ff20706bc46a99f8b7cf4
Reviewed-on: https://chromium-review.googlesource.com/638338
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48005}
2017-09-14 08:33:49 +00:00
Albert Mingkun Yang
6aafc43e9d Extract calling RecordWrite CSA logic to a function
There are two places where RecordWrite code stub is called,
OutOfLineRecordWrite and RecordWriteField. With this commit, if
`v8_enable_csa_write_barrier` flag is turned on, no instances of the old
RecordWrite stub appear in the snapshot.

Bug: chromium:749486
Change-Id: I2bc3fa38c8831736303b46d153a79c034a450f16
Reviewed-on: https://chromium-review.googlesource.com/648983
Commit-Queue: Albert Mingkun Yang <albertnetymk@google.com>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48004}
2017-09-14 07:38:29 +00:00
Mostyn Bramley-Moore
46000a1244 [jumbo] fix arm64 builds
Previously instructions-arm64.h was alternatively defining or declaring
some constants based on whether or not ARM64_DEFINE_FP_STATICS was defined,
and it was assumed that exactly one file would include this header with
the macro defined.

In jumbo builds, the header guards in instructions-arm64.h meant that the
resulting state of the header file would be whichever of the two cases
that appeared first in the compilation unit.  This would cause multiple
definitions in some cases and no definitions in some other cases (or if
you were really lucky, it would work out ok).

Let's move these constants to a separate source file temporarily, to be
excluded from jumbo compilation units.  This code should eventually be
replaced with a cleaner solution.

Bug: chromium:746958
Change-Id: I7edb1821ef408afd50c6b236d63d3c07f955b58f
Reviewed-on: https://chromium-review.googlesource.com/663898
Commit-Queue: Mostyn Bramley-Moore <mostynb@opera.com>
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48003}
2017-09-13 22:12:16 +00:00
Jakob Kummerow
98bb06733c [bigint] Proper variable-length object layout
Bug: v8:6791
Change-Id: I2da258f7db6c74d764c674eb8d550418a566c5ea
Reviewed-on: https://chromium-review.googlesource.com/662138
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48002}
2017-09-13 22:03:25 +00:00
Karl Schimpf
7b5a40222e Add capability of throwing values in WASM
Extends the current implementation of WASM exceptions to be able to
throw exceptions with values (not just tags).

An JS typed array (uint_16) is used to hold thrown values, so that the
thrown values can be inspected in JS.

Bug: v8:6577
Change-Id: I1007e79ceaffd64386b62562919cfbb920fc10c5
Reviewed-on: https://chromium-review.googlesource.com/633866
Commit-Queue: Karl Schimpf <kschimpf@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Eric Holk <eholk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#48001}
2017-09-13 19:29:15 +00:00
Anisha Rohra
2eb17cccc0 PPC: Fix compilation failure in debug mode after removal of Register::is method
Fix 0b491c89df

R=bjaideep@ca.ibm.com, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com
BUG=
LOG=N

Change-Id: I7d05371844ddb0b5a165a61bc901346f85fcb631
Reviewed-on: https://chromium-review.googlesource.com/665477
Reviewed-by: Jaideep Bajwa <bjaideep@ca.ibm.com>
Commit-Queue: Jaideep Bajwa <bjaideep@ca.ibm.com>
Cr-Commit-Position: refs/heads/master@{#48000}
2017-09-13 18:29:26 +00:00
Camillo Bruni
f899c3d727 [CSA] Use UndefinedConstant() helper instead of loading root
Change-Id: I5cd16774e3e66ff33580e9ed958d4adc57663210
Reviewed-on: https://chromium-review.googlesource.com/664705
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47999}
2017-09-13 17:10:53 +00:00
Toon Verwaest
9a0d5d9700 [ic] Move handler construction code from ic to handler-configuration
Bug: 
Change-Id: I91b08ad6d95e60f84cb083b444bf0eb2fff10e27
Reviewed-on: https://chromium-review.googlesource.com/663864
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47998}
2017-09-13 15:44:43 +00:00
Mythri
9c3dc33efe Remove SetForceInlineFlag from tests.
SetForceInlineFlag is now only used in tests. Earlier, it was also used
in js builtins, because unless this flag was specified the js builtins
were not inlined. All the performance critical js builtins are moved
to turbofan builtins and SetForceInlineFlag is no longer used. We would
like to remove this flag completely to simplify inlining heuristics.
Also, this uses a bit on the SharedFuntionInfo.

Bug: v8:6682
Change-Id: I19afd27381afc212f29179f2c5477095c8174f39
Reviewed-on: https://chromium-review.googlesource.com/660739
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47997}
2017-09-13 15:31:44 +00:00
Ross McIlroy
43d6dc5615 [Interpreter] Move ast printing into interpreter.cc
Moves ast printing out of codegen.cc and into interpreter.cc since this is
the only place which calls it.

BUG=v8:6409

Change-Id: I7b730f6b4da76247f57e3cb4fa7895e638ea0517
Reviewed-on: https://chromium-review.googlesource.com/664888
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Mythri Alle <mythria@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47996}
2017-09-13 15:24:45 +00:00
Adam Klein
cf9386c7b9 [ignition] Improve implementation of unary-minus
For the HeapNumber case, use Float64Neg directly instead of a
Float64Mul by -1.0.

For the Smi case, logic is added to handle the boundary conditions
(0 and Smi::kMinValue), and the general case is handled by a SmiSub
from 0.

Change-Id: I110916d9d1eb5d22d618fbf358d8d5b63cc71b3a
Reviewed-on: https://chromium-review.googlesource.com/663945
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47995}
2017-09-13 14:34:51 +00:00
Adam Klein
5077e79446 [js] Replace max/min macros with calls to Math.max/Math.min
In the years since https://codereview.chromium.org/1331993004, a lot has
changed in v8: Math.max/min are now CSA builtins, with lowerings in
TF.

In a quick test on my machine of the microbenchmark on that CL
(modified with start and end values), I don't detect any difference
in speed between the macro versions on master and this version.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I82d9d14c043fd2a112050cdbcb98a872bfb87b61
Reviewed-on: https://chromium-review.googlesource.com/664339
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47994}
2017-09-13 14:32:30 +00:00
Ross McIlroy
eb0950d2ec [profiler] Minor cleanup since we only harvest vector IC counts now
BUG=v8:6409

Change-Id: I9e06388c683e283a1922fb436dceb244f5093042
Reviewed-on: https://chromium-review.googlesource.com/664857
Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Ross McIlroy <rmcilroy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47993}
2017-09-13 13:02:50 +00:00
Jaroslav Sevcik
14b424c308 [turbofan] Lower monomorphic loads during graph building.
We introduce an explicit LoweringResult data structure. Until this change,
the lowering result could be recovered from the node. However, lowering
monomorphic loads requires wiring different value and effect, so we need
a structure that can express such lowering result.

Bug: v8:6357
Change-Id: I92655800890b744d9203a778a1936a8dcd465ed3
Reviewed-on: https://chromium-review.googlesource.com/637304
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47992}
2017-09-13 12:32:50 +00:00
Michael Starzinger
bc69f3450b [iwyu] Remove illegal inline include from "macro-assembler.h"
R=clemensh@chromium.org

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I3df5d50f81909188ee0cb31d0f479aadeeabe20f
Reviewed-on: https://chromium-review.googlesource.com/662780
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47991}
2017-09-13 11:44:07 +00:00
Maya Lekova
26d299755e Implement microbenchmark for has-in idiom
Bug: v8:6557
Change-Id: Ia858c87a602a37e70d9df61c7225eda10e566258
Reviewed-on: https://chromium-review.googlesource.com/663727
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Maya Lekova <mslekova@google.com>
Cr-Commit-Position: refs/heads/master@{#47990}
2017-09-13 08:48:44 +00:00
Franziska Hinkelmann
721f94ad99 [test] Fixing incorrectly capitalised regexps
Bug: 
Change-Id: I32faae50c786b67599a68840baad478ce81c1398
Reviewed-on: https://chromium-review.googlesource.com/663544
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Franziska Hinkelmann <franzih@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47989}
2017-09-13 08:43:13 +00:00
Mythri
981b77126a [IC] Do not update the type feedback, if feedback hasn't changed.
We reset the profiler ticks when the feedback changes. So, we should
not update the feedback when the feedback hasn't changed. Added a
check in IC::ConfigureVectorState to see if the feedback has changed
before we update the feedback.

Bug: 
Change-Id: I83f38656b52df7f687cd0c2eceac961dcd4f35f7
Reviewed-on: https://chromium-review.googlesource.com/657698
Commit-Queue: Mythri Alle <mythria@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Reviewed-by: Toon Verwaest <verwaest@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47988}
2017-09-13 08:28:44 +00:00
Jakob Gruber
cbbf949e28 [snapshot] Ship lazy TFJ builtins under --future
Bug: v8:6624
Change-Id: I98e055936a556ee607e286354dfa40a28b249dd9
Reviewed-on: https://chromium-review.googlesource.com/663542
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#47987}
2017-09-13 07:23:49 +00:00