Commits · c7e8f23754dcb4c904ccbe3d4885d0b198cd135e · Linshizhi / V8

12 Jul, 2017 24 commits

[compiler] Move the wasm pipeline's code assembly pass into the background. · c7e8f237

Georg Neis authored Jul 07, 2017

R=ahaas@chromium.org, bmeurer@chromium.org

Bug: v8:6048
Change-Id: I5641cb1036fb0c6bf0803de3df9ddeb5787a93de
Reviewed-on: https://chromium-review.googlesource.com/563308Reviewed-by: Andreas Haas <ahaas@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Ben Titzer <titzer@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46593}

c7e8f237

Revert "[mjsunit] Improve mjsunit stracktrace readability" · c86ad81b

Georg Neis authored Jul 12, 2017

This reverts commit f720d024.

Reason for revert: Bot failure at
https://build.chromium.org/p/client.v8/builders/V8%20Linux64%20-%20custom%20snapshot%20-%20debug/builds/15690

Original change's description:
> [mjsunit] Improve mjsunit stracktrace readability
> 
> Format the function name and file-position into proper columns to easily spot
> where the test code ends and the mjsunit framework code starts.
> 
> BEFORE:
> Stack: Error
>     at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
>     at failWithMessage (test/mjsunit/mjsunit.js:310:11)
>     at fail (test/mjsunit/mjsunit.js:327:12)
>     at assertEquals (test/mjsunit/mjsunit.js:398:7)
>     at closure (test/mjsunit/regress/regress-4121.js:20:7)
>     at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
>     at test (test/mjsunit/regress/regress-4121.js:37:5)
>     at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
>     at test/mjsunit/regress/regress-4121.js:49:6
>     at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
>     throw new MjsUnitAssertionError(message);
> 
> AFTER:
> Stack: MjsUnitAssertionError
>     at assertEquals          test/mjsunit/mjsunit.js 398:7
>     at closure               test/mjsunit/regress/regress-4121.js 20:7
>     at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
>     at test                  test/mjsunit/regress/regress-4121.js 37:5
>     at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
>     at                       test/mjsunit/regress/regress-4121.js 49:6
>     at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
>     throw new MjsUnitAssertionError(message);
> 
> 
> Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
> Reviewed-on: https://chromium-review.googlesource.com/563627
> Reviewed-by: Michael Achenbach <machenbach@chromium.org>
> Reviewed-by: Igor Sheludko <ishell@chromium.org>
> Commit-Queue: Camillo Bruni <cbruni@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46589}

TBR=machenbach@chromium.org,cbruni@chromium.org,ishell@chromium.org

Change-Id: I631cec7f318637ce2f60500e2bf0ab7fe1f6d09e
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Reviewed-on: https://chromium-review.googlesource.com/567062Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46592}

c86ad81b

No longer disable double field tracking for serialized isolates. · bc16cd0c

Yang Guo authored Jul 11, 2017

Previously, the serializer would share mutable heap numbers between
contexts. The workaround was to disable double field tracking entirely
during bootstrapping of isolates preparing to be serialized.

This does not cover custom scripts run between bootstrapping and
serialization, and can cause race conditions when writing to the flag.

This no longer seems necessary since we can correctly tell mutable and
immutable heap numbers apart by instance type now.

Bug: v8:6585
Change-Id: I7a59ffaad9d96f1c2b08813e19505f4fda95e555
Reviewed-on: https://chromium-review.googlesource.com/566861Reviewed-by: Yang Guo <yangguo@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46591}

bc16cd0c

[coverage] Move source ranges out of AST · 645a1ea5

jgruber authored Jul 12, 2017

This CL moves collected source range information out of AST nodes
and into a side table stored on ParseInfo. The side table is only 
created if block coverage is enabled, so there's almost no memory
overhead in the standard case.

Change-Id: I41871b8425ebbc6217d82d3ad26b5fc9e5d68ecb
Reviewed-on: https://chromium-review.googlesource.com/566808
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46590}

645a1ea5

[mjsunit] Improve mjsunit stracktrace readability · f720d024

Camillo Bruni authored Jul 12, 2017

Format the function name and file-position into proper columns to easily spot
where the test code ends and the mjsunit framework code starts.

BEFORE:
Stack: Error
    at new MjsUnitAssertionError (test/mjsunit/mjsunit.js:36:18)
    at failWithMessage (test/mjsunit/mjsunit.js:310:11)
    at fail (test/mjsunit/mjsunit.js:327:12)
    at assertEquals (test/mjsunit/mjsunit.js:398:7)
    at closure (test/mjsunit/regress/regress-4121.js:20:7)
    at literals_sharing_test (test/mjsunit/regress/regress-4121.js:27:3)
    at test (test/mjsunit/regress/regress-4121.js:37:5)
    at eval (eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6), <anonymous>:1:1)
    at test/mjsunit/regress/regress-4121.js:49:6
    at Array.forEach.call (test/mjsunit/regress/regress-4121.js:50:7)
    throw new MjsUnitAssertionError(message);

AFTER:
Stack: MjsUnitAssertionError
    at assertEquals          test/mjsunit/mjsunit.js 398:7
    at closure               test/mjsunit/regress/regress-4121.js 20:7
    at literals_sharing_test test/mjsunit/regress/regress-4121.js 27:3
    at test                  test/mjsunit/regress/regress-4121.js 37:5
    at eval                  eval at <anonymous> (test/mjsunit/regress/regress-4121.js:49:6)
    at                       test/mjsunit/regress/regress-4121.js 49:6
    at Array.forEach.call    test/mjsunit/regress/regress-4121.js 50:7
    throw new MjsUnitAssertionError(message);


Change-Id: Iad3460a648e26effb43c00426ab043743ee6a138
Reviewed-on: https://chromium-review.googlesource.com/563627Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Reviewed-by: Igor Sheludko <ishell@chromium.org>
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46589}

f720d024

Implement micro-benchmark for Proxy call and construct · 7280d03b

Maya Lekova authored Jul 12, 2017

Bug: v8:6558, v8:6557
Change-Id: Ife58f78d00bfd53d6b904e838cbd028f039945b4
Reviewed-on: https://chromium-review.googlesource.com/567501
Commit-Queue: Maya Lekova <mslekova@google.com>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46588}

7280d03b

[parser] Disallow async functions as destructuring targets · cad3c5a1

Daniel Ehrenberg authored Jul 11, 2017

This patch teaches the parser that async functions are not valid
destructuring targets so that it can cleanly exit with a SyntaxError.
Previously, async functions used in the wrong position would lead
to a check failure.

Bug: chromium:740366
Change-Id: Ie5b0cf50326c3f96174c6b29d0ccedb5da4f75a2
Reviewed-on: https://chromium-review.googlesource.com/567002Reviewed-by: Adam Klein <adamk@chromium.org>
Reviewed-by: Caitlin Potter <caitp@igalia.com>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46587}

cad3c5a1

[utils] Make Abs return an unsigned value · 869dd9b3

Clemens Hammacher authored Jul 12, 2017

In most cases, this does not matter, especially if assigning to the
source variable again:
x = Abs(x)

But there are cases where it matters, e.g. when being used as argument
to a template function:
DCHECK_EQ(x, Abs(x));
which would currently *not* fail for x==kMinInt.

R=tebbi@chromium.org

Change-Id: Ia5abfe164db602b80a34548e0bf9b22033b77c6e
Reviewed-on: https://chromium-review.googlesource.com/568028Reviewed-by: Tobias Tebbi <tebbi@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46586}

869dd9b3

[turbofan] Fix inline JSGeneratorObject allocation. · 0a4ad440

Michael Starzinger authored Jul 12, 2017

This makes sure the inline allocation of generator objects only shrinks
initial maps when slack tracking is actually in progress. Shrinking all
unused properties unconditionally is bogus because instances using them
might have become unreachable and collected by the GC.

R=mvstanton@chromium.org
TEST=mjsunit/regress/regress-crbug-741078
BUG=chromium:741078

Change-Id: Iaf2f08a4fa82c820a945bf012d24c760a6b4f514
Reviewed-on: https://chromium-review.googlesource.com/567982Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46585}

0a4ad440

[tests] Fix timezone dependence in an intl test · 8345cd3e

Daniel Ehrenberg authored Jul 12, 2017

In certain timezones, being at noon UTC doesn't guarantee that
you'll be the same day in local time. This patch fixes that
false assumption. Thanks to Holmes He for reporting the issue.

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: I7432c0eb1e13fdf11c665e59dabaebeb79bff8c8
Reviewed-on: https://chromium-review.googlesource.com/568021Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Daniel Ehrenberg <littledan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46584}

8345cd3e

[heap] Replace marking deque with marking worklist. · 5e724050

Ulan Degenbaev authored Jul 11, 2017

Change-Id: Id73c2c3a8b19c3e398d7de760dffe95e0e8b49a4
Reviewed-on: https://chromium-review.googlesource.com/566836Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46583}

5e724050

Reland "[compiler] Move the main pipeline's code assembly pass into the background." · 97f5e1fa

Georg Neis authored Jul 07, 2017

This is a reland of 66b54ab1
Original change's description:
> [compiler] Move the main pipeline's code assembly pass into the background.
> 
> R=bmeurer@chromium.org
> 
> Bug: v8:6048
> Change-Id: I60bc35c02b5460416c3b0e2872fc72ebf9b808a5
> Reviewed-on: https://chromium-review.googlesource.com/563386
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46499}

TBR=bmeurer@chromium.org

Bug: v8:6048
Change-Id: Ifcdd660dd69c6c4c1bc628961f4180a0b6ea4d9f
Reviewed-on: https://chromium-review.googlesource.com/567061Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46582}

97f5e1fa

[assembler] Don't look at max_old_generation_size when growing buffer. · c97c01b2

Georg Neis authored Jul 12, 2017

TF will instantiate the Assembler when we're already on a background
thread, so it's not safe to read out the heap's max_old_generation_size
(it can change). This CL simply removes the use of that value from the
assembler. If the buffer gets too large we will fail when creating the
actual code object.

Bug: v8:6048
Change-Id: Ifb8a64c90222e4516117d237b001779fae060d28
Reviewed-on: https://chromium-review.googlesource.com/567921Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46581}

c97c01b2

[CQ] Temporarily exclude broken bot from CQ · 0d910860

Michael Achenbach authored Jul 12, 2017

TBR=neis@chromium.org

Change-Id: I59903a40c1ca47cce3e5744c51a2abda93e45dad
Reviewed-on: https://chromium-review.googlesource.com/567931Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46580}

0d910860

[arm] Handle 32 and 128 bit FP stack moves. · 2b551661

Pierre Langlois authored Jul 11, 2017

It seems there was a typo which meant we didn't generate any code for 32 and 128
bit slot to slot moves.

Bug: 
Change-Id: Ia6982ec92471d16541d8ee873e1de33e4f46e77a
Reviewed-on: https://chromium-review.googlesource.com/566812Reviewed-by: Bill Budge <bbudge@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Pierre Langlois <pierre.langlois@arm.com>
Cr-Commit-Position: refs/heads/master@{#46579}

2b551661

[heap] Scavenger fixes · b1eecfd5

Michael Lippautz authored Jul 11, 2017

Various Scavenger fixes for smaller issues that accumulated over the
last years.

Bug: chromium:738865
Change-Id: I7573e438eba030944b99c65807944c662526a171
Reviewed-on: https://chromium-review.googlesource.com/567190
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46578}

b1eecfd5

[heap] Worklist: Avoid false sharing for Segment access · f6f86e74

Michael Lippautz authored Jul 11, 2017

Bug: chromium:738865
Change-Id: Iffa80389def41cf03719c01b56f7971612367660
Reviewed-on: https://chromium-review.googlesource.com/567154Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46577}

f6f86e74

[heap] Scavenger: Update counters locally · 5fe5cbf8

Michael Lippautz authored Jul 11, 2017

Bug: chromium:738865
Change-Id: I53f82a459a82057486dcba26696fadebf7befcf7
Reviewed-on: https://chromium-review.googlesource.com/567156Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Commit-Queue: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46576}

5fe5cbf8

[turbofan] Introduce upper limit for table switch size. · 4a4bcda3

Michael Starzinger authored Jul 11, 2017

This introduces 2^16 as an upper limit for the allowed value range of a
table switch on all architectures. It also fixes several overflows in
the table size calculation.

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-736633
BUG=chromium:736633

Change-Id: I931bd226c99eb8a1ae1770c159fc314ff650bf57
Reviewed-on: https://chromium-review.googlesource.com/566829Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46575}

4a4bcda3

[string] Handle two-byte contents in String.p.toLowerCase · 3c260762

jgruber authored Jul 11, 2017

Previously (since f0e95769), this toLowerCase fast-path assumed
it would only see one-byte flat contents. Unfortunately, it's 
possible to have a one-byte sliced string that has a two-byte parent.

This CL ensures that String.p.toLowerCase handles such cases
correctly.

BUG=chromium:736451

Cq-Include-Trybots: master.tryserver.v8:v8_linux_noi18n_rel_ng
Change-Id: Iae056b3db5535bb5665439a5cc8282a51571a548
Reviewed-on: https://chromium-review.googlesource.com/565559Reviewed-by: Yang Guo <yangguo@chromium.org>
Commit-Queue: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46574}

3c260762

[inspector] catch exception during object.toString() call for console · 292e9670

Alexey Kozyatinskiy authored Jul 11, 2017

Console methods should never throw an exception.

R=jgruber@chromium.org

Bug: chromium:736302
Change-Id: I05791b366d46a43b2a78825cbb8a82bb049110e6
Reviewed-on: https://chromium-review.googlesource.com/567434Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46573}

292e9670

Update V8 DEPS. · 3d269890

v8-autoroll authored Jul 12, 2017

Rolling v8/build: https://chromium.googlesource.com/chromium/src/build/+log/6ada47b..7e59b44

Rolling v8/third_party/catapult: https://chromium.googlesource.com/external/github.com/catapult-project/catapult/+log/b708a0d..08d8c9f

TBR=machenbach@chromium.org,hablich@chromium.org

Change-Id: I8dd5b454dae8273252f2b8404db2f25da71ef9c8
Reviewed-on: https://chromium-review.googlesource.com/567707Reviewed-by: v8 autoroll <v8-autoroll@chromium.org>
Commit-Queue: v8 autoroll <v8-autoroll@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46572}

3d269890

[csa] Update CSA_ASSERT in StoreFixedArrayElement to accept PropertyArrays · ee629440

Adam Klein authored Jul 12, 2017

Change-Id: I48adcad748a84dccbd542739f436dccfd6adca1d
Reviewed-on: https://chromium-review.googlesource.com/567725Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46571}

ee629440

Make ArrayList::Elements() static in order to be GC-safe · 5562f6a2

Adam Klein authored Jul 11, 2017

NOTREECHECKS=true

Change-Id: I4ebd05d41d524ac0583b507fcdf7d4c15136d3b8
Reviewed-on: https://chromium-review.googlesource.com/567548Reviewed-by: Sathya Gunasekaran <gsathya@chromium.org>
Commit-Queue: Adam Klein <adamk@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46570}

5562f6a2

11 Jul, 2017 16 commits

[runtime] Introduce PropertyArray · 892d49a6

Sathya Gunasekaran authored Jul 11, 2017

This patch changes the backing store of slow properties to be a
new instance type called PropertyArray.

Currently the only difference between this and a FixedArray is
the map. A future patch will change the length property to store
the hash code.

Bug: v8:5717, v8:6404
Cq-Include-Trybots: master.tryserver.chromium.linux:linux_chromium_rel_ng
Change-Id: Iaebc98f42e6d93c1392772e6f837787beb64afec
Reviewed-on: https://chromium-review.googlesource.com/539028Reviewed-by: Jakob Kummerow <jkummerow@chromium.org>
Reviewed-by: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Reviewed-by: Camillo Bruni <cbruni@chromium.org>
Commit-Queue: Sathya Gunasekaran <gsathya@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46569}

892d49a6

[cleanup] CSA: Use CStringConstant helper · 86a9b4e1

Camillo Bruni authored Jul 11, 2017

Change-Id: Id3989d09f6adfb934842a9b0761d811117d69993
Reviewed-on: https://chromium-review.googlesource.com/567003
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Peter Marshall <petermarshall@chromium.org>
Reviewed-by: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46568}

86a9b4e1

Revert "[inspector] doesn't run user code to stringify console method arg" · c917ecfe

Michael Achenbach authored Jul 11, 2017

This reverts commit 82451d45.

Reason for revert:
https://build.chromium.org/p/client.v8.fyi/builders/V8-Blink%20Linux%2064/builds/16923

Original change's description:
> [inspector] doesn't run user code to stringify console method arg
> 
> Otherwise user code can produce an exception and we will crash.
> 
> R=jakob@chromium.org
> 
> Bug: chromium:736302
> Change-Id: I078150909b0348a63e8c375b508e34fc4751b4ab
> Reviewed-on: https://chromium-review.googlesource.com/565628
> Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
> Reviewed-by: Jakob Gruber <jgruber@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46566}

TBR=kozyatinskiy@chromium.org,jgruber@chromium.org,jakob@chromium.org

Change-Id: I6d7e06fad2ab6c1c894c199fe7b3b6afb2930734
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: chromium:736302
Reviewed-on: https://chromium-review.googlesource.com/567060Reviewed-by: Michael Achenbach <machenbach@chromium.org>
Commit-Queue: Michael Achenbach <machenbach@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46567}

c917ecfe

[inspector] doesn't run user code to stringify console method arg · 82451d45

Alexey Kozyatinskiy authored Jul 11, 2017

Otherwise user code can produce an exception and we will crash.

R=jakob@chromium.org

Bug: chromium:736302
Change-Id: I078150909b0348a63e8c375b508e34fc4751b4ab
Reviewed-on: https://chromium-review.googlesource.com/565628
Commit-Queue: Aleksey Kozyatinskiy <kozyatinskiy@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46566}

82451d45

Revert "Reland "[compiler] Move the main pipeline's code assembly pass into the background."" · 1c25b9a5

Georg Neis authored Jul 11, 2017

This reverts commit 7b080310.

Reason for revert: There's still another issue.

Original change's description:
> Reland "[compiler] Move the main pipeline's code assembly pass into the background."
> 
> This is a reland of 66b54ab1
> Original change's description:
> > [compiler] Move the main pipeline's code assembly pass into the background.
> > 
> > R=bmeurer@chromium.org
> > 
> > Bug: v8:6048
> > Change-Id: I60bc35c02b5460416c3b0e2872fc72ebf9b808a5
> > Reviewed-on: https://chromium-review.googlesource.com/563386
> > Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> > Commit-Queue: Georg Neis <neis@chromium.org>
> > Cr-Commit-Position: refs/heads/master@{#46499}
> 
> TBR=bmeurer@chromium.org
> 
> Bug: v8:6048
> Change-Id: Ic841abc893c96271dc4dec7a0d19ba6a8b39164e
> Reviewed-on: https://chromium-review.googlesource.com/565140
> Reviewed-by: Georg Neis <neis@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46563}

TBR=neis@chromium.org

Change-Id: I07ac9d44324d7cfed72531c7084bc8ba9ddef799
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Bug: v8:6048
Reviewed-on: https://chromium-review.googlesource.com/567059Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46565}

1c25b9a5

[ast] Simplify NewYieldStar. · 949a5d1e

Georg Neis authored Jul 11, 2017

yield* always has an argument.

R=rmcilroy@chromium.org

Bug: 
Change-Id: I5d14c0db05b1e1b873831e0f5a18ec479c1399c9
Reviewed-on: https://chromium-review.googlesource.com/566816Reviewed-by: Ross McIlroy <rmcilroy@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46564}

949a5d1e

Reland "[compiler] Move the main pipeline's code assembly pass into the background." · 7b080310

Georg Neis authored Jul 07, 2017

This is a reland of 66b54ab1
Original change's description:
> [compiler] Move the main pipeline's code assembly pass into the background.
> 
> R=bmeurer@chromium.org
> 
> Bug: v8:6048
> Change-Id: I60bc35c02b5460416c3b0e2872fc72ebf9b808a5
> Reviewed-on: https://chromium-review.googlesource.com/563386
> Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
> Commit-Queue: Georg Neis <neis@chromium.org>
> Cr-Commit-Position: refs/heads/master@{#46499}

TBR=bmeurer@chromium.org

Bug: v8:6048
Change-Id: Ic841abc893c96271dc4dec7a0d19ba6a8b39164e
Reviewed-on: https://chromium-review.googlesource.com/565140Reviewed-by: Georg Neis <neis@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46563}

7b080310

MIPS[64]: Prefer handle.address() over handle.location() in some places. · 4a03a235

Georg Neis authored Jul 11, 2017

Port https://chromium-review.googlesource.com/563658.

R=mvstanton@chromium.org

Bug: v8:6048
Change-Id: Ic3e23d82a039a1bec7b328e79fefb0ea18a3b3f7
Reviewed-on: https://chromium-review.googlesource.com/566837Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46562}

4a03a235

[wasm] [fuzzer] Also test validation · 94d1509e

Clemens Hammacher authored Jul 10, 2017

After compiling a function, check that validation produces the same
success/error result.

R=ahaas@chromium.org

Change-Id: I617881e125dccff485f5572557b19709de488d55
Reviewed-on: https://chromium-review.googlesource.com/565722Reviewed-by: Andreas Haas <ahaas@chromium.org>
Commit-Queue: Clemens Hammacher <clemensh@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46561}

94d1509e

[heap] Fix infinite GC loop in stress incremental marking mode. · 6f48866d

Ulan Degenbaev authored Jul 11, 2017

BUG=chromium:694255

Change-Id: Iaaa7a493bfad8817fba288efd486a5a7e8b0a0fb
Reviewed-on: https://chromium-review.googlesource.com/567005
Commit-Queue: Ulan Degenbaev <ulan@chromium.org>
Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46560}

6f48866d

MIPS[64]: Move TF parts of MacroAssembler into new TurboAssembler. · be35b222

Georg Neis authored Jul 11, 2017

Port https://chromium-review.googlesource.com/559674.

R=bmeurer@chromium.org

Bug: v8:6048
Change-Id: Ia419f174a342d19a8cbd3581b9cad6d24e0fbe19
Reviewed-on: https://chromium-review.googlesource.com/566834Reviewed-by: Michael Stanton <mvstanton@chromium.org>
Commit-Queue: Georg Neis <neis@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46559}

be35b222

Fix bytecode offset · ea535b90

Juliana Franco authored Jul 11, 2017

Change DoComputeInterpretedFrame to print the right bytecode
offset, that is, it does not use header size and object tag.

Bug: 
Change-Id: Ibdd16a9d1178b4c7487164676007c6b9fdb3a33a
Reviewed-on: https://chromium-review.googlesource.com/566859
Commit-Queue: Juliana Patricia Vicente Franco <jupvfranco@google.com>
Reviewed-by: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46558}

ea535b90

[cleanup] CSA: Add ThrowTypeError helper · 2625037d

Camillo Bruni authored Jul 11, 2017

Change-Id: I916696c1a15f1eaea1128b1d147bb3e5f50bca9a
Reviewed-on: https://chromium-review.googlesource.com/567000
Commit-Queue: Camillo Bruni <cbruni@chromium.org>
Reviewed-by: Jakob Gruber <jgruber@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46557}

2625037d

[turbofan] Fix Reflect.getPrototypeOf on primitives. · 933a874e

Michael Starzinger authored Jul 11, 2017

This fixes the lowering of Reflect.getPrototypeOf and friends to not
perform a [[ToObject]] coercion, but bailout instead. We ensure to
exclude primitive values from the lowering. This makes the lowering
uniform between "Reflect.getPrototypeOf" and "Object.getPrototypeOf".

R=bmeurer@chromium.org
TEST=mjsunit/regress/regress-crbug-740116
BUG=chromium:740116

Change-Id: If986ee2a3ae4e8f1fd227bdeb4668f523b0dea84
Reviewed-on: https://chromium-review.googlesource.com/565295Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Commit-Queue: Michael Starzinger <mstarzinger@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46556}

933a874e

[builtins] Optimize {Map,Set}.prototype.size. · 4a5418b5

Benedikt Meurer authored Jul 11, 2017

Add support for fast

  - get Map.prototype.size
  - get Set.prototype.size

by porting both the baseline implementation to the CodeStubAssembler and
inlining a fast-path into TurboFan (when the compiler can infer the fact
that the receiver is a proper JSCollection from the surrounding graph,
i.e. from feedback gathered by a dominating LOAD_IC).

R=yangguo@chromium.org

Bug: v8:5269, v8:5717
Change-Id: Ie003fd2551462591273bcb8487b80808dcc6cd82
Reviewed-on: https://chromium-review.googlesource.com/566438
Commit-Queue: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Benedikt Meurer <bmeurer@chromium.org>
Reviewed-by: Yang Guo <yangguo@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46555}

4a5418b5

[mjsunit] Reenable wasm/gc-frame test in predictable mode. · 88c61f7b

Ben L. Titzer authored Jul 11, 2017

Bug: v8:5803
Change-Id: Ib5a4af363057d217a269b38ef5c54b0399a2aa55
Reviewed-on: https://chromium-review.googlesource.com/566803Reviewed-by: Michael Lippautz <mlippautz@chromium.org>
Commit-Queue: Ben Titzer <titzer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#46554}

88c61f7b