Commit Graph

6037 Commits

Author SHA1 Message Date
mstarzinger
a55beb68e0 [interpreter] Add explicit OSR polling bytecode.
This adds an explicit {OsrPoll} bytecode into every loop header which
triggers on-stack replacement when armed. Note that each such bytecode
stores the static loop depths as an operand, and hence can be armed for
specific loop depths.

This also adds builtin code that triggers OSR compilation and switches
execution over to optimized code in case compilation succeeds. In case
compilation fails, the bytecode dispatch just continues unhindered.

R=rmcilroy@chromium.org
TEST=mjsunit/ignition/osr-from-bytecode
BUG=v8:4764

Review-Url: https://codereview.chromium.org/2172233002
Cr-Commit-Position: refs/heads/master@{#38043}
2016-07-26 10:35:17 +00:00
bmeurer
32346aaea0 [turbofan] Fix overly aggressive dead code elimination.
When we eliminate nodes during truncation analysis that have no value
uses, we must make sure that we do not eliminate speculative number
operations that would have side effects depending on the inputs, i.e.
for example a SpeculativeNumberMultiply(x,y) does ToNumber(x) and
ToNumber(y) first, so if either x or y could throw an exception during
ToNumber conversion, we must not eliminate the multiplication, even if
it has no value uses (some later pass may kill the actual machine
multiplication, but the checks on the inputs have to remain still).
So we check whether both x and y are PlainPrimitive, i.e. neither
Receiver nor Symbol, which could raise exceptions for ToNumber, and
only in that case we propagate the "unusedness" of the node to its
inputs.

This also uncovered a bug with the type of Dead, which must be None,
as this represents an impossible value, so we had to fix that too.

Also the dead code removal will not work correctly for constants (i.e.
pure nodes with no value inputs), as those might be cached and hence
we might resurrect them for an unrelated node lowering during
SimplifiedLowering and only later kill the actual node (replacing its
uses with Dead), which would then also replace the new use with Dead.
So that was fixed as well. This shouldn't change anything for the
result, as unused constants automagically disappear from the graph later
on anyways.

R=yangguo@chromium.org
BUG=chromium:631318

Review-Url: https://codereview.chromium.org/2182003002
Cr-Commit-Position: refs/heads/master@{#38038}
2016-07-26 07:09:58 +00:00
caitp
917f0093fb [test] copy revoked proxy tests for array-concat to new files
The tests array-concat-revoked-proxy-*.js are copied out from array-concat.js,
in order to verify that they work correctly with a valid ArrayProtector cell.

These tests pass with https://crrev.com/122a9b7af02606dae558336082ab139a87eba39d
applied, but fail without it.

BUG=v8:5134
R=neis@chromium.org, cbruni@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2177903002
Cr-Commit-Position: refs/heads/master@{#38026}
2016-07-25 15:26:16 +00:00
neis
88a795d1c8 Remove the --ignition-generators flag.
This flag has been enabled by default for over a month now.

R=mstarzinger@chromium.org, rmcilroy@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2176143002
Cr-Commit-Position: refs/heads/master@{#38020}
2016-07-25 12:56:27 +00:00
mvstanton
0a36b5cd2c [Turbofan] Make the -0 deopt case more efficient in multiplication.
After multiplying two integers we emit code like:

  if (result == 0) {
    if (OR_OPERATION(rhs, lhs) < 0) {
      DEOPT;
    }
  }

This CL allows us to eliminate the OR and comparison if either rhs or
lhs is a negative number, reducing the code to:

  if (result == 0) DEOPT;

BUG=

Review-Url: https://codereview.chromium.org/2167643002
Cr-Commit-Position: refs/heads/master@{#38016}
2016-07-25 12:15:22 +00:00
mvstanton
480f155ed6 [Turbofan] IsUseLessGeneral shouldn't consider machine representation.
BUG=chromium:630952

Review-Url: https://codereview.chromium.org/2177193002
Cr-Commit-Position: refs/heads/master@{#38014}
2016-07-25 12:01:54 +00:00
bmeurer
5bed1516c8 [turbofan] Avoid introducing machine operators during typed lowering.
Introducing machine operators early causes trouble for the typing,
truncation analysis and representation selection, so we should rather
stick to simplified operators instead. Now there's only the for-in case
left, which is not clear how we can handle this in a better way.

Drive-by-fix: Also don't introduce Int32Constant and Word32Shl in
JSTypedLowering, but use NumberConstant and proper NumberShiftLeft
operators instead.

R=jarin@chromium.org
BUG=chromium:630951

Review-Url: https://codereview.chromium.org/2182453002
Cr-Commit-Position: refs/heads/master@{#38008}
2016-07-25 10:38:00 +00:00
yangguo
02503b080f Make stack property collected by captureStackTrace non-enumerable and -writable.
TBR=jgruber@chromium.org

Review-Url: https://codereview.chromium.org/2177183002
Cr-Commit-Position: refs/heads/master@{#38005}
2016-07-25 10:04:13 +00:00
yangguo
986814218b Native try-catch syntax parsing should not crash.
R=littledan@chromium.org
BUG=chromium:630559

Review-Url: https://codereview.chromium.org/2176613002
Cr-Commit-Position: refs/heads/master@{#37996}
2016-07-25 05:32:28 +00:00
bmeurer
e3e347b85c [turbofan] Remove overly restrictive DCHECK.
The dead code elimination in SimplifiedLowering can eliminate pure nodes
if they don't have value uses. But some of those can indeed have control
inputs, i.e. Phi nodes do of course have a control input.

R=jarin@chromium.org
BUG=chromium:630923

Review-Url: https://codereview.chromium.org/2177133002
Cr-Commit-Position: refs/heads/master@{#37995}
2016-07-25 05:22:19 +00:00
jarin
a81d19d583 [turbofan] Handle impossible types (Type::None()) in the backend.
BUG=chromium:630611

Review-Url: https://codereview.chromium.org/2177483002
Cr-Commit-Position: refs/heads/master@{#37994}
2016-07-25 04:02:58 +00:00
cbruni
7ede61ed1d [elements] Omit fast path in PrependElementIndices
In PrependElementIndicesImpl we sort a FixedArray of indices potentially
containing HeapNumbers. During the string conversion we might trigger a GC.
This in turn might try to read a slot where we previously had a HeapNumber
but the sort sneaked a SMI in there which is not a valid pointer.

BUG=chromium:630561

Review-Url: https://codereview.chromium.org/2173653003
Cr-Commit-Position: refs/heads/master@{#37993}
2016-07-23 12:16:14 +00:00
caitp
122a9b7af0 [builtins] take slow path in IsConcatSpreadable if proxy in prototype
BUG=v8:5134
R=cbruni@chromium.org, littledan@chromium.org, neis@chromium.org

Review-Url: https://codereview.chromium.org/2131383002
Cr-Commit-Position: refs/heads/master@{#37987}
2016-07-22 18:43:19 +00:00
jgruber
89403e0316 Omit frames up to new target in Error constructor
BUG=v8:5216
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2175603003
Cr-Commit-Position: refs/heads/master@{#37978}
2016-07-22 11:45:50 +00:00
jgruber
4feafee9d9 Eagerly format traces in captureStackTrace
This allows us to skip complicated logic for setting the accessors.

BUG=

Review-Url: https://codereview.chromium.org/2164903004
Cr-Commit-Position: refs/heads/master@{#37969}
2016-07-22 08:14:50 +00:00
yangguo
6d0a420298 [debug] use catch prediction flag for promise rejections.
This is in preparation to implementing exception prediction for async
functions.  Each handler table entry can now predict "caught", "uncaught", or
"promise". The latter indicates that the exception will lead to a promise
rejection.

To mark the relevant try-catch blocks, we add a new native syntax.
try { } %catch (e) { } indicates a TryCatchStatement with the "promise"
prediction.

The previous implementation of using the function to tell the relevant
try-catch apart from inner try-catch blocks will not work for async functions
since these can have inner try-catch blocks inside the same function.

BUG=v8:5167

Review-Url: https://codereview.chromium.org/2161263003
Cr-Commit-Position: refs/heads/master@{#37966}
2016-07-22 06:04:54 +00:00
ritesht
b887013712 Revert "[wasm] Adding a convolution matrix filter test to highlight the performance advantages of JITing"
GC-Stress asserts in filter-jit.

This reverts commit ccfd224ec3.

BUG=v8:5044
R=bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2168343002
Cr-Commit-Position: refs/heads/master@{#37961}
2016-07-22 02:10:44 +00:00
jwolfe
3cfd80d6a2 Adjust whitespace to make tests oblivious to --harmony-function-tostring
See discussion in https://codereview.chromium.org/2156303002/#msg8

With the new --harmony-function-tostring behavior, these tests would
fail without this change. This change makes the tests pass regardless
of whether or not --harmony-function-tostring is used.

All of these changes are simply inserting a space after the "function"
keyword to match the current function toString behavior. When
--harmony-function-tostring is enabled, the toString behavior matches
the spacing used in the function declaration. With the declaration
matching the current formatting, the toString behavior becomes
unaffected by --harmony-function-tostring.

BUG=v8:4958
LOG=n

Review-Url: https://codereview.chromium.org/2161413002
Cr-Commit-Position: refs/heads/master@{#37959}
2016-07-22 00:18:41 +00:00
ritesht
ccfd224ec3 [wasm] Adding a convolution matrix filter test to highlight the performance advantages of JITing
This cl also fixes two bugs in the previous code:
    1) JITed functions were not allowed access to the heap because the module instance wasn't correctly synthesized. This wasn't discovered in the previous test.
    2) Decoding of functions with the JITSingleFunction opcode was off by 1 as the length of the opcode wasn't computed correctly.
BUG=5044

Review-Url: https://codereview.chromium.org/2168183002
Cr-Commit-Position: refs/heads/master@{#37957}
2016-07-21 22:39:41 +00:00
ivica.bogosavljevic
eaa86cbf06 MIPS: Fix infinite loop in Math.pow(2,-2147483648)
BUG=v8:5213

Review-Url: https://codereview.chromium.org/2163963003
Cr-Commit-Position: refs/heads/master@{#37955}
2016-07-21 19:38:01 +00:00
yangguo
07a0f9ebff [debugger] be more lenient about argument type in %DebugGetProperty.
R=mstarzinger@chromium.org
BUG=chromium:629996

Review-Url: https://codereview.chromium.org/2166123003
Cr-Commit-Position: refs/heads/master@{#37942}
2016-07-21 11:29:24 +00:00
cbruni
4b59bf5313 [fullcodegen] [crankshaft] Avoid jumping to the runtime for ForInFilter
Use the ForInFilterStub directly. Hence we will only jump to the runtime for
special receivers (instance_type <= LAST_SPECIAL_RECEIVER_TYPE) and for
converting element indices which are not in the string cache.

BUG=

Review-Url: https://codereview.chromium.org/2151773002
Cr-Commit-Position: refs/heads/master@{#37934}
2016-07-21 09:34:11 +00:00
jacob.bramley
e83739c0ae [arm] Fix infinite loop in Math.pow(2,2147483648).
BUG=v8:5214

Review-Url: https://codereview.chromium.org/2166743003
Cr-Commit-Position: refs/heads/master@{#37933}
2016-07-21 09:30:32 +00:00
bmeurer
f793cb1fc3 [runtime] %TransitionElementsKind works for any kind of JSObject.
The optimizing compilers actually invoke %TransitionElementsKind for
any kind of JSObject, the only relevant thing is the elements kind.
The runtime function was however checking for JSArray unnecessarily.
This only worked by coincindence in Crankshaft because the stub would
normally not call into the runtime fallback.

R=jarin@chromium.org
BUG=chromium:629823

Review-Url: https://codereview.chromium.org/2166963004
Cr-Commit-Position: refs/heads/master@{#37919}
2016-07-21 07:23:58 +00:00
ahaas
6627d81c68 [wasm] Use a C wrapper function to calculate F64Pow.
This CL more or less reverts commit https://codereview.chromium.org/2107733002/
The use of the MathPow code stub that was introduced by that commit caused
problems on arm64, and the MathPow code stub was also an obstacle in the
implementation of parallel code generation.

In addition this CL turns on the mjsunit/wasm/embenchen tests for arm64
which were turned off because of problems with MathPow on arm64.

R=titzer@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2166793002
Cr-Commit-Position: refs/heads/master@{#37911}
2016-07-20 14:27:06 +00:00
jgruber
9211dee01a Move Error methods to C++
This ports a large portion of Error methods to C++,
including the constructor, stack setter and getter,
and Error.prototype.toString.

BUG=

Committed: https://crrev.com/5742da056a290caa13a0b8717ddb1e43424e0d31
Review-Url: https://codereview.chromium.org/2142933003
Cr-Original-Commit-Position: refs/heads/master@{#37870}
Cr-Commit-Position: refs/heads/master@{#37908}
2016-07-20 13:05:47 +00:00
neis
f2c2ef1f0e Make toLocaleString on arrays always call toLocaleString on its elements.
As required by the spec.

This is a variant of what I reverted in f47e722403.
It will probably still cause a regression but now it's easier to migrate (parts of)
the current implementation to C++, which is expected to make things faster again.

BUG=chromium:627729,v8:5113

Review-Url: https://codereview.chromium.org/2164923002
Cr-Commit-Position: refs/heads/master@{#37897}
2016-07-20 09:32:20 +00:00
jgruber
8c163cfe45 Revert of Move Error methods to C++ (patchset #11 id:200001 of https://codereview.chromium.org/2142933003/ )
Reason for revert:
Clusterfuzz failures: https://bugs.chromium.org/p/chromium/issues/detail?id=629749

Original issue's description:
> Move Error methods to C++
>
> This ports a large portion of Error methods to C++,
> including the constructor, stack setter and getter,
> and Error.prototype.toString.
>
> BUG=
>
> Committed: https://crrev.com/5742da056a290caa13a0b8717ddb1e43424e0d31
> Cr-Commit-Position: refs/heads/master@{#37870}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review-Url: https://codereview.chromium.org/2159223004
Cr-Commit-Position: refs/heads/master@{#37881}
2016-07-20 06:45:49 +00:00
jgruber
5742da056a Move Error methods to C++
This ports a large portion of Error methods to C++,
including the constructor, stack setter and getter,
and Error.prototype.toString.

BUG=

Review-Url: https://codereview.chromium.org/2142933003
Cr-Commit-Position: refs/heads/master@{#37870}
2016-07-19 13:51:07 +00:00
yangguo
4de5e1456e [debug] add test case for scope iterator using correct language mode.
TBR=mstarzinger@chromium.org
BUG=v8:5207

Review-Url: https://codereview.chromium.org/2154393003
Cr-Commit-Position: refs/heads/master@{#37860}
2016-07-19 11:07:03 +00:00
bmeurer
e0b8707c78 [turbofan] Fix typing rule for number addition.
R=jarin@chromium.org
BUG=chromium:629435

Review-Url: https://codereview.chromium.org/2161013002
Cr-Commit-Position: refs/heads/master@{#37859}
2016-07-19 10:08:13 +00:00
bmeurer
15f99cd5b5 [turbofan] Properly handle bit->float64 representation changes.
BUG=chromium:629062
R=jarin@chromium.org

Review-Url: https://codereview.chromium.org/2155323003
Cr-Commit-Position: refs/heads/master@{#37853}
2016-07-19 08:29:52 +00:00
bmeurer
173313e297 [crankshaft] Guard against side effects in Array.prototype.shift lowering.
We need to pay attention to potential side effects from parameter
evaluation when inlining the fast case Array.prototype.shift.

R=yangguo@chromium.org
BUG=chromium:614644

Review-Url: https://codereview.chromium.org/2161943002
Cr-Commit-Position: refs/heads/master@{#37850}
2016-07-19 06:43:04 +00:00
thakis
6e5077a450 improve grammar in comment
Review-Url: https://codereview.chromium.org/2160633002
Cr-Commit-Position: refs/heads/master@{#37844}
2016-07-18 15:52:21 +00:00
jochen
02ba244125 Reland^2 "Don't compile functions in a context the caller doesn't have access to"
Original issue's description:
> Don't compile functions in a context the caller doesn't have access to
>
> Instead just return undefined
>
> A side effect of this is that it's no longer possible to compile
> functions in a detached context.
>
> BUG=chromium:541703
> R=verwaest@chromium.org,bmeurer@chromium.org

BUG=chromium:541703
R=verwaest@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2155503004
Cr-Commit-Position: refs/heads/master@{#37842}
2016-07-18 15:35:45 +00:00
yangguo
a51f429772 [regexp] Fix case-insensitive matching for one-byte subjects.
The bug occurs because we do not canonicalize character class ranges
before adding case equivalents. While adding case equivalents, we abort
early for one-byte subject strings, assuming that the ranges are sorted.
Which they are not.

R=marja@chromium.org
BUG=v8:5199

Review-Url: https://codereview.chromium.org/2159683002
Cr-Commit-Position: refs/heads/master@{#37833}
2016-07-18 12:03:37 +00:00
jarin
86110796f6 [turbofan] Eliminate checkpoints before return in common op reducer.
This makes sure that we preserve call's tailness even if we have
introduced a loop exit between the call and the return.

BUG=chromium:628773

Review-Url: https://codereview.chromium.org/2155123002
Cr-Commit-Position: refs/heads/master@{#37832}
2016-07-18 11:56:54 +00:00
mvstanton
47aaac6442 [Turbofan]: Eliminate the check for -0 if it's not possible/observable.
In int32 multiplication, if we have a positive integer as input, then we know we can't produce a -0 answer. The same is true if truncation is applied (x * y | 0). Without this information, we have to rather annoyingly check if the result of multiplication is 0, then OR the inputs to check for negativity, and possibly return -0. In TurboFan, we'll deopt in this case.

BUG=

Review-Url: https://codereview.chromium.org/2154073002
Cr-Commit-Position: refs/heads/master@{#37831}
2016-07-18 11:37:23 +00:00
mstarzinger
a95cdbb4b4 [turbofan] Fix deopt point for [[ToObject]] lazy bailout.
This fixes the deoptimization information for the lazy bailout point
after a [[ToObject]] operation inserted for with statements. The result
value was pushed on the operand stack but erroneously ignored and left
on the operand stack by the FullCodeGenerator.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-5205
BUG=v8:5205

Review-Url: https://codereview.chromium.org/2158443002
Cr-Commit-Position: refs/heads/master@{#37818}
2016-07-18 08:08:47 +00:00
jarin
514951f651 [turbofan] In effect control linearizer, only delay effect phi update for loops.
Delaying for merges caused branch cloning using dummy effect phi inputs,
potentially splitting the effect chain at start.

We still have to delay the creation for loops because we need to break
cycles.

BUG=chromium:628403

Review-Url: https://codereview.chromium.org/2159603002
Cr-Commit-Position: refs/heads/master@{#37808}
2016-07-16 12:39:14 +00:00
gdeepti
18543ff1da Convert SIMD wasm ops to runtime function calls
- Add Simd128 type to Wasm AST types
 - Decode SIMD prefix, wasm opcodes correctly
 - Add a pass that converts SIMD machine ops to runtime calls
 - Sample opcodes Int32x4Splat, Int32x4ExtractLane and test

LOG=N
BUG=v8:4124

R=bradnelson@chromium.org, bbudge@chromium.org, titzer@chromium.org

Committed: https://crrev.com/73df92fc2fdbbfadc17e8ab4e58ec56ae2b3d91a
Review-Url: https://codereview.chromium.org/1991143002
Cr-Original-Commit-Position: refs/heads/master@{#37789}
Cr-Commit-Position: refs/heads/master@{#37807}
2016-07-16 03:50:54 +00:00
ishell
5d66a7f76b [fullcode] Restore context after calling ToNumber builtin.
BUG=chromium:628573

Review-Url: https://codereview.chromium.org/2153783002
Cr-Commit-Position: refs/heads/master@{#37796}
2016-07-15 13:18:57 +00:00
neis
f47e722403 Revert "Make toLocaleString on arrays always call toLocaleString on its elements."
This reverts commit 457c02573c because it caused a
regression in SunSpider/string-fasta and possibly AreWeFastYet/Life.  Need to
implement this in a smarter way.

TBR=littledan@chromium.org
BUG=chromium:627729,v8:5113

Review-Url: https://codereview.chromium.org/2149303003
Cr-Commit-Position: refs/heads/master@{#37793}
2016-07-15 11:28:42 +00:00
jarin
9f859c66a1 [turbofan] Add re-typing for PlainPrimitiveToNumber during representation inference.
This makes sure that the uses of PlainPrimitiveToNumber get a more
precise type (so that the uses know how to interpret the output
representation).

BUG=chromium:628516

Review-Url: https://codereview.chromium.org/2151223002
Cr-Commit-Position: refs/heads/master@{#37792}
2016-07-15 10:37:27 +00:00
machenbach
9f46c1112b Revert of Convert SIMD wasm ops to runtime function calls (patchset #17 id:320001 of https://codereview.chromium.org/1991143002/ )
Reason for revert:
[Sheriff] Violates msan and tsan:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20arm64%20-%20sim%20-%20MSAN/builds/9663
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20TSAN/builds/10670

Original issue's description:
> Convert SIMD machine ops to runtime function calls
>  - Add Simd128 type to Wasm AST types
>  - Add a pass that converts SIMD machine ops to runtime calls
>  - Sample opcodes Int32x4Splat, Int32x4ExtractLane and test
>  - Separate out generic SIMD Machine ops as these cannot be
>  handled by runtime functions just yet.
>
> LOG=N
> BUG=v8:4124
>
> R=bradnelson@chromium.org, bbudge@chromium.org, titzer@chromium.org
>
> Committed: https://crrev.com/73df92fc2fdbbfadc17e8ab4e58ec56ae2b3d91a
> Cr-Commit-Position: refs/heads/master@{#37789}

TBR=bbudge@chromium.org,bradnelson@chromium.org,titzer@chromium.org,gdeepti@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4124

Review-Url: https://codereview.chromium.org/2154723002
Cr-Commit-Position: refs/heads/master@{#37790}
2016-07-15 09:00:02 +00:00
gdeepti
73df92fc2f Convert SIMD machine ops to runtime function calls
- Add Simd128 type to Wasm AST types
 - Add a pass that converts SIMD machine ops to runtime calls
 - Sample opcodes Int32x4Splat, Int32x4ExtractLane and test
 - Separate out generic SIMD Machine ops as these cannot be
 handled by runtime functions just yet.

LOG=N
BUG=v8:4124

R=bradnelson@chromium.org, bbudge@chromium.org, titzer@chromium.org

Review-Url: https://codereview.chromium.org/1991143002
Cr-Commit-Position: refs/heads/master@{#37789}
2016-07-15 08:30:25 +00:00
bakkot
f6c6ae9034 Block-scoped functions in evals are now only conditionally hoisted out.
Annex B.3.3 of the spec requires that sloppy-mode block-scoped functions
declared by "eval" are hoisted unless doing so would cause an early
error (which is to say, conflict with a lexical declaration). This patch
amends the check for conflicting declarations to include those outside
of the eval itself.

BUG=v8:4468, v8:4479

Review-Url: https://codereview.chromium.org/2112163002
Cr-Commit-Position: refs/heads/master@{#37783}
2016-07-14 22:43:01 +00:00
adamk
458bd3b9a3 Slight cleanup of TryCatch parsing/variable declaration
Instead of unconditionally parsing the catch parameter as an expression
and then recovering if it turns out to be a simple variable proxy
(the overwhelmingly common case), this patch peeks one token ahead
before attempting to parse. This avoids doing the usual RemoveUnresolved
gymnastics in ParseTryStatement, and as a side-effect slightly improves
function name inference for an async arrow function test case.

Review-Url: https://codereview.chromium.org/2151433005
Cr-Commit-Position: refs/heads/master@{#37780}
2016-07-14 17:55:45 +00:00
mtrofin
bd03c64297 [wasm] Compile and Instantiation
Implemented the WebAssembly.Module and WebAssembly.Instance
in terms of the WasmModule::CompileFunctions and
WasmModule::Instantiate APIs.

Added negative tests - for invalid module object.

BUG=

Review-Url: https://codereview.chromium.org/2121593002
Cr-Commit-Position: refs/heads/master@{#37775}
2016-07-14 16:31:07 +00:00
neis
1c1bdfe17e [test] Extend a test of destructuring.
R=adamk@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2147733003
Cr-Commit-Position: refs/heads/master@{#37773}
2016-07-14 16:11:41 +00:00
mstarzinger
ed5802cc8c [turbofan] Re-enable flaky tests that should no longer flake.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2143973002
Cr-Commit-Position: refs/heads/master@{#37767}
2016-07-14 13:54:24 +00:00
mvstanton
e7111cfff7 [Turbofan]: Add integer multiplication with overflow to typed lowering.
BUG=

Review-Url: https://codereview.chromium.org/2141953002
Cr-Commit-Position: refs/heads/master@{#37764}
2016-07-14 13:25:15 +00:00
epertoso
d93fd41aaa [turbofan] Introduces the SpeculativeNumberShiftLeft opcode.
Typed lowering now produces SpeculativeNumberShiftLeft for JSShiftLeft if the type feedback is kSignedSmall or kSigned32.

BUG=v8:4583
LOG=n

Review-Url: https://codereview.chromium.org/2150553002
Cr-Commit-Position: refs/heads/master@{#37762}
2016-07-14 12:49:32 +00:00
jochen
63449d21d3 Revert of Reland "Don't compile functions in a context the caller doesn't have access to" (patchset #4 id:60001 of https://codereview.chromium.org/2143893005/ )
Reason for revert:
blink is unhappy about the microtask change

Original issue's description:
> Reland "Don't compile functions in a context the caller doesn't have access to"
>
> Original issue's description:
> > Don't compile functions in a context the caller doesn't have access to
> >
> > Instead just return undefined
> >
> > A side effect of this is that it's no longer possible to compile
> > functions in a detached context.
> >
> > BUG=chromium:541703
> > R=verwaest@chromium.org,bmeurer@chromium.org
>
> BUG=chromium:541703
> R=verwaest@chromium.org
>
> Committed: https://crrev.com/6bceabac5b705b2ce1f52d34650cea1ae3b8c617
> Cr-Commit-Position: refs/heads/master@{#37756}

TBR=verwaest@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:541703

Review-Url: https://codereview.chromium.org/2151843002
Cr-Commit-Position: refs/heads/master@{#37760}
2016-07-14 12:39:13 +00:00
mstarzinger
95ba1af314 [i18n] Make regression test work without i18n.
TBR=machenbach@chromium.org
NOTREECHECKS=true
NOTRY=true

Review-Url: https://codereview.chromium.org/2144263002
Cr-Commit-Position: refs/heads/master@{#37759}
2016-07-14 12:32:45 +00:00
bmeurer
6530a16eb5 [stubs] Properly handle length overflow in StringAddStub.
Using the Hydrogen code stub bailout mechanism is not correct for the
string length overflow check in the StringAddStub. Instead make sure we
just throw the proper exception.

R=mstarzinger@chromium.org
BUG=chromium:627934

Review-Url: https://codereview.chromium.org/2146353002
Cr-Commit-Position: refs/heads/master@{#37758}
2016-07-14 11:47:42 +00:00
mstarzinger
8226c88b52 [i18n] Ensure [[ToString]] conversion of time zone names.
This adds a missing conversion of time zone names to string primitives
before case conversion and regular expression matching are applied.

This is in sync with ECMA-402, section 12.1.1.1, step 16(a).

R=jochen@chromium.org
TEST=mjsunit/regress/regress-crbug-627935
BUG=chromium:627935

Review-Url: https://codereview.chromium.org/2143003005
Cr-Commit-Position: refs/heads/master@{#37757}
2016-07-14 11:31:29 +00:00
jochen
6bceabac5b Reland "Don't compile functions in a context the caller doesn't have access to"
Original issue's description:
> Don't compile functions in a context the caller doesn't have access to
>
> Instead just return undefined
>
> A side effect of this is that it's no longer possible to compile
> functions in a detached context.
>
> BUG=chromium:541703
> R=verwaest@chromium.org,bmeurer@chromium.org

BUG=chromium:541703
R=verwaest@chromium.org

Review-Url: https://codereview.chromium.org/2143893005
Cr-Commit-Position: refs/heads/master@{#37756}
2016-07-14 11:08:52 +00:00
mvstanton
8e18a5f2a0 [turbofan] Introduce integer multiplication with overflow.
BUG=

Review-Url: https://codereview.chromium.org/2101123005
Cr-Commit-Position: refs/heads/master@{#37748}
2016-07-14 08:56:14 +00:00
adamk
68f205b2a7 Revert of Don't compile functions in a context the caller doesn't have access to (patchset #9 id:160001 of https://codereview.chromium.org/2034083002/ )
Reason for revert:
Causes crashes on Canary

Original issue's description:
> Don't compile functions in a context the caller doesn't have access to
>
> Instead just return undefined
>
> A side effect of this is that it's no longer possible to compile
> functions in a detached context.
>
> BUG=chromium:541703
> R=verwaest@chromium.org,bmeurer@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng
>
> Committed: https://crrev.com/992e34c21635b179a993b82ac1d81753e7a6a57a
> Cr-Commit-Position: refs/heads/master@{#37657}

TBR=bmeurer@chromium.org,verwaest@chromium.org,jochen@chromium.org
# Not skipping CQ checks because original CL landed more than 1 days ago.
BUG=chromium:541703, chromium:628053

Review-Url: https://codereview.chromium.org/2148163002
Cr-Commit-Position: refs/heads/master@{#37736}
2016-07-14 02:02:20 +00:00
ritesht
de33e4bad2 [wasm] Adding feature to JIT a wasm function at runtime and hook up the compiled code into the indirect function table
The runtime JIT function is passed in the function table to hook up the compiled code and the starting address of the memory to locate the bytes to be compiled.

BUG=5044

Review-Url: https://codereview.chromium.org/2137993003
Cr-Commit-Position: refs/heads/master@{#37735}
2016-07-14 01:13:50 +00:00
jpp
aa91225289 V8. ASM-2-WASM. Migrates asm-wasm-builder to the new asm-typer.
BUG= https://bugs.chromium.org/p/v8/issues/detail?id=4203
TEST=mjsunit/wasm/*
LOG=N

Review-Url: https://codereview.chromium.org/2134333003
Cr-Commit-Position: refs/heads/master@{#37729}
2016-07-13 19:40:10 +00:00
bakkot
819fe04645 Reland of Add errors for declarations which conflict with catch parameters. (patchset #1 id:1 of https://codereview.chromium.org/2112223002/ )
Reason for revert:
Correcting issue.

Original issue's description:
> Revert of Add errors for declarations which conflict with catch parameters. (patchset #6 id:100001 of https://codereview.chromium.org/2109733003/ )
>
> Reason for revert:
> Fuzzer claims `try {  \"\" ; } catch(x) { let x1 = [1,,], x = x; }` causes a crash.
>
> Original issue's description:
> > Add errors for declarations which conflict with catch parameters.
> >
> > Catch parameters are largely treated as lexical declarations in the
> > block which contains their body for the purposes of early syntax errors,
> > with some exceptions outlined in B.3.5. This patch introduces most of
> > those errors, except those from `eval('for (var e of ...);')` inside of
> > a catch with a simple parameter named 'e'.
> >
> > Note that annex B.3.5 allows var declarations to conflict with simple
> > catch parameters, except when the variable declaration is the init of a
> > for-of statement.
> >
> > BUG=v8:5112,v8:4231
> >
> > Committed: https://crrev.com/2907c726b2bb5cf20b2bec639ca9e6a521585406
> > Cr-Commit-Position: refs/heads/master@{#37462}
>
> TBR=littledan@chromium.org
> # Skipping CQ checks because original CL landed less than 1 days ago.
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=v8:5112,v8:4231
>
> Committed: https://crrev.com/8834d5ecb559001c87c42322969471da60574a8c
> Cr-Commit-Position: refs/heads/master@{#37464}

R=littledan@chromium.org
BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2119933002
Cr-Commit-Position: refs/heads/master@{#37728}
2016-07-13 19:29:11 +00:00
binji
a16ca012e0 [Atomics] Rename Atomics.futex*, remove Atomics.futexWakeOrRequeue
* Rename Atomics.futexWait -> Atomics.wait
* Rename Atomics.futexWake -> Atomics.wake
* Remove Atomics.futexWakeOrRequeue
* Return value of Atomics.wait is now a string: "ok", "not-equal" or
  "timed-out"
* Update comments that reference URL for ecmascript_sharedmem to
  https://github.com/tc39/ecmascript_sharedmem

Review-Url: https://codereview.chromium.org/2143443002
Cr-Commit-Position: refs/heads/master@{#37727}
2016-07-13 18:34:03 +00:00
mstarzinger
a2f1519f68 [turbofan] Fix deopt point for [[ToName]] lazy bailout.
This fixes the deoptimization information for the lazy bailout point
after a [[ToName]] operation inserted for object literals and class
literals. The result value was erroneously ignored.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-627828
BUG=chromium:627828

Review-Url: https://codereview.chromium.org/2149493003
Cr-Commit-Position: refs/heads/master@{#37719}
2016-07-13 15:18:10 +00:00
mstarzinger
04062e92cc [runtime] Fully remove RUNTIME_ASSERT for good.
This fully deprecates all uses of the RUNTIME_ASSERT macro and removes
the macro and underlying logging function in question. All uses have
been replaces with CHECK macros which crash safely even in production.

It makes sure we discover abuse of runtime functions in the wild early
and also abort the process safely. Breaking assumptions in any runtime
function can no longer accidentally be caught by JavaScript.

R=yangguo@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2132493002
Cr-Commit-Position: refs/heads/master@{#37704}
2016-07-13 08:36:04 +00:00
mstarzinger
08843650db [turbofan] Respect catch prediction provided by parser.
This makes sure the {AstGraphBuilder} respects the catch-prediction that
is provided by the parser along with each {TryStatement}. This is needed
for try-blocks materialized by the parser not to influence predictions
users expect when using the debugger.

R=neis@chromium.org
TEST=mjsunit/debug-exceptions
BUG=v8:5183

Review-Url: https://codereview.chromium.org/2147573002
Cr-Commit-Position: refs/heads/master@{#37702}
2016-07-13 08:13:18 +00:00
mythria
fd420203ec [Interpreter] Collect type feedback for calls in the bytecode handler
Collect type feedback in the call bytecode handler. The current
implementation only collects feedback for JS function objects. The other
objects and Array functions do not collect any feedback. They will be
marked Megamorphic.

BUG=v8:4280, v8:4780
LOG=N

Review-Url: https://codereview.chromium.org/2122183002
Cr-Commit-Position: refs/heads/master@{#37700}
2016-07-13 08:00:23 +00:00
aseemgarg
cd95c600be [wasm] allow array access with unsigned indices
BUG=618608
R=bradnelson@chromium.org
TEST=regress-618608.js

Review-Url: https://codereview.chromium.org/2138243002
Cr-Commit-Position: refs/heads/master@{#37693}
2016-07-12 21:56:38 +00:00
neis
457c02573c Make toLocaleString on arrays always call toLocaleString on its elements.
As required by the spec.

BUG=v8:5113

Review-Url: https://codereview.chromium.org/2141603002
Cr-Commit-Position: refs/heads/master@{#37689}
2016-07-12 17:33:36 +00:00
neis
8f1f1cb1c7 Move catch prediction into frontend and make it aware of rethrows.
This solves an issue with throws inside for-of always being marked as caught.

BUG=v8:5183

Review-Url: https://codereview.chromium.org/2146493002
Cr-Commit-Position: refs/heads/master@{#37686}
2016-07-12 15:23:35 +00:00
cbruni
d234118e29 Revert of making heap verification more aggressive (patchset #7 id:120001 of https://codereview.chromium.org/2126613002/ )
Reason for revert:
failing gc stress tests: https://build.chromium.org/p/client.v8/builders/V8%20Mac%20GC%20Stress/builds/7223/steps/Mjsunit/logs/stdio

Original issue's description:
> [runtime] making heap verification more aggressive
>
> - check that packed elements do not contain the_hole (with fix)
> - verify argument objects with elements kind
> - use JSObjectVerifiy in all JSObject "subclasses"
> - change initialization order for ArrayLiteralBoilerplate to simplify verification
>
> BUG=v8:5188
>
> Committed: https://crrev.com/599aa2e106ca8ab79f5cc489d1b93b6a26b19714
> Cr-Commit-Position: refs/heads/master@{#37680}

TBR=ishell@chromium.org,ulan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5188

Review-Url: https://codereview.chromium.org/2140163002
Cr-Commit-Position: refs/heads/master@{#37682}
2016-07-12 14:07:17 +00:00
cbruni
599aa2e106 [runtime] making heap verification more aggressive
- check that packed elements do not contain the_hole (with fix)
- verify argument objects with elements kind
- use JSObjectVerifiy in all JSObject "subclasses"
- change initialization order for ArrayLiteralBoilerplate to simplify verification

BUG=v8:5188

Review-Url: https://codereview.chromium.org/2126613002
Cr-Commit-Position: refs/heads/master@{#37680}
2016-07-12 13:32:03 +00:00
mstarzinger
6e38f4270a [test] Remove NaCl support from test runner harness.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141013002
Cr-Commit-Position: refs/heads/master@{#37678}
2016-07-12 13:18:49 +00:00
mstarzinger
88402eccc7 [turbofan] Re-enable tests no longer failing on ARM hardware.
R=machenbach@chromium.org

Review-Url: https://codereview.chromium.org/2141563002
Cr-Commit-Position: refs/heads/master@{#37677}
2016-07-12 12:44:11 +00:00
mstarzinger
f3ca214222 [turbofan] Speed up structural graph verification.
This removes the checking for use-def and def-use chain links from the
graph verification. Presence of such links can only be violated by a bug
in the actual {Node} implementation itself. That container class is also
covered by unit tests.

The verification in question was useful in the early days when the graph
implementation itself was prone to bugs. By now it has stabilized and
spending O(n^2) time during graph verification is too wasteful to still
be considered a reasonable trade-off.

R=jarin@chromium.org
TEST=unittests/NodeTest.*

Review-Url: https://codereview.chromium.org/2140973003
Cr-Commit-Position: refs/heads/master@{#37670}
2016-07-12 09:31:12 +00:00
bmeurer
4e862dd964 [intrinsics] Remove obsolete intrinsics.
Remove obsolete definitions from macros.py, and drop the now obsolete
%_ToPrimitive, %_ToPrimitive_Number, %_ToPrimitive_String, %_ToName
and the %ToPrimitive_String intrinsics/runtime entries.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2137203002
Cr-Commit-Position: refs/heads/master@{#37665}
2016-07-12 06:41:23 +00:00
yangguo
bbb2159d4c [regexp] Fix regexp source escaping with preceding backslashes.
R=franzih@chromium.org
BUG=chromium:515897

Review-Url: https://codereview.chromium.org/2137033002
Cr-Commit-Position: refs/heads/master@{#37664}
2016-07-12 05:36:17 +00:00
jochen
992e34c216 Don't compile functions in a context the caller doesn't have access to
Instead just return undefined

A side effect of this is that it's no longer possible to compile
functions in a detached context.

BUG=chromium:541703
R=verwaest@chromium.org,bmeurer@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng

Review-Url: https://codereview.chromium.org/2034083002
Cr-Commit-Position: refs/heads/master@{#37657}
2016-07-11 20:11:51 +00:00
littledan
77cbe27689 Narrowly address async function stack overflow parsing case
This patch just checks for a stack overflow and returns failure
from the cases which Clusterfuzz found. However, there may be
more locations in the parser which need similar treatment.

R=caitpotter88@gmail.com,neis
BUG=v8:4483,chromium:624300

Review-Url: https://codereview.chromium.org/2135503002
Cr-Commit-Position: refs/heads/master@{#37655}
2016-07-11 19:33:43 +00:00
aseemgarg
8474f24450 [wasm] throw in case of assignment to module parameters
BUG=613928
R=bradnelson@chromium.org
TEST=regress-613928.js

Review-Url: https://codereview.chromium.org/2123283007
Cr-Commit-Position: refs/heads/master@{#37653}
2016-07-11 17:41:30 +00:00
ishell
b030a6f59d [runtime] Follow-up fix for "Better encapsulation of dictionary objects handling in lookup iterator."
BUG=chromium:626715

Review-Url: https://codereview.chromium.org/2135253002
Cr-Commit-Position: refs/heads/master@{#37651}
2016-07-11 15:51:58 +00:00
mstarzinger
f57b0604ed [crankshaft] Re-enable Math.min/max tests that no longer fail.
R=titzer@chromium.org

Review-Url: https://codereview.chromium.org/2132373002
Cr-Commit-Position: refs/heads/master@{#37635}
2016-07-11 11:14:00 +00:00
caitp
08d0012dda [keys] propagate PropertyFilter to proxy targets in KeyAccumulator
BUG=v8:5174, v8:1543
R=cbruni@chromium.org, littledan@chromium.org

Review-Url: https://codereview.chromium.org/2129193003
Cr-Commit-Position: refs/heads/master@{#37634}
2016-07-11 10:39:35 +00:00
jgruber
be5808bff8 Correctly format builtin constructors in stack traces
CallSite::IsConstructor() was unable to recognize builtin construct stubs
(NumberConstructor_ConstructStub and StringConstructor_ConstructStub) as
constructors, and thus these frames were not formatted correctly in stack
traces.

Fix this by explicitly marking their Code objects as construct stubs and
passing along a special receiver value when we encounter such cases in
CaptureSimpleStackTrace.

R=mstarzinger@chromium.org, yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2125163004
Cr-Commit-Position: refs/heads/master@{#37631}
2016-07-11 10:05:03 +00:00
yangguo
dfcc5d4ee8 [debugger] omit exception events for rethrown exceptions in async.
R=bmeurer@chromium.org, littledan@chromium.org
BUG=v8:5167

Review-Url: https://codereview.chromium.org/2124813002
Cr-Commit-Position: refs/heads/master@{#37623}
2016-07-11 05:50:03 +00:00
mstarzinger
3660505e5f [turbofan] Re-enable debugger tests that no longer fail.
R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2127423002
Cr-Commit-Position: refs/heads/master@{#37609}
2016-07-08 12:49:53 +00:00
Michael Starzinger
2c09760ac4 [turbofan] Re-enable test that no longer fails.
This enables tests which rely on the context available at "debugger"
statements to be accurate. This is the case by now when deoptimization
information is available.

R=yangguo@chromium.org
BUG=v8:4055

Review URL: https://codereview.chromium.org/2129123002 .

Cr-Commit-Position: refs/heads/master@{#37604}
2016-07-08 09:52:07 +00:00
jgruber
d49d3864d7 [builtins] Construct builtin frame in String/Number ctors
BUG=v8:5173
R=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2118283003
Cr-Commit-Position: refs/heads/master@{#37598}
2016-07-08 06:38:19 +00:00
ben
1f53e42bd6 Handle symbols in FrameMirror#invocationText().
Fix a TypeError when putting together the invocationText for a symbol
method's stack frame.

See https://github.com/nodejs/node/issues/7536.

Review-Url: https://codereview.chromium.org/2122793003
Cr-Commit-Position: refs/heads/master@{#37597}
2016-07-07 21:32:03 +00:00
franzih
2f36ee7176 [builtins] Migrate SharedArrayBuffer.byteLength to C++.
Drive-by-fix: hydrogen code does not blindly return the
byteLength offset, instead it executes what is defined
in the byteLength getter.

BUG=

Review-Url: https://codereview.chromium.org/2123263002
Cr-Commit-Position: refs/heads/master@{#37595}
2016-07-07 19:44:23 +00:00
mstarzinger
b3b1bf279a [turbofan] Context in debugger is accurate by now.
This enables tests which rely on the context available at "debugger"
statements to be accurate. This is the case by now when deoptimization
information is available.

R=mvstanton@chromium.org
BUG=v8:4035

Review-Url: https://codereview.chromium.org/2125773005
Cr-Commit-Position: refs/heads/master@{#37590}
2016-07-07 14:26:52 +00:00
mstarzinger
67efc381b0 [turbofan] Re-enable tests that no longer fail.
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2127093002
Cr-Commit-Position: refs/heads/master@{#37589}
2016-07-07 13:40:00 +00:00
mstarzinger
07612e0d35 [test] Remove obsolete mjsunit/call-counts test.
R=mvstanton@chromium.org
BUG=v8:4458

Review-Url: https://codereview.chromium.org/2129903002
Cr-Commit-Position: refs/heads/master@{#37584}
2016-07-07 12:04:11 +00:00
mstarzinger
bae7870c41 [turbofan] Re-enable tests that are not longer too slow.
R=mvstanton@chromium.org

Review-Url: https://codereview.chromium.org/2132503002
Cr-Commit-Position: refs/heads/master@{#37583}
2016-07-07 11:30:15 +00:00
jkummerow
b36237b8a3 [ForIn] Fix HasEnumerableProperty for Proxies with null prototype
BUG=v8:5181

Review-Url: https://codereview.chromium.org/2129563002
Cr-Commit-Position: refs/heads/master@{#37577}
2016-07-07 10:12:06 +00:00
neis
d3aefe8cc3 [parser] Fix bug in for-of desugaring.
When reading the value property of an iterator result fails, we must not close the iterator.
This was not discovered earlier because the tests had a subtle bug.

This CL fixes both the desugaring and the tests.

BUG=

Review-Url: https://codereview.chromium.org/2119353002
Cr-Commit-Position: refs/heads/master@{#37571}
2016-07-07 08:16:13 +00:00
neis
4a4f7175df [parser] Fix bug in destructuring binding for catch.
For variables introduced as part of a catch pattern, we used to set their
"initializer position" to the beginning of the pattern.  This lead to
full-codegen eliminating crucial hole checks when reading such variables
inside the pattern itself.

R=adamk@chromium.org, littledan@chromium.org
BUG=v8:5178

Review-Url: https://codereview.chromium.org/2123953002
Cr-Commit-Position: refs/heads/master@{#37569}
2016-07-07 07:31:16 +00:00
mvstanton
a80164ec43 [TurboFan] Improve Array constructor optimization
And in so doing, enable a handful of excluded tests.

BUG=

Review-Url: https://codereview.chromium.org/2127713003
Cr-Commit-Position: refs/heads/master@{#37559}
2016-07-06 15:17:10 +00:00
mlippautz
9f7fd3a554 [heap] Remove test running OOM on some bots
While the test was useful to reproduce the issue locally it creates a lot of
heap pressure and causes all sorts of troubles (OOM, slowness) on the bots, so
let's drop it.

R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2127803002
Cr-Commit-Position: refs/heads/master@{#37551}
2016-07-06 13:09:03 +00:00
mstarzinger
c4781e344c [runtime] Deprecate RUNTIME_ASSERT from debugger methods.
This removes explicit uses of the RUNTIME_ASSERT macro from some runtime
methods. The implicit ones in CONVERT_FOO_ARG_CHECKED will be addressed
in a separate CL for all runtime modules at once.

R=yangguo@chromium.org
BUG=v8:5066

Review-Url: https://codereview.chromium.org/2053573004
Cr-Commit-Position: refs/heads/master@{#37545}
2016-07-06 09:06:58 +00:00
neis
45a8167477 [debugger] Don't leak holes from generator arguments.
This is a quick fix for the hole leaking from generators via the debugger's frame
inspection feature: when collecting the arguments, convert each hole to undefined.
In the long term, we probably want to remember and restore the actual arguments
rather than pushing these dummy arguments on each resume.

BUG=v8:5164

Review-Url: https://codereview.chromium.org/2122923003
Cr-Commit-Position: refs/heads/master@{#37544}
2016-07-06 08:11:29 +00:00
jarin
7614362b7e [turbofan] Set elements kind to holey if constructing array of possibly non-zero length.
BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2126623003
Cr-Commit-Position: refs/heads/master@{#37543}
2016-07-06 07:55:36 +00:00
mlippautz
da3745d8d9 Reland "[heap] Track length for array buffers to avoid free-ing dependency"
The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

This reverts commit 1791d7bb9a.

Review-Url: https://codereview.chromium.org/2127643002
Cr-Commit-Position: refs/heads/master@{#37537}
2016-07-05 16:32:17 +00:00
machenbach
1791d7bb9a Revert of [heap] Track length for array buffers to avoid free-ing dependency (patchset #2 id:20001 of https://codereview.chromium.org/2122603004/ )
Reason for revert:
[Sheriff] This makes mjsunit/regress/regress-625752 extremely slow on all gc stress bots and leads to timeouts with custom snapshot:
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20GC%20Stress%20-%20custom%20snapshot/builds/6602

Original issue's description:
> [heap] Track length for array buffers to avoid free-ing dependency
>
> The dependency would only happen if we have a smi overflow for the length and
> have create a heap number. In this case the heap number would've to survive
> until the array buffer is collected.
>
> To avoid this dependency we track the length (as we previously used to).
>
> BUG=chromium:625748,chromium:625752
> LOG=N
> TEST=test/mjsunit/regress/regress-625752.js
> R=hpayer@chromium.org
>
> Committed: https://crrev.com/ddc75cc1356a58b6cfd63f9da0586e1150496b3d
> Cr-Commit-Position: refs/heads/master@{#37530}

TBR=hpayer@chromium.org,mlippautz@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:625748,chromium:625752

Review-Url: https://codereview.chromium.org/2127483003
Cr-Commit-Position: refs/heads/master@{#37533}
2016-07-05 14:43:24 +00:00
mlippautz
ddc75cc135 [heap] Track length for array buffers to avoid free-ing dependency
The dependency would only happen if we have a smi overflow for the length and
have create a heap number. In this case the heap number would've to survive
until the array buffer is collected.

To avoid this dependency we track the length (as we previously used to).

BUG=chromium:625748,chromium:625752
LOG=N
TEST=test/mjsunit/regress/regress-625752.js
R=hpayer@chromium.org

Review-Url: https://codereview.chromium.org/2122603004
Cr-Commit-Position: refs/heads/master@{#37530}
2016-07-05 13:15:22 +00:00
yangguo
7a834e8b69 [debugger] add test case for throwing in generators.
R=neis@chromium.org

Review-Url: https://codereview.chromium.org/2117303003
Cr-Commit-Position: refs/heads/master@{#37520}
2016-07-05 10:12:33 +00:00
bmeurer
72275e6620 [intrinsic] Drop the %_ValueOf intrinsic.
This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
Review-Url: https://codereview.chromium.org/2126453002
Cr-Original-Commit-Position: refs/heads/master@{#37512}
Cr-Commit-Position: refs/heads/master@{#37519}
2016-07-05 10:05:40 +00:00
machenbach
0960beb0ef Revert of [intrinsic] Drop the %_ValueOf intrinsic. (patchset #2 id:20001 of https://codereview.chromium.org/2126453002/ )
Reason for revert:
[Sheriff] Breaks without i18n:
https://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20noi18n%20-%20debug/builds/8466

Original issue's description:
> [intrinsic] Drop the %_ValueOf intrinsic.
>
> This drops the %_ValueOf intrinsic, but keeps the runtime entry
> %ValueOf for now, by either migrating the functionality (mostly
> Debug mirror or toString/valueOf methods) to C++ or TurboFan
> builtins, or switching to the %ValueOf runtime call when it's
> not performance critical anyways.
>
> The %_ValueOf intrinsic was one of the last blockers for fixing
> the unsound machine operator typing in TurboFan.
>
> R=yangguo@chromium.org
> BUG=v8:5049
>
> Committed: https://crrev.com/293bd7882987f00e465710ce468bfb1eaa7d3fa2
> Cr-Commit-Position: refs/heads/master@{#37512}

TBR=yangguo@chromium.org,bmeurer@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2117273002
Cr-Commit-Position: refs/heads/master@{#37514}
2016-07-05 08:01:06 +00:00
jgruber
971468031a Use toString tag to format receiver in stack traces
This concerns formatting of calls to, e.g., Math.acos in stack traces,
in which the receiver is an object with an attached toString tag. If
such a tag exists, use it to format the receiver typename to ensure that
the stack trace includes 'Math.acos' instead of 'Object.acos'.

R=yangguo@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2110683007
Cr-Commit-Position: refs/heads/master@{#37513}
2016-07-05 07:42:53 +00:00
bmeurer
293bd78829 [intrinsic] Drop the %_ValueOf intrinsic.
This drops the %_ValueOf intrinsic, but keeps the runtime entry
%ValueOf for now, by either migrating the functionality (mostly
Debug mirror or toString/valueOf methods) to C++ or TurboFan
builtins, or switching to the %ValueOf runtime call when it's
not performance critical anyways.

The %_ValueOf intrinsic was one of the last blockers for fixing
the unsound machine operator typing in TurboFan.

R=yangguo@chromium.org
BUG=v8:5049

Review-Url: https://codereview.chromium.org/2126453002
Cr-Commit-Position: refs/heads/master@{#37512}
2016-07-05 06:47:53 +00:00
caitpotter88
8134986917 [builtins] don't create keys for undefined property descriptors in O.gOPDs
Implements the change proposed at https://github.com/tc39/ecma262/pull/593.

In summary, Object.getOwnPropertyDescriptors can produce results which cause
Object.defineProperties() to throw, by inserting a property with an undefined
descriptor into the result object. This change to the algorithm requires that
the descriptor only be added to the result object if it is not undefined.

BUG=v8:4725
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118613003
Cr-Commit-Position: refs/heads/master@{#37504}
2016-07-04 18:04:05 +00:00
jgruber
f59a23356b [builtins] Add receiver to builtin exit frames
Stack trace generation requires access to the receiver; and while the
receiver is already on the stack, we cannot determine its position
during stack trace generation (it's stored in argv[0], and argc is only
stored in a callee-saved register).

This patch grants access to the receiver by pushing argc onto builtin
exit frames as an extra argument. Compared to simply pushing the
receiver, this requires an additional dereference during stack trace
generation, but one fewer during builtin calls.

BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106883003
Cr-Commit-Position: refs/heads/master@{#37500}
2016-07-04 12:46:47 +00:00
ishell
43aee0331d [fullcode][mips][mips64][ppc][s390] Avoid trashing of a home object when doing a keyed store to a super.
BUG=chromium:625590

Review-Url: https://codereview.chromium.org/2120963002
Cr-Commit-Position: refs/heads/master@{#37497}
2016-07-04 11:42:39 +00:00
ishell
acd674db10 [crankshaft] Use canonical nan_value or minus_zero_value objects instead of constant heap numbers with NaN or -0.0 values.
BUG=chromium:625547

Review-Url: https://codereview.chromium.org/2115413002
Cr-Commit-Position: refs/heads/master@{#37495}
2016-07-04 09:59:26 +00:00
jarin
9fdacb9e55 [turbofan] Better handling of empty type in simplified lowering.
The re-typer now only types a node if its inputs are all typed with the
exception of phi nodes. This works because all cycles in the graph have
to contain a phi node.

BUG=chromium:625558

Review-Url: https://codereview.chromium.org/2120243002
Cr-Commit-Position: refs/heads/master@{#37493}
2016-07-04 08:43:12 +00:00
hablich
9c0aef52fa Revert of Amends the TypedArray constructor to use the path for primitives for all (patchset #4 id:60001 of https://codereview.chromium.org/2096873002/ )
Reason for revert:
Speculative revert to unblock roll https://codereview.chromium.org/2114113002/

Original issue's description:
> Amends the TypedArray constructor to use the path for primitives for all
> types of primitives, not just undefined, booleans, numbers, and strings.
> (The missing cases were null and Symbol.) This is required by the
> specification, and there are test262 tests which we were failing due to
> this bug.
>
> BUG=v8:5124
>
> Committed: https://crrev.com/f788bd9cce19815cba746e47bb65abfe25c16208
> Committed: https://crrev.com/f772c22cd1c492aa0235a8e6012d0386146d2eb2
> Cr-Original-Commit-Position: refs/heads/master@{#37234}
> Cr-Commit-Position: refs/heads/master@{#37407}

TBR=littledan@chromium.org,bakkot@google.com
NOTREECHECKS=true
BUG=v8:5124

Review-Url: https://codereview.chromium.org/2120763002
Cr-Commit-Position: refs/heads/master@{#37487}
2016-07-02 14:53:11 +00:00
caitpotter88
cd9e5f30ea [builtins] make AsyncFunction constructor a subclass of Function
Corrects a small problem with the current implementation of the AsyncFunction
constructor.

See https://tc39.github.io/ecmascript-asyncawait/#async-function-constructor for
details.

BUG=v8:4483
R=littledan@chromium.org, adamk@chromium.org, jwolfe@igalia.com

Review-Url: https://codereview.chromium.org/2118653004
Cr-Commit-Position: refs/heads/master@{#37484}
2016-07-01 22:52:40 +00:00
littledan
0ff7b4830c Implement immutable prototype chains
This patch implements "immutable prototype exotic objects" from the ECMAScript
spec, which are objects whose __proto__ cannot be changed, but are not otherwise
frozen. They are introduced in order to prevent a Proxy from being introduced
to the prototype chain of the global object.

The API is extended by a SetImmutablePrototype() call in ObjectTemplate, which
can be used to vend new immutable prototype objects. Additionally, Object.prototype
is an immutable prototype object.

In the implementation, a new bit is added to Maps to say whether the prototype is
immutable, which is read by SetPrototype. Map transitions to the immutable prototype
state are not saved in the transition tree because the main use case is just for
the prototype chain of the global object, which there will be only one of per
Context, so no need to take up the extra word for a pointer in each full transition
tree.

BUG=v8:5149

Review-Url: https://codereview.chromium.org/2108203002
Cr-Commit-Position: refs/heads/master@{#37482}
2016-07-01 19:20:11 +00:00
mstarzinger
a757a62bf5 [turbofan] Broaden checkpoint elimination on returns.
This makes the elimination of checkpoints flowing effect-wise into nodes
having the {Return} operator more permissive. We can cut out checkpoints
even when they are not wholly owned by the return. This also alleviates
a problem where TCO no longer applies.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624747
BUG=chromium:624747

Review-Url: https://codereview.chromium.org/2118793002
Cr-Commit-Position: refs/heads/master@{#37480}
2016-07-01 13:53:45 +00:00
bmeurer
9c281f2407 [turbofan] Properly lower NumberSinh, NumberCosh and NumberTanh.
R=jarin@chromium.org
BUG=chromium:625121

Review-Url: https://codereview.chromium.org/2116533004
Cr-Commit-Position: refs/heads/master@{#37479}
2016-07-01 12:53:04 +00:00
titzer
ac4fdca6c9 [wasm] Dont ship by default.
R=mstarzinger@chromium.org,bradnelson@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2118733003
Cr-Commit-Position: refs/heads/master@{#37478}
2016-07-01 11:37:47 +00:00
bmeurer
0a0fe8fb8b [builtins] Unify most of the remaining Math builtins.
Import fdlibm versions of acos, acosh, asin and asinh, which are more
precise and produce the same result across platforms (we were using
libm versions for asin and acos so far, where both speed and precision
depended on the operating system so far). Introduce appropriate TurboFan
operators for these functions and use them both for inlining and for the
generic builtin.

Also migrate the Math.imul and Math.fround builtins to TurboFan builtins
to ensure that their behavior is always exactly the same as the inlined
TurboFan version (i.e. C++ truncation semantics for double to float
don't necessarily meet the JavaScript semantics).

For completeness, also migrate Math.sign, which can even get some nice
love in TurboFan.

Drive-by-fix: Some alpha-sorting on the Math related functions, and
cleanup the list of Math intrinsics that we have to export via the
native context currently.

BUG=v8:3266,v8:3496,v8:3509,v8:3952,v8:5169,v8:5170,v8:5171,v8:5172
TBR=rossberg@chromium.org
R=franzih@chromium.org

Review-Url: https://codereview.chromium.org/2116753002
Cr-Commit-Position: refs/heads/master@{#37476}
2016-07-01 11:13:02 +00:00
mstarzinger
920bc17c97 [turbofan] Fix eager bailout point after comma expression.
This ensures no eager bailout point is emitted after a comma expression
in test context where the right-hand side omitted an eager bailout point
as well. This is to stay in sync with full-codegen.

R=jarin@chromium.org
TEST=mjsunit/regress/regress-crbug-624919
BUG=chromium:624919

Review-Url: https://codereview.chromium.org/2113893004
Cr-Commit-Position: refs/heads/master@{#37475}
2016-07-01 09:51:50 +00:00
zhengxing.li
5a2f5c128f [x87] Enable test cases which failed at know issue that x87 change sNaN to qNaN by default.
Since the workaround (CL 36697 : 22a73e0d85) for sNaN issue works, enable those test cases.

BUG=

Review-Url: https://codereview.chromium.org/2114853002
Cr-Commit-Position: refs/heads/master@{#37472}
2016-07-01 07:35:58 +00:00
bakkot
8834d5ecb5 Revert of Add errors for declarations which conflict with catch parameters. (patchset #6 id:100001 of https://codereview.chromium.org/2109733003/ )
Reason for revert:
Fuzzer claims `try {  \"\" ; } catch(x) { let x1 = [1,,], x = x; }` causes a crash.

Original issue's description:
> Add errors for declarations which conflict with catch parameters.
>
> Catch parameters are largely treated as lexical declarations in the
> block which contains their body for the purposes of early syntax errors,
> with some exceptions outlined in B.3.5. This patch introduces most of
> those errors, except those from `eval('for (var e of ...);')` inside of
> a catch with a simple parameter named 'e'.
>
> Note that annex B.3.5 allows var declarations to conflict with simple
> catch parameters, except when the variable declaration is the init of a
> for-of statement.
>
> BUG=v8:5112,v8:4231
>
> Committed: https://crrev.com/2907c726b2bb5cf20b2bec639ca9e6a521585406
> Cr-Commit-Position: refs/heads/master@{#37462}

TBR=littledan@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2112223002
Cr-Commit-Position: refs/heads/master@{#37464}
2016-07-01 04:28:57 +00:00
bakkot
2907c726b2 Add errors for declarations which conflict with catch parameters.
Catch parameters are largely treated as lexical declarations in the
block which contains their body for the purposes of early syntax errors,
with some exceptions outlined in B.3.5. This patch introduces most of
those errors, except those from `eval('for (var e of ...);')` inside of
a catch with a simple parameter named 'e'.

Note that annex B.3.5 allows var declarations to conflict with simple
catch parameters, except when the variable declaration is the init of a
for-of statement.

BUG=v8:5112,v8:4231

Review-Url: https://codereview.chromium.org/2109733003
Cr-Commit-Position: refs/heads/master@{#37462}
2016-07-01 00:01:31 +00:00
verwaest
c17b44bd3a Fix double canonicalization
This turns the blacklist back into a white-list adding all binary operations as allowed operations. The one known fix is that it forces canonicalization of the double-hole as double constant.

BUG=chromium:621147

Review-Url: https://codereview.chromium.org/2106393002
Cr-Commit-Position: refs/heads/master@{#37452}
2016-06-30 15:18:16 +00:00
littledan
34880eb3dc Revert of Put RegExp js code in strict mode (patchset #2 id:20001 of https://codereview.chromium.org/1776883005/ )
Reason for revert:
Found to break SAP Web IDE, and these semantics are not shipped in any other browser.
Revert to legacy semantics while assessing web compatibility.

BUG=chromium:624318

Original issue's description:
> Put RegExp js code in strict mode
>
> src/js/regexp.js was one of the few files that was left in sloppy
> mode. The ES2017 draft specification requires that writes to
> lastIndex throw when the property is non-writable, and test262
> tests enforce this behavior. This patch puts that file in strict
> mode.
>
> BUG=v8:4504
> R=yangguo@chromium.org
> LOG=Y
>
> Committed: https://crrev.com/80b1b2a45bbd9bf3d08e4e6516acfaaa8f438213
> Cr-Commit-Position: refs/heads/master@{#34801}

TBR=yangguo@chromium.org,adamk@chromium.org

Review-Url: https://codereview.chromium.org/2112713003
Cr-Commit-Position: refs/heads/master@{#37449}
2016-06-30 14:36:34 +00:00
franzih
203391bcc0 [builtins] Migrate Math.abs() to TurboFan builtins.
Like the other Math builtins, Math.abs() is now a TurboFan builtin.
It uses RawMachineAssembler::Float64Abs().

R=bmeurer@chromium.org
BUG=v8:5163, v8:5086
LOG=N

Review-Url: https://codereview.chromium.org/2115493002
Cr-Commit-Position: refs/heads/master@{#37433}
2016-06-30 10:27:09 +00:00
bmeurer
bbc44c2696 [intrinsics] Drop the now obsolete %_DoubleHi and %_DoubleLo intrinsics.
These are no longer used, except in tests that test these intrinsics.

R=yangguo@chromium.org

Review-Url: https://codereview.chromium.org/2114613002
Cr-Commit-Position: refs/heads/master@{#37432}
2016-06-30 10:21:13 +00:00
titzer
d249efd705 [wasm] Disassemble wasm code from script
This stores the wasm object and the function index in the script, and
adds functions to get the disassembled wasm code as well as the offset
table mapping from byte position to line and column in the disassembly
solely from the script.
This will be used to show "ui source code" in DevTools, and map raw
locations from the stack trace into this code view.

R=yangguo@chromium.org, ahaas@chromium.org, titzer@chromium.org
BUG=chromium:613110

patch from issue 2063013004 at patchset 80001 (http://crrev.com/2063013004#ps80001)

Review-Url: https://codereview.chromium.org/2105303002
Cr-Commit-Position: refs/heads/master@{#37430}
2016-06-30 09:57:07 +00:00
titzer
971731f354 [wasm] Fix receiver conversion for WASM->JS calls.
R=yangguo@chromium.org,ahaas@chromium.org
BUG=chromium:624713
LOG=Y

Review-Url: https://codereview.chromium.org/2111843002
Cr-Commit-Position: refs/heads/master@{#37428}
2016-06-30 09:41:43 +00:00
hablich
b1f7f1f4e4 Revert of Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex. (patchset #8 id:140001 of https://codereview.chromium.org/2090353003/ )
Reason for revert:
Speculative revert to unblock roll: https://codereview.chromium.org/2107223003/

Original issue's description:
> Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex.
>
> The spec was modified to relax some requirements which implementors had not been
> enforcing. Part of this process involved introducing a new abstract operation
> ToIndex, which had partial overlap with our existing semantics as well as some
> differences (most notably treating undefined as 0). Test262 tests were introduced to
> check for the new semantics, some of which we were failing. This patch amends the
> parts of our implementation corresponding to specification algorithms which use
> ToIndex to follow its semantics precisely.
>
> BUG=v8:4784,v8:5120
>
> Committed: https://crrev.com/09720349ea058d178521ec58d0a5676443a5a132
> Cr-Commit-Position: refs/heads/master@{#37406}

TBR=littledan@chromium.org,adamk@chromium.org,bakkot@google.com
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2113593002
Cr-Commit-Position: refs/heads/master@{#37417}
2016-06-30 07:39:09 +00:00
jgruber
5febc27b5d [builtins] New frame type for exits to C++ builtins
Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel;tryserver.v8:v8_linux_nosnap_dbg

Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
Review-Url: https://codereview.chromium.org/2090723005
Cr-Original-Commit-Position: refs/heads/master@{#37384}
Cr-Commit-Position: refs/heads/master@{#37416}
2016-06-30 06:58:23 +00:00
adamk
7166503f6e Do all parsing for try/catch destructuring inside the appropriate scopes
Previously, any expressions inside destructuring patterns in a catch
would be parsed in the surrounding scope, instead of in the catch's
scope. This change fixes that by entering not only the catch scope,
but also the block scope inside it.

R=neis@chromium.org
BUG=v8:5106, v8:5112

Review-Url: https://codereview.chromium.org/2110193002
Cr-Commit-Position: refs/heads/master@{#37415}
2016-06-30 06:52:13 +00:00
gdeepti
8bd1e0dc88 [wasm] Explicitly Disallow heap allocation when wasm memory references are updated
- Enable grow memory tests on 32 bit windows
 - Use handles to module JSObject instead of object pointers

R=ahaas@chromium.org, bradnelson@chromium.org

Review-Url: https://codereview.chromium.org/2105013004
Cr-Commit-Position: refs/heads/master@{#37409}
2016-06-29 23:42:42 +00:00
bakkot
f772c22cd1 Amends the TypedArray constructor to use the path for primitives for all
types of primitives, not just undefined, booleans, numbers, and strings.
(The missing cases were null and Symbol.) This is required by the
specification, and there are test262 tests which we were failing due to
this bug.

BUG=v8:5124

Committed: https://crrev.com/f788bd9cce19815cba746e47bb65abfe25c16208
Review-Url: https://codereview.chromium.org/2096873002
Cr-Original-Commit-Position: refs/heads/master@{#37234}
Cr-Commit-Position: refs/heads/master@{#37407}
2016-06-29 22:23:18 +00:00
bakkot
09720349ea Amend DataView, ArrayBuffer, and TypedArray methods to use ToIndex.
The spec was modified to relax some requirements which implementors had not been
enforcing. Part of this process involved introducing a new abstract operation
ToIndex, which had partial overlap with our existing semantics as well as some
differences (most notably treating undefined as 0). Test262 tests were introduced to
check for the new semantics, some of which we were failing. This patch amends the
parts of our implementation corresponding to specification algorithms which use
ToIndex to follow its semantics precisely.

BUG=v8:4784,v8:5120

Review-Url: https://codereview.chromium.org/2090353003
Cr-Commit-Position: refs/heads/master@{#37406}
2016-06-29 21:18:59 +00:00
bakkot
9bbba1441a Sloppy-mode function declarations in blocks are now hoisted appropriately.
In ES2016, function declarations nested in blocks are formally allowed. This was
never a part of ECMAScript, but was a common extension. Unfortunately
implementations differed in the exact semantics. Annex B.3.3 in the spec tries
to standardize the parts which are common to different implementations, but does
so with some fairly complicated semantics.

This CL addresses three issues related to annex B.3.3:
* When the outer function had a complex parameter list, no hoisting whatsoever was
  being performed.
* Hoisting was not blocked by parameters of the same name.
* Hoisting was not blocked by nested lexical declarations of the same name.

We had tests which checked for the second, but they were incorrectly passing due to
the first. This CL adds more complete tests.

BUG=v8:5151, v8:5111

Review-Url: https://codereview.chromium.org/2099623003
Cr-Commit-Position: refs/heads/master@{#37405}
2016-06-29 20:55:35 +00:00
bradnelson
b218d6448a Adding a few more owners to the wasm directory.
Mircea and Andreas have been making changes to wasm.

R=titzer@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2103793006
Cr-Commit-Position: refs/heads/master@{#37401}
2016-06-29 17:38:30 +00:00
bmeurer
5927deaaf1 Revert of [builtins] New frame type for exits to C++ builtins (patchset #5 id:80001 of https://codereview.chromium.org/2090723005/ )
Reason for revert:
Looks like this breaks on nosnap: http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug/builds/7626

Original issue's description:
> [builtins] New frame type for exits to C++ builtins
>
> Prior to this commit, calls to C++ builtins created standard exit
> frames, which are skipped when constructing JS stack traces. In order to
> show these calls on traces, we introduce a new builtin exit frame type.
>
> Builtin exit frames contain target and new.target on the stack and are
> not skipped during stack trace construction.
>
> BUG=v8:4815
> R=bmeurer@chromium.org, yangguo@chromium.org
> CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
>
> Committed: https://crrev.com/3c60c6b105f39344f93a8407f41534e5e60cf19a
> Cr-Commit-Position: refs/heads/master@{#37384}

TBR=yangguo@chromium.org,jgruber@chromium.org
# Skipping CQ checks because original CL landed less than 1 days ago.
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4815

Review-Url: https://codereview.chromium.org/2106113002
Cr-Commit-Position: refs/heads/master@{#37394}
2016-06-29 12:39:36 +00:00
bmeurer
89c9fc73be [turbofan] Fix non-termination in RedundancyElimination.
A pointer comparison on the effect path states is not sufficient to
guarantee termination; we really need to check the actual nodes to
make sure we terminate properly, similar to what BranchElimination
does.

R=jarin@chromium.org
BUG=v8:5161

Review-Url: https://codereview.chromium.org/2112463002
Cr-Commit-Position: refs/heads/master@{#37389}
2016-06-29 11:58:03 +00:00
jgruber
3c60c6b105 [builtins] New frame type for exits to C++ builtins
Prior to this commit, calls to C++ builtins created standard exit
frames, which are skipped when constructing JS stack traces. In order to
show these calls on traces, we introduce a new builtin exit frame type.

Builtin exit frames contain target and new.target on the stack and are
not skipped during stack trace construction.

BUG=v8:4815
R=bmeurer@chromium.org, yangguo@chromium.org
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel

Review-Url: https://codereview.chromium.org/2090723005
Cr-Commit-Position: refs/heads/master@{#37384}
2016-06-29 11:10:27 +00:00
titzer
2f8ed90582 [wasm] Enable wasm frame inspection for debugging
This changes many interfaces to accept StandardFrames instead of
JavaScriptFrames, and use the StackTraceFrameIterator instead of the
JavaScriptFrameIterator.
Also, the detailed frame information array now contains the script in
addition to the function, as wasm frames are not associated to any
javascript function.

This is a rebase of (https://codereview.chromium.org/2069823003/), since clemensh's internship has ended.

R=yangguo@chromium.org,ahaas@chromium.org
BUG=

Review-Url: https://codereview.chromium.org/2109093003
Cr-Commit-Position: refs/heads/master@{#37379}
2016-06-29 10:23:09 +00:00
neis
f96be554b9 Fix order of conversions in String.prototype.substr.
The start argument must be converted to an integer before the length argument is
converted.  (Consequently, the start argument is converted even when the length
is 0.)  This matters because conversion is observable.

Also rewrite the function in a way that closely resembles the spec text.

R=littledan@chromium.org
BUG=v8:5140

Review-Url: https://codereview.chromium.org/2109583002
Cr-Commit-Position: refs/heads/master@{#37378}
2016-06-29 09:53:48 +00:00
hpayer
46a365faae [heap] Reland uncommit unused large object page memory.
BUG=

Review-Url: https://codereview.chromium.org/2109943003
Cr-Commit-Position: refs/heads/master@{#37376}
2016-06-29 09:38:45 +00:00
neis
40641fbc03 [regexp] Fix writing of lastIndex in JSRegExp::Initialize.
The lastIndex property must be written with the semantics of a strict [[Set]],
so an exception must be thrown when the attributes don't allow writing.  We used
to ignore the attributes.

R=littledan@chromium.org, yangguo@chromium.org
BUG=v8:5138

Review-Url: https://codereview.chromium.org/2109593002
Cr-Commit-Position: refs/heads/master@{#37369}
2016-06-29 08:48:03 +00:00
machenbach
33452e7a05 [test] Skip flaky tests with turbofan
BUG=v8:5161
NOTRY=true
TBR=bmeurer@chromium.org

Review-Url: https://codereview.chromium.org/2107113002
Cr-Commit-Position: refs/heads/master@{#37362}
2016-06-29 07:21:10 +00:00
jwolfe
1ac0965542 Allow trailing commas in function parameter lists
Add a flag harmony_trailing_commas_in_parameters that allows trailing
commas in function parameter declaration lists and function call
parameter lists. Trailing commas are allowed in parenthetical lists like
`(a, b, c,)` only if the next token is `=>`, thereby making it an arrow
function declaration. Only 1 trailing comma is allowed, not `(a,,)`. A
trailing comma must follow a non-rest parameter, so `(,)` and `(...a,)`
are still SyntaxErrors. However, a trailing comma is allowed after a
spread parameter, e.g. `a(...b,);`.

Add parser tests for all of the above.

BUG=v8:5051
LOG=y

Review-Url: https://codereview.chromium.org/2094463002
Cr-Commit-Position: refs/heads/master@{#37355}
2016-06-29 01:39:10 +00:00