mvstanton [Fri, 25 Sep 2015 13:56:24 +0000 (06:56 -0700)]
Full code shouldn't embed the type feedback vector.
Make sure to always reference it indirectly. This allows us to make the vector
native-context dependent should we wish.
R=ishell@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1364373003
Cr-Commit-Position: refs/heads/master@{#30940}
mstarzinger [Fri, 25 Sep 2015 13:55:11 +0000 (06:55 -0700)]
[heap] No leakage of gc-idle-time-handler.h outside of heap.
This prevents the internal gc-idle-time-handler.h to be usable outisde
of the "heap" directory. The logic inside that component is only useful
within the GC and is now properly encapsulated.
R=ulan@chromium.org
Review URL: https://codereview.chromium.org/
1368983002
Cr-Commit-Position: refs/heads/master@{#30939}
hpayer [Fri, 25 Sep 2015 13:54:01 +0000 (06:54 -0700)]
[heap] Move large object space selection into AllocateRaw.
BUG=
Review URL: https://codereview.chromium.org/
1373523002
Cr-Commit-Position: refs/heads/master@{#30938}
machenbach [Fri, 25 Sep 2015 13:51:33 +0000 (06:51 -0700)]
[test] Skip test262-es6 tests failing on mac.
Looks like we never ran test262-es6 on mac. After merging
into test262 we've got these failures. Skipping for now.
BUG=v8:4437
LOG=n
NOTRY=true
NOTREECHECKS=true
TBR=jkummerow@chromium.org
Review URL: https://codereview.chromium.org/
1372603002
Cr-Commit-Position: refs/heads/master@{#30937}
machenbach [Fri, 25 Sep 2015 13:03:27 +0000 (06:03 -0700)]
[test] Copy test262-es6 into test262.
BUG=v8:4254
LOG=n
NOTRY=true
Review URL: https://codereview.chromium.org/
1365293002
Cr-Commit-Position: refs/heads/master@{#30936}
jkummerow [Fri, 25 Sep 2015 12:26:22 +0000 (05:26 -0700)]
[elements.cc] Clean up CopyDoubleToObjectElements
Review URL: https://codereview.chromium.org/
1372533002
Cr-Commit-Position: refs/heads/master@{#30935}
bmeurer [Fri, 25 Sep 2015 11:33:28 +0000 (04:33 -0700)]
[turbofan] Rename --context-specialization to --function-context-specialization.
This name makes it clear that the flag (also the variant in the Compiler)
is talking about specializing to the function context instead of i.e. the
native context.
R=mstarzinger@chromium.org
Review URL: https://codereview.chromium.org/
1372513003
Cr-Commit-Position: refs/heads/master@{#30934}
mstarzinger [Fri, 25 Sep 2015 11:32:38 +0000 (04:32 -0700)]
[presubmit] Enable runtime/threadsafe_fn linter checking.
This enables linter checking for "runtime/threadsafe_fn" violations
during presubmit and instead marks the few known exceptions that we
allow explicitly.
R=jochen@chromium.org
Review URL: https://codereview.chromium.org/
1369673003
Cr-Commit-Position: refs/heads/master@{#30933}
paul.lind [Fri, 25 Sep 2015 11:31:27 +0000 (04:31 -0700)]
Fix a sign-compare error to make gcc 4.9.2 happy.
This is from
https://chromium.googlesource.com/v8/v8/+/
347fa90626a448e3535cf6aa100124dfd5b711ce
BUG=
Review URL: https://codereview.chromium.org/
1365113003
Cr-Commit-Position: refs/heads/master@{#30932}
machenbach [Fri, 25 Sep 2015 11:27:43 +0000 (04:27 -0700)]
Revert of [heap] Move large object space selection into AllocateRaw. (patchset #1 id:1 of https://codereview.chromium.org/
1360903004/ )
Reason for revert:
[Sheriff] Breaks:
http://build.chromium.org/p/client.v8/builders/V8%20Linux%20-%20nosnap%20-%20debug%20-%202/builds/2080
And maybe (not sure):
http://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064%20%28dbg%29/builds/1529
Original issue's description:
> [heap] Move large object space selection into AllocateRaw.
>
> BUG=
>
> Committed: https://crrev.com/
1403815bdbcbd3336b2d85291704640fada30ffe
> Cr-Commit-Position: refs/heads/master@{#30930}
TBR=mlippautz@chromium.org,hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=
Review URL: https://codereview.chromium.org/
1368103002
Cr-Commit-Position: refs/heads/master@{#30931}
hpayer [Fri, 25 Sep 2015 10:41:02 +0000 (03:41 -0700)]
[heap] Move large object space selection into AllocateRaw.
BUG=
Review URL: https://codereview.chromium.org/
1360903004
Cr-Commit-Position: refs/heads/master@{#30930}
mstarzinger [Fri, 25 Sep 2015 09:29:27 +0000 (02:29 -0700)]
[turbofan] Remove obsolete method from RawMachineAssembler.
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/
1370663002
Cr-Commit-Position: refs/heads/master@{#30929}
mlippautz [Fri, 25 Sep 2015 09:27:23 +0000 (02:27 -0700)]
[heap] Fix PagedSpace::SizeOfObjects calling from within FreeList::Allocate
Not resetting the allocation area after freeing it potentially results in
negative SizeOfObjects() because the area is accounted for as allocated while it
has already been freed.
BUG=
Review URL: https://codereview.chromium.org/
1364303002
Cr-Commit-Position: refs/heads/master@{#30928}
jarin [Fri, 25 Sep 2015 08:42:51 +0000 (01:42 -0700)]
[turbofan] Check node input/use consistency for changed operators and new nodes.
Verifies consistency of node inputs and uses:
- node inputs should agree with the input count computed from the node's operator.
- effect inputs should have effect outputs (or be a sentinel).
- control inputs should have control outputs (or be a sentinel).
- frame state inputs should be frame states (or be a sentinel).
- if the node has control uses, it should produce control.
- if the node has effect uses, it should produce effect.
- if the node has frame state uses, it must be a frame state.
I also removed some tests, either because they did not seem to be useful (scheduler) or they tested dead functionality (diamond effect phi).
Review URL: https://codereview.chromium.org/
1368913002
Cr-Commit-Position: refs/heads/master@{#30927}
julien.gilli [Fri, 25 Sep 2015 04:59:20 +0000 (21:59 -0700)]
Update post-mortem metadata generation
mdb_v8, a post-mortem debugger for Node.js, now uses JSArrayBuffer's
backing_store property and JSArrayBufferView's byte_offset property to
get access to the content of Buffer instances in node (which are
Uint8Array instances). This change adds post-mortem metadata for these
two properties.
This change also fixes a typo in
inobject_properties_of_constructor_function_index_offset that was added
to gen-postmortem-metadata in a previous change. It should be named
inobject_properties_or_constructor_function_index instead.
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/
1363403003
Cr-Commit-Position: refs/heads/master@{#30926}
bmeurer [Fri, 25 Sep 2015 04:04:28 +0000 (21:04 -0700)]
[es6] Remove left-overs from Function.prototype.toMethod.
The actual Function.prototype.toMethod was removed some time already,
but there were some stuff (esp. %ToMethod) left in the tree, including
tests for %ToMethod. This code (and esp. the tests) cause trouble in
the process of moving bound functions away from JSFunction; so since
the code is unused anyway, we can as well remove it.
The original removal of Function.prototype.toMethod was in February
2015 in
68e489758607bb7373409b49a0a7883407a322b3.
R=jarin@chromium.org
BUG=v8:3330
LOG=n
Review URL: https://codereview.chromium.org/
1366063002
Cr-Commit-Position: refs/heads/master@{#30925}
v8-autoroll [Fri, 25 Sep 2015 03:25:17 +0000 (20:25 -0700)]
Update V8 DEPS.
Rolling v8/tools/clang to
1f65dc9f9e1879a25d79a8bc46a12265532e4a0f
TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
Review URL: https://codereview.chromium.org/
1368903002
Cr-Commit-Position: refs/heads/master@{#30924}
chunyang.dai [Fri, 25 Sep 2015 03:00:27 +0000 (20:00 -0700)]
X87: [turbofan] Call ArgumentsAccessStub to materialize arguments.
port
9b12ec9ac2aff2978d05df775ce621ba4d90cbe8 (r30919)
original commit message:
This lowers JSCreateArgument nodes to call the ArgumentsAccessStub for
help with materializing arguments objects when possible. Along the way
this changes the calling convention of said stub to take parameters in
registers instead of on the stack.
R=weiliang.lin@intel.com
BUG=
Review URL: https://codereview.chromium.org/
1368873002
Cr-Commit-Position: refs/heads/master@{#30923}
stefan.penner [Thu, 24 Sep 2015 21:46:35 +0000 (14:46 -0700)]
Don’t smash globals used by the test helper itself.
Since https://codereview.chromium.org/
366103005 the promise tests null out
various globals, to ensure the promise implementation doesn’t itself rely
on functions patchable by monkeys.
Unfortunately, doing so breaks test assertion failures which rely on
those globals.
This isn’t the ideal solution, but does improve the current state.
R=littledan@chromium.org,domenic@chromium.org
LOG=N
BUG=
Review URL: https://codereview.chromium.org/
1370583002
Cr-Commit-Position: refs/heads/master@{#30922}
ofrobots [Thu, 24 Sep 2015 18:22:09 +0000 (11:22 -0700)]
[heap] refactor inline allocation step code
Once I improved byte accounting done for incremental mark in [1], there is some
code duplication that becomes apparent. This commit refactors the duplicated
code into a private method on NewSpace. This also makes it easy to add new
consumers of inline allocation steps in the future.
[1] https://codereview.chromium.org/
1274453002/
R=hpayer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1351983002
Cr-Commit-Position: refs/heads/master@{#30921}
mstarzinger [Thu, 24 Sep 2015 16:48:50 +0000 (09:48 -0700)]
[turbofan] Remove dead code from Diamond class.
R=titzer@chromium.org
Review URL: https://codereview.chromium.org/
1365963003
Cr-Commit-Position: refs/heads/master@{#30920}
mstarzinger [Thu, 24 Sep 2015 15:30:30 +0000 (08:30 -0700)]
[turbofan] Call ArgumentsAccessStub to materialize arguments.
This lowers JSCreateArgument nodes to call the ArgumentsAccessStub for
help with materializing arguments objects when possible. Along the way
this changes the calling convention of said stub to take parameters in
registers instead of on the stack.
R=mvstanton@chromium.org
Review URL: https://codereview.chromium.org/
1348773002
Cr-Commit-Position: refs/heads/master@{#30919}
oth [Thu, 24 Sep 2015 15:20:47 +0000 (08:20 -0700)]
[Interpreter] Basic flow control.
+ Add bytecodes for conditional and unconditional jumps.
+ Add bytecodes for test/compare operations.
+ Expose jumps in bytecode-array-builder and add BytecodeLabel class for
identifying jump targets.
+ Add support for if..then...else in the bytecode-generator.
+ Implement jump bytecodes in the interpreter. Test/compare operations
dependent on runtime call for comparisons.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1343363002
Cr-Commit-Position: refs/heads/master@{#30918}
machenbach [Thu, 24 Sep 2015 14:51:31 +0000 (07:51 -0700)]
[test] Make fuzzer output the archive file name for easy upload.
NOTRY=true
Review URL: https://codereview.chromium.org/
1365083002
Cr-Commit-Position: refs/heads/master@{#30917}
mstarzinger [Thu, 24 Sep 2015 14:46:29 +0000 (07:46 -0700)]
[turbofan] Make Node::set_op safer via wrapper.
This introduces the NodeProperties::ChangeOp helper which guards node
operator changes so that additional checking can be done without any
additional dependencies being pulled into the Node class. For now only
the input count is checked, but additional checking might follow.
R=jarin@chromium.org
Review URL: https://codereview.chromium.org/
1366753003
Cr-Commit-Position: refs/heads/master@{#30916}
cbruni [Thu, 24 Sep 2015 14:09:41 +0000 (07:09 -0700)]
PrototypeInfo.validity_cell: adding comment
BUG=
Review URL: https://codereview.chromium.org/
1370443002
Cr-Commit-Position: refs/heads/master@{#30915}
danno [Thu, 24 Sep 2015 13:38:50 +0000 (06:38 -0700)]
Revert of Remove register index/code indirection (patchset #17 id:320001 of https://codereview.chromium.org/
1287383003/ )
Reason for revert:
Failures on greedy RegAlloc, Fuzzer
Original issue's description:
> Remove register index/code indirection
>
> Previous to this patch, both the lithium and TurboFan register
> allocators tracked allocated registers by "indices", rather than
> the register codes used elsewhere in the runtime. This patch
> ensures that codes are used everywhere, and in the process cleans
> up a bunch of redundant code and adds more structure to how the
> set of allocatable registers is defined.
>
> Some highlights of changes:
>
> * TurboFan's RegisterConfiguration class moved to V8's top level
> so that it can be shared with Crankshaft.
> * Various "ToAllocationIndex" and related methods removed.
> * Code that can be easily shared between Register classes on
> different platforms is now shared.
> * The list of allocatable registers on each platform is declared
> as a list rather than implicitly via the register index <->
> code mapping.
>
> Committed: https://crrev.com/
80bc6f6e11f79524e3f1ad05579583adfd5f18b2
> Cr-Commit-Position: refs/heads/master@{#30913}
TBR=akos.palfi@imgtec.com,bmeurer@chromium.org,jarin@chromium.org,paul.lind@imgtec.com,titzer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/
1365073002
Cr-Commit-Position: refs/heads/master@{#30914}
danno [Thu, 24 Sep 2015 12:52:54 +0000 (05:52 -0700)]
Remove register index/code indirection
Previous to this patch, both the lithium and TurboFan register
allocators tracked allocated registers by "indices", rather than
the register codes used elsewhere in the runtime. This patch
ensures that codes are used everywhere, and in the process cleans
up a bunch of redundant code and adds more structure to how the
set of allocatable registers is defined.
Some highlights of changes:
* TurboFan's RegisterConfiguration class moved to V8's top level
so that it can be shared with Crankshaft.
* Various "ToAllocationIndex" and related methods removed.
* Code that can be easily shared between Register classes on
different platforms is now shared.
* The list of allocatable registers on each platform is declared
as a list rather than implicitly via the register index <->
code mapping.
Review URL: https://codereview.chromium.org/
1287383003
Cr-Commit-Position: refs/heads/master@{#30913}
titzer [Thu, 24 Sep 2015 12:51:30 +0000 (05:51 -0700)]
Refactor the StackFrameIterator::ComputeType() method to look up the code object (if any) before looking at the magic markers.
This will allow per-code-kind logic more easily in the future (e.g. for WASM).
BUG=
Review URL: https://codereview.chromium.org/
1350763004
Cr-Commit-Position: refs/heads/master@{#30912}
pierre.langlois [Thu, 24 Sep 2015 12:04:01 +0000 (05:04 -0700)]
[arm] Optimize vcmp when lhs operand is #0.0
This patch checks the type of the lhs operand of a floating point
comparison for ARM, and commutes the operands if it is #0.0. It allows
us to optimize a comparison with zero, as the vcmp instruction
accepts #0.0 as rhs operand.
Code before for "0.0 < 0.123":
------------------------------
movw ip, #29360
movt ip, #37224
movw r9, #31981
movt r9, #16319
vmov d0, ip, r9
mov ip, #0
vmov d1, ip, ip
vcmp.f64 d1, d0
vmrs APSR, FPSCR
bcc +12
Code after:
-----------
movw ip, #29360
movt ip, #37224
movw r9, #31981
movt r9, #16319
vmov d0, ip, r9
vcmp.f64 d0, #0.0
vmrs APSR, FPSCR
bgt +12
BUG=
Review URL: https://codereview.chromium.org/
1361913003
Cr-Commit-Position: refs/heads/master@{#30911}
rmcilroy [Thu, 24 Sep 2015 11:48:22 +0000 (04:48 -0700)]
[Interpreter] Add support for loading globals in the interpreter.
Adds LdaGlobal bytecode and augments BytecodeGenerator to load globals for
global variables and function calls.
Modified TestBytecodeGenerator to add the ability to specify that a bytecode
operand has an unknown value (used so we don't need to figure out the slot
index of a global). Also added a helper which checks equality of BytecodeArray
with the expected snipptets.
Modified TestInterpreter to allow it to take snippets of JS and have the
BytecodeGenerator generate the bytecode rather than having to build a
BytecodeArray manually. This is used to enable the global tests.
BUG=v8:4280
LOG=N
Review URL: https://codereview.chromium.org/
1361113002
Cr-Commit-Position: refs/heads/master@{#30910}
martyn.capewell [Thu, 24 Sep 2015 11:24:23 +0000 (04:24 -0700)]
[turbofan] Elide fp32 convert for const compares
Reduce operations of the form f64cmp(fp32to64(x), k) to f32cmp(x, k) when k
can be encoded as a 32-bit float.
Review URL: https://codereview.chromium.org/
1365623002
Cr-Commit-Position: refs/heads/master@{#30909}
chunyang.dai [Thu, 24 Sep 2015 10:46:05 +0000 (03:46 -0700)]
X87: [es6] Introduce spec compliant IsConstructor.
port
8fe3ac07014ce5891be0a1cbd8019e9f3b02ff0b (30902).
original commit message:
There was already a bit on the Map named "function with prototype",
which basically meant that the Map was a map for a JSFunction that could
be used as a constructor. Now this CL generalizes that bit to
IsConstructor, which says that whatever (Heap)Object you are looking at
can be used as a constructor (i.e. the bit is also set for bound
functions that can be used as constructors and proxies that have a
[[Construct]] internal method).
This way we have a single chokepoint for IsConstructor checking, which
allows us to get rid of the various ways in which we tried to guess
whether something could be used as a constructor or not.
Drive-by-fix: Renamed IsConstructor on FunctionKind to
IsClassConstructor to resolve the weird name clash, and the
IsClassConstructor name also matches the spec.
BUG=
Review URL: https://codereview.chromium.org/
1362313002
Cr-Commit-Position: refs/heads/master@{#30908}
chunyang.dai [Thu, 24 Sep 2015 10:37:28 +0000 (03:37 -0700)]
X87: [runtime] Remove weird pushing of something on StackOverflow.
port
556b522ac62414c87d05f5d6bab33f6b6cab9b13 (r30883)
original commit message:
We somehow try to push some stuff on the stack when we detect a stack
overflow, that we don't need. Even worse we might access outside the
valid stack bounds. Since we don't need this, it's gone.
BUG=
Review URL: https://codereview.chromium.org/
1367943002
Cr-Commit-Position: refs/heads/master@{#30907}
machenbach [Thu, 24 Sep 2015 09:42:19 +0000 (02:42 -0700)]
[test] Fetch mozilla test data from SVN.
NOTRY=true
Review URL: https://codereview.chromium.org/
1367933002
Cr-Commit-Position: refs/heads/master@{#30906}
pierre.langlois [Thu, 24 Sep 2015 09:27:20 +0000 (02:27 -0700)]
[arm64] Explicit commuted conditions in unittests
This patch explicitly names commuted conditions for floating point
comparisons, instead of relying on CommuteFlagsCondition. Otherwise, a
bug in this function would not be caught.
BUG=
Review URL: https://codereview.chromium.org/
1364773002
Cr-Commit-Position: refs/heads/master@{#30905}
chunyang.dai [Thu, 24 Sep 2015 08:58:19 +0000 (01:58 -0700)]
X87: [builtin] Refactor Invoke to deal with any kind of callable.
port
634d1d86d8e98584097c6cb548a68ecf705c44f7 (r30874).
original commit message:
Now both Execution::Call and Execution::New can deal with any
kind of target and will raise a proper exception if the target is not
callable (which is not yet spec compliant for New, as we would
have to check IsConstructor instead, which we don't have yet).
Now we no longer need to do any of these weird call/construct
delegate gymnastics in C++, and we finally have a single true
bottleneck for Call/Construct abstract operations in the code
base, with only a few special handlings left in the compilers to
optimize the JSFunction case.
BUG=
Review URL: https://codereview.chromium.org/
1362293002
Cr-Commit-Position: refs/heads/master@{#30904}
chunyang.dai [Thu, 24 Sep 2015 08:53:19 +0000 (01:53 -0700)]
X87: [ic] Introduce BOOLEAN state for CompareIC.
port
10c5f2e85ef92b7ca002ef95e406d5dc4f0c410b
original commit message:
Slow path for relational comparison of boolean primitive values
now goes through the runtime, which made the slow path even
slower than it already was. So in order to repair the regression,
we just track boolean feedback for comparisons and use that
to generate decent code in Crankshaft (not the best possible
code, but good enough for Crankshaft; TurboFan will be able
to do better on that).
BUG=
Review URL: https://codereview.chromium.org/
1367523005
Cr-Commit-Position: refs/heads/master@{#30903}
bmeurer [Thu, 24 Sep 2015 06:50:01 +0000 (23:50 -0700)]
[es6] Introduce spec compliant IsConstructor.
There was already a bit on the Map named "function with prototype",
which basically meant that the Map was a map for a JSFunction that could
be used as a constructor. Now this CL generalizes that bit to
IsConstructor, which says that whatever (Heap)Object you are looking at
can be used as a constructor (i.e. the bit is also set for bound
functions that can be used as constructors and proxies that have a
[[Construct]] internal method).
This way we have a single chokepoint for IsConstructor checking, which
allows us to get rid of the various ways in which we tried to guess
whether something could be used as a constructor or not.
Drive-by-fix: Renamed IsConstructor on FunctionKind to
IsClassConstructor to resolve the weird name clash, and the
IsClassConstructor name also matches the spec.
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=jarin@chromium.org, rossberg@chromium.org
BUG=v8:4413, v8:4430
LOG=n
Committed: https://crrev.com/
8de4d9351df4cf66c8a128d561a6e331d196be54
Cr-Commit-Position: refs/heads/master@{#30900}
Review URL: https://codereview.chromium.org/
1358423002
Cr-Commit-Position: refs/heads/master@{#30902}
bmeurer [Thu, 24 Sep 2015 05:26:44 +0000 (22:26 -0700)]
Revert of [es6] Introduce spec compliant IsConstructor. (patchset #2 id:20001 of https://codereview.chromium.org/
1358423002/ )
Reason for revert:
Failed on Fuzzer and MIPS bot.
Original issue's description:
> [es6] Introduce spec compliant IsConstructor.
>
> There was already a bit on the Map named "function with prototype",
> which basically meant that the Map was a map for a JSFunction that could
> be used as a constructor. Now this CL generalizes that bit to
> IsConstructor, which says that whatever (Heap)Object you are looking at
> can be used as a constructor (i.e. the bit is also set for bound
> functions that can be used as constructors and proxies that have a
> [[Construct]] internal method).
>
> This way we have a single chokepoint for IsConstructor checking, which
> allows us to get rid of the various ways in which we tried to guess
> whether something could be used as a constructor or not.
>
> Drive-by-fix: Renamed IsConstructor on FunctionKind to
> IsClassConstructor to resolve the weird name clash, and the
> IsClassConstructor name also matches the spec.
>
> R=jarin@chromium.org, rossberg@chromium.org
> BUG=v8:4430
> LOG=n
>
> Committed: https://crrev.com/
8de4d9351df4cf66c8a128d561a6e331d196be54
> Cr-Commit-Position: refs/heads/master@{#30900}
TBR=jarin@chromium.org,rossberg@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=v8:4430
Review URL: https://codereview.chromium.org/
1360403002
Cr-Commit-Position: refs/heads/master@{#30901}
bmeurer [Thu, 24 Sep 2015 04:00:25 +0000 (21:00 -0700)]
[es6] Introduce spec compliant IsConstructor.
There was already a bit on the Map named "function with prototype",
which basically meant that the Map was a map for a JSFunction that could
be used as a constructor. Now this CL generalizes that bit to
IsConstructor, which says that whatever (Heap)Object you are looking at
can be used as a constructor (i.e. the bit is also set for bound
functions that can be used as constructors and proxies that have a
[[Construct]] internal method).
This way we have a single chokepoint for IsConstructor checking, which
allows us to get rid of the various ways in which we tried to guess
whether something could be used as a constructor or not.
Drive-by-fix: Renamed IsConstructor on FunctionKind to
IsClassConstructor to resolve the weird name clash, and the
IsClassConstructor name also matches the spec.
R=jarin@chromium.org, rossberg@chromium.org
BUG=v8:4430
LOG=n
Review URL: https://codereview.chromium.org/
1358423002
Cr-Commit-Position: refs/heads/master@{#30900}
chunyang.dai [Thu, 24 Sep 2015 03:51:55 +0000 (20:51 -0700)]
X87: [builtins] Add support for NewTarget to Execution::New.
port
1dfac69f1fb5ad8e2db2d5be591c094def55d451 (r30857).
original commit message:
Introduce new builtins Construct and ConstructFunction (in line
with the Call and CallFunction builtins that we already have) as
proper bottleneck for Construct and [[Construct]] on JSFunctions.
Use these builtins to support passing NewTarget from C++ to
JavaScript land.
Long-term we want the CallConstructStub to be used for
gathering feedback on entry to construction chain (i.e. the
initial new Foo), and use the Construct builtins to do the
actual work inside the construction chain (i.e. calling into
super and stuff).
BUG=
Review URL: https://codereview.chromium.org/
1362573002
Cr-Commit-Position: refs/heads/master@{#30899}
chunyang.dai [Thu, 24 Sep 2015 03:43:42 +0000 (20:43 -0700)]
X87: [turbofan] Add support for reinterpreting integers as floating point and vice versa.
port
c610a22231212b12055c294f55b8f3942127580b (r30849).
original commit message:
BUG=
Review URL: https://codereview.chromium.org/
1362783003
Cr-Commit-Position: refs/heads/master@{#30898}
chunyang.dai [Thu, 24 Sep 2015 03:34:45 +0000 (20:34 -0700)]
X87: [ic] Also collect known map for relational comparison.
port
e56f265f6d41fadbcea2be65d9b573bad8b4709d (r30852).
original commit message:
Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.
For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.
BUG=
Review URL: https://codereview.chromium.org/
1342243005
Cr-Commit-Position: refs/heads/master@{#30897}
v8-autoroll [Thu, 24 Sep 2015 03:26:39 +0000 (20:26 -0700)]
Update V8 DEPS.
Rolling v8/tools/clang to
1cde9025c16dfc3e23be2db010b24f657c255b4c
TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
Review URL: https://codereview.chromium.org/
1359983006
Cr-Commit-Position: refs/heads/master@{#30896}
bmeurer [Wed, 23 Sep 2015 21:46:37 +0000 (14:46 -0700)]
[runtime] Replace %to_string_fun with %_ToString.
Introduce a new macro TO_STRING that maps to %_ToString and use that
instead of calling into any of the ToString/NonStringToString JavaScript
builtins. Also remove the TO_STRING_INLINE macro, which is basically
obsolete with %_ToString. We still have a few uses of ToString left (via
the utils export mechanism), where we need to investigate whether we
will tank badly if we replace them with TO_STRING as well.
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=yangguo@chromium.org
BUG=v8:4307
LOG=n
Review URL: https://codereview.chromium.org/
1323543002
Cr-Commit-Position: refs/heads/master@{#30895}
gdeepti [Wed, 23 Sep 2015 18:24:51 +0000 (11:24 -0700)]
[simdjs] Update Spec version to 0.9
Remove sumOfAbsoluteDifferences functions.
BUG=v8:4124
LOG=Y
R=bbudge@chromium.org, littledan@chromium.org
Review URL: https://codereview.chromium.org/
1356413002
Cr-Commit-Position: refs/heads/master@{#30894}
titzer [Wed, 23 Sep 2015 15:08:27 +0000 (08:08 -0700)]
Rename PLACEHOLDER code kind to WASM_FUNCTION.
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1365613002
Cr-Commit-Position: refs/heads/master@{#30893}
titzer [Wed, 23 Sep 2015 14:00:23 +0000 (07:00 -0700)]
Add CompilationInfo::output_code_kind to allow overriding the kind of code generated.
R=mstarzinger@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1356363004
Cr-Commit-Position: refs/heads/master@{#30892}
mlippautz [Wed, 23 Sep 2015 13:52:35 +0000 (06:52 -0700)]
[tools] Incrementally keep track of GC NVP output
We not keep track of the histogram as we process values and do not wait until
printing the histogram. Furthermore processing the histogram is not O(n) for n
values.
BUG=
Review URL: https://codereview.chromium.org/
1364733002
Cr-Commit-Position: refs/heads/master@{#30891}
bmeurer [Wed, 23 Sep 2015 13:49:09 +0000 (06:49 -0700)]
[builtins] Re-add similar String wrapper optimization for StringAdd.
For string wrappers (JSValue instances with [[StringData]] internal
fields), we can shortcirciut the ToPrimitive if
(a) the {input} map matches the initial map of the String function,
(b) the {input} [[Prototype]] is the unmodified %StringPrototype% (i.e.
no one monkey-patched toString, @@toPrimitive or valueOf), and
(c) the %ObjectPrototype% (i.e. the [[Prototype]] of the
%StringPrototype%) is also unmodified, that is no one sneaked a
@@toPrimitive into the %ObjectPrototype%.
If all these assumptions hold, we can just take the [[StringData]] value
and return it.
This just repairs a regression introduced by removing the
weird (and broken) intrinsic %_IsStringWrapperSafeForDefaultValue, which
was intendend to something similar to this, although less efficient and
wrong in the presence of @@toPrimitive. Long-term we might want to move
into the direction of having a ToPrimitiveStub that can do common cases
while staying in JavaScript land (i.e. not going to C++).
R=jarin@chromium.org
BUG=chromium:532524
LOG=n
Review URL: https://codereview.chromium.org/
1366563002
Cr-Commit-Position: refs/heads/master@{#30890}
jkummerow [Wed, 23 Sep 2015 13:48:01 +0000 (06:48 -0700)]
Remove crash-hunting instrumentation that has served its purpose.
BUG=chromium:527994
LOG=n
Review URL: https://codereview.chromium.org/
1358393004
Cr-Commit-Position: refs/heads/master@{#30889}
machenbach [Wed, 23 Sep 2015 13:46:51 +0000 (06:46 -0700)]
Revert of [heap] Add more tasks for parallel compaction (patchset #11 id:200001 of https://codereview.chromium.org/
1354383002/ )
Reason for revert:
[Sheriff] May have caused this new flake:
http://build.chromium.org/p/client.v8/builders/V8%20Linux/builds/5412
Original issue's description:
> [heap] Add more tasks for parallel compaction
>
> - We now compute the number of parallel compaction tasks, depending on the
> evacuation candidate list, the number of cores, and some hard limit.
> - Free memory is moved over to compaction tasks (up to some limit)
> - Moving over memory is done by dividing the free list of a given space up among
> other free lists. Since this is potentially slow we limit the maximum amount
> of moved memory.
>
> BUG=chromium:524425
> LOG=N
>
> Committed: https://crrev.com/
0e842418835eea85886a06cf37052895bc8a17db
> Cr-Commit-Position: refs/heads/master@{#30886}
TBR=hpayer@chromium.org,mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425
Review URL: https://codereview.chromium.org/
1356363005
Cr-Commit-Position: refs/heads/master@{#30888}
jkummerow [Wed, 23 Sep 2015 12:35:21 +0000 (05:35 -0700)]
[field type tracking] Fix handling of cleared WeakCells
Whenever a generalization is computed, the inputs must be checked for being cleared, and if they are, the generalization must be Type::Any.
Hopefully this fixes Chromium issue 527994 as well.
BUG=v8:4325,chromium:527994
LOG=n
Review URL: https://codereview.chromium.org/
1361103002
Cr-Commit-Position: refs/heads/master@{#30887}
mlippautz [Wed, 23 Sep 2015 12:28:55 +0000 (05:28 -0700)]
[heap] Add more tasks for parallel compaction
- We now compute the number of parallel compaction tasks, depending on the
evacuation candidate list, the number of cores, and some hard limit.
- Free memory is moved over to compaction tasks (up to some limit)
- Moving over memory is done by dividing the free list of a given space up among
other free lists. Since this is potentially slow we limit the maximum amount
of moved memory.
BUG=chromium:524425
LOG=N
Review URL: https://codereview.chromium.org/
1354383002
Cr-Commit-Position: refs/heads/master@{#30886}
ishell [Wed, 23 Sep 2015 11:15:50 +0000 (04:15 -0700)]
Exclude test/mjsunit/regress/regress-4121.js from GC stress testing.
NOTRY=true
Review URL: https://codereview.chromium.org/
1364583003
Cr-Commit-Position: refs/heads/master@{#30885}
titzer [Wed, 23 Sep 2015 11:04:44 +0000 (04:04 -0700)]
[test] Add FOR_INT64_INPUTS and FOR_UINT64_INPUTS.
R=bmeurer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1360133002
Cr-Commit-Position: refs/heads/master@{#30884}
bmeurer [Wed, 23 Sep 2015 10:58:38 +0000 (03:58 -0700)]
[runtime] Remove weird pushing of something on StackOverflow.
We somehow try to push some stuff on the stack when we detect a stack
overflow, that we don't need. Even worse we might access outside the
valid stack bounds. Since we don't need this, it's gone.
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=jarin@chromium.org
BUG=chromium:534881
LOG=n
Review URL: https://codereview.chromium.org/
1360953003
Cr-Commit-Position: refs/heads/master@{#30883}
thechargingvolcano [Wed, 23 Sep 2015 10:52:37 +0000 (03:52 -0700)]
Remove unused function in presubmit script
FilterFiles function is defined but unused in the code.
BUG=
R=machenbach@chromium.org
Review URL: https://codereview.chromium.org/
1364643002
Cr-Commit-Position: refs/heads/master@{#30882}
pierre.langlois [Wed, 23 Sep 2015 09:33:27 +0000 (02:33 -0700)]
[arm64] Optimize fcmp when lhs operand is #0.0
This patch checks the type of the lhs operand of a floating point
comparison, and commutes the operands if it is #0.0. It allows us to
optimize a comparison with zero, as the fcmp instruction accepts #0.0 as
rhs operand.
Code before for "0.0 < 0.123":
------------------------------
fmov d1, xzr
ldr d0, pc+96
fcmp d1, d0
b.lo #+0xc
Code after:
-----------
ldr d0, pc+92
fcmp d0, #0.0
b.gt #+0xc
Before this patch, we used unsigned condition codes for floating point
comparisons, but the unordered case was not correctly commuted.
Review URL: https://codereview.chromium.org/
1356283003
Cr-Commit-Position: refs/heads/master@{#30881}
jarin [Wed, 23 Sep 2015 09:08:15 +0000 (02:08 -0700)]
Reland "[turbofan] Checking of input counts on node creation"
(Original CL: https://codereview.chromium.org/
1347353003/)
Unfortunately, the mips gcc gets confused by arraysize on
variadic templated arguments, so we use sizeof... instead.
Review URL: https://codereview.chromium.org/
1366543003
Cr-Commit-Position: refs/heads/master@{#30880}
ishell [Wed, 23 Sep 2015 08:46:09 +0000 (01:46 -0700)]
Share literals arrays per <NativeContext, SharedFunctionInfo> pair.
This CL also renames wrongly named test for v8:4173.
BUG=v8:4121
LOG=Y
Review URL: https://codereview.chromium.org/
1353363002
Cr-Commit-Position: refs/heads/master@{#30879}
machenbach [Wed, 23 Sep 2015 08:02:22 +0000 (01:02 -0700)]
Revert of [turbofan] Checking of input counts on node creation (patchset #4 id:60001 of https://codereview.chromium.org/
1347353003/ )
Reason for revert:
[Sheriff] Breaks mips cross-compile:
http://build.chromium.org/p/client.v8/builders/V8%20Mips%20-%20builder/builds/4315
Original issue's description:
> [turbofan] Checking of input counts on node creation
>
> This required fixing bunch of tests with wrong input counts.
>
> Committed: https://crrev.com/
260ec46efd74c45cdc4b156d95086b7de06621ad
> Cr-Commit-Position: refs/heads/master@{#30877}
TBR=bmeurer@chromium.org,mstarzinger@chromium.org,jarin@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
Review URL: https://codereview.chromium.org/
1362783004
Cr-Commit-Position: refs/heads/master@{#30878}
jarin [Wed, 23 Sep 2015 07:53:43 +0000 (00:53 -0700)]
[turbofan] Checking of input counts on node creation
This required fixing bunch of tests with wrong input counts.
Review URL: https://codereview.chromium.org/
1347353003
Cr-Commit-Position: refs/heads/master@{#30877}
Benedikt Meurer [Wed, 23 Sep 2015 07:26:44 +0000 (09:26 +0200)]
[mips] Fix typo introduced in r30874.
TBR=machenbach@chromium.org
Review URL: https://codereview.chromium.org/
1363863002 .
Cr-Commit-Position: refs/heads/master@{#30876}
bmeurer [Wed, 23 Sep 2015 05:53:23 +0000 (22:53 -0700)]
[runtime] Remove obsolete Object::IsSpecFunction.
We don't need Object::IsSpecFunction anymore, since it only checks for
JSFunction and JSFunctionProxy, but what you actually want to check for
(in case of accessors) is whether the target has a [[Call]] internal
method, which is exactly what Object::IsCallable does.
CQ_INCLUDE_TRYBOTS=tryserver.v8:v8_linux_layout_dbg,v8_linux_nosnap_dbg
R=rossberg@chromium.org
BUG=v8:4413
LOG=n
Review URL: https://codereview.chromium.org/
1358403002
Cr-Commit-Position: refs/heads/master@{#30875}
bmeurer [Wed, 23 Sep 2015 05:43:57 +0000 (22:43 -0700)]
[builtin] Refactor Invoke to deal with any kind of callable.
Now both Execution::Call and Execution::New can deal with any
kind of target and will raise a proper exception if the target is not
callable (which is not yet spec compliant for New, as we would
have to check IsConstructor instead, which we don't have yet).
Now we no longer need to do any of these weird call/construct
delegate gymnastics in C++, and we finally have a single true
bottleneck for Call/Construct abstract operations in the code
base, with only a few special handlings left in the compilers to
optimize the JSFunction case.
R=jarin@chromium.org
BUG=v8:4430, v8:4413
LOG=n
Review URL: https://codereview.chromium.org/
1360793002
Cr-Commit-Position: refs/heads/master@{#30874}
julien.gilli [Wed, 23 Sep 2015 05:37:21 +0000 (22:37 -0700)]
Add JSTypedArray's length in post-mortem metadata.
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/
1363683002
Cr-Commit-Position: refs/heads/master@{#30873}
mbrandy [Tue, 22 Sep 2015 19:56:01 +0000 (12:56 -0700)]
PPC: [builtins] Add support for NewTarget to Execution::New.
Port
1dfac69f1fb5ad8e2db2d5be591c094def55d451
Original commit message:
Introduce new builtins Construct and ConstructFunction (in line
with the Call and CallFunction builtins that we already have) as
proper bottleneck for Construct and [[Construct]] on JSFunctions.
Use these builtins to support passing NewTarget from C++ to
JavaScript land.
Long-term we want the CallConstructStub to be used for
gathering feedback on entry to construction chain (i.e. the
initial new Foo), and use the Construct builtins to do the
actual work inside the construction chain (i.e. calling into
super and stuff).
R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=v8:4430
LOG=n
Review URL: https://codereview.chromium.org/
1358203002
Cr-Commit-Position: refs/heads/master@{#30872}
mbrandy [Tue, 22 Sep 2015 19:42:02 +0000 (12:42 -0700)]
PPC: [ic] Introduce BOOLEAN state for CompareIC.
Port
10c5f2e85ef92b7ca002ef95e406d5dc4f0c410b
Original commit message:
Slow path for relational comparison of boolean primitive values
now goes through the runtime, which made the slow path even
slower than it already was. So in order to repair the regression,
we just track boolean feedback for comparisons and use that
to generate decent code in Crankshaft (not the best possible
code, but good enough for Crankshaft; TurboFan will be able
to do better on that).
R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:534200
LOG=n
Review URL: https://codereview.chromium.org/
1362683002
Cr-Commit-Position: refs/heads/master@{#30871}
mbrandy [Tue, 22 Sep 2015 19:21:55 +0000 (12:21 -0700)]
PPC: Fix "[turbofan] Add support for reinterpreting integers as floating point and vice versa."
R=titzer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=
Review URL: https://codereview.chromium.org/
1358193002
Cr-Commit-Position: refs/heads/master@{#30870}
mbrandy [Tue, 22 Sep 2015 19:19:52 +0000 (12:19 -0700)]
PPC: [ic] Also collect known map for relational comparison.
Port
e56f265f6d41fadbcea2be65d9b573bad8b4709d
Original commit message:
Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.
For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.
R=bmeurer@chromium.org, joransiu@ca.ibm.com, jyan@ca.ibm.com, michael_dawson@ca.ibm.com, dstence@us.ibm.com
BUG=chromium:534200
LOG=n
Review URL: https://codereview.chromium.org/
1358063005
Cr-Commit-Position: refs/heads/master@{#30869}
adamk [Tue, 22 Sep 2015 17:43:26 +0000 (10:43 -0700)]
Don't crash when preparsing destructured arguments
This adds the materialized literal count accumulated while parsing the
parameters (in the parser proper) to that accumulated by the preparser.
This should have been caught in cctest/test-parsing, but it's not covered
because the parsing tests call directly into the preparser rather than
using Parser::ParseFunctionLiteral (which fully-parses the parameters
and then calls into the preparser to skip over the function body).
Note that this further-inflates the materialized literal count for
functions with destructured arguments, since some of the counted
literals are actually binding patterns. But that's not specific to
binding patterns in formal parameters: it happens in function bodies, too.
BUG=v8:4400,v8:4407
LOG=n
Review URL: https://codereview.chromium.org/
1350913005
Cr-Commit-Position: refs/heads/master@{#30868}
conradw [Tue, 22 Sep 2015 16:34:40 +0000 (09:34 -0700)]
[strong] Implement revised strong class semantics
Weak classes can inherit from strong ones again, a strong base class makes
instances strong.
BUG=v8:3956
LOG=N
Review URL: https://codereview.chromium.org/
1347243004
Cr-Commit-Position: refs/heads/master@{#30867}
neis [Tue, 22 Sep 2015 15:57:04 +0000 (08:57 -0700)]
Make prettyprinter useful in gdb.
R=rossberg
BUG=
Review URL: https://codereview.chromium.org/
1354433004
Cr-Commit-Position: refs/heads/master@{#30866}
mlippautz [Tue, 22 Sep 2015 13:59:19 +0000 (06:59 -0700)]
[tools] Add script to analyze GC tracing output
BUG=
Review URL: https://codereview.chromium.org/
1348763006
Cr-Commit-Position: refs/heads/master@{#30865}
hpayer [Tue, 22 Sep 2015 13:48:12 +0000 (06:48 -0700)]
[heap] Process live weak cells directly in the marking visitor.
This reduces the pause time of weak cells processing during a full GC.
BUG=
Review URL: https://codereview.chromium.org/
1363553002
Cr-Commit-Position: refs/heads/master@{#30864}
Michael Achenbach [Tue, 22 Sep 2015 13:34:46 +0000 (15:34 +0200)]
Whitespace change to test infra changes.
Cr-Commit-Position: refs/heads/master@{#30863}
Michael Achenbach [Tue, 22 Sep 2015 13:16:47 +0000 (15:16 +0200)]
Whitespace change to test infra changes.
Cr-Commit-Position: refs/heads/master@{#30862}
ishell [Tue, 22 Sep 2015 08:39:48 +0000 (01:39 -0700)]
[x64] Tweaking kMaxSizeEarlyOpt value to recover SunSpider/3d-cube.
With the IC-less global variables accesses the size of the Rotate* functions became small enough to be immediately optimized by Crankshaft which in turn tanked SunSpider/3d-cube.
BUG=chromium:531338
LOG=N
Review URL: https://codereview.chromium.org/
1356603005
Cr-Commit-Position: refs/heads/master@{#30861}
bmeurer [Tue, 22 Sep 2015 08:01:26 +0000 (01:01 -0700)]
[ic] Introduce BOOLEAN state for CompareIC.
Slow path for relational comparison of boolean primitive values
now goes through the runtime, which made the slow path even
slower than it already was. So in order to repair the regression,
we just track boolean feedback for comparisons and use that
to generate decent code in Crankshaft (not the best possible
code, but good enough for Crankshaft; TurboFan will be able
to do better on that).
R=jarin@chromium.org
BUG=chromium:534200
LOG=n
Review URL: https://codereview.chromium.org/
1347063004
Cr-Commit-Position: refs/heads/master@{#30860}
bmeurer [Tue, 22 Sep 2015 07:19:58 +0000 (00:19 -0700)]
[x64] Compare map instead of value to heap number map in ToStringStub.
Fixes a typo introduced earlier, where we compare the value to heap
number map instead of the map loaded previously.
TBR=jarin@chromium.org
Review URL: https://codereview.chromium.org/
1355253002
Cr-Commit-Position: refs/heads/master@{#30859}
bmeurer [Tue, 22 Sep 2015 05:46:36 +0000 (22:46 -0700)]
[crankshaft] Re-add fast-case for string add left/right.
Now the StringAddStub can optionally convert it's parameters to strings
(following the rules for the addition operator). This could be further
optimized once we have a ToPrimitiveStub, but it should be sufficient
for the moment.
Also removed the unused Strength parameter to the HStringAdd operator,
because string addition does not depend on language mode.
R=jarin@chromium.org
BUG=v8:4307, chromium:532524
LOG=n
Committed: https://crrev.com/
d261849e53fbf8c36efae42d478271f87acff70f
Cr-Commit-Position: refs/heads/master@{#30726}
Review URL: https://codereview.chromium.org/
1339053002
Cr-Commit-Position: refs/heads/master@{#30858}
bmeurer [Tue, 22 Sep 2015 04:27:14 +0000 (21:27 -0700)]
[builtins] Add support for NewTarget to Execution::New.
Introduce new builtins Construct and ConstructFunction (in line
with the Call and CallFunction builtins that we already have) as
proper bottleneck for Construct and [[Construct]] on JSFunctions.
Use these builtins to support passing NewTarget from C++ to
JavaScript land.
Long-term we want the CallConstructStub to be used for
gathering feedback on entry to construction chain (i.e. the
initial new Foo), and use the Construct builtins to do the
actual work inside the construction chain (i.e. calling into
super and stuff).
MIPS and MIPS64 ports contributed by akos.palfi@imgtec.com.
R=jarin@chromium.org
BUG=v8:4430
LOG=n
Review URL: https://codereview.chromium.org/
1359583002
Cr-Commit-Position: refs/heads/master@{#30857}
bmeurer [Tue, 22 Sep 2015 04:07:53 +0000 (21:07 -0700)]
[crankshaft] Handle @@toStringTag accessor correctly for BuildCompareInstruction.
If @@toStringTag is an accessor property, we cannot assume that the result
of calling Object.prototype.toString() for objects with the same map.
R=adamk@chromium.org
BUG=chromium:534200
LOG=n
Review URL: https://codereview.chromium.org/
1360723002
Cr-Commit-Position: refs/heads/master@{#30856}
v8-autoroll [Tue, 22 Sep 2015 03:25:00 +0000 (20:25 -0700)]
Update V8 DEPS.
Rolling v8/build/gyp to
01528c7244837168a1c80f06ff60fa5a9793c824
Rolling v8/tools/clang to
3e04436a49a26f4bd2c6f352efcf4c7b10a6d07d
TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org
Review URL: https://codereview.chromium.org/
1360563003
Cr-Commit-Position: refs/heads/master@{#30855}
dpranke [Tue, 22 Sep 2015 02:28:32 +0000 (19:28 -0700)]
Split the GN 'snapshot_toolchain' logic out into an include file.
We need to build parts of v8 with a toolchain that might be different
from both the default (target) toolchain and the regular host toolchain,
because we need the snapshot to have the same bit-width as the target.
V8's build defines a 'snapshot_toolchain' setting for this.
It turns out that we need the value of this toolchain to be exposed
to the Chromium build because some of the test targets (in browser_tests)
depend on d8 and need to be able to built using the same toolchain.
R=brett@chromium.org, jochen@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1350223004
Cr-Commit-Position: refs/heads/master@{#30854}
littledan [Mon, 21 Sep 2015 16:30:25 +0000 (09:30 -0700)]
Stage sloppy block-scoped functions (Annex B 3.3)
Turn on some test262 tests that pass now.
R=adamk
LOG=Y
BUG=v8:4285
Review URL: https://codereview.chromium.org/
1357233002
Cr-Commit-Position: refs/heads/master@{#30853}
bmeurer [Mon, 21 Sep 2015 16:05:27 +0000 (09:05 -0700)]
[ic] Also collect known map for relational comparison.
Previously we only collected the known map for equality comparisons. But
if we also collect it for relational comparisons, we can inline a fast
path of ToPrimitive on the objects, which is especially interesting
since both sides have the same map.
For now we only inline a very limited subset of ToPrimitive in
Crankshaft, which is when the receiver map (and its prototype chain)
doesn't have @@toPrimitive, and both valueOf and toString are the
default versions on the %ObjectPrototype%. In this case the relational
comparison would reduce to a string comparison of "[object CLASS]" with
itself and so we can reduce that to a boolean constant plus map checks
on both left and right hand side, plus code dependencies on the
prototype chain. This repairs the regression on box2d.
R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n
Review URL: https://codereview.chromium.org/
1355113002
Cr-Commit-Position: refs/heads/master@{#30852}
Michael Achenbach [Mon, 21 Sep 2015 14:33:03 +0000 (16:33 +0200)]
Whitespace change to test infra changes.
Cr-Commit-Position: refs/heads/master@{#30851}
mlippautz [Mon, 21 Sep 2015 14:03:44 +0000 (07:03 -0700)]
[heap] Sort declarations for MemoryChunk.
R=hpayer@chromium.org
BUG=
Review URL: https://codereview.chromium.org/
1360553003
Cr-Commit-Position: refs/heads/master@{#30850}
titzer [Mon, 21 Sep 2015 14:00:51 +0000 (07:00 -0700)]
[turbofan] Add support for reinterpreting integers as floating point and vice versa.
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/
1356913002
Cr-Commit-Position: refs/heads/master@{#30849}
hpayer [Mon, 21 Sep 2015 13:16:21 +0000 (06:16 -0700)]
[heap] Add timer scopes to process weak cells and clear non-live references.
BUG=
Review URL: https://codereview.chromium.org/
1345273004
Cr-Commit-Position: refs/heads/master@{#30848}
bmeurer [Mon, 21 Sep 2015 12:58:00 +0000 (05:58 -0700)]
[crankshaft] Generalize PropertyAccessInfo to Name (so it can deal with symbols).
This doesn't fix the performance regression mentioned by the bug yet,
but is necessary cleanup to land the fix, and should be separated from
the actual fix.
R=jkummerow@chromium.org
BUG=chromium:534200
LOG=n
Review URL: https://codereview.chromium.org/
1345313005
Cr-Commit-Position: refs/heads/master@{#30847}
mythria [Mon, 21 Sep 2015 10:34:44 +0000 (03:34 -0700)]
Continuing removing deprecated function from cctest
Removes deprecated functions from the following files:
test/cctest/compiler/function-tester.h
test/cctest/test-thread-termination.cc
test/cctest/test-threads.cc
test/cctest/test-transitions.cc
test/cctest/test-typedarrays.cc
test/cctest/test-types.cc
test/cctest/test-typing-reset.cc
test/cctest/test-unbound-queue.cc
test/cctest/test-unboxed-doubles.cc
BUG=v8:4134
LOG=n
Review URL: https://codereview.chromium.org/
1344583002
Cr-Commit-Position: refs/heads/master@{#30846}
chunyang.dai [Mon, 21 Sep 2015 09:18:11 +0000 (02:18 -0700)]
X87: [stubs] Refactor StringCompareStub and use it for HStringCompareAndBranch.
port
8016547c8e6fde00fff0a1791f3c83b444d8af25 (r30818).
original commit message:
The StringCompareStub used to take its parameters on the (JavaScript)
stack, which made it impossible to use in TurboFan. Actually
StringCompareStub was currently completely unused. This changes the
calling convention to something TurboFan compatible and introduces a
CallInterfaceDescriptor for StringCompareStub. It also changes
HStringCompareAndBranch to use the StringCompareStub instead of using
the full blown CompareICStub for a stupid string comparison.
BUG=
Review URL: https://codereview.chromium.org/
1355983003
Cr-Commit-Position: refs/heads/master@{#30845}
chunyang.dai [Mon, 21 Sep 2015 09:13:01 +0000 (02:13 -0700)]
X87: [runtime] Replace COMPARE/COMPARE_STRONG with proper Object::Compare.
port
593c655a3c814277283f9fa1520d5ce59d6b019c (r30816).
original commit message:
This removes the weird COMPARE and COMPARE_STRONG JavaScript builtins
and replaces them with a proper C++ implementation in Object::Compare
and appropriate wrappers Object::LessThan, Object::GreaterThan, and
friends that are intended to be used by a true/false returning CompareIC
in the future, as well as the interpreter. As a short-term solution we
provide %Compare and %Compare_Strong entry points for the current
CompareIC that return the appropriate integer values expected by
fullcodegen currently.
Now the Abstract Relational Comparison is also using the correct
ToPrimitive implementation, which properly supports @@toPrimitive.
BUG=
Review URL: https://codereview.chromium.org/
1353343002
Cr-Commit-Position: refs/heads/master@{#30844}
julien.gilli [Mon, 21 Sep 2015 05:45:20 +0000 (22:45 -0700)]
Add ScopeInfo constants to post-mortem metadata
mdb_v8, a post-mortem debugging tool for Node.js, allows users to
inspect ScopeInfo structures in order to get more information about
closures.
Currently, it hardcodes the metadata it uses to find this information.
This change allows it to get this metadata from the node binary itself,
and thus to adapt to future changes made to the layout of the ScopeInfo
data structure.
BUG=
R=bmeurer@chromium.org
Review URL: https://codereview.chromium.org/
1350843003
Cr-Commit-Position: refs/heads/master@{#30843}
littledan [Mon, 21 Sep 2015 04:30:50 +0000 (21:30 -0700)]
Implement sloppy-mode block-defined functions (Annex B 3.3)
ES2015 specifies very particular semantics for functions defined in blocks.
In strict mode, it is simply a lexical binding scoped to that block. In sloppy
mode, in addition to that lexical binding, there is a var-style binding in
the outer scope, which is overwritten with the local binding when the function
declaration is evaluated, *as long as* introducing ths var binding would not
create a var/let conflict in the outer scope.
This patch implements the semantics by introducing a DelegateStatement, which
is initially filled in with the EmptyStatement and overwritten with the
assignment when the scope is closed out and it can be checked that there is
no conflict.
This patch is tested with a new mjsunit test, and I tried staging it and running
test262, finding that the tests that we have disabled due to lack of Annex B
support now pass.
R=adamk,rossberg
LOG=Y
BUG=v8:4285
Review URL: https://codereview.chromium.org/
1332873003
Cr-Commit-Position: refs/heads/master@{#30842}
alph [Sun, 20 Sep 2015 16:40:19 +0000 (09:40 -0700)]
Reland of Make profiler no frame region detection code more robust [ia86/x64]
Upon collection of the stack trace if the current PC falls into
the frame building code, the top frame might be in a non-consistent
state. That leads to some of the frames could be missing from the
stack trace.
The patch makes it check instructions under current PC and if they
look like the frame setup/destroy code, it skips the entire sample.
Support for x86/x64
CG_INCLUDE_TRYBOTS=tryserver.v8:v8_linux64_msan_rel
BUG=chromium:529931
LOG=N
Review URL: https://codereview.chromium.org/
1348533005
Cr-Commit-Position: refs/heads/master@{#30841}