mstarzinger [Wed, 19 Aug 2015 16:09:40 +0000 (09:09 -0700)]
[heap] Remove obsolete Heap::sweep_generation field.
R=mlippautz@chromium.org
Review URL: https://codereview.chromium.org/
1289963006
Cr-Commit-Position: refs/heads/master@{#30253}
mlippautz [Wed, 19 Aug 2015 15:38:44 +0000 (08:38 -0700)]
[heap] Fix comment in tracer.
BUG=
Review URL: https://codereview.chromium.org/
1292583004
Cr-Commit-Position: refs/heads/master@{#30252}
yangguo [Wed, 19 Aug 2015 14:29:35 +0000 (07:29 -0700)]
Do not compact weak fixed array when re-allocating new backing store.
JSObject::UnregisterPrototypeUser relies on the index of the weak
fixed array entry not to change.
See commit
1e65e2018.
There is no bug currently, because we would only re-allocate if there is no empty slot left. In which case there is no actual compaction going on during re-allocation.
R=jkummerow@chromium.org, mvstanton@chromium.org
Review URL: https://codereview.chromium.org/
1294883004
Cr-Commit-Position: refs/heads/master@{#30251}
mvstanton [Wed, 19 Aug 2015 13:51:19 +0000 (06:51 -0700)]
Cleanup: Remove unncessary leave_frame parameter from stub cache.
BUG=
Review URL: https://codereview.chromium.org/
1299213002
Cr-Commit-Position: refs/heads/master@{#30250}
jarin [Wed, 19 Aug 2015 12:50:03 +0000 (05:50 -0700)]
Fix variable decl register collision on ARM.
BUG=chromium:455207
LOG=n
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/
1040703003
Cr-Commit-Position: refs/heads/master@{#30249}
yangguo [Wed, 19 Aug 2015 12:48:57 +0000 (05:48 -0700)]
Native context: install JS builtins via container object.
Instead of installing them on the JS builtins object and later
grab them from there.
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/
1296163003
Cr-Commit-Position: refs/heads/master@{#30248}
mstarzinger [Wed, 19 Aug 2015 12:47:49 +0000 (05:47 -0700)]
Realize IWYU pattern for fdlibm.cc file.
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/
1292753004
Cr-Commit-Position: refs/heads/master@{#30247}
yangguo [Wed, 19 Aug 2015 11:30:21 +0000 (04:30 -0700)]
Native context: do not hold onto helper functions on the utils object.
This is to avoid holding onto the function context of prologue.js.
R=cbruni@chromium.org
Review URL: https://codereview.chromium.org/
1285133009
Cr-Commit-Position: refs/heads/master@{#30246}
yangguo [Wed, 19 Aug 2015 10:03:32 +0000 (03:03 -0700)]
Ignore test failure for mjsunit/for-in-opt in gc stress.
TBR=hablich@chromium.org
BUG=v8:4381
Review URL: https://codereview.chromium.org/
1295513004
Cr-Commit-Position: refs/heads/master@{#30245}
yangguo [Wed, 19 Aug 2015 08:34:21 +0000 (01:34 -0700)]
Native context: debug.js does not load from js builtins object anymore.
This mainly changes how we share ToBoolean, ToNumber and ToString between
native scripts. Instead of putting them on the js builtins object, we now
explicitly export and import those functions.
I also had to change the import/export mechanism slightly. Previously,
exports and imports are hooked up after all native scripts have been
executed. This means that imported functions cannot be called at the time
the native script is executed.
However, since ToBoolean (and also e.g. ObjectDefineProperties) is called
in v8natives.js, I changed the mechanism so that exports from previous
native scripts (runtime.js for ToBoolean) is imported immediately and can
be called.
R=cbruni@chromium.org
Review URL: https://codereview.chromium.org/
1302533002
Cr-Commit-Position: refs/heads/master@{#30244}
jkummerow [Wed, 19 Aug 2015 06:30:41 +0000 (23:30 -0700)]
[API] Check for NULL external data pointer in ArrayBuffer::New()
Embedders must not provide invalid pointers for external backing stores.
BUG=chromium:522128
LOG=n
R=cbruni@chromium.org
Review URL: https://codereview.chromium.org/
1289373004
Cr-Commit-Position: refs/heads/master@{#30243}
v8-autoroll [Wed, 19 Aug 2015 03:24:16 +0000 (20:24 -0700)]
Update V8 DEPS.
Rolling v8/third_party/android_tools to
9e9b6169a098bc19986e44fbbf65e4c29031e4bd
TBR=machenbach@chromium.org
Review URL: https://codereview.chromium.org/
1303573003
Cr-Commit-Position: refs/heads/master@{#30242}
chunyang.dai [Wed, 19 Aug 2015 03:18:48 +0000 (20:18 -0700)]
X87: [simd.js] Single SIMD128_VALUE_TYPE for all Simd128Values.
port
f4c079d450a5990639b295d40a3d1663d70412d6 (r30107).
original commit message:
There's no need to have one InstanceType per SIMD primitive type (this
will not scale long-term). Also reduce the amount of code duplication
and make it more robust wrt adding new SIMD types.
BUG=
Review URL: https://codereview.chromium.org/
1286313003
Cr-Commit-Position: refs/heads/master@{#30241}
ejcaruso [Wed, 19 Aug 2015 01:32:56 +0000 (18:32 -0700)]
Only evaluate length once in %TypedArray%.prototype.set
The ES6 spec for this function declares that ToLength
should only be called once. We were evaluating it multiple
times, so if length was an object with a valueOf method,
we could see effects take place multiple times.
R=littledan@chromium.org
LOG=N
BUG=v8:4218
Review URL: https://codereview.chromium.org/
1237583005
Cr-Commit-Position: refs/heads/master@{#30240}
bbudge [Tue, 18 Aug 2015 20:39:43 +0000 (13:39 -0700)]
[simd.js] Macro-ize more SIMD code.
Use macros for SIMD get/set_lane, and print fns.
LOG=N
BUG=v8:4124
Review URL: https://codereview.chromium.org/
1302513004
Cr-Commit-Position: refs/heads/master@{#30239}
Ben Smith [Tue, 18 Aug 2015 18:55:44 +0000 (11:55 -0700)]
Disable regress-crbug-518748 on ARM
BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n
Review URL: https://codereview.chromium.org/
1290683004 .
Cr-Commit-Position: refs/heads/master@{#30238}
Ben L. Titzer [Tue, 18 Aug 2015 18:51:20 +0000 (20:51 +0200)]
[test] Silence array bounds warning. GCC, I think you are wrong in this case.
TBR=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1295323003 .
Cr-Commit-Position: refs/heads/master@{#30237}
bradnelson [Tue, 18 Aug 2015 18:25:18 +0000 (11:25 -0700)]
Add a makefile option for wasm prototype.
Adding wasm=on when invoking make will build with the wasm prototype, Ex:
make x64.debug wasm=on V=1
BUG=None
TEST=manual
R=titzer@chromium.org,ncbray@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/
1293073004
Cr-Commit-Position: refs/heads/master@{#30236}
titzer [Tue, 18 Aug 2015 18:21:57 +0000 (11:21 -0700)]
[turbofan] Fix stack->stack double moves for pushing on ia32 and x64.
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1299023002
Cr-Commit-Position: refs/heads/master@{#30235}
mstarzinger [Tue, 18 Aug 2015 18:18:11 +0000 (11:18 -0700)]
Remove empty string-search.cc file.
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/
1295333002
Cr-Commit-Position: refs/heads/master@{#30234}
Ben Smith [Tue, 18 Aug 2015 18:16:18 +0000 (11:16 -0700)]
Disable regress-crbug-518748 on debug
Seems to fail only on V8 Linux - debug - code serializer
(See http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20debug%20-%20code%20serializer/builds/3762)
BUG=chromium:518748
TBR=mstarzinger@chromium.org
LOG=n
Review URL: https://codereview.chromium.org/
1294163003 .
Cr-Commit-Position: refs/heads/master@{#30233}
mstarzinger [Tue, 18 Aug 2015 17:55:19 +0000 (10:55 -0700)]
Remove grab-bag includes of v8.h from runtime entries.
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/
1293053004
Cr-Commit-Position: refs/heads/master@{#30232}
Ben Smith [Tue, 18 Aug 2015 17:30:57 +0000 (10:30 -0700)]
[d8] Fix compile failure due to kMaxWorkers
TBR=adamk@chromium.org
Review URL: https://codereview.chromium.org/
1302593002 .
Cr-Commit-Position: refs/heads/master@{#30231}
binji [Tue, 18 Aug 2015 17:12:03 +0000 (10:12 -0700)]
[d8 Workers] Add max worker count, throw an exception if too many.
BUG=chromium:518748
R=mstarzinger@chromium.org
LOG=n
Review URL: https://codereview.chromium.org/
1284683004
Cr-Commit-Position: refs/heads/master@{#30230}
binji [Tue, 18 Aug 2015 16:47:19 +0000 (09:47 -0700)]
[d8] Fix flakiness when calling quit() with isolates
Don't use exit(), use Shell::Exit() (which calls _exit() instead). This won't
run C++ static destructors, atexit() functions, etc., which can occasionally
cause flaky failures.
BUG=v8:4279
R=machenbach@chromium.org
LOG=n
Review URL: https://codereview.chromium.org/
1294913005
Cr-Commit-Position: refs/heads/master@{#30229}
mstarzinger [Tue, 18 Aug 2015 16:41:02 +0000 (09:41 -0700)]
Add presubmit check for header inclusion violation.
This warns about include directives of inline headers within normal
header files. Note that this warning should not close the tree or
prevent the CQ from landing the patch.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1293273005
Cr-Commit-Position: refs/heads/master@{#30228}
mstarzinger [Tue, 18 Aug 2015 16:21:31 +0000 (09:21 -0700)]
Make heap.h usable without objects-inl.h header.
This CL us a pure refactoring that makes an empty compilation unit
including just "heap.h" but not "objects-inl.h" compile without
warnings or errors. This is needed to further reduce the header
dependency tangle.
R=mlippautz@chromium.org
Review URL: https://codereview.chromium.org/
1301583003
Cr-Commit-Position: refs/heads/master@{#30227}
rmcilroy [Tue, 18 Aug 2015 15:29:21 +0000 (08:29 -0700)]
[Interpreter] Add implementations for load immediate bytecodes.
Adds implementations and tests for the following bytecodes:
- LdaZero
- LdaSmi8
- LdaUndefined
- LdaNull
- LdaTheHole
- LdaTrue
- LdaFalse
- LdaLdar
- LdaStar
Also adds Smi tagging / untagging and OperandType typed
BytecodeOperand operations to InterpreterAssembler.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1294793002
Cr-Commit-Position: refs/heads/master@{#30226}
bradnelson [Tue, 18 Aug 2015 15:04:02 +0000 (08:04 -0700)]
Allowing optional build of a WASM prototype behind a gyp define.
Place a copy of the v8-native-prototype in third_party/wasm.
GYP_DEFINES='v8_wasm=1' gclient runhooks
BUG=None
TEST=None
R=titzer@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/
1294543006
Cr-Commit-Position: refs/heads/master@{#30225}
danno [Tue, 18 Aug 2015 14:47:56 +0000 (07:47 -0700)]
[turbofan] Unify referencing of stack slots
Previously, it was not possible to specify StackSlotOperands for all
slots in both the caller and callee stacks. Specifically, the region
of the callee's stack including the saved return address, frame
pointer, function pointer and context pointer could not be addressed
by the register allocator/gap resolver.
In preparation for better tail call support, which will use the gap
resolver to reconcile outgoing parameters, this change makes it
possible to address all slots on the stack, because slots in the
previously inaccessible dead zone may become parameter slots for
outgoing tail calls. All caller stack slots are accessible as they
were before, with slot -1 corresponding to the last stack
parameter. Stack slot indices >= 0 access the callee stack, with slot
0 corresponding to the callee's saved return address, 1 corresponding
to the saved frame pointer, 2 corresponding to the current function
context, 3 corresponding to the frame marker/JSFunction, and slots 4
and above corresponding to spill slots.
The following changes were specifically needed:
* Frame has been changed to explicitly manage three areas of the
callee frame, the fixed header, the spill slot area, and the
callee-saved register area.
* Conversions from stack slot indices to fp offsets all now go through
a common bottleneck: OptimizedFrame::StackSlotOffsetRelativeToFp
* The generation of deoptimization translation tables has been changed
to support the new stack slot indexing scheme. Crankshaft, which
doesn't support the new slot numbering in its register allocator,
must adapt the indexes when creating translation tables.
* Callee-saved parameters are now kept below spill slots, not above,
to support saving only the optimal set of used registers, which is
only known after register allocation is finished and spill slots
have been allocated.
Review URL: https://codereview.chromium.org/
1261923007
Cr-Commit-Position: refs/heads/master@{#30224}
yangguo [Tue, 18 Aug 2015 14:35:59 +0000 (07:35 -0700)]
Skip regress-4279 for --isolates tests.
R=hablich@chromium.org
BUG=v8:4378
LOG=N
Review URL: https://codereview.chromium.org/
1290383004
Cr-Commit-Position: refs/heads/master@{#30223}
mstarzinger [Tue, 18 Aug 2015 14:31:26 +0000 (07:31 -0700)]
Remove inline header includes from natives.h header.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/
1303463002
Cr-Commit-Position: refs/heads/master@{#30222}
oth [Tue, 18 Aug 2015 13:46:43 +0000 (06:46 -0700)]
[Interpreter] Minimal bytecode generator.
Bytecode generator for local assignment and basic binary operations.
Command-line flag for printing bytecodes.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1294543002
Cr-Commit-Position: refs/heads/master@{#30221}
yangguo [Tue, 18 Aug 2015 13:08:05 +0000 (06:08 -0700)]
Native context: Fix issue when running prologue.js before runtime.js
%InstallFunctionsFromArray is not entirely equivalent to the old
InstallFunctions implementation, which causes gc stress failures.
TBR=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/
1287203006
Cr-Commit-Position: refs/heads/master@{#30220}
rmcilroy [Tue, 18 Aug 2015 12:41:41 +0000 (05:41 -0700)]
[interpreter]: Changes to interpreter builtins for accumulator and register file registers.
Makes the following modifications to the interpreter builtins and
InterpreterAssembler:
- Adds an accumulator register and initializes it to undefined()
- Adds a register file pointer register and use it instead of FramePointer to
access registers
- Modifies builtin to support functions with 0 regiters in the register file
- Modifies builtin to Call rather than TailCall to first bytecode handler.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1289863003
Cr-Commit-Position: refs/heads/master@{#30219}
mlippautz [Tue, 18 Aug 2015 12:03:45 +0000 (05:03 -0700)]
[api,heap] Fix external GC callbacks.
* Add types to properly report what has been executed in the GC
* Unify GCPrologueCallback and GCEpilogueCallback into GCCallback
* Report processing of second round weak handels, either synchronously or asynchronously
BUG=chromium:521946
LOG=N
Review URL: https://codereview.chromium.org/
1298113003
Cr-Commit-Position: refs/heads/master@{#30218}
yangguo [Tue, 18 Aug 2015 11:15:34 +0000 (04:15 -0700)]
Native context: run prologue.js before runtime.js
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/
1294803004
Cr-Commit-Position: refs/heads/master@{#30217}
yangguo [Tue, 18 Aug 2015 11:14:26 +0000 (04:14 -0700)]
Skip regress-crbug-501711 for --isolates tests.
TBR=hablich@chromium.org
BUG=v8:4378
LOG=N
Review URL: https://codereview.chromium.org/
1295813006
Cr-Commit-Position: refs/heads/master@{#30216}
yangguo [Tue, 18 Aug 2015 09:55:40 +0000 (02:55 -0700)]
Reland of move property loads from js builtins objects from runtime. (patchset #1 id:1 of https://codereview.chromium.org/
1297803003/ )
Reason for revert:
Debug isolate failure has nothing to do with this CL.
Original issue's description:
> Revert of Remove property loads from js builtins objects from runtime. (patchset #2 id:20001 of https://codereview.chromium.org/
1293113002/ )
>
> Reason for revert:
> Still failures in debug-isolates tests
>
> Original issue's description:
> > Remove property loads from js builtins objects from runtime.
> >
> > R=cbruni@chromium.org
> >
> > Committed: https://crrev.com/
40f6e80d22d2e146b781aa661b76087ab9a492c4
> > Cr-Commit-Position: refs/heads/master@{#30199}
> >
> > Committed: https://crrev.com/
f22d0f205031054a5f3116e052c81ae85741e8e0
> > Cr-Commit-Position: refs/heads/master@{#30209}
>
> TBR=cbruni@chromium.org,hpayer@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
>
> Committed: https://crrev.com/
4106a4cbb701b5fe7d0b639e28a4ebfca5c05630
> Cr-Commit-Position: refs/heads/master@{#30213}
TBR=cbruni@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/
1298733003
Cr-Commit-Position: refs/heads/master@{#30215}
Djordje.Pesic [Tue, 18 Aug 2015 09:38:33 +0000 (02:38 -0700)]
MIPS: Fix bug in disassembler for JALR
Adding missing rd register in JALR disassembly, for mips and mipps64
Review URL: https://codereview.chromium.org/
1297183002
Cr-Commit-Position: refs/heads/master@{#30214}
yangguo [Tue, 18 Aug 2015 09:37:25 +0000 (02:37 -0700)]
Revert of Remove property loads from js builtins objects from runtime. (patchset #2 id:20001 of https://codereview.chromium.org/
1293113002/ )
Reason for revert:
Still failures in debug-isolates tests
Original issue's description:
> Remove property loads from js builtins objects from runtime.
>
> R=cbruni@chromium.org
>
> Committed: https://crrev.com/
40f6e80d22d2e146b781aa661b76087ab9a492c4
> Cr-Commit-Position: refs/heads/master@{#30199}
>
> Committed: https://crrev.com/
f22d0f205031054a5f3116e052c81ae85741e8e0
> Cr-Commit-Position: refs/heads/master@{#30209}
TBR=cbruni@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/
1297803003
Cr-Commit-Position: refs/heads/master@{#30213}
jarin [Tue, 18 Aug 2015 09:10:19 +0000 (02:10 -0700)]
[turbofan] Remove the output_index field that was unused in Node::Use.
BUG=
Review URL: https://codereview.chromium.org/
1294913003
Cr-Commit-Position: refs/heads/master@{#30212}
hpayer [Tue, 18 Aug 2015 09:02:27 +0000 (02:02 -0700)]
Only evacuation candidate pages have a slots buffer, just visit these pages when filtering slots.
BUG=
Review URL: https://codereview.chromium.org/
1299623003
Cr-Commit-Position: refs/heads/master@{#30211}
yangguo [Tue, 18 Aug 2015 07:53:45 +0000 (00:53 -0700)]
Reenable code recompilation verification.
BUG=chromium:516304
LOG=N
Review URL: https://codereview.chromium.org/
1267953002
Cr-Commit-Position: refs/heads/master@{#30210}
yangguo [Tue, 18 Aug 2015 07:48:13 +0000 (00:48 -0700)]
Remove property loads from js builtins objects from runtime.
R=cbruni@chromium.org
Committed: https://crrev.com/
40f6e80d22d2e146b781aa661b76087ab9a492c4
Cr-Commit-Position: refs/heads/master@{#30199}
Review URL: https://codereview.chromium.org/
1293113002
Cr-Commit-Position: refs/heads/master@{#30209}
v8-autoroll [Tue, 18 Aug 2015 03:24:59 +0000 (20:24 -0700)]
Update V8 DEPS.
Rolling v8/third_party/icu to
89dcdec16381883782b9cc9cff38e00f047a0f46
Rolling v8/tools/clang to
5b12e334ec0e571a8e1f68d028dc5427b58c17ec
TBR=machenbach@chromium.org
Review URL: https://codereview.chromium.org/
1294523005
Cr-Commit-Position: refs/heads/master@{#30208}
Adam Klein [Mon, 17 Aug 2015 21:46:44 +0000 (14:46 -0700)]
Point @@isConcatSpreadable test failure line at the correct bug
BUG=v8:4317
LOG=n
TBR=littledan@chromium.org
Review URL: https://codereview.chromium.org/
1285983004 .
Cr-Commit-Position: refs/heads/master@{#30207}
bbudge [Mon, 17 Aug 2015 18:58:38 +0000 (11:58 -0700)]
[simd.js] Macro-ize more SIMD code.
Use macros for factory functions, and in hydrogen code stubs.
LOG=N
BUG=v8:4124
Review URL: https://codereview.chromium.org/
1293533003
Cr-Commit-Position: refs/heads/master@{#30206}
hpayer [Mon, 17 Aug 2015 18:25:11 +0000 (11:25 -0700)]
Revert "Regularly check hash set addresses to verify memory integrity."
This debug check is not needed anymore.
This reverts commit
ce311ed00123be1ffefdfbee39bd67cec63599ed.
BUG=
Review URL: https://codereview.chromium.org/
1300663002
Cr-Commit-Position: refs/heads/master@{#30205}
mlippautz [Mon, 17 Aug 2015 18:19:43 +0000 (11:19 -0700)]
[heap] Get rid of unused regexp includes.
BUG=
Review URL: https://codereview.chromium.org/
1290403002
Cr-Commit-Position: refs/heads/master@{#30204}
titzer [Mon, 17 Aug 2015 17:35:40 +0000 (10:35 -0700)]
[turbofan] Support unboxed float and double stack parameters and add tests.
R=jarin@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1291113003
Cr-Commit-Position: refs/heads/master@{#30203}
mstarzinger [Mon, 17 Aug 2015 16:58:16 +0000 (09:58 -0700)]
[heap] Unify MarkingDeque push and unshift operations.
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/
1294093003
Cr-Commit-Position: refs/heads/master@{#30202}
hablich [Mon, 17 Aug 2015 15:31:46 +0000 (08:31 -0700)]
Revert of Remove property loads from js builtins objects from runtime. (patchset #1 id:1 of https://codereview.chromium.org/
1293113002/ )
Reason for revert:
Reverting because it made the waterfall red http://build.chromium.org/p/client.v8/builders/V8%20Win32%20-%20nosnap%20-%20shared/builds/8390
Original issue's description:
> Remove property loads from js builtins objects from runtime.
>
> R=cbruni@chromium.org
>
> Committed: https://crrev.com/
40f6e80d22d2e146b781aa661b76087ab9a492c4
> Cr-Commit-Position: refs/heads/master@{#30199}
TBR=cbruni@chromium.org,yangguo@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/
1294123002
Cr-Commit-Position: refs/heads/master@{#30201}
hpayer [Mon, 17 Aug 2015 15:24:13 +0000 (08:24 -0700)]
Filter out slot buffer slots, that point to SMIs in dead objects.
The following situation may happen which reproduces this bug:
(1) We allocate JSObject A on an evacuation candidate.
(2) We allocate JSObject B on a non-evacuation candidate.
(3) Incremental marking starts and marks object A and B.
(4) We create a reference from B.field = A; which records the slot B.field since A is on an evacuation candidate.
(5) After that we write a SMI into B.field.
(6) After that B goes into dictionary mode and shrinks its original size. B.field is now outside of the JSObject, i.e B.field is in memory that will be freed by the sweeper threads.
(7) GC is triggered.
(8) BUG: Slots buffer filtering walks over the slots buffer, SMIs are not filtered out because we assumed that SMIs are just ignored when the slots get updated later. However, recorded SMI slots of dead objects may be overwritten by double values at evacuation time.
(9) During evacuation, a heap number that looks like a valid pointer is moved over B.field.
(10) The slots buffer is scanned for updates, follows B.field since it looks like a pointer (the double value looks like a pointer), and crashes.
BUG=chromium:519577,chromium:454297
LOG=y
Review URL: https://codereview.chromium.org/
1286343004
Cr-Commit-Position: refs/heads/master@{#30200}
yangguo [Mon, 17 Aug 2015 15:08:20 +0000 (08:08 -0700)]
Remove property loads from js builtins objects from runtime.
R=cbruni@chromium.org
Review URL: https://codereview.chromium.org/
1293113002
Cr-Commit-Position: refs/heads/master@{#30199}
vogelheim [Mon, 17 Aug 2015 13:59:40 +0000 (06:59 -0700)]
Default-enable external startup snapshot for, like, everywhere.
BUG=
Review URL: https://codereview.chromium.org/
1209223005
Cr-Commit-Position: refs/heads/master@{#30198}
titzer [Mon, 17 Aug 2015 13:56:11 +0000 (06:56 -0700)]
[turbofan] Handle void return in simplified-lowering.cc.
R=jarin@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1296933002
Cr-Commit-Position: refs/heads/master@{#30197}
jkummerow [Mon, 17 Aug 2015 13:26:28 +0000 (06:26 -0700)]
[test] Remove FLAG_always_opt special case in NotifyDeoptimized
Always unlink optimized code on deopt, even when FLAG_always_opt is present, because assumptions that the code made could have become invalid.
BUG=v8:4375
LOG=n
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/
1284103006
Cr-Commit-Position: refs/heads/master@{#30196}
mstarzinger [Mon, 17 Aug 2015 13:13:32 +0000 (06:13 -0700)]
Remove grab-bag includes of v8.h from heap.
R=mlippautz@chromium.org
Review URL: https://codereview.chromium.org/
1291833003
Cr-Commit-Position: refs/heads/master@{#30195}
mstarzinger [Mon, 17 Aug 2015 13:09:29 +0000 (06:09 -0700)]
[heap] Simplify MarkingDeque implementation.
This removes the dependency of the MarkingDeque on the underlying
collector by moving out the live bytes accounting and object color
mutations into a wrapper. The MarkingDeque can now be split into a
separate file.
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/
1293773002
Cr-Commit-Position: refs/heads/master@{#30194}
danno [Mon, 17 Aug 2015 12:43:59 +0000 (05:43 -0700)]
[turbofan]: Fix bug in register hinting
Previously, UsePositions for Phis that are constant LiveRanges which are also used
as hints for other USePositions would always force-allocate the first register in
the allocatable register file to that range.
Review URL: https://codereview.chromium.org/
1289313003
Cr-Commit-Position: refs/heads/master@{#30193}
rossberg [Mon, 17 Aug 2015 12:01:55 +0000 (05:01 -0700)]
[es6] Implement default parameters
Based on caitp's https://codereview.chromium.org/
1127063003/
R=adamk@chromium.org, littledan@chromium.org
BUG=v8:2160
LOG=N
Review URL: https://codereview.chromium.org/
1287063004
Cr-Commit-Position: refs/heads/master@{#30192}
jianghua.yjh [Mon, 17 Aug 2015 11:30:30 +0000 (04:30 -0700)]
fix StrDup memory leak in CcTest
BUG=
Review URL: https://codereview.chromium.org/
1287023002
Cr-Commit-Position: refs/heads/master@{#30191}
rmcilroy [Mon, 17 Aug 2015 11:24:34 +0000 (04:24 -0700)]
[Interpreter] Move interpreter initialization until after snapshot deserialization.
The interpreter needs to be initialized after the snapshot has been deserialized.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1290883004
Cr-Commit-Position: refs/heads/master@{#30190}
yangguo [Mon, 17 Aug 2015 11:02:31 +0000 (04:02 -0700)]
Do not use js builtins object when constructing an error.
R=cbruni@chromium.org
Review URL: https://codereview.chromium.org/
1295093002
Cr-Commit-Position: refs/heads/master@{#30189}
yangguo [Mon, 17 Aug 2015 11:00:43 +0000 (04:00 -0700)]
Add DCHECK that the script context table do not contain native scripts.
This is to prevent unnecessary script contexts to be created for
native scripts, which could end up with a script context table
containing twenty script contexts for a newly created native context.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1301533002
Cr-Commit-Position: refs/heads/master@{#30188}
mstarzinger [Mon, 17 Aug 2015 09:42:26 +0000 (02:42 -0700)]
Remove grab-bag includes of v8.h from architecture ports.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/
1299563003
Cr-Commit-Position: refs/heads/master@{#30187}
bmeurer [Mon, 17 Aug 2015 08:01:55 +0000 (01:01 -0700)]
[runtime] Unify and fix the strict equality comparison.
Add Object::StrictEquals to unify the implementation of strict equality
comparison in the runtime and the api (the api was already missing a
case for SIMD). Now we (almost) have a single bottleneck for strict
equality, we just need to reduce the amount of unnecessary complexity
for the code stub.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/
1298603002
Cr-Commit-Position: refs/heads/master@{#30186}
chunyang.dai [Mon, 17 Aug 2015 00:40:28 +0000 (17:40 -0700)]
X87: Realize IWYU pattern for frames-inl.h header.
port
19a49abf02dfac722dc8c5079aba9d73fcd60725 (r30127).
original commit message:
BUG=
Review URL: https://codereview.chromium.org/
1286143009
Cr-Commit-Position: refs/heads/master@{#30185}
caitpotter88 [Sat, 15 Aug 2015 17:57:01 +0000 (10:57 -0700)]
[parser] make kInvalidLhsInFor a SyntaxError
Second item in section 13.7.5.1 states that the error should be a
SyntaxError, when previously CheckAndRewriteReferenceExpression
would always emit a ReferenceError.
BUG=v8:4373
R=adamk, rossberg
LOG=N
CQ_INCLUDE_TRYBOTS=tryserver.chromium.linux:linux_chromium_rel_ng;tryserver.blink:linux_blink_rel
Review URL: https://codereview.chromium.org/
1292393002
Cr-Commit-Position: refs/heads/master@{#30184}
domenic [Fri, 14 Aug 2015 18:47:46 +0000 (11:47 -0700)]
Put V8 extras into the snapshot
Previously, all extras were "experimental" and left out of the snapshot. This
patch moves them to the snapshot, so now all extras are non-experimental. A
future patch will re-introduce experimental extras as part of the linked bug.
R=yangguo@chromium.org
BUG=https://code.google.com/p/chromium/issues/detail?id=507137
LOG=Y
Review URL: https://codereview.chromium.org/
1289603002
Cr-Commit-Position: refs/heads/master@{#30183}
chunyang.dai [Fri, 14 Aug 2015 16:02:22 +0000 (09:02 -0700)]
Add per-file OWNERS for x87-specific cctests.
BUG=
Review URL: https://codereview.chromium.org/
1290963005
Cr-Commit-Position: refs/heads/master@{#30182}
yangguo [Fri, 14 Aug 2015 15:12:34 +0000 (08:12 -0700)]
Clean up native context slots and add new ones.
Newly added native context slots are used to avoid accessing
the js builtins object to get native functions.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1294583006
Cr-Commit-Position: refs/heads/master@{#30181}
mstarzinger [Fri, 14 Aug 2015 15:09:27 +0000 (08:09 -0700)]
Remove grab-bag includes of v8.h from regexp engine.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/
1294783002
Cr-Commit-Position: refs/heads/master@{#30180}
ofrobots [Fri, 14 Aug 2015 14:51:51 +0000 (07:51 -0700)]
New flag --perf_basic_prof_only_functions
Restricts linux perf-event code range reporting to functions only (i.e. on
stubs.) While this makes the gathered ticks less accurate, it reduces the
growth of the /tmp/perf-${pid}.map file.
BUG=v8:3453
R=hablich@chromium.org,danno@chromium.org
LOG=N
Review URL: https://codereview.chromium.org/
1292743002
Cr-Commit-Position: refs/heads/master@{#30179}
mstarzinger [Fri, 14 Aug 2015 13:33:32 +0000 (06:33 -0700)]
Remove grab-bag includes of v8.h from IC subsystem.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1293793002
Cr-Commit-Position: refs/heads/master@{#30178}
jkummerow [Fri, 14 Aug 2015 13:09:36 +0000 (06:09 -0700)]
[serializer] Move WeakFixedArray compaction to separate heap walk phase
This avoids discovering and compacting the same array repeatedly. No change in resulting snapshots intended.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/
1290393002
Cr-Commit-Position: refs/heads/master@{#30177}
titzer [Fri, 14 Aug 2015 13:07:27 +0000 (06:07 -0700)]
[turbofan] Gracefully handle missing info()->context() in CodeGenerator::IsMaterializableFromFrame()
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1292233004
Cr-Commit-Position: refs/heads/master@{#30176}
yangguo [Fri, 14 Aug 2015 12:34:45 +0000 (05:34 -0700)]
Do not export natives to runtime via js builtins object.
Using a temporary container object instead.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1293493003
Cr-Commit-Position: refs/heads/master@{#30175}
vogelheim [Fri, 14 Aug 2015 12:11:29 +0000 (05:11 -0700)]
Rework startup-data-util.
- Make the API look like v8::V8::InitializeICU.
(That is: A static method call, not an object to be created on the stack.)
- Fix path separator on Windows, by calling base::OS::isPathSeparator.
- Move into API, so that it can be called by hello-world & friends.
- Actually call it from hello-world and friends.
R=jochen@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1292053002
Cr-Commit-Position: refs/heads/master@{#30174}
yangguo [Fri, 14 Aug 2015 10:22:16 +0000 (03:22 -0700)]
No longer use js builtins object as receiver for calls into JS.
This is no longer necessary. Everything the callee needs should
be in its context chain.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1289203003
Cr-Commit-Position: refs/heads/master@{#30173}
mstarzinger [Fri, 14 Aug 2015 09:41:32 +0000 (02:41 -0700)]
Remove grab-bag includes of v8.h from several files.
R=yangguo@chromium.org
Review URL: https://codereview.chromium.org/
1297583002
Cr-Commit-Position: refs/heads/master@{#30172}
mstarzinger [Fri, 14 Aug 2015 08:48:11 +0000 (01:48 -0700)]
Make some foo.h headers usable without foo-inl.h header.
This CL is a pure refactoring that makes an empty compilation unit
including just "foo.h" but not "foo-inl.h" compile without warnings or
errors. This is needed to further reduce the header dependency tangle.
This realizes above state for "spaces.h" and "mark-compact.h".
R=hpayer@chromium.org
Review URL: https://codereview.chromium.org/
1288413002
Cr-Commit-Position: refs/heads/master@{#30171}
yangguo [Fri, 14 Aug 2015 07:36:36 +0000 (00:36 -0700)]
Debugger: simplify calling into Javascript.
R=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1292533003
Cr-Commit-Position: refs/heads/master@{#30170}
v8-autoroll [Fri, 14 Aug 2015 03:25:40 +0000 (20:25 -0700)]
Update V8 DEPS.
Rolling v8/build/gyp to
6ee91ad8659871916f9aa840d42e1513befdf638
TBR=machenbach@chromium.org
Review URL: https://codereview.chromium.org/
1292633003
Cr-Commit-Position: refs/heads/master@{#30169}
adamk [Thu, 13 Aug 2015 19:10:59 +0000 (12:10 -0700)]
Align PreParser for loop early error-checking with Parser
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/
1290193003
Cr-Commit-Position: refs/heads/master@{#30168}
rossberg [Thu, 13 Aug 2015 18:36:34 +0000 (11:36 -0700)]
[es6] Remove redundant flag parameter
R=adamk@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1286133003
Cr-Commit-Position: refs/heads/master@{#30167}
adamk [Thu, 13 Aug 2015 18:06:04 +0000 (11:06 -0700)]
[es6] Make assignment to new.target an early ReferenceError
In doing so, fix calls CheckAndRewriteReferenceExpression to take proper
start and end positions (instead of just pointing at the first token in
the LHS expression).
BUG=v8:4370
LOG=n
Review URL: https://codereview.chromium.org/
1290013002
Cr-Commit-Position: refs/heads/master@{#30166}
rmcilroy [Thu, 13 Aug 2015 17:39:21 +0000 (10:39 -0700)]
[interpreter]: Fix interpreter handler table initialization.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1288893003
Cr-Commit-Position: refs/heads/master@{#30165}
mlippautz [Thu, 13 Aug 2015 17:22:47 +0000 (10:22 -0700)]
[api] Do not force external GCs when only trying to synchronously process phantom callbacks
Improves on
aec8987b5ee55fa46b90b58927e957a4e5f19c09 by not forcing external GCs
(blink) through the GC epilogue callback.
BUG=chromium:515795
LOG=N
Review URL: https://codereview.chromium.org/
1287323002
Cr-Commit-Position: refs/heads/master@{#30164}
oth [Thu, 13 Aug 2015 17:11:25 +0000 (10:11 -0700)]
[Interpreter] Register conversion fix and test.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1294523002
Cr-Commit-Position: refs/heads/master@{#30163}
yangguo [Thu, 13 Aug 2015 16:26:02 +0000 (09:26 -0700)]
Debugger: remove duplicate heap iterations.
R=mlippautz@chromium.org
Review URL: https://codereview.chromium.org/
1291043002
Cr-Commit-Position: refs/heads/master@{#30162}
mstarzinger [Thu, 13 Aug 2015 15:30:04 +0000 (08:30 -0700)]
Remove inline header includes from non-inline headers (2).
This tries to remove includes of "-inl.h" headers from normal ".h"
headers, thereby reducing the chance of any cyclic dependencies and
decreasing the average size of our compilation units.
Note that this change still leaves 5 violations of that rule in the
code. It only tackles "node.h" including "types-inl.h".
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/
1288053004
Cr-Commit-Position: refs/heads/master@{#30161}
adamk [Thu, 13 Aug 2015 15:24:30 +0000 (08:24 -0700)]
Remove old webkit Object-getOwnPropertyNames test
This test enumerates properties on all the builtins and makes sure that
they never change. In practice, this just generates busywork when trying
to add new language features; I've never seen it catch an
accidentally-exposed bit of API.
Review URL: https://codereview.chromium.org/
1275423006
Cr-Commit-Position: refs/heads/master@{#30160}
paul.lind [Thu, 13 Aug 2015 14:27:05 +0000 (07:27 -0700)]
MIPS64: Fix InterpreterEntryTrampoline().
Was incorrectly loading BytecodeArray::kFrameSizeOffset as 64-bit int.
TEST=cctest/test-interpreter/TestInterpreterReturn
BUG=
Review URL: https://codereview.chromium.org/
1286343002
Cr-Commit-Position: refs/heads/master@{#30159}
mstarzinger [Thu, 13 Aug 2015 14:02:22 +0000 (07:02 -0700)]
Make some foo.h headers usable without foo-inl.h header.
This CL us a pure refactoring that makes an empty compilation unit
including just "foo.h" but not "foo-inl.h" compile without warnings or
errors. This is needed to further reduce the header dependency tangle.
R=rossberg@chromium.org
Review URL: https://codereview.chromium.org/
1290743005
Cr-Commit-Position: refs/heads/master@{#30158}
titzer [Thu, 13 Aug 2015 13:33:04 +0000 (06:33 -0700)]
[turbofan] Propagate representation information from call descriptors in SimplifiedLowering.
R=jarin@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1292033002
Cr-Commit-Position: refs/heads/master@{#30157}
chunyang.dai [Thu, 13 Aug 2015 13:31:55 +0000 (06:31 -0700)]
X87: [compiler] Remove broken support for undetectable strings.
port
b62dbf1efdec68ae709b0e91d3b7c13171b720c9 (r30132).
original commit messge:
Support for undetectable strings was officially dropped in
https://codereview.chromium.org/
916753002, but the compilers
weren't fixed properly.
BUG=
Review URL: https://codereview.chromium.org/
1287173002
Cr-Commit-Position: refs/heads/master@{#30156}
bmeurer [Thu, 13 Aug 2015 13:06:45 +0000 (06:06 -0700)]
Revert of [runtime] Remove useless IN builtin. (patchset #2 id:20001 of https://codereview.chromium.org/
1295433002/ )
Reason for revert:
Breaks win32 nosnap
Original issue's description:
> [runtime] Remove useless IN builtin.
>
> Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
> and %HasProperty anyway, and cannot be optimized, plus it had a weird
> special fast case (which also involved at least one LOAD_IC plus some
> intrinsic magic).
>
> R=yangguo@chromium.org,jarin@chromium.org
>
> Committed: https://crrev.com/
72d60a1e80e81e2e68ca402665e2acbc46c5e471
> Cr-Commit-Position: refs/heads/master@{#30154}
TBR=yangguo@chromium.org,jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/
1288923002
Cr-Commit-Position: refs/heads/master@{#30155}
bmeurer [Thu, 13 Aug 2015 12:39:03 +0000 (05:39 -0700)]
[runtime] Remove useless IN builtin.
Similar to DELETE, the IN builtin is just a thin wrapper for %HasElement
and %HasProperty anyway, and cannot be optimized, plus it had a weird
special fast case (which also involved at least one LOAD_IC plus some
intrinsic magic).
R=yangguo@chromium.org,jarin@chromium.org
Review URL: https://codereview.chromium.org/
1295433002
Cr-Commit-Position: refs/heads/master@{#30154}