Skip to content

Commit

Permalink
deps: upgrade v8 to 4.1.0.7
Browse files Browse the repository at this point in the history
This commit upgrades V8 from 3.31.74.1 to 4.1.0.7.  Despite the major
version bump, there are no API or ABI changes, it's a bug fix release
only.

PR-URL: #490
Reviewed-By: Colin Ihrig <[email protected]>
Reviewed-By: Fedor Indutny <[email protected]>
Reviewed-By: Kenan Sulayman <[email protected]>
Reviewed-By: Rod Vagg <[email protected]>
  • Loading branch information
bnoordhuis committed Jan 18, 2015
1 parent ea7750b commit 5e7ebc7
Show file tree
Hide file tree
Showing 57 changed files with 962 additions and 386 deletions.
31 changes: 31 additions & 0 deletions deps/v8/ChangeLog
Original file line number Diff line number Diff line change
@@ -1,3 +1,34 @@
2015-01-07: Version 3.32.3

Performance and stability improvements on all platforms.


2015-01-07: Version 3.32.2

Performance and stability improvements on all platforms.


2015-01-07: Version 3.32.1

[turbofan] Don't crash when typing load from a Uint8ClampedArray
(Chromium issue 446156).

[turbofan] Truncation of Bit/Word8/16 to Word32 is a no-op (Chromium
issue 445859).

[x64] Rearrange code for OOB integer loads (Chromium issue 445858).

Fix %NeverOptimizeFunction() intrinsic (Chromium issue 445732).

[turbofan] Fix invalid bounds check with overflowing offset (Chromium
issue 445267).

[turbofan] Raise max virtual registers and call parameter limit (issue
3786).

Performance and stability improvements on all platforms.


2014-12-23: Version 3.31.74

[turbofan] Turn DCHECK for fixed slot index into a CHECK (Chromium issue
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/DEPS
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ deps = {
"v8/testing/gmock":
Var("git_url") + "/external/googlemock.git" + "@" + "29763965ab52f24565299976b936d1265cb6a271", # from svn revision 501
"v8/tools/clang":
Var("git_url") + "/chromium/src/tools/clang.git" + "@" + "90fb65e7a9a5c9d6d9613dfb0e78921c52ca9cfc",
Var("git_url") + "/chromium/src/tools/clang.git" + "@" + "c945be21f6485fa177b43814f910b76cce921653",
}

deps_os = {
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/build/features.gypi
Original file line number Diff line number Diff line change
Expand Up @@ -117,7 +117,7 @@
'Release': {
'variables': {
'v8_enable_extra_checks%': 0,
'v8_enable_handle_zapping%': 1,
'v8_enable_handle_zapping%': 0,
},
'conditions': [
['v8_enable_extra_checks==1', {
Expand Down
1 change: 1 addition & 0 deletions deps/v8/src/api.cc
Original file line number Diff line number Diff line change
Expand Up @@ -1780,6 +1780,7 @@ Local<Script> ScriptCompiler::Compile(Isolate* v8_isolate,
// Do the parsing tasks which need to be done on the main thread. This will
// also handle parse errors.
source->parser->Internalize();
source->parser->HandleSourceURLComments();

i::Handle<i::SharedFunctionInfo> result =
i::Handle<i::SharedFunctionInfo>::null();
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/base/platform/platform-freebsd.cc
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,7 @@ std::vector<OS::SharedLibraryAddress> OS::GetSharedLibraryAddresses() {
if (bytes_read < 8) break;
unsigned end = StringToLong(addr_buffer);
char buffer[MAP_LENGTH];
bytes_read = -1;
int bytes_read = -1;
do {
bytes_read++;
if (bytes_read >= MAP_LENGTH - 1)
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/base/platform/platform-posix.cc
Original file line number Diff line number Diff line change
Expand Up @@ -261,7 +261,7 @@ int OS::GetCurrentThreadId() {
#elif V8_OS_ANDROID
return static_cast<int>(gettid());
#else
return static_cast<int>(reinterpret_cast<intptr_t>(pthread_self()));
return static_cast<int>(pthread_self());
#endif
}

Expand Down
24 changes: 19 additions & 5 deletions deps/v8/src/compiler/control-reducer.cc
Original file line number Diff line number Diff line change
Expand Up @@ -196,6 +196,9 @@ class ControlReducerImpl {
merge = graph()->NewNode(common_->Merge(2), merge, loop);
end->ReplaceInput(0, merge);
to_add = merge;
// Mark the node as visited so that we can revisit later.
EnsureStateSize(merge->id());
state_[merge->id()] = kVisited;
} else {
// Append a new input to the final merge at the end.
merge->AppendInput(graph()->zone(), loop);
Expand Down Expand Up @@ -293,14 +296,17 @@ class ControlReducerImpl {
if (replacement != node) Recurse(replacement);
}

void EnsureStateSize(size_t id) {
if (id >= state_.size()) {
state_.resize((3 * id) / 2, kUnvisited);
}
}

// Push a node onto the stack if its state is {kUnvisited} or {kRevisit}.
bool Recurse(Node* node) {
size_t id = static_cast<size_t>(node->id());
if (id < state_.size()) {
if (state_[id] != kRevisit && state_[id] != kUnvisited) return false;
} else {
state_.resize((3 * id) / 2, kUnvisited);
}
EnsureStateSize(id);
if (state_[id] != kRevisit && state_[id] != kUnvisited) return false;
Push(node);
return true;
}
Expand Down Expand Up @@ -403,6 +409,14 @@ class ControlReducerImpl {
if (n <= 1) return dead(); // No non-control inputs.
if (n == 2) return node->InputAt(0); // Only one non-control input.

// Never remove an effect phi from a (potentially non-terminating) loop.
// Otherwise, we might end up eliminating effect nodes, such as calls,
// before the loop.
if (node->opcode() == IrOpcode::kEffectPhi &&
NodeProperties::GetControlInput(node)->opcode() == IrOpcode::kLoop) {
return node;
}

Node* replacement = NULL;
Node::Inputs inputs = node->inputs();
for (InputIter it = inputs.begin(); n > 1; --n, ++it) {
Expand Down
192 changes: 51 additions & 141 deletions deps/v8/src/compiler/js-typed-lowering.cc
Original file line number Diff line number Diff line change
Expand Up @@ -490,124 +490,34 @@ Reduction JSTypedLowering::ReduceJSStrictEqual(Node* node, bool invert) {
}


Reduction JSTypedLowering::ReduceJSToBooleanInput(Node* input) {
if (input->opcode() == IrOpcode::kJSToBoolean) {
// Recursively try to reduce the input first.
Reduction result = ReduceJSToBoolean(input);
if (result.Changed()) return result;
return Changed(input); // JSToBoolean(JSToBoolean(x)) => JSToBoolean(x)
}
// Check if we have a cached conversion.
Node* conversion = FindConversion<IrOpcode::kJSToBoolean>(input);
if (conversion) return Replace(conversion);
Reduction JSTypedLowering::ReduceJSUnaryNot(Node* node) {
Node* input = node->InputAt(0);
Type* input_type = NodeProperties::GetBounds(input).upper;
if (input_type->Is(Type::Boolean())) {
return Changed(input); // JSToBoolean(x:boolean) => x
}
if (input_type->Is(Type::Undefined())) {
// JSToBoolean(undefined) => #false
return Replace(jsgraph()->FalseConstant());
}
if (input_type->Is(Type::Null())) {
// JSToBoolean(null) => #false
return Replace(jsgraph()->FalseConstant());
}
if (input_type->Is(Type::DetectableReceiver())) {
// JSToBoolean(x:detectable) => #true
return Replace(jsgraph()->TrueConstant());
}
if (input_type->Is(Type::Undetectable())) {
// JSToBoolean(x:undetectable) => #false
return Replace(jsgraph()->FalseConstant());
}
if (input_type->Is(Type::OrderedNumber())) {
// JSToBoolean(x:ordered-number) => BooleanNot(NumberEqual(x, #0))
Node* cmp = graph()->NewNode(simplified()->NumberEqual(), input,
jsgraph()->ZeroConstant());
Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
return Replace(inv);
}
if (input_type->Is(Type::String())) {
// JSToBoolean(x:string) => BooleanNot(NumberEqual(x.length, #0))
FieldAccess access = AccessBuilder::ForStringLength();
Node* length = graph()->NewNode(simplified()->LoadField(access), input,
graph()->start(), graph()->start());
Node* cmp = graph()->NewNode(simplified()->NumberEqual(), length,
jsgraph()->ZeroConstant());
Node* inv = graph()->NewNode(simplified()->BooleanNot(), cmp);
return Replace(inv);
// JSUnaryNot(x:boolean,context) => BooleanNot(x)
node->set_op(simplified()->BooleanNot());
node->TrimInputCount(1);
return Changed(node);
}
return NoChange();
// JSUnaryNot(x,context) => BooleanNot(AnyToBoolean(x))
node->set_op(simplified()->BooleanNot());
node->ReplaceInput(0, graph()->NewNode(simplified()->AnyToBoolean(), input));
node->TrimInputCount(1);
return Changed(node);
}


Reduction JSTypedLowering::ReduceJSToBoolean(Node* node) {
// Try to reduce the input first.
Node* const input = node->InputAt(0);
Reduction reduction = ReduceJSToBooleanInput(input);
if (reduction.Changed()) return reduction;
if (input->opcode() == IrOpcode::kPhi) {
// JSToBoolean(phi(x1,...,xn,control),context)
// => phi(JSToBoolean(x1,no-context),...,JSToBoolean(xn,no-context))
int const input_count = input->InputCount() - 1;
Node* const control = input->InputAt(input_count);
DCHECK_LE(0, input_count);
DCHECK(NodeProperties::IsControl(control));
DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
node->set_op(common()->Phi(kMachAnyTagged, input_count));
for (int i = 0; i < input_count; ++i) {
// We must be very careful not to introduce cycles when pushing
// operations into phis. It is safe for {value}, since it appears
// as input to the phi that we are replacing, but it's not safe
// to simply reuse the context of the {node}. However, ToBoolean()
// does not require a context anyways, so it's safe to discard it
// here and pass the dummy context.
Node* const value = ConvertToBoolean(input->InputAt(i));
if (i < node->InputCount()) {
node->ReplaceInput(i, value);
} else {
node->AppendInput(graph()->zone(), value);
}
}
if (input_count < node->InputCount()) {
node->ReplaceInput(input_count, control);
} else {
node->AppendInput(graph()->zone(), control);
}
node->TrimInputCount(input_count + 1);
return Changed(node);
}
if (input->opcode() == IrOpcode::kSelect) {
// JSToBoolean(select(c,x1,x2),context)
// => select(c,JSToBoolean(x1,no-context),...,JSToBoolean(x2,no-context))
int const input_count = input->InputCount();
BranchHint const input_hint = SelectParametersOf(input->op()).hint();
DCHECK_EQ(3, input_count);
DCHECK(NodeProperties::GetBounds(node).upper->Is(Type::Boolean()));
DCHECK(!NodeProperties::GetBounds(input).upper->Is(Type::Boolean()));
node->set_op(common()->Select(kMachAnyTagged, input_hint));
node->InsertInput(graph()->zone(), 0, input->InputAt(0));
for (int i = 1; i < input_count; ++i) {
// We must be very careful not to introduce cycles when pushing
// operations into selects. It is safe for {value}, since it appears
// as input to the select that we are replacing, but it's not safe
// to simply reuse the context of the {node}. However, ToBoolean()
// does not require a context anyways, so it's safe to discard it
// here and pass the dummy context.
Node* const value = ConvertToBoolean(input->InputAt(i));
node->ReplaceInput(i, value);
}
DCHECK_EQ(3, node->InputCount());
return Changed(node);
}
InsertConversion(node);
if (node->InputAt(1) != jsgraph()->NoContextConstant()) {
// JSToBoolean(x,context) => JSToBoolean(x,no-context)
node->ReplaceInput(1, jsgraph()->NoContextConstant());
return Changed(node);
Node* input = node->InputAt(0);
Type* input_type = NodeProperties::GetBounds(input).upper;
if (input_type->Is(Type::Boolean())) {
// JSToBoolean(x:boolean,context) => x
return Replace(input);
}
return NoChange();
// JSToBoolean(x,context) => AnyToBoolean(x)
node->set_op(simplified()->AnyToBoolean());
node->TrimInputCount(1);
return Changed(node);
}


Expand Down Expand Up @@ -927,14 +837,36 @@ Reduction JSTypedLowering::ReduceJSStoreContext(Node* node) {

Reduction JSTypedLowering::Reduce(Node* node) {
// Check if the output type is a singleton. In that case we already know the
// result value and can simply replace the node unless there are effects.
// result value and can simply replace the node if it's eliminable.
if (NodeProperties::IsTyped(node) &&
NodeProperties::GetBounds(node).upper->IsConstant() &&
!IrOpcode::IsLeafOpcode(node->opcode()) &&
node->op()->EffectOutputCount() == 0) {
return ReplaceEagerly(node, jsgraph()->Constant(
NodeProperties::GetBounds(node).upper->AsConstant()->Value()));
// TODO(neis): Extend this to Range(x,x), NaN, MinusZero, ...?
node->op()->HasProperty(Operator::kEliminatable)) {
Type* upper = NodeProperties::GetBounds(node).upper;
if (upper->IsConstant()) {
Node* replacement = jsgraph()->Constant(upper->AsConstant()->Value());
NodeProperties::ReplaceWithValue(node, replacement);
return Changed(replacement);
} else if (upper->Is(Type::MinusZero())) {
Node* replacement = jsgraph()->Constant(factory()->minus_zero_value());
NodeProperties::ReplaceWithValue(node, replacement);
return Changed(replacement);
} else if (upper->Is(Type::NaN())) {
Node* replacement = jsgraph()->NaNConstant();
NodeProperties::ReplaceWithValue(node, replacement);
return Changed(replacement);
} else if (upper->Is(Type::Null())) {
Node* replacement = jsgraph()->NullConstant();
NodeProperties::ReplaceWithValue(node, replacement);
return Changed(replacement);
} else if (upper->Is(Type::PlainNumber()) && upper->Min() == upper->Max()) {
Node* replacement = jsgraph()->Constant(upper->Min());
NodeProperties::ReplaceWithValue(node, replacement);
return Changed(replacement);
} else if (upper->Is(Type::Undefined())) {
Node* replacement = jsgraph()->UndefinedConstant();
NodeProperties::ReplaceWithValue(node, replacement);
return Changed(replacement);
}
}
switch (node->opcode()) {
case IrOpcode::kJSEqual:
Expand Down Expand Up @@ -972,18 +904,8 @@ Reduction JSTypedLowering::Reduce(Node* node) {
return ReduceNumberBinop(node, simplified()->NumberDivide());
case IrOpcode::kJSModulus:
return ReduceNumberBinop(node, simplified()->NumberModulus());
case IrOpcode::kJSUnaryNot: {
Reduction result = ReduceJSToBooleanInput(node->InputAt(0));
if (result.Changed()) {
// JSUnaryNot(x:boolean) => BooleanNot(x)
node = result.replacement();
} else {
// JSUnaryNot(x) => BooleanNot(JSToBoolean(x))
node->set_op(javascript()->ToBoolean());
}
Node* value = graph()->NewNode(simplified()->BooleanNot(), node);
return Replace(value);
}
case IrOpcode::kJSUnaryNot:
return ReduceJSUnaryNot(node);
case IrOpcode::kJSToBoolean:
return ReduceJSToBoolean(node);
case IrOpcode::kJSToNumber:
Expand All @@ -1005,17 +927,6 @@ Reduction JSTypedLowering::Reduce(Node* node) {
}


Node* JSTypedLowering::ConvertToBoolean(Node* input) {
// Avoid inserting too many eager ToBoolean() operations.
Reduction const reduction = ReduceJSToBooleanInput(input);
if (reduction.Changed()) return reduction.replacement();
Node* const conversion = graph()->NewNode(javascript()->ToBoolean(), input,
jsgraph()->NoContextConstant());
InsertConversion(conversion);
return conversion;
}


Node* JSTypedLowering::ConvertToNumber(Node* input) {
DCHECK(NodeProperties::GetBounds(input).upper->Is(Type::PlainPrimitive()));
// Avoid inserting too many eager ToNumber() operations.
Expand Down Expand Up @@ -1043,8 +954,7 @@ Node* JSTypedLowering::FindConversion(Node* input) {


void JSTypedLowering::InsertConversion(Node* conversion) {
DCHECK(conversion->opcode() == IrOpcode::kJSToBoolean ||
conversion->opcode() == IrOpcode::kJSToNumber);
DCHECK(conversion->opcode() == IrOpcode::kJSToNumber);
size_t const input_id = conversion->InputAt(0)->id();
if (input_id >= conversions_.size()) {
conversions_.resize(2 * input_id + 1);
Expand Down
3 changes: 1 addition & 2 deletions deps/v8/src/compiler/js-typed-lowering.h
Original file line number Diff line number Diff line change
Expand Up @@ -41,7 +41,7 @@ class JSTypedLowering FINAL : public Reducer {
Reduction ReduceJSStoreContext(Node* node);
Reduction ReduceJSEqual(Node* node, bool invert);
Reduction ReduceJSStrictEqual(Node* node, bool invert);
Reduction ReduceJSToBooleanInput(Node* input);
Reduction ReduceJSUnaryNot(Node* node);
Reduction ReduceJSToBoolean(Node* node);
Reduction ReduceJSToNumberInput(Node* input);
Reduction ReduceJSToNumber(Node* node);
Expand All @@ -52,7 +52,6 @@ class JSTypedLowering FINAL : public Reducer {
Reduction ReduceUI32Shift(Node* node, Signedness left_signedness,
const Operator* shift_op);

Node* ConvertToBoolean(Node* input);
Node* ConvertToNumber(Node* input);
template <IrOpcode::Value>
Node* FindConversion(Node* input);
Expand Down
1 change: 1 addition & 0 deletions deps/v8/src/compiler/opcodes.h
Original file line number Diff line number Diff line change
Expand Up @@ -132,6 +132,7 @@

// Opcodes for VirtuaMachine-level operators.
#define SIMPLIFIED_OP_LIST(V) \
V(AnyToBoolean) \
V(BooleanNot) \
V(BooleanToNumber) \
V(NumberEqual) \
Expand Down
2 changes: 1 addition & 1 deletion deps/v8/src/compiler/pipeline.cc
Original file line number Diff line number Diff line change
Expand Up @@ -441,7 +441,7 @@ struct SimplifiedLoweringPhase {
void Run(PipelineData* data, Zone* temp_zone) {
SourcePositionTable::Scope pos(data->source_positions(),
SourcePosition::Unknown());
SimplifiedLowering lowering(data->jsgraph());
SimplifiedLowering lowering(data->jsgraph(), temp_zone);
lowering.LowerAllNodes();
ValueNumberingReducer vn_reducer(temp_zone);
SimplifiedOperatorReducer simple_reducer(data->jsgraph());
Expand Down
Loading

0 comments on commit 5e7ebc7

Please sign in to comment.