From aee316ba83009f72212c2a53d42e4bc1172fb64c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Johan=20Bergstr=C3=B6m?= Date: Sat, 21 Mar 2015 12:31:48 +1100 Subject: [PATCH] deps: upgrade v8 to 4.1.0.25 --- deps/v8/AUTHORS | 1 + deps/v8/PRESUBMIT.py | 4 +- deps/v8/include/v8-version.h | 20 ++++++ deps/v8/include/v8.h | 1 + deps/v8/src/hydrogen-check-elimination.cc | 13 +++- deps/v8/src/hydrogen-instructions.h | 27 +++++--- deps/v8/src/hydrogen.cc | 3 - deps/v8/src/version.cc | 66 +++++-------------- .../v8/test/mjsunit/regress/regress-460917.js | 35 ++++++++++ .../v8/test/mjsunit/regress/regress-467481.js | 22 +++++++ 10 files changed, 126 insertions(+), 66 deletions(-) create mode 100644 deps/v8/include/v8-version.h create mode 100644 deps/v8/test/mjsunit/regress/regress-460917.js create mode 100644 deps/v8/test/mjsunit/regress/regress-467481.js diff --git a/deps/v8/AUTHORS b/deps/v8/AUTHORS index 89caae648c6286..6cda4f239730b0 100644 --- a/deps/v8/AUTHORS +++ b/deps/v8/AUTHORS @@ -45,6 +45,7 @@ Jan de Mooij Jay Freeman James Pike Joel Stanley +Johan Bergström John Jozwiak Jonathan Liu Kun Zhang diff --git a/deps/v8/PRESUBMIT.py b/deps/v8/PRESUBMIT.py index 6d19a4e57408d7..040972e8da2db9 100644 --- a/deps/v8/PRESUBMIT.py +++ b/deps/v8/PRESUBMIT.py @@ -198,8 +198,8 @@ def _CommonChecks(input_api, output_api): def _SkipTreeCheck(input_api, output_api): """Check the env var whether we want to skip tree check. - Only skip if src/version.cc has been updated.""" - src_version = 'src/version.cc' + Only skip if include/v8-version.h has been updated.""" + src_version = 'include/v8-version.h' FilterFile = lambda file: file.LocalPath() == src_version if not input_api.AffectedSourceFiles( lambda file: file.LocalPath() == src_version): diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h new file mode 100644 index 00000000000000..3416edebca979f --- /dev/null +++ b/deps/v8/include/v8-version.h @@ -0,0 +1,20 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +#ifndef V8_INCLUDE_VERSION_H_ // V8_VERSION_H_ conflicts with src/version.h +#define V8_INCLUDE_VERSION_H_ + +// These macros define the version number for the current version. +// NOTE these macros are used by some of the tool scripts and the build +// system so their names cannot be changed without changing the scripts. +#define V8_MAJOR_VERSION 4 +#define V8_MINOR_VERSION 1 +#define V8_BUILD_NUMBER 0 +#define V8_PATCH_LEVEL 25 + +// Use 1 for candidates and 0 otherwise. +// (Boolean macro values are not supported by all preprocessors.) +#define V8_IS_CANDIDATE_VERSION 0 + +#endif // V8_INCLUDE_VERSION_H_ diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h index d35f2fcb27fabe..32730ebc5f1332 100644 --- a/deps/v8/include/v8.h +++ b/deps/v8/include/v8.h @@ -19,6 +19,7 @@ #include #include +#include "v8-version.h" #include "v8config.h" // We reserve the V8_* prefix for macros defined in V8 public API and diff --git a/deps/v8/src/hydrogen-check-elimination.cc b/deps/v8/src/hydrogen-check-elimination.cc index 1530fe1cf5dceb..4bdad06503c5b1 100644 --- a/deps/v8/src/hydrogen-check-elimination.cc +++ b/deps/v8/src/hydrogen-check-elimination.cc @@ -628,14 +628,23 @@ class HCheckTable : public ZoneObject { HValue* object = instr->object()->ActualValue(); HCheckTableEntry* entry = Find(object); // Can only learn more about an object that already has a known set of maps. - if (entry == NULL) return; + if (entry == NULL) { + Kill(object); + return; + } EnsureChecked(entry, object, instr); if (entry->maps_->Contains(instr->original_map())) { // If the object has the original map, it will be transitioned. UniqueSet* maps = entry->maps_->Copy(zone()); maps->Remove(instr->original_map()); maps->Add(instr->transitioned_map(), zone()); - entry->maps_ = maps; + HCheckTableEntry::State state = + (entry->state_ == HCheckTableEntry::CHECKED_STABLE && + instr->map_is_stable()) + ? HCheckTableEntry::CHECKED_STABLE + : HCheckTableEntry::CHECKED; + Kill(object); + Insert(object, NULL, maps, state); } else { // Object does not have the given map, thus the transition is redundant. instr->DeleteAndReplaceWith(object); diff --git a/deps/v8/src/hydrogen-instructions.h b/deps/v8/src/hydrogen-instructions.h index 74f27118141858..c863612cdde4e3 100644 --- a/deps/v8/src/hydrogen-instructions.h +++ b/deps/v8/src/hydrogen-instructions.h @@ -7355,8 +7355,13 @@ class HTransitionElementsKind FINAL : public HTemplateInstruction<2> { HValue* context() const { return OperandAt(1); } Unique original_map() const { return original_map_; } Unique transitioned_map() const { return transitioned_map_; } - ElementsKind from_kind() const { return from_kind_; } - ElementsKind to_kind() const { return to_kind_; } + ElementsKind from_kind() const { + return FromElementsKindField::decode(bit_field_); + } + ElementsKind to_kind() const { + return ToElementsKindField::decode(bit_field_); + } + bool map_is_stable() const { return MapIsStableField::decode(bit_field_); } std::ostream& PrintDataTo(std::ostream& os) const OVERRIDE; // NOLINT @@ -7372,29 +7377,33 @@ class HTransitionElementsKind FINAL : public HTemplateInstruction<2> { int RedefinedOperandIndex() OVERRIDE { return 0; } private: - HTransitionElementsKind(HValue* context, - HValue* object, + HTransitionElementsKind(HValue* context, HValue* object, Handle original_map, Handle transitioned_map) : original_map_(Unique(original_map)), transitioned_map_(Unique(transitioned_map)), - from_kind_(original_map->elements_kind()), - to_kind_(transitioned_map->elements_kind()) { + bit_field_( + FromElementsKindField::encode(original_map->elements_kind()) | + ToElementsKindField::encode(transitioned_map->elements_kind()) | + MapIsStableField::encode(transitioned_map->is_stable())) { SetOperandAt(0, object); SetOperandAt(1, context); SetFlag(kUseGVN); SetChangesFlag(kElementsKind); - if (!IsSimpleMapChangeTransition(from_kind_, to_kind_)) { + if (!IsSimpleMapChangeTransition(from_kind(), to_kind())) { SetChangesFlag(kElementsPointer); SetChangesFlag(kNewSpacePromotion); } set_representation(Representation::Tagged()); } + class FromElementsKindField : public BitField {}; + class ToElementsKindField : public BitField {}; + class MapIsStableField : public BitField {}; + Unique original_map_; Unique transitioned_map_; - ElementsKind from_kind_; - ElementsKind to_kind_; + uint32_t bit_field_; }; diff --git a/deps/v8/src/hydrogen.cc b/deps/v8/src/hydrogen.cc index a6843115bb2710..e8fa84f264de03 100644 --- a/deps/v8/src/hydrogen.cc +++ b/deps/v8/src/hydrogen.cc @@ -6954,9 +6954,6 @@ HInstruction* HOptimizedGraphBuilder::BuildMonomorphicElementAccess( PropertyAccessType access_type, KeyedAccessStoreMode store_mode) { HCheckMaps* checked_object = Add(object, map, dependency); - if (dependency) { - checked_object->ClearDependsOnFlag(kElementsKind); - } if (access_type == STORE && map->prototype()->IsJSObject()) { // monomorphic stores need a prototype chain check because shape diff --git a/deps/v8/src/version.cc b/deps/v8/src/version.cc index edcf2be2db4a86..eaef96d44df8b4 100644 --- a/deps/v8/src/version.cc +++ b/deps/v8/src/version.cc @@ -1,51 +1,17 @@ // Copyright 2012 the V8 project authors. All rights reserved. -// Redistribution and use in source and binary forms, with or without -// modification, are permitted provided that the following conditions are -// met: -// -// * Redistributions of source code must retain the above copyright -// notice, this list of conditions and the following disclaimer. -// * Redistributions in binary form must reproduce the above -// copyright notice, this list of conditions and the following -// disclaimer in the documentation and/or other materials provided -// with the distribution. -// * Neither the name of Google Inc. nor the names of its -// contributors may be used to endorse or promote products derived -// from this software without specific prior written permission. -// -// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS -// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT -// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR -// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT -// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, -// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT -// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, -// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY -// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT -// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE -// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. +#include "include/v8-version.h" #include "src/v8.h" - #include "src/version.h" -// These macros define the version number for the current version. -// NOTE these macros are used by some of the tool scripts and the build -// system so their names cannot be changed without changing the scripts. -#define MAJOR_VERSION 4 -#define MINOR_VERSION 1 -#define BUILD_NUMBER 0 -#define PATCH_LEVEL 21 -// Use 1 for candidates and 0 otherwise. -// (Boolean macro values are not supported by all preprocessors.) -#define IS_CANDIDATE_VERSION 0 - // Define SONAME to have the build system put a specific SONAME into the // shared library instead the generic SONAME generated from the V8 version // number. This define is mainly used by the build system script. #define SONAME "" -#if IS_CANDIDATE_VERSION +#if V8_IS_CANDIDATE_VERSION #define CANDIDATE_STRING " (candidate)" #else #define CANDIDATE_STRING "" @@ -54,24 +20,24 @@ #define SX(x) #x #define S(x) SX(x) -#if PATCH_LEVEL > 0 -#define VERSION_STRING \ - S(MAJOR_VERSION) "." S(MINOR_VERSION) "." S(BUILD_NUMBER) "." \ - S(PATCH_LEVEL) CANDIDATE_STRING +#if V8_PATCH_LEVEL > 0 +#define VERSION_STRING \ + S(V8_MAJOR_VERSION) "." S(V8_MINOR_VERSION) "." S(V8_BUILD_NUMBER) "." S( \ + V8_PATCH_LEVEL) CANDIDATE_STRING #else -#define VERSION_STRING \ - S(MAJOR_VERSION) "." S(MINOR_VERSION) "." S(BUILD_NUMBER) \ - CANDIDATE_STRING +#define VERSION_STRING \ + S(V8_MAJOR_VERSION) "." S(V8_MINOR_VERSION) "." S(V8_BUILD_NUMBER) \ + CANDIDATE_STRING #endif namespace v8 { namespace internal { -int Version::major_ = MAJOR_VERSION; -int Version::minor_ = MINOR_VERSION; -int Version::build_ = BUILD_NUMBER; -int Version::patch_ = PATCH_LEVEL; -bool Version::candidate_ = (IS_CANDIDATE_VERSION != 0); +int Version::major_ = V8_MAJOR_VERSION; +int Version::minor_ = V8_MINOR_VERSION; +int Version::build_ = V8_BUILD_NUMBER; +int Version::patch_ = V8_PATCH_LEVEL; +bool Version::candidate_ = (V8_IS_CANDIDATE_VERSION != 0); const char* Version::soname_ = SONAME; const char* Version::version_string_ = VERSION_STRING; diff --git a/deps/v8/test/mjsunit/regress/regress-460917.js b/deps/v8/test/mjsunit/regress/regress-460917.js new file mode 100644 index 00000000000000..68e1b630882175 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-460917.js @@ -0,0 +1,35 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function boom(a1, a2) { + // Do something with a2 that needs a map check (for DOUBLE_ELEMENTS). + var s = a2[0]; + // Emit a load that transitions a1 to FAST_ELEMENTS. + var t = a1[0]; + // Emit a store to a2 that assumes DOUBLE_ELEMENTS. + // The map check is considered redundant and will be eliminated. + a2[0] = 0.3; +} + +// Prepare type feedback for the "t = a1[0]" load: fast elements. +var fast_elem = new Array(1); +fast_elem[0] = "tagged"; +boom(fast_elem, [1]); + +// Prepare type feedback for the "a2[0] = 0.3" store: double elements. +var double_elem = new Array(1); +double_elem[0] = 0.1; +boom(double_elem, double_elem); + +// Reset |double_elem| and go have a party. +double_elem = new Array(10); +double_elem[0] = 0.1; + +%OptimizeFunctionOnNextCall(boom); +boom(double_elem, double_elem); + +assertEquals(0.3, double_elem[0]); +assertEquals(undefined, double_elem[1]); diff --git a/deps/v8/test/mjsunit/regress/regress-467481.js b/deps/v8/test/mjsunit/regress/regress-467481.js new file mode 100644 index 00000000000000..dcb12d89b0b0c8 --- /dev/null +++ b/deps/v8/test/mjsunit/regress/regress-467481.js @@ -0,0 +1,22 @@ +// Copyright 2015 the V8 project authors. All rights reserved. +// Use of this source code is governed by a BSD-style license that can be +// found in the LICENSE file. + +// Flags: --allow-natives-syntax + +function f(a1, a2) { + var v7 = a2[0]; + var v8 = a1[0]; + a2[0] = 0.3; +} +v6 = new Array(1); +v6[0] = "tagged"; +f(v6, [1]); +v5 = new Array(1); +v5[0] = 0.1; +f(v5, v5); +v5 = new Array(10); +f(v5, v5); +%OptimizeFunctionOnNextCall(f); +f(v5, v5); +v5[0];