review.tizen.org Git - platform/upstream/v8.git/log

Test for wrong arguments object materialization.

The test demonstrates a bad interaction between arguments object
materialization, escape analysis and exception handling.

We can return a wrong arguments object if we materialize arguments
object (using f.arguments) and then throw around f's frame so that f
does not clean up the materialized frame information (see the
MaterializedObjectStore in deoptimizer.h/.cc). If we enter another
function that has the same frame pointer and request an arguments object
of (or lazily deoptimize) that function, we can get the materialized
object of the original function.

We should clean up the materialized object store when we unwind the
stack.

BUG=v8:3985
LOG=n

Review URL: https://codereview.chromium.org/1032623003

Cr-Commit-Position: refs/heads/master@{#27406}

[turbofan] Add RegisterAllocator::NewLiveRange() utility method.

R=dcarney@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1036433002

Cr-Commit-Position: refs/heads/master@{#27405}

Cleanups needed for this-scoping in arrow functions

Remove Variable::IsValidReference(), and the Variable::is_valid_ref_
member: This was "false" only for "this", and for internal variables.
For the first, VariableProxy::is_this() can be used for the check
instead; and for internal variables, it is guaranteed they they will
not be written to (because the V8 code does not do it, and they are
not accessible from JavaScript).

The "bool is_this" parameter of VariableProxy() constructor is
changed to use Variable::Kind. This will allow to later on adding
a parameter to create unresolved variables of any kind, which in
turn will be used to make references to "this" initially unresolved,
and use the existing variable resolution mechanics for "this".

BUG=v8:2700
LOG=N

Review URL: https://codereview.chromium.org/1024703004

Cr-Commit-Position: refs/heads/master@{#27404}

CpuProfiler: push the collected information about deopts to cpu profiler

it is the last patch of https://codereview.chromium.org/1012633002

All that we need here is to push the collected info to the profiler
and convert it into actionable information about deopt.

On the Next: get the info accessible by embedder.

BUG=chromium:452067
LOG=n
TEST=DeoptAtFirstLevelInlinedSource, DeoptAtSecondLevelInlinedSource, DeoptUntrackedFunction

Review URL: https://codereview.chromium.org/1013143003

Cr-Commit-Position: refs/heads/master@{#27403}

[es6] call ToString() on template substitutions

BUG=v8:3980
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1027183002

Cr-Commit-Position: refs/heads/master@{#27402}

[turbofan] Rename Node::RemoveAllInputs() to Node::NullAllInputs().

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1032553006

Cr-Commit-Position: refs/heads/master@{#27401}

Fix out of date assert after PropertyCell enterbung

R=verwaest@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1028393002

Cr-Commit-Position: refs/heads/master@{#27400}

If CallNew targets a constant global, set its state to monomorphic

BUG=

Review URL: https://codereview.chromium.org/1023103003

Cr-Commit-Position: refs/heads/master@{#27399}

Revert of [V8] Removed SourceLocationRestrict (patchset #3 id:40001 of https://codereview.chromium.org/1022333004/)

Reason for revert:
[Sheriff] This seems to change layout test expectations of some tests, e.g.:
http://build.chromium.org/p/client.v8/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/2317

Expectation example:
https://storage.googleapis.com/chromium-layout-test-archives/V8-Blink_Linux_64__dbg_/2317/layout-test-results/fast/events/window-onerror-11-pretty-diff.html

Please add a needsmanualrebaseline expectation to the tests affected by this change on the blink side first before relanding.

Original issue's description:
> [V8] Removed SourceLocationRestrict
>
> This method uses in messages.js in GetSourceLine and GetPositionInLine. This methods uses in v8::Message API methods and there is no documentation about it.
> Method looks obsolete.
> One of the strange side effect is shown by attached issue.
>
> BUG=chromium:468781
> R=yangguo@chromium.org
> LOG=Y
>
> Committed: https://crrev.com/b563ceac0f95551a128a1403cdbacc7aefcdabaf
> Cr-Commit-Position: refs/heads/master@{#27374}

TBR=yangguo@chromium.org,kozyatinskiy@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:468781

Review URL: https://codereview.chromium.org/1028413002

Cr-Commit-Position: refs/heads/master@{#27398}

X87: [stubs] Add missing interface descriptor for the CompareIC.

port e18e3cd4d88f35f3690d2993ac1702b65edde54f (r27305)

original commit message:

[stubs] Add missing interface descriptor for the CompareIC.

BUG=

Review URL: https://codereview.chromium.org/1024553007

Cr-Commit-Position: refs/heads/master@{#27397}

X87: Serializer: serialize internal references via object visitor.

port 7c149afb6c875b1c53723384459dc14a0e961927 (r27275).

original commit message:

Serializer: serialize internal references via object visitor.

BUG=

Review URL: https://codereview.chromium.org/1029793002

Cr-Commit-Position: refs/heads/master@{#27396}

X87: Remove PropertyCell space

port 16c8485a35efc36cf6ccd15185282d65412e1502 (r27269).

original commit message:

Replaces StoreGlobalCell / LoadGlobalCell with NamedField variants that use write barriers.

BUG=

Review URL: https://codereview.chromium.org/1013543004

Cr-Commit-Position: refs/heads/master@{#27395}

X87: Use platform specific stubs for vector-based Load/KeyedLoad.

port 34a1a76ddf30109f7b6cb60aa2651493ab38660a (r27235)

original commit message:

  A hydrogen code stub is not the best approach because it builds a frame
  and doesn't have the technology to discard roots at tail call exits.
  Platform-specific stubs provide much better performance at this point.

BUG=

Review URL: https://codereview.chromium.org/1025073005

Cr-Commit-Position: refs/heads/master@{#27394}

Revert "ARM64: use jssp for stack slots"

This reverts r21101. r21101 appears to be at fault for the ARM64
failures here: https://codereview.chromium.org/1023103003

BUG=

Review URL: https://codereview.chromium.org/1019393003

Cr-Commit-Position: refs/heads/master@{#27393}

PPC: [es6] implement Reflect.apply() & Reflect.construct()

Port d21fd15467e16f185e511dbfbaeef7caddfe804a

Original commit message:
BUG=v8:3900
LOG=N

R=mbrandy@us.ibm.com, svenpanne@chromium.org, danno@chromium.org, jkummerow@chromium.org, dslomov@chromium.org

Review URL: https://codereview.chromium.org/999613004

Cr-Commit-Position: refs/heads/master@{#27392}

PPC: [turbofan] Turn Math.clz32 into an inlinable builtin.

Port 3aa206b86560da94f895625186295bf07a0301d8

Original commit message:
R=dcarney@chromium.org, yangguo@chromium.org
BUG=v8:3952
LOG=n

R=mbrandy@us.ibm.com, svenpanne@chromium.org, danno@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1028313003

Cr-Commit-Position: refs/heads/master@{#27391}

PPC: [es6] generate rest parameters correctly for subclass constructors

commit bef80fcfd7e89cadc215f7d10a016a375e346490

Original commit message:
BUG=v8:3977
R=dslomov@chromium.org, arv@chromium.org
LOG=N

R=mbrandy@us.ibm.com, svenpanne@chromium.org, danno@chromium.org, jkummerow@chromium.org

Review URL: https://codereview.chromium.org/1018043008

Cr-Commit-Position: refs/heads/master@{#27390}

Revert of [es6] Object.getPrototypeOf should work with values (patchset #3 id:40001 of https://codereview.chromium.org/1014813003/)

Reason for revert:
Layout test failures. Please update layout test expectations before landing this, in order to not block the roll.

Original issue's description:
> [es6] Object.getPrototypeOf should work with values
>
> The final spec for Object.getPrototypeOf calls ToObject on the
> parameter, which means that it should only throw for null and
> undefined. For other non object values the prototype of the wrapper
> should be used.
>
> BUG=v8:3964
> LOG=N
> R=adamk, rossberg@chromium.org
>
> Committed: https://crrev.com/ea463a916bbe5994b0d2d04e8075058b373b2e2c
> Cr-Commit-Position: refs/heads/master@{#27354}

TBR=adamk@chromium.org,rossberg@chromium.org,arv@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:3964

Review URL: https://codereview.chromium.org/1033623002

Cr-Commit-Position: refs/heads/master@{#27389}

PPC: Serializer: serialize internal references via object visitor.

Port 7c149afb6c875b1c53723384459dc14a0e961927

Original commit message:

R=mbrandy@us.ibm.com, svenpanne@chromium.org, danno@chromium.org, jkummerow@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1029723002

Cr-Commit-Position: refs/heads/master@{#27388}

PPC: Load from PropertyCells using PropertyCell::kValueOffset rather than Cell::kValueOffset

Port dda2bd6f4f952c604ab836f04052684722480849

Original commit message:

R=mbrandy@us.ibm.com, svenpanne@chromium.org, danno@chromium.org, jkummerow@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1028323002

Cr-Commit-Position: refs/heads/master@{#27387}

Remove calls to IdleNotification()

All users should use IdleNotificationDeadline() instead

BUG=none
R=hpayer@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1028163003

Cr-Commit-Position: refs/heads/master@{#27386}

X87: Remove kind field from StackHandler.

port 15f8213809a57c2a163b500a732c9ffe5160a41a (r27263)

original commit message:

This relands commit 96f79568a926966ebcf0685bf9adc947f4e1fbff.

This makes the Isolate::Throw logic not depend on a prediction of
whether an exception is caught or uncaught. Such a prediction is
inherently undecidable because a finally block can decide between
consuming or re-throwing an exception depending on arbitray control
flow.

There still is a conservative prediction mechanism in place that
components like the debugger or tracing can use for reporting.

With this change we can get rid of the StackHandler::kind field, a
pre-requisite to do table-based lookups of exception handlers.

BUG=

Review URL: https://codereview.chromium.org/1027413002

Cr-Commit-Position: refs/heads/master@{#27385}

Save heap object tracking data in heap snapshot

Every time embedder calls v8::HeapProfiler::GetHeapStats we store next unuassigned heap object id and timestamp of the request. This patch serializes all that data into heap snapshot so that embedder can restore allocation timeline.

BUG=chromium:467222
LOG=Y

Review URL: https://codereview.chromium.org/1019813004

Cr-Commit-Position: refs/heads/master@{#27384}

MIPS64: VectorICs: keyed element loads were kicking out non-smi keys unnecessarily

Port 6689cc27ebe60685c025de9ae1f09919093f8213

Original commit message:
Handlers should be in charge of this work. The change uncovered a bug in
vector-ics related to keyed loads into strings. It's important for
StringCharCodeAtGenerator, a helper used in full code and in
LoadIndexedStringStub (a handler) to protect the vector and slot registers
when it makes a runtime call to convert a HeapNumber to a Smi.

It's still possible for the handler to MISS after this call, perhaps due
to out of bounds access. In that case, the vector and slot registers need
to be delivered safely to the MISS handler.

BUG=

Review URL: https://codereview.chromium.org/1025303005

Cr-Commit-Position: refs/heads/master@{#27383}

PPC: Disinherit PropertyCell from Cell

Port 8c0d289772649217a55011133c0e481741618330

Original commit message:

R=mbrandy@us.ibm.com, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1019843003

Cr-Commit-Position: refs/heads/master@{#27382}

PPC: Remove kind field from StackHandler.

Port 15f8213809a57c2a163b500a732c9ffe5160a41a

Original commit message:
This relands commit 96f79568a926966ebcf0685bf9adc947f4e1fbff.

This makes the Isolate::Throw logic not depend on a prediction of
whether an exception is caught or uncaught. Such a prediction is
inherently undecidable because a finally block can decide between
consuming or re-throwing an exception depending on arbitray control
flow.

There still is a conservative prediction mechanism in place that
components like the debugger or tracing can use for reporting.

With this change we can get rid of the StackHandler::kind field, a
pre-requisite to do table-based lookups of exception handlers.

R=mbrandy@us.ibm.com, yangguo@chromium.org, svenpanne@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1016333002

Cr-Commit-Position: refs/heads/master@{#27381}

PPC: Remove PropertyCell space

Port 16c8485a35efc36cf6ccd15185282d65412e1502

Original commit message:
Replaces StoreGlobalCell / LoadGlobalCell with NamedField variants that use write barriers.

R=mbrandy@us.ibm.com, svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1018333003

Cr-Commit-Position: refs/heads/master@{#27380}

Properly handle non-JSFunction constructors in CanRetainOtherContext

BUG=

Review URL: https://codereview.chromium.org/1017263003

Cr-Commit-Position: refs/heads/master@{#27379}

Move CompilationInfo::this_has_uses to HGraph::this_has_uses.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1029643002

Cr-Commit-Position: refs/heads/master@{#27378}

VectorICs: keyed element loads were kicking out non-smi keys unnecessarily

Handlers should be in charge of this work. The change uncovered a bug in
vector-ics related to keyed loads into strings. It's important for
StringCharCodeAtGenerator, a helper used in full code and in
LoadIndexedStringStub (a handler) to protect the vector and slot registers
when it makes a runtime call to convert a HeapNumber to a Smi.

It's still possible for the handler to MISS after this call, perhaps due
to out of bounds access. In that case, the vector and slot registers need
to be delivered safely to the MISS handler.

BUG=

Review URL: https://codereview.chromium.org/1028093002

Cr-Commit-Position: refs/heads/master@{#27377}

Remove dangerous constructor from CompilationInfoWithZone.

This removes the stub-based constructor from CompilationInfoWithZone
as this class is more than a pure convenience class and only by chance
doesn't have an effect in the destructor.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/1026513004

Cr-Commit-Position: refs/heads/master@{#27376}

Acquire a lock before checking for GC interrupt in JSON parser.

BUG=

Review URL: https://codereview.chromium.org/1025333002

Cr-Commit-Position: refs/heads/master@{#27375}

[V8] Removed SourceLocationRestrict

This method uses in messages.js in GetSourceLine and GetPositionInLine. This methods uses in v8::Message API methods and there is no documentation about it.
Method looks obsolete.
One of the strange side effect is shown by attached issue.

BUG=chromium:468781
R=yangguo@chromium.org
LOG=Y

Review URL: https://codereview.chromium.org/1022333004

Cr-Commit-Position: refs/heads/master@{#27374}

[turbofan] add non fixed slot constraint to register allocator

R=jarin@chromium.org

BUG=

Review URL: https://codereview.chromium.org/1018853003

Cr-Commit-Position: refs/heads/master@{#27373}

[es5] call ToString() on argument in String.prototype.concat() fast case

15.5.4.6 5.b requires each part to be converted using ToString(). This also needs to occur in the single argument fast-case.

BUG=v8:3981
R=arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1029103002

Cr-Commit-Position: refs/heads/master@{#27372}

Remove reference to PropertyCellSpace from include/v8.h

BUG=

Review URL: https://codereview.chromium.org/1009123003

Cr-Commit-Position: refs/heads/master@{#27371}

[V8] Added debug-sourceinfo.js with LF endings back

Readded after https://codereview.chromium.org/1029063002/ with correct line endings.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1032443002

Cr-Commit-Position: refs/heads/master@{#27370}

Move this_has_uses from ParseInfo back into CompilationInfo and renumber CompilationInfo flags.

R=svenpanne@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1028973002

Cr-Commit-Position: refs/heads/master@{#27369}

[V8] Removed debug-sourceinfo.js with CRLF line endings

We can't simple delete and add one file in one CL. This is necessary for replacing this test with version with LF line endings.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1029063002

Cr-Commit-Position: refs/heads/master@{#27368}

Make compiler more acceptive wrt Isolate::use_crankshaft.

This allows using %OptimizeFunctionOnNextCall and friends even when
Crankshaft is disabled. Note that this should only affect code paths
that are not relevant to performance. By now we have a single bailout
point in place within OptimizedCompileJob::CreateGraph that ensures
Crankshaft is only used when enabled and supported.

R=titzer@chromium.org

Review URL: https://codereview.chromium.org/999173007

Cr-Commit-Position: refs/heads/master@{#27367}

[turbofan] Fix control reducer bug with walking non-control edges during ConnectNTL phase.

R=jarin@chromium.org
BUG=chromium:469605
LOG=Y

Review URL: https://codereview.chromium.org/1030623003

Cr-Commit-Position: refs/heads/master@{#27366}

PPC: Use platform specific stubs for vector-based Load/KeyedLoad.

Port 34a1a76ddf30109f7b6cb60aa2651493ab38660a

Original commit message:
A hydrogen code stub is not the best approach because it builds a frame
and doesn't have the technology to discard roots at tail call exits.
Platform-specific stubs provide much better performance at this point.

R=verwaest@chromium.org, mbrandy@us.ibm.com

BUG=

Review URL: https://codereview.chromium.org/1019003002

Cr-Commit-Position: refs/heads/master@{#27365}

Respect old space allocation limit in PagedSpace::AllocateRaw.

BUG=v8:3976
LOG=NO

Review URL: https://codereview.chromium.org/1025643002

Cr-Commit-Position: refs/heads/master@{#27364}

Fix unintentional typo in Parser::ParseLazy() comments

BUG=
LOG=N
NOTRY=true

Review URL: https://codereview.chromium.org/1022413003

Cr-Commit-Position: refs/heads/master@{#27363}

Reland "Fix memory leak caused by field type in descriptor array."

BUG=v8:3877
LOG=NO

Review URL: https://codereview.chromium.org/1018283002

Cr-Commit-Position: refs/heads/master@{#27362}

[ARM64] [turbofan] Support Float64Min and Float64Max.

ARM64 support for Float64Min and Float64Max machine operators
(https://codereview.chromium.org/998283002/) using fmin and fmax.

BUG=

Review URL: https://codereview.chromium.org/1024093002

Cr-Commit-Position: refs/heads/master@{#27361}

X87: Simplify pending message object handling.

port d4696c484142c601cbd691ae80164043785a3af7 (r27150)

original commit message:

  This moves the decision whether to report a message or not to when
  the pending exception is propagated instead of trying to preserve the
  decision in a ThreadLocalTop field.

BUG=

Review URL: https://codereview.chromium.org/1028073002

Cr-Commit-Position: refs/heads/master@{#27360}

Remove the check for turbofan unsupported platform.

BUG=

Review URL: https://codereview.chromium.org/1025073004

Cr-Commit-Position: refs/heads/master@{#27359}

X87: Simplify pending message script handling.

port f71e26268338d2840133264329bf35a63011bb5a (r27127)

original commit message:

  Simplify pending message script handling.

  This removes the separate tracking of the pending message script,
  because that script is already stored in the message object and
  duplicating it in the ThreadLocalTop makes it more brittle.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1028993003

Cr-Commit-Position: refs/heads/master@{#27358}

X87: Remove frame pointer from StackHandler.

port 36e69a916f2a88664887d2b62f0eaf8400edb182 (r27115)

original commit message:

This reduces the size of the StackHandler by yet another word. We no
longer need to keep track of the frame pointer, as the stack walk will
be able to recalculate it.

BUG=

Review URL: https://codereview.chromium.org/1030563002

Cr-Commit-Position: refs/heads/master@{#27357}

X87:  [es6] Throw TypeError for computed static prototype property name

port 8d946b9c3f6ea42dd5232c0529be4d47798b06aa (r27106).

original commit message:

  [es6] Throw TypeError for computed static prototype property name

  The prototype of a class constructor function is read only. When we set
  computed property names we were ignoring this and we were overriding the
  property.

  Since the prototype is the only possible own read only property on the
  constructor function object we special case this so we do not have to
  check this for every property in the class literal.

BUG=

Review URL: https://codereview.chromium.org/1028983002

Cr-Commit-Position: refs/heads/master@{#27356}

Use TO_OBJECT_INLINE a bit more

We were using ToObject in a lot of places where the common case is that
we already have an object. By changing to TO_OBJECT_INLINE we don't
have to go through 5 different if statements before falling through.

We were also calling ToObject too many times in DefineObjectProperty
where we already know that obj is an object.

BUG=None
LOG=N

Review URL: https://codereview.chromium.org/1019413002

Cr-Commit-Position: refs/heads/master@{#27355}

[es6] Object.getPrototypeOf should work with values

The final spec for Object.getPrototypeOf calls ToObject on the
parameter, which means that it should only throw for null and
undefined. For other non object values the prototype of the wrapper
should be used.

BUG=v8:3964
LOG=N
R=adamk, rossberg@chromium.org

Review URL: https://codereview.chromium.org/1014813003

Cr-Commit-Position: refs/heads/master@{#27354}

X87: Remove code object from StackHandler.

port e0aa8ebf933b4c659e1c4a01ba244c5de452ff1c (r27103).

original commit message:

This reduces the size of the StackHandler by one word. We no longer
need to keep track of the code object, as the stack walk finds it.

BUG=
R=weiliang.lin@intel.com

Review URL: https://codereview.chromium.org/1022403002

Cr-Commit-Position: refs/heads/master@{#27353}

[es6] remove --harmony-templates flag

BUG=v8:3230
R=dslomov@chromium.org, arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1027593005

Cr-Commit-Position: refs/heads/master@{#27352}

MIPS: Fix 'MIPS: Serializer: serialize internal references via object visitor.'

BUG=

Review URL: https://codereview.chromium.org/1025453003

Cr-Commit-Position: refs/heads/master@{#27351}

Update V8 DEPS.

Rolling v8/third_party/icu to 7c81740601355556e630da515b74d889ba2f8d08

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1030513002

Cr-Commit-Position: refs/heads/master@{#27350}

MIPS: [es6] generate rest parameters correctly for subclass constructors

Port bef80fcfd7e89cadc215f7d10a016a375e346490

BUG=v8:3977
LOG=N

Review URL: https://codereview.chromium.org/1028703002

Cr-Commit-Position: refs/heads/master@{#27349}

MAP_NORESERVE was never implemented in FreeBSD as has been retired
as of https://reviews.freebsd.org/D848. This makes V8 build on
FreeBSD-current (and the forthcoming 11).

BUG=none
LOG=n

Review URL: https://codereview.chromium.org/1025823003

Cr-Commit-Position: refs/heads/master@{#27348}

MIPS: Fix 'MIPS: [es6] implement Reflect.apply() & Reflect.construct()'

Port d21fd15467e16f185e511dbfbaeef7caddfe804a

TEST=mjsunit/harmony/reflect-construct
BUG=

Review URL: https://codereview.chromium.org/1022053002

Cr-Commit-Position: refs/heads/master@{#27347}

Ensure we don't overflow in BCE

BUG=chromium:469148
LOG=y
R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1023123003

Cr-Commit-Position: refs/heads/master@{#27346}

Revert of Allow compaction when incremental marking is on. (patchset #1 id:1 of https://codereview.chromium.org/1014263002/)

Reason for revert:
It seems to cause crbug/469146.

Original issue's description:
> Allow compaction when incremental marking is on.
>
> BUG=chromium:450824
> LOG=NO
>
> Committed: https://crrev.com/92f96e4e9a527fcb085b68f81ee14b26acdd4719
> Cr-Commit-Position: refs/heads/master@{#27267}

TBR=hpayer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:450824

Review URL: https://codereview.chromium.org/1026813002

Cr-Commit-Position: refs/heads/master@{#27345}

[es6] generate rest parameters correctly for subclass constructors

BUG=v8:3977
R=dslomov@chromium.org, arv@chromium.org
LOG=N

Review URL: https://codereview.chromium.org/1018043003

Cr-Commit-Position: refs/heads/master@{#27344}

MIPS: [turbofan] Turn Math.clz32 into an inlinable builtin.

Port 3aa206b86560da94f895625186295bf07a0301d8

BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/1020223002

Cr-Commit-Position: refs/heads/master@{#27343}

X87: [turbofan] Implement throwing exceptions into TurboFan code.

port 1382879f29bd71c36aeda2421e867c4cdd232a0d (r27016).

oringinal commit message:

    [turbofan] Implement throwing exceptions into TurboFan code.

    This extends the stack unwinding logic to respect optimized frames
    and perform a lookup in the handler table to find handlers. It also
    contains fixes to the API call stubs to allow a stack walk while
    promoting scheduled exceptions.

BUG=

Review URL: https://codereview.chromium.org/1023943002

Cr-Commit-Position: refs/heads/master@{#27342}

[turbofan] Fix lowering of Math.max for integral inputs.

R=jarin@chromium.org
BUG=chromium:468162
LOG=y

Review URL: https://codereview.chromium.org/1027753002

Cr-Commit-Position: refs/heads/master@{#27341}

Serializer: cache hashmaps on the isolate.

This speeds up multiple uses of the serializer quite a bit.

R=mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1003363003

Cr-Commit-Position: refs/heads/master@{#27340}

[harmony] Move some regression tests to the right place

TBR=dslomov@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1027693003

Cr-Commit-Position: refs/heads/master@{#27339}

[strong] Less pleading error messages

R=dslomov@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1021213002

Cr-Commit-Position: refs/heads/master@{#27338}

Remove harmony-strings flag.

String functions are shipping since 4.1/Chrome M41, it is time to unflag.

R=yanngguo@chromium.org,rossberg@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1024813002

Cr-Commit-Position: refs/heads/master@{#27337}

[turbofan] More inlinable Math builtins.

Turn Math.acos, Math.asin, Math.atan, Math.atan2, Math.sign and Math.trunc
into inlinable builtins.

R=yangguo@chromium.org
BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/1027713002

Cr-Commit-Position: refs/heads/master@{#27336}

Don't DCHECK that the weak closure wasn't yet overapproximated

Maybe it was overapproximated via the idle notification already, so just
don't retry in that case

BUG=chromium:469023
R=hpayer@chromium.org
LOG=n

Review URL: https://codereview.chromium.org/1025603003

Cr-Commit-Position: refs/heads/master@{#27335}

Check for GC interrupt in JSON parser.

BUG=v8:3974
LOG=NO

Review URL: https://codereview.chromium.org/1021523002

Cr-Commit-Position: refs/heads/master@{#27334}

[turbofan] Work-around untagged result of CompareIC in pointer maps.

BUG=chromium:469089
LOG=n
R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1026683002

Cr-Commit-Position: refs/heads/master@{#27333}

X87: Fix exception for assignment to uninitialised const.

port 2ecdf736cf0409b52832f78a4439ace855d6739b (r27014).

original commit message:

Fix exception for assignment to uninitialised const.

BUG=

Review URL: https://codereview.chromium.org/1028533002

Cr-Commit-Position: refs/heads/master@{#27332}

[turbofan] Add explicit set for nodes with weakened types.

To ensure termination, we need to be sure that once we start weakening
a node, we keep weakening that node in subsequent re-typings. Until now,
we were guessing that we previously weakened from the type. This
change introduces a set of nodes that have already be weakened, so
that we have a reliable way to detect previous weakening.

BUG=chromium:468799
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1019883002

Cr-Commit-Position: refs/heads/master@{#27331}

[turbofan] Improve typing for string::length property.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1028563002

Cr-Commit-Position: refs/heads/master@{#27330}

[turbofan] Turn Math.clz32 into an inlinable builtin.

R=dcarney@chromium.org, yangguo@chromium.org
BUG=v8:3952
LOG=n

Review URL: https://codereview.chromium.org/1021183002

Cr-Commit-Position: refs/heads/master@{#27329}

[turbofan] Fix unit test coverage for JSIntrinsicLowering.

R=dcarney@chromium.org

Review URL: https://codereview.chromium.org/1028553002

Cr-Commit-Position: refs/heads/master@{#27328}

Update V8 DEPS.

Rolling v8/third_party/icu to d319ad9e25e8045f051dcd30bd5835f99936af6c

TBR=machenbach@chromium.org

Review URL: https://codereview.chromium.org/1021953002

Cr-Commit-Position: refs/heads/master@{#27327}

MIPS: [es6] implement Reflect.apply() & Reflect.construct()

Port d21fd15467e16f185e511dbfbaeef7caddfe804a

Known issue: the mjsunit/harmony/reflect-construct test fails, it will be addressed in a follow-up CL.

BUG=

Review URL: https://codereview.chromium.org/1021863002

Cr-Commit-Position: refs/heads/master@{#27326}

Parser: Fix crash on stack overflow when lazy-parsing arrow functions

The problem manifests itself when parsing manages to return something
meaningful in the presence of a stack overflow. This happens because
calling ParserBase::Next() will still return one valid token on stack
overflow, before starting to return invalid tokens.

Take the following input as example:

        a.map(v => v + 1);
              | |
       already   next token
        parsed   (which will be an invalid token
  (identifier)   because of a stack overflow)

The "v" may have been already parsed into a VariableProxy, then if a
stack overflow occurs, next token will be an invalid token (instead
of Token::ARROW), but the parser will return the VariableProxy.

This always happens when lazy-parsing arrow functions, so the position
in the input stream where the the arrow function code ends is known.
This fix adds a check that ensures that parsing ended at the end
position of the arrow function.

BUG=465671
LOG=N

Review URL: https://codereview.chromium.org/1023483003

Cr-Commit-Position: refs/heads/master@{#27325}

Cannot use Handle<T>::cast in Unique<T>::cast since it will try to do a T::cast (and its typecheck) concurrently, which is unsafe concurrently on moving values

BUG=

Review URL: https://codereview.chromium.org/1022943002

Cr-Commit-Position: refs/heads/master@{#27324}

Revert "Merge old data and pointer space."

TBR=verwaest@chromium.org,ulan@chromium.org,ishell@chromium.org
NOTRY=true

Review URL: https://codereview.chromium.org/1027463002

Cr-Commit-Position: refs/heads/master@{#27323}

[turbofan] Emit constant pool before blocking it in AssembleArchTableSwitch.

BUG=chromium:468749
LOG=NO
TEST=Emscripten/NBodyJava

Review URL: https://codereview.chromium.org/1014093005

Cr-Commit-Position: refs/heads/master@{#27322}

Rename kMaxFrameRenderingIdleTime to kMaxActiveIdleTime and adjust it to the currently maximum value of 50ms passed in by the Blink scheduler.

BUG=468692
LOG=n

Review URL: https://codereview.chromium.org/1024543002

Cr-Commit-Position: refs/heads/master@{#27321}

[strong] Check constructor returns

R=dslomov@chromium.org
BUG=v8:3956
LOG=N

Review URL: https://codereview.chromium.org/1019283002

Cr-Commit-Position: refs/heads/master@{#27320}

[turbofan] Remove last_use_ field from Node.

R=mstarzinger@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1022783002

Cr-Commit-Position: refs/heads/master@{#27319}

Use libdl to get symbols for backtraces

With this patch, it'll look like this:

$ out/x64.optdebug/d8 --expose-trigger-failure test/mjsunit/mjsunit.js test/mjsunit/verify-assert-false.js

==== C stack trace ===============================

1: V8_Fatal
2: v8::internal::FunctionCallbackArguments::Call(void (*)(v8::FunctionCallbackInfo<v8::Value> const&))
3: 0x727ced
4: 0x72b6ba
5: 0x188c7f607f9b

BUG=none
R=svenpanne@chromium.org
LOG=y

Review URL: https://codereview.chromium.org/1018313003

Cr-Commit-Position: refs/heads/master@{#27318}

Remove early bail-out in VisitWeakList to investigate chrasher.

BUG=468601
LOG=n

Review URL: https://codereview.chromium.org/1016353002

Cr-Commit-Position: refs/heads/master@{#27317}

[es6] implement Reflect.apply() & Reflect.construct()

BUG=v8:3900
LOG=N
R=dslomov@chromium.org

Review URL: https://codereview.chromium.org/913073003

Cr-Commit-Position: refs/heads/master@{#27316}

[x86] Atom check includes AMT

BUG=

Review URL: https://codereview.chromium.org/998883002

Cr-Commit-Position: refs/heads/master@{#27315}

Add debug checks to catch crashes with WeakCell::cast().

BUG=

Review URL: https://codereview.chromium.org/1009603003

Cr-Commit-Position: refs/heads/master@{#27314}

Add a counter for legacy const.
Only adds a counter id, does not count anything.

R=jochen@chromium.org
BUG=v8:3942
LOG=N

Review URL: https://codereview.chromium.org/1020883002

Cr-Commit-Position: refs/heads/master@{#27313}

Serializer: another small reorder of root objects.

I was mistaken, cons strings only occur a lot for custom heap snapshots,
not for the default start-up snapshot.

R=erik.corry@gmail.com, mvstanton@chromium.org

Review URL: https://codereview.chromium.org/1023673003

Cr-Commit-Position: refs/heads/master@{#27312}

[arm64] serialize internal references via object visitor

BUG=

Review URL: https://codereview.chromium.org/1020863003

Cr-Commit-Position: refs/heads/master@{#27311}

[turbofan] Remember types for deoptimization during simplified lowering.

With this change, we remember the types of frame state inputs (in a new
operator, called TypedStateValues). Instead of inferring the value types
when building translations, we used the recorded types.

The original approach was not reliable because the passes after
simplified lowering can change node types, and this in turn confuses
the translation builder.

BUG=chromium:468727
LOG=n
R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1015423002

Cr-Commit-Position: refs/heads/master@{#27310}

Add debug checks to catch PropertyCell::cast failures.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1025433002

Cr-Commit-Position: refs/heads/master@{#27309}

[turbofan] Use proper parameter representation for stub calls.

The CallInterfaceDescriptor already provides information about the
expected representation of parameters, so we can use that instead of
hardcoding tagged representation for all parameters.

R=jarin@chromium.org

Review URL: https://codereview.chromium.org/1019293002

Cr-Commit-Position: refs/heads/master@{#27308}