Commit Graph

46340 Commits

Author SHA1 Message Date
jgruber
f45eca794c [builtins] Disable embedded builtins on mips and mips64
Mips big-endian builders don't like embedded builtins. Disable embedded
builtins on mips for now and defer investigation for when there's time.

Example failures:
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20big%20endian%20-%20nosnap%20-%201/builds/6666
https://build.chromium.org/p/client.v8.ports/builders/V8%20Mips%20-%20big%20endian%20-%20nosnap%20-%202/builds/5188

Two issues: test failures due to big-endianness and mismatches in the
isolate-independence list.

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I73750668c03c132a9bb4d4ae9ed2bafd6d91f816
Reviewed-on: https://chromium-review.googlesource.com/955699
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51848}
2018-03-09 15:39:37 +00:00
Mike Stanton
ab9ac99458 [TurboFan] Use the FlagsContinuation more effectively
We can reduce boilerplate if we pass the continuation to
some InstructionSelector::Emit.* methods.

Change-Id: I0221f446129cc086122d3f77a00de7d1256d3ee1
bug: v8:7310
Reviewed-on: https://chromium-review.googlesource.com/934454
Commit-Queue: Michael Stanton <mvstanton@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51847}
2018-03-09 15:36:17 +00:00
sreten.kovacevic
dc247d4b71 [mips] Emit trampoline pool after Sdc1 instruction
Since there are some regression tests that use this instruction
many times in a row, trampoline pool can't be emitted. This commit
fixes this issue.

Change-Id: I7b575c4920f7e72a39051dee1ccca4baf9562ff1
Reviewed-on: https://chromium-review.googlesource.com/955696
Commit-Queue: Sreten Kovacevic <sreten.kovacevic@mips.com>
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51846}
2018-03-09 15:33:17 +00:00
Georg Neis
b19d2851bf [compiler] Try to convert value to Smi in StoreField/StoreElement.
If the value can be converted, we can skip the write barrier.

Change-Id: I88ac7f3756ddfaf4b8e58dc36a9b26faf544f0d9
Reviewed-on: https://chromium-review.googlesource.com/957033
Commit-Queue: Georg Neis <neis@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51845}
2018-03-09 14:44:35 +00:00
Benedikt Meurer
fd29e1d841 [builtins] Properly handle DICTIONARY_ELEMENTS in Promise.all closures.
Bug: chromium:820312
Change-Id: Ie9237a5c53ac7121e469af460a2f0ad5016d9d03
Reviewed-on: https://chromium-review.googlesource.com/957090
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51844}
2018-03-09 14:25:34 +00:00
Mathias Bynens
b10dc352ff [builtins] Refactor the TypedArrayConstructor builtin
This patch removes the TypedArrayConstructor_ConstructStub builtin,
merging its functionality into the refactored TypedArrayConstructor
TurboFan builtin.

This brings us closer to our goal of deprecating the `construct_stub`
field in `SharedFunctionInfo`.

Bug: v8:7503, v8:7518
Change-Id: I264aa0933b3c80814e021b05033636196dc289da
Reviewed-on: https://chromium-review.googlesource.com/956044
Commit-Queue: Mathias Bynens <mathias@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51843}
2018-03-09 14:21:34 +00:00
Peter Marshall
5a70a5ea0a [memory] Save space in the FeedbackMetadata on 64 bit platforms.
Previously we used a FixedArray for the FeedbackMetadata, packing bits
of information into Smi fields. On 64-bit platforms, we waste at least
half of the available memory by using the Smi representation.

Given that this is just raw data (no pointers), we can just use a new
type that uses the existing packing scheme to store the data in int32
format instead.

This CL changes FeedbackMetadata to a new subclass of HeapObject. This
is to reduce the API surface exposed, in comparison to extending/using
a more general purpose data structure like ByteArray, which is also just
raw data.

FeedbackMetadata only exposes general purpose methods for accessing
slots, but hides the implementation detail of packing bits into int32
fields.

This CL also introduces a sentinal EmptyFeedbackMetadata, because there
are ~750 empty FeedbackMetadata objects when running an empty program in
V8. These are probably for builtins.

Bug: v8:7500
Change-Id: Ic85563153abbd71a22854cee8519260c32b1e9ab
Reviewed-on: https://chromium-review.googlesource.com/945730
Commit-Queue: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51842}
2018-03-09 14:18:14 +00:00
Clemens Hammacher
907c7fad71 [Liftoff] Implement i32/i64 to f32 conversions
This adds support for f32.convert_{s,u}/i{32,64}.
On 32-bit platforms, i64 conversions are implemented by a call to a c
function. Since the signature of this c function is very different to
the currently used functions in Liftoff (in particular they contain an
out parameter), this CL requires a major refactoring of how Liftoff
generates c-calls.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: Iffb4d0263ca1ca3eb9c6216344220322cda16062
Reviewed-on: https://chromium-review.googlesource.com/952122
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51841}
2018-03-09 14:15:14 +00:00
Hannes Payer
b0fa91965d Revert "[heap] Turn on --write-protect-code-memory."
This reverts commit e816d2bad0.

Reason for revert: <INSERT REASONING HERE>

Original change's description:
> [heap] Turn on --write-protect-code-memory.
> 
> Bug: chromium:774108
> Change-Id: Ifcf9939f29c9a3dc14ed686dc14608860ff32678
> Reviewed-on: https://chromium-review.googlesource.com/950902
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Reviewed-by: Michael Hablich <hablich@chromium.org>
> Commit-Queue: Hannes Payer <hpayer@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51766}

TBR=mstarzinger@chromium.org,hpayer@chromium.org,hablich@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Bug: chromium:774108
Change-Id: Icf6da14ec795cf89d2c4085ff7f9afb892184c12
Reviewed-on: https://chromium-review.googlesource.com/955692
Reviewed-by: Hannes Payer <hpayer@chromium.org>
Commit-Queue: Hannes Payer <hpayer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51840}
2018-03-09 13:04:59 +00:00
Sigurd Schneider
5bc8daf6b4 [js-perf-test] Add micro-benchmark for StringAt functions
This benchmark checks comparison with StringAt functions against
each other and and constants. The benchmarks will serve to measure
the effect of an optimization that will omit the implicit
String.fromCharCode in such cases.

Bug: v8:7531
Change-Id: I171df92301516c96beb6a4ed86f1dec8d10e34f5
Reviewed-on: https://chromium-review.googlesource.com/957086
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Sigurd Schneider <sigurds@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51839}
2018-03-09 12:43:36 +00:00
jgruber
31ac0219a3 Move ExternalReference to own files
This is a move-only CL (except includes cleanup).

Bug: v8:6666
Change-Id: I28422b4a21074e642e8d5c9b3a563ecafdafbda7
Reviewed-on: https://chromium-review.googlesource.com/957087
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51838}
2018-03-09 12:42:31 +00:00
jgruber
391fb8fea7 [builtins] Remove unneeded code
It turns out that with the help of Code::Instruction{Start,End,Size}
helpers, we don't need custom profiler methods.

InstructionStream is now all-static.

Bug: v8:6666
Change-Id: I59e1d2d2cb72c128725a1ed03f11506d40e76224
Reviewed-on: https://chromium-review.googlesource.com/947973
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51837}
2018-03-09 11:42:09 +00:00
Jaroslav Sevcik
89a7c4a0c3 [turbofan,arm] Add float loads poisoning.
Bug: chromium:798964
Change-Id: I1ef202296744a39054366f2bc424d6952c3bbe9d
Reviewed-on: https://chromium-review.googlesource.com/955588
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51836}
2018-03-09 11:37:49 +00:00
jgruber
5025e41545 Reland "[builtins] Execute binary-embedded builtin code"
This is a reland of 6afd25fff0

Original change's description:
> [builtins] Execute binary-embedded builtin code
>
> This CL creates trampolines into binary-embedded builtins on
> isolate-creation, if --stress-off-heap-code is passed.
>
> Note that this still overwrites existing code objects with the
> off-heap trampoline, and that off-heap builtins still exist both in
> the snapshot and the binary. Addressing these points are the next
> steps.
>
> Drive-by-change: More efficient off-heap code lookups now that the
> off-heap memory area has a contiguous and static layout.
>
> Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
> Bug: v8:6666
> Change-Id: I7e7ef0aa2cd7b8184ae3a13fa02bdcbb4f2c9f86
> Reviewed-on: https://chromium-review.googlesource.com/947969
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51809}

TBR=mstarzinger@chromium.org

Bug: v8:6666
Change-Id: I4e0684de90733e5f18f6f0ea4832e327d03dfbf7
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/955595
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51835}
2018-03-09 11:04:19 +00:00
Clemens Hammacher
b3f4a377a0 [arm64] Fix compile error in Simulator
Some compilers complain that ConvertReturn is private in SimulatorBase,
but used in the arm64 Simulator. This CL fixes this by making
ConvertReturn protected.

R=ulan@chromium.org

Bug: v8:7541
Change-Id: I9326b2c746829e9c37c58c14561811b32929c615
Reviewed-on: https://chromium-review.googlesource.com/955689
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51834}
2018-03-09 10:45:49 +00:00
Marja Hölttä
43d8696639 [iwyu] Fixes related to factory.h
BUG=v8:7490

Change-Id: I07905a57c47ad6663d2d7f6bf539858bed1041f1
Reviewed-on: https://chromium-review.googlesource.com/939164
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51833}
2018-03-09 10:28:39 +00:00
jgruber
e6476f8930 Reland "[builtins] Embed builtins into the binary"
This is a reland of 491d5a81dd

Original change's description:
> [builtins] Embed builtins into the binary
>
> This embeds code for off-heap-safe builtins into the binary. Actual
> execution of embedded code is not implemented yet.
>
> The embedded file has the following format:
>
> namespace v8 {
> namespace internal {
>
> namespace {
>
> V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> __asm__( /* builtin offsets and lengths */ );
> __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> __asm__( /* binary instruction stream */ );
> /* Repeat for other builtins. */
>
> extern "C" const uint8_t v8_embedded_blob_[];
> static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
>
> }  // namespace
>
> const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
>
> }  // namespace internal
> }  // namespace v8
>
> Bug: v8:6666
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> Reviewed-on: https://chromium-review.googlesource.com/946011
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51759}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I89b0498f22b4ce573723748d55d86a82ba285a88
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/957024
Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51832}
2018-03-09 10:19:49 +00:00
Stephan Herhut
fc45d0f4af Make V8DebuggerScript parameters const again.
This reverts a previous accidential edit.

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ib6a2e31f600de242e960171dd921387e897e3bc9
Reviewed-on: https://chromium-review.googlesource.com/951305
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51831}
2018-03-09 10:04:29 +00:00
Yang Guo
c242f27ec6 [debug] support break points on API functions.
R=jgruber@chromium.org

Bug: v8:178
Change-Id: I1cabed9aa2a04f86e582ba09742b2e2857a40f27
Reviewed-on: https://chromium-review.googlesource.com/956045
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51830}
2018-03-09 10:03:24 +00:00
Leszek Swirski
37c362638b Revert "[builtins] Remove CheckOptimizationMarker builtin"
This reverts commit daa224d4d0.

Reason for revert: https://bugs.chromium.org/p/chromium/issues/detail?id=819873

Original change's description:
> [builtins] Remove CheckOptimizationMarker builtin
> 
> This was a shim for the non-I+TF codepath, which is now the only
> codepath (that still uses this tier-up mechanism anyway). There were a
> couple of places we were accidentally using it due to CompileLazy or
> deopts, so this also fixes those.
> 
> Change-Id: I00a7fdf9fb5cf74844138dac62d01ceaaf192e17
> Reviewed-on: https://chromium-review.googlesource.com/951490
> Commit-Queue: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51786}

TBR=rmcilroy@chromium.org,machenbach@chromium.org,leszeks@chromium.org

# Not skipping CQ checks because original CL landed > 1 day ago.

Change-Id: I80765eb18aaf5086e6db5d5df96f608a317c999f
Reviewed-on: https://chromium-review.googlesource.com/957022
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Leszek Swirski <leszeks@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51829}
2018-03-09 10:02:19 +00:00
Jakob Gruber
481aa56d87 Revert "Reland "[builtins] Embed builtins into the binary""
This reverts commit 36b32aa28d.

Reason for revert: https://build.chromium.org/p/client.v8.fyi/builders/Win%20V8%20FYI%20Release%20%28NVIDIA%29/builds/208

Original change's description:
> Reland "[builtins] Embed builtins into the binary"
> 
> This is a reland of 491d5a81dd
> 
> Original change's description:
> > [builtins] Embed builtins into the binary
> >
> > This embeds code for off-heap-safe builtins into the binary. Actual
> > execution of embedded code is not implemented yet.
> >
> > The embedded file has the following format:
> >
> > namespace v8 {
> > namespace internal {
> >
> > namespace {
> >
> > V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> > __asm__( /* builtin offsets and lengths */ );
> > __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> > __asm__( /* binary instruction stream */ );
> > /* Repeat for other builtins. */
> >
> > extern "C" const uint8_t v8_embedded_blob_[];
> > static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
> >
> > }  // namespace
> >
> > const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> > uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
> >
> > }  // namespace internal
> > }  // namespace v8
> >
> > Bug: v8:6666
> > Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> > Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> > Reviewed-on: https://chromium-review.googlesource.com/946011
> > Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> > Reviewed-by: Yang Guo <yangguo@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#51759}
> 
> TBR=yangguo@chromium.org
> 
> Bug: v8:6666
> Change-Id: I741554cb080b6811dfbcb0913c6e1594e74c0432
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Reviewed-on: https://chromium-review.googlesource.com/955084
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51804}

TBR=yangguo@chromium.org,jgruber@chromium.org

Change-Id: I0e21f958f18b0e4d7edebece5e4a2a3ea094cdd3
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/956185
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51828}
2018-03-09 08:34:16 +00:00
v8-autoroll
106d4074e5 Update V8 DEPS.
Rolling v8/build: ca739dc..d8b353b

Rolling v8/third_party/catapult: https://chromium.googlesource.com/catapult/+log/406b235..df668c3

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I3712e0f496692dc50d2ee4e8374cc025a54658cd
Reviewed-on: https://chromium-review.googlesource.com/955914
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51827}
2018-03-09 05:03:14 +00:00
Ali Ijaz Sheikh
f2c65e8b94 test needs to run without stress_incremental_marking
This test depends on lack of randomness in the allocation path so it is
not compatible with stress_incremental_marking. Extract it into a
standalone tests which runs with the stress flag disabled.

Revert "[cctests] Disable flaky cctest test-heap-profiler/SamplingHeapProfiler"

This reverts commit 3ea2d6b06f.

Bug: v8:7444
Change-Id: Id246bca4699a61e6b9ff4b5b5d2ff1ce4ebbd0da
Reviewed-on: https://chromium-review.googlesource.com/953865
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ali Ijaz Sheikh <ofrobots@google.com>
Cr-Commit-Position: refs/heads/master@{#51826}
2018-03-08 22:05:24 +00:00
Yang Guo
56baf01854 Revert "Attempt to fix MSVC failure in test-debug/BreakPointJSBuiltin"
This reverts commit b342e61122.

Reason for revert: x64 msvc failure

Original change's description:
> Attempt to fix MSVC failure in test-debug/BreakPointJSBuiltin
> 
> TBR=bmeurer@chromium.org
> 
> Bug: v8:178
> Change-Id: Idfa86749f3ee49c9f3b2a7fc7c0d7d3285e45c20
> Reviewed-on: https://chromium-review.googlesource.com/956066
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Commit-Queue: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51824}

TBR=yangguo@chromium.org,clemensh@chromium.org,bmeurer@chromium.org

Change-Id: I76c4df67416b982b3215df7dce23eb1e7d42ec4c
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:178
Reviewed-on: https://chromium-review.googlesource.com/955572
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51825}
2018-03-08 19:53:57 +00:00
Yang Guo
b342e61122 Attempt to fix MSVC failure in test-debug/BreakPointJSBuiltin
TBR=bmeurer@chromium.org

Bug: v8:178
Change-Id: Idfa86749f3ee49c9f3b2a7fc7c0d7d3285e45c20
Reviewed-on: https://chromium-review.googlesource.com/956066
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51824}
2018-03-08 19:21:25 +00:00
Teddy Katz
bf021c3c1b Fix error message for octal escapes in templates
This updates the scanner to use the correct error message when it
encounters an octal escape sequence in a template literal. Previously,
the error message referred to strict mode, even when the template
literal was not in strict mode code.

Bug: v8:7502
Change-Id: I37bb1338cf796c471108bc10f35f824cdf3ce0b7
Reviewed-on: https://chromium-review.googlesource.com/945411
Reviewed-by: Adam Klein <adamk@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51823}
2018-03-08 18:57:45 +00:00
Yang Guo
1b9f518d21 [api] introduce v8::Context::GetNumberOfEmbedderDataFields.
The number of embedder fields grows dynamically, but reading these
fields do not perform bounds checks. The naming is taken from a similar
method on v8::Isolate.

Also changed the growing strategy for the backing store to not
over-allocate.

R=adamk@chromium.org, bmeurer@chromium.org

Bug: v8:7533
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng
Change-Id: I70beab124a32296c940ffabd897a7790bc8ff47a
Reviewed-on: https://chromium-review.googlesource.com/952923
Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51822}
2018-03-08 18:18:35 +00:00
Yang Guo
be8c26db8f Skip test-debug/BreakPointJSBuiltin on windows.
TBR=bmeurer@chromium.org
NOTRY=true

Bug: v8:178
Change-Id: I5f8b128d9f0e5ae0ad9c44da0b6cd599c47fdf6b
Reviewed-on: https://chromium-review.googlesource.com/956064
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51821}
2018-03-08 18:05:25 +00:00
Clemens Hammacher
a810e422f2 [Liftoff] Remove {RegClass} argument of PopToRegister
Stack slots store the type of the respective value, so we can always
get the reg class from that type.

R=titzer@chromium.org

Bug: v8:6600
Change-Id: I60ca21daa4cc1505562c344367c7586bcd272c9b
Reviewed-on: https://chromium-review.googlesource.com/950948
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51820}
2018-03-08 17:42:55 +00:00
Jakob Kummerow
96e2e8588d Reland "[bigint] Serialization support for BigInts"
This is a reland of 609aaa5549

Originally reviewed at: https://chromium-review.googlesource.com/952626

Tbr: adamk@chromium.org
Bug: v8:6791
Change-Id: If0699fbfb280192bed61538ccc67c7c95893e691
Reviewed-on: https://chromium-review.googlesource.com/954665
Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Commit-Queue: Jakob Kummerow <jkummerow@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51819}
2018-03-08 17:37:35 +00:00
Yang Guo
6cb5903769 Split test-debug/BreakPointBuiltin into smaller tests.
This is to better pinpoint win64 failures.

TBR=bmeurer@chromium.org

Bug: v8:178
Change-Id: If778352cad1f209927067a12d5684e62c4ead8d2
Reviewed-on: https://chromium-review.googlesource.com/955687
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51818}
2018-03-08 17:16:05 +00:00
Clemens Hammacher
a71e5f9a7b [wasm] Avoid integer overflow on function locals check
On 32-bit systems, the computation {count + type_list->size()} can
overflow, leading to memory corruption later on.

R=titzer@chromium.org

Bug: chromium:819869
Change-Id: Ic81d201e58211e3989b4e945cd52e98dc951fbda
Reviewed-on: https://chromium-review.googlesource.com/955025
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51817}
2018-03-08 17:00:55 +00:00
Jakob Gruber
d4c4345ef8 Revert "[builtins] Execute binary-embedded builtin code"
This reverts commit 6afd25fff0.

Reason for revert: https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20debug%20-%20fyi/builds/1437

Original change's description:
> [builtins] Execute binary-embedded builtin code
> 
> This CL creates trampolines into binary-embedded builtins on
> isolate-creation, if --stress-off-heap-code is passed.
> 
> Note that this still overwrites existing code objects with the
> off-heap trampoline, and that off-heap builtins still exist both in
> the snapshot and the binary. Addressing these points are the next
> steps.
> 
> Drive-by-change: More efficient off-heap code lookups now that the
> off-heap memory area has a contiguous and static layout.
> 
> Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
> Bug: v8:6666
> Change-Id: I7e7ef0aa2cd7b8184ae3a13fa02bdcbb4f2c9f86
> Reviewed-on: https://chromium-review.googlesource.com/947969
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51809}

TBR=mstarzinger@chromium.org,jgruber@chromium.org

Change-Id: I18276541b468b9d2b2a1366ccd287822e96b6df7
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6666
Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/956042
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51816}
2018-03-08 16:58:56 +00:00
Sergiy Byelozyorov
2678c004ed Whitespace CL
TBR=sergiyb@chromium.org

Bug: chromium:776035
Change-Id: I6a9f2cb62ec275af49ec629d6a4d41d61c0a9dfe
Reviewed-on: https://chromium-review.googlesource.com/955322
Commit-Queue: Sergiy Byelozyorov <sergiyb@chromium.org>
Reviewed-by: Sergiy Byelozyorov <sergiyb@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51815}
2018-03-08 16:13:55 +00:00
Yang Guo
d7ffa8affd Skip test-debug/BreakPointBuiltin on windows for now.
TBR=bmeurer@chromium.org
NOTRY=true

Bug: v8:178
Change-Id: I25438302be07f51eb9f540ada2ec28e4d06a5198
Reviewed-on: https://chromium-review.googlesource.com/955626
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51814}
2018-03-08 15:55:25 +00:00
Jaroslav Sevcik
abfb582490 [turbofan,x64] Poison float64 loads.
Bug: chromium:798964
Change-Id: Ia359f68e30e87e2cbee5b8322b4ac54c335ef474
Reviewed-on: https://chromium-review.googlesource.com/955425
Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Jaroslav Sevcik <jarin@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51813}
2018-03-08 15:06:05 +00:00
Camillo Bruni
0d26307046 [runtime] Properly calculate upper bound for NOF in_object_properties
Bug: chr:81499
Change-Id: I5a18b9ec061d426e21c08747a8c18a36bf5ca194
Reviewed-on: https://chromium-review.googlesource.com/950724
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51812}
2018-03-08 14:54:55 +00:00
Yang Guo
31f2a821c9 [debug] implement break at builtin entry via debug trampoline.
R=bmeurer@chromium.org, leszeks@chromium.org

Bug: v8:178
Change-Id: I00411ddfee458a71464dcba7f1b504b46c70ef06
Reviewed-on: https://chromium-review.googlesource.com/953002
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Leszek Swirski <leszeks@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51811}
2018-03-08 14:49:15 +00:00
Benedikt Meurer
e122fc4565 [builtins] Add fast-path for the Promise.resolve lookup.
This adds a global protector to guard the lookup of "resolve" on the
%Promise% intrinsic object (the initial Promise constructor), making
sure that Promise.resolve yields the initial builtin method. We use
this protector to avoid the lookup of "resolve" all the time inside
of Promise.all and Promise.race, when called with constructor being
the %Promise% intrinsic object.

This improves the performance on the parallel-async-es2017-native
benchmark by roughly 2-3%.

Bug: v8:7253
Change-Id: Ida93b88afbaeae61f17be4cd30ea6a78b4267cea
Reviewed-on: https://chromium-review.googlesource.com/955564
Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51810}
2018-03-08 14:30:35 +00:00
jgruber
6afd25fff0 [builtins] Execute binary-embedded builtin code
This CL creates trampolines into binary-embedded builtins on
isolate-creation, if --stress-off-heap-code is passed.

Note that this still overwrites existing code objects with the
off-heap trampoline, and that off-heap builtins still exist both in
the snapshot and the binary. Addressing these points are the next
steps.

Drive-by-change: More efficient off-heap code lookups now that the
off-heap memory area has a contiguous and static layout.

Cq-Include-Trybots: luci.v8.try:v8_linux64_fyi_rel_ng
Bug: v8:6666
Change-Id: I7e7ef0aa2cd7b8184ae3a13fa02bdcbb4f2c9f86
Reviewed-on: https://chromium-review.googlesource.com/947969
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51809}
2018-03-08 14:04:35 +00:00
Tobias Tebbi
221173eaa2 [turbofan] handle DeadValue in JSCreateArguments lowering
JSCallReducer runs at the same time as DeadCodeElimination and hence can observe an incompletely propagated DeadValue in place of a StateValue node holding the arguments to materialize for JSCreateArguments.
This CL fixes this by aborting the lowring of JSCreateArguments in this case.

Bug: chromium:819311 v8:7536
Change-Id: I42c4a1923e3dbe470db1a16c5069aaa7c38659ac
Reviewed-on: https://chromium-review.googlesource.com/955306
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51808}
2018-03-08 13:42:02 +00:00
Benedikt Meurer
35b4bde832 [builtins] Fix typo in PromiseResolve fast-path.
The PromiseResolve builtin was missing it's fast-path for when we can
skip the "constructor" lookup due to a typo.

Bug: v8:7253
Change-Id: Icca033af5d4f7fe8b43ebf49c9315b4c80d52cbc
Reviewed-on: https://chromium-review.googlesource.com/955483
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51807}
2018-03-08 13:19:22 +00:00
sreten.kovacevic
98e0bcfae2 [Liftoff][mips] Fix cctest/test-run-wasm/RunWasmLiftoff_ExprBlock_ManualSwitch_brif
Test started failing after commit `[Liftoff] Remove Get{Unary,Binary}OpTargetRegister`.
Optimization shouldn't be done if dst == rhs in i32_set_cond instruction.
This CL fixes the issue.

Change-Id: I67cd1ca4692fcf69202ef25f7aa58756a5ddddca
Reviewed-on: https://chromium-review.googlesource.com/952963
Reviewed-by: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Reviewed-by: Clemens Hammacher <clemensh@chromium.org>
Commit-Queue: Ivica Bogosavljevic <ivica.bogosavljevic@mips.com>
Cr-Commit-Position: refs/heads/master@{#51806}
2018-03-08 13:05:02 +00:00
Benedikt Meurer
e583fc836b [turbofan] Fix invalid SpeculativeToNumber optimization.
When optimizing SpeculativeToNumber we need to pay attention to the
hint, otherwise we optimize away a Signed32 conversion, based on the
fact that the input is a Number.

Bug: chromium:819298
Change-Id: I2ac7b0dac708fee9083eca2880bd5674a82daaa3
Reviewed-on: https://chromium-review.googlesource.com/955423
Reviewed-by: Jaroslav Sevcik <jarin@chromium.org>
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51805}
2018-03-08 12:38:29 +00:00
jgruber
36b32aa28d Reland "[builtins] Embed builtins into the binary"
This is a reland of 491d5a81dd

Original change's description:
> [builtins] Embed builtins into the binary
>
> This embeds code for off-heap-safe builtins into the binary. Actual
> execution of embedded code is not implemented yet.
>
> The embedded file has the following format:
>
> namespace v8 {
> namespace internal {
>
> namespace {
>
> V8_EMBEDDED_TEXT_HEADER(v8_embedded_blob_)
> __asm__( /* builtin offsets and lengths */ );
> __asm__(V8_ASM_LABEL("Builtins_RecordWrite"));
> __asm__( /* binary instruction stream */ );
> /* Repeat for other builtins. */
>
> extern "C" const uint8_t v8_embedded_blob_[];
> static const uint32_t v8_embedded_blob_size_ = /* size in bytes */;
>
> }  // namespace
>
> const uint8_t* DefaultEmbeddedBlob() { return v8_embedded_blob_; }
> uint32_t DefaultEmbeddedBlobSize() { return v8_embedded_blob_size_; }
>
> }  // namespace internal
> }  // namespace v8
>
> Bug: v8:6666
> Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
> Change-Id: Ic989f01da69ebe2863f31d934bfbe2c5d6e80864
> Reviewed-on: https://chromium-review.googlesource.com/946011
> Commit-Queue: Jakob Gruber <jgruber@chromium.org>
> Reviewed-by: Yang Guo <yangguo@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#51759}

TBR=yangguo@chromium.org

Bug: v8:6666
Change-Id: I741554cb080b6811dfbcb0913c6e1594e74c0432
Cq-Include-Trybots: luci.chromium.try:linux_chromium_rel_ng;luci.v8.try:v8_linux64_fyi_rel_ng
Reviewed-on: https://chromium-review.googlesource.com/955084
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51804}
2018-03-08 11:50:56 +00:00
Igor Sheludko
aeee606360 [ic] Introduce canonical invalid prototype validity cell.
... and use Smi Map::kPrototypeChainValid for the cases where direct receiver's
prototype is not JSObject instead of creating a new valid cell for each such
case. This will make a validity cell checking code simpler.

Bug: v8:5988
Change-Id: I52cf55797171cc8021d80e4e441615d0c8fc8bd4
Reviewed-on: https://chromium-review.googlesource.com/951384
Commit-Queue: Igor Sheludko <ishell@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51803}
2018-03-08 10:40:55 +00:00
Tobias Tebbi
501f250c0b [turbofan] [cleanup] remove UnalignedLoadRepresentation
UnalignedLoad is the only kind of load operation that defines its own
UnalignedLoadRepresentation type alias and LoadRepresentationOf function.
This is a problem because it means we cannot use the LOAD_MATCHER
infrastructure without defining all of this boilerplate for all the other
kinds of load operations. Since these aliases serve no real purpose,
it is best to unify UnalignedLoad to how its peers are handled.

Change-Id: I51a591eb82fb85edee66512136b23276e851f767
Reviewed-on: https://chromium-review.googlesource.com/951683
Commit-Queue: Tobias Tebbi <tebbi@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51802}
2018-03-08 10:30:55 +00:00
Stephan Herhut
6af30f41e4 Use String16Builder.appendUnsignedAsHex for hashes
The debugger script implementation had its own way to write
uint32_t values to a string as hex values. This removes the
custom code and uses a shared implementation in String16Builder
instead.

The observable effect is that script hashes are now lower-case
and the character sequence is reversed for each 8-character
pair.

Cq-Include-Trybots: master.tryserver.blink:linux_trusty_blink_rel
Change-Id: Ib21769fbe10c24055fbd3fa9573bc5c2d72f6a74
Reviewed-on: https://chromium-review.googlesource.com/951303
Reviewed-by: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Commit-Queue: Stephan Herhut <herhut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51801}
2018-03-08 10:14:55 +00:00
v8-autoroll
8ae00f5a46 Update V8 DEPS.
Rolling v8/base/trace_event/common: 0e9a47d..e0009bb

Rolling v8/build: 06a6e63..ca739dc

Rolling v8/tools/clang: 36f3a71..b6fe934

TBR=machenbach@chromium.org,hablich@chromium.org,sergiyb@chromium.org

Change-Id: I793509e5285594adf9f030bd2824ca2629d68117
Reviewed-on: https://chromium-review.googlesource.com/952703
Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51800}
2018-03-08 09:36:52 +00:00
Marja Hölttä
187cb431fb [heap profiler] Refactor visited field tracking.
- Make it explicit that the field marks are supposed to be all-false after each
  object.

- Remove unused param from MarkVisitedField.

BUG=v8:7534

Change-Id: Ibc226290bb09daca60b92819944e0049bb33e594
Reviewed-on: https://chromium-review.googlesource.com/951725
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Marja Hölttä <marja@chromium.org>
Cr-Commit-Position: refs/heads/master@{#51799}
2018-03-08 09:01:23 +00:00