Commits · 9b421f269054f62bef81eb78119c9721cf17760c · Linshizhi / V8

02 Dec, 2015 39 commits

Revert of [heap] Refactor evacuation for young and old gen into visitors.... · 9b421f26

mlippautz authored Dec 02, 2015

Revert of [heap] Refactor evacuation for young and old gen into visitors. (patchset #1 id:1 of https://codereview.chromium.org/1493523003/ )

Reason for revert:
Speculative revert for crashing Canary.

Original issue's description:
> Reland of [heap] Refactor evacuation for young and old gen into visitors. (patchset #1 id:1 of https://codereview.chromium.org/1483393002/ )
>
> Reason for revert:
> Reland after fixing the potential root cause of the canary crasher.
>
> Original issue's description:
> > Revert of [heap] Refactor evacuation for young and old gen into visitors. (patchset #5 id:80001 of https://codereview.chromium.org/1470253002/ )
> >
> > Reason for revert:
> > Still investigating bad canary.
> >
> > Original issue's description:
> > > [heap] Refactor evacuation for young and old gen into visitors.
> > >
> > > Create a visitor for evacuating objects for young and old generation. This is
> > > the first step of preparing a task to process, both,  newspace and oldspace
> > > pages in parallel.
> > >
> > > BUG=chromium:524425
> > > LOG=N
> > >
> > > Committed: https://crrev.com/138d9bae5d7014e0d205634a49b5eac3697744c8
> > > Cr-Commit-Position: refs/heads/master@{#32349}
> >
> > TBR=mlippautz@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=chromium:524425
> >
> > Committed: https://crrev.com/aa24a3135ec308e1f84bce334844caf0cae2437a
> > Cr-Commit-Position: refs/heads/master@{#32462}
>
> TBR=mlippautz@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:524425
>
> Committed: https://crrev.com/120b640dfce5f02cecc5af72ca0b2b3b93ce8652
> Cr-Commit-Position: refs/heads/master@{#32500}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1495583002

Cr-Commit-Position: refs/heads/master@{#32522}

9b421f26

Revert of [heap] Unify evacuating an object for new and old generation.... · e35e8c9d

mlippautz authored Dec 02, 2015

Revert of [heap] Unify evacuating an object for new and old generation. (patchset #1 id:1 of https://codereview.chromium.org/1494533002/ )

Reason for revert:
Speculative revert for crashing Canary.

Original issue's description:
> Reland of [heap] Unify evacuating an object for new and old generation. (patchset #1 id:1 of https://codereview.chromium.org/1483963004/ )
>
> Reason for revert:
> Reland after fixing the potential root cause of the canary crasher.
>
> Original issue's description:
> > Revert of [heap] Unify evacuating an object for new and old generation. (patchset #2 id:20001 of https://codereview.chromium.org/1481873002/ )
> >
> > Reason for revert:
> > Still investigating bad canary.
> >
> > Original issue's description:
> > > [heap] Unify evacuating an object for new and old generation.
> > >
> > > BUG=chromium:524425
> > > LOG=N
> > >
> > > Committed: https://crrev.com/afb8bcce8ba889280ed747eb218d287ddd233b4a
> > > Cr-Commit-Position: refs/heads/master@{#32365}
> >
> > TBR=mlippautz@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=chromium:524425
> >
> > Committed: https://crrev.com/9c60ddc60e96da0c59e646660789c26550ad52a2
> > Cr-Commit-Position: refs/heads/master@{#32460}
>
> TBR=mlippautz@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:524425
>
> Committed: https://crrev.com/7ea8ac98f6eb5ffa9d4976aa22fec9befb814e0c
> Cr-Commit-Position: refs/heads/master@{#32501}

TBR=hpayer@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1491013003

Cr-Commit-Position: refs/heads/master@{#32521}

e35e8c9d

Revert of "[heap] Clean up stale store buffer entries for aborted pages."... · 23227681

mlippautz authored Dec 02, 2015

Revert of "[heap] Clean up stale store buffer entries for aborted pages." (patchset #3 id:40001 of https://codereview.chromium.org/1494503004/ )

Reason for revert:
Still failing on GC stress
  https://chromegw.corp.google.com/i/client.v8/builders/V8%20Linux%20-%20gc%20stress/builds/690

Original issue's description:
> Reland of "[heap] Clean up stale store buffer entries for aborted pages."
>
> This reverts commit d4fc4a8c.
>
> 1.  Let X be the aborted slot (slot in an evacuated object in an aborted page)
> 2.  Assume X contains pointer to Y and Y is in the new space, so X is in the
>     store buffer.
> 3.  Store buffer rebuilding will not filter out X (it checks InNewSpace(Y)).
> 4.  The current mark-sweep finishes. The slot X is in free space and is also in
>     the store buffer.
> 5.  A string of length 9 "abcdefghi" is allocated in the new space. The string
>     looks like |MAP|LENGTH|hgfedcba|NNNNNNNi| in memory, where NNNNNNN is
>     previous garbage. Let's assume that NNNNNNN0 was pointing to a new space
>     object before.
> 6.  Scavenge happens.
> 7.  Slot X is still in free space and in store buffer. [It causes scavenge of
>     the object Y in
>     store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject). But
>     it is not important].
> 8.  Our string is promoted and is allocated over the slot X, such that NNNNNNNi
>     is written in X.
> 9.  The scavenge finishes.
> 9.  Another scavenge starts.
> 10. We crash in
>     store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject) when
>     processing slot X, because it doesn't point to valid map.
>
> BUG=chromium:524425, chromium:564498
> LOG=N
> R=hpayer@chromium.org, ulan@chromium.org
>
> Committed: https://crrev.com/fc6ff534003480e49dc481d9c665e961ab709c02
> Cr-Commit-Position: refs/heads/master@{#32514}

TBR=hpayer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425, chromium:564498

Review URL: https://codereview.chromium.org/1492823002

Cr-Commit-Position: refs/heads/master@{#32520}

23227681

[turbofan] Optimize %_IsJSReceiver based on input type. · ddb9f461

bmeurer authored Dec 02, 2015

We can constant fold %_IsJSReceiver(x) based on whether x is always a
receiver or can never be a receiver.  This is important as
%_IsJSReceiver is inserted by the JSInliner.

R=jarin@chromium.org
BUG=v8:4544
LOG=n

Review URL: https://codereview.chromium.org/1486383003

Cr-Commit-Position: refs/heads/master@{#32519}

ddb9f461

Account for embedded constant pool pointer in Live Edit frame. · d0b30d02

mbrandy authored Dec 02, 2015

R=mvstanton@chromium.org, yangguo@chromium.org
BUG=

Review URL: https://codereview.chromium.org/1491683003

Cr-Commit-Position: refs/heads/master@{#32518}

d0b30d02

[debugger] fix liveedit in combination with step in. · e1866c8f

yangguo authored Dec 02, 2015

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1493733002

Cr-Commit-Position: refs/heads/master@{#32517}

e1866c8f

[debugger] simplify reloc info for debug break slots. · 531dde9f

yangguo authored Dec 02, 2015

The new step-in implementation no longer tries to predict the step-in
target, so we don't need the arguments count nor call type anymore.

R=verwaest@chromium.org

Review URL: https://codereview.chromium.org/1484893003

Cr-Commit-Position: refs/heads/master@{#32516}

531dde9f

X87: [turbofan] Implemented the optional Float32RoundUp operator. · 7d6c5666

zhengxing.li authored Dec 02, 2015

  port 4f494789 (r32262)

  original commit message:
  The Float32RoundUp operator rounds float32 numbers towards infinity.
  The operator is currently implemented on x64, ia32, arm, and arm64.

BUG=

Review URL: https://codereview.chromium.org/1491843003

Cr-Commit-Position: refs/heads/master@{#32515}

7d6c5666

Reland of "[heap] Clean up stale store buffer entries for aborted pages." · fc6ff534

mlippautz authored Dec 02, 2015

This reverts commit d4fc4a8c.

1.  Let X be the aborted slot (slot in an evacuated object in an aborted page)
2.  Assume X contains pointer to Y and Y is in the new space, so X is in the
    store buffer.
3.  Store buffer rebuilding will not filter out X (it checks InNewSpace(Y)).
4.  The current mark-sweep finishes. The slot X is in free space and is also in
    the store buffer.
5.  A string of length 9 "abcdefghi" is allocated in the new space. The string
    looks like |MAP|LENGTH|hgfedcba|NNNNNNNi| in memory, where NNNNNNN is
    previous garbage. Let's assume that NNNNNNN0 was pointing to a new space
    object before.
6.  Scavenge happens.
7.  Slot X is still in free space and in store buffer. [It causes scavenge of
    the object Y in
    store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject). But
    it is not important].
8.  Our string is promoted and is allocated over the slot X, such that NNNNNNNi
    is written in X.
9.  The scavenge finishes.
9.  Another scavenge starts.
10. We crash in
    store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject) when
    processing slot X, because it doesn't point to valid map.

BUG=chromium:524425, chromium:564498
LOG=N
R=hpayer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1494503004

Cr-Commit-Position: refs/heads/master@{#32514}

fc6ff534

[runtime] Rename IsPropertyEnumerable to PropertyIsEnumerable conforming to the spec. · 535e221d
cbruni authored Dec 02, 2015
```
BUG=

Review URL: https://codereview.chromium.org/1491613002

Cr-Commit-Position: refs/heads/master@{#32513}
```
535e221d

Revert of [CQ] Update proto format to fix triggered builders. (patchset #1... · 1125f160

machenbach authored Dec 02, 2015

Revert of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1495443003/ )

Reason for revert:
Still not working

Original issue's description:
> Reland of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1485813004/ )
>
> Reason for revert:
> Should be fixed after https://codereview.chromium.org/1487413002/
>
> Original issue's description:
> > Revert of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1486963002/ )
> >
> > Reason for revert:
> > Maybe causing problems
> >
> > Original issue's description:
> > > [CQ] Update proto format to fix triggered builders.
> > >
> > > Depends on https://chromereviews.googleplex.com/319777013/
> > >
> > > BUG=chromium:561530
> > > LOG=n
> > > TBR=sergiyb@chromium.org, tandrii@chromium.org
> > > NOTRY=true
> > >
> > > Committed: https://crrev.com/51d6d619330080a76c5bc7a2ebdafebc6a808aa8
> > > Cr-Commit-Position: refs/heads/master@{#32453}
> >
> > TBR=sergiyb@chromium.org,tandrii@chromium.org
> > NOPRESUBMIT=true
> > NOTREECHECKS=true
> > NOTRY=true
> > BUG=chromium:561530
> >
> > Committed: https://crrev.com/79ded5acc9da6a80cbd739c24c6dfa0cf207ae93
> > Cr-Commit-Position: refs/heads/master@{#32464}
>
> TBR=sergiyb@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:561530
>
> Committed: https://crrev.com/3cea13351c1af365013f51c7b67e72eeba79afe6
> Cr-Commit-Position: refs/heads/master@{#32511}

TBR=sergiyb@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:561530

Review URL: https://codereview.chromium.org/1493693003

Cr-Commit-Position: refs/heads/master@{#32512}

1125f160

Reland of [CQ] Update proto format to fix triggered builders. (patchset #1... · 3cea1335

machenbach authored Dec 02, 2015

Reland of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1485813004/ )

Reason for revert:
Should be fixed after https://codereview.chromium.org/1487413002/

Original issue's description:
> Revert of [CQ] Update proto format to fix triggered builders. (patchset #1 id:1 of https://codereview.chromium.org/1486963002/ )
>
> Reason for revert:
> Maybe causing problems
>
> Original issue's description:
> > [CQ] Update proto format to fix triggered builders.
> >
> > Depends on https://chromereviews.googleplex.com/319777013/
> >
> > BUG=chromium:561530
> > LOG=n
> > TBR=sergiyb@chromium.org, tandrii@chromium.org
> > NOTRY=true
> >
> > Committed: https://crrev.com/51d6d619330080a76c5bc7a2ebdafebc6a808aa8
> > Cr-Commit-Position: refs/heads/master@{#32453}
>
> TBR=sergiyb@chromium.org,tandrii@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:561530
>
> Committed: https://crrev.com/79ded5acc9da6a80cbd739c24c6dfa0cf207ae93
> Cr-Commit-Position: refs/heads/master@{#32464}

TBR=sergiyb@chromium.org,tandrii@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:561530

Review URL: https://codereview.chromium.org/1495443003

Cr-Commit-Position: refs/heads/master@{#32511}

3cea1335

[Release] CC hpayer@ and ulan@ to every heap change · 424b246b

hablich authored Dec 02, 2015

NOTRY=true
TBR=hpayer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1490263002

Cr-Commit-Position: refs/heads/master@{#32510}

424b246b

Pass explicit Isolate parameter to v8::Debug methods that need it · 6c0d1a11

jochen authored Dec 02, 2015

BUG=v8:2487
LOG=n
R=vogelheim@chromium.org

Review URL: https://codereview.chromium.org/1496493002

Cr-Commit-Position: refs/heads/master@{#32509}

6c0d1a11

[stubs] A new approach to TF stubs · 3e7e3ed7

danno authored Dec 02, 2015

* Add a sibling interface to InterpreterAssembler called
  CodeStubAssembler which provides a wrapper around the
  RawMachineAssembler and is intented to make it easy to build
  efficient cross-platform code stubs. Much of the implementation
  of CodeStubAssembler is shamelessly stolen from the
  InterpreterAssembler, and the idea is to eventually merge the
  two interfaces somehow, probably moving the
  InterpreterAssembler interface over to use the
  CodeStubAssembler. Short-term, however, the two interfaces
  shall remain decoupled to increase our velocity developing the
  two systems in parallel.
* Implement the StringLength stub in TurboFan with the new
  CodeStubAssembler. Replace and remove the old Hydrogen-stub
  version.
* Remove a whole slew of machinery to support JavaScript-style
  code stub generation, since it ultimately proved unwieldy,
  brittle and baroque. This cleanup includes removing the shared
  code stub context, several example stubs and a tangle of build
  file changes.

BUG=v8:4587
LOG=n

Review URL: https://codereview.chromium.org/1475953002

Cr-Commit-Position: refs/heads/master@{#32508}

3e7e3ed7

[proxies] Implement the Proxy constructor in C++ fully. · 2377170d

bmeurer authored Dec 02, 2015

The main part of the Proxy constructor was already in C++, there's
actually no point in keeping a JavaScript wrapper.

R=cbruni@chromium.org
BUG=v8:1543
LOG=n

Review URL: https://codereview.chromium.org/1491893002

Cr-Commit-Position: refs/heads/master@{#32507}

2377170d

[runtime] Adding more detailed error message for Object::GetMethod. · 9cffd0d2
cbruni authored Dec 02, 2015
```
BUG=

Review URL: https://codereview.chromium.org/1484393002

Cr-Commit-Position: refs/heads/master@{#32506}
```
9cffd0d2

[builtins] Some refactoring on the builtin mechanism. · 4013a8df

bmeurer authored Dec 02, 2015

Allow to pass new.target (in addition to target) to C++ builtins, and
remove some obsolete/dangerous code from the C++ builtins.

R=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1491883002

Cr-Commit-Position: refs/heads/master@{#32505}

4013a8df

Revert of [heap] Clean up stale store buffer entries for aborted pages.... · d4fc4a8c

mlippautz authored Dec 02, 2015

Revert of [heap] Clean up stale store buffer entries for aborted pages. (patchset #4 id:60001 of https://codereview.chromium.org/1493653002/ )

Reason for revert:
Not completely correct fix.

Original issue's description:
> [heap] Clean up stale store buffer entries for aborted pages.
>
> 1.  Let X be the aborted slot (slot in an evacuated object in an aborted page)
> 2.  Assume X contains pointer to Y and Y is in the new space, so X is in the
>     store buffer.
> 3.  Store buffer rebuilding will not filter out X (it checks InNewSpace(Y)).
> 4.  The current mark-sweep finishes. The slot X is in free space and is also in
>     the store buffer.
> 5.  A string of length 9 "abcdefghi" is allocated in the new space. The string
>     looks like |MAP|LENGTH|hgfedcba|NNNNNNNi| in memory, where NNNNNNN is
>     previous garbage. Let's assume that NNNNNNN0 was pointing to a new space
>     object before.
> 6.  Scavenge happens.
> 7.  Slot X is still in free space and in store buffer. [It causes scavenge of
>     the object Y in
>     store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject). But
>     it is not important].
> 8.  Our string is promoted and is allocated over the slot X, such that NNNNNNNi
>     is written in X.
> 9.  The scavenge finishes.
> 9.  Another scavenge starts.
> 10. We crash in
>     store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject) when
>     processing slot X, because it doesn't point to valid map.
>
> BUG=chromium:524425,chromium:564498
> LOG=N
> R=hpayer@chromium.org, ulan@chromium.org
>
> Committed: https://crrev.com/2e7eea4aef3403969fe885e30f892d46253b3572
> Cr-Commit-Position: refs/heads/master@{#32495}

TBR=hpayer@chromium.org,ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425,chromium:564498

Review URL: https://codereview.chromium.org/1489243004

Cr-Commit-Position: refs/heads/master@{#32504}

d4fc4a8c

Reland of [heap] Remove live weak cells from weak cell list when finalizing... · 09032dad

hpayer authored Dec 02, 2015

Reland of [heap] Remove live weak cells from weak cell list when finalizing incremental marking. (patchset #1 id:1 of https://codereview.chromium.org/1481383004/ )

Reason for revert:
Reland after fixing the potential root cause of the canary crasher.

Original issue's description:
> Revert of [heap] Remove live weak cells from weak cell list when finalizing incremental marking. (patchset #3 id:40001 of https://codereview.chromium.org/1474303002/ )
>
> Reason for revert:
> Still investigating bad canary.
>
> Original issue's description:
> > [heap] Remove live weak cells from weak cell list when finalizing incremental marking.
> >
> > BUG=chromium:548562
> > LOG=n
> >
> > Committed: https://crrev.com/6190c608c8f3ced0f00ff53965e115b78646cecd
> > Cr-Commit-Position: refs/heads/master@{#32372}
>
> TBR=ulan@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:548562
>
> Committed: https://crrev.com/72ae472ccc51ec304a66a8730c1fedbe265c16fa
> Cr-Commit-Position: refs/heads/master@{#32459}

TBR=ulan@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:548562

Review URL: https://codereview.chromium.org/1491743003

Cr-Commit-Position: refs/heads/master@{#32503}

09032dad

Reland of [heap] Cleanup mark bit usage. (patchset #1 id:1 of... · 0240d202

hpayer authored Dec 02, 2015

Reland of [heap] Cleanup mark bit usage. (patchset #1 id:1 of https://codereview.chromium.org/1490753003/ )

Reason for revert:
Reland after fixing the potential root cause of the canary crasher.

Original issue's description:
> Revert of [heap] Cleanup mark bit usage. (patchset #1 id:1 of https://codereview.chromium.org/1474203003/ )
>
> Reason for revert:
> Still investigating bad canary.
>
> Original issue's description:
> > [heap] Cleanup mark bit usage.
> >
> > BUG=
> >
> > Committed: https://crrev.com/5874ac783ff9bc4bb4b2fda81f5077f06619f96c
> > Cr-Commit-Position: refs/heads/master@{#32362}
>
> TBR=mlippautz@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=
>
> Committed: https://crrev.com/d3faef8658598e68331208b5a1846ac1c250cb49
> Cr-Commit-Position: refs/heads/master@{#32461}

TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=

Review URL: https://codereview.chromium.org/1488393003

Cr-Commit-Position: refs/heads/master@{#32502}

0240d202

Reland of [heap] Unify evacuating an object for new and old generation.... · 7ea8ac98

hpayer authored Dec 02, 2015

Reland of [heap] Unify evacuating an object for new and old generation. (patchset #1 id:1 of https://codereview.chromium.org/1483963004/ )

Reason for revert:
Reland after fixing the potential root cause of the canary crasher.

Original issue's description:
> Revert of [heap] Unify evacuating an object for new and old generation. (patchset #2 id:20001 of https://codereview.chromium.org/1481873002/ )
>
> Reason for revert:
> Still investigating bad canary.
>
> Original issue's description:
> > [heap] Unify evacuating an object for new and old generation.
> >
> > BUG=chromium:524425
> > LOG=N
> >
> > Committed: https://crrev.com/afb8bcce8ba889280ed747eb218d287ddd233b4a
> > Cr-Commit-Position: refs/heads/master@{#32365}
>
> TBR=mlippautz@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:524425
>
> Committed: https://crrev.com/9c60ddc60e96da0c59e646660789c26550ad52a2
> Cr-Commit-Position: refs/heads/master@{#32460}

TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1494533002

Cr-Commit-Position: refs/heads/master@{#32501}

7ea8ac98

Reland of [heap] Refactor evacuation for young and old gen into visitors.... · 120b640d

hpayer authored Dec 02, 2015

Reland of [heap] Refactor evacuation for young and old gen into visitors. (patchset #1 id:1 of https://codereview.chromium.org/1483393002/ )

Reason for revert:
Reland after fixing the potential root cause of the canary crasher.

Original issue's description:
> Revert of [heap] Refactor evacuation for young and old gen into visitors. (patchset #5 id:80001 of https://codereview.chromium.org/1470253002/ )
>
> Reason for revert:
> Still investigating bad canary.
>
> Original issue's description:
> > [heap] Refactor evacuation for young and old gen into visitors.
> >
> > Create a visitor for evacuating objects for young and old generation. This is
> > the first step of preparing a task to process, both,  newspace and oldspace
> > pages in parallel.
> >
> > BUG=chromium:524425
> > LOG=N
> >
> > Committed: https://crrev.com/138d9bae5d7014e0d205634a49b5eac3697744c8
> > Cr-Commit-Position: refs/heads/master@{#32349}
>
> TBR=mlippautz@chromium.org
> NOPRESUBMIT=true
> NOTREECHECKS=true
> NOTRY=true
> BUG=chromium:524425
>
> Committed: https://crrev.com/aa24a3135ec308e1f84bce334844caf0cae2437a
> Cr-Commit-Position: refs/heads/master@{#32462}

TBR=mlippautz@chromium.org
NOPRESUBMIT=true
NOTREECHECKS=true
NOTRY=true
BUG=chromium:524425

Review URL: https://codereview.chromium.org/1493523003

Cr-Commit-Position: refs/heads/master@{#32500}

120b640d

MIPS: Correct handling of Nan values on MIPS R6 · 60d77c8a

ivica.bogosavljevic authored Dec 02, 2015

MIPS R6 introduced new behavior for handling of NaN values
for TRUNC, FLOOR, CEIL and CVT instructions. Adding support for
the new behavior in MIPS and MIPS64 simulators. Fixing tests
for MIPS and MIPS64 to align them with the new behavior.

BUG=

Review URL: https://codereview.chromium.org/1488613007

Cr-Commit-Position: refs/heads/master@{#32499}

60d77c8a

[turbofan] Initial support for escape analysis. · aa0ddf7d

sigurds authored Dec 02, 2015

This is the first part of escape analysis for turbofan.
At the moment, there is no deopt support, and support
for loops is partial (only binary Phis are handled).

The CL includes 4 unittests.

There are also 8 new mjsunit tests, some of which are
skiped as they require features not yet implemented.

BUG=v8:4586
LOG=n

Review URL: https://codereview.chromium.org/1457683003

Cr-Commit-Position: refs/heads/master@{#32498}

aa0ddf7d

Don't EnsureHasInitialMap on non-constructors. · 9bee6750

verwaest authored Dec 02, 2015

non-constructors are not allowed to have initial maps. The optimizing compilers used to add initial maps unconditionally to functions used as right-hand-side in instanceof.

BUG=

Review URL: https://codereview.chromium.org/1490003003

Cr-Commit-Position: refs/heads/master@{#32497}

9bee6750

[proxies] Implement Symbol/DONT_ENUM filtering for GetKeys() · e478a8ac

jkummerow authored Dec 02, 2015

And use it to fix Object.keys() for proxies.

BUG=v8:1543
LOG=n
R=cbruni@chromium.org

Review URL: https://codereview.chromium.org/1488873003

Cr-Commit-Position: refs/heads/master@{#32496}

e478a8ac

[heap] Clean up stale store buffer entries for aborted pages. · 2e7eea4a

mlippautz authored Dec 02, 2015

1.  Let X be the aborted slot (slot in an evacuated object in an aborted page)
2.  Assume X contains pointer to Y and Y is in the new space, so X is in the
    store buffer.
3.  Store buffer rebuilding will not filter out X (it checks InNewSpace(Y)).
4.  The current mark-sweep finishes. The slot X is in free space and is also in
    the store buffer.
5.  A string of length 9 "abcdefghi" is allocated in the new space. The string
    looks like |MAP|LENGTH|hgfedcba|NNNNNNNi| in memory, where NNNNNNN is
    previous garbage. Let's assume that NNNNNNN0 was pointing to a new space
    object before.
6.  Scavenge happens.
7.  Slot X is still in free space and in store buffer. [It causes scavenge of
    the object Y in
    store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject). But
    it is not important].
8.  Our string is promoted and is allocated over the slot X, such that NNNNNNNi
    is written in X.
9.  The scavenge finishes.
9.  Another scavenge starts.
10. We crash in
    store_buffer()->IteratePointersToNewSpace(&Scavenger::ScavengeObject) when
    processing slot X, because it doesn't point to valid map.

BUG=chromium:524425,chromium:564498
LOG=N
R=hpayer@chromium.org, ulan@chromium.org

Review URL: https://codereview.chromium.org/1493653002

Cr-Commit-Position: refs/heads/master@{#32495}

2e7eea4a

[es6] correctly handle object wrappers in JSON.stringify. · 62dcf2fa

yangguo authored Dec 02, 2015

R=bmeurer@chromium.org
BUG=v8:4581
LOG=N

Review URL: https://codereview.chromium.org/1495473002

Cr-Commit-Position: refs/heads/master@{#32494}

62dcf2fa

Clobber to hopefully resolve a clang problem · 4fb84b9d

hablich authored Dec 02, 2015

BUG=chromium:500934
LOG=N
TBR=yangguo@chromium.org

Review URL: https://codereview.chromium.org/1486343003

Cr-Commit-Position: refs/heads/master@{#32493}

4fb84b9d

X87: [turbofan] Implemented the optional Float32RoundDown operator. · ed679e52

zhengxing.li authored Dec 02, 2015

  port 74434403 (r32261)

  original commit message:
  I implemented the optional Float32RoundDown operator on x64, ia32, arm,
  and arm64.

  For arm I also had to adjust the simulator.

BUG=

Review URL: https://codereview.chromium.org/1490113003

Cr-Commit-Position: refs/heads/master@{#32492}

ed679e52

[builtins] Remove some (now) unused code from C++ builtin adaptor. · f618401a

bmeurer authored Dec 02, 2015

Sanitize ConstructStub handling and add a test case to ensure that the
Symbol constructor is using the correct context.

R=jarin@chromium.org
BUG=v8:4413
LOG=n

Review URL: https://codereview.chromium.org/1489323002

Cr-Commit-Position: refs/heads/master@{#32491}

f618401a

X87: [turbofan] Added the optional Float64RoundTiesEven operator to turbofan. · a0134a6d

zhengxing.li authored Dec 02, 2015

  port dffecf31 (r32005)

  original commit message:
  The TiesEven rounding mode rounds float64 numbers to the nearest
  integer. If there are two nearest integers, then the number is rounded
  to the even one.  This is the default rounding mode according to
  IEEE~754.

  I implemented the operator on ia32, x64, arm, arm64, mips, and mips64.

  I think there is a bug in the current implementation of the ppc
  simulator, which kept me from implementing the operator on ppc.
  According to my understanding of the ppc instruction manual, the FRIN
  instruction provides the right behavior for Float64RoundTiesEven. In the
  simulator, however, FRIN provides a different semantics. If there are
  two nearest integers, then the simulator returns the one which is
  further away form 0.

BUG=

Review URL: https://codereview.chromium.org/1486323003

Cr-Commit-Position: refs/heads/master@{#32490}

a0134a6d

X87: Array constructor failed to enter it's function execution context. · 48795506

zhengxing.li authored Dec 02, 2015

  port d2f78c6b (r32476)

  original commit message:
  This becomes visible if an exception is thrown by the constructor.
  We do this on "new Array(3.5)", throwing a RangeError.

BUG=

Review URL: https://codereview.chromium.org/1491153002

Cr-Commit-Position: refs/heads/master@{#32489}

48795506

X87: Provide call counts for constructor calls, surface them as a vector IC. · 54a9d349

zhengxing.li authored Dec 02, 2015

  port 66d5a9df (r32452)

  original commit message:
  CallIC and CallConstructStub look so alike, at least in the feedback they gather even if the implementation differs...and CallIC has such a nice way of surfacing the feedback (CallICNexus), that there

BUG=

Review URL: https://codereview.chromium.org/1491063003

Cr-Commit-Position: refs/heads/master@{#32488}

54a9d349

X87: [debugger] Remove code to predict step-in target. · ee29b94a

zhengxing.li authored Dec 02, 2015

  port 2f559f21 (r32449)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1494453002

Cr-Commit-Position: refs/heads/master@{#32487}

ee29b94a

X87: [x86] Sane default for Label::Distance on JumpIfRoot/JumpIfNotRoot. · a7ec7ebd

zhengxing.li authored Dec 02, 2015

  port c83db2d0 (r32456)

  original commit message:

BUG=

Review URL: https://codereview.chromium.org/1487293002

Cr-Commit-Position: refs/heads/master@{#32486}

a7ec7ebd

Update V8 DEPS. · 44ec3397

v8-autoroll authored Dec 02, 2015

Rolling v8/build/gyp to e2313c02ad7b6d589b38fe578f5d39970a9bbc20

Rolling v8/tools/clang to 3cc3dac50b26c67176bfed187a300741f31651bf

TBR=machenbach@chromium.org,vogelheim@chromium.org,hablich@chromium.org

Review URL: https://codereview.chromium.org/1491133002

Cr-Commit-Position: refs/heads/master@{#32485}

44ec3397

X87: [turbofan] Added the optional Float64RoundUp operator to turbofan. · 0b94c998

zhengxing.li authored Dec 02, 2015

  port 1389b9f5 (r32004)

  original commit message:
  I implemented it on x64, ia32, arm, arm64, mips, mips64, and ppc.

BUG=

Review URL: https://codereview.chromium.org/1488993002

Cr-Commit-Position: refs/heads/master@{#32484}

0b94c998

01 Dec, 2015 1 commit

[bootstrapper] no longer use outdated contexts list. · 564a2086

yangguo authored Dec 01, 2015

We currently use the outdated contexts list provided by the serializer
to update the receiver (the global proxy) in script contexts. However,
this is not actually necessary, since the global proxy is passed to the
deserializer and replaced as we deserialize.

Originally, the outdated contexts list is to update the global object
field in contexts. This was necessary since at the time the deserializer
creates the native context, the global object has not yet been created.
But the global proxy already exists.

R=bmeurer@chromium.org

Review URL: https://codereview.chromium.org/1488873004

Cr-Commit-Position: refs/heads/master@{#32483}

564a2086